* Re: Newbie: IPv6 equivalent of 192.168.178.0/24
2020-10-09 13:16 ` Bernd Naumann
@ 2020-10-09 13:20 ` Bernd Naumann
2020-10-10 12:52 ` paul.guijt
1 sibling, 0 replies; 5+ messages in thread
From: Bernd Naumann @ 2020-10-09 13:20 UTC (permalink / raw)
To: netfilter
On 09.10.20 15:16, Bernd Naumann wrote:
> On 09.10.20 14:49, paul.guijt@gmail.com wrote:
>> I had
>> add rule inet filter input ip saddr 192.168.178.0/24
>> jump LocalIN
>> add rule inet filter input ip6 saddr
>> fe::/10 jump LocalIN
>> to divert all packets coming from my private network to rules in the
>> LocalIN chain.
>>
>> Nftables converts the second line into “ip6 saddr c0::/10 jump
>> LocalIN”. FE into C0.
>> Will that do what I intended? If not, what rule do you prefer?
>>
>> Regards,
>> Paul Guijt
>>
>>
>
> Hi Paul,
>
> From
> https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
>
>
> > fc00::/7 Unique-Local
> > fe80::/10 Link-Local Unicast
>
> I assume you want both in your case. ULA (unique local addr) and
> link-local.
> Or, if you do not want to allow the whole ULA space, maybe just i.e. a
> `/48`, like i.e. openwrt generates for you automatically.
> A use case to not accept the whole fc00::/10 would be if you are
> connected to i.e. dn42, or another community VPNs, which makes use of ULA.
>
Sorry double-post.
Sorry... double-post.
I wanted to say:
A use case to not accept the whole **fc00::/7** would be if you are
connected to i.e. dn42, or another community VPNs, which makes use of ULA.
^ permalink raw reply [flat|nested] 5+ messages in thread
* RE: Newbie: IPv6 equivalent of 192.168.178.0/24
2020-10-09 13:16 ` Bernd Naumann
2020-10-09 13:20 ` Bernd Naumann
@ 2020-10-10 12:52 ` paul.guijt
1 sibling, 0 replies; 5+ messages in thread
From: paul.guijt @ 2020-10-10 12:52 UTC (permalink / raw)
To: netfilter
Thanks for the link!
In this I'm a newbie, though.
I have a network at home behind a DSL router, and want to jump to LocalIN with any packet that comes from my home network. I know the first line does that with IPv4 packets, but I want to do it with IPv6 packets too.
I realized my problem with your answer was my not understanding the terms ' Unique-Local' and ' Link-Local Unicast'. With the help of https://en.wikipedia.org/wiki/Unique_local_address I now understand that I should use fc00::/7 instead of fe::/10 (what faulty for fe00::/10), and similarly re the Link-Local Unicast.
I have now
ip saddr 192.168.178.0/24 jump LocalIN
ip6 saddr { fc00::/7, fe80::/10} jump LocalIN
And trust that this set of rules does the trick. Thanks, Florian and Bernd!
Regards,
Paul
-----Original Message-----
From: Bernd Naumann <bena@spreadshirt.net>
Sent: Friday, October 9, 2020 3:17 PM
To: netfilter@vger.kernel.org
Subject: Re: Newbie: IPv6 equivalent of 192.168.178.0/24
On 09.10.20 14:49, paul.guijt@gmail.com wrote:
> I had
> add rule inet filter input ip saddr 192.168.178.0/24 jump LocalIN
> add rule inet filter input ip6 saddr fe::/10 jump LocalIN
> to divert all packets coming from my private network to rules in the LocalIN chain.
>
> Nftables converts the second line into “ip6 saddr c0::/10 jump LocalIN”. FE into C0.
> Will that do what I intended? If not, what rule do you prefer?
>
> Regards,
> Paul Guijt
>
>
Hi Paul,
From
https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
> fc00::/7 Unique-Local
> fe80::/10 Link-Local Unicast
I assume you want both in your case. ULA (unique local addr) and link-local.
Or, if you do not want to allow the whole ULA space, maybe just i.e. a `/48`, like i.e. openwrt generates for you automatically.
A use case to not accept the whole fc00::/10 would be if you are connected to i.e. dn42, or another community VPNs, which makes use of ULA.
Best,
Bernd
^ permalink raw reply [flat|nested] 5+ messages in thread