Stateful filtering for IPv6?

Stateful filtering for IPv6?

[Nicolas Boullis]

Hi,

I thought this question would be a FAQ, but I could not find it answered 
on http://www.netfilter.org/documentation/FAQ/netfilter-faq.html.
Currently, only stateless filtering is available for IPv6. Hence, I'd 
like to know what the status of stateful filtering for IPv6 is. Is it 
some work in progress? Is it supposed to be a very complex task? Is it 
thought to be impossible for some reason?

I'd love to switch to IPv6, but a good firewall would be a requirement, 
and I'm very happy with netfilter for IPv4.


Thanks,

Nicolas

Re: Stateful filtering for IPv6?

[Kenneth Porter]

--On Monday, November 08, 2004 2:42 AM +0100 Nicolas Boullis 
<nboullis@debian.org> wrote:

> I thought this question would be a FAQ, but I could not find it answered
> on http://www.netfilter.org/documentation/FAQ/netfilter-faq.html.
> Currently, only stateless filtering is available for IPv6. Hence, I'd
> like to know what the status of stateful filtering for IPv6 is. Is it
> some work in progress? Is it supposed to be a very complex task? Is it
> thought to be impossible for some reason?
>
> I'd love to switch to IPv6, but a good firewall would be a requirement,
> and I'm very happy with netfilter for IPv4.

I was just looking into this the other day. Actually, I was investigating 
why the IPv6 REJECT target is considered "unstable" by Red Hat and found 
sort of an answer in the same place, but this section should answer your 
question:

<http://www.netfilter.org/documentation/conferences/nf-workshop-2004-summary.html#AEN482>