* IPv6: unknown packet logged ...
@ 2017-08-22 14:42 Walter H.
2017-08-22 14:47 ` Mark Coetser
0 siblings, 1 reply; 8+ messages in thread
From: Walter H. @ 2017-08-22 14:42 UTC (permalink / raw)
To: netfilter
Hello,
I have these rules at the beginning of /etc/sysconfig/ip6tables
# Filter all packets with state INVALID
-A INPUT -m state --state INVALID -j DROP
-A FORWARD -m state --state INVALID -j DROP
-A OUTPUT -m state --state INVALID -j DROP
and on bottom these rules:
# Log all other
-A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7
-A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
-A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7
which rule would have catched these logged packets:
[70223.386265] IPv6[FWD]: IN=sit1 OUT=br0
SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0
HOPLIMIT=60 FLOWLBL=617912 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
RES=0x00 ACK PSH URGP=0
[70232.150311] IPv6[FWD]: IN=sit1 OUT=br0
SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0
HOPLIMIT=60 FLOWLBL=949795 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
RES=0x00 ACK PSH URGP=0
[70249.740932] IPv6[FWD]: IN=sit1 OUT=br0
SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0
HOPLIMIT=60 FLOWLBL=811062 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
RES=0x00 ACK PSH URGP=0
Thanks,
Walter
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: IPv6: unknown packet logged ...
2017-08-22 14:42 IPv6: unknown packet logged Walter H.
@ 2017-08-22 14:47 ` Mark Coetser
2017-08-22 14:59 ` Walter H.
0 siblings, 1 reply; 8+ messages in thread
From: Mark Coetser @ 2017-08-22 14:47 UTC (permalink / raw)
To: Walter H., netfilter
On 22/08/2017 16:42, Walter H. wrote:
> Hello,
>
> I have these rules at the beginning of /etc/sysconfig/ip6tables
>
> # Filter all packets with state INVALID
> -A INPUT -m state --state INVALID -j DROP
> -A FORWARD -m state --state INVALID -j DROP
> -A OUTPUT -m state --state INVALID -j DROP
>
> and on bottom these rules:
>
> # Log all other
> -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7
> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
> -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7
>
> which rule would have catched these logged packets:
>
> [70223.386265] IPv6[FWD]: IN=sit1 OUT=br0
> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0
> HOPLIMIT=60 FLOWLBL=617912 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
> RES=0x00 ACK PSH URGP=0
> [70232.150311] IPv6[FWD]: IN=sit1 OUT=br0
> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0
> HOPLIMIT=60 FLOWLBL=949795 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
> RES=0x00 ACK PSH URGP=0
> [70249.740932] IPv6[FWD]: IN=sit1 OUT=br0
> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0
> HOPLIMIT=60 FLOWLBL=811062 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
> RES=0x00 ACK PSH URGP=0
those logged packets are from packets traversing your filter FORWARD
chain obviously no rule is matching which is why its triggering the last
rule which is
-A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: IPv6: unknown packet logged ...
2017-08-22 14:47 ` Mark Coetser
@ 2017-08-22 14:59 ` Walter H.
2017-08-22 15:08 ` Mark Coetser
0 siblings, 1 reply; 8+ messages in thread
From: Walter H. @ 2017-08-22 14:59 UTC (permalink / raw)
To: Mark Coetser; +Cc: Walter H., netfilter
On Tue, August 22, 2017 16:47, Mark Coetser wrote:
> On 22/08/2017 16:42, Walter H. wrote:
>> Hello,
>>
>> I have these rules at the beginning of /etc/sysconfig/ip6tables
>>
>> # Filter all packets with state INVALID
>> -A INPUT -m state --state INVALID -j DROP
>> -A FORWARD -m state --state INVALID -j DROP
>> -A OUTPUT -m state --state INVALID -j DROP
>>
>> and on bottom these rules:
>>
>> # Log all other
>> -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7
>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
>> -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7
>>
>> which rule would have catched these logged packets:
>>
>> [70223.386265] IPv6[FWD]: IN=sit1 OUT=br0
>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0
>> HOPLIMIT=60 FLOWLBL=617912 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>> RES=0x00 ACK PSH URGP=0
>> [70232.150311] IPv6[FWD]: IN=sit1 OUT=br0
>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0
>> HOPLIMIT=60 FLOWLBL=949795 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>> RES=0x00 ACK PSH URGP=0
>> [70249.740932] IPv6[FWD]: IN=sit1 OUT=br0
>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0
>> HOPLIMIT=60 FLOWLBL=811062 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>> RES=0x00 ACK PSH URGP=0
>
> those logged packets are from packets traversing your filter FORWARD
> chain obviously no rule is matching which is why its triggering the last
> rule which is
>
> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
>
of course, and which rule would I have to add bevor this rule, so that
these are not logged ...?
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: IPv6: unknown packet logged ...
2017-08-22 14:59 ` Walter H.
@ 2017-08-22 15:08 ` Mark Coetser
2017-08-22 15:36 ` Walter H.
0 siblings, 1 reply; 8+ messages in thread
From: Mark Coetser @ 2017-08-22 15:08 UTC (permalink / raw)
To: Walter H.; +Cc: netfilter
On 22/08/2017 16:59, Walter H. wrote:
> On Tue, August 22, 2017 16:47, Mark Coetser wrote:
>> On 22/08/2017 16:42, Walter H. wrote:
>>> Hello,
>>>
>>> I have these rules at the beginning of /etc/sysconfig/ip6tables
>>>
>>> # Filter all packets with state INVALID
>>> -A INPUT -m state --state INVALID -j DROP
>>> -A FORWARD -m state --state INVALID -j DROP
>>> -A OUTPUT -m state --state INVALID -j DROP
>>>
>>> and on bottom these rules:
>>>
>>> # Log all other
>>> -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7
>>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
>>> -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7
>>>
>>> which rule would have catched these logged packets:
>>>
>>> [70223.386265] IPv6[FWD]: IN=sit1 OUT=br0
>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0
>>> HOPLIMIT=60 FLOWLBL=617912 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>>> RES=0x00 ACK PSH URGP=0
>>> [70232.150311] IPv6[FWD]: IN=sit1 OUT=br0
>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0
>>> HOPLIMIT=60 FLOWLBL=949795 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>>> RES=0x00 ACK PSH URGP=0
>>> [70249.740932] IPv6[FWD]: IN=sit1 OUT=br0
>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123 TC=0
>>> HOPLIMIT=60 FLOWLBL=811062 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>>> RES=0x00 ACK PSH URGP=0
>>
>> those logged packets are from packets traversing your filter FORWARD
>> chain obviously no rule is matching which is why its triggering the last
>> rule which is
>>
>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
>>
> of course, and which rule would I have to add bevor this rule, so that
> these are not logged ...?
It depends on what you want to allow, if you want to allow all traffic
between interface sit1 and br0
-I FORWARD -i sit1 -o br0 -j ACCEPT
although the logged packets above show the source port being tcp/443
which means this connection came in br0 and out sit1 so you are probably
missing an established/related rule.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: IPv6: unknown packet logged ...
2017-08-22 15:08 ` Mark Coetser
@ 2017-08-22 15:36 ` Walter H.
2017-08-22 15:40 ` Mark Coetser
0 siblings, 1 reply; 8+ messages in thread
From: Walter H. @ 2017-08-22 15:36 UTC (permalink / raw)
To: Mark Coetser; +Cc: netfilter
[-- Attachment #1: Type: text/plain, Size: 2576 bytes --]
On 22.08.2017 17:08, Mark Coetser wrote:
> On 22/08/2017 16:59, Walter H. wrote:
>> On Tue, August 22, 2017 16:47, Mark Coetser wrote:
>>> On 22/08/2017 16:42, Walter H. wrote:
>>>> Hello,
>>>>
>>>> I have these rules at the beginning of /etc/sysconfig/ip6tables
>>>>
>>>> # Filter all packets with state INVALID
>>>> -A INPUT -m state --state INVALID -j DROP
>>>> -A FORWARD -m state --state INVALID -j DROP
>>>> -A OUTPUT -m state --state INVALID -j DROP
>>>>
>>>> and on bottom these rules:
>>>>
>>>> # Log all other
>>>> -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7
>>>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
>>>> -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7
>>>>
>>>> which rule would have catched these logged packets:
>>>>
>>>> [70223.386265] IPv6[FWD]: IN=sit1 OUT=br0
>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123
>>>> TC=0
>>>> HOPLIMIT=60 FLOWLBL=617912 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>>>> RES=0x00 ACK PSH URGP=0
>>>> [70232.150311] IPv6[FWD]: IN=sit1 OUT=br0
>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123
>>>> TC=0
>>>> HOPLIMIT=60 FLOWLBL=949795 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>>>> RES=0x00 ACK PSH URGP=0
>>>> [70249.740932] IPv6[FWD]: IN=sit1 OUT=br0
>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123
>>>> TC=0
>>>> HOPLIMIT=60 FLOWLBL=811062 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>>>> RES=0x00 ACK PSH URGP=0
>>>
>>> those logged packets are from packets traversing your filter FORWARD
>>> chain obviously no rule is matching which is why its triggering the
>>> last
>>> rule which is
>>>
>>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
>>>
>> of course, and which rule would I have to add bevor this rule, so that
>> these are not logged ...?
