<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN" "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd"> <article> <!--$Id$--> <articleinfo> <title>Shorewall IPv6 Support</title> <authorgroup> <author> <firstname>Tom</firstname> <surname>Eastep</surname> </author> </authorgroup> <pubdate><?dbtimestamp format="Y/m/d"?></pubdate> <copyright> <year>2008</year> <year>2009</year> <holder>Thomas M. Eastep</holder> </copyright> <legalnotice> <para>Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of the license is included in the section entitled <quote><ulink url="GnuCopyright.htm">GNU Free Documentation License</ulink></quote>.</para> </legalnotice> </articleinfo> <caution> <para><emphasis role="bold">This article applies to Shorewall 4.3 and later. If you are running a version of Shorewall earlier than Shorewall 4.3.5 then please see the documentation for that release.</emphasis></para> </caution> <section> <title>Overview</title> <para>Beginning with Shorewall 4.2.4, support for firewalling IPv6 is included as part of Shorewall.</para> <section> <title>Prerequisites</title> <para>In order to use Shorewall with IPv6, your firewall must meet the following prerequisites:</para> <orderedlist> <listitem> <para><ulink url="FAQ.htm#faq80a