From: Jonathan Tripathy <jonnyt@abpni.co.uk>
To: Guido Winkelmann <guido-nf@thisisnotatest.de>
Cc: netfilter@vger.kernel.org
Subject: Re: IPv6 filtering
Date: Wed, 02 Feb 2011 09:35:28 +0000 [thread overview]
Message-ID: <4D492560.1070609@abpni.co.uk> (raw)
In-Reply-To: <201102020000.58388.guido-nf@thisisnotatest.de>
On 01/02/11 23:00, Guido Winkelmann wrote:
> On Tuesday 01 February 2011 22:38:49 you wrote:
>> With IPv6, does anyone have any experience on how to do this? I know we
>> can use ip6tables, but isn't there some trickery with NDP (Which
>> replaces ARP)?
> There shouldn't be, just as long as you only filter on the source address of
> outgoing packets, and not on the destination of incoming ones. The NDP request
> packets go to weird multicast addresses that depend on the address being
> requested. I haven't totally figured out the scheme yet (haven't really
> tried).
I really do need to filter by both the source and destination IP
addresses. Amongst other things, I want to make sure that packets
destined for another VPS never arrive at the wrong VPS. This can happen
when the Linux bridge is "re-learning" the MAC Address mappings.
It is wise to allow *all icmpv6* traffic destined for the multicast
address to the destined VPS?
> Answer packets for NDP always have a valid IPv6 address from the answering
> host as their source address. Also, they're IPv6 packets like any other and
> not a separate protocol as with ARP+IPv4.
Yes, however there is nothing currently like arptables for IPv6 that I
know of. Even though the NDP answers may have a correct source IP,
surely the payload could provide wrong (i.e. malicious) data...
> Note that hosts using IPv6 will usually have at least two autoconfigured
> addresses, and it's sometimes hard to predict which one will be used as source
> address for outgoing packets, especially if the number of configured addresses
> grows. You must not block any of those.
I'm willing to give up the auto-config features of IPv6. We can just
manually put the address in the respective config file. It's no big deal
really.
> Also see my message from yesterday on that subject, please. I'm having
> problems with filtering IPv6 from VPSes as well, and if you find a solution
> that works with large numbers of vpses, I would appreciate it if you could
> share it.
>
> Guido
next prev parent reply other threads:[~2011-02-02 9:35 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-02-01 21:38 IPv6 filtering Jonathan Tripathy
2011-02-01 23:00 ` Guido Winkelmann
2011-02-02 4:11 ` Jan Engelhardt
2011-02-02 13:30 ` Guido Winkelmann
2011-02-02 13:46 ` Jan Engelhardt
2011-02-02 9:35 ` Jonathan Tripathy [this message]
2011-02-02 9:51 ` Jozsef Kadlecsik
2011-02-02 13:05 ` Guido Winkelmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4D492560.1070609@abpni.co.uk \
--to=jonnyt@abpni.co.uk \
--cc=guido-nf@thisisnotatest.de \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.