IPv6 Support

Printable View

Show 40 post(s) from this thread on one page

11-11-2009, 06:25
theMIROn

Quote:

Originally Posted by wpte

we need a proper standard ip6tables script, basicly:p

suggest executing iptables-save to get ipv4 rules, and make corresponding ipv6 changes
11-11-2009, 15:23
wpte

Quote:

Originally Posted by theMIROn

suggest executing iptables-save to get ipv4 rules, and make corresponding ipv6 changes

hmm... yeh well, they don't seem to fit entirely:(
ipv6 works different than ipv4 like you don't have NAT anymore etc.
I can probably rip out a few lines tho:)

edit: got it:

Quote:

ifconfig sixtun | grep 'Scope:Global' | awk '{print $3}'
ifconfig sixtun | grep 'Scope:Link' | awk '{print $3}'

Quote:

any chance you know how to get
"2001:470:1f14:31e::2/64" and "fe80::c0a8:201/64" out of

Code:

ifconfig sixtun sixtun Link encap:IPv6-in-IPv4 inet6 addr: 2001:470:1f14:31e::2/64 Scope:Global inet6 addr: fe80::c0a8:201/64 Scope:Link UP POINTOPOINT RUNNING NOARP MTU:1280 Metric:1 RX packets:58 errors:0 dropped:0 overruns:0 frame:0 TX packets:96 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:28655 (27.9 KiB) TX bytes:15705 (15.3 KiB)

that way I can make the scipt unified:)
11-11-2009, 17:15
kamil

Quote:

Originally Posted by wpte

we need a proper standard ip6tables script, basicly:p

like blocking all ports from the outside standard, but allowing traffic from the inside, and then just open up ports by doing something like:

the script in my post earlier does that already quite a bit, but is there a "cleaner" way to do it?:p

My example script ip6tables: http://pld.pastebin.com/m14831f76
11-11-2009, 19:09
lly

Quote:

Originally Posted by kamil

My example script ip6tables:

Since you are IPv6 guru, please explain some moments:

Why you use /10 instead of /64 in following rules?

Code:

ip6tables -A INPUT -s fe80::/10 -j ACCEPT ip6tables -A OUTPUT -s fe80::/10 -j ACCEPT
11-11-2009, 19:20
wpte

Quote:

Originally Posted by lly

Since you are IPv6 guru, please explain some moments:

Why you use /10 instead of /64 in following rules?

Code:

ip6tables -A INPUT -s fe80::/10 -j ACCEPT ip6tables -A OUTPUT -s fe80::/10 -j ACCEPT

yes indeed, the code is quite explaining but I don't get those ip's where are they from?:p

PHP Code:

ip6tables -A INPUT -s fe80::/10 -j ACCEPT ip6tables -A OUTPUT -s fe80::/10 -j ACCEPT ip6tables -A INPUT -s ff00::/8 -j ACCEPT ip6tables -A OUTPUT -s ff00::/8 -j ACCEPT

the script is quite nice, and maybe we can merge it with the iptables I'm converting at the moment, from the standard firewall:)
together they would cover pretty much anything I guess:)
11-11-2009, 23:40
kamil

Quote:

Originally Posted by lly

Since you are IPv6 guru, please explain some moments:

Why you use /10 instead of /64 in following rules?

Code:

ip6tables -A INPUT -s fe80::/10 -j ACCEPT ip6tables -A OUTPUT -s fe80::/10 -j ACCEPT

simple explain:

Code:

$ ip -f inet6 add 1: lo: <LOOPBACK,MULTICAST,UP> mtu 16436 qdisc noqueue inet6 ::1/128 scope host 3: eth0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast qlen 100 inet6 fe80::21f:c6ff:fe27:e8a7/10 scope link 4: eth1: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast qlen 100 inet6 fe80::21f:c6ff:fe27:e8a7/10 scope link 5: vlan0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc noqueue inet6 fe80::21f:c6ff:fe27:e8a7/10 scope link 6: vlan1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc htb inet6 fe80::21f:c6ff:fe27:e8a7/10 scope link 7: br0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue inet6 2001:6a0:1a9:ffff::/64 scope global inet6 fe80::21f:c6ff:fe27:e8a7/10 scope link 8: sixtun@NONE: <POINTOPOINT,NOARP,UP> mtu 1280 qdisc noqueue inet6 2001:6a0:200:113::2/64 scope global inet6 fe80::a05:2001/10 scope link 9: tap0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast qlen 100 inet6 fe80::2ff:7fff:fe20:f7ba/10 scope link

why not /64? because fe80 is link lokal - and not routing in world, only local and this is standard... but you can use /64 - it's only my example script:)
12-11-2009, 00:11
wpte

