Opensourcetechブログ

OpensourcetechによるLinux・オープンソース・IT技術などに関するブログです。

ip6tables に関するメモ

 

 

こんにちは、鯨井貴博@opensourcetechです。

 

タイトルの通り、ip6tables を使うためのメモです。

 

ip6tablesルールの確認

[root@CentOS6 ~]# ip6tables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all anywhere anywhere state RELATED,ESTABLISHED
ACCEPT ipv6-icmp anywhere anywhere
ACCEPT all anywhere anywhere
ACCEPT udp anywhere fe80::/64 state NEW udp dpt:dhcpv6-client
ACCEPT tcp anywhere anywhere state NEW tcp dpt:ssh
REJECT all anywhere anywhere reject-with icmp6-adm-prohibited

Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all anywhere anywhere reject-with icmp6-adm-prohibited

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

 

 

ip6tablesルールの追加

[root@CentOS6 ~]# ip6tables -I INPUT 3 -p tcp --dport 80 -s 2001:A2B8:BC34:0:AAA8:B800:200C:418A -j ACCEPT
[root@CentOS6 ~]# ip6tables -I INPUT 3 -p tcp --dport 80 -d ::1 -j ACCEPT
[root@CentOS6 ~]# ip6tables -I INPUT 3 -p tcp --dport 80 --source FE80::2002:43B7 -j ACCEPT
[root@CentOS6 ~]# ip6tables -I INPUT 3 -p tcp --dport 80 --destination FF01:0:0:0:0:0:0:102 -j ACCEPT

 

 

ip6tablesルールの追加(ルール番号付き)

[root@CentOS6 ~]# ip6tables -L --line-numbers
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all anywhere anywhere state RELATED,ESTABLISHED
2 ACCEPT ipv6-icmp anywhere anywhere
3 ACCEPT tcp anywhere ff01::102/128 tcp dpt:http
4 ACCEPT tcp fe80::2002:43b7/128 anywhere tcp dpt:http
5 ACCEPT tcp anywhere localhost/128 tcp dpt:http
6 ACCEPT tcp 2001:a2b8:bc34:0:aaa8:b800:200c:418a/128 anywhere tcp dpt:http
7 ACCEPT all anywhere anywhere
8 ACCEPT udp anywhere fe80::/64 state NEW udp dpt:dhcpv6-client
9 ACCEPT tcp anywhere anywhere state NEW tcp dpt:ssh
10 REJECT all anywhere anywhere reject-with icmp6-adm-prohibited

Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 REJECT all anywhere anywhere reject-with icmp6-adm-prohibited

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

 

 

ip6tables 設定ファイルの確認

[root@CentOS6 ~]# cat /etc/sysconfig/ip6tables
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 546 -d fe80::/64 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp6-adm-prohibited
-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited
COMMIT

 

 

ip6tables 設定ファイルのバックアップ・リストア

[root@CentOS6 ~]# ip6tables-save > /etc/sysconfig/ip6tables.test
[root@CentOS6 ~]# ip6tables-restore < /etc/sysconfig/ip6tables.test

 

 

オープンソース技研

www.slideshare.net

github.com

www.facebook.com

twitter.com

www.instagram.com

 

 

にほんブログ村 IT技術ブログ Linuxへ
Linux

にほんブログ村 IT技術ブログ オープンソースへ
オープンソース

 

bitFlyer ビットコインを始めるなら安心・安全な取引所で

ビットコイン取引高日本一の仮想通貨取引所 coincheck bitcoin

 

 

Opensourcetech by Takahiro Kujirai