Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm in the process of rebuilding my IBF (invisible bridging firewall) as Ubuntu 10.04.2 LTS. In the past I have dealt with ipv6 by way of disabling it entirely. This time around I want to leave it enabled and filter it with ip6tables, etc.

All my config seems fine, except I cannot seem to discover a working method for getting the 'fe80' addresses off of my bridge-interface-cards. It might be understandable for br0 to get such an address, but under no circumstances would I want anything speaking on any layer higher than '2' directly to eth0 or eth1.

Things I have tried thus far include:

1) Specifying 'inet6 manual' entries in 'interfaces'

2) Specifying 'inet6 static' and 'address ::'

3) sysctl.conf '0' for various inet6 settings found via Google

4) 'post-up echo 0 >' as above

Nothing seems to work. If I run a 'ip -6 addr del' command, I can get it to go away, but that (as you likely know) doesn't last and it doesn't survive a reboot.

What I want is the equivalent to ipv4's '' addressing - a non-functional, yet not unconfigured address.


share|improve this question
Out of curiosity, does the ip6tables and bridge still carry IPv6 traffic when you do the 'ip -6 addr del' command? – Azendale May 26 '11 at 21:48
That's an excellent question. I haven't tested it yet. I'd assume, though, that even if it didn't that my testing window would be pretty short. It takes only a small number of minutes for that address to return. – mcbobbo May 26 '11 at 22:05
Also aren't you getting the fe80 addresses on the individual interfaces too? (Like eth0 and eth1)? – Azendale May 27 '11 at 0:43
Yes, I'm getting them on eth0 and eth1. br0 is getting eth0's address, by default. – mcbobbo May 27 '11 at 13:49
up vote 0 down vote accepted

I'm not sure what you are setting in sysctl.conf, but the settings in it should automatically be applied when you restart. You should be able to apply them right away with something like sudo sysctl -p If you are having trouble with it not applying, you may need to specify the interface like this: net.ipv6.conf.eth0.<something> = 0 instead of net.ipv6.conf.all.<something> = 0.

From what I understand, if you have IPv6 on you will have a link local address (but I could be wrong).

share|improve this answer
Yeah, it's that later part that I'm trying to work around. Or at a minimum, if I absolutely must have an address, I'd like it to not work. – mcbobbo May 26 '11 at 22:03
@mcbobbo Ok, I found this:… Sounds like it's part of the IPv6 standard to have a link local address if IPv6 is enabled. – Azendale May 26 '11 at 23:43
I see. Thank you for the link. Further proof that ipv6 is an insipid, anti-user protocol, don't you think? – mcbobbo May 27 '11 at 13:55

I'm not totally sure if this will work, but what if you do something like this:
sudo ip6tables -A OUTPUT -t filter -s fe80::8dbd:b9ff:fedb:8db8 -j DROP
sudo ip6tables -A INPUT -t filter -d fe80::8dbd:b9ff:fedb:8db8 -j DROP
More strict, but if it works, all the better according to your philosophy:
sudo ip6tables -A OUTPUT -t filter -s ::/0 -j DROP
sudo ip6tables -A INPUT -t filter -d ::/0 -j DROP

This should silently drop anything whose final destination is the bridge without sending any 'your message was rejected's, and should drop any traffic from your Bridge generated by the OS.

share|improve this answer
Initially, at least, I do intend to set ip6tables '-P DROP' and '-J DROP'. But that's only going to work when netfilter is running and configured. It is passable security, but not very good in my opinion. – mcbobbo May 27 '11 at 13:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.