ipv4 and ipv6 tables

ipv4 and ipv6 tables

[Aleksandar Milivojevic]

Ok, if I have good old ipv4 packet, or good new ipv6 packet they will go 
through respective chains in respective tables (either for ipv4 or 
ipv6).  But how about ipv6-in-ipv4 packets?  How is this handled when 
packet is forwarded (especially by ipv6 enabled host)?  How does the 
packet traverse tables and chains once it reach destination and is 
unwrapped from its ipv4 wrapper (does it go through both ipv4 and ipv6 
tables and chains)?  Any other special cases to watch for to prevent 
packets that should be blocked to go through ipv6 back door?

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7

Re: ipv4 and ipv6 tables

[Alistair Tonner]

On August 27, 2004 06:08 pm, Aleksandar Milivojevic wrote:
> Ok, if I have good old ipv4 packet, or good new ipv6 packet they will go
> through respective chains in respective tables (either for ipv4 or
> ipv6).  But how about ipv6-in-ipv4 packets?  How is this handled when
> packet is forwarded (especially by ipv6 enabled host)?  How does the
> packet traverse tables and chains once it reach destination and is
> unwrapped from its ipv4 wrapper (does it go through both ipv4 and ipv6
> tables and chains)?  Any other special cases to watch for to prevent
> packets that should be blocked to go through ipv6 back door?

	When the IPV6 packet is wrapped up in IPV4 it becomes an
	ipv4 protocol 41 packet.

	You need to allow protocol 41 through the ipv4 rules to let the ipv6-in-ipv4 
stuff through.

	in my case 

	iptables -I INPUT 3 -p 41 -s {ipaddress of tunnel server} -d {my external 
ipv4 address} -j ACCEPT
	iptables -I OUTPUT 7 -p 41 -s {my external ipv4 address} -d {ipaddress of 
tunnel server} -j ACCEPT

	you would likely want the rules in different locations in INPUT and OUTPUT 


	Alistair Tonner
	
	(after bouncing head on desk for days trying to get mine working, I'll make 
yer life a little easier)