Ubuntu IPv6 setup for LAMP and Mail Server

Question

I noticed my ip6tables are not configured on my newish server, but well supported by my VPS and I have some idea about how to implement ipv4 rules, but know nothing about ipv6, I've tried looking through various Google and serverfault examples, but get somewhat conflicting arguments about best practices. So my question is, given the practices in my iptables.firewall.rules file below, what would an ipv6tables.firewall.rules file look like for me to start-up with the server?

*filter

#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

#  Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#  Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

#  Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

#  Allow ports for testing
-A INPUT -p tcp --dport 8080:8090 -j ACCEPT

# Allows SMTP access
-A INPUT -p tcp --dport 25 -j ACCEPT

# Allows pop and pops connections
-A INPUT -p tcp --dport 110 -j ACCEPT
-A INPUT -p tcp --dport 995 -j ACCEPT

# Allows imap and imaps connections
-A INPUT -p tcp --dport 143 -j ACCEPT
-A INPUT -p tcp --dport 993 -j ACCEPT

#  Allow ports for MOSH (mobile shell)
-A INPUT -p udp --dport 60000:61000 -j ACCEPT

#  Allow SSH connections
#  The -dport number should be the same port number you set in sshd_config
-A INPUT -p tcp -m state --state NEW --dport 1022 -j ACCEPT

#  Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

#  Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

#  Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT

http://serverfault.com/a/410327/126632 – Michael Hampton May 27 '13 at 15:13 — Michael Hampton, May 27 '13 at 15:13

score 0 · Accepted Answer · answered May 27 '13 at 12:17

ip6tables is pretty much the same as iptables. IPv6 depends heavily on ICMP so I suggest not filtering it unless you have a very good reason.

I would start with removing this line (IPv4 addresses don't make sense in ip6tables):

-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

And changing the ICMP line to:

-A INPUT -p icmpv6 -j ACCEPT

Everything else looks to be IP version independent and should work for both iptables and ip6tables.

Ubuntu IPv6 setup for LAMP and Mail Server

1 Answers1