# [solved] ipv6 - will it double the iptables rules

## toralf

/me wonders if I had to duplicate nearly every rule in my firewall script when I enable ipv6 in the kernel ?Last edited by toralf on Sat May 25, 2013 1:45 pm; edited 1 time in total

----------

## NeddySeagoon

toralf,

Yes, if you intend ti use it to connect to the outside world.

I don't run a IPv6 tunnel and my ISP does not provide native IPv6 (yet) so I can safely play with IPv6 on my local network, knowing its isolated.

----------

## toralf

 *NeddySeagoon wrote:*   

> I don't run a IPv6 tunnel and my ISP does not provide native IPv6 (yet) so I can safely play with IPv6 on my local network, knowing its isolated.

 yes - that answered my next question. Thx

----------

## Hu

If you want to be paranoid, add some basic ip6tables rules to filter traffic not coming from the LAN, so that you do not suddenly get global IPv6 connectivity due to an ISP configuration change.

----------

## toralf

 *Hu wrote:*   

> If you want to be paranoid, 

 gladly *Quote:*   

> add some basic ip6tables rules to filter traffic not coming from the LAN

 errm, do you have such basic rules at hand ?

----------

## Hu

Set the ip6tables policy to DROP: ip6tables -P INPUT DROP.  Then, for each IPv6 subnet you expect to be using, ip6tables -A INPUT -s subnet -j ACCEPT.  You might also need to permit some forms of ipv6-icmp to allow host address discovery.

----------

## Ant P.

 *toralf wrote:*   

> errm, do you have such basic rules at hand ?

 

```
ip6tables -A INPUT -s 2000::/3 -j REJECT

ip6tables -A OUTPUT -d 2000::/3 -j REJECT
```

That will block all access to the outside internet while not breaking things like LAN, local multicast or localhost.

----------

## toralf

Thx for the input, this should now work I think : http://bpaste.net/show/102202/

Now /me wondering how to tell the LOG target to shrink the ipv6 address :

```
kernel: MYFW6_OUT= IN= OUT=lo SRC=0000:0000:0000:0000:0000:0000:0000:0001 DST=0000:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=11624 SEQ=12
```

using the ":" character ?

----------

