IPv6 and nftables firewall

[NicholasBarnes]

Further to post: https://www.3cx.com/community/threads/something-is-wrong-in-nftables-slaac-not-working.88205/

The default firewall ruleset doesn't work with some IPv6 installations. This is for two reasons - firstly because multicast packets are dropped before the ICMPv6 accept rules and secondly there are some ICMPv6 types missing from the accept list.

We use the following configuration: https://www.debau.ch/2023/06/ipv6-compatible-firewall-for-3cx which works well for us.

 

[SweetAction]

You should open a bug report with 3CX and post this.

 

[Nathan@Voxtelesys]

I had case #792859/#30564 open with R&D about this in 2021.

For us, mobile app clients would not ring and web-meetings would not launch ("connecting") when using Dual stack and the ruleset provided in ISO.

From what I understand, table inet filter is for combined ipv4 and ipv6 rules. When I use a separate table ip6 filter in addition to table inet filter, IPv6 rules do not cause issues with the webmeeting connecting/mobile clients not ringing. -- Keep in mind I have not done extensive testing of this.

See both "typical workstation" examples:

https://wiki.gentoo.org/wiki/Nftables/Examples

IPV6 Rules that were in the table inet filter from initial V18 ISO release can be put into the table ip6 filter.

Thanks for sharing your blog post, I look forward to trying those rules sometime.