After upgrading to BARRIER BREAKER (14.07, r42625), I cannot get IPv6 via gw6c zu work. The gw6c and radvd parts are fine, and I can access IPv6 hosts from the router directly. In my LAN, IPv6 addresses are correctly assigned, but I cannot get a connection to the outside world. After some debugging, I see one obvious problem in the firewall (ip6tables):
Chain zone_lan_forward (1 references)
pkts bytes target prot opt in out source destination
37 3128 forwarding_lan_rule all * * ::/0 ::/0 /* user chain for forwarding */
37 3128 zone_wan_dest_ACCEPT all * * ::/0 ::/0 /* forwarding lan -> wan */
37 3128 zone_lan_dest_ACCEPT all * * ::/0 ::/0
clearly doesn't make sense, note wan_dest, then lan_dest. It should be lan_src, I assume.
I changed this to add a -j ACCEPT as the third rule to circumvent the issue, but it seems only part of the problem.
I reset the counters and tried to establish a connection to see what other DROP or REJECT rules were hit, but found none.
This is the full output of ip6tables:
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
21 1440 delegate_input all * * ::/0 ::/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
8 640 delegate_forward all * * ::/0 ::/0
Chain OUTPUT (policy ACCEPT 3 packets, 312 bytes)
pkts bytes target prot opt in out source destination
66 5228 delegate_output all * * ::/0 ::/0
Chain delegate_forward (1 references)
pkts bytes target prot opt in out source destination
8 640 forwarding_rule all * * ::/0 ::/0 /* user chain for forwarding */
0 0 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 DROP all * * ::/0 ::/0 ctstate INVALID
7 560 zone_lan_forward all br-lan * ::/0 ::/0
0 0 zone_wan_forward all pppoe-wan * ::/0 ::/0
1 80 reject all * * ::/0 ::/0
Chain delegate_input (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all lo * ::/0 ::/0
21 1440 input_rule all * * ::/0 ::/0 /* user chain for input */
0 0 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 DROP all * * ::/0 ::/0 ctstate INVALID
0 0 syn_flood tcp * * ::/0 ::/0 tcp flags:0x17/0x02
21 1440 zone_lan_input all br-lan * ::/0 ::/0
0 0 zone_wan_input all pppoe-wan * ::/0 ::/0
Chain delegate_output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * lo ::/0 ::/0
66 5228 output_rule all * * ::/0 ::/0 /* user chain for output */
9 1084 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 DROP all * * ::/0 ::/0 ctstate INVALID
54 3832 zone_lan_output all * br-lan ::/0 ::/0
0 0 zone_wan_output all * pppoe-wan ::/0 ::/0
Chain forwarding_lan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain forwarding_rule (1 references)
pkts bytes target prot opt in out source destination
Chain forwarding_wan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain input_lan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain input_rule (1 references)
pkts bytes target prot opt in out source destination
Chain input_wan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain output_lan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain output_rule (1 references)
pkts bytes target prot opt in out source destination
Chain output_wan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain reject (3 references)
pkts bytes target prot opt in out source destination
1 80 REJECT tcp * * ::/0 ::/0 reject-with tcp-reset
0 0 REJECT all * * ::/0 ::/0 reject-with icmp6-port-unreachable
Chain syn_flood (1 references)
pkts bytes target prot opt in out source destination
0 0 RETURN tcp * * ::/0 ::/0 tcp flags:0x17/0x02 limit: avg 25/sec burst 50
0 0 DROP all * * ::/0 ::/0
Chain zone_lan_dest_ACCEPT (2 references)
pkts bytes target prot opt in out source destination
54 3832 ACCEPT all * br-lan ::/0 ::/0
Chain zone_lan_forward (1 references)
pkts bytes target prot opt in out source destination
7 560 forwarding_lan_rule all * * ::/0 ::/0 /* user chain for forwarding */
7 560 zone_wan_dest_ACCEPT all * * ::/0 ::/0 /* forwarding lan -> wan */
7 560 ACCEPT all * * ::/0 ::/0
0 0 zone_lan_dest_ACCEPT all * * ::/0 ::/0
Chain zone_lan_input (1 references)
pkts bytes target prot opt in out source destination
21 1440 input_lan_rule all * * ::/0 ::/0 /* user chain for input */
21 1440 zone_lan_src_ACCEPT all * * ::/0 ::/0
Chain zone_lan_output (1 references)
pkts bytes target prot opt in out source destination
54 3832 output_lan_rule all * * ::/0 ::/0 /* user chain for output */
54 3832 zone_lan_dest_ACCEPT all * * ::/0 ::/0
Chain zone_lan_src_ACCEPT (1 references)
pkts bytes target prot opt in out source destination
21 1440 ACCEPT all br-lan * ::/0 ::/0
Chain zone_wan_dest_ACCEPT (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * pppoe-wan ::/0 ::/0
Chain zone_wan_dest_REJECT (1 references)
pkts bytes target prot opt in out source destination
0 0 reject all * pppoe-wan ::/0 ::/0
Chain zone_wan_forward (1 references)
pkts bytes target prot opt in out source destination
0 0 forwarding_wan_rule all * * ::/0 ::/0 /* user chain for forwarding */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Forward */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Forward */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Forward */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Forward */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Forward */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4 code 0 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Forward */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4 code 1 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Forward */
0 0 zone_wan_dest_REJECT all * * ::/0 ::/0
Chain zone_wan_input (1 references)
pkts bytes target prot opt in out source destination
0 0 input_wan_rule all * * ::/0 ::/0 /* user chain for input */
0 0 ACCEPT udp * * fe80::/10 fe80::/10 udp spt:547 dpt:546 /* Allow-DHCPv6 */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Input */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Input */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Input */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Input */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Input */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4 code 0 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Input */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4 code 1 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Input */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 133 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Input */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 135 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Input */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 134 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Input */
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 136 limit: avg 1000/sec burst 5 /* Allow-ICMPv6-Input */
0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:22 /* SSH */
0 0 zone_wan_src_REJECT all * * ::/0 ::/0
Chain zone_wan_output (1 references)
pkts bytes target prot opt in out source destination
0 0 output_wan_rule all * * ::/0 ::/0 /* user chain for output */
0 0 zone_wan_dest_ACCEPT all * * ::/0 ::/0
Chain zone_wan_src_REJECT (1 references)
pkts bytes target prot opt in out source destination
0 0 reject all pppoe-wan * ::/0 ::/0
Can anybody spot the problem?
Thanks,
Frank