On Sat, Dec 31, 2016 at 7:19 PM, Tom Eastep <[email protected]> wrote:
>> Should I restart shorewall6? And if yes, on which event?
> We can't answer that without knowing if your Shorewall6 configuration
> is dependent on the IPv6 address of ppp0 or the IPv6 local network
> address. If it isn't, then there is no reason to *reload* (there is
> never a need to *restart* in this case)
My rules don't specify IPv6 addresses, they only filter between zones.
But the IPv6 network is in the reject, Broadcast and smurfs chain:
Chain reject
target prot opt in out source destination
DROP all * * ::/0
2a02:200:2e00:91d4::
DROP all * * ::/0
2a02:200:2e00:91d4:ffff:ffff:ffff:ff80/121
DROP all * * ::/0
2a02:200:2e00:91da::
DROP all * * ::/0
2a02:200:2e00:91da:ffff:ffff:ffff:ff80/121
DROP all * * ::/0
2a02:200:2e00:91db::
DROP all * * ::/0
2a02:200:2e00:91db:ffff:ffff:ffff:ff80/121
DROP all * * ::/0
2a02:200:2e00:91dc::
DROP all * * ::/0
2a02:200:2e00:91dc:ffff:ffff:ffff:ff80/121
DROP all * * ::/0
2a02:200:2e00:91dd::
DROP all * * ::/0
2a02:200:2e00:91dd:ffff:ffff:ffff:ff80/121
DROP all * * ::/0
2a02:200:2f00:91d::
DROP all * * ::/0
2a02:200:2f00:91d:ffff:ffff:ffff:ff80/121
DROP all * * ff00::/8 ::/0
DROP 2 * * ::/0 ::/0
REJECT tcp * * ::/0 ::/0
reject-with tcp-reset
REJECT udp * * ::/0 ::/0
reject-with icmp6-port-unreachable
REJECT icmpv6 * * ::/0 ::/0
reject-with icmp6-addr-unreachable
REJECT all * * ::/0 ::/0
reject-with icmp6-adm-prohibited
Chain Broadcast
target prot opt in out source destination
NFLOG all * * ::/0
2a02:200:2e00:91d4:: nflog-prefix "Shorewall:Broadcast:DROP:"
nflog-group 6
DROP all * * ::/0
2a02:200:2e00:91d4::
NFLOG all * * ::/0
2a02:200:2e00:91d4:ffff:ffff:ffff:ff80/121 nflog-prefix
"Shorewall:Broadcast:DROP:" nflog-group 6
DROP all * * ::/0
2a02:200:2e00:91d4:ffff:ffff:ffff:ff80/121
NFLOG all * * ::/0
2a02:200:2e00:91da:: nflog-prefix "Shorewall:Broadcast:DROP:"
nflog-group 6
DROP all * * ::/0
2a02:200:2e00:91da::
NFLOG all * * ::/0
2a02:200:2e00:91da:ffff:ffff:ffff:ff80/121 nflog-prefix
"Shorewall:Broadcast:DROP:" nflog-group 6
DROP all * * ::/0
2a02:200:2e00:91da:ffff:ffff:ffff:ff80/121
NFLOG all * * ::/0
2a02:200:2e00:91db:: nflog-prefix "Shorewall:Broadcast:DROP:"
nflog-group 6
DROP all * * ::/0
2a02:200:2e00:91db::
NFLOG all * * ::/0
2a02:200:2e00:91db:ffff:ffff:ffff:ff80/121 nflog-prefix
"Shorewall:Broadcast:DROP:" nflog-group 6
DROP all * * ::/0
2a02:200:2e00:91db:ffff:ffff:ffff:ff80/121
NFLOG all * * ::/0
2a02:200:2e00:91dc:: nflog-prefix "Shorewall:Broadcast:DROP:"
nflog-group 6
DROP all * * ::/0
2a02:200:2e00:91dc::
NFLOG all * * ::/0
2a02:200:2e00:91dc:ffff:ffff:ffff:ff80/121 nflog-prefix
"Shorewall:Broadcast:DROP:" nflog-group 6
DROP all * * ::/0
2a02:200:2e00:91dc:ffff:ffff:ffff:ff80/121
NFLOG all * * ::/0
2a02:200:2e00:91dd:: nflog-prefix "Shorewall:Broadcast:DROP:"
nflog-group 6
DROP all * * ::/0
2a02:200:2e00:91dd::
NFLOG all * * ::/0
2a02:200:2e00:91dd:ffff:ffff:ffff:ff80/121 nflog-prefix
"Shorewall:Broadcast:DROP:" nflog-group 6
DROP all * * ::/0
2a02:200:2e00:91dd:ffff:ffff:ffff:ff80/121
NFLOG all * * ::/0
2a02:200:2f00:91d:: nflog-prefix "Shorewall:Broadcast:DROP:"
nflog-group 6
DROP all * * ::/0
2a02:200:2f00:91d::
NFLOG all * * ::/0
2a02:200:2f00:91d:ffff:ffff:ffff:ff80/121 nflog-prefix
"Shorewall:Broadcast:DROP:" nflog-group 6
DROP all * * ::/0
2a02:200:2f00:91d:ffff:ffff:ffff:ff80/121
NFLOG all * * ::/0
ff00::/8 nflog-prefix "Shorewall:Broadcast:DROP:"
nflog-group 6
DROP all * * ::/0 ff00::/8
Chain smurfs
target prot opt in out source destination
smurflog all * * 2a02:200:2e00:91d4:: ::/0
[goto]
smurflog all * *
2a02:200:2e00:91d4:ffff:ffff:ffff:ff80/121 ::/0 [goto]
smurflog all * * 2a02:200:2e00:91da:: ::/0
[goto]
smurflog all * *
2a02:200:2e00:91da:ffff:ffff:ffff:ff80/121 ::/0 [goto]
smurflog all * * 2a02:200:2e00:91db:: ::/0
[goto]
smurflog all * *
2a02:200:2e00:91db:ffff:ffff:ffff:ff80/121 ::/0 [goto]
smurflog all * * 2a02:200:2e00:91dc:: ::/0
[goto]
smurflog all * *
2a02:200:2e00:91dc:ffff:ffff:ffff:ff80/121 ::/0 [goto]
smurflog all * * 2a02:200:2e00:91dd:: ::/0
[goto]
smurflog all * *
2a02:200:2e00:91dd:ffff:ffff:ffff:ff80/121 ::/0 [goto]
smurflog all * * 2a02:200:2f00:91d:: ::/0
[goto]
smurflog all * *
2a02:200:2f00:91d:ffff:ffff:ffff:ff80/121 ::/0 [goto]
smurflog all * * ff00::/8 ::/0
[goto]
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
