Re: ip6tables problem

[Petr Pisar <xpisar@fi.muni.cz>]

On 2006-12-20, Asfand Yar Qazi <ayqazi@gmail.com> wrote:
> I have an ipv6 tunnel on the device 'tunbt6', and another interface on
> eth0 to the rest of my network.
>
> When I enter the following commands:
>
> ip6tables -N filter6
> ip6tables -A filter6 -m state --state NEW -i ! tunbt6 -j ACCEPT
> ip6tables -A filter6 -m state --state ESTABLISHED,RELATED -j ACCEPT
> ip6tables -A filter6 -j REJECT
>
> ip6tables -A INPUT -j filter6
> ip6tables -A FORWARD -j filter6
>
>
> It doesn't work!  I can't even ping6 the machine over eth0 from my
> other computer connected to the same ethernet segment!
>

IP6 uses ICMP6 for link level address resolution (like IP4 uses ARP).
Therefore you need to accept NEW icmp6 packets. At least some types.
Read draft-ietf-v6ops-icmpv6-filtering-bcp-01.txt (can be found on IETF
FTP server) for more detailes.

-- Petr