[Firehol-support] IPv6 help!

Rich forums at artfulrobot.uk
Tue Dec 22 15:35:08 GMT 2015


I'm getting vexed by IPv6.

I'm using firehol v3 compiled on Debian Jessie on a VM with native IPv6 

With the firewall off I can get a reply from*ping6 ipv6.google.com*.

With the firewall on, this still works for about 30s and then I just get 
"connect: network is unreachable" errors. In the log I have things like

kernel: [143183.342905] IN-unknown:IN=eth0 OUT= 
DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=224 HOPLIMIT=255 

The ipv6 rules I have currently are:

interface6 eth0 internet6 src not "${UNROUTABLE_IPS}" dst $MY_IP6
   policy accept   server ipv6error accept   server ipv6neigh accept   server custom 
test1 tcp/13579 any accept   client custom test1 tcp/13579 any accept   
client ipv6neigh accept   client ipv6router accept   client http accept 
   client https accept
   client all accept

interface6 eth0 lan6 src $MY_IP6 dst $MY_IP6
   policy accept
   client all accept

interface6 eth0 dst not $MY_IP6
   policy accept
   client all accept

The ones in grey are from earlier testing but as I have 'accept' as a 
policy, I don't think they'll be in the way. The only other rules are 
specifically ipv4 ones (interface4...); there are no router lines - it 
only has one NIC.

The $MY_IP6 is my /internet/ IPv6 address. I've tried this with /64 at 
the end (as reported by ip -6 addr show) and without that. The link 
local one is fe80::f03c:91ff:fe33:f855/64.

Two things I don't understand are:

1. Why don't the rules I've got in my conf file allow all IPv6? Why is 
the firewall prohibiting IPv6 at all?

2. Why am I seeing rejected traffic from what is presumably my gateway 
(fe80::1) but with a DST address that's not my link local one, nor my 
external IP?

I've read all the pages on firehol manual, I think but am still stuck.

Many thanks for your consideration!

PS. Happy Christmas :-)

More information about the Firehol-support mailing list