3 ms·
> Are there any guides for how to properly secure a home network so that I can re-enable IPv6 with a clear conscience? ip6tables -P FORWARD REJECT ip6t
by q3k 7y ago
> Are there any guides for how to properly secure a home network so that I can re-enable IPv6 with a clear conscience?
ip6tables -P FORWARD REJECT
ip6tables -F FORWARD
ip6tables -A FORWARD -o wan -s 2a42:.../64 -j ACCEPT
ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
Literally the same as for IPv4.
- Wheaties466 7y agoWhy do I get the feeling that some home routers won't NAT or have the established/related rule by default for ipv6.
- q3k 7y agoI don't know. I've never misconfigured/insecure v6 CPEs in Europe. But if you're bringing your own device, all bets are off of course. This makes sense, considering ISPs might not want to deal with a ton of pwned devices that are now part of botnets.
- porjo 7y agoYou should also enable ICMP (or at least some of it) - see http://shouldiblockicmp.com/ http://shouldiblockicmp.com/ for explanation on why this is important for IPv6 ip6tables -A FORWARD -p icmpv6 -j ACCEPT