IPv6 Conference 2008 and DNS

How to disable IPv6 networking

Our policy and network configuration does not requires IPv6 support in RHEL / CentOS / Fedora Linux. How do I prevent the kernel module from loading at boot time and disable IPv6 networking?

You can easily prevent the kernel module from loading by updating the following two files:

/etc/modprobe.conf - Kernel driver configuration file.

/etc/sysconfig/network - RHEL / CentOS networking configuration file.

/etc/modprobe.conf

Edit /etc/modprobe.conf, enter:

# vi /etc/modprobe.conf

Append the following line:

install ipv6 /bin/true

Save and close the file.

/etc/sysconfig/network

Edit /etc/sysconfig/network, enter:

# vi /etc/sysconfig/network

Update / add as follows:

NETWORKING_IPV6=no

IPV6INIT=no

Save and close the file. Restart networking service

# service network restart

# rmmod ipv6

Alternatively, simple reboot the box:

# reboot

Verify IPv6 is disabled, enter:

# lsmod | grep ipv6

# /sbin/ifconfig

IPv6 ip6tables Firewall Configuration

know how to configure iptables (IPv4) host-based firewall using Netfilter. How do I configure ip6tables for basic filtering IPv6 packets?

Ip6tables is used to set up, maintain, and inspect the tables of IPv6 packet filter rules in the Linux kernel. The following configuration is tested on:

CentOS Linux 5.x

Red Hat Enterprise Linux 5.x

Fedora Linux 10 and 11.

Type the following command to see current ipv6 firewall configuration:

# ip6tables -nL --line-numbers

If no rules appear, activate IPv6 firewall and ensure that it starts at boot by typing the following command:

# chkconfig ip6tables on

# /etc/sysconfig/ip6tables

Edit /etc/sysconfig/ip6tables, enter:

# vi /etc/sysconfig/ip6tables

You will see default rules as follows:

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:RH-Firewall-1-INPUT - [0:0]

-A INPUT -j RH-Firewall-1-INPUT

-A FORWARD -j RH-Firewall-1-INPUT

-A RH-Firewall-1-INPUT -i lo -j ACCEPT

-A RH-Firewall-1-INPUT -p icmpv6 -j ACCEPT

-A RH-Firewall-1-INPUT -p 50 -j ACCEPT

-A RH-Firewall-1-INPUT -p 51 -j ACCEPT

-A RH-Firewall-1-INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT

-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT

-A RH-Firewall-1-INPUT -p udp -m udp --dport 32768:61000 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 32768:61000 ! --syn -j ACCEPT

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j ACCEPT

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited

COMMIT

To open port 80 (Http server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 80 -j ACCEPT

To open port 53 (DNS Server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 53 -j ACCEPT

-A RH-Firewall-1-INPUT -m udp -p tcp --dport 53 -j ACCEPT

To open port 443 (Https server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 443 -j ACCEPT

To open port 25 (smtp server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 25 -j ACCEPT

To log before dropping all packets that are not explicitly accepted by previous rules, change the final lines from:

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited

COMMIT

To:

-A RH-Firewall-1-INPUT -j LOG

-A RH-Firewall-1-INPUT -j DROP

COMMIT

Save and close the file. Restart ip6tables firewall:

# service ip6tables restart

# ip6tables -vnL --line-numbers

Sample Outputs:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)

num   pkts bytes target     prot opt in     out     source               destination

1    42237 3243K RH-Firewall-1-INPUT  all      *      *       ::/0                 ::/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

num   pkts bytes target     prot opt in     out     source               destination

1        0     0 RH-Firewall-1-INPUT  all      *      *       ::/0                 ::/0

Chain OUTPUT (policy ACCEPT 12557 packets, 2042K bytes)

num   pkts bytes target     prot opt in     out     source               destination

Chain RH-Firewall-1-INPUT (2 references)

num   pkts bytes target     prot opt in     out     source               destination

1        6   656 ACCEPT     all      lo     *       ::/0                 ::/0

2    37519 2730K ACCEPT     icmpv6    *      *       ::/0                 ::/0

3        0     0 ACCEPT     esp      *      *       ::/0                 ::/0

4        0     0 ACCEPT     ah       *      *       ::/0                 ::/0

5      413 48385 ACCEPT     udp      *      *       ::/0                 ff02::fb/128       udp dpt:5353

6        0     0 ACCEPT     udp      *      *       ::/0                 ::/0               udp dpt:631

7        0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:631

8      173 79521 ACCEPT     udp      *      *       ::/0                 ::/0               udp dpts:32768:61000

9        0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpts:32768:61000 flags:!0x16/0x02

10       0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:22

11       0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:80

12       0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:53

13    4108  380K ACCEPT     udp      *      *       ::/0                 ::/0               udp dpt:53

14      18  4196 REJECT     all      *      *       ::/0                 ::/0               reject-with icmp6-adm-prohibited

I know how to configure iptables (IPv4) host-based firewall using Netfilter. How do I configure ip6tables for basic filtering IPv6 packets?

Ip6tables is used to set up, maintain, and inspect the tables of IPv6 packet filter rules in the Linux kernel. The following configuration is tested on:

CentOS Linux 5.x

Red Hat Enterprise Linux 5.x

Fedora Linux 10 and 11.

Type the following command to see current ipv6 firewall configuration:

# ip6tables -nL --line-numbers

If no rules appear, activate IPv6 firewall and ensure that it starts at boot by typing the following command:

# chkconfig ip6tables on

# /etc/sysconfig/ip6tables

Edit /etc/sysconfig/ip6tables, enter:

# vi /etc/sysconfig/ip6tables

You will see default rules as follows:

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:RH-Firewall-1-INPUT - [0:0]

-A INPUT -j RH-Firewall-1-INPUT

-A FORWARD -j RH-Firewall-1-INPUT

-A RH-Firewall-1-INPUT -i lo -j ACCEPT

-A RH-Firewall-1-INPUT -p icmpv6 -j ACCEPT

-A RH-Firewall-1-INPUT -p 50 -j ACCEPT

-A RH-Firewall-1-INPUT -p 51 -j ACCEPT

-A RH-Firewall-1-INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT

-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT

-A RH-Firewall-1-INPUT -p udp -m udp --dport 32768:61000 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 32768:61000 ! --syn -j ACCEPT

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j ACCEPT

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited

COMMIT

To open port 80 (Http server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 80 -j ACCEPT

To open port 53 (DNS Server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 53 -j ACCEPT

-A RH-Firewall-1-INPUT -m udp -p tcp --dport 53 -j ACCEPT

To open port 443 (Https server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 443 -j ACCEPT

To open port 25 (smtp server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 25 -j ACCEPT

To log before dropping all packets that are not explicitly accepted by previous rules, change the final lines from:

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited

COMMIT

To:

-A RH-Firewall-1-INPUT -j LOG

-A RH-Firewall-1-INPUT -j DROP

COMMIT

Save and close the file. Restart ip6tables firewall:

# service ip6tables restart

# ip6tables -vnL --line-numbers

Sample Outputs:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)

num   pkts bytes target     prot opt in     out     source               destination

1    42237 3243K RH-Firewall-1-INPUT  all      *      *       ::/0                 ::/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

num   pkts bytes target     prot opt in     out     source               destination

1        0     0 RH-Firewall-1-INPUT  all      *      *       ::/0                 ::/0

Chain OUTPUT (policy ACCEPT 12557 packets, 2042K bytes)

num   pkts bytes target     prot opt in     out     source               destination

Chain RH-Firewall-1-INPUT (2 references)

num   pkts bytes target     prot opt in     out     source               destination

1        6   656 ACCEPT     all      lo     *       ::/0                 ::/0

2    37519 2730K ACCEPT     icmpv6    *      *       ::/0                 ::/0

3        0     0 ACCEPT     esp      *      *       ::/0                 ::/0

4        0     0 ACCEPT     ah       *      *       ::/0                 ::/0

5      413 48385 ACCEPT     udp      *      *       ::/0                 ff02::fb/128       udp dpt:5353

6        0     0 ACCEPT     udp      *      *       ::/0                 ::/0               udp dpt:631

7        0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:631

8      173 79521 ACCEPT     udp      *      *       ::/0                 ::/0               udp dpts:32768:61000

9        0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpts:32768:61000 flags:!0x16/0x02

10       0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:22

11       0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:80

12       0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:53

13    4108  380K ACCEPT     udp      *      *       ::/0                 ::/0               udp dpt:53

14      18  4196 REJECT     all      *      *       ::/0                 ::/0               reject-with icmp6-adm-prohibited

IPv6 ip6tables Firewall Configuration

know how to configure iptables (IPv4) host-based firewall using Netfilter. How do I configure ip6tables for basic filtering IPv6 packets?

Ip6tables is used to set up, maintain, and inspect the tables of IPv6 packet filter rules in the Linux kernel. The following configuration is tested on:

CentOS Linux 5.x

Red Hat Enterprise Linux 5.x

Fedora Linux 10 and 11.

Type the following command to see current ipv6 firewall configuration:

# ip6tables -nL --line-numbers

If no rules appear, activate IPv6 firewall and ensure that it starts at boot by typing the following command:

# chkconfig ip6tables on

# /etc/sysconfig/ip6tables

Edit /etc/sysconfig/ip6tables, enter:

# vi /etc/sysconfig/ip6tables

You will see default rules as follows:

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:RH-Firewall-1-INPUT - [0:0]

-A INPUT -j RH-Firewall-1-INPUT

-A FORWARD -j RH-Firewall-1-INPUT

-A RH-Firewall-1-INPUT -i lo -j ACCEPT

-A RH-Firewall-1-INPUT -p icmpv6 -j ACCEPT

-A RH-Firewall-1-INPUT -p 50 -j ACCEPT

-A RH-Firewall-1-INPUT -p 51 -j ACCEPT

-A RH-Firewall-1-INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT

-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT

-A RH-Firewall-1-INPUT -p udp -m udp --dport 32768:61000 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 32768:61000 ! --syn -j ACCEPT

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j ACCEPT

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited

COMMIT

To open port 80 (Http server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 80 -j ACCEPT

To open port 53 (DNS Server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 53 -j ACCEPT

-A RH-Firewall-1-INPUT -m udp -p tcp --dport 53 -j ACCEPT

To open port 443 (Https server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 443 -j ACCEPT

To open port 25 (smtp server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 25 -j ACCEPT

To log before dropping all packets that are not explicitly accepted by previous rules, change the final lines from:

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited

COMMIT

To:

-A RH-Firewall-1-INPUT -j LOG

-A RH-Firewall-1-INPUT -j DROP

COMMIT

Save and close the file. Restart ip6tables firewall:

# service ip6tables restart

# ip6tables -vnL --line-numbers

Sample Outputs:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)

num   pkts bytes target     prot opt in     out     source               destination

1    42237 3243K RH-Firewall-1-INPUT  all      *      *       ::/0                 ::/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

num   pkts bytes target     prot opt in     out     source               destination

1        0     0 RH-Firewall-1-INPUT  all      *      *       ::/0                 ::/0

Chain OUTPUT (policy ACCEPT 12557 packets, 2042K bytes)

num   pkts bytes target     prot opt in     out     source               destination

Chain RH-Firewall-1-INPUT (2 references)

num   pkts bytes target     prot opt in     out     source               destination

1        6   656 ACCEPT     all      lo     *       ::/0                 ::/0

2    37519 2730K ACCEPT     icmpv6    *      *       ::/0                 ::/0

3        0     0 ACCEPT     esp      *      *       ::/0                 ::/0

4        0     0 ACCEPT     ah       *      *       ::/0                 ::/0

5      413 48385 ACCEPT     udp      *      *       ::/0                 ff02::fb/128       udp dpt:5353

6        0     0 ACCEPT     udp      *      *       ::/0                 ::/0               udp dpt:631

7        0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:631

8      173 79521 ACCEPT     udp      *      *       ::/0                 ::/0               udp dpts:32768:61000

9        0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpts:32768:61000 flags:!0x16/0x02

10       0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:22

11       0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:80

12       0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:53

13    4108  380K ACCEPT     udp      *      *       ::/0                 ::/0               udp dpt:53

14      18  4196 REJECT     all      *      *       ::/0                 ::/0               reject-with icmp6-adm-prohibited

I know how to configure iptables (IPv4) host-based firewall using Netfilter. How do I configure ip6tables for basic filtering IPv6 packets?

Ip6tables is used to set up, maintain, and inspect the tables of IPv6 packet filter rules in the Linux kernel. The following configuration is tested on:

CentOS Linux 5.x

Red Hat Enterprise Linux 5.x

Fedora Linux 10 and 11.

Type the following command to see current ipv6 firewall configuration:

# ip6tables -nL --line-numbers

If no rules appear, activate IPv6 firewall and ensure that it starts at boot by typing the following command:

# chkconfig ip6tables on

# /etc/sysconfig/ip6tables

Edit /etc/sysconfig/ip6tables, enter:

# vi /etc/sysconfig/ip6tables

You will see default rules as follows:

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:RH-Firewall-1-INPUT - [0:0]

-A INPUT -j RH-Firewall-1-INPUT

-A FORWARD -j RH-Firewall-1-INPUT

-A RH-Firewall-1-INPUT -i lo -j ACCEPT

-A RH-Firewall-1-INPUT -p icmpv6 -j ACCEPT

-A RH-Firewall-1-INPUT -p 50 -j ACCEPT

-A RH-Firewall-1-INPUT -p 51 -j ACCEPT

-A RH-Firewall-1-INPUT -p udp --dport 5353 -d ff02::fb -j ACCEPT

-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT

-A RH-Firewall-1-INPUT -p udp -m udp --dport 32768:61000 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 32768:61000 ! --syn -j ACCEPT

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j ACCEPT

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited

COMMIT

To open port 80 (Http server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 80 -j ACCEPT

To open port 53 (DNS Server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 53 -j ACCEPT

-A RH-Firewall-1-INPUT -m udp -p tcp --dport 53 -j ACCEPT

To open port 443 (Https server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 443 -j ACCEPT

To open port 25 (smtp server) add the following before COMMIT line:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 25 -j ACCEPT

To log before dropping all packets that are not explicitly accepted by previous rules, change the final lines from:

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-adm-prohibited

COMMIT

To:

-A RH-Firewall-1-INPUT -j LOG

-A RH-Firewall-1-INPUT -j DROP

COMMIT

Save and close the file. Restart ip6tables firewall:

# service ip6tables restart

# ip6tables -vnL --line-numbers

Sample Outputs:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)

num   pkts bytes target     prot opt in     out     source               destination

1    42237 3243K RH-Firewall-1-INPUT  all      *      *       ::/0                 ::/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

num   pkts bytes target     prot opt in     out     source               destination

1        0     0 RH-Firewall-1-INPUT  all      *      *       ::/0                 ::/0

Chain OUTPUT (policy ACCEPT 12557 packets, 2042K bytes)

num   pkts bytes target     prot opt in     out     source               destination

Chain RH-Firewall-1-INPUT (2 references)

num   pkts bytes target     prot opt in     out     source               destination

1        6   656 ACCEPT     all      lo     *       ::/0                 ::/0

2    37519 2730K ACCEPT     icmpv6    *      *       ::/0                 ::/0

3        0     0 ACCEPT     esp      *      *       ::/0                 ::/0

4        0     0 ACCEPT     ah       *      *       ::/0                 ::/0

5      413 48385 ACCEPT     udp      *      *       ::/0                 ff02::fb/128       udp dpt:5353

6        0     0 ACCEPT     udp      *      *       ::/0                 ::/0               udp dpt:631

7        0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:631

8      173 79521 ACCEPT     udp      *      *       ::/0                 ::/0               udp dpts:32768:61000

9        0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpts:32768:61000 flags:!0x16/0x02

10       0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:22

11       0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:80

12       0     0 ACCEPT     tcp      *      *       ::/0                 ::/0               tcp dpt:53

13    4108  380K ACCEPT     udp      *      *       ::/0                 ::/0               udp dpt:53

14      18  4196 REJECT     all      *      *       ::/0                 ::/0               reject-with icmp6-adm-prohibited