Quote:

Originally Posted by kamil

simple explain:

why not /64? because fe80 is link lokal - and not routing in world, only local and this is standard... but you can use /64 - it's only my example script:)

aha, I tought they got rid of private/local ip ranges in ipv6:p
are there any more private ranges? or is this just standard for everyone?

what about using the scope global and the scope link both to be accepted, is that safe?

Quote:

sixtun@NONE: <POINTOPOINT,NOARP,UP> mtu 1280 qdisc noqueue
inet6 2001:6a0:200:113::2/64 scope global
inet6 fe80::a05:2001/10 scope link
12-11-2009, 12:56
lly

wpte
As the starting point, could you add following recommended rules to your script

Code:

# Disable processing of any RH0 packet # Which could allow a ping-pong of packets ip6tables -A INPUT -m rt --rt-type 0 -j DROP ip6tables -A OUTPUT -m rt --rt-type 0 -j DROP ip6tables -A FORWARD -m rt --rt-type 0 -j DROP

apply rules, issue

Code:

ip6tables-save >/tmp/filter6_rules

and send result to me?
I will inject this basic rules to rc, commit to svn trunk, and then you can test new version.
12-11-2009, 13:23
kamil

Quote:

Originally Posted by wpte

aha, I tought they got rid of private/local ip ranges in ipv6:p
are there any more private ranges? or is this just standard for everyone?

what about using the scope global and the scope link both to be accepted, is that safe?

Yes it's safe... if You be afraid Your Tunnel Broker/ISP then block this INPUT/OUTPUT/FORWARDING in you tunnel SIT/Wan link-local address :)

Private address class IPv6:
fc00::/7

but... i'm not used... link-local address auto configure network... :)

example:

MAC: 00:50:56:C0:00:01

link-local: fe80::0250:56ff:fec0:0001

first 00 - local mac addres... not public mac address... then is not included in address link-local

http://www.faqs.org/rfcs/rfc2460.html :)
12-11-2009, 17:30
wpte

Quote:

Originally Posted by lly

wpte
As the starting point, could you add following recommended rules to your script
and send result to me?
I will inject this basic rules to rc, commit to svn trunk, and then you can test new version.

you're talking about the script I was thinking of merging right?
it's not completely finished yet. First I'm going to eat and I'll send it you later on this night?:)

Quote:

Yes it's safe... if You be afraid Your Tunnel Broker/ISP then block this INPUT/OUTPUT/FORWARDING in you tunnel SIT/Wan link-local address

Private address class IPv6:
fc00::/7

but... i'm not used... link-local address auto configure network...

example:

MAC: 00:50:56:C0:00:01

link-local: fe80::0250:56ff:fec0:0001

first 00 - local mac addres... not public mac address... then is not included in address link-local

http://www.faqs.org/rfcs/rfc2460.html

so basicly when you think your isp is a hacker you want to block it?:p

I'm not sure what you mean by the link-local addresses :confused:
they have parts of the non-public mac address in it...
12-11-2009, 20:00
wpte

Quote:

ip6tables -A INPUT -i $WANIF6 -p tcp -m state --state INVALID -j DROP
ip6tables -A INPUT -m rt --rt-type 0 -j DROP
ip6tables -A OUTPUT -m rt --rt-type 0 -j DROP
ip6tables -A FORWARD -m rt --rt-type 0 -j DROP
ip6tables -A INPUT -i $WANIF6 -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A FORWARD -m state --state NEW -i $ETHLAN -o $WANIF6 -s $GLOBALSCOPE -j ACCEPT
ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

these don't work
error message:

Quote:

ip6tables: No chain/target/match by that name

hmm...
12-11-2009, 20:27
kamil

Quote:

