1

I'm having a little trouble setting up nftables on a dual stack server. My setup is debian 9.11 with nftables installed (obviously). The IPv4 part is working as expected but IPv6 is not.

Output of nft list ruleset:


        chain input {
                type filter hook input priority 0; policy drop;
                ct state established,related accept
                iif "lo" accept
                ct state invalid drop
                ip protocol icmp icmp type echo-request ct state new accept
                ip6 nexthdr icmpv6 icmpv6 type echo-request ct state new accept
                ip protocol udp ct state new jump UDP
                tcp flags & (fin | syn | rst | ack) == syn ct state new jump TCP
                ip protocol udp drop
                ip protocol tcp drop
                meta nfproto ipv4 counter packets 24 bytes 1101 reject with icmp type prot-unreachable
        }

        chain forward {
                type filter hook forward priority 0; policy drop;
        }

        chain output {
                type filter hook output priority 0; policy accept;
        }

        chain TCP {
                tcp dport http accept
                tcp dport https accept
        }

        chain UDP {
                udp dport 9987 accept
        }
}

The problem here is that neither the webserver is reachable, nor the server address is pingable when nftables are enabled.

I've added the ipv4 counterpart ip6 nexthdr icmpv6 icmpv6 type echo-request ct state new accept but no success here.

I'm also suspecting ip protocol udp ct state new jump UDP and tcp flags & (fin | syn | rst | ack) == syn ct state new jump TCP to be triggered only by ipv4 traffic. What do I need to add here to also catch IPv6?

Thanks in advance for any helpful answers. I'm a little afraid to lock myself out that's why I'm asking here first.

proximity
  • 11
  • 3
  • Okay, seems like I have figured out the ping problematic, replaced ```ip6 nexthdr icmpv6 icmpv6 type echo-request ct state new accept```with ```ip6 nexthdr ipv6-icmp accept``` and the host is now pingable. – proximity Apr 27 '20 at 19:47
  • 1
    This isn't an nftables problem but a problem of IPv6 comprehension: IPv4 relies on ARP for link layer resolution. ARP isn't firewalled. IPv6 relies on additional addresses and ICMPv6 to resolve link layer. ICMPv6 *is* IPv6, so, contrary to the IPv4 case, gets firewalled. Dropping ICMP in IPv4 has only "small" effects (no ping, PMTU and tunnel issues etc.), Dropping all of ICMPv6 gets the system to lose its addresses and all connectivity in a few seconds (not only ping, but all). – A.B May 27 '20 at 12:03

0 Answers0