OK, firewall rules aren't in my wheelhouse.
I've got an IPv6 network with a /56 prefix assigned to me by my ISP. This, I understand, is rather large and it breaks some functionality. It is meant that this be broken up into 256 /64 networks or smaller.
On my ISP facing router the LAN has a /64 segment defined and all systems on the same LAN work just fine.
I created a static route to a host with 2 LAN interfaces. It can be reached by using either IP address. I have made these additions
net.ipv6.conf.all.forwarding = 1 net.ipv6.conf.all.proxy_ndp = 1
to a config file in /etc/sysctl.d
However in order to reach that second system from the internet I need to disable the firewall on the first. Otherwise I get....
May 12 18:47:59 f30-k kernel: FINAL_REJECT: IN=enp0s3 OUT=enp0s8 MAC=08:00:27:62:b8:24:00:11:32:76:13:a8:86:dd SRC=2001:0470:0066:0cce:0000:0000:0000:0002 DST=2001:b030:112f:0001:0000:0000:0000:0010 LEN=80 TC=0 HOPLIMIT=49 FLOWLBL=875364 PROTO=TCP SPT=54428 DPT=22 WINDOW=65320 RES=0x00 SYN URGP=0
So, I'm sure I need to add a "rich rule" or something to the firewall but I've no idea what it should be. :-(
On 5/12/19 7:12 PM, Ed Greshko wrote:
So, I'm sure I need to add a "rich rule" or something to the firewall but I've no idea what it should be.
Well a rich rule *may* be one solution. However, I got around the issue by placing the interfaces in different firewall zones.
-
Ed Greshko