IPv6 en eth0

[anoniem]

Heb IPChains weggegooid omdat dit volgens mij conflicteerde met mijn pas verworven IPTABLES. IPCHAINS heb ik in SuSE verwijderd met YAST2 en dit gooide ook nog een afhankelijk programma weg alleen onbekend wat. Nu heb ik een firewallscript met IPTABLES en dat leek in het begin te werken totdat ik dus IPCHAINS weggooide (ivm conflicten). Mijn router route niet meer voor het netwerk. In mijn ISDN log krijg ik de volgende foutmelding: ____________ Oct 22 22:48:02 adelaar kernel: isdn_net: ippp0 connected Oct 22 22:48:03 adelaar kernel: eth0: no IPv6 routers present Oct 22 22:48:03 adelaar kernel: Received CCP frame from peer Oct 22 22:48:03 adelaar kernel: [0/0].ccp-rcv[0]: 01 01 00 09 11 05 00 01 04 Oct 22 22:48:03 adelaar kernel: eth0: no IPv6 routers present ____________ Iemand een idee hoe ik hiervan af kom (behalve zet de computer uit en andere opmerking in die trend )?

[anoniem]

Ik heb de ballen verstand van Linux, dus op dat vlak kan ik je niet helpen, ik zie echter wel in je log staan dat er geen IPv6 routers gevonden kunnen worden. Het lijkt er dus op dat Linux iets met IPv6 probeert te doen (als eth0 de interface aan je LAN kant is), echter IPv6 wordt door de meeste routers nog niet ondersteund. suc6

[anoniem]

IK vind dit een beetje warrig, ip-chains = kernel 2.2, ip-tables is kernel 2.4. Welke versie gebruik je? Max

[anoniem]

Suse : 7.2 Kernel 2.4.4 Standaard installeerd Suse dus IPCHains en geen iptables. Die heb ik apart moeten downloaden. VOlgens mij heb ik nu IPtables 1.2.4 maar weet niet helemaal zeker. Ik wilde de standaard SUse dingen niet gebruiken omdat portforwarding dan nietmogelijk is. Vandaar een eigen script, dat overigens geen foutmeldingen geeft. Hieronder een uitdraai van mijn script. Ik dacht eerst dat die melding de oorzaak was van het niet routen van mijn linuxbakkie [quote] [color=green:d5a9904cb0]#!/bin/sh # First, we'll turn on the modules for our Netfilter firewall. modprobe ip_tables modprobe ip_nat_ftp modprobe ip_conntrack_ftp modprobe ip_conntrack # We'll assign the iptables executable to this variable, so we # can call it with 4 letters instead of the full path. IPT=/usr/sbin/iptables LAN=10.1.1.0 AOE_COMP=10.1.1.2 MY_SRV=10.1.1.1 INT_IFACE=ippp0 LO_INT="lo" echo "##################################" echo "Starting MV's Iptables Firewall..." # Stops Forwarding Packets while we set up Firewall echo 0 > /proc/sys/net/ipv4/ip_forward # Clear all the existing Iptables rules. We'll overwrite them with my own. for table in filter nat mangle do $IPT -t $table -F $IPT -t $table -X done ####################### # Set default policys # ####################### $IPT -P INPUT ACCEPT $IPT -P FORWARD DROP $IPT -P OUTPUT ACCEPT $IPT -t nat -P PREROUTING ACCEPT $IPT -t nat -P POSTROUTING ACCEPT $IPT -t nat -P OUTPUT ACCEPT ######################################################################################## # Prerouting Rules # The Prerouting rules take place before the IP packets get to the INPUT or FORWARD # tables. This allows us to modify incoming packets source and destination fields # to NAT them across the firewall to point them at their intended destination. ## Onbeperkt verkeer op lo toestaan $IPT -A INPUT -i $LO_INT -j ACCEPT $IPT -A OUTPUT -o $LO_INT -j ACCEPT ################################################################################ # in de gemiddelde HTK-environment kunnen we ook alles op het lokale netwerk # toelaten ## Onbeperkt verkeer op interne interface toestaan $IPT -A INPUT -i $INT_IFACE -j ACCEPT $IPT -A OUTPUT -o $INT_IFACE -j ACCEPT ######### # First, I'm going to redirect anything looking for port 80 (www) and port 23 # (secure shell) to my computer. $IPT -A PREROUTING -t nat -p tcp -i $INT_IFACE --dport 80 -j DNAT --to $MY_SRV $IPT -A PREROUTING -t nat -p tcp -i $INT_IFACE --dport 23 -j DNAT --to $MY_SRV ######### # These ports are all MSN Gaming Zone ports, so I'm pointing these incoming packets # I've also set them to log the PREROUTING request to the default # logfile prior to actually prerouting the packet. $IPT -A PREROUTING -t nat -p tcp -i $INT_IFACE --dport 6667 -j DNAT --to $AOE_COMP $IPT -A PREROUTING -t nat -p tcp -i $INT_IFACE --dport 2300:2400 -j DNAT --to $AOE_COMP $IPT -A PREROUTING -t nat -p tcp -i $INT_IFACE --dport 28800:29000 -j DNAT --to $AOE_COMP $IPT -A PREROUTING -t nat -p udp -i $INT_IFACE --dport 28800:29000 -j DNAT --to $AOE_COMP $IPT -A PREROUTING -t nat -p udp -i $INT_IFACE --dport 2300:2400 -j DNAT --to $AOE_COMP $IPT -A PREROUTING -t nat -p udp -i $INT_IFACE --dport 47624 -j DNAT --to $AOE_COMP $IPT -A PREROUTING -t nat -p udp -i $INT_IFACE --dport 6073 -j DNAT --to $AOE_COMP ######################################################################################## # Routing Rules: Input, Forward, Output Rules # The Routing Rules take place after the prerouting rules. There are two tables # that my rules are most concerned with. The Input table, which deals with connections # to my computer, and the Forward table, which deals with connections passing through # my computer. Finally, the Output table deals with connections leaving my computer. ######### # First, since I trust all the computers on my LAN, I'm "accepting" all traffic being # sent to my computer or sent through it from the ethernet adapter and the "localhost adapter". $IPT -A INPUT -t filter -i lo -j ACCEPT $IPT -A INPUT -t filter -i eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT $IPT -A FORWARD -t filter -i eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT ######### # Any packets that attempt to get to my computer that are already established connections # or are new connections that are related to an already-established connection are accepted. # $IPT -A INPUT -t filter -i ppp+ -m state --state ESTABLISHED -j LOG --log-prefix "Input Established Accept: " # $IPT -A INPUT -t filter -i ppp+ -m state --state RELATED -j LOG --log-prefix "Input Related Accept: " #$IPT -A INPUT -t filter -i ppp+ -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A INPUT -t filter -i $INT_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT ######### # This works similarly to the previous rule, except it accepts packets to be forwarded if # they are related to established or are already established. # $IPT -A FORWARD -t filter -i ppp+ -m state --state RELATED -j LOG --log-prefix "Forward Related Accept: " # $IPT -A FORWARD -t filter -i ppp+ -m state --state ESTABLISHED -j LOG --log-prefix "Forward Established Accept: " #$IPT -A FORWARD -t filter -i ppp+ -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A FORWARD -t filter -i $INT_IFACE -m state --state ESTABLISHED,RELATED -jACCEPT ######### # This one accepts packets related to webservers and secure shell. I probably # don't need a forward rule since I preroute everything to my pc anyway. # I just kept it in for fun. $IPT -A FORWARD -t filter -p tcp -i $INT_IFACE --dport 80 -m state --state NEW -j ACCEPT $IPT -A INPUT -t filter -p tcp -i $INT_IFACE --dport 80 -m state --state NEW -jACCEPT $IPT -A FORWARD -t filter -p tcp -i $INT_IFACE --dport 23 -m state --state NEW-j ACCEPT $IPT -A INPUT -t filter -p tcp -i $INT_IFACE --dport 23 -m state --state NEW -jACCEPT ### ## counterstrike server ### $IPT -A FORWARD -t filter -p tcp -i $INT_IFACE --dport 27015 -m state --state NEW -j ACCEPT $IPT -A INPUT -t filter -p tcp -i $INT_IFACE --dport 27015 -m state --state NEW -j ACCEPT ### ## Battlefield 1942 ### $IPT -A FORWARD -t filter -p udp -i $INT_IFACE --dport 14567 -m state --state NEW -j ACCEPT $IPT -A INPUT -t filter -p udp -i $INT_IFACE --dport 14567 -m state --state NEW -j ACCEPT $IPT -A FORWARD -t filter -p udp -i $INT_IFACE --dport 23000 -m state --state NEW -j ACCEPT $IPT -A INPUT -t filter -p udp -i $INT_IFACE --dport 23000 -m state --state NEW -j ACCEPT ### ## ibod settings ### $IPT -A FORWARD -t filter -p tcp -i $INT_IFACE --dport 6051 -m state --state NEW -j ACCEPT $IPT -A INPUT -t filter -p tcp -i $INT_IFACE --dport 6051 -m state --state NEW -j ACCEPT ######### # These next few rules deal with MSN Zone and Age of Kings connections again. If I see the # Age of Kings packets, (i.e. ones in the --dport range) I will forward themover to AOE comp $IPT -A FORWARD -t filter -p tcp -i $INT_IFACE --dport 6667 -m state --state NEW -j ACCEPT $IPT -A FORWARD -t filter -p tcp -i $INT_IFACE --dport 2300:2400 -m state --state NEW -j ACCEPT $IPT -A FORWARD -t filter -p tcp -i $INT_IFACE --dport 28800:29000 -m state --state NEW -j ACCEPT $IPT -A FORWARD -t filter -p udp -i $INT_IFACE --dport 28800:29000 -m state --state NEW -j ACCEPT $IPT -A FORWARD -t filter -p udp -i $INT_IFACE --dport 2300:2400 -m state --state NEW -j ACCEPT $IPT -A FORWARD -t filter -p udp -i $INT_IFACE --dport 47624 -m state --state NEW -j ACCEPT $IPT -A FORWARD -t filter -p udp -i $INT_IFACE --dport 6073 -m state --state NEW -j ACCEPT ######### # Finally, since IPtables quits processing a packet through these rules once a match is found and # an Input/Forward table accepts it, I can say "If the packet hasn't already been accepted at # this point, just drop it, since its probably useless". These next few lines log and then # drop all leftover packets. # $IPT -A INPUT -t filter -i ppp+ -m state --state NEW -j LOG --log-prefix "Input New Drop: " # $IPT -A INPUT -t filter -i ppp+ -m state --state INVALID -j LOG --log-prefix "Input Invalid Drop: " #$IPT -A INPUT -t filter -i ppp+ -m state --state NEW,INVALID -j DROP $IPT -A INPUT -t filter -i $INT_IFACE -m state --state NEW,INVALID -j DROP # $IPT -A FORWARD -t filter -i ppp+ -m state --state NEW -j LOG --log-prefix "Forward New Drop: " # $IPT -A FORWARD -t filter -i ppp+ -m state --state INVALID -j LOG --log-prefix "Forward Invalid Drop: " #$IPT -A FORWARD -t filter -i ppp+ -m state --state NEW,INVALID -j DROP $IPT -A FORWARD -t filter -i $INT_IFACE -m state --state NEW,INVALID -j DROP ######################################################################################## # Postrouting Rules # These rules deal with packets once they are out of the Input, Output and Forward tables. # I use them for my IP Masquerading stuff. ######### # Anything that needs to be translated out the Internet connection that originated from # inside the network, pretend it came from this PC and let it out. # $IPT -A POSTROUTING -t nat -o ppp+ -s 10.1.1.0/0 -d 0/0 -j LOG --log-prefix "Masqueraded Packet" #$IPT -A POSTROUTING -t nat -o ppp+ -s 10.1.1.0/8 -d 0/0 -j MASQUERADE $IPT -A POSTROUTING -t nat -o $INT_IFACE -s 10.1.1.0/8 -d 0/0 -j MASQUERADE ######################################################################################## # Restart Forwarding Packets now that Firewall is ready. echo 1 > /proc/sys/net/ipv4/ip_forward ## Enable dynamic TCP/IP address hacking echo 1 > /proc/sys/net/ipv4/ip_dynaddr echo "Finished Starting MV's Iptables Firewall..." echo "###########################################"[/color:d5a9904cb0][\quote]

[anoniem]

Kernel 2.4 heeft wel achterwaartse ondersteuning voor ip-chains. En ipv6 wordt toch (vrijwel) nog niet gebruikt? Iig zeker niet tussen provider en particuliere abonnementshouder.

[anoniem]

[quote:ace58e4cf4="water"]Kernel 2.4 heeft wel achterwaartse ondersteuning voor ip-chains. En ipv6 wordt toch (vrijwel) nog niet gebruikt? Iig zeker niet tussen provider en particuliere abonnementshouder.[/quote:ace58e4cf4] jawel hoor, bij Xs4all, de eerste in Nederland, kijk maar op: http://www.nedlinux.nl/modules/news/index.php?id=92