>
> It depends on what you want to allow, if you want to allow all traffic
> between interface sit1 and br0
>
> -I FORWARD -i sit1 -o br0 -j ACCEPT
>
> although the logged packets above show the source port being tcp/443
> which means this connection came in br0 and out sit1 so you are
> probably missing an established/related rule.
this rules are after dropping invalid and before logging
# Enable forwarding to IPv6-Tunnel interface
-A FORWARD -i br0 -o sit1 -j ACCEPT
# Enable established, related packets back through
-I FORWARD -i sit1 -o br0 -m state --state ESTABLISHED,RELATED -j ACCEPT
so I have the problem, that I cannot really know, why these packets were
logged ...
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 3491 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: IPv6: unknown packet logged ...
2017-08-22 15:36 ` Walter H.
@ 2017-08-22 15:40 ` Mark Coetser
2017-08-22 15:52 ` Walter H.
0 siblings, 1 reply; 8+ messages in thread
From: Mark Coetser @ 2017-08-22 15:40 UTC (permalink / raw)
To: Walter H.; +Cc: netfilter
On 22/08/2017 17:36, Walter H. wrote:
> On 22.08.2017 17:08, Mark Coetser wrote:
>> On 22/08/2017 16:59, Walter H. wrote:
>>> On Tue, August 22, 2017 16:47, Mark Coetser wrote:
>>>> On 22/08/2017 16:42, Walter H. wrote:
>>>>> Hello,
>>>>>
>>>>> I have these rules at the beginning of /etc/sysconfig/ip6tables
>>>>>
>>>>> # Filter all packets with state INVALID
>>>>> -A INPUT -m state --state INVALID -j DROP
>>>>> -A FORWARD -m state --state INVALID -j DROP
>>>>> -A OUTPUT -m state --state INVALID -j DROP
>>>>>
>>>>> and on bottom these rules:
>>>>>
>>>>> # Log all other
>>>>> -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7
>>>>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
>>>>> -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7
>>>>>
>>>>> which rule would have catched these logged packets:
>>>>>
>>>>> [70223.386265] IPv6[FWD]: IN=sit1 OUT=br0
>>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123
>>>>> TC=0
>>>>> HOPLIMIT=60 FLOWLBL=617912 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>>>>> RES=0x00 ACK PSH URGP=0
>>>>> [70232.150311] IPv6[FWD]: IN=sit1 OUT=br0
>>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123
>>>>> TC=0
>>>>> HOPLIMIT=60 FLOWLBL=949795 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>>>>> RES=0x00 ACK PSH URGP=0
>>>>> [70249.740932] IPv6[FWD]: IN=sit1 OUT=br0
>>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr LEN=123
>>>>> TC=0
>>>>> HOPLIMIT=60 FLOWLBL=811062 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>>>>> RES=0x00 ACK PSH URGP=0
>>>>
>>>> those logged packets are from packets traversing your filter FORWARD
>>>> chain obviously no rule is matching which is why its triggering the
>>>> last
>>>> rule which is
>>>>
>>>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
>>>>
>>> of course, and which rule would I have to add bevor this rule, so that
>>> these are not logged ...?
>>
>> It depends on what you want to allow, if you want to allow all traffic
>> between interface sit1 and br0
>>
>> -I FORWARD -i sit1 -o br0 -j ACCEPT
>>
>> although the logged packets above show the source port being tcp/443
>> which means this connection came in br0 and out sit1 so you are
>> probably missing an established/related rule.