Originally Posted by wpte

Code:

ip6tables -A INPUT -i $WANIF6 -p tcp -m state --state INVALID -j DROP ip6tables -A INPUT -m rt --rt-type 0 -j DROP ip6tables -A OUTPUT -m rt --rt-type 0 -j DROP ip6tables -A FORWARD -m rt --rt-type 0 -j DROP ip6tables -A INPUT -i $WANIF6 -m state --state ESTABLISHED,RELATED -j ACCEPT ip6tables -A FORWARD -m state --state NEW -i $ETHLAN -o $WANIF6 -s $GLOBALSCOPE -j ACCEPT ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

these don't work
error message:

Code:

ip6tables: No chain/target/match by that name

hmm...

i'm test... work... maybe you variables is empty or wrong defined?
12-11-2009, 20:32
kamil

Quote:

Originally Posted by wpte

so basicly when you think your isp is a hacker you want to block it?:p

no, it's only example :)

Quote:

I'm not sure what you mean by the link-local addresses :confused:
they have parts of the non-public mac address in it...

maybe you read rfc?:)

IPv4 can't auto configure, IPv6 auto configure when put cable in socket - this simple configuration make connection protocol IP in area network where is or not DHCP server:)
12-11-2009, 20:38
wpte

Quote:

Originally Posted by kamil

i'm test... work... maybe you variables is empty or wrong defined?

no, these tables are not quite suitable for kernel 2.4:p
we are walking into the limitations I guess:(

I think we need to keep these ip6tables low level only meaning... block anything from the outside, allow everything on the inside and keep track of things like ping and ddos (something which seems to work for now)
going to rewrite my script, since it's not working:(
13-11-2009, 08:09
lly

Quote:

Originally Posted by wpte

no, these tables are not quite suitable for kernel 2.4:p

Fortunately, this match is just turned off. Set

Code:

CONFIG_IP6_NF_MATCH_RT=y

in kernel .config and rebuild FW. Will be fixed soon.

Could you send to me your /etc/radvd.conf via PM?

Quote:

Originally Posted by kamil

maybe you read rfc?:)

It's the best solution, but very time hungry ;)
13-11-2009, 19:35
wpte

Quote:

Originally Posted by lly

Fortunately, this match is just turned off. Set

Code:

CONFIG_IP6_NF_MATCH_RT=y

in kernel .config and rebuild FW. Will be fixed soon.

I've done that, but ipv6 is turned off again:p
in fact I can't seem to find any

Code:

ifeq ($(CONFIG_IPV6),y) COPTS += -DUSE_IPV6 endif export COPTS

in the dnsmasq makefile:D
I just added it myself, lets see what happens again:)

edit... nothing :(
ipv6 is dead again... hmm
the sixtun is gone again.

what I did was: clean everything out (kernel, wl500g-1.9.2.7-d and gateway)
update svn
cd /whatever-you-want/broadcom/src/wl500g-1.9.2.7-d
make kernel
make
edit the kernel .config file for the CONFIG_IP6_NF_MATCH_RT=y
Edit /whatever-you-want/broadcom/src/gateway/Makefile and set MODEL=wl500gp or whichever fits your expectance better.
add the ipv6 in the .config file
make koldconfig
cd /whatever-you-want/broadcom/src/gateway
make
make install

just the same as last time :s
13-11-2009, 21:27
lly
Quote:

Originally Posted by wpte

ipv6 is dead again... hmm

Very strange, moments ago I build r794:

Quote:

$ ls /proc/sys/net
802 core ethernet ipv4 ipv6 unix
$ dnsmasq -v
Dnsmasq version 2.51 Copyright (C) 2000-2009 Simon Kelley
Compile time options IPv6 GNU-getopt no-RTC no-DBus no-I18N DHCP no-scripts no-TFTP
...
$ip6tables -A INPUT -m rt --rt-type 0 -j DROP
$ip6tables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP all anywhere anywhere rt type:0

I didn't perform any manual changes except src/gateway/.config. My build sequence (Sources prepared for compilation):
- cd src/gateway
- vi .config
- make koldconf
- make
- make install
13-11-2009, 21:52
wpte
Quote:
Originally Posted by lly

Very strange, moments ago I build r794:

