1

When running commands like ntpq -p or apt-get update it takes a very long time to display the results. If I remove all the ipv6 rules, everything works fine.

I checked syslog, and there's no iptables being dropped so the rules are working. I'm assuming I am missing some rules that are causing the process to be slow.

How can I improve the performance? IPv4 traffic doesn't have this issue.

Here is an example of my ip6tables configuration:

  # Allow loopback access
  ip6tables -A INPUT -i lo -j ACCEPT
  ip6tables -A OUTPUT -o lo -j ACCEPT

  # Allow link-local
  ip6tables -A INPUT -s fe80::/10 -j ACCEPT
  ip6tables -A OUTPUT -s fe80::/10 -j ACCEPT

  # Allow multicast
  ip6tables -A INPUT -d ff00::/8 -j ACCEPT
  ip6tables -A OUTPUT -d ff00::/8 -j ACCEPT

  # Allow inbound PING
  ip6tables -A INPUT -i eth0 -p icmpv6 --icmpv6-type echo-request -j ACCEPT
  ip6tables -A OUTPUT -o eth0 -p icmpv6 --icmpv6-type echo-reply -j ACCEPT

  # Allow outbound PING
  ip6tables -A OUTPUT -o eth0 -p icmpv6 --icmpv6-type echo-request -j ACCEPT
  ip6tables -A INPUT -i eth0 -p icmpv6 --icmpv6-type echo-reply -j ACCEPT

  # Allow outbound DNS
  ip6tables -A OUTPUT -o eth0 -p udp --dport 53 -j ACCEPT
  ip6tables -A INPUT -i eth0 -p udp --sport 53 -j ACCEPT


     # Allow outbound NTP
  ip6tables -A OUTPUT -o eth0 -p udp --dport 123 -j ACCEPT
  ip6tables -A INPUT -i eth0 -p udp --sport 123 -j ACCEPT


  # Allow outbound SMTP
  ip6tables -A OUTPUT -o eth0 -p tcp --dport 25 -m conntrack --ctstate NEW,ESTABLISHED -j$
  ip6tables -A INPUT -i eth0 -p tcp --sport 25 -m conntrack --ctstate ESTABLISHED -j ACCE$

  # Allow outbound HTTP
  ip6tables -A OUTPUT -o eth0 -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j$
  ip6tables -A INPUT -i eth0 -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCE$
  • Can you show the actual configuration that is loaded into the system? Use iptables -S or iptables-save to print it. – grawity Jan 4 '16 at 8:29
4

You seem to be filtering too much ICMPv6. IPv6 makes much more use of ICMP than IPv4 does and you filter so much that you actually break IPv6. Things that won't work are for example neighbour discovery, packet too big error messages and other error messages. Those are essential to IPv6.

When building your own firewall rules you should take a look at RFC 4890 which contains good guidelines on how to filter ICMPv6.

  • 1
    I opened up ICMP on ipv6 and everything seems to be working better. Thanks! – user72718271 Jan 5 '16 at 1:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.