* IPv6: unknown packet logged ... @ 2017-08-22 14:42 Walter H. 2017-08-22 14:47 ` Mark Coetser 0 siblings, 1 reply; 8+ messages in thread From: Walter H. @ 2017-08-22 14:42 UTC (permalink / raw) To: netfilter Hello, I have these rules at the beginning of /etc/sysconfig/ip6tables # Filter all packets with state INVALID -A INPUT -m state --state INVALID -j DROP -A FORWARD -m state --state INVALID -j DROP -A OUTPUT -m state --state INVALID -j DROP and on bottom these rules: # Log all other -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7 -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7 which rule would have catched these logged packets: [70223.386265] IPv6[FWD]: IN=sit1 OUT=br0 SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0 HOPLIMIT=60 FLOWLBL=617912 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 RES=0x00 ACK PSH URGP=0 [70232.150311] IPv6[FWD]: IN=sit1 OUT=br0 SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0 HOPLIMIT=60 FLOWLBL=949795 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 RES=0x00 ACK PSH URGP=0 [70249.740932] IPv6[FWD]: IN=sit1 OUT=br0 SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0 HOPLIMIT=60 FLOWLBL=811062 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 RES=0x00 ACK PSH URGP=0 Thanks, Walter ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: IPv6: unknown packet logged ... 2017-08-22 14:42 IPv6: unknown packet logged Walter H. @ 2017-08-22 14:47 ` Mark Coetser 2017-08-22 14:59 ` Walter H. 0 siblings, 1 reply; 8+ messages in thread From: Mark Coetser @ 2017-08-22 14:47 UTC (permalink / raw) To: Walter H., netfilter On 22/08/2017 16:42, Walter H. wrote: > Hello, > > I have these rules at the beginning of /etc/sysconfig/ip6tables > > # Filter all packets with state INVALID > -A INPUT -m state --state INVALID -j DROP > -A FORWARD -m state --state INVALID -j DROP > -A OUTPUT -m state --state INVALID -j DROP > > and on bottom these rules: > > # Log all other > -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7 > -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 > -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7 > > which rule would have catched these logged packets: > > [70223.386265] IPv6[FWD]: IN=sit1 OUT=br0 > SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0 > HOPLIMIT=60 FLOWLBL=617912 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 > RES=0x00 ACK PSH URGP=0 > [70232.150311] IPv6[FWD]: IN=sit1 OUT=br0 > SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0 > HOPLIMIT=60 FLOWLBL=949795 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 > RES=0x00 ACK PSH URGP=0 > [70249.740932] IPv6[FWD]: IN=sit1 OUT=br0 > SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0 > HOPLIMIT=60 FLOWLBL=811062 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 > RES=0x00 ACK PSH URGP=0 those logged packets are from packets traversing your filter FORWARD chain obviously no rule is matching which is why its triggering the last rule which is -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: IPv6: unknown packet logged ... 2017-08-22 14:47 ` Mark Coetser @ 2017-08-22 14:59 ` Walter H. 2017-08-22 15:08 ` Mark Coetser 0 siblings, 1 reply; 8+ messages in thread From: Walter H. @ 2017-08-22 14:59 UTC (permalink / raw) To: Mark Coetser; +Cc: Walter H., netfilter On Tue, August 22, 2017 16:47, Mark Coetser wrote: > On 22/08/2017 16:42, Walter H. wrote: >> Hello, >> >> I have these rules at the beginning of /etc/sysconfig/ip6tables >> >> # Filter all packets with state INVALID >> -A INPUT -m state --state INVALID -j DROP >> -A FORWARD -m state --state INVALID -j DROP >> -A OUTPUT -m state --state INVALID -j DROP >> >> and on bottom these rules: >> >> # Log all other >> -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7 >> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 >> -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7 >> >> which rule would have catched these logged packets: >> >> [70223.386265] IPv6[FWD]: IN=sit1 OUT=br0 >> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0 >> HOPLIMIT=60 FLOWLBL=617912 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >> RES=0x00 ACK PSH URGP=0 >> [70232.150311] IPv6[FWD]: IN=sit1 OUT=br0 >> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0 >> HOPLIMIT=60 FLOWLBL=949795 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >> RES=0x00 ACK PSH URGP=0 >> [70249.740932] IPv6[FWD]: IN=sit1 OUT=br0 >> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0 >> HOPLIMIT=60 FLOWLBL=811062 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >> RES=0x00 ACK PSH URGP=0 > > those logged packets are from packets traversing your filter FORWARD > chain obviously no rule is matching which is why its triggering the last > rule which is > > -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 > of course, and which rule would I have to add bevor this rule, so that these are not logged ...? ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: IPv6: unknown packet logged ... 2017-08-22 14:59 ` Walter H. @ 2017-08-22 15:08 ` Mark Coetser 2017-08-22 15:36 ` Walter H. 0 siblings, 1 reply; 8+ messages in thread From: Mark Coetser @ 2017-08-22 15:08 UTC (permalink / raw) To: Walter H.; +Cc: netfilter On 22/08/2017 16:59, Walter H. wrote: > On Tue, August 22, 2017 16:47, Mark Coetser wrote: >> On 22/08/2017 16:42, Walter H. wrote: >>> Hello, >>> >>> I have these rules at the beginning of /etc/sysconfig/ip6tables >>> >>> # Filter all packets with state INVALID >>> -A INPUT -m state --state INVALID -j DROP >>> -A FORWARD -m state --state INVALID -j DROP >>> -A OUTPUT -m state --state INVALID -j DROP >>> >>> and on bottom these rules: >>> >>> # Log all other >>> -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7 >>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 >>> -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7 >>> >>> which rule would have catched these logged packets: >>> >>> [70223.386265] IPv6[FWD]: IN=sit1 OUT=br0 >>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0 >>> HOPLIMIT=60 FLOWLBL=617912 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >>> RES=0x00 ACK PSH URGP=0 >>> [70232.150311] IPv6[FWD]: IN=sit1 OUT=br0 >>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0 >>> HOPLIMIT=60 FLOWLBL=949795 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >>> RES=0x00 ACK PSH URGP=0 >>> [70249.740932] IPv6[FWD]: IN=sit1 OUT=br0 >>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0 >>> HOPLIMIT=60 FLOWLBL=811062 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >>> RES=0x00 ACK PSH URGP=0 >> >> those logged packets are from packets traversing your filter FORWARD >> chain obviously no rule is matching which is why its triggering the last >> rule which is >> >> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 >> > of course, and which rule would I have to add bevor this rule, so that > these are not logged ...? It depends on what you want to allow, if you want to allow all traffic between interface sit1 and br0 -I FORWARD -i sit1 -o br0 -j ACCEPT although the logged packets above show the source port being tcp/443 which means this connection came in br0 and out sit1 so you are probably missing an established/related rule. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: IPv6: unknown packet logged ... 