Category Archives: ipv6

IPv6 without tunnel broker on linux

Posted on by
Reply

2 easy steps to make IPv6 work without a tunnel broker.

The technique used to make this work is called 6to4. You use a computer of somebody else to put your IPv6 traffic on the very big IPv6 network.

Okay, lets make things work:

Step 1

type this on your console to activate IPv6:
/sbin/ip tunnel add tun6to4 mode sit ttl 64 remote any local 38.107.179.236
/sbin/ip link set dev tun6to4 up
/sbin/ip -6 addr add 2002:266b:b3ec::/16 dev tun6to4
/sbin/ip -6 route add 2002::/3 via ::192.88.99.1 dev tun6to4 metric 1

Explanation: 38.107.179.236 is your ip adress from your internet provider. It is used to calculate a special part of the 2002:266b:b3ec::/16 IPv6 address as you see above. Your ip address is converted into hex and inserted as the 266b:b3ec part in this 2002: thingy.
Your IPv6 adress on the very big IPv6 network is now: 2002:266b:b3ec::

Step 2

Test your fresh IPv6 connection.
Type ping6 -nc4 www.ipv6.org in your linux console. It should say something like this:
PING www.ipv6.org(2001:6b0:1:ea:a00:20ff:fe8f:708f) 56 data bytes
64 bytes from 2001:6b0:1:ea:a00:20ff:fe8f:708f: icmp_seq=1 ttl=241 time=90.7 ms
64 bytes from 2001:6b0:1:ea:a00:20ff:fe8f:708f: icmp_seq=2 ttl=241 time=97.4 ms
64 bytes from 2001:6b0:1:ea:a00:20ff:fe8f:708f: icmp_seq=3 ttl=241 time=91.4 ms
64 bytes from 2001:6b0:1:ea:a00:20ff:fe8f:708f: icmp_seq=4 ttl=241 time=89.4 ms
Congrats if you seen no errors, you now have a working IPv6 connection. Do something usefull with it.

If you see errors.... read on, maybe I know how how to fix it.

Errors?

What to do if you get errors in any of the steps above.

Here are some things you can check:

  • You must have the iproute2 tools (check with /sbin/ip -V)
  • You must have IPv6 support in your linux kernel (check if /proc/sys/net/ipv6 exists)
  • If your public ip is not 38.107.179.236 then use the ip address on your eth0 interface of your computer (or the interface connected to the internet), take this ip and use it instead of 38.107.179.236. You do not have to recalculate the special 266b:b3ec hex part of the 2002:266b:b3ec.
  • If it still does not work, check if you have a router installed. If you do, you must configure your router to forward ip protocol 41 (NOT port 41) to your linux computer. Don't know what I'm talking about? Here is something easyer to do: configure your routers DMZ to point to your linux computer, but be sure to setup a IPv4 firewall because your linux computer is now open for the whole world.

IPv6 linux Firewall with subnet protection

Posted on by
Reply

Hi, this is my IPv6 firewall I use on Linux. Maybe you can do something with it:

#!/bin/bash
# DiNo, http://www.atoomnet.net/
IPTABLES="/sbin/ip6tables"
# Flush everything
echo "flush"
${IPTABLES} -F INPUT
${IPTABLES} -F OUTPUT
${IPTABLES} -F FORWARD
${IPTABLES} -F
${IPTABLES} -X extIN
${IPTABLES} -X intIN
${IPTABLES} -X extOUT
${IPTABLES} -X intOUT
${IPTABLES} -X ext2int
${IPTABLES} -X int2ext
# Default Policies
echo "policies"
${IPTABLES} -t filter -P INPUT DROP
${IPTABLES} -t filter -P OUTPUT DROP
${IPTABLES} -t filter -P FORWARD DROP
#loopback can do everything
${IPTABLES} -A INPUT   -i lo -j ACCEPT
${IPTABLES} -A FORWARD -i lo -j ACCEPT
${IPTABLES} -A OUTPUT  -i lo -j ACCEPT
# chain of all public incoming ipv6 interfaces
echo "extIN"
${IPTABLES} -N extIN
${IPTABLES} -A INPUT -i sixxs   -j extIN
${IPTABLES} -A INPUT -i tun6to4 -j extIN
# chain of all public outgoing ipv6 interfaces
echo "extOUT"
${IPTABLES} -N extOUT
${IPTABLES} -A OUTPUT -o sixxs   -j extOUT
${IPTABLES} -A OUTPUT -o tun6to4 -j extOUT
# chain of all internal incoming ipv6 interfaces
echo "intIN"
${IPTABLES} -N intIN
${IPTABLES} -A INPUT -i bridge0  -j intIN
${IPTABLES} -A INPUT -i atoomnet -j intIN
${IPTABLES} -A INPUT -i tap0     -j intIN
# chain of all internal outgoing ipv6 interfaces
echo "intOUT"
${IPTABLES} -N intOUT
${IPTABLES} -A OUTPUT -o bridge0  -j intOUT
${IPTABLES} -A OUTPUT -o atoomnet -j intOUT
${IPTABLES} -A OUTPUT -o tap0     -j intOUT
# chain of external to internal forward interfaces
echo "ext2int"
${IPTABLES} -N ext2int
${IPTABLES} -A FORWARD -i sixxs -j ext2int
${IPTABLES} -A FORWARD -i tun6to4 -j ext2int
# chain of internal to external forward interfaces
echo "int2ext"
${IPTABLES} -N int2ext
${IPTABLES} -A FORWARD -i bridge0 -j int2ext
#logging
${IPTABLES} -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "INPUT_DROP:"
${IPTABLES} -A OUTPUT  -m limit --limit 10/minute -j LOG --log-prefix "OUTPUT_DROP:"
${IPTABLES} -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "FORWARD_DROP:"
#Tha Rulez...
# allow all internal hosts to this server
echo "intIN rules"
${IPTABLES} -A intIN -j ACCEPT
# allow outgoing traffic to internal hosts
echo "intOUT rules"
${IPTABLES} -A intOUT -j ACCEPT
# allow outgoing traffic to external hosts
echo "extOUT rules"
${IPTABLES} -A extOUT -j ACCEPT
# allow incoming traffic
echo "extIN rules"
${IPTABLES} -A extIN -p tcp --dport 22 -j ACCEPT
${IPTABLES} -A extIN -p tcp --dport 80 -j ACCEPT
${IPTABLES} -A extIN -p tcp --dport 25 -j ACCEPT
${IPTABLES} -A extIN -p udp --dport 53 -j ACCEPT
${IPTABLES} -A extIN -p tcp --dport 53 -j ACCEPT
${IPTABLES} -A extIN -p tcp ! --syn -j ACCEPT
${IPTABLES} -A extIN -p icmpv6 -j ACCEPT --match limit --limit 30/minute
${IPTABLES} -A extIN -m limit --limit 10/minute -j LOG --log-prefix "extIN_DROP:"
${IPTABLES} -A extIN -j DROP
# allow all internal hosts to go play outside
echo "int2ext rules"
${IPTABLES} -A int2ext -j ACCEPT
# allow all external hosts to go inside
echo "ext2int rules"
${IPTABLES} -A ext2int -p tcp ! --syn -j ACCEPT
${IPTABLES} -A ext2int -p icmpv6 -j ACCEPT --match limit --limit 30/minute
${IPTABLES} -A ext2int -m limit --limit 10/minute -j LOG --log-prefix "ext2int_DROP:"
${IPTABLES} -A ext2int -j DROP