How to disable IPv6 ping echo reply in Ubuntu 18.04
0
I want to disable IPv4/6 ping echo reply on my Ubuntu 18.04.
For IPv4 I can do it with net.ipv4.icmp_echo_ignore_all=1 in /etc/sysctl.conf.
What is the IPv6 equivalent?
Here is my ip6tables -nvL:
root@localhost:~# sudo ip6tables -nvL
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1990 130K ufw6-before-logging-input all * * ::/0 ::/0
1990 130K ufw6-before-input all * * ::/0 ::/0
0 0 ufw6-after-input all * * ::/0 ::/0
0 0 ufw6-after-logging-input all * * ::/0 ::/0
0 0 ufw6-reject-input all * * ::/0 ::/0
0 0 ufw6-track-input all * * ::/0 ::/0
0 0 DROP icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ufw6-before-logging-forward all * * ::/0 ::/0
0 0 ufw6-before-forward all * * ::/0 ::/0
0 0 ufw6-after-forward all * * ::/0 ::/0
0 0 ufw6-after-logging-forward all * * ::/0 ::/0
0 0 ufw6-reject-forward all * * ::/0 ::/0
0 0 ufw6-track-forward all * * ::/0 ::/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
283 21372 ufw6-before-logging-output all * * ::/0 ::/0
283 21372 ufw6-before-output all * * ::/0 ::/0
39 3884 ufw6-after-output all * * ::/0 ::/0
39 3884 ufw6-after-logging-output all * * ::/0 ::/0
39 3884 ufw6-reject-output all * * ::/0 ::/0
39 3884 ufw6-track-output all * * ::/0 ::/0
Chain ufw6-after-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:137
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:138
0 0 ufw6-skip-to-policy-input tcp * * ::/0 ::/0 tcp dpt:139
0 0 ufw6-skip-to-policy-input tcp * * ::/0 ::/0 tcp dpt:445
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:546
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:547
Chain ufw6-after-logging-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-logging-input (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw6-after-logging-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-forward (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all * * ::/0 ::/0 rt type:0
0 0 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ufw6-user-forward all * * ::/0 ::/0
Chain ufw6-before-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all lo * ::/0 ::/0
0 0 DROP all * * ::/0 ::/0 rt type:0
14 1152 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ufw6-logging-deny all * * ::/0 ::/0 ctstate INVALID
0 0 DROP all * * ::/0 ::/0 ctstate INVALID
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
4 320 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 133 HL match HL == 255
89 5696 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 134 HL match HL == 255
6 432 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 135 HL match HL == 255
11 704 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 136 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 141 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 142 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 130
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 131
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 132
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 143
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 148 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 149 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 151 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 152 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 153 HL match HL == 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 144
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 145
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 146
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 147
0 0 ACCEPT udp * * fe80::/10 fe80::/10 udp spt:547 dpt:546
0 0 ACCEPT udp * * ::/0 ff02::fb udp dpt:5353
0 0 ACCEPT udp * * ::/0 ff02::f udp dpt:1900
0 0 ufw6-user-input all * * ::/0 ::/0
Chain ufw6-before-logging-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-logging-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-logging-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * lo ::/0 ::/0
0 0 DROP all * * ::/0 ::/0 rt type:0
16 1280 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 133 HL match HL == 255
6 384 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 136 HL match HL == 255
11 792 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 135 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 134 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 141 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 142 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 130
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 131
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 132
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 143
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 148 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 149 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 151 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 152 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 153 HL match HL == 1
2 192 ufw6-user-output all * * ::/0 ::/0
Chain ufw6-logging-allow (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "
Chain ufw6-logging-deny (1 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all * * ::/0 ::/0 ctstate INVALID limit: avg 3/min burst 10
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw6-reject-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-reject-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-reject-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-skip-to-policy-forward (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-skip-to-policy-input (6 references)
pkts bytes target prot opt in out source destination
0 0 DROP all * * ::/0 ::/0
Chain ufw6-skip-to-policy-output (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-track-forward (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp * * ::/0 ::/0 ctstate NEW
0 0 ACCEPT udp * * ::/0 ::/0 ctstate NEW
Chain ufw6-track-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-track-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp * * ::/0 ::/0 ctstate NEW
2 192 ACCEPT udp * * ::/0 ::/0 ctstate NEW
Chain ufw6-user-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-input (1 references)
pkts bytes target prot opt in out source destination
.....
.....
.....
Chain ufw6-user-limit (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
0 0 REJECT all * * ::/0 ::/0 reject-with icmp6-port-unreachable
Chain ufw6-user-limit-accept (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-user-logging-forward (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-logging-input (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-logging-output (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-output (1 references)
pkts bytes target prot opt in out source destination
networking ipv6 ping
edited Jan 31 at 7:57
Melebius
5,03752040
asked Jan 31 at 7:18
3x3cut0r3x3cut0r
63
add a comment |
0
I want to disable IPv4/6 ping echo reply on my Ubuntu 18.04.
For IPv4 I can do it with net.ipv4.icmp_echo_ignore_all=1 in /etc/sysctl.conf.
What is the IPv6 equivalent?
Here is my ip6tables -nvL:
root@localhost:~# sudo ip6tables -nvL
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1990 130K ufw6-before-logging-input all * * ::/0 ::/0
1990 130K ufw6-before-input all * * ::/0 ::/0
0 0 ufw6-after-input all * * ::/0 ::/0
0 0 ufw6-after-logging-input all * * ::/0 ::/0
0 0 ufw6-reject-input all * * ::/0 ::/0
0 0 ufw6-track-input all * * ::/0 ::/0
0 0 DROP icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ufw6-before-logging-forward all * * ::/0 ::/0
0 0 ufw6-before-forward all * * ::/0 ::/0
0 0 ufw6-after-forward all * * ::/0 ::/0
0 0 ufw6-after-logging-forward all * * ::/0 ::/0
0 0 ufw6-reject-forward all * * ::/0 ::/0
0 0 ufw6-track-forward all * * ::/0 ::/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
283 21372 ufw6-before-logging-output all * * ::/0 ::/0
283 21372 ufw6-before-output all * * ::/0 ::/0
39 3884 ufw6-after-output all * * ::/0 ::/0
39 3884 ufw6-after-logging-output all * * ::/0 ::/0
39 3884 ufw6-reject-output all * * ::/0 ::/0
39 3884 ufw6-track-output all * * ::/0 ::/0
Chain ufw6-after-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:137
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:138
0 0 ufw6-skip-to-policy-input tcp * * ::/0 ::/0 tcp dpt:139
0 0 ufw6-skip-to-policy-input tcp * * ::/0 ::/0 tcp dpt:445
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:546
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:547
Chain ufw6-after-logging-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-logging-input (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw6-after-logging-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-forward (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all * * ::/0 ::/0 rt type:0
0 0 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ufw6-user-forward all * * ::/0 ::/0
Chain ufw6-before-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all lo * ::/0 ::/0
0 0 DROP all * * ::/0 ::/0 rt type:0
14 1152 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ufw6-logging-deny all * * ::/0 ::/0 ctstate INVALID
0 0 DROP all * * ::/0 ::/0 ctstate INVALID
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
4 320 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 133 HL match HL == 255
89 5696 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 134 HL match HL == 255
6 432 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 135 HL match HL == 255
11 704 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 136 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 141 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 142 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 130
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 131
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 132
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 143
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 148 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 149 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 151 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 152 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 153 HL match HL == 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 144
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 145
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 146
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 147
0 0 ACCEPT udp * * fe80::/10 fe80::/10 udp spt:547 dpt:546
0 0 ACCEPT udp * * ::/0 ff02::fb udp dpt:5353
0 0 ACCEPT udp * * ::/0 ff02::f udp dpt:1900
0 0 ufw6-user-input all * * ::/0 ::/0
Chain ufw6-before-logging-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-logging-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-logging-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * lo ::/0 ::/0
0 0 DROP all * * ::/0 ::/0 rt type:0
16 1280 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 133 HL match HL == 255
6 384 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 136 HL match HL == 255
11 792 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 135 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 134 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 141 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 142 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 130
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 131
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 132
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 143
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 148 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 149 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 151 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 152 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 153 HL match HL == 1
2 192 ufw6-user-output all * * ::/0 ::/0
Chain ufw6-logging-allow (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "
Chain ufw6-logging-deny (1 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all * * ::/0 ::/0 ctstate INVALID limit: avg 3/min burst 10
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw6-reject-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-reject-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-reject-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-skip-to-policy-forward (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-skip-to-policy-input (6 references)
pkts bytes target prot opt in out source destination
0 0 DROP all * * ::/0 ::/0
Chain ufw6-skip-to-policy-output (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-track-forward (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp * * ::/0 ::/0 ctstate NEW
0 0 ACCEPT udp * * ::/0 ::/0 ctstate NEW
Chain ufw6-track-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-track-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp * * ::/0 ::/0 ctstate NEW
2 192 ACCEPT udp * * ::/0 ::/0 ctstate NEW
Chain ufw6-user-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-input (1 references)
pkts bytes target prot opt in out source destination
.....
.....
.....
Chain ufw6-user-limit (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
0 0 REJECT all * * ::/0 ::/0 reject-with icmp6-port-unreachable
Chain ufw6-user-limit-accept (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-user-logging-forward (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-logging-input (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-logging-output (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-output (1 references)
pkts bytes target prot opt in out source destination
networking ipv6 ping
edited Jan 31 at 7:57
Melebius
5,03752040
asked Jan 31 at 7:18
3x3cut0r3x3cut0r
63
1
Don't do that. ICMPv6 echo requests are useful for debugging. They are also absolutely required for your service to be reachable for Teredo clients. Filtering those packets won't solve any problems but it will make problems harder to debug and introduce problems on its own. And if you make any mistake in the filter configuration you may end up filtering ICMPv6 packets which are even more important than echo requests.
– rfc2460
Feb 2 at 11:25
add a comment |
0
0
0
I want to disable IPv4/6 ping echo reply on my Ubuntu 18.04.
For IPv4 I can do it with net.ipv4.icmp_echo_ignore_all=1 in /etc/sysctl.conf.
What is the IPv6 equivalent?
Here is my ip6tables -nvL:
root@localhost:~# sudo ip6tables -nvL
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1990 130K ufw6-before-logging-input all * * ::/0 ::/0
1990 130K ufw6-before-input all * * ::/0 ::/0
0 0 ufw6-after-input all * * ::/0 ::/0
0 0 ufw6-after-logging-input all * * ::/0 ::/0
0 0 ufw6-reject-input all * * ::/0 ::/0
0 0 ufw6-track-input all * * ::/0 ::/0
0 0 DROP icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ufw6-before-logging-forward all * * ::/0 ::/0
0 0 ufw6-before-forward all * * ::/0 ::/0
0 0 ufw6-after-forward all * * ::/0 ::/0
0 0 ufw6-after-logging-forward all * * ::/0 ::/0
0 0 ufw6-reject-forward all * * ::/0 ::/0
0 0 ufw6-track-forward all * * ::/0 ::/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
283 21372 ufw6-before-logging-output all * * ::/0 ::/0
283 21372 ufw6-before-output all * * ::/0 ::/0
39 3884 ufw6-after-output all * * ::/0 ::/0
39 3884 ufw6-after-logging-output all * * ::/0 ::/0
39 3884 ufw6-reject-output all * * ::/0 ::/0
39 3884 ufw6-track-output all * * ::/0 ::/0
Chain ufw6-after-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:137
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:138
0 0 ufw6-skip-to-policy-input tcp * * ::/0 ::/0 tcp dpt:139
0 0 ufw6-skip-to-policy-input tcp * * ::/0 ::/0 tcp dpt:445
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:546
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:547
Chain ufw6-after-logging-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-logging-input (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw6-after-logging-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-forward (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all * * ::/0 ::/0 rt type:0
0 0 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ufw6-user-forward all * * ::/0 ::/0
Chain ufw6-before-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all lo * ::/0 ::/0
0 0 DROP all * * ::/0 ::/0 rt type:0
14 1152 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ufw6-logging-deny all * * ::/0 ::/0 ctstate INVALID
0 0 DROP all * * ::/0 ::/0 ctstate INVALID
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
4 320 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 133 HL match HL == 255
89 5696 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 134 HL match HL == 255
6 432 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 135 HL match HL == 255
11 704 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 136 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 141 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 142 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 130
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 131
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 132
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 143
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 148 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 149 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 151 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 152 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 153 HL match HL == 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 144
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 145
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 146
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 147
0 0 ACCEPT udp * * fe80::/10 fe80::/10 udp spt:547 dpt:546
0 0 ACCEPT udp * * ::/0 ff02::fb udp dpt:5353
0 0 ACCEPT udp * * ::/0 ff02::f udp dpt:1900
0 0 ufw6-user-input all * * ::/0 ::/0
Chain ufw6-before-logging-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-logging-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-logging-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * lo ::/0 ::/0
0 0 DROP all * * ::/0 ::/0 rt type:0
16 1280 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 133 HL match HL == 255
6 384 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 136 HL match HL == 255
11 792 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 135 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 134 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 141 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 142 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 130
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 131
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 132
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 143
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 148 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 149 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 151 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 152 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 153 HL match HL == 1
2 192 ufw6-user-output all * * ::/0 ::/0
Chain ufw6-logging-allow (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "
Chain ufw6-logging-deny (1 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all * * ::/0 ::/0 ctstate INVALID limit: avg 3/min burst 10
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw6-reject-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-reject-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-reject-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-skip-to-policy-forward (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-skip-to-policy-input (6 references)
pkts bytes target prot opt in out source destination
0 0 DROP all * * ::/0 ::/0
Chain ufw6-skip-to-policy-output (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-track-forward (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp * * ::/0 ::/0 ctstate NEW
0 0 ACCEPT udp * * ::/0 ::/0 ctstate NEW
Chain ufw6-track-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-track-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp * * ::/0 ::/0 ctstate NEW
2 192 ACCEPT udp * * ::/0 ::/0 ctstate NEW
Chain ufw6-user-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-input (1 references)
pkts bytes target prot opt in out source destination
.....
.....
.....
Chain ufw6-user-limit (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
0 0 REJECT all * * ::/0 ::/0 reject-with icmp6-port-unreachable
Chain ufw6-user-limit-accept (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-user-logging-forward (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-logging-input (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-logging-output (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-output (1 references)
pkts bytes target prot opt in out source destination
networking ipv6 ping
edited Jan 31 at 7:57
Melebius
5,03752040
asked Jan 31 at 7:18
3x3cut0r3x3cut0r
63
I want to disable IPv4/6 ping echo reply on my Ubuntu 18.04.
For IPv4 I can do it with net.ipv4.icmp_echo_ignore_all=1 in /etc/sysctl.conf.
What is the IPv6 equivalent?
Here is my ip6tables -nvL:
root@localhost:~# sudo ip6tables -nvL
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1990 130K ufw6-before-logging-input all * * ::/0 ::/0
1990 130K ufw6-before-input all * * ::/0 ::/0
0 0 ufw6-after-input all * * ::/0 ::/0
0 0 ufw6-after-logging-input all * * ::/0 ::/0
0 0 ufw6-reject-input all * * ::/0 ::/0
0 0 ufw6-track-input all * * ::/0 ::/0
0 0 DROP icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ufw6-before-logging-forward all * * ::/0 ::/0
0 0 ufw6-before-forward all * * ::/0 ::/0
0 0 ufw6-after-forward all * * ::/0 ::/0
0 0 ufw6-after-logging-forward all * * ::/0 ::/0
0 0 ufw6-reject-forward all * * ::/0 ::/0
0 0 ufw6-track-forward all * * ::/0 ::/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
283 21372 ufw6-before-logging-output all * * ::/0 ::/0
283 21372 ufw6-before-output all * * ::/0 ::/0
39 3884 ufw6-after-output all * * ::/0 ::/0
39 3884 ufw6-after-logging-output all * * ::/0 ::/0
39 3884 ufw6-reject-output all * * ::/0 ::/0
39 3884 ufw6-track-output all * * ::/0 ::/0
Chain ufw6-after-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:137
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:138
0 0 ufw6-skip-to-policy-input tcp * * ::/0 ::/0 tcp dpt:139
0 0 ufw6-skip-to-policy-input tcp * * ::/0 ::/0 tcp dpt:445
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:546
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:547
Chain ufw6-after-logging-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-logging-input (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw6-after-logging-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-forward (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all * * ::/0 ::/0 rt type:0
0 0 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ufw6-user-forward all * * ::/0 ::/0
Chain ufw6-before-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all lo * ::/0 ::/0
0 0 DROP all * * ::/0 ::/0 rt type:0
14 1152 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ufw6-logging-deny all * * ::/0 ::/0 ctstate INVALID
0 0 DROP all * * ::/0 ::/0 ctstate INVALID
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
4 320 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 133 HL match HL == 255
89 5696 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 134 HL match HL == 255
6 432 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 135 HL match HL == 255
11 704 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 136 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 141 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 142 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 130
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 131
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 132
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 143
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 148 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 149 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 151 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 152 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 153 HL match HL == 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 144
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 145
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 146
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 147
0 0 ACCEPT udp * * fe80::/10 fe80::/10 udp spt:547 dpt:546
0 0 ACCEPT udp * * ::/0 ff02::fb udp dpt:5353
0 0 ACCEPT udp * * ::/0 ff02::f udp dpt:1900
0 0 ufw6-user-input all * * ::/0 ::/0
Chain ufw6-before-logging-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-logging-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-logging-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * lo ::/0 ::/0
0 0 DROP all * * ::/0 ::/0 rt type:0
16 1280 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 133 HL match HL == 255
6 384 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 136 HL match HL == 255
11 792 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 135 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 134 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 141 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 142 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 130
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 131
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 132
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 143
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 148 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 149 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 151 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 152 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 153 HL match HL == 1
2 192 ufw6-user-output all * * ::/0 ::/0
Chain ufw6-logging-allow (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "
Chain ufw6-logging-deny (1 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all * * ::/0 ::/0 ctstate INVALID limit: avg 3/min burst 10
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw6-reject-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-reject-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-reject-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-skip-to-policy-forward (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-skip-to-policy-input (6 references)
pkts bytes target prot opt in out source destination
0 0 DROP all * * ::/0 ::/0
Chain ufw6-skip-to-policy-output (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-track-forward (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp * * ::/0 ::/0 ctstate NEW
0 0 ACCEPT udp * * ::/0 ::/0 ctstate NEW
Chain ufw6-track-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-track-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp * * ::/0 ::/0 ctstate NEW
2 192 ACCEPT udp * * ::/0 ::/0 ctstate NEW
Chain ufw6-user-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-input (1 references)
pkts bytes target prot opt in out source destination
.....
.....
.....
Chain ufw6-user-limit (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
0 0 REJECT all * * ::/0 ::/0 reject-with icmp6-port-unreachable
Chain ufw6-user-limit-accept (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-user-logging-forward (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-logging-input (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-logging-output (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-output (1 references)
pkts bytes target prot opt in out source destination
networking ipv6 ping
networking ipv6 ping
edited Jan 31 at 7:57
Melebius
5,03752040
asked Jan 31 at 7:18
3x3cut0r3x3cut0r
63
edited Jan 31 at 7:57
Melebius
5,03752040
asked Jan 31 at 7:18
3x3cut0r3x3cut0r
63
edited Jan 31 at 7:57
Melebius
5,03752040
edited Jan 31 at 7:57
Melebius
5,03752040
edited Jan 31 at 7:57
Melebius
5,03752040
5,03752040
asked Jan 31 at 7:18
3x3cut0r3x3cut0r
63
asked Jan 31 at 7:18
3x3cut0r3x3cut0r
63
asked Jan 31 at 7:18
3x3cut0r3x3cut0r
63
63
1
Don't do that. ICMPv6 echo requests are useful for debugging. They are also absolutely required for your service to be reachable for Teredo clients. Filtering those packets won't solve any problems but it will make problems harder to debug and introduce problems on its own. And if you make any mistake in the filter configuration you may end up filtering ICMPv6 packets which are even more important than echo requests.
– rfc2460
Feb 2 at 11:25
add a comment |
1
Don't do that. ICMPv6 echo requests are useful for debugging. They are also absolutely required for your service to be reachable for Teredo clients. Filtering those packets won't solve any problems but it will make problems harder to debug and introduce problems on its own. And if you make any mistake in the filter configuration you may end up filtering ICMPv6 packets which are even more important than echo requests.
– rfc2460
Feb 2 at 11:25
1
1
Don't do that. ICMPv6 echo requests are useful for debugging. They are also absolutely required for your service to be reachable for Teredo clients. Filtering those packets won't solve any problems but it will make problems harder to debug and introduce problems on its own. And if you make any mistake in the filter configuration you may end up filtering ICMPv6 packets which are even more important than echo requests.
– rfc2460
Feb 2 at 11:25
Don't do that. ICMPv6 echo requests are useful for debugging. They are also absolutely required for your service to be reachable for Teredo clients. Filtering those packets won't solve any problems but it will make problems harder to debug and introduce problems on its own. And if you make any mistake in the filter configuration you may end up filtering ICMPv6 packets which are even more important than echo requests.
– rfc2460
Feb 2 at 11:25
add a comment |
1 Answer
1
active
oldest
votes
0
Because you use ufw, you have to edit file /etc/ufw/before6.rules and add a line:
-A ufw6-before-input -p icmpv6 --icmpv6-type echo-request -j DROP
Then sudo service ufw restart
For "clean ip6tables" solution:
sudo ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
It will ignore every echo request packet. But be aware, that VPS provider may use echo-request/echo-reply to determine if your server is running.
answered Jan 31 at 7:23
Krzysztof SawickiKrzysztof Sawicki
23115
this is not working. i can ping6 my vps anyway. and even it would ... how can i make this permanent? i'm using ufw ... should i write this in the /etc/ufw/before.rules?
– 3x3cut0r
Jan 31 at 7:28
Show us the current ip6tables configurationsudo ip6tables -nvL. For making it permament just install iptables-persistent package.
– Krzysztof Sawicki
Jan 31 at 7:31
i edited the question above to add the output
– 3x3cut0r
Jan 31 at 7:45
ahh now it is working. i found the entrys in the /etc/ufw/before6.rules and changed the --icmpv6-type echo-request and echo-reply to DROP in the INPUT section. thank you
– 3x3cut0r
Jan 31 at 9:40
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1114311%2fhow-to-disable-ipv6-ping-echo-reply-in-ubuntu-18-04%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
0
Because you use ufw, you have to edit file /etc/ufw/before6.rules and add a line:
-A ufw6-before-input -p icmpv6 --icmpv6-type echo-request -j DROP
Then sudo service ufw restart
For "clean ip6tables" solution:
sudo ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
It will ignore every echo request packet. But be aware, that VPS provider may use echo-request/echo-reply to determine if your server is running.
answered Jan 31 at 7:23
Krzysztof SawickiKrzysztof Sawicki
23115
this is not working. i can ping6 my vps anyway. and even it would ... how can i make this permanent? i'm using ufw ... should i write this in the /etc/ufw/before.rules?
– 3x3cut0r
Jan 31 at 7:28
Show us the current ip6tables configurationsudo ip6tables -nvL. For making it permament just install iptables-persistent package.
– Krzysztof Sawicki
Jan 31 at 7:31
i edited the question above to add the output
– 3x3cut0r
Jan 31 at 7:45
ahh now it is working. i found the entrys in the /etc/ufw/before6.rules and changed the --icmpv6-type echo-request and echo-reply to DROP in the INPUT section. thank you
– 3x3cut0r
Jan 31 at 9:40
add a comment |
0
Because you use ufw, you have to edit file /etc/ufw/before6.rules and add a line:
-A ufw6-before-input -p icmpv6 --icmpv6-type echo-request -j DROP
Then sudo service ufw restart
For "clean ip6tables" solution:
sudo ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
It will ignore every echo request packet. But be aware, that VPS provider may use echo-request/echo-reply to determine if your server is running.
answered Jan 31 at 7:23
Krzysztof SawickiKrzysztof Sawicki
23115
this is not working. i can ping6 my vps anyway. and even it would ... how can i make this permanent? i'm using ufw ... should i write this in the /etc/ufw/before.rules?
– 3x3cut0r
Jan 31 at 7:28
Show us the current ip6tables configurationsudo ip6tables -nvL. For making it permament just install iptables-persistent package.
– Krzysztof Sawicki
Jan 31 at 7:31
i edited the question above to add the output
– 3x3cut0r
Jan 31 at 7:45
ahh now it is working. i found the entrys in the /etc/ufw/before6.rules and changed the --icmpv6-type echo-request and echo-reply to DROP in the INPUT section. thank you
– 3x3cut0r
Jan 31 at 9:40
add a comment |
0
0
0
Because you use ufw, you have to edit file /etc/ufw/before6.rules and add a line:
-A ufw6-before-input -p icmpv6 --icmpv6-type echo-request -j DROP
Then sudo service ufw restart
For "clean ip6tables" solution:
sudo ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
It will ignore every echo request packet. But be aware, that VPS provider may use echo-request/echo-reply to determine if your server is running.
answered Jan 31 at 7:23
Krzysztof SawickiKrzysztof Sawicki
23115
Because you use ufw, you have to edit file /etc/ufw/before6.rules and add a line:
-A ufw6-before-input -p icmpv6 --icmpv6-type echo-request -j DROP
Then sudo service ufw restart
For "clean ip6tables" solution:
sudo ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
It will ignore every echo request packet. But be aware, that VPS provider may use echo-request/echo-reply to determine if your server is running.
answered Jan 31 at 7:23
Krzysztof SawickiKrzysztof Sawicki
23115
edited Jan 31 at 7:57
answered Jan 31 at 7:23
Krzysztof SawickiKrzysztof Sawicki
23115
answered Jan 31 at 7:23
Krzysztof SawickiKrzysztof Sawicki
23115
answered Jan 31 at 7:23
Krzysztof SawickiKrzysztof Sawicki
23115
23115
this is not working. i can ping6 my vps anyway. and even it would ... how can i make this permanent? i'm using ufw ... should i write this in the /etc/ufw/before.rules?
– 3x3cut0r
Jan 31 at 7:28
Show us the current ip6tables configurationsudo ip6tables -nvL. For making it permament just install iptables-persistent package.
– Krzysztof Sawicki
Jan 31 at 7:31
i edited the question above to add the output
– 3x3cut0r
Jan 31 at 7:45
ahh now it is working. i found the entrys in the /etc/ufw/before6.rules and changed the --icmpv6-type echo-request and echo-reply to DROP in the INPUT section. thank you
– 3x3cut0r
Jan 31 at 9:40
add a comment |
this is not working. i can ping6 my vps anyway. and even it would ... how can i make this permanent? i'm using ufw ... should i write this in the /etc/ufw/before.rules?
– 3x3cut0r
Jan 31 at 7:28
Show us the current ip6tables configurationsudo ip6tables -nvL. For making it permament just install iptables-persistent package.
– Krzysztof Sawicki
Jan 31 at 7:31
i edited the question above to add the output
– 3x3cut0r
Jan 31 at 7:45
ahh now it is working. i found the entrys in the /etc/ufw/before6.rules and changed the --icmpv6-type echo-request and echo-reply to DROP in the INPUT section. thank you
– 3x3cut0r
Jan 31 at 9:40
this is not working. i can ping6 my vps anyway. and even it would ... how can i make this permanent? i'm using ufw ... should i write this in the /etc/ufw/before.rules?
– 3x3cut0r
Jan 31 at 7:28
this is not working. i can ping6 my vps anyway. and even it would ... how can i make this permanent? i'm using ufw ... should i write this in the /etc/ufw/before.rules?
– 3x3cut0r
Jan 31 at 7:28
Show us the current ip6tables configuration
sudo ip6tables -nvL. For making it permament just install iptables-persistent package.– Krzysztof Sawicki
Jan 31 at 7:31
Show us the current ip6tables configuration
sudo ip6tables -nvL. For making it permament just install iptables-persistent package.– Krzysztof Sawicki
Jan 31 at 7:31
i edited the question above to add the output
– 3x3cut0r
Jan 31 at 7:45
i edited the question above to add the output
– 3x3cut0r
Jan 31 at 7:45
ahh now it is working. i found the entrys in the /etc/ufw/before6.rules and changed the --icmpv6-type echo-request and echo-reply to DROP in the INPUT section. thank you
– 3x3cut0r
Jan 31 at 9:40
ahh now it is working. i found the entrys in the /etc/ufw/before6.rules and changed the --icmpv6-type echo-request and echo-reply to DROP in the INPUT section. thank you
– 3x3cut0r
Jan 31 at 9:40
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1114311%2fhow-to-disable-ipv6-ping-echo-reply-in-ubuntu-18-04%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Don't do that. ICMPv6 echo requests are useful for debugging. They are also absolutely required for your service to be reachable for Teredo clients. Filtering those packets won't solve any problems but it will make problems harder to debug and introduce problems on its own. And if you make any mistake in the filter configuration you may end up filtering ICMPv6 packets which are even more important than echo requests.
– rfc2460
Feb 2 at 11:25