Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Out of the box neither IPCop nor ipfire support IPv6, not even on the green interface (internal LAN).

How do I add IPv6 support to one of them? If that's not possible, is there a linux-based embedded firewall (I run them on PC Engines) which supports IPv6?

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

Take a look at mOnOwall. http://m0n0.ch/wall/features.php

It supports ipv6 and pcengines hardware.

share|improve this answer
1  
+1 Maybe it's really time switch from Linux to FreeBSD... –  Aaron Digulla Sep 27 '11 at 9:16
    
FreeBSD contains a very good firewall. Hopefully monowall meets your needs and doesn't restrict it's features too much. –  Matt H Sep 28 '11 at 1:28
    
My problem is mostly that I know very little about BSD so I'm worried how long it will take me to get my tasks done when similar Linux versions (say openSUSE and Ubuntu) are already so different... –  Aaron Digulla Sep 28 '11 at 15:31
1  
You'd be surprised how simple it is to use. FreeBSD is not very hard to learn. Monowall provides a very user friendly interface to it. While Monowall is aimed at embedded devices like pcengines, pfsense is a branch that's aimed at servers. –  Matt H Sep 28 '11 at 22:24
    
Here is the pf documentation. Worth looking through. openbsd.org/faq/pf Although you probably won't need to touch this if using pfsense or monowall. –  Matt H Sep 28 '11 at 22:26
show 1 more comment

The "ip6tables" firewall is likely what you're looking for. This web page explains how to install it: http://www.cyberciti.biz/faq/ip6tables-ipv6-firewall-for-linux/

Additionally, if your flavour of Linux has "pf" then you could also use that (I'm using it for IPv6 and IPv4 firewalling on my NetBSD Unix systems, and I'm very pleased with its flexibility, reliability, and high quality documentation).

Regarding IPCop, most of the information I found with Google was a lot of people wondering how to get IPv6 support (and a few responses suggesting "don't worry about it right now because it's not in demand," which is disappointing). According to a response on SourceForge.net, it is "somewhere on the roadmap" as per this web page: http://sourceforge.net/tracker/index.php?func=detail&aid=1364092&group_id=40604&atid=428519

It apperas that IPFire doesn't have IPv6 support yet either, although this request from the year 2010 indicates a need for it: http://redmine.ipfire.org/issues/83

IPv4 address space depleted in February, 2011

For those of you who aren't thinking about IPv6 yet, it's time to start looking into it and learning how to use it, because the world has run out of IPv4 addresses.

The fact that there are no more IPv4 addresses available means that ISPs that need more IP address space can only get IPv6 address blocks from the numbering authorities now (unless they can buy an IPv4 block from someone else, such as by purchasing an existing ISP, but this is not a reliable approach).

This article addresses the IPv4 shortage: http://www.nro.net/news/ipv4-free-pool-depleted

Firewalls that haven't had IPv6 support for the last 5 to 10 years have fallen behind the times in my strong opinion because there has been more than adequate notice that IPv6 addressing is coming, and there is a great deal of free information about IPv6 and a lot of expertise out there that has been available for free for developers who want/need to implement it in their software (e.g., the IPv6 channel on the FreeNode.net IRC network).

share|improve this answer
add comment

If you want a flashy web-based-with-cute-pictures interface, you can disregard this answer, but if you want things to just work, and you are OK with command-line interfaces, I have a pair of suggestions.

  1. openSUSE. I have built many router/firewalls on openSUSE over the years, and I even used the ALIX 2D2 for some of them. (I used KIWI to build images to dd onto CF cards)

    IPv6 "just works" in openSUSE, and is not considered a second class citizen. I can put IPADDR="ipv6_address" in an ifcfg file and it does the right thing. Most importantly, SuSEfirewall2 supports IPv6 in the same manner, and is a very easy-to-use zone-based drop-by-default firewall. If I wanted to allow incoming ssh to the router, for example, I would have:

    FW_SERVICES_EXT_TCP="22"
    

    From this, SuSEfirewall2 will create the accept rules for both IPv4 and IPv6.

    For forwarding/routing to specific machines, you can use IPv4 and IPv6 addresses interchangeably. This is how you can allow ssh to an internal machine with both IPv4 and IPv6 addresses:

    FW_FORWARD="\
    0/0,1.2.3.4/32,tcp,ssh \
    ::/0,2001:1:2:3::4/128,tcp,ssh \
    "
    

    SuSEfirewall2 will automatically figure out what do with those rules.

  2. Vyatta. This also has integrated "just works" IPv6 support. It also has a very nice CLI and tons of documentation. I switched my router from openSUSE to Vyatta for about a month a while back, and it was able to handle my rather complex network config, which included a combination of IPv6, bridging, tunneling, and OpenVPN. The only thing IPv6-related that didn't work was host identifier fixed address mapping, due to a bug. (I think it's fixed in the more recent 6.3 release, which I am actually now about to test)

In comparing the 2, there are some tradeoffs.

Pros for Vyatta:

  • I really like the CLI and the single configuration in Vyatta

  • I have also noticed that it performs better with certain workloads. (I have been trying to figure out why, but I haven't found the magic setting yet)

Pros for OpenSUSE:

  • I prefer the easy-to-use zone-based firewall in OpenSUSE. Vyatta implemented a very thin layer over iptables/ip6tables (Though I ended up writing a script to generate Vyatta firewall rules that is zone-based and automatically creates IPv4 and IPv6 rules where necessary...)

  • I like being able to run certain things on my router, such as Nginx. A general purpose distro like OpenSUSE makes that easy. I can build it myself on Vyatta, but it's unsupported and can break in an upgrade

share|improve this answer
    
OpenBSD should not be overlooked when considering an OS-centric product given it's strong reputation for stringent security. –  Randolf Richardson Sep 27 '11 at 16:51
    
+1 The only thing from accepting this entry is that it's all for the command line. While I'm a CLI guy myself, I rarely touch the firewall (about once a year). In this case, the effort to dig up the documentation again every time is too much - for these rare occasions, I really need a web interface. –  Aaron Digulla Oct 4 '11 at 8:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.