Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have setup a simple isolated network consist of following Linux based machines: Node1<---->Router<---->Node2

Router's eth0 is connected with Node1's eth0. Router's eth1 is connected with Node2's eth0.

All the three systems are configured with IPv6 address and I can ping each other successfully. I am running iptables/ip6tables on Router and I want to block all the IPv6 traffic coming from Node2 going towards Node1 (via Router)

As we know all the IPv6 traffic has the Ethernet Packet Type signature 0x86dd and I want to block the traffic using ip6tables using this specific signature only. After reading man page of ip6tables and searching on the internet I could not find a suitable option (like ether-type) to block the traffic.

Can I do this via ip6tables at all?

EDIT: I am specifically looking for a way to use data from Layer 2 (0x86dd) to block the traffic. Basically, the question boils down to whether iptables/ip6tables works on Layer 2 or not?

share|improve this question

migrated from stackoverflow.com Oct 16 '12 at 8:12

This question came from our site for professional and enthusiast programmers.

    
Why are you trying to filter at layer 2, when you could easily filter IPv6 using ip6tables? You certainly don't (generally) do it this way with IPv4 or anything else. –  Michael Hampton Oct 16 '12 at 17:45

1 Answer 1

ip6tables -I FORWARD -o eth0 -j REJECT

This will reject all IPv6 traffic not originating on Router and going out of eth0. You might want to throw in an -i eth1 to specify the input interface, too. Additionally, you might also like

ip6tables -I FORWARD -d ${IP(Node1)} -j REJECT

which will block all traffic send to the IP address of Node1 not originating on Router or maybe

ip6tables -I FORWARD -s ${IP(Node2)} -d ${IP(Node1)} -j REJECT

which will block all traffic from Node2 towards Node1, based on their respective IP addresses.

Note that the last two only work if Node1 and/or Node2 have fixed IP addresses. Feel free to replace REJECT by DROP, but REJECT is usually the nicer way of doing things (especially in a ‘friendly’ environment).

share|improve this answer
    
I was specifically looking to use Layer 2 information (Ethernet Packet Type 0x86dd) to achieve this. I will update my question so that it is more specific. –  modest Oct 16 '12 at 16:33
    
ip(6)tables does not operate on Layer 2. –  Claudius Oct 16 '12 at 16:46
    
Thanks for confirming. Does anybody know if there is a tool in Linux that can achieve this? –  modest Oct 16 '12 at 17:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.