2017-08-22 15:08 ` Mark Coetser @ 2017-08-22 15:36 ` Walter H. 2017-08-22 15:40 ` Mark Coetser 0 siblings, 1 reply; 8+ messages in thread From: Walter H. @ 2017-08-22 15:36 UTC (permalink / raw) To: Mark Coetser; +Cc: netfilter [-- Attachment #1: Type: text/plain, Size: 2576 bytes --] On 22.08.2017 17:08, Mark Coetser wrote: > On 22/08/2017 16:59, Walter H. wrote: >> On Tue, August 22, 2017 16:47, Mark Coetser wrote: >>> On 22/08/2017 16:42, Walter H. wrote: >>>> Hello, >>>> >>>> I have these rules at the beginning of /etc/sysconfig/ip6tables >>>> >>>> # Filter all packets with state INVALID >>>> -A INPUT -m state --state INVALID -j DROP >>>> -A FORWARD -m state --state INVALID -j DROP >>>> -A OUTPUT -m state --state INVALID -j DROP >>>> >>>> and on bottom these rules: >>>> >>>> # Log all other >>>> -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7 >>>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 >>>> -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7 >>>> >>>> which rule would have catched these logged packets: >>>> >>>> [70223.386265] IPv6[FWD]: IN=sit1 OUT=br0 >>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 >>>> TC=0 >>>> HOPLIMIT=60 FLOWLBL=617912 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >>>> RES=0x00 ACK PSH URGP=0 >>>> [70232.150311] IPv6[FWD]: IN=sit1 OUT=br0 >>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 >>>> TC=0 >>>> HOPLIMIT=60 FLOWLBL=949795 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >>>> RES=0x00 ACK PSH URGP=0 >>>> [70249.740932] IPv6[FWD]: IN=sit1 OUT=br0 >>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 >>>> TC=0 >>>> HOPLIMIT=60 FLOWLBL=811062 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >>>> RES=0x00 ACK PSH URGP=0 >>> >>> those logged packets are from packets traversing your filter FORWARD >>> chain obviously no rule is matching which is why its triggering the >>> last >>> rule which is >>> >>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 >>> >> of course, and which rule would I have to add bevor this rule, so that >> these are not logged ...? > > It depends on what you want to allow, if you want to allow all traffic > between interface sit1 and br0 > > -I FORWARD -i sit1 -o br0 -j ACCEPT > > although the logged packets above show the source port being tcp/443 > which means this connection came in br0 and out sit1 so you are > probably missing an established/related rule. this rules are after dropping invalid and before logging # Enable forwarding to IPv6-Tunnel interface -A FORWARD -i br0 -o sit1 -j ACCEPT # Enable established, related packets back through -I FORWARD -i sit1 -o br0 -m state --state ESTABLISHED,RELATED -j ACCEPT so I have the problem, that I cannot really know, why these packets were logged ... [-- Attachment #2: S/MIME Cryptographic Signature --] [-- Type: application/pkcs7-signature, Size: 3491 bytes --] ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: IPv6: unknown packet logged ... 2017-08-22 15:36 ` Walter H. @ 2017-08-22 15:40 ` Mark Coetser 2017-08-22 15:52 ` Walter H. 0 siblings, 1 reply; 8+ messages in thread From: Mark Coetser @ 2017-08-22 15:40 UTC (permalink / raw) To: Walter H.; +Cc: netfilter On 22/08/2017 17:36, Walter H. wrote: > On 22.08.2017 17:08, Mark Coetser wrote: >> On 22/08/2017 16:59, Walter H. wrote: >>> On Tue, August 22, 2017 16:47, Mark Coetser wrote: >>>> On 22/08/2017 16:42, Walter H. wrote: >>>>> Hello, >>>>> >>>>> I have these rules at the beginning of /etc/sysconfig/ip6tables >>>>> >>>>> # Filter all packets with state INVALID >>>>> -A INPUT -m state --state INVALID -j DROP >>>>> -A FORWARD -m state --state INVALID -j DROP >>>>> -A OUTPUT -m state --state INVALID -j DROP >>>>> >>>>> and on bottom these rules: >>>>> >>>>> # Log all other >>>>> -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7 >>>>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 >>>>> -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7 >>>>> >>>>> which rule would have catched these logged packets: >>>>> >>>>> [70223.386265] IPv6[FWD]: IN=sit1 OUT=br0 >>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 >>>>> TC=0 >>>>> HOPLIMIT=60 FLOWLBL=617912 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >>>>> RES=0x00 ACK PSH URGP=0 >>>>> [70232.150311] IPv6[FWD]: IN=sit1 OUT=br0 >>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 >>>>> TC=0 >>>>> HOPLIMIT=60 FLOWLBL=949795 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >>>>> RES=0x00 ACK PSH URGP=0 >>>>> [70249.740932] IPv6[FWD]: IN=sit1 OUT=br0 >>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 >>>>> TC=0 >>>>> HOPLIMIT=60 FLOWLBL=811062 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >>>>> RES=0x00 ACK PSH URGP=0 >>>> >>>> those logged packets are from packets traversing your filter FORWARD >>>> chain obviously no rule is matching which is why its triggering the >>>> last >>>> rule which is >>>> >>>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 >>>> >>> of course, and which rule would I have to add bevor this rule, so that >>> these are not logged ...? >> >> It depends on what you want to allow, if you want to allow all traffic >> between interface sit1 and br0 >> >> -I FORWARD -i sit1 -o br0 -j ACCEPT >> >> although the logged packets above show the source port being tcp/443 >> which means this connection came in br0 and out sit1 so you are >> probably missing an established/related rule. > this rules are after dropping invalid and before logging > > # Enable forwarding to IPv6-Tunnel interface > -A FORWARD -i br0 -o sit1 -j ACCEPT > # Enable established, related packets back through > -I FORWARD -i sit1 -o br0 -m state --state ESTABLISHED,RELATED -j ACCEPT > > so I have the problem, that I cannot really know, why these packets were > logged ... > > without seeing your whole ruleset its pretty hard to tell or at least see your filter forward rules as for the estabalished/related rule you dont have to specify the input/output interfaces ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: IPv6: unknown packet logged ... 2017-08-22 15:40 ` Mark Coetser @ 2017-08-22 15:52 ` Walter H. 2017-08-22 16:03 ` Mark Coetser 0 siblings, 1 reply; 8+ messages in thread From: Walter H. @ 2017-08-22 15:52 UTC (permalink / raw) To: Mark Coetser; +Cc: netfilter [-- Attachment #1: Type: text/plain, Size: 5813 bytes --] On 22.08.2017 17:40, Mark Coetser wrote: > > On 22/08/2017 17:36, Walter H. wrote: >> On 22.08.2017 17:08, Mark Coetser wrote: >>> On 22/08/2017 16:59, Walter H. wrote: >>>> On Tue, August 22, 2017 16:47, Mark Coetser wrote: >>>>> On 22/08/2017 16:42, Walter H. wrote: >>>>>> Hello, >>>>>> >>>>>> I have these rules at the beginning of /etc/sysconfig/ip6tables >>>>>> >>>>>> # Filter all packets with state INVALID >>>>>> -A INPUT -m state --state INVALID -j DROP >>>>>> -A FORWARD -m state --state INVALID -j DROP >>>>>> -A OUTPUT -m state --state INVALID -j DROP >>>>>> >>>>>> and on bottom these rules: >>>>>> >>>>>> # Log all other >>>>>> -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7 >>>>>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 >>>>>> -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7 >>>>>> >>>>>> which rule would have catched these logged packets: >>>>>> >>>>>> [70223.386265] IPv6[FWD]: IN=sit1 OUT=br0 >>>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr >>>>>> LEN=123 TC=0 >>>>>> HOPLIMIT=60 FLOWLBL=617912 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >>>>>> RES=0x00 ACK PSH URGP=0 >>>>>> [70232.150311] IPv6[FWD]: IN=sit1 OUT=br0 >>>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr >>>>>> LEN=123 TC=0 >>>>>> HOPLIMIT=60 FLOWLBL=949795 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >>>>>> RES=0x00 ACK PSH URGP=0 >>>>>> [70249.740932] IPv6[FWD]: IN=sit1 OUT=br0 >>>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr >>>>>> LEN=123 TC=0 >>>>>> HOPLIMIT=60 FLOWLBL=811062 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171 >>>>>> RES=0x00 ACK PSH URGP=0 >>>>> >>>>> those logged packets are from packets traversing your filter FORWARD >>>>> chain obviously no rule is matching which is why its triggering >>>>> the last >>>>> rule which is >>>>> >>>>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 >>>>> >>>> of course, and which rule would I have to add bevor this rule, so that >>>> these are not logged ...? >>> >>> It depends on what you want to allow, if you want to allow all >>> traffic between interface sit1 and br0 >>> >>> -I FORWARD -i sit1 -o br0 -j ACCEPT >>> >>> although the logged packets above show the source port being tcp/443 >>> which means this connection came in br0 and out sit1 so you are >>> probably missing an established/related rule. >> this rules are after dropping invalid and before logging >> >> # Enable forwarding to IPv6-Tunnel interface >> -A FORWARD -i br0 -o sit1 -j ACCEPT >> # Enable established, related packets back through >> -I FORWARD -i sit1 -o br0 -m state --state ESTABLISHED,RELATED -j ACCEPT >> >> so I have the problem, that I cannot really know, why these packets >> were logged ... >> >> > > without seeing your whole ruleset its pretty hard to tell or at least > see your filter forward rules as for the estabalished/related rule you > dont have to specify the input/output interfaces ip6tables-save results in this: # Generated by ip6tables-save v1.4.7 on Tue Aug 22 17:44:04 2017 *filter :INPUT DROP [0:0] :FORWARD DROP [17:7812] :OUTPUT DROP [0:0] -A INPUT -i sit1 -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -m rt --rt-type 0 -j DROP -A INPUT -m state --state INVALID -j DROP -A INPUT -s fe80::/10 -j ACCEPT -A INPUT -d ff00::/8 -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -i br0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -s myprefix::/64 -d fe80::/10 -i br0 -j ACCEPT -A INPUT -s fe80::/10 -d ff02::1:2/128 -i br0 -p tcp -m tcp -m multiport --dports 546,547 -j ACCEPT -A INPUT -s fe80::/10 -d ff02::1:2/128 -i br0 -p udp -m udp -m multiport --dports 546,547 -j ACCEPT -A INPUT -i br0 -p ipv6-icmp -j ACCEPT -A INPUT -i br0 -p udp -m udp --sport 32769:65535 --dport 33434:33523 -j ACCEPT -A INPUT -i br0 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT -A INPUT -i br0 -p udp -m udp --dport 53 -j ACCEPT -A INPUT -i br0 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT -A INPUT -i br0 -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT -A INPUT -i br0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT -A INPUT -i br0 -p tcp -m tcp --dport 3128 -m state --state NEW -j ACCEPT -A INPUT -i sit1 -p ipv6-icmp -j ACCEPT -A INPUT -i sit1 -p ipv6-icmp -j ACCEPT -A INPUT -i sit1 -p udp -m udp --sport 32769:65535 --dport 33434:33523 -j ACCEPT -A INPUT -i sit1 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT -A INPUT -i br0 -p udp -m udp --dport 5353 -j DROP -A INPUT -i sit1 -p tcp -m tcp --dport 21 -j DROP -A INPUT -i sit1 -p tcp -m tcp --dport 22 -j DROP -A INPUT -i sit1 -p tcp -m tcp --dport 23 -j DROP -A INPUT -i sit1 -p tcp -m tcp --dport 80 -j DROP -A INPUT -i sit1 -p tcp -m tcp --dport 443 -j DROP -A INPUT -i sit1 -p tcp -m tcp --dport 3128 -j DROP -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7 -A FORWARD -i sit1 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -m rt --rt-type 0 -j DROP -A FORWARD -m state --state INVALID -j DROP -A FORWARD -i br0 -o br0 -j ACCEPT -A FORWARD -i br0 -o sit1 -p tcp -m tcp --dport 25 -j LOG --log-prefix "IPv6[FWD-SMTP(out)]: " --log-level 7 -A FORWARD -i br0 -o sit1 -p tcp -m tcp --dport 25 -j DROP -A FORWARD -i br0 -o sit1 -j ACCEPT -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 -A OUTPUT -m rt --rt-type 0 -j DROP -A OUTPUT -m state --state INVALID -j DROP -A OUTPUT -s fe80::/10 -j ACCEPT -A OUTPUT -d ff00::/8 -j ACCEPT -A OUTPUT -o lo -j ACCEPT -A OUTPUT -o br0 -j ACCEPT -A OUTPUT -o sit1 -j ACCEPT -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7 COMMIT # Completed on Tue Aug 22 17:44:04 2017 br0 is LAN port sit1 is HE-tunnel port Thanks, Walter [-- Attachment #2: S/MIME Cryptographic Signature --] [-- Type: application/pkcs7-signature, Size: 3491 bytes --] ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: IPv6: unknown packet logged ... 2017-08-22 15:52 ` Walter H. @ 2017-08-22 16:03 ` Mark Coetser 0 siblings, 0 replies; 8+ messages in thread From: Mark Coetser @ 2017-08-22 16:03 UTC (permalink / raw) To: Walter H.; +Cc: netfilter On 22/08/2017 17:52, Walter H. wrote: > ip6tables-save results in this: > > # Generated by ip6tables-save v1.4.7 on Tue Aug 22 17:44:04 2017 > *filter > :INPUT DROP [0:0] > :FORWARD DROP [17:7812] > :OUTPUT DROP [0:0] > -A INPUT -i sit1 -m state --state RELATED,ESTABLISHED -j ACCEPT > -A INPUT -m rt --rt-type 0 -j DROP > -A INPUT -m state --state INVALID -j DROP > -A INPUT -s fe80::/10 -j ACCEPT > -A INPUT -d ff00::/8 -j ACCEPT > -A INPUT -i lo -j ACCEPT > -A INPUT -i br0 -m state --state RELATED,ESTABLISHED -j ACCEPT > -A INPUT -s myprefix::/64 -d fe80::/10 -i br0 -j ACCEPT > -A INPUT -s fe80::/10 -d ff02::1:2/128 -i br0 -p tcp -m tcp -m multiport > --dports 546,547 -j ACCEPT > -A INPUT -s fe80::/10 -d ff02::1:2/128 -i br0 -p udp -m udp -m multiport > --dports 546,547 -j ACCEPT > -A INPUT -i br0 -p ipv6-icmp -j ACCEPT > -A INPUT -i br0 -p udp -m udp --sport 32769:65535 --dport 33434:33523 -j > ACCEPT > -A INPUT -i br0 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT > -A INPUT -i br0 -p udp -m udp --dport 53 -j ACCEPT > -A INPUT -i br0 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT > -A INPUT -i br0 -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT > -A INPUT -i br0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT > -A INPUT -i br0 -p tcp -m tcp --dport 3128 -m state --state NEW -j ACCEPT > -A INPUT -i sit1 -p ipv6-icmp -j ACCEPT > -A INPUT -i sit1 -p ipv6-icmp -j ACCEPT > -A INPUT -i sit1 -p udp -m udp --sport 32769:65535 --dport 33434:33523 > -j ACCEPT > -A INPUT -i sit1 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT > -A INPUT -i br0 -p udp -m udp --dport 5353 -j DROP > -A INPUT -i sit1 -p tcp -m tcp --dport 21 -j DROP > -A INPUT -i sit1 -p tcp -m tcp --dport 22 -j DROP > -A INPUT -i sit1 -p tcp -m tcp --dport 23 -j DROP > -A INPUT -i sit1 -p tcp -m tcp --dport 80 -j DROP > -A INPUT -i sit1 -p tcp -m tcp --dport 443 -j DROP > -A INPUT -i sit1 -p tcp -m tcp --dport 3128 -j DROP > -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7 > -A FORWARD -i sit1 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT > -A FORWARD -m rt --rt-type 0 -j DROP > -A FORWARD -m state --state INVALID -j DROP > -A FORWARD -i br0 -o br0 -j ACCEPT > -A FORWARD -i br0 -o sit1 -p tcp -m tcp --dport 25 -j LOG --log-prefix > "IPv6[FWD-SMTP(out)]: " --log-level 7 > -A FORWARD -i br0 -o sit1 -p tcp -m tcp --dport 25 -j DROP > -A FORWARD -i br0 -o sit1 -j ACCEPT > -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7 > -A OUTPUT -m rt --rt-type 0 -j DROP > -A OUTPUT -m state --state INVALID -j DROP > -A OUTPUT -s fe80::/10 -j ACCEPT > -A OUTPUT -d ff00::/8 -j ACCEPT > -A OUTPUT -o lo -j ACCEPT > -A OUTPUT -o br0 -j ACCEPT > -A OUTPUT -o sit1 -j ACCEPT > -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7 > COMMIT > # Completed on Tue Aug 22 17:44:04 2017 > > br0 is LAN port > sit1 is HE-tunnel port > > Thanks, > Walter > Looks fine to me, unless conntrack isnt picking those packets up as established/related to the initial connection. ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2017-08-22 16:03 UTC | newest] Thread overview: 8+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2017-08-22 14:42 IPv6: unknown packet logged Walter H. 2017-08-22 14:47 ` Mark Coetser 2017-08-22 14:59 ` Walter H. 2017-08-22 15:08 ` Mark Coetser 2017-08-22 15:36 ` Walter H. 2017-08-22 15:40 ` Mark Coetser 2017-08-22 15:52 ` Walter H. 2017-08-22 16:03 ` Mark Coetser
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox