From: Kalin KOZHUHAROV <kalin@thinrope.net>
To: linux-kernel@vger.kernel.org
Subject: Re: Trivial IPv6-for-Fedora HOWTO
Date: Mon, 23 Aug 2004 14:25:32 +0900 [thread overview]
Message-ID: <cgbv4e$pd6$1@sea.gmane.org> (raw)
In-Reply-To: <E1Bz1ya-0006Vi-00@calista.eckenfels.6bone.ka-ip.net>
Bernd Eckenfels wrote:
> In article <4129236E.9020205@pobox.com> you wrote:
>
>>If you have an iptables ipv4 firewall, you'll want to
>>
>>F1) allow ipv6 tunnelled packets to pass through to ip6tables, by
>>allowing protocol 41
>>
>>iptables -A block -p 41 -j ACCEPT
>>("block" is a custom chain on my firewall)
>>
>>F2) duplicate your ipv4 firewall rules for ipv6, using ip6tables. Some
>>things, like masquerade, are not applicable to ipv6.
>
>
> Note that you have to terminate the tunnel on your firewall in order to
> filter the encapsulated ipv6. This is important, since letting tunnel
> packets pass your firewall is a major security problem, otherwise.
And what exactly does this mean?
"terminate the tunnel on your firewall" ???
Would you enlighten me (and the list) how do you do that with ip{,6}tables?
Kalin.
--
|| ~~~~~~~~~~~~~~~~~~~~~~ ||
( ) http://ThinRope.net/ ( )
|| ______________________ ||
next prev parent reply other threads:[~2004-08-23 5:25 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-08-22 22:51 Trivial IPv6-for-Fedora HOWTO Jeff Garzik
2004-08-22 23:08 ` Paul Fraser
2004-08-22 23:06 ` Alan Cox
2004-08-22 23:22 ` Jeff Garzik
2004-08-22 23:24 ` Tomasz Torcz
2004-08-22 23:42 ` Bernd Eckenfels
2004-08-23 5:25 ` Kalin KOZHUHAROV [this message]
2004-08-23 9:07 ` Bernd Eckenfels
2004-08-23 8:50 ` Frank Matthieß
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='cgbv4e$pd6$1@sea.gmane.org' \
--to=kalin@thinrope.net \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.