Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.protocols.time.ntp > #6349

Re: IPv6 and ip6tables

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hello there.

In IPv4 firewalls, people usually blocks ICMPv4 messages. In IPv6,
ICMPv6 covers funcionalities provided by ICMP, ARP and RARP. So, there
must be some caution about which ICMPv6 messages to be blocked.

There are a few documents about how to manage ICMPv6 messages.

[1] RFC4890 - Recommendations for Filtering ICMPv6 Messages in
Firewalls: http://tools.ietf.org/html/rfc4890

[2] NIST - Guidelines for the Secure Deployment of IPv6:
http://csrc.nist.gov/publications/nistpubs/800-119/sp800-119.pdf
(Subsection 3.5.6 and Table 3-7)

Remaining any doubts, don't hesitate to ask them!

On 2013-03-12 13:50, Rob wrote:
> Xavier Robin <geckolimo@gmail.com> wrote:
>> I don't know if it is related with my provider's network architecture (I have a VPS server hosted by gandi.net) or if it is the common behaviour of NTP over IPv6. I should note I've already had ICMPv6-related issues in the past: I had to turn on router-solicitation and router-advertisement to get a global ipv6 address at all. What should be enabled is still a bit arcane to me.
> 
> When you don't understand ICMP(v6) you should not block it in your
> firewall, as this will cause the weirdest of problems.
> 
> _______________________________________________
> questions mailing list
> questions@lists.ntp.org
> http://lists.ntp.org/listinfo/questions
> 


-- 
Alexandre Yukio Harano
Projects Analyst
harano@nic.br
+55 11 5509-3537 ext 4041

NIC.br - http://nic.br
CEPTRO.br - http://ceptro.br

Back to comp.protocols.time.ntp | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

IPv6 and ip6tables Xavier Robin <geckolimo@gmail.com> - 2013-03-11 02:10 -0700
  Re: IPv6 and ip6tables Ivan Shmakov <oneingray@gmail.com> - 2013-03-11 21:13 +0000
    Re: IPv6 and ip6tables Xavier Robin <geckolimo@gmail.com> - 2013-03-12 08:50 -0700
      Re: IPv6 and ip6tables Rob <nomail@example.com> - 2013-03-12 16:50 +0000
        Re: IPv6 and ip6tables "Alexandre Y. Harano" <harano@nic.br> - 2013-03-12 17:54 +0000
          Re: IPv6 and ip6tables Rob <nomail@example.com> - 2013-03-13 13:28 +0000
            Re: IPv6 and ip6tables David Woolley <david@ex.djwhome.demon.invalid> - 2013-03-14 07:58 +0000
        Re: IPv6 and ip6tables Xavier Robin <geckolimo@gmail.com> - 2013-03-14 07:08 -0700

csiph-web