Hey everybody,
I keep running into a wall on when turning on ip6tables. I'm using my Linux box as a network firewall to connect to the IPv4 Internet as well as the IPv6 Internet. On the IPv4 Internet, I'm using iptables to do NAT and stateful filtering. For IPv6, I'm connecting to tunnelbroker via pptp, then pushing my IPv6 routes through the pptp tunnel. That all works perfectly, but when I turn on ip6tables, the stateful filters don't get built for some reason when traffic passes through the firewall.
Here is what my ip6tables look like:
[root@darkstar ~]# ip6tables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all anywhere anywhere
DROP all anywhere anywhere rt type:0
Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all anywhere anywhere
ACCEPT all anywhere anywhere
DROP all anywhere anywhere rt type:0
ACCEPT ipv6-icmp anywhere anywhere
ACCEPT esp anywhere anywhere
ACCEPT ah anywhere anywhere
ACCEPT all anywhere anywhere state NEW
ACCEPT all anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp anywhere anywhere state NEW tcp dpt:ssh
REJECT all anywhere anywhere reject-with icmp6-port-unreachable
And here is a tcpdump of traffic going through my ipv6 tunnel. The first eight lines are a icmp6 ping to ipv6.google.com, which is successful. The remaining lines are me trying to telnet to TCP port 80 to ipv6.google.com. As you can see, My initial outbound packet is successful, and I get an acknowledgment from Google. After that, the stateful stream appears to close and I start getting the default reject code from ip6tables as google tries to send me more data to my source port that had already been opened. Any ideas?
[root@darkstar ~]# tcpdump -i sixbone -vv
tcpdump: WARNING: sixbone: no IPv4 address assigned
tcpdump: listening on sixbone, link-type RAW (Raw IP), capture size 96 bytes
10:51:55.727005 IP6 (hlim 127, next-header: ICMPv6 (58), length: 40) 2001:470:####::2 > gy-in-x68.1e100.net: [icmp6 sum ok] ICMP6, echo request, length 40, seq 1033
10:51:55.829533 IP6 (class 0x80, hlim 56, next-header: ICMPv6 (58), length: 40) gy-in-x68.1e100.net > 2001:470:####::2: [icmp6 sum ok] ICMP6, echo reply, length 40, seq 1033
10:51:56.727815 IP6 (hlim 127, next-header: ICMPv6 (58), length: 40) 2001:470:####::2 > gy-in-x68.1e100.net: [icmp6 sum ok] ICMP6, echo request, length 40, seq 1034
10:51:56.806925 IP6 (class 0x80, hlim 56, next-header: ICMPv6 (58), length: 40) gy-in-x68.1e100.net > 2001:470:####::2: [icmp6 sum ok] ICMP6, echo reply, length 40, seq 1034
10:51:57.728841 IP6 (hlim 127, next-header: ICMPv6 (58), length: 40) 2001:470:####::2 > gy-in-x68.1e100.net: [icmp6 sum ok] ICMP6, echo request, length 40, seq 1035
10:51:57.817087 IP6 (class 0x80, hlim 56, next-header: ICMPv6 (58), length: 40) gy-in-x68.1e100.net > 2001:470:####::2: [icmp6 sum ok] ICMP6, echo reply, length 40, seq 1035
10:51:58.730858 IP6 (hlim 127, next-header: ICMPv6 (58), length: 40) 2001:470:####::2 > gy-in-x68.1e100.net: [icmp6 sum ok] ICMP6, echo request, length 40, seq 1036
10:51:58.819369 IP6 (class 0x80, hlim 56, next-header: ICMPv6 (58), length: 40) gy-in-x68.1e100.net > 2001:470:####::2: [icmp6 sum ok] ICMP6, echo reply, length 40, seq 1036
10:52:04.159429 IP6 (hlim 63, next-header: TCP (6), length: 32) 2001:470:####::2.50972 > gy-in-x68.1e100.net.http: S, cksum 0x4483 (correct), 2882457998:2882457998(0) win 8192 <mss 1440,nop,wscale 8,nop,nop,sackOK>
10:52:04.239276 IP6 (class 0x80, hlim 56, next-header: TCP (6), length: 32) gy-in-x68.1e100.net.http > 2001:470:####::2.50972: S, cksum 0x45c1 (correct), 3383770784:3383770784(0) ack 2882457999 win 5760 <mss 1410,nop,nop,sackOK,nop,wscale 6>
10:52:04.239335 IP6 (hlim 64, next-header: ICMPv6 (58), length: 80) #######-1-pt.tunnel.tserv8.dal1.ipv6.he.net > gy-in-x68.1e100.net: ICMP6, destination unreachable, length 80, unreachable port, 2001:470:####::2 tcp port 50972
10:52:07.169028 IP6 (hlim 63, next-header: TCP (6), length: 32) 2001:470:####::2.50972 > gy-in-x68.1e100.net.http: S, cksum 0x4483 (correct), 2882457998:2882457998(0) win 8192 <mss 1440,nop,wscale 8,nop,nop,sackOK>
10:52:07.238546 IP6 (class 0x80, hlim 56, next-header: TCP (6), length: 32) gy-in-x68.1e100.net.http > 2001:470:####::2.50972: S, cksum 0x45c1 (correct), 3383770784:3383770784(0) ack 2882457999 win 5760 <mss 1410,nop,nop,sackOK,nop,wscale 6>
10:52:07.238600 IP6 (hlim 64, next-header: ICMPv6 (58), length: 80) #######-1-pt.tunnel.tserv8.dal1.ipv6.he.net > gy-in-x68.1e100.net: ICMP6, destination unreachable, length 80, unreachable port, 2001:470:####::2 tcp port 50972
10:52:07.254015 IP6 (class 0x80, hlim 56, next-header: TCP (6), length: 32) gy-in-x68.1e100.net.http > 2001:470:####::2.50972: S, cksum 0x45c1 (correct), 3383770784:3383770784(0) ack 2882457999 win 5760 <mss 1410,nop,nop,sackOK,nop,wscale 6>
10:52:07.254051 IP6 (hlim 64, next-header: ICMPv6 (58), length: 80) #######-1-pt.tunnel.tserv8.dal1.ipv6.he.net > gy-in-x68.1e100.net: ICMP6, destination unreachable, length 80, unreachable port, 2001:470:####::2 tcp port 50972
10:52:13.180050 IP6 (hlim 63, next-header: TCP (6), length: 28) 2001:470:####::2.50972 > gy-in-x68.1e100.net.http: S, cksum 0x5892 (correct), 2882457998:2882457998(0) win 8192 <mss 1440,nop,nop,sackOK>
10:52:13.258592 IP6 (class 0x80, hlim 56, next-header: TCP (6), length: 32) gy-in-x68.1e100.net.http > 2001:470:####::2.50972: S, cksum 0x45c1 (correct), 3383770784:3383770784(0) ack 2882457999 win 5760 <mss 1410,nop,nop,sackOK,nop,wscale 6>
10:52:13.258648 IP6 (hlim 64, next-header: ICMPv6 (58), length: 80) #######-1-pt.tunnel.tserv8.dal1.ipv6.he.net > gy-in-x68.1e100.net: ICMP6, destination unreachable, length 80, unreachable port, 2001:470:####::2 tcp port 50972
10:52:13.259738 IP6 (class 0x80, hlim 56, next-header: TCP (6), length: 32) gy-in-x68.1e100.net.http > 2001:470:####::2.50972: S, cksum 0x45c1 (correct), 3383770784:3383770784(0) ack 2882457999 win 5760 <mss 1410,nop,nop,sackOK,nop,wscale 6>
10:52:13.259776 IP6 (hlim 64, next-header: ICMPv6 (58), length: 80) #######-1-pt.tunnel.tserv8.dal1.ipv6.he.net > gy-in-x68.1e100.net: ICMP6, destination unreachable, length 80, unreachable port, 2001:470:####::2 tcp port 50972
10:52:23.256642 IP6 (class 0x80, hlim 56, next-header: TCP (6), length: 32) gy-in-x68.1e100.net.http > 2001:470:####::2.50972: S, cksum 0x45c1 (correct), 3383770784:3383770784(0) ack 2882457999 win 5760 <mss 1410,nop,nop,sackOK,nop,wscale 6>
10:52:23.256712 IP6 (hlim 64, next-header: ICMPv6 (58), length: 80) #######-1-pt.tunnel.tserv8.dal1.ipv6.he.net > gy-in-x68.1e100.net: ICMP6, destination unreachable, length 80, unreachable port, 2001:470:####::2 tcp port 50972
10:52:33.257584 IP6 (class 0x80, hlim 56, next-header: TCP (6), length: 32) gy-in-x68.1e100.net.http > 2001:470:####::2.50972: S, cksum 0x45c1 (correct), 3383770784:3383770784(0) ack 2882457999 win 5760 <mss 1410,nop,nop,sackOK,nop,wscale 6>
10:52:33.257662 IP6 (hlim 64, next-header: ICMPv6 (58), length: 80) #######-1-pt.tunnel.tserv8.dal1.ipv6.he.net > gy-in-x68.1e100.net: ICMP6, destination unreachable, length 80, unreachable port, 2001:470:####::2 tcp port 50972
10:52:43.276180 IP6 (class 0x80, hlim 56, next-header: TCP (6), length: 32) gy-in-x68.1e100.net.http > 2001:470:####::2.50972: S, cksum 0x45c1 (correct), 3383770784:3383770784(0) ack 2882457999 win 5760 <mss 1410,nop,nop,sackOK,nop,wscale 6>
10:52:43.276252 IP6 (hlim 64, next-header: ICMPv6 (58), length: 80) #######-1-pt.tunnel.tserv8.dal1.ipv6.he.net > gy-in-x68.1e100.net: ICMP6, destination unreachable, length 80, unreachable port, 2001:470:####::2 tcp port 50972