This is the last tutorial in a series of iptables tutorials. Last week I’ve shown you how to persist iptables. The week before that I gave a short introduction. I now want to finish that series with talking about IPv6 and adding more (advanced) rules.

IPv6

iptables is not compatible with IPv6 because of the vastly different packets IPv6 has compared to IPv4. ip6tables, on the other hand, is compatible and handles the job just as fine as iptables. But having a seperate program for IPv6 means having seperate rules. And having different packets compared to IPv4 means having different rule options (for example ICMP vs ICMPv6).

Basically, you can close your server down with IPtables and then have it completely exposed with IPv6 because your ip6tables are not in order. To prevent this, you should add the rules you add to iptables to ip6tables as well, as far as they are compatible. Luckily, this is the case for most rules (except for source and destination addresses, naturally).

Working with ip6tables

To check your current ip6tables, run:

sudo ip6tables -L

Just as with IPtables, this should output:

mpkossen@host:~$ sudo ip6tables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
mpkossen@host:~$

Now, if we just add a rule to it like we did last times with iptables, it changes in exactly the same way. The difference between iptables and ip6tables is going to show when you add an ACCEPT or DROP rule with an IPv6 address in it.

So, let’s add a rule which does show that difference:

sudo ip6tables -A INPUT -s 2001:db8:1f0a:3ec::2 -j DROP

No worries, you’ve just blocked an IP address reserved for documentation purposes. If you list your ip6tables now, it should show you this:

mpkossen@host:~$ sudo ip6tables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       all      2001:db8:1f0a:3ec::2/128  anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
mpkossen@host:~$

As you see, not much difference between iptables and ip6tables. Basically just the addresses. The difference will show a bit more if you want to allow or block ICMP traffic, as there are some different protocols for IPv6. The rule of thumb, however, is to just add a ‘6’ after the ‘ip’ part in iptables commands and you should be good.

Persistence

So, where do we persist these rules? The infrastructure is already in place if you have followed my previous guide.

For CentOS, ip6tables rules are stored in /etc/sysconfig/ip6tables or saved with the following command:

sudo /etc/init.d/ip6tables save

On Ubuntu, with the persistent-iptables package, the ip6tables rules are saved in /etc/iptables/rules.v6. The save command is the same for iptables and ip6tables:

sudo /etc/init.d/iptables-persistent save

So, that’s it! Persisting ip6tables is just as easy as persisting iptables.

More rules

Allowing traffic to port 80 and 443 in a closed firewall (policy DROP) is quite straight-forward. The same applies to port 22 (SSH). Allowing ping, however, is something different. It doesn’t go to a certain port, so allowing it through the firewall requires more advances iptables rules.

To allow IPv4 ping through your firewall, run the following commands (or add them as rules to your persistence file):

sudo iptables -A INPUT -p icmp –icmp-type 8 -m state –state NEW -j ACCEPT
sudo iptables -A OUTPUT -p icmp –icmp-type 0 -m state –state ESTABLISHED,RELATED -j ACCEPT

There’s a couple of new things here. Let’s start at the beginning, with the first command:

sudo iptables -A INPUT -p icmp –icmp-type 8 -m state –state NEW -j ACCEPT

We add a rule to the INPUT chain for the ‘icmp’ protocol (-p). We then pass a protocol-related option (–icmp-type) which indicates which type of ICMP to allow. In this case it’s 8, which is an ‘echo’ packet, which is used for ping. Next is the ‘state’ extension, which is loaded with -m. This extension allows to require the connection to have a certain state (–state). In this case we allow NEW incoming connections.

So, summarized, we narrowed it down to allow packets that meets the following requirements:

• Protocol: ICMP
• ICMP type: 8
• Connection type: NEW

Which boils down to ping being allow to come in.

Next, we add the role to allow the response to go out, otherwise your server would seem down when you ping it from the outside:

sudo iptables -A OUTPUT -p icmp –icmp-type 0 -m state –state ESTABLISHED,RELATED -j ACCEPT

This rule is basically the same as the rule above, except for three things:

• It is added to the OUTPUT chain
• It allows ICMP type 0 (echo reply)
• It only allows ESTABLISHED or RELATED connections

An ‘echo reply’ packet is always sent in response to an ‘echo’ packet, so there should always be an established or related connection.

So, now you know how to allow incoming PING requests but also how to work with different protocols, options and connection states. If you use the iptables man-pages, you can allow virtually any type of packet through without allowing too much packets through. A nice challenge is allowing outgoing PING from a server with a closed firewall. Give it a shot! I’ll give you one hint: it’s easy.

As one commenter correctly noted (thanks, Olipro), the ‘state’ extension contains a subset of connection states from the ‘conntrack’ extension and has been marked as ‘obsolete’ from iptables 1.4.17 and up. While not many distributions have that version of iptables yet, it is worth to note how the ‘conntrack’ extension works compared to the ‘state’ extension. The following is an example of the above commands using the ‘conntrack’ extension:

sudo iptables -A INPUT -p icmp –icmp-type 8 -m conntrack –ctstate NEW -j ACCEPT
sudo iptables -A OUTPUT -p icmp –icmp-type 0 -m conntrack –ctstate ESTABLISHED,RELATED -j ACCEPT

The ‘conntrack’ extension is available for use in most versions of iptables and it is probably wise to start using it straight away. However, a lot of the available documentation online (including some of Netfilter’s official HOWTOs) still use the ‘state’ extension. Now you know both, but should keep in mind to use ‘conntrack’ rather than ‘state’ for compatibility with future iptables versions!

Final notes

There’s (still) a lot more to learn about iptables, so I suggest you read the man-pages for more information, as they are a good source of information. Also, in this case, Google is your friend. iptables is established software so there’s plenty to be found about it.

This concludes my series of iptables-related tutorials, which are part of a bigger series of security-related tutorials. I’ll be picking up on that later.

Up next week: how to create your own mail server with Virtualmin!

• Author
• Recent Posts

mpkossen

Maarten Kossen was the administrator of LowEndBox from 2013 to 2015, and brought many ideas and improvements to the website during his leadership. Today he is member of our community and LowEndTalk.

Latest posts by mpkossen (see all)

• How to Rapidly Install Java, OpenJDK & Oracle JDK on your VPS - December 14, 2015
• It’s been a great ride - December 14, 2015
• Cheap Windows VPS – $21/quarter 1GB KVM-based Windows VPS in 11 worldwide locations - November 30, 2015