Bdtyktl

I have IPv6 tunnel (he.net) on my NAT router. I also have a simple firewall and routing setup to allow hosts behind the router to use IPv6 address space. Unfortunately only outgoing connectivity and incoming icmp works for these hosts.

#!/bin/bash

PUBIF="he-ipv6"

LOCIF="vmbr0"

echo "Starting IPv6 firewall..."

ip6tables -F

ip6tables -X

ip6tables -t mangle -F

ip6tables -t mangle -X



ip6tables -A INPUT -i lo -j ACCEPT

ip6tables -A OUTPUT -o lo -j ACCEPT



ip6tables -P INPUT DROP

ip6tables -P OUTPUT DROP

ip6tables -P FORWARD DROP



ip6tables -A INPUT -i $PUBIF -m state --state ESTABLISHED,RELATED -j ACCEPT

ip6tables -A OUTPUT -o $PUBIF -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT



ip6tables -A INPUT -m rt --rt-type 0 -j DROP

ip6tables -A FORWARD -m rt --rt-type 0 -j DROP

ip6tables -A OUTPUT -m rt --rt-type 0 -j DROP



ip6tables -A INPUT -s fe80::/10 -j ACCEPT

ip6tables -A OUTPUT -s fe80::/10 -j ACCEPT



ip6tables -A INPUT -d ff00::/8 -j ACCEPT

ip6tables -A OUTPUT -d ff00::/8 -j ACCEPT



ip6tables -A INPUT -i $LOCIF -j ACCEPT

ip6tables -A OUTPUT -o $LOCIF -j ACCEPT



ip6tables -A FORWARD -i $LOCIF -o $PUBIF -j ACCEPT

ip6tables -A FORWARD -i $PUBIF -o $LOCIF -p icmpv6 -j ACCEPT

ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT



ip6tables -A INPUT -i $PUBIF -p ipv6-icmp -j ACCEPT

ip6tables -A OUTPUT -o $PUBIF -p ipv6-icmp -j ACCEPT



ip6tables -A INPUT -i $PUBIF -p tcp --destination-port 65000 -j ACCEPT



ip6tables -A INPUT -i $PUBIF -j LOG

ip6tables -A INPUT -i $PUBIF -j DROP

What did I miss here?

You're only allowing ICMP inward!

ip6tables -A FORWARD -i $PUBIF -o $LOCIF -p icmpv6 -j ACCEPT

Compare it to the previous rule where you allow all traffic outward.

ip6tables -A FORWARD -i $LOCIF -o $PUBIF -j ACCEPT

BTW, these rules are redundant; the Linux kernel has automatically dropped this traffic since about 2.6.25 (2007-ish). You can safely remove them. And you should reevaluate whatever tutorial you found them in, as it is probably very far out of date.

ip6tables -A INPUT -m rt --rt-type 0 -j DROP

ip6tables -A FORWARD -m rt --rt-type 0 -j DROP

ip6tables -A OUTPUT -m rt --rt-type 0 -j DROP