ip6tables problem

[Asfand Yar Qazi]

On 12/20/06, Asfand Yar Qazi <ayqazi at gmail.com> wrote:
> On 12/20/06, Petr Pisar <xpisar at fi.muni.cz> wrote:
> > On 2006-12-20, Asfand Yar Qazi <ayqazi at gmail.com> wrote:
> > > On 12/20/06, Petr Pisar <xpisar at fi.muni.cz> wrote:
> > >> On 2006-12-20, Asfand Yar Qazi <ayqazi at gmail.com> wrote:
> > >> > I have an ipv6 tunnel on the device 'tunbt6', and another interface on
> > >> > eth0 to the rest of my network.
> > >> >
> > >> > When I enter the following commands:
> > >> >
> > >> > ip6tables -N filter6
> > >> > ip6tables -A filter6 -m state --state NEW -i ! tunbt6 -j ACCEPT
> > >> > ip6tables -A filter6 -m state --state ESTABLISHED,RELATED -j ACCEPT
> > >> > ip6tables -A filter6 -j REJECT
> > >> >
> > >> > ip6tables -A INPUT -j filter6
> > >> > ip6tables -A FORWARD -j filter6
> > >> >
> > >> >
> > >> > It doesn't work!  I can't even ping6 the machine over eth0 from my
> > >> > other computer connected to the same ethernet segment!
> > >> >
> > >>
> > >> IP6 uses ICMP6 for link level address resolution (like IP4 uses ARP).
> > >> Therefore you need to accept NEW icmp6 packets. At least some types.
> > >> Read draft-ietf-v6ops-icmpv6-filtering-bcp-01.txt (can be found on IETF
> > >> FTP server) for more detailes.
> > >>
> > >
> > > I'll just let in all icmp6 packets.  Now to figure out how to do that...
> > >
> > ip6tables -I filter6 -p icmpv6 -j ACCEPT
> >
>
> Yep, figured that out, thanks :-)
>

Argh - still no luck.  I can now ping6 remote destinations, but I
can't, for example, establish ssh connections.  I can't even ssh to
another local box over eth0!

To summarise, here's where it stands:

ip6tables -N filter6
ip6tables -A filter6 -p icmpv6 -j ACCEPT
ip6tables -A filter6 -m state --state NEW -i ! tunbt6 -j ACCEPT
ip6tables -A filter6 -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A filter6 -j REJECT

ip6tables -A INPUT -j filter6
ip6tables -A FORWARD -j filter6

To force it to let me ssh around to and from my router box, I am
forced to do this:
ip6tables -N filter6
ip6tables -A filter6 -i eth0 -j ACCEPT
ip6tables -A filter6 -i lo -j ACCEPT
ip6tables -A filter6 -p icmpv6 -j ACCEPT
ip6tables -A filter6 -m state --state NEW -i ! tunbt6 -j ACCEPT
ip6tables -A filter6 -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A filter6 -j REJECT

ip6tables -A INPUT -j filter6
ip6tables -A FORWARD -j filter6

Anybody know what's happening?