Now that you’ve gotten IPv6 configured on your home network, forget about relying on NAT to be your “firewall”. All your devices now have a globally routed IP (v6) address, so it’s time to get familiar with a setting up a “real” firewall.<\/p>\n
Since my IPv6 router is a linux box that is also other things (server, wireless access point, etc) I can’t set up a nice dedicated firewall like pfsense<\/a> (currently IPv6 is enabled on the beta versions) without spending more money and quite a bit more work. So I’ll work with what I have – ip6tables<\/a><\/p>\n Here’s a simple set of ip6tables rules I’ve come up with. You’ll want to tweak these for your specific site. Mine are called from \/etc\/rc.local #Define Policy # Input to the router #Allow unrestricted access on internal network #Allow unrestricted outgoing connections # Forwarding through from the internal network #Allow unrestricted outgoing connections # allow SSH in # allow remote desktop in # Drop everything else #allow everything to our router\/server. # Drop everything else In a few places, I only allow packets from 2000::\/3. Currently this encompasses all of the global IPv6 addresses, so I could have easily used 0\/0 (equivalent to ::\/0 or “anywhere”) but I’m okay with being a little more specific here. In fact, for some of them (like ssh and remote desktop) I should be even more specific, but this is a start.<\/p>\n Ensure you can test your rules before leaving them on. I had some rules ordered incorrectly (I tried adding some rules after the “Drop everything else” rule for the chain) and broke www to ipcalypse.ca for a while. (oops!). To verify www, dns and smtp on my server, I used http:\/\/go6.se\/check\/<\/a> to test these rules.<\/p>\n","protected":false},"excerpt":{"rendered":" Now that you’ve gotten IPv6 configured on your home network, forget about relying on NAT to be your “firewall”. All your devices now have a globally routed IP (v6) address, so it’s time to get familiar with a setting up a “real” firewall. Since my IPv6 router is a linux box that is also other […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,40,7],"tags":[],"class_list":["post-130","post","type-post","status-publish","format-standard","hentry","category-ipcalypse","category-ipv6","category-ubuntu"],"_links":{"self":[{"href":"https:\/\/www.ipcalypse.ca\/index.php?rest_route=\/wp\/v2\/posts\/130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ipcalypse.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ipcalypse.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ipcalypse.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ipcalypse.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=130"}],"version-history":[{"count":8,"href":"https:\/\/www.ipcalypse.ca\/index.php?rest_route=\/wp\/v2\/posts\/130\/revisions"}],"predecessor-version":[{"id":139,"href":"https:\/\/www.ipcalypse.ca\/index.php?rest_route=\/wp\/v2\/posts\/130\/revisions\/139"}],"wp:attachment":[{"href":"https:\/\/www.ipcalypse.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ipcalypse.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ipcalypse.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
\n# IPv6 firewall (ipv6tables)
\nWAN_IF=he-ipv6
\nLAN_IF=eth0
\nWLAN_IF=wlan0
\n#flush tables
\nip6tables -F<\/p>\n
\nip6tables -P INPUT DROP
\nip6tables -P FORWARD DROP
\nip6tables -P OUTPUT ACCEPT<\/p>\n
\n# Allow all loopback traffic
\nip6tables -A INPUT -i lo -s 0\/0 -d 0\/0 -j ACCEPT<\/p>\n
\nip6tables -A INPUT -i $LAN_IF -j ACCEPT
\nip6tables -A INPUT -i $WLAN_IF -j ACCEPT<\/p>\n
\nip6tables -A INPUT -i $WAN_IF -m state --state RELATED,ESTABLISHED -j ACCEPT<\/p>\n
\n# For now allow unrestricted access out from the internal network
\nip6tables -A FORWARD -i $LAN_IF -j ACCEPT
\nip6tables -A FORWARD -i $WLAN_IF -j ACCEPT<\/p>\n
\nip6tables -A FORWARD -i $WAN_IF -m state --state RELATED,ESTABLISHED -j ACCEPT<\/p>\n
\nip6tables -A FORWARD -s 2000::\/3 -i $WAN_IF -p tcp -m tcp --dport 22 -j ACCEPT<\/p>\n
\nip6tables -A FORWARD -s 2000::\/3 -i $WAN_IF -p tcp -m tcp --dport 3389 -j ACCEPT<\/p>\n
\nip6tables -A FORWARD -i $WAN_IF -j DROP<\/p>\n
\nip6tables -A INPUT -s 0\/0 -d 2001:470:81e5::1\/128 -j ACCEPT<\/p>\n
\nip6tables -A INPUT -i $WAN_IF -j DROP
\n<\/code><\/p>\n