I have just recently learned that even if I block all traffic to my webserver using iptables it is still vulnerable to external attacks via IPv6. In my understanding, this renders iptables-only firewalling useless (or am I wrong?)... That being, What security measures should I take into account to protect a webserver from attacks conducted through IPv6?
Two basic options:
- Disable ipv6
- Create a firewall configuration for ipv6 using
A basic guide to disabling ipv6 is here,
although I'm betting a
rmmod ipv6 will do the trick.
You could use any existing iptables scripts you have as a basis for an "ip6tables" script. The following should tell ip6tables to lockdown all ipv6 (nothing in, out, or routed):
ip6tables -F ip6tables -P INPUT DROP ip6tables -P OUTPUT DROP ip6tables -P FORWARD DROP