I didn't perform any manual changes except src/gateway/.config. My build sequence (Sources prepared for compilation):

cd src/gateway
vi .config
make koldconf
make
make install
can you send me a build for the wl500w then?:p
13-11-2009, 22:07
theMIROn

btw, shipped radvd is quite old - 0.7.3, here's the changelog up to the last 1.5
http://cvs.litech.org/viewcvs/radvd/CHANGES?view=markup
size comparsion:
radvd-0.7.3 58Kb, ~20Kb inside FW
radvd-1.5 91Kb, ~28Kb inside FW
Is it worth to?
13-11-2009, 22:16
lly

Quote:

Originally Posted by theMIROn

btw, shipped radvd is quite old - 0.7.3, here's the changelog up to the last 1.5

Personally, I can't score this changes - are they urgent or just minor features. May be kamil can consult us?
Moreover, I really aware moments below from Changelog:

Quote:

Note: this could break deployments with some very old kernels, see more info at:

i.e. we should spend hours to find all such places due to our 2.4 kernel :(
13-11-2009, 22:23
theMIROn

Quote:

Originally Posted by lly

May be kamil can consult us?

Hope so

Quote:

Originally Posted by lly

Moreover, I really aware moments below from Changelog:
Note: this could break deployments with some very old kernels, see more info at:
i.e. we should spend hours to find all such places due to our 2.4 kernel :(

Don't be afraid, we have the very fresh kernel. openwrt 2.4 uses it already, and there is notice about in changelog.
moreover i had to make same almost the changes for traceroute6 recently
13-11-2009, 23:21
wpte

I tried your file lly, but there isn't any sixtun coming up:(
maybe I should try make menuconf...
14-11-2009, 07:50
lly
Quote:

Originally Posted by wpte

I tried your file lly, but there isn't any sixtun coming up:(

Updated: seems to be my mistake - too hard week :( Right sequence for compile should be:
- cd src/gateway
- vi .config
- make oldconfig
- make
- make install
Updated2 13:26: More problems discovered:
1. ip6tables-save/ip6tables-restore missing - fixed in r802
2. "state" match missed in kernel for ipv6 - I need extra time to fix this
I'm going to hardcode following ipv6 firewall rules into rc:

Code:

# Disable processing of any RH0 packet ip6tables -A INPUT -m rt --rt-type 0 -j DROP ip6tables -A OUTPUT -m rt --rt-type 0 -j DROP ip6tables -A FORWARD -m rt --rt-type 0 -j DROP ip6tables -A INPUT -t filter -i lo -j ACCEPT ip6tables -A OUTPUT -t filter -o lo -j ACCEPT ip6tables -A FORWARD -t filter -o lo -j ACCEPT ip6tables -A OUTPUT -o sixtun -j ACCEPT ip6tables -A OUTPUT -o br0 -j ACCEPT ip6tables -A INPUT -i br0 -j ACCEPT # Allow ICMP (conditional?) ip6tables -A INPUT -p icmpv6 -j ACCEPT ip6tables -A OUTPUT -p icmpv6 -j ACCEPT ip6tables -A FORWARD -p icmpv6 -j ACCEPT # Allow Link-Local addresses ip6tables -A INPUT -s fe80::/10 -j ACCEPT ip6tables -A OUTPUT -s fe80::/10 -j ACCEPT # Allow multicast ip6tables -A INPUT -s ff00::/8 -j ACCEPT ip6tables -A OUTPUT -s ff00::/8 -j ACCEPT

kamil - is it OK for the first step?
14-11-2009, 12:32
kamil

Quote:

Originally Posted by lly

I'm going to hardcode following ipv6 firewall rules into rc:

Code:

# Disable processing of any RH0 packet ip6tables -A INPUT -m rt --rt-type 0 -j DROP ip6tables -A OUTPUT -m rt --rt-type 0 -j DROP ip6tables -A FORWARD -m rt --rt-type 0 -j DROP ip6tables -A INPUT -t filter -i lo -j ACCEPT ip6tables -A OUTPUT -t filter -o lo -j ACCEPT ip6tables -A FORWARD -t filter -o lo -j ACCEPT ip6tables -A OUTPUT -o sixtun -j ACCEPT ip6tables -A OUTPUT -o br0 -j ACCEPT ip6tables -A INPUT -i br0 -j ACCEPT # Allow ICMP (conditional?) ip6tables -A INPUT -p icmpv6 -j ACCEPT ip6tables -A OUTPUT -p icmpv6 -j ACCEPT ip6tables -A FORWARD -p icmpv6 -j ACCEPT # Allow Link-Local addresses ip6tables -A INPUT -s fe80::/10 -j ACCEPT ip6tables -A OUTPUT -s fe80::/10 -j ACCEPT # Allow multicast ip6tables -A INPUT -s ff00::/8 -j ACCEPT ip6tables -A OUTPUT -s ff00::/8 -j ACCEPT

kamil - is it OK for the first step?

yes, but i not see default policy:)

ps: scripts i'm tested in VirtualBox and iso rescuecd - http://rescuecd.pld-linux.org/downlo...RCDx86_297.iso :)
14-11-2009, 12:35
kamil

Quote:

Originally Posted by theMIROn

btw, shipped radvd is quite old - 0.7.3, here's the changelog up to the last 1.5
http://cvs.litech.org/viewcvs/radvd/CHANGES?view=markup
size comparsion:
radvd-0.7.3 58Kb, ~20Kb inside FW
radvd-1.5 91Kb, ~28Kb inside FW
Is it worth to?

radvd-0.7.x great works on my ASUS wl500g, but...
0.7.x - 2005
1.5.x - 2009
4 year:)
14-11-2009, 12:52
theMIROn

Quote:

Originally Posted by kamil

radvd-0.7.x great works on my ASUS wl500g, but...
0.7.x - 2005
1.5.x - 2009
4 year:)

I'm afraid that build date shouldn't be the main reason to update
14-11-2009, 13:11
lly

Quote:

Originally Posted by kamil

yes, but i not see default policy:)

default policy will be ACCEPT, for tests period at least. As I can understand - your sample firewall script not from Oleg's 1.9.2.7-10 (which based on 2.4 kernel too), isn't it?

Bad news - kernel 2.4.X don't support ipv6 connection tracking(ip6_conntrack) at all. And nobody done backport from 2.6 line :(

Also, I can't find ipv6 TCPMSS module for 2.4 ...

About radvd - many software developers increase versions too rapid, without real core functionality change, especially commercial software. So, I don't want to repair new bugs in new version due to incompatibility with our obsolete 2.4 kernel.
14-11-2009, 13:12
wpte

Quote:

Originally Posted by kamil

yes, but i not see default policy:)

default policy is always accept

or lly can add something like this into the beginning:

Quote:

POLICY="DROP"
ip6tables -P OUTPUT $POLICY
ip6tables -P INPUT $POLICY
ip6tables -P FORWARD $POLICY

I'm not sure how drop will work out, I always had bad luck with it, meaning that the tunnel was blocked:p
14-11-2009, 13:17
wpte

Quote:

Originally Posted by lly

Bad news - kernel 2.4.X don't support ipv6 connection tracking(ip6_conntrack) at all. And nobody done backport from 2.6 line :(

http://www.linux-ipv6.org/ml/usagi-users/msg02587.html

Quote:

But ip6_conntrack is highly independent, so I think it isn't difficult
to port it to Linux 2.4. Please try below.

maybe when there is more time we can give it a shot?:p
14-11-2009, 13:32
theMIROn

Quote:

Originally Posted by lly

"state" match missed in kernel for ipv6 - I need extra time to fix this

the onlly way is to backport it from 2.6. btw, we could even merge ipv4 and ipv6 modules/extensions to save space, like it was done in mainstream
14-11-2009, 13:36
lly

Quote:

Originally Posted by wpte

http://www.linux-ipv6.org/ml/usagi-users/msg02587.html
maybe when there is more time we can give it a shot?:p

I found this link. It is real task, but since nobody done it, seems to be it is not so easy.
Unfortunately, I haven't enough time to do this backport. We will be happy if someone send us patches against 2.4.3x.

What your opinion about significance of TCPMSS for ipv6?
14-11-2009, 16:36
theMIROn

Just set up ipv6 tunnel via http://tunnelbroker.net, works fine
http://ipv6.he.net/certification/cre...eMIROn&badge=3

btw, do we need following (for the first approach without detailed ifs names)?

iptables -I FORWARD -p ipv6 (-i/o sixtun/br0) - j ACCEPT
iptables -t nat -I POSTROUTING -p ! ipv6 ... -j MASQUERADE
14-11-2009, 16:41
kamil

Quote:

Originally Posted by lly

default policy will be ACCEPT, for tests period at least. As I can understand - your sample firewall script not from Oleg's 1.9.2.7-10 (which based on 2.4 kernel too), isn't it?
...

Oleg's 1.9.2.7-10 don't have ip6tables :)

My scripts write in other routers where base system is linux with kernel 2.6.x :)

Oleg's soft is poor support ipv6 (no mtr6, traceroute6, ip6tables)... but basic support have (ping6, firmaware 1.9.2.7-10 compiled with ipv6)... - i can't create scripts where base system not full support ipv6 (Oleg's firmware) :)
14-11-2009, 18:45
lly

Quote:

Originally Posted by theMIROn

btw, do we need following (for the first approach without detailed ifs names)?

iptables -t nat -I POSTROUTING -p ! ipv6 ... -j MASQUERADE

nat is absent for IPv6 :)

Quote:

Originally Posted by kamil

My scripts write in other routers where base system is linux with kernel 2.6.x :)

You are happy man :)
One more question - have you ever use TCPMSS for IPv6?
14-11-2009, 18:50
theMIROn

Quote:

Originally Posted by lly

nat is absent for IPv6 :)

yep, it's abs useless for that, in case or routed ipv6 range
15-11-2009, 16:43
wpte

I have the new build and it works great:)

Quote:

I'm proudly running:
1.9.2.7-d-r815

is it just me or is that portscanner from he.net quite slow?:p
maybe I'll make a c# ipv6 portscanner, you need a mono version theMIROn?
15-11-2009, 17:38
theMIROn

Quote:

Originally Posted by wpte

I have the new build and it works great:)
is it just me or is that portscanner from he.net quite slow?:p
maybe I'll make a c# ipv6 portscanner, you need a mono version theMIROn?

what for?
he.net uses nmap 5.00, you could use the same from optware.

btw, http://wpte.crabdance.com/ isn't accessable via ipv6, but themiron.ru is =)
15-11-2009, 17:48
theMIROn

Thoughts 'bout ip6tables defaults:
1. filter6_ruses should be grouped by chain, not by match/target, following changes should be applied to rc internally
2. OUTPUT chain should always have default ACCEPT policy, and only REJECT/DROP targets (for ex. -m rt --rt-type - -j DROP/REJECT)
coz output ifs could be br0/vlan1/sixtun/lo - to much to enum them all
3. ipv6-icmp proto used for ipv6 advert (radvd), auto conf, etc, so it shouldn't depend on firewall coz it'll break the overall netability
4. did I miss smth?
15-11-2009, 18:11
lly

Quote:

Originally Posted by theMIROn

Thoughts 'bout ip6tables defaults:
1. filter6_ruses should be grouped by chain, not by match/target, following changes should be applied to rc internally

Sounds resonable. No problem, we still on the way :)

Quote:

2. OUTPUT chain should always have default ACCEPT policy, and only REJECT/DROP targets (for ex. -m rt --rt-type - -j DROP/REJECT)
coz output ifs could be br0/vlan1/sixtun/lo - to much to enum them all

3. ipv6-icmp proto used for ipv6 advert (radvd), auto conf, etc, so it shouldn't depend on firewall coz it'll break the overall netability

Unfortunately, I don't know yet. Maybe kamil or someone else can help us and answer to this questions?
15-11-2009, 20:50
wpte

Quote:

Originally Posted by theMIROn

what for?
he.net uses nmap 5.00, you could use the same from optware.

btw, http://wpte.crabdance.com/ isn't accessable via ipv6, but themiron.ru is =)

I know it's not accessable, though I opened up the port:p

Quote:

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

after I added the line

Quote:

-A INPUT -d 2001:470:1f14:31e::2/128 -i sixtun -p tcp -m tcp --dport 80 -j ACCEPT

everything goes open:confused:
what do you use to open up ports then?

Show 40 post(s) from this thread on one page

All times are GMT +1. The time now is 14:45.