ip6tables blocking output traffic

Posted by jmccrohan on Server Fault See other posts from Server Fault or by jmccrohan
Published on 2011-06-29T16:27:27Z Indexed on 2011/06/30 0:23 UTC
Read the original article Hit count: 119

Filed under:
|
|
|

My OpenVZ VPS is blocking outbound IPv6 traffic, but correctly filtering inbound IPv6 traffic.

Below is my ip6tables-restore script.

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 51413 -j ACCEPT
-A INPUT -p udp -m udp --dport 51413 -j ACCEPT
-A INPUT -m limit --limit 5/min
-A INPUT -j REJECT --reject-with icmp6-adm-prohibited
-A FORWARD -j ACCEPT
-A OUTPUT -j ACCEPT
COMMIT

ICMPv6 traffic is still able to pass both inbound and outbound.

When I flush these rules using -F, outbound traffic flows fine.

What am I missing here?

EDIT: It appears that ip6tables is marking ESTABLISHED packets as INVALID. Consequently, the outbound traffic is NOT actually being blocked. The reply packets are not allowed inbound again, hence appearing like blocked outbound traffic. Allowing INVALID packets inbound solves the outbound issue, but also renders the inbound filter useless.

© Server Fault or respective owner

Related posts about linux

Related posts about firewall