3 ms·

And then realize you left all ipv6 traffic open (?)

• nly 13y ago
  Having separate iptables for IPv6 is painful. Are there any means to address this?
  • txutxu 13y ago
    Modern rule generators use to have this in account. Well, maybe you still need to maintain certain definitions separated (as far as I can see on http://www.fwbuilder.org/4.0/docs/users_guide5/working-with-objects.shtml http://www.fwbuilder.org/4.0/docs/users_guide5/working-with-...) But home made scripts and rulesets, may or may don't, depends on implementations.
  • richardwhiuk 13y ago
    Simple. Disable IPv6 - it's probably not worth the tradeoff, and your network provider probably doesn't support it anyway.
    • secure 13y ago
      Worst advice ever :-(. Many ISPs (and hosters) do support IPv6, and it’s worthwhile to learn a bit about it. If you are running an internet-facing server, I’d say it’s part of being a good citizen to support the latest standards. To address the parent question, the firewall rules actually need to be a bit different than for IPv4. As an example, IPv6 makes supporting ICMP (for ping and the like) mandatory. I wrote a post with a simple ip6tables setup about 4 years ago (in German, though, and there might be better posts): http://blogs.noname-ev.de/commandline-tools/archives/74-ip6tables,-grundlegendes-Setup-bei-IPv6.html http://blogs.noname-ev.de/commandline-tools/archives/74-ip6t...