Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 175974 - IPv6 router guide: firewall rules blocking IPv6 access
Summary: IPv6 router guide: firewall rules blocking IPv6 access
Status: RESOLVED FIXED
Alias: None
Product: [OLD] Docs on www.gentoo.org
Classification: Unclassified
Component: Other documents (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: nm (RETIRED)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-04-25 15:06 UTC by Xake
Modified: 2007-05-20 20:58 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Xake 2007-04-25 15:06:52 UTC
I have tried for some time to get IPv6 running on my router, and here is the current problem that I have had for some time:

If I compile IPv6 into the kernel or places ipv6 in /etx/modules.autoload.d/kernel-2.6 I get no "Scope: Global" adress, only a Link adress for my wan interface.
However if I DO NOT aoutoload ipv6 and then I do a modprobe -iv ipv6 I see the module got loaded and after that ifconfig shows me an assigned ipv6-address.
I have no diffrence on my system what so ever before and after.

All packages compiled with ipv6, and yes. My ISP do provide ipv6.

Portage 2.1.2.4 (selinux/x86/2006.1, gcc-4.1.2, glibc-2.5-r1, 2.6.20-hardened-r2 i686)
=================================================================
System uname: 2.6.20-hardened-r2 i686 Pentium III (Coppermine)
Gentoo Base System release 1.13.0_alpha12
Timestamp of tree: Wed, 25 Apr 2007 13:50:01 +0000
distcc 2.18.3 i686-pc-linux-gnu (protocols 1 and 2) (default port 3632) [enabled]
dev-lang/python:     2.4.4
dev-python/pycrypto: 2.0.1-r5
sys-apps/sandbox:    1.2.18.1
sys-devel/autoconf:  2.13, 2.61
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.17.50.0.15
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.23b
virtual/os-headers:  2.6.20-r2
ACCEPT_KEYWORDS="x86 ~x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=pentium3 -pipe -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /opt/glftpd/etc /opt/glftpd/ftp-data /usr/lib/fax /var/spool/fax/etc"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/php/apache1-php5/ext-active/ /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/terminfo"
CXXFLAGS="-O2 -march=pentium3 -pipe -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="distcc distlocks loadpolicy parallel-fetch sandbox selinux sesandbox sfperms strict test"
GENTOO_MIRRORS="ftp://ftp.sunet.se/pub/os/Linux/distributions/gentoo http://ds.thn.htu.se/linux/gentoo "
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,--hash-style=gnu"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/overlays/portage /usr/local/overlays/pieworld /usr/portage/local/layman/webapps-experimental"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="apache2 bash-completion berkdb bzip2 crypt cups curl fam glibc-omitfp gmp hardened ipv6 jpeg logrotate midi mysql ncurses nls nonfsv4 nptl nptlonly offensive pam pic png python readline selinux sensord serial srvdir sse ssl syslog tcpd test tiff unicode unzip x86 xattr xinetd zip zlib" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="none"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 1 Xake 2007-04-26 15:46:36 UTC
This is something for the DOC team as it seems like my old firewall-rules (a version of the ones found in the "home-router-doc") did block dhcpv6-client and thus my machine could not obtain a address. Maybe add a note about this in that or the "ipv6-guide"?
Comment 2 Daniel Drake (RETIRED) gentoo-dev 2007-04-26 20:25:17 UTC
Are you able to test the latest gentoo-sources or does your system require you to run a hardened kernel?
Comment 3 Daniel Drake (RETIRED) gentoo-dev 2007-05-06 21:02:00 UTC
Ignore the above comment, I must have missed the earlier explanation.

Please clarify which home router doc you were reading, which firewall rule was blocking the access, and which changes you needed to make to solve the problem.
Comment 4 Daniel Drake (RETIRED) gentoo-dev 2007-05-20 04:42:49 UTC
Closing due to no response. I'm assuming the guides you originally followed were not part of the official Gentoo documentation project. If they were, feel free to reopen with the info requested above.
Comment 5 Xake 2007-05-20 08:59:18 UTC
Sorry, did forgot this one.

I think your documentation (the only one I have followed) should be written to include how you do things if your ISP does provide ipv6.

But my question really is:
does net.ipv6.conf.default.forwarding=1 need a configured radvd and/or dns and/or a tunnel if you are having native ipv6 from your ISP? The language the docs is written in like "Traffic should now be forwarded from this box through the tunnel we've established with our broker." makes things confusing: is this optional or a must have in my case?

My ISP currently can't provide prefixes (they say the support is on it's way, but currently not a priority) so I had to stop at Radvd. Then after reboot ipv6 did not work. After MUCH experiments I found the culprit was net.ipv6.conf.default.forwarding=1, removing it from sysctrl and everything works fine after a reboot. Looking trough your documantation for a IPv6 router I found the only missing things is radvd and a dns. So that is the motivation behind my question.
Comment 6 Daniel Drake (RETIRED) gentoo-dev 2007-05-20 14:26:22 UTC
I still don't feel you provided all the info requested in comment #3. Nevertheless I'll send this over to the docs team who will hopefully help after you have clarified. I know nothing about ipv6 myself.
Comment 7 Xake 2007-05-20 15:16:11 UTC
Makeing things clearer.
The docs I followed was: 

"Home Router Guide" http://www.gentoo.org/doc/en/home-router-howto.xml
"Gentoo IPv6 Router Guide" http://www.gentoo.org/doc/en/ipv6.xml

Currently removing/changeing
net.ipv6.conf.default.forwarding=1
to 0 and reboot makes things work.
Had forgotten about the firewall-part my earlier investigations showed, should take a look at them again.
Comment 8 nm (RETIRED) gentoo-dev 2007-05-20 20:58:40 UTC
You missed the warnings in the document that the default.forwarding step is **unnecessary if you will using the radvd init script**. Though this is more the fault of the user than of the doc, I went ahead and made this more clear.

While I was at it, I stripped out all the stuff on 2.4 kernels, since those are no longer available in the tree.