{"id":18353,"date":"2014-07-04T06:20:43","date_gmt":"2014-07-03T22:20:43","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/07\/04\/ipv6-firewall\/"},"modified":"2021-03-18T17:23:58","modified_gmt":"2021-03-18T09:23:58","slug":"ipv6-firewall","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/07\/04\/ipv6-firewall\/","title":{"rendered":"IPv6 Firewall"},"content":{"rendered":"

\u4e00\u822c\u5728\u8a2d\u5b9a Server \u7684\u9632\u706b\u7246\u898f\u5247\u6642\uff0c\u5927\u90e8\u5206\u90fd\u96c6\u4e2d\u5728 IPv4\uff0c\u4e0d\u904e\u76ee\u524d\u5b9c\u862d\u7e23\u7684 IPv6 \u74b0\u5883\u61c9\u8a72\u975e\u5e38\u5b8c\u6574\uff0c\u6240\u4ee5 IPv6 \u7684\u90e8\u5206\u4e5f\u4e0d\u80fd\u5ffd\u8996\u3002
\u53c3\u8003\u7db2\u7ad9\uff1aip6tables: IPv6 Firewall For Linux<\/a><\/p>\n

\u539f\u672c\u6c92\u6709\u8a2d\u5b9a\u7684\u756b\u9762
# ip6tables -L -n<\/span>
Chain INPUT (policy ACCEPT)<\/span>
target\u00a0\u00a0\u00a0\u00a0 prot opt source\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 destination<\/span><\/p>\n

Chain FORWARD (policy ACCEPT)<\/span>
target\u00a0\u00a0\u00a0\u00a0 prot opt source\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 destination<\/span><\/p>\n

Chain OUTPUT (policy ACCEPT)<\/span>
target\u00a0\u00a0\u00a0\u00a0 prot opt source\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 destination<\/span>
[@more@]\u4ee5 Ubuntu Server 14.04 \u70ba\u4f8b
IPv6 \u7684\u9632\u706b\u7246\u898f\u5247\u5beb\u5728 \/etc\/rc.local \u6a94\u6848\u4e4b\u4e2d<\/p>\n

# vim \/etc\/rc.local<\/span>
###—————————————————–###<\/span>
# \u8a2d\u5b9a ip6tables \u7684\u8def\u5f91<\/span>
###—————————————————–###<\/span>
echo “Set path of ip6tables”<\/span><\/p>\n

IP6TABLES=”\/sbin\/ip6tables”<\/span><\/p>\n

###—————————————————–###<\/span>
# \u8a2d\u5b9a\u5c0d\u5916\u7684\u7db2\u8def\u5361\u7de8\u865f<\/span>
###—————————————————–###<\/span>
FW_IFACE=”eth0″<\/span><\/p>\n

###—————————————————–###<\/span>
# \u6e05\u9664\u5148\u524d\u7684\u8a2d\u5b9a<\/span>
###—————————————————–###<\/span>
echo “Flush fiter table ……”<\/span>
echo<\/span><\/p>\n

$IP6TABLES -F<\/span>
$IP6TABLES -X<\/span>
$IP6TABLES -Z<\/span><\/p>\n

$IP6TABLES -t mangle -F<\/span>
$IP6TABLES -t mangle -X<\/span><\/p>\n

###—————————————————–###<\/span>
# \u8a2d\u5b9a filter table \u7684\u9810\u8a2d\u653f\u7b56<\/span>
###—————————————————–###<\/span>
$IP6TABLES -P INPUT DROP<\/span>
$IP6TABLES -P OUTPUT DROP<\/span>
$IP6TABLES -P FORWARD DROP<\/span><\/p>\n

# \u5141\u8a31\u5df2\u5efa\u7acb\u9023\u7dda\u548c\u56de\u61c9\u7684\u5c01\u5305\u901a\u904e<\/span>
$IP6TABLES -A INPUT -i $FW_IFACE -m state –state ESTABLISHED,RELATED -j ACCEPT<\/span>
$IP6TABLES -A OUTPUT -o $FW_IFACE -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT<\/span><\/p>\n

# \u9810\u5b9a\u958b\u653e\u7684\u670d\u52d9 22 \/ 80<\/span>
$IP6TABLES -A INPUT -i $FW_IFACE -p tcp –dport 80 -j ACCEPT<\/span>
$IP6TABLES -A INPUT -i $FW_IFACE -p tcp -s 2001:288:a229:1::\/64 –dport 22 -j ACCEPT<\/span><\/p>\n

# \u958b\u653e ipv6 icmp<\/span>
$IP6TABLES -A INPUT -i $FW_IFACE -p ipv6-icmp -j ACCEPT<\/span>
$IP6TABLES -A OUTPUT -o $FW_IFACE -p ipv6-icmp\u00a0 -j ACCEPT<\/span><\/p>\n

\u8b93\u8a2d\u5b9a\u751f\u6548
# service rc.local start<\/span><\/p>\n

IPv6 \u9632\u706b\u7246\u898f\u5247
# ip6tables -L -n<\/span>
Chain INPUT (policy DROP)<\/span>
target\u00a0\u00a0\u00a0\u00a0 prot opt source\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 destination<\/span>
ACCEPT\u00a0\u00a0\u00a0\u00a0 all\u00a0\u00a0\u00a0\u00a0\u00a0 ::\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ::\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 state RELATED,ESTABLISHED<\/span>
ACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0\u00a0\u00a0\u00a0\u00a0 ::\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ::\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp dpt:80<\/span>
ACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0\u00a0\u00a0\u00a0\u00a0 2001:288:a229:1::\/64\u00a0 ::\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp dpt:22<\/span>
ACCEPT\u00a0\u00a0\u00a0\u00a0 icmpv6\u00a0\u00a0\u00a0 ::\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ::\/0<\/span><\/p>\n

Chain FORWARD (policy DROP)<\/span>
target\u00a0\u00a0\u00a0\u00a0 prot opt source\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 destination<\/span><\/p>\n

Chain OUTPUT (policy DROP)<\/span>
target\u00a0\u00a0\u00a0\u00a0 prot opt source\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 destination<\/span>
ACCEPT\u00a0\u00a0\u00a0\u00a0 all\u00a0\u00a0\u00a0\u00a0\u00a0 ::\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ::\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 state NEW,RELATED,ESTABLISHED<\/span>
ACCEPT\u00a0\u00a0\u00a0\u00a0 icmpv6\u00a0\u00a0\u00a0 ::\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ::\/0<\/span><\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

\u4e00\u822c\u5728\u8a2d\u5b9a Server \u7684\u9632\u706b\u7246\u898f\u5247\u6642\uff0c\u5927\u90e8\u5206\u90fd\u96c6\u4e2d\u5728 IPv4\uff0c\u4e0d\u904e\u76ee\u524d\u5b9c\u862d\u7e23\u7684 IPv6 \u74b0\u5883\u61c9\u8a72\u975e\u5e38\u5b8c … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008IPv6 Firewall\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[138,113,119],"tags":[],"class_list":["post-18353","post","type-post","status-publish","format-standard","hentry","category-c-78483","category-c-77170","category-c-78464"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["510611"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18353"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=18353"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18353\/revisions"}],"predecessor-version":[{"id":20006,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18353\/revisions\/20006"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=18353"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=18353"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=18353"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}