ip6tables blocking output traffic
Posted
by
jmccrohan
on Server Fault
See other posts from Server Fault
or by jmccrohan
Published on 2011-06-29T16:27:27Z
Indexed on
2011/06/30
0:23 UTC
Read the original article
Hit count: 143
My OpenVZ VPS is blocking outbound IPv6 traffic, but correctly filtering inbound IPv6 traffic.
Below is my ip6tables-restore script.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 51413 -j ACCEPT
-A INPUT -p udp -m udp --dport 51413 -j ACCEPT
-A INPUT -m limit --limit 5/min
-A INPUT -j REJECT --reject-with icmp6-adm-prohibited
-A FORWARD -j ACCEPT
-A OUTPUT -j ACCEPT
COMMIT
ICMPv6 traffic is still able to pass both inbound and outbound.
When I flush these rules using -F
, outbound traffic flows fine.
What am I missing here?
EDIT: It appears that ip6tables is marking ESTABLISHED packets as INVALID. Consequently, the outbound traffic is NOT actually being blocked. The reply packets are not allowed inbound again, hence appearing like blocked outbound traffic. Allowing INVALID packets inbound solves the outbound issue, but also renders the inbound filter useless.
© Server Fault or respective owner