0

How do I configure ufw to only allow outgoing/established connections for a IPv6 network?

I am using an old computer with 12.04 installed to create an IPv6 router for my local network. I would like it to act as a firewall as well.

I have a tunnel setup and working with Hurricane Electric and the computer is successfully routing traffic to and from the IPv6 Internet.

I have followed the instructions given at https://wiki.ubuntu.com/IPv6#Configure_your_Ubuntu_box_as_a_IPv6_router under the “ufw and Routing” section.

Unfortunately, when I enable ufw, all connectivity is lost.

I'm also not sure what is meant by

If you only want outgoing connections you also need to change DEFAULT_FORWARD_POLICY="DROP"

Does that mean change it to equal “DROP” or change it to equal something else?

iptables -l http://ubuntuone.com/0fu17qZ5h3XQp3KP0hQmnf

after.rules http://ubuntuone.com/2Pc1rzOgIDiDcGSeJ4spmO

after6.rules http://ubuntuone.com/7ZOeXanT8oinUwu72DKeSz

before.rules http://ubuntuone.com/520w8EHgyUkDR4tr5rQ3hr

before6.rules http://ubuntuone.com/5qeoz9EQAesCquMJbItV2a

sysctl.conf http://ubuntuone.com/2In6k6Abs07LEwe6gC1PgG

ufw.conf http://ubuntuone.com/4P6RIQqM3zaQ6PbV30AD6T

user.rules http://ubuntuone.com/3s9vS1oz9sxgOXlxYJD0Da

user6.rules http://ubuntuone.com/545d5g1G8W2lDe6x5XACzX

Improve this question
3

1 Answer 1

Reset to default
1

You need to add rules so that the tunnel traffic is accepted on your external interface. You already allow outbound traffic by default, but because the input default policy is to drop you lose all your tunnel traffic.

Try something like this in user.rules:

-A ufw-user-input -p 41 -s <remote tunnel endpoint> -d <your IP address> -j ACCEPT

This rule allows protocol-41 (also called 6in4) packets from to . Protocol-41 is the protocol used for HE (and many other) tunnels. If you don't include this rule then the firewall will drop (default action) these packets, and you will never receive anything over the tunnel.

Improve this answer
9
  • here is my edited user.rules ubuntuone.com/462PMbBCY5RY8e5iX18plo
    – Corey
    Apr 8, 2013 at 13:38
  • does that look right to you? would you mind explaining in your answer what each part of that line does?
    – Corey
    Apr 8, 2013 at 13:39
  • Looks right if w, x, y and z match your tunnel setup :-)
    – Sander Steffann
    Apr 8, 2013 at 13:51
  • So now I can enable the firewall with "ufw enable", and I can ping out to the v6 Internet. However, when I use the IPv6 Portscan feature in the tunnelbroker.net portal and scan the v6 address of an internal Windows box, I get the following. ubuntuone.com/1fqRSsvGlq3cAGD0bIpGcA
    – Corey
    Apr 8, 2013 at 14:29
  • I would like to firewall any access from the outside unless it’s a response to an internal request. Is my understanding flawed somewhere?
    – Corey
    Apr 8, 2013 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.