16

Is it possible for a host to have different open ports for IPv4 and IPv6 stack? For example, is it feasible to have the port 22 open only for IPv6 and not for IPv4 and vice versa? Also when I tried to block a port only for IPv6 it had no effect:

ip6tables -A INPUT -p tcp --dport 22 -j REJECT
4
  • 4
    Sure, otherwise there wouldn't be iptables and ip6tables. Define no effect.
    – Tom Yan
    Jun 5 at 14:37
  • 6
    Your question is unclear. Neither IPv4 nor IPv6 have a concept of "port". Ports don't exist in either IPv4 or IPv6. IPv4 has a concept of "protocol number" and IPv6 has a concept of "Next Header". Is that what you are talking about? Jun 6 at 7:04
  • @JörgWMittag judging by the ip6tables command example the OP gave they are talking about TCP port.
    – Rodney
    Jun 6 at 9:52
  • 3
    It is even possible for a host to have different open ports for different IPv4 (or IPv6, for that matter) addresses. You may pretty much have openssh listening on 192.168.0.1:22/tcp and dropbear listening on 192.168.0.10:22/tcp on the same host.
    – fraxinus
    Jun 6 at 18:48
37

Yes, definitely. In fact, there is even a difference between a port on TCP vs that same port on UDP on the same IPv6 address, which is why you specify -p tcp as well.

IPv4 is a different mechanism than IPv6 and they have separate interfaces, with separate IP addresses with separate ports. In fact, you cannot use IPv6 to connect to an IPv4 address unless you have some kind of intermediator in between that does it for you. But such intermediator would simply accept IPv4 then bridge that connection to a new IPv6.

It would also be the same case if you have 2 network cards, both having a different IP address. You would then also have to specify the correct IP address.

But it basically all boils down to this: you have a program that hosts a server, look in its configuration what ports it open, and block according to its ipv4, ipv6 and port usage on either or both tcp or udp.

2
  • 1
    You don't even need two network cards. With IPv6 most of the time you already have multiple IP addresses on each interface, and you can usually add an almost unlimited number of additional addresses and host a different service on the same port on each address. Jun 7 at 10:30
  • @JosefsaysReinstateMonica Yes, I know. This was only added as example to explain how IPv6 has its own interface just as if you had a 2nd network card.
    – LPChip
    Jun 7 at 12:44
12

Yes, they’re entirely separate. In POSIX, you create sockets using the socket(2) system call, and you pass AF_INET or AF_INET6 to it to choose between IPv4 and IPv6, respectively. Such sockets can use the same port numbers without any interference.

However, Linux has the feature where an IPv6 socket listening on a certain port will also get IPv4 traffic with the source address mapped into the IPv6 address. This can be switched off by setting IPV6_V6ONLY.

1
9

In short

Yes

Note that application doesn't have to bind to both IPv4 and IPv6 so you could do this even without IP tables.

Look at the ListenAddress directive in your sshd config or other application.

Not that you'd want to do this, but it is entirely possible to have an ssh server listening on TCP/IP6 port 22 while a web server listens on TCP/IP4 port 22.

iptables and ip6tables are configured separately.

Note as pointed out in the comments, IP itself does not have ports, but some of the transport protocols most commonly used with it, TCP and UDP, do have ports. This is why iptables requires something like -p tcp before you can filter by port, otherwise port is meaningless.

2

I'd like to answer from a technical perspective.

Are IPv4 ports separated from IPv6 ports?

The concept of ports is at "transport layer", where as the IP protocols are at "internet layer". As IP addresses are separate (for most parts, see below), the ports are also naturally separate.

However, it should be noted that, to ease migration from IPv4 to IPv6, some addresses in the IPv6 address space are mapped onto IPv4. This means when some IPv4 sockets are taken, their IPv6 counter parts may also become unavailable. The details are dependent on specific operating system implementations.

0

First, IPv4 and IPv6 don't have "ports."

Ports are a concept added by the TCP and UDP transport protocols.

Second, TCP/UDP addresses are separate for IPv4 and IPv6, since the address is the ip_address:port combination. 127.0.0.1:8000 is a different address than ::1:8000. Two different programs can be communicating on those two different addresses.

Third, you need to use ip6tables to affect IPv6 traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.