> this rules are after dropping invalid and before logging
>
> # Enable forwarding to IPv6-Tunnel interface
> -A FORWARD -i br0 -o sit1 -j ACCEPT
> # Enable established, related packets back through
> -I FORWARD -i sit1 -o br0 -m state --state ESTABLISHED,RELATED -j ACCEPT
>
> so I have the problem, that I cannot really know, why these packets were
> logged ...
>
>
without seeing your whole ruleset its pretty hard to tell or at least
see your filter forward rules as for the estabalished/related rule you
dont have to specify the input/output interfaces
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: IPv6: unknown packet logged ...
2017-08-22 15:40 ` Mark Coetser
@ 2017-08-22 15:52 ` Walter H.
2017-08-22 16:03 ` Mark Coetser
0 siblings, 1 reply; 8+ messages in thread
From: Walter H. @ 2017-08-22 15:52 UTC (permalink / raw)
To: Mark Coetser; +Cc: netfilter
[-- Attachment #1: Type: text/plain, Size: 5813 bytes --]
On 22.08.2017 17:40, Mark Coetser wrote:
>
> On 22/08/2017 17:36, Walter H. wrote:
>> On 22.08.2017 17:08, Mark Coetser wrote:
>>> On 22/08/2017 16:59, Walter H. wrote:
>>>> On Tue, August 22, 2017 16:47, Mark Coetser wrote:
>>>>> On 22/08/2017 16:42, Walter H. wrote:
>>>>>> Hello,
>>>>>>
>>>>>> I have these rules at the beginning of /etc/sysconfig/ip6tables
>>>>>>
>>>>>> # Filter all packets with state INVALID
>>>>>> -A INPUT -m state --state INVALID -j DROP
>>>>>> -A FORWARD -m state --state INVALID -j DROP
>>>>>> -A OUTPUT -m state --state INVALID -j DROP
>>>>>>
>>>>>> and on bottom these rules:
>>>>>>
>>>>>> # Log all other
>>>>>> -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7
>>>>>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
>>>>>> -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7
>>>>>>
>>>>>> which rule would have catched these logged packets:
>>>>>>
>>>>>> [70223.386265] IPv6[FWD]: IN=sit1 OUT=br0
>>>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr
>>>>>> LEN=123 TC=0
>>>>>> HOPLIMIT=60 FLOWLBL=617912 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>>>>>> RES=0x00 ACK PSH URGP=0
>>>>>> [70232.150311] IPv6[FWD]: IN=sit1 OUT=br0
>>>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr
>>>>>> LEN=123 TC=0
>>>>>> HOPLIMIT=60 FLOWLBL=949795 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>>>>>> RES=0x00 ACK PSH URGP=0
>>>>>> [70249.740932] IPv6[FWD]: IN=sit1 OUT=br0
>>>>>> SRC=2a00:1450:4001:081a:0000:0000:0000:200e DST=myipv6addr
>>>>>> LEN=123 TC=0
>>>>>> HOPLIMIT=60 FLOWLBL=811062 PROTO=TCP SPT=443 DPT=59073 WINDOW=1171
>>>>>> RES=0x00 ACK PSH URGP=0
>>>>>
>>>>> those logged packets are from packets traversing your filter FORWARD
>>>>> chain obviously no rule is matching which is why its triggering
>>>>> the last
>>>>> rule which is
>>>>>
>>>>> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
>>>>>
>>>> of course, and which rule would I have to add bevor this rule, so that
>>>> these are not logged ...?
>>>
>>> It depends on what you want to allow, if you want to allow all
>>> traffic between interface sit1 and br0
>>>
>>> -I FORWARD -i sit1 -o br0 -j ACCEPT
>>>
>>> although the logged packets above show the source port being tcp/443
>>> which means this connection came in br0 and out sit1 so you are
>>> probably missing an established/related rule.
>> this rules are after dropping invalid and before logging
>>
>> # Enable forwarding to IPv6-Tunnel interface
>> -A FORWARD -i br0 -o sit1 -j ACCEPT
>> # Enable established, related packets back through
>> -I FORWARD -i sit1 -o br0 -m state --state ESTABLISHED,RELATED -j ACCEPT
>>
>> so I have the problem, that I cannot really know, why these packets
>> were logged ...
>>
>>
>
> without seeing your whole ruleset its pretty hard to tell or at least
> see your filter forward rules as for the estabalished/related rule you
> dont have to specify the input/output interfaces
ip6tables-save results in this:
# Generated by ip6tables-save v1.4.7 on Tue Aug 22 17:44:04 2017
*filter
:INPUT DROP [0:0]
:FORWARD DROP [17:7812]
:OUTPUT DROP [0:0]
-A INPUT -i sit1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m rt --rt-type 0 -j DROP
-A INPUT -m state --state INVALID -j DROP
-A INPUT -s fe80::/10 -j ACCEPT
-A INPUT -d ff00::/8 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s myprefix::/64 -d fe80::/10 -i br0 -j ACCEPT
-A INPUT -s fe80::/10 -d ff02::1:2/128 -i br0 -p tcp -m tcp -m multiport
--dports 546,547 -j ACCEPT
-A INPUT -s fe80::/10 -d ff02::1:2/128 -i br0 -p udp -m udp -m multiport
--dports 546,547 -j ACCEPT
-A INPUT -i br0 -p ipv6-icmp -j ACCEPT
-A INPUT -i br0 -p udp -m udp --sport 32769:65535 --dport 33434:33523 -j
ACCEPT
-A INPUT -i br0 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A INPUT -i br0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i br0 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A INPUT -i br0 -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A INPUT -i br0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -i br0 -p tcp -m tcp --dport 3128 -m state --state NEW -j ACCEPT
-A INPUT -i sit1 -p ipv6-icmp -j ACCEPT
-A INPUT -i sit1 -p ipv6-icmp -j ACCEPT
-A INPUT -i sit1 -p udp -m udp --sport 32769:65535 --dport 33434:33523
-j ACCEPT
-A INPUT -i sit1 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A INPUT -i br0 -p udp -m udp --dport 5353 -j DROP
-A INPUT -i sit1 -p tcp -m tcp --dport 21 -j DROP
-A INPUT -i sit1 -p tcp -m tcp --dport 22 -j DROP
-A INPUT -i sit1 -p tcp -m tcp --dport 23 -j DROP
-A INPUT -i sit1 -p tcp -m tcp --dport 80 -j DROP
-A INPUT -i sit1 -p tcp -m tcp --dport 443 -j DROP
-A INPUT -i sit1 -p tcp -m tcp --dport 3128 -j DROP
-A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7
-A FORWARD -i sit1 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m rt --rt-type 0 -j DROP
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -i br0 -o br0 -j ACCEPT
-A FORWARD -i br0 -o sit1 -p tcp -m tcp --dport 25 -j LOG --log-prefix
"IPv6[FWD-SMTP(out)]: " --log-level 7
-A FORWARD -i br0 -o sit1 -p tcp -m tcp --dport 25 -j DROP
-A FORWARD -i br0 -o sit1 -j ACCEPT
-A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
-A OUTPUT -m rt --rt-type 0 -j DROP
-A OUTPUT -m state --state INVALID -j DROP
-A OUTPUT -s fe80::/10 -j ACCEPT
-A OUTPUT -d ff00::/8 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o br0 -j ACCEPT
-A OUTPUT -o sit1 -j ACCEPT
-A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7
COMMIT
# Completed on Tue Aug 22 17:44:04 2017
br0 is LAN port
sit1 is HE-tunnel port
Thanks,
Walter
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 3491 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: IPv6: unknown packet logged ...
2017-08-22 15:52 ` Walter H.
