4 ms·
Another gotcha is that ipv4 and ipv6 has different firewall tables. So if you for example have blocked all traffic besides port 80, you also need to do it on ip
by z3t4 8y ago
Another gotcha is that ipv4 and ipv6 has different firewall tables. So if you for example have blocked all traffic besides port 80, you also need to do it on ipv6 !
- clan 8y agoThat does depend on the firewall you use. Using the "pf" firewall you can have nice clean rules which covers both. Simple example: tcp_inbound = "{ ssh, domain, http, https }" tcp_outbound = "{ domain, http, https, imaps, smtps }" udp_services = "{ domain, ntp }" block all pass proto udp to any port $udp_services keep state pass out proto tcp to any port $tcp_outbound keep state pass in proto tcp to any port $tcp_inbound keep state
- yrro 8y agopfft, who is still using iptables? :) FYI, nftables has the 'inet' table which processes both IPv4 and IPv6 packets, and 'ip' and 'ip6' which processes each respectively.
- z3t4 8y agoiptables' are easy to configure and available almost everywhere.
- floatboth 8y agoeasy to configure?? iptables is the most infamously difficult firewall to configure. Ubuntu created the ufw "uncomplicated firewall" wrapper for a reason :D
- romeisendcoming 8y agoAnd your an authority on this? I find PF much more difficult to deal with and I like having two clean interfaces to v4 and v6 in iptables....rather than some overeager tool set that thinks it knows what I mean when I create a rule and the tool then (willy-nilly) applies it across both stacks.
- dan1234 8y agoI’m curious to know what you find so difficult about iptables? It has always seemed reasonably straightforward to me, although I will concede that not being able to combine tcp & udp into the same rule is a bit annoying (though also rarely needed).
- z3t4 8y agoI think it's similar to CSS... I however have a sense that IPv6 is much different so we might get better and easier tools for future IP versions once IPv4 is gone, I however don't expect that to happen during my lifetime :/
- josteink 8y agoThat should be obvious as sunlight though, if you know anything at all about IPv6 networking.
- TorKlingberg 8y agoFor someone who is just doing port blocking it's less obvious. The port numbers are the same on v4 and v6.