I have setup a simple isolated network consist of following Linux based machines: Node1<---->Router<---->Node2

Router's eth0 is connected with Node1's eth0. Router's eth1 is connected with Node2's eth0.

All the three systems are configured with IPv6 address and I can ping each other successfully. I am running iptables/ip6tables on Router and I want to block all the IPv6 traffic coming from Node2 going towards Node1 (via Router)

As we know all the IPv6 traffic has the Ethernet Packet Type signature 0x86dd and I want to block the traffic using ip6tables using this specific signature only. After reading man page of ip6tables and searching on the internet I could not find a suitable option (like ether-type) to block the traffic.

Can I do this via ip6tables at all?

EDIT: I am specifically looking for a way to use data from Layer 2 (0x86dd) to block the traffic. Basically, the question boils down to whether iptables/ip6tables works on Layer 2 or not?

  • Why are you trying to filter at layer 2, when you could easily filter IPv6 using ip6tables? You certainly don't (generally) do it this way with IPv4 or anything else. Oct 16 '12 at 17:45
ip6tables -I FORWARD -o eth0 -j REJECT

This will reject all IPv6 traffic not originating on Router and going out of eth0. You might want to throw in an -i eth1 to specify the input interface, too. Additionally, you might also like

ip6tables -I FORWARD -d ${IP(Node1)} -j REJECT

which will block all traffic send to the IP address of Node1 not originating on Router or maybe

ip6tables -I FORWARD -s ${IP(Node2)} -d ${IP(Node1)} -j REJECT

which will block all traffic from Node2 towards Node1, based on their respective IP addresses.

Note that the last two only work if Node1 and/or Node2 have fixed IP addresses. Feel free to replace REJECT by DROP, but REJECT is usually the nicer way of doing things (especially in a ‘friendly’ environment).

  • I was specifically looking to use Layer 2 information (Ethernet Packet Type 0x86dd) to achieve this. I will update my question so that it is more specific.
    – modest
    Oct 16 '12 at 16:33
  • ip(6)tables does not operate on Layer 2.
    – Claudius
    Oct 16 '12 at 16:46
  • Thanks for confirming. Does anybody know if there is a tool in Linux that can achieve this?
    – modest
    Oct 16 '12 at 17:39

I know this is old, but I happen to be looking at something similar. One option here is to use ebtables on a bridge with the -p ip6 option. I've gotten it to work 'fully', but haven't managed to get exceptions through for certain things (yet).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.