ip6tables icmp

H6G · Nov 7th 2016

Guten Tag Zusammen,

ich versuche derzeit einen unserer Server abzuschotten. Das gelingt auch soweit ganz gut, nur dass ICMP Pakete in IPv6 von bestimmten erlaubten Hosts nicht durchkommt. Eine Umleitung auf den Log bietet auch keine neuen Erkenntnisse, außer dass die Pakete nicht in der entsprechenden Chain landen, sondern vorher abgefangen werden.

Die Eingangsregel habe ich auch schon weiter erleichtert, bishin zu jedem ICMPv6 Traffic zu erlauben - führt leider auch nicht zum gewünschten Ergebnis.
Hoffe, dass mir jemand noch einen Anhaltspunkt liefern kann.

Was auch verwunderlich ist, dass nach jedem 4. Paket ein Adress unreachable zurückwirft.

Code

ip6tables -F
ip6tables -P INPUT DROP
ip6tables -P OUTPUT DROP
ip6tables -P FORWARD DROP
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT
ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A INPUT -s fe80::/10 -j ACCEPT
ip6tables -A OUTPUT -s fe80::/10 -j ACCEPT
ip6tables -N CH-DNS
ip6tables -A OUTPUT -p tcp -m tcp -o eth0 --dport 53 -m state --state NEW -j CH-DNS
ip6tables -A OUTPUT -p udp -m udp -o eth0 --dport 53 -m state --state NEW -j CH-DNS
ip6tables -A CH-DNS -d 2001:4860:4860::8888 -j ACCEPT
ip6tables -A CH-DNS -d 2001:4860:4860::8844 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type 1 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type 2 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type 3 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type 4 -j ACCEPT
ip6tables -N CH-ICMP-IN
ip6tables -A INPUT -p icmpv6 -j CH-ICMP-IN
ip6tables -A CH-ICMP-IN -s 2a03:4000:10:**::1 -j ACCEPT
ip6tables -A CH-ICMP-IN -s 2a03:4000:10:**::1 -j ACCEPT
ip6tables -A CH-ICMP-IN -s 2a00:ccc1:0:****::1 -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 -o eth0 -m state --state NEW -j ACCEPT

Display More

Danke für die Unterstützung.

killerbees19 · Nov 7th 2016

Du solltest ICMPv6 lieber nicht nach der Quelle oder dem Ziel filtern, sondern nur nach dem Typ. Du schließt ansonsten sehr viele NDP-Informationen aus, der Router leitet die realen Pakete somit vielleicht gar nicht mehr zu Dir weiter. Hier mal ein Auszug aus meiner Firewall:

Code

Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
5494K 2209M ACCEPT all * * ::/0 ::/0 state ESTABLISHED
21475 1596K ACCEPT all lo * ::1 ::1
53037 3754K fnx_icmpv6_local icmpv6 * * ::/0 ::/0
6033 602K fnx_icmpv6_forward icmpv6 * * ::/0 ::/0
33 1980 REJECT udp * * ::/0 ::/0 udp dpts:33434:33655 reject-with icmp6-port-unreachable
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1268K 973M ACCEPT all * * ::/0 ::/0 state ESTABLISHED
34623 4271K fnx_icmpv6_forward icmpv6 * * ::/0 ::/0
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
5606K 733M ACCEPT all * * ::/0 ::/0 state ESTABLISHED
12242 857K ACCEPT all * lo ::1 ::1
55497 8865K fnx_icmpv6_local icmpv6 * * ::/0 ::/0
35696 7462K fnx_icmpv6_forward icmpv6 * * ::/0 ::/0
0 0 REJECT all * * ::/0 ::/0 reject-with icmp6-port-unreachable
Chain fnx_icmpv6_forward (3 references)
pkts bytes target prot opt in out source destination
218 273K DROP all * * ::/0 ::/0 state INVALID
0 0 ACCEPT all * * ::/0 ::/0 state ESTABLISHED
37089 7362K ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1 state RELATED
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2 state RELATED
17414 2647K ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3 state RELATED
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4 state RELATED
21631 2053K ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128 state NEW
0 0 DROP all * * ::/0 ::/0
Chain fnx_icmpv6_local (2 references)
pkts bytes target prot opt in out source destination
3 168 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 133
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 134
47005 3286K ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 135
19784 1266K ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 136
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 141
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 142
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 130
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 131
13 1668 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 143
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 132
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 148
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 149
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 151
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 152
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 153

Display More

Credits: Die beiden zusätzlichen Ketten wurden größtenteils aus dem "Linux-Firewalls" Buch von Ralf Spenneberg übernommen.

MfG Christian

H6G · Nov 7th 2016

Hallo Christian,

danke für Deinen Input. Ich stelle das nochmal als Shellscript hier zur Verfügung.
Läuft auch soweit.

Kann ich dennoch den Typ 128 (echo-request) auf bestimmte Source Adressen reduzieren zzgl. des fe80::/10 Subnetzes?

Code

ip6tables -F
ip6tables -P INPUT DROP
ip6tables -P OUTPUT DROP
ip6tables -P FORWARD DROP
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT
ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -N CH-ICMP-IN
ip6tables -N CH-ICMP-FW
ip6tables -A INPUT -p icmpv6 -j CH-ICMP-IN
ip6tables -A INPUT -p icmpv6 -j CH-ICMP-FW
ip6tables -A FORWARD -p icmpv6 -j CH-ICMP-FW
ip6tables -A OUTPUT -p icmpv6 -j CH-ICMP-IN
ip6tables -A OUTPUT -p icmpv6 -j CH-ICMP-FW
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 130 -j ACCEPT
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 131 -j ACCEPT
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 132 -j ACCEPT
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 133 -j ACCEPT
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 134 -j ACCEPT
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 135 -j ACCEPT
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 136 -j ACCEPT
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 141 -j ACCEPT
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 142 -j ACCEPT
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 143 -j ACCEPT
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 148 -j ACCEPT
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 149 -j ACCEPT
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 151 -j ACCEPT
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 152 -j ACCEPT
ip6tables -A CH-ICMP-IN -p icmpv6 --icmpv6-type 153 -j ACCEPT
ip6tables -A CH-ICMP-FW -m state --state INVALID -j DROP
ip6tables -A CH-ICMP-FW -m state --state ESTABLISHED -j ACCEPT
ip6tables -A CH-ICMP-FW -p icmpv6 --icmpv6-type 1 -m state --state RELATED -j ACCEPT
ip6tables -A CH-ICMP-FW -p icmpv6 --icmpv6-type 2 -m state --state RELATED -j ACCEPT
ip6tables -A CH-ICMP-FW -p icmpv6 --icmpv6-type 3 -m state --state RELATED -j ACCEPT
ip6tables -A CH-ICMP-FW -p icmpv6 --icmpv6-type 4 -m state --state RELATED -j ACCEPT
ip6tables -A CH-ICMP-FW -p icmpv6 --icmpv6-type 128 -m state --state NEW -j ACCEPT

Display More

ip6tables icmp

Similar Threads

Ubuntu 16.04 und IPv6

IPv6 Funktioniert nicht auf vServer.

IPv6 gateway und minimale Firewall-Freigaben

Tags

Users Online