From: Nicolas KOWALSKI <niko@petole.dyndns.org>
To: netfilter@vger.kernel.org
Subject: Re: ip6tables icmp conntracking on 2.6.18 vs 2.6.24
Date: Fri, 04 Apr 2008 19:57:00 +0200 [thread overview]
Message-ID: <87y77tpkpf.fsf@petole.dyndns.org> (raw)
In-Reply-To: <20080404123940.GA9157@piper.oerlikon.madduck.net>
martin f krafft <madduck@madduck.net> writes:
> Ideally, however, --syn is no longer needed if you do
>
> -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A INPUT -m state --state INVALID -j DROP
> -A INPUT -m state --state NEW -j in-new
>
> -A in-new -p tcp --dport 22 -j ACCEPT
> [...]
>
> -A INPUT -j log-and-drop
>
> I /think/ this is the correct way to write iptables rules, but
> please correct me if I am wrong, anyone!
Ok, I use your suggestion.
> Now make sure that your hosts don't honour redirects. I actually
> don't think passing *all* ICMPv6 is a good idea. Do read the RFC
> (see followup thread).
I read the RFC (whose example script contains typos). "Just for fun",
I applied the recommandations, and ended up with the following. Note
the ruleset for ICMPv6... This is getting scary, isn't it ? These
certainly need some cleanup, but you get it.
# Generated by ip6tables-save v1.3.6 on Fri Apr 4 19:54:58 2008
*filter
:INPUT ACCEPT [1:200]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5:360]
:IN-NEW - [0:0]
:icmpv6-filter - [0:0]
:icmpv6-filter-from-internal - [0:0]
:icmpv6-filter-to-internal - [0:0]
:icmpv6-filter-to-internal-s - [0:0]
-A INPUT -s ::/0 -d ::/0 -i lo -j ACCEPT
-A INPUT -s ::/0 -d ::/0 -p ipv6-icmp -j ACCEPT
-A INPUT -s ::/0 -d ::/0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s ::/0 -d ::/0 -m state --state INVALID -j DROP
-A INPUT -s ::/0 -d ::/0 -m state --state NEW -j IN-NEW
-A INPUT -s ::/0 -d ::/0 -j DROP
-A FORWARD -s ::/0 -d ::/0 -p ipv6-icmp -j icmpv6-filter
-A FORWARD -s ::/0 -d 2001:6f8:3f1::/48 -i sixxs -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 2001:6f8:3f1::/48 -d ::/0 -i eth0 -o sixxs -j ACCEPT
-A FORWARD -s ::/0 -d ::/0 -j DROP
-A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 22 -j ACCEPT
-A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 25 -j ACCEPT
-A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 80 -j ACCEPT
-A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 443 -j ACCEPT
-A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 465 -j ACCEPT
-A IN-NEW -s ::/0 -d ::/0 -p tcp -m tcp --dport 993 -j ACCEPT
-A IN-NEW -s ::/0 -d ::/0 -j DROP
-A icmpv6-filter -s ::/0 -d fe80::/10 -p ipv6-icmp -j DROP
-A icmpv6-filter -s fe80::/10 -d ::/0 -p ipv6-icmp -j DROP
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 137 -j DROP
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 135 -j DROP
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 136 -j DROP
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 133 -j DROP
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 134 -j DROP
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 130 -j DROP
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 131 -j DROP
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 132 -j DROP
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 143 -j DROP
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 138 -j DROP
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 139 -j DROP
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 140 -j DROP
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -j ACCEPT
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -m state --state RELATED,ESTABLISHED -m icmp6 --icmpv6-type 129 -j ACCEPT
-A icmpv6-filter -s 2001:6f8:3f1::/48 -d ::/0 -j icmpv6-filter-from-internal
-A icmpv6-filter -s ::/0 -d 2001:6f8:3f1::/48 -j icmpv6-filter-to-internal
-A icmpv6-filter -s ::/0 -d ::/0 -p ipv6-icmp -j DROP
-A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 128 -j ACCEPT
-A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 1 -j ACCEPT
-A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 2 -j ACCEPT
-A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 3/0 -j ACCEPT
-A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 3/1 -j ACCEPT
-A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -j ACCEPT
-A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/2 -j ACCEPT
-A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 145 -j ACCEPT
-A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 147 -j ACCEPT
-A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -j ACCEPT
-A icmpv6-filter-from-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/2 -j ACCEPT
-A icmpv6-filter-from-internal -s ::/0 -d ::/0 -j DROP
-A icmpv6-filter-to-internal -s ::/0 -d ::/0 -m state --state RELATED,ESTABLISHED -j icmpv6-filter-to-internal-s
-A icmpv6-filter-to-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 128 -j ACCEPT
-A icmpv6-filter-to-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 144 -j ACCEPT
-A icmpv6-filter-to-internal -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 146 -j ACCEPT
-A icmpv6-filter-to-internal -s ::/0 -d ::/0 -j DROP
-A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 1 -j ACCEPT
-A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 2 -j ACCEPT
-A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 3/0 -j ACCEPT
-A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 3/1 -j ACCEPT
-A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -j ACCEPT
-A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -p ipv6-icmp -m icmp6 --icmpv6-type 4/2 -j ACCEPT
-A icmpv6-filter-to-internal-s -s ::/0 -d ::/0 -j DROP
COMMIT
# Completed on Fri Apr 4 19:54:58 2008
--
Nicolas
next prev parent reply other threads:[~2008-04-04 17:57 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-04-02 21:26 ip6tables icmp conntracking on 2.6.18 vs 2.6.24 martin f krafft
2008-04-02 21:44 ` Petr Pisar
2008-04-02 21:57 ` Jan Engelhardt
2008-04-02 22:05 ` martin f krafft
2008-04-03 8:18 ` martin f krafft
2008-04-03 9:29 ` Pascal Hambourg
2008-04-03 9:36 ` Nicolas KOWALSKI
2008-04-03 10:26 ` martin f krafft
2008-04-03 15:07 ` Pascal Hambourg
2008-04-03 15:23 ` martin f krafft
2008-04-03 23:00 ` Pascal Hambourg
2008-04-03 23:03 ` Pascal Hambourg
2008-04-04 8:50 ` martin f krafft
2008-04-04 16:19 ` Pascal Hambourg
2008-04-08 13:15 ` martin f krafft
2008-04-03 15:35 ` Nicolas KOWALSKI
2008-04-03 15:38 ` martin f krafft
2008-04-03 15:48 ` Nicolas KOWALSKI
2008-04-04 8:51 ` martin f krafft
2008-04-04 8:57 ` Nicolas KOWALSKI
2008-04-04 11:04 ` martin f krafft
2008-04-04 11:59 ` Nicolas KOWALSKI
2008-04-04 12:39 ` martin f krafft
2008-04-04 17:57 ` Nicolas KOWALSKI [this message]
2008-04-03 16:14 ` Jozsef Kadlecsik
2008-04-04 6:22 ` martin f krafft
2008-04-04 9:39 ` Jozsef Kadlecsik
2008-04-04 7:32 ` RFC 4890 (icmpv6 firewall recommendations) and ip6tables (was: ip6tables icmp conntracking on 2.6.18 vs 2.6.24) martin f krafft
2008-04-04 9:12 ` Jozsef Kadlecsik
2008-04-04 11:15 ` martin f krafft
2009-03-11 12:44 ` martin f krafft
2009-03-21 13:43 ` RFC 4890 (icmpv6 firewall recommendations) and ip6tables Chris Hills
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87y77tpkpf.fsf@petole.dyndns.org \
--to=niko@petole.dyndns.org \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox