6 ms·

Linux: Limit IPv6 connectivity to specific programs

31 points by DarkPlayer 13y ago

nskelsey 13y ago
This was interesting but got me thinking about a problem I encountered at work. Is it possible to create two bridges out of one namespace so that two separate programs can receive the same network traffic?
akira2501 13y ago
This seems to take the long way around. I wonder why they didn't consider just using the firewall to control network traffic; unless you really need your applications to be completely unaware of IPv6, but so far, I've not experienced that problem. Also, requiring root privileges for launch is a bit of a burden in some use-case scenarios.
- Already__Taken 13y ago
  Not exactly a common use case or linux related but my Red Alert 2 game patched for tcp/ip instead of IPX support it shipped with will only let you into LAN game lobbies on ipv6, you can't see any games to join. ipv4 and it works like a charm. My point is just that I'm sure some very very weird stuff can happen with software.
deleted 13y ago
[deleted]
Tomdarkness 13y ago
> "The main problem is to secure an IPv6 network which is much more complicated than using a typical IPv4 network consisting of a router and several devices behind it." Does anyone know why this is the case? I'm not a network security expert but to me I don't see how IPv4/v6 makes a different in terms of security. I'd assume that each computer on the network could most likely be assigned a public IPv6 address rather than using NAT in which case how is configuring your perimeter firewall to drop incoming connections by default any different from not having any port forwarding setup by default? Even your average domestic router has some sort of basic firewall built in.
- stephen_g 13y ago
  I agree - that line from the article makes no sense. Not having NAT is awesome because NAT is a nasty hack that doesn't add any security. The tunnelling scenario is valid though - because they add quite a bit of latency so you might not want to use it for everything.
- ajasmin 13y ago
  What's the point of assigning an address to every node on the Internet if you can't connect to these addresses. The advantage of IPv6 is that any computer can act as a server again. NAT makes it unnecessarily difficult to build simple peer to peer applications such as for telephony, remote access or file transfer.
- IgorPartola 13y ago
  There is nothing special about firewalling off IPv6. NAT is not a security feature. The problem is that most consumer "routers" that people use nowadays are really: a router, a switch, a wireless access point, a firewall, and who knows what else. Here are some sample rules for firewalling off IPv4 (typed from memory, so use with caution): iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT iptables -A INPUT -p icmp -j ACCEPT iptables -A INPUT -j DROP iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -s 192.168.1.0/24 -j ACCEPT iptables -A FORWARD -p icmp -j ACCEPT iptables -A FORWARD -j DROP Here are the IPv6 rules: ip6tables -A INPUT -i lo -j ACCEPT ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ip6tables -A INPUT -s 2001:xx:xx:xx::/64 -j ACCEPT ip6tables -A INPUT -p ipv6-icmp -j ACCEPT ip6tables -A INPUT -j DROP ip6tables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ip6tables -A FORWARD -s 2001:xx:xx:xx::/64 -j ACCEPT ip6tables -A FORWARD -p ipv6-icmp -j ACCEPT ip6tables -A FORWARD -j DROP Does that look like it would be hard to do? Your router should come with these rules already. If it does not, ditch it and buy one that is supported by OpenWRT, where IPv6 support is not a second class citizen. Edit: Naturally, IPv4 rules would have to be more complicated since you'll want to have your NAT setup in there. In this way, configuring IPv6 is actually easier :). Also, a real router would have rules set up for throttling certain types of traffic (e.g.: you don't want more than, say, 1000 ICMP messages per second). However, all those steps are identical for IPv6.
lgbr 13y ago
Security aside, this is even useful for new deployments of IPv6. It seems a lot of people have IPv6 networks that are less favorable for some traffic than their IPv4 networks. Some are running their IPv6 through tunnels. As soon as you enable IPv6 on your desktop, suddenly Firefox or Chromium will prefer IPv6 for any website with a AAAA record, which adds a ton of latency and reduces bandwidth. But theoretically, I could enable IPv6 for sshd (where I stand the most benefit) and leave it off for wget and browsers with this.
- wmf 13y ago
  IPv6 is no longer necessarily preferred due to happy eyeballs. http://tools.ietf.org/html/rfc6555 http://tools.ietf.org/html/rfc6555
  - IgorPartola 13y ago
    I did something independent of happy eyeballs (I consider my implementation actually superior in some ways as it aims to improve connection latency on all networks), but when I tried to get in front of some browser developers (by posting on HN), I was told by a Chrome networking dev that they tried it and decided that it wasn't worth it. He cited something about how the performance was actually worse than before. The impression that I got was that Happy Eyeballs was not actually widely adopted.
- dfc 13y ago
  At home my HE tunnel is snappier than the plain ipv4 from rr. The weird thing is it is not just a case of user perception (mine). One of the upstream s1 ntp boxes I sync with has ipv4 and ipv6 and is relatively close. I set one of my s1s to sync with both the ipv4 and ipv6 addresses of the machine and the ipv4 clock displayed a lower delay and less jitter while the offsets were seasonably close.
  - dfc 13y ago
    argh, for posterity's sake the last line should read: "the ipv6 peer entry displayed a lower delay and less jitter while the offsets were reasonably close."
lifeisstillgood 13y ago
On this subject, sort of, if I want to dump the commercial routers and replace with eithe a Linux install on a commercial router or a x86 box that is not too chunky / loud Where do I go for readme and instructions and community? I can find some old Linux on linksys sites but not a lot recently
- justincormack 13y ago
  Openwrt https://openwrt.org/ https://openwrt.org/ is where most of the docs are, though there are other similar projects. The most supportive vendor is probablr Netgear now http://www.myopenrouter.com/ http://www.myopenrouter.com/
- marios 13y ago
  If you with the commercial router route, checkout OpenWRT / DD-WRT / Tomato. There are several forks, so depending on what features you want, and what hardware you have, you may opt for a different version. If you go with an existing x86/amd64, just install your favorite distro and start reading up on iptables configuration and management. While iptables to be quite powerful in terms of features, I find its' syntax is painful. There are several projets aiming to simplify this, by generating rules from another, simpler, DSL but it adds complexity. This is why I prefer PF, but that requires you to install OpenBSD instead of Linux. If you know your way around UNIX, and are ready to read up the FAQ and man pages, this shouldn't be a problem :).

31 points by DarkPlayer 13y ago

This was interesting but got me thinking about a problem I encountered at work. Is it possible to create two bridges out of one namespace so that two separate programs can receive the same network traffic?

akira2501 13y ago

This seems to take the long way around. I wonder why they didn't consider just using the firewall to control network traffic; unless you really need your applications to be completely unaware of IPv6, but so far, I've not experienced that problem. Also, requiring root privileges for launch is a bit of a burden in some use-case scenarios.

Already__Taken 13y ago
Not exactly a common use case or linux related but my Red Alert 2 game patched for tcp/ip instead of IPX support it shipped with will only let you into LAN game lobbies on ipv6, you can't see any games to join. ipv4 and it works like a charm. My point is just that I'm sure some very very weird stuff can happen with software.

deleted 13y ago

[deleted]

Tomdarkness 13y ago

> "The main problem is to secure an IPv6 network which is much more complicated than using a typical IPv4 network consisting of a router and several devices behind it." Does anyone know why this is the case? I'm not a network security expert but to me I don't see how IPv4/v6 makes a different in terms of security. I'd assume that each computer on the network could most likely be assigned a public IPv6 address rather than using NAT in which case how is configuring your perimeter firewall to drop incoming connections by default any different from not having any port forwarding setup by default? Even your average domestic router has some sort of basic firewall built in.

stephen_g 13y ago
I agree - that line from the article makes no sense. Not having NAT is awesome because NAT is a nasty hack that doesn't add any security. The tunnelling scenario is valid though - because they add quite a bit of latency so you might not want to use it for everything.
ajasmin 13y ago
What's the point of assigning an address to every node on the Internet if you can't connect to these addresses. The advantage of IPv6 is that any computer can act as a server again. NAT makes it unnecessarily difficult to build simple peer to peer applications such as for telephony, remote access or file transfer.
IgorPartola 13y ago
There is nothing special about firewalling off IPv6. NAT is not a security feature. The problem is that most consumer "routers" that people use nowadays are really: a router, a switch, a wireless access point, a firewall, and who knows what else. Here are some sample rules for firewalling off IPv4 (typed from memory, so use with caution): iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT iptables -A INPUT -p icmp -j ACCEPT iptables -A INPUT -j DROP iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -s 192.168.1.0/24 -j ACCEPT iptables -A FORWARD -p icmp -j ACCEPT iptables -A FORWARD -j DROP Here are the IPv6 rules: ip6tables -A INPUT -i lo -j ACCEPT ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ip6tables -A INPUT -s 2001:xx:xx:xx::/64 -j ACCEPT ip6tables -A INPUT -p ipv6-icmp -j ACCEPT ip6tables -A INPUT -j DROP ip6tables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ip6tables -A FORWARD -s 2001:xx:xx:xx::/64 -j ACCEPT ip6tables -A FORWARD -p ipv6-icmp -j ACCEPT ip6tables -A FORWARD -j DROP Does that look like it would be hard to do? Your router should come with these rules already. If it does not, ditch it and buy one that is supported by OpenWRT, where IPv6 support is not a second class citizen. Edit: Naturally, IPv4 rules would have to be more complicated since you'll want to have your NAT setup in there. In this way, configuring IPv6 is actually easier :). Also, a real router would have rules set up for throttling certain types of traffic (e.g.: you don't want more than, say, 1000 ICMP messages per second). However, all those steps are identical for IPv6.

lgbr 13y ago

Security aside, this is even useful for new deployments of IPv6. It seems a lot of people have IPv6 networks that are less favorable for some traffic than their IPv4 networks. Some are running their IPv6 through tunnels. As soon as you enable IPv6 on your desktop, suddenly Firefox or Chromium will prefer IPv6 for any website with a AAAA record, which adds a ton of latency and reduces bandwidth. But theoretically, I could enable IPv6 for sshd (where I stand the most benefit) and leave it off for wget and browsers with this.

wmf 13y ago
IPv6 is no longer necessarily preferred due to happy eyeballs. http://tools.ietf.org/html/rfc6555 http://tools.ietf.org/html/rfc6555
- IgorPartola 13y ago
  I did something independent of happy eyeballs (I consider my implementation actually superior in some ways as it aims to improve connection latency on all networks), but when I tried to get in front of some browser developers (by posting on HN), I was told by a Chrome networking dev that they tried it and decided that it wasn't worth it. He cited something about how the performance was actually worse than before. The impression that I got was that Happy Eyeballs was not actually widely adopted.
dfc 13y ago
At home my HE tunnel is snappier than the plain ipv4 from rr. The weird thing is it is not just a case of user perception (mine). One of the upstream s1 ntp boxes I sync with has ipv4 and ipv6 and is relatively close. I set one of my s1s to sync with both the ipv4 and ipv6 addresses of the machine and the ipv4 clock displayed a lower delay and less jitter while the offsets were seasonably close.
- dfc 13y ago
  argh, for posterity's sake the last line should read: "the ipv6 peer entry displayed a lower delay and less jitter while the offsets were reasonably close."

lifeisstillgood 13y ago

On this subject, sort of, if I want to dump the commercial routers and replace with eithe a Linux install on a commercial router or a x86 box that is not too chunky / loud Where do I go for readme and instructions and community? I can find some old Linux on linksys sites but not a lot recently

justincormack 13y ago
Openwrt https://openwrt.org/ https://openwrt.org/ is where most of the docs are, though there are other similar projects. The most supportive vendor is probablr Netgear now http://www.myopenrouter.com/ http://www.myopenrouter.com/
marios 13y ago
If you with the commercial router route, checkout OpenWRT / DD-WRT / Tomato. There are several forks, so depending on what features you want, and what hardware you have, you may opt for a different version. If you go with an existing x86/amd64, just install your favorite distro and start reading up on iptables configuration and management. While iptables to be quite powerful in terms of features, I find its' syntax is painful. There are several projets aiming to simplify this, by generating rules from another, simpler, DSL but it adds complexity. This is why I prefer PF, but that requires you to install OpenBSD instead of Linux. If you know your way around UNIX, and are ready to read up the FAQ and man pages, this shouldn't be a problem :).