ip6tables forward chain filters all ports

Question

Trying the following on a centos 6 node (running openvz kernel)

ip6tables -F ip6tables -X ip6tables -P FORWARD DROP ip6tables -A FORWARD -p tcp -m multiport --dports 21,22,80,443 -j ACCEPT ip6tables -A FORWARD -p udp -m multiport --dports 21,22,80,443 -j ACCEPT ip6tables -A FORWARD -p ipv6-icmp -j ACCEPT

However, this seems to disable ipv6 connectivity from the openvz VPS outwards to the node, or the internet, and on a port scanner it shows all ports as filtered/blocked by firewall.

However, pinging the vps from within the node to the VPS works fine.

All that I am trying to do is to drop all forward, and accept the multiple ports shown above, and allow ipv6 connectivity to pass through.

It is definitely an ip6tables issue, as when I stop ip6tables, it runs fine and pinging is absolutely okay.

Your help is appreciated.

score 2 · Answer 1 · answered Aug 05 '15 at 16:28

2

The problem is that your firewall is not stateful, and it only allowed traffic to pass in one direction. There is nothing here to allow return traffic. So, while a client request is passed through, the response from the server doesn't match any rules and is dropped.

Write instead normal stateful rules. For example:

-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m conntrack --ctstate NEW -m tcp -p tcp -m multiport --dports 21,22,80,443 -j ACCEPT

The second rule allows the initial connection attempt, and the first rule allows all of the rest of the traffic, as long as the connection remains open. It is first because it will match most frequently, and having it first makes things faster.

Your ICMP rule is fine and should be left as-is.

answered Aug 05 '15 at 16:28

Michael Hampton

237,123
42
477
940

This still blocks all ports (checked with online scanner), however pinging is now okay. – el5yeli Aug 05 '15 at 18:38
You also have some other issue, then. – Michael Hampton Aug 05 '15 at 18:41
That is pretty much all the rules that is in ip6tables that I used unfortunately. Nothing else. – el5yeli Aug 05 '15 at 19:00
How did you set up the network, then? Look at everything... – Michael Hampton Aug 05 '15 at 19:23
Just a standard openvz node running centos 6 – el5yeli Aug 06 '15 at 03:31

ip6tables forward chain filters all ports

1 Answers1