@ 2017-08-22 16:03 ` Mark Coetser
0 siblings, 0 replies; 8+ messages in thread
From: Mark Coetser @ 2017-08-22 16:03 UTC (permalink / raw)
To: Walter H.; +Cc: netfilter
On 22/08/2017 17:52, Walter H. wrote:
> ip6tables-save results in this:
>
> # Generated by ip6tables-save v1.4.7 on Tue Aug 22 17:44:04 2017
> *filter
> :INPUT DROP [0:0]
> :FORWARD DROP [17:7812]
> :OUTPUT DROP [0:0]
> -A INPUT -i sit1 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A INPUT -m rt --rt-type 0 -j DROP
> -A INPUT -m state --state INVALID -j DROP
> -A INPUT -s fe80::/10 -j ACCEPT
> -A INPUT -d ff00::/8 -j ACCEPT
> -A INPUT -i lo -j ACCEPT
> -A INPUT -i br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A INPUT -s myprefix::/64 -d fe80::/10 -i br0 -j ACCEPT
> -A INPUT -s fe80::/10 -d ff02::1:2/128 -i br0 -p tcp -m tcp -m multiport
> --dports 546,547 -j ACCEPT
> -A INPUT -s fe80::/10 -d ff02::1:2/128 -i br0 -p udp -m udp -m multiport
> --dports 546,547 -j ACCEPT
> -A INPUT -i br0 -p ipv6-icmp -j ACCEPT
> -A INPUT -i br0 -p udp -m udp --sport 32769:65535 --dport 33434:33523 -j
> ACCEPT
> -A INPUT -i br0 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
> -A INPUT -i br0 -p udp -m udp --dport 53 -j ACCEPT
> -A INPUT -i br0 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
> -A INPUT -i br0 -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
> -A INPUT -i br0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
> -A INPUT -i br0 -p tcp -m tcp --dport 3128 -m state --state NEW -j ACCEPT
> -A INPUT -i sit1 -p ipv6-icmp -j ACCEPT
> -A INPUT -i sit1 -p ipv6-icmp -j ACCEPT
> -A INPUT -i sit1 -p udp -m udp --sport 32769:65535 --dport 33434:33523
> -j ACCEPT
> -A INPUT -i sit1 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
> -A INPUT -i br0 -p udp -m udp --dport 5353 -j DROP
> -A INPUT -i sit1 -p tcp -m tcp --dport 21 -j DROP
> -A INPUT -i sit1 -p tcp -m tcp --dport 22 -j DROP
> -A INPUT -i sit1 -p tcp -m tcp --dport 23 -j DROP
> -A INPUT -i sit1 -p tcp -m tcp --dport 80 -j DROP
> -A INPUT -i sit1 -p tcp -m tcp --dport 443 -j DROP
> -A INPUT -i sit1 -p tcp -m tcp --dport 3128 -j DROP
> -A INPUT -j LOG --log-prefix "IPv6[IN]: " --log-level 7
> -A FORWARD -i sit1 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A FORWARD -m rt --rt-type 0 -j DROP
> -A FORWARD -m state --state INVALID -j DROP
> -A FORWARD -i br0 -o br0 -j ACCEPT
> -A FORWARD -i br0 -o sit1 -p tcp -m tcp --dport 25 -j LOG --log-prefix
> "IPv6[FWD-SMTP(out)]: " --log-level 7
> -A FORWARD -i br0 -o sit1 -p tcp -m tcp --dport 25 -j DROP
> -A FORWARD -i br0 -o sit1 -j ACCEPT
> -A FORWARD -j LOG --log-prefix "IPv6[FWD]: " --log-level 7
> -A OUTPUT -m rt --rt-type 0 -j DROP
> -A OUTPUT -m state --state INVALID -j DROP
> -A OUTPUT -s fe80::/10 -j ACCEPT
> -A OUTPUT -d ff00::/8 -j ACCEPT
> -A OUTPUT -o lo -j ACCEPT
> -A OUTPUT -o br0 -j ACCEPT
> -A OUTPUT -o sit1 -j ACCEPT
> -A OUTPUT -j LOG --log-prefix "IPv6[OUT]: " --log-level 7
> COMMIT
> # Completed on Tue Aug 22 17:44:04 2017
>
> br0 is LAN port
> sit1 is HE-tunnel port
>
> Thanks,
> Walter
>
Looks fine to me, unless conntrack isnt picking those packets up as
established/related to the initial connection.
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2017-08-22 16:03 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-08-22 14:42 IPv6: unknown packet logged Walter H.
2017-08-22 14:47 ` Mark Coetser
2017-08-22 14:59 ` Walter H.
2017-08-22 15:08 ` Mark Coetser
2017-08-22 15:36 ` Walter H.
2017-08-22 15:40 ` Mark Coetser
2017-08-22 15:52 ` Walter H.
2017-08-22 16:03 ` Mark Coetser
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.