3 ms·
Having separate iptables for IPv6 is painful. Are there any means to address this?
by nly 13y ago
Having separate iptables for IPv6 is painful. Are there any means to address this?
- txutxu 13y agoModern rule generators use to have this in account. Well, maybe you still need to maintain certain definitions separated (as far as I can see on http://www.fwbuilder.org/4.0/docs/users_guide5/working-with-objects.shtml http://www.fwbuilder.org/4.0/docs/users_guide5/working-with-...) But home made scripts and rulesets, may or may don't, depends on implementations.
- richardwhiuk 13y agoSimple. Disable IPv6 - it's probably not worth the tradeoff, and your network provider probably doesn't support it anyway.
- secure 13y agoWorst advice ever :-(. Many ISPs (and hosters) do support IPv6, and it’s worthwhile to learn a bit about it. If you are running an internet-facing server, I’d say it’s part of being a good citizen to support the latest standards. To address the parent question, the firewall rules actually need to be a bit different than for IPv4. As an example, IPv6 makes supporting ICMP (for ping and the like) mandatory. I wrote a post with a simple ip6tables setup about 4 years ago (in German, though, and there might be better posts): http://blogs.noname-ev.de/commandline-tools/archives/74-ip6tables,-grundlegendes-Setup-bei-IPv6.html http://blogs.noname-ev.de/commandline-tools/archives/74-ip6t...