We are using IPv6 for our customers now, but new installation using Debian 10 does not get an IPv6.
Old installation with Debian 9 are working fine.
Everything is fine in the network config, I found out that if I flush all ruleset in NFT it is working fine again.
So, something is wrong there :
I tried to replace all IPv6 rules with this simple one :
But it does not help either.
Any idea ?
Meanwhile I removed all the rules and use a hardware firewall, but I would love too fix NFT anyway.
Best regards,
Marc
Old installation with Debian 9 are working fine.
Everything is fine in the network config, I found out that if I flush all ruleset in NFT it is working fine again.
So, something is wrong there :
#!/usr/sbin/nft -f
# vim:set ts=4:
# You can find examples in /usr/share/nftables/.
# Clear all prior state
flush ruleset
# Basic IPv4/IPv6 stateful firewall for server/workstation.
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
iifname lo accept comment "Accept any localhost traffic"
ct state { established, related } accept comment "Accept traffic originated from us"
ip daddr 224.0.1.75 counter accept comment "Accept SIP Multicast"
fib daddr type broadcast drop comment "Drop other broadcast"
fib daddr type multicast drop comment "Drop other multicast"
fib daddr type anycast drop comment "Drop other anycast"
ip daddr 224.0.0.0/4 drop comment "Drop DVMRP"
ct state invalid drop comment "Drop invalid connections"
tcp dport 113 reject with icmpx type port-unreachable comment "Reject AUTH to make it fail fast"
# 3CX PhoneSystem specific
tcp dport { 80,443,5000,5001,5015,5060,5061,5090 } ct state new counter accept comment "Accept 3CX PhoneSystem TCP ports"
udp dport { 69,5060,5090,7000-10999 } counter accept comment "Accept 3CX PhoneSystem UDP ports"
# Other services specific
udp dport { 137,138 } counter accept comment "Accept NetBIOS"
tcp dport { 139,445 } counter accept comment "Accept TCP/IP MS Networking"
# SSH Bruteforce blacklist
tcp dport ssh ct state new limit rate 15/minute accept comment "Avoid brute force on SSH"
# ICMPv4
ip protocol icmp icmp type {
echo-reply, # type 0
destination-unreachable, # type 3
time-exceeded, # type 11
parameter-problem, # type 12
} accept comment "Accept ICMP"
ip protocol icmp icmp type echo-request limit rate 1/second accept comment "Accept max 1 ping per second"
# ICMPv6
ip6 nexthdr icmpv6 icmpv6 type {
destination-unreachable, # type 1
packet-too-big, # type 2
time-exceeded, # type 3
parameter-problem, # type 4
echo-reply, # type 129
} accept comment "Accept basic IPv6 functionality"
ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate 1/second accept comment "Accept max 1 ping per second"
ip6 nexthdr icmpv6 icmpv6 type {
nd-router-solicit, # type 133
nd-router-advert, # type 134
nd-neighbor-solicit, # type 135
nd-neighbor-advert, # type 136
} ip6 hoplimit 255 accept comment "Allow IPv6 SLAAC"
ip6 nexthdr icmpv6 icmpv6 type {
mld-listener-query, # type 130
mld-listener-report, # type 131
mld-listener-reduction, # type 132
mld2-listener-report, # type 143
} ip6 saddr fe80::/10 accept comment "Allow IPv6 multicast listener discovery on link-local"
}
chain forward {
type filter hook forward priority 0; policy drop;
}
chain output {
type filter hook output priority 0; policy accept;
}
}
I tried to replace all IPv6 rules with this simple one :
ip6 nexthdr icmpv6 counter accept comment "accept all ICMP types"But it does not help either.
Any idea ?
Meanwhile I removed all the rules and use a hardware firewall, but I would love too fix NFT anyway.
Best regards,
Marc
