ip6tables blocking output traffic
- by jmccrohan
My OpenVZ VPS is blocking outbound IPv6 traffic, but correctly filtering inbound IPv6 traffic.
Below is my ip6tables-restore script.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 51413 -j ACCEPT
-A INPUT -p udp -m udp --dport 51413 -j ACCEPT
-A INPUT -m limit --limit 5/min
-A INPUT -j REJECT --reject-with icmp6-adm-prohibited
-A FORWARD -j ACCEPT
-A OUTPUT -j ACCEPT
COMMIT
ICMPv6 traffic is still able to pass both inbound and outbound.
When I flush these rules using -F, outbound traffic flows fine.
What am I missing here?
EDIT: It appears that ip6tables is marking ESTABLISHED packets as INVALID. Consequently, the outbound traffic is NOT actually being blocked. The reply packets are not allowed inbound again, hence appearing like blocked outbound traffic.
Allowing INVALID packets inbound solves the outbound issue, but also renders the inbound filter useless.
