1

Im using ubuntu 18.04 and successfully setup nginx and uwsgi to host multiple websites.

I have an AAAA record mapped to an IPV6 address through my DNS provider, and I have my nginx config file listening on ports 80 and 443 for that IPV6 address.

This setup is working just fine.

However, I would like to restrict IPV6 traffic to ports 80 and 443 to ONLY a few specific IP addresses.

When I list the current ip6table rules using ip6tables -S, there is a line towards the bottom like this.

-A ufw6-user-input -p tcp -m multiport --dports 80,443 -m comment --comment "\'dapp_Nginx%20Full\'" -j ACCEPT

I am new to iptables in general but from all the reading and tutorials I have done it sounds like:

  1. You need to make sure rules are in the correct order.
  2. You want to save the rules to a file before making changes in case you screw something up.
  3. After you have your rules the way you want them you want to use something like the persistent flag so the rules persist in event of reboot.

My question is what rules would i need to have to achieve the stated goal above, and in what order, and will this only apply to ipv6 traffic on the 80/443 ports?

foo@example:~# sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp (OpenSSH)           ALLOW IN    Anywhere
80,443/tcp (Nginx Full)    ALLOW IN    Anywhere
22/tcp (OpenSSH (v6))      ALLOW IN    Anywhere (v6)
80,443/tcp (Nginx Full (v6)) ALLOW IN    Anywhere (v6)
  • 1
    ufw6-user-input is a UFW rule table. Are you using ufw on this system? If so the 'allow' rules get entered via UFW, not via direct iptables manipulation. – Thomas Ward Apr 15 at 22:55
  • @ThomasWard Hi Thomas, yes ufw is enabled, and I am sure this rule was autogenerated made obvious by the comment in the rule. However, my understanding is that ufw is just a wrapper around iptables. So I should be able to override anything ufw inserted and/or extend ufw limitations by directly inserting rules using ip6tables commands? I am still am looking for a way to achieve the above regardless of the method I have to use. Thanks for responding! – guht Apr 15 at 23:01
  • If you are using ufw set everything through UFW because any manual changes you make are going to be overridden eventually by ufw if it resets or refreshes the ruleset. – Thomas Ward Apr 15 at 23:02
  • I'm confused though, what's the ruleset already in use on here? Default deny outbound or allow outbound? – Thomas Ward Apr 15 at 23:13
  • @ThomasWard I updated my post to show ufw status. I am confused too, because the ufw rules listed when I use ufw command show very little, but if I type iptables -S it shows a ton of entries. I realize its the "Uncomplicated Firewall", but obviously its doing a lot of stuff behind the scenes in terms of what its actually putting in the iptable rules. – guht Apr 15 at 23:20
0

You are already using ufw. So set the rules with ufw.

For IPv4 Allow In to 80,443, try:

ufw allow proto tcp from 0.0.0.0/0 to port 80,443

For IPv6 we need to use a few more rules:

ufw allow proto tcp from IPV6ADDRESS/128 to port 80,443
# Do the above more than once for more than one IPv6 address
ufw deny proto tcp from ::0/0 to port 80,443

Based on the manpage for ufw, this would achieve what you want - allow IPv4 to TCP ports 80 and 443, allow IPV6ADDRESS to TCP ports 80 and 443, and disallow all other IPv6 addresses from reaching TCP ports 80 and 443.

Note that you can't access IPv6 addresses without IPv6 connectivity, so if you don't have IPv6 access on the boxes in question (that're IPv4) you can't really access the v6 address easily.


Note that we ultimately decomplexified this XY Problem via Chat and narrowed down their goals for access control to a specific website/subdomain, and as they were using NGINX as the backend, I provided them the details on how to implement access controls per-site.

  • I should have specified that the addresses I want to allow to visit MY IPV6 address are IPv4 addresses. For eg, I want to allow a PUT response from one of googles APIs, and I know that the response is going to come from a particular set IPv4 addresses. Is that possible? I am sure my lack of fully understanding the concepts at play here are aiding my confusion, but I feel like what I am asking should be possible. When I externally ping my foo.example.com it returns my IPv6 address. Additionally is there anything I can do to preserve my existing rules so I do dont hose something messing around? – guht Apr 16 at 0:00
  • Google's APIs come from a huge range of IPs, ther'es no way to really account for them all unless they provide documentation of what IPs – Thomas Ward Apr 16 at 0:09
  • @guht Also, v4 can't visit v6. It's not possible. You need v6 to visit v6 addresses :P – Thomas Ward Apr 16 at 0:09
  • That was just an example the particular API I am working with has a set list of IPv4 addresses it provides. – guht Apr 16 at 0:10
  • @guht v4 -> v6 doesn't work usually, it's not in the same 'IP Family' so you can't really get to v6 addresses from solely v4 connected systems. And not every ISP is capable of routing v4 to v6 when there's no other IP(s) available. From the prespective of your firewall that is also not possible to permit/reject – Thomas Ward Apr 16 at 0:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.