Iptables – Differences between iptables and ip6tables processing of packets

ip6tablesiptables

I've reviewed a variety of netfilter, iptables, and ip6tables resources. I've searched Google, including StackExchange websites for information, and, I can't find easy or clear links to information regarding differences between how iptables and ip6tables process packets.

Here are my standard iptables rules:

* filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --sport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 22 -m state --state ESTABLISHED -j ACCEPT

Similar rules are also in place for both incoming & outgoing HTTP, and DNS resolution, as well as basic ICMP (v4 0, 3, 8, 11, 12).

When I use ip6tables to put the same rules in place, my server response to both HTTP, SSH and ICMP connections with "host is down."

I can set the preliminary rules to:

-P INPUT ACCEPT
-P OUTPUT ACCEPT

And this opens the server back up again. But it doesn't filter packets (arbitrary rules for all packets, less FORWARD).

I've tried appending:

-A INPUT -i eth0 -j DROP

But, again, this starts causing issues.

Double and triple checked with telnet among other packet verification (server logs just simply drop connections if DROP is used, same for REJECT).

Alternatively, I've also seen rule-sets which are simple ACCEPT (all) with dport and sport ranges excepting the required rules.

In a nutshell, I'm used to the typical iptables (ipv4) rules which DROP everything, except the following rules.

Ideally, I'm looking for links or information which provide in-depth, detailed technical information about differences between how iptables and ip6tables process (and drop or accept) packets differently.

It would seem ip6tables will DROP everything arbitrarily if these are the basic proto rules, BUT, where not accepted in the first set of rules, the latter rule I've tried to DROP all interface INPUT continues to cause issues (given the initial set of rules is to ACCEPT, but have nowhere to go).

FWIW: This is Debian Jessie (v8) on a dist-upgrade from Debian Wheezy (v7) on a DigitalOcean droplet. Everything else runs kosher except for the ip6tables rules (server becomes unavailable to ipv6 resources).

Original posted on StackOverflow, deleted, copy/pasted here on ServerFault (suggested more relevant).

Best Answer

Your rules are dropping ICMP. This is wrong for both IPv4 and IPv6, and it will notably break PMTU discovery; however, most IPv4 stacks implement workarounds for this (very common) kind of misconfiguration. For IPv6, however, many things will be broken, notably access from Teredo hosts.

A simple solution is to add rules to allow ICMP:

iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A FORWARD -p icmp -j ACCEPT

ip6tables -A INPUT -p icmpv6 -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 -j ACCEPT
ip6tables -A FORWARD -p icmpv6 -j ACCEPT

A potentially more secure solution is to allow just the types of ICMP messages that are necessary for proper functionality, by following the recommendations of RFC 4890.

Related Solutions

Ssh – iptables rules to block ssh remote forwarded ports

Would it not be easier to switch off ssh forwarding on the ssh server? Just change AllowTcpForwarding from yes to no in your /etc/ssh/sshd_config. If this doesn't suit, you could try something along the lines of

iptables -A OUTPUT -o eth1 -p tcp --cmd-owner "sshd" -j DROP

Iptables – RHEL 6 Having issues forwarding port 80 to port 8080

I would say this is wrong approach. In any case, I wouldn't want to have JBoss (nor tomcat) to manage direct connections other then for test purpose. It's not designed to manage directly outside connections.

Option 1 Have apache web server proxy to 127.0.0.1:8080

You need this somewhere in your apache setup

LoadModule proxy_module  {path-to-modules}/mod_proxy.so
AddModule  mod_proxy.c

Or with apache2

$ sudo a2enmod proxy
$ sudo apache2ctl restart

And in virtual hosts you could have several apps

ProxyPass         /myapp  http://localhost:8080/myapp
ProxyPassReverse  /myapp  http://localhost:8080/myapp

or have a unique one

ProxyPass         /  http://localhost:8080/
ProxyPassReverse  /  http://localhost:8080/

after changing virtual hosts setting, no need to restart apache

$ sudo apache2ctl graceful

will update settings without dropping ongoing connections.

Option 2, using mod_ajp

$ sudo a2enmod proxy_ajp
$ sudo apache2ctl restart

adding this to your virtualhost

ProxyPass /app ajp://backend.example.com:8009/app

Assuming tomcat instance is configured to have ajp connector on port 8009. Check tomcat settings.

http://httpd.apache.org/docs/2.2/mod/mod_proxy_ajp.html

Option 3, using mod_jk http://tomcat.apache.org/connectors-doc/

You'll still have the other issue that is to configure JBoss as to create links to :80, that will be a JBoss setting problem... can't remember where it's set, all I can remember is that it took me a while to find out. I've preferred using the ajp connector so far.

Sorry, I don't have have access to a JBoss setup right now, perhaps someone can point us where is that setting.

Best Answer

Related Solutions

Ssh – iptables rules to block ssh remote forwarded ports

Iptables – RHEL 6 Having issues forwarding port 80 to port 8080

Related Topic