Add IPv6 router settings to ufw-framework
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
ufw |
Triaged
|
Wishlist
|
Patrick Fasano |
Bug Description
"man ufw-framework" already gives simple instructions on how to set up a NAT firewall using ufw's before.rules -- a similar section on setting up routing for IPv6 should be added to ufw-framework. It should be a lot simpler than explaining NAT, since NAT is gone. :-)
The applicable rules that would be added to the man page are (something like) :
To allow connections to servers on the inside at 2001:0DB8::a and 2001:0DB8::b add the following lines before COMMIT in before6.rules:
-A ufw6-before-forward -o eth0 -d 2001:0DB8::a -m state --state NEW -j ACCEPT
-A ufw6-before-forward -o eth0 -d 2001:0DB8::b -m state --state NEW -j ACCEPT</pre>
To allow routing to the Internet for hosts on the internal network 2001:0DB8::/32 on interface eth0 add the following lines before COMMIT in before6.rules:
# ok icmp codes
-A ufw6-before-forward -p icmpv6 --icmpv6-type destination-
-A ufw6-before-forward -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
-A ufw6-before-forward -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
-A ufw6-before-forward -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
-A ufw6-before-forward -p icmpv6 --icmpv6-type echo-request -j ACCEPT
-A ufw6-before-forward -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
-A ufw6-before-forward -i eth0 -s 2001:0DB8::/32 -o eth1 -m state --state NEW -j ACCEPT
-A ufw6-before-forward -m state --state RELATED,ESTABLISHED -j ACCEPT
To allow DHCPv6 for the local network, run the following command
ufw allow in on eth0 proto udp from fe80::/10 port 546 to any port 547
Changed in ufw: | |
status: | In Progress → Triaged |
Granted, some nice explanation of all the rules would be helpful, too... I might be able to work on them if this has a good chance of making it into the main source...