Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have just recently learned that even if I block all traffic to my webserver using iptables it is still vulnerable to external attacks via IPv6. In my understanding, this renders iptables-only firewalling useless (or am I wrong?)... That being, What security measures should I take into account to protect a webserver from attacks conducted through IPv6?

share|improve this question
up vote 4 down vote accepted

Two basic options:

  • Disable ipv6
  • Create a firewall configuration for ipv6 using ip6tables.

A basic guide to disabling ipv6 is here, although I'm betting a rmmod ipv6 will do the trick.

You could use any existing iptables scripts you have as a basis for an "ip6tables" script. The following should tell ip6tables to lockdown all ipv6 (nothing in, out, or routed):

ip6tables -F
ip6tables -P INPUT DROP
ip6tables -P OUTPUT DROP
ip6tables -P FORWARD DROP
share|improve this answer
4  
Disabling IPv6 doesn't seem like a good option now that it is becoming the Internet's standard way of addressing... Anyway, is there any simple way of achieving that in Ubuntu 12.04? – NetStudent Jun 13 '12 at 20:12
    
@NetStudent: There is... but what's wrong with ip6tables? – grawity Jun 13 '12 at 20:15
1  
Sounds like you basically need to mirror your ipv4 configuration to ipv6. – LawrenceC Jun 13 '12 at 20:19
1  
rmmod ipv6 won't do the trick; Linux will automatically load it again when a program attempts to create an IPv6 socket. (That's even assuming ipv6 is a module, and not compiled into kernel.) – grawity Jun 13 '12 at 20:30
    
@ultrasawblade: Yes, I think that is what I need then... – NetStudent Jun 13 '12 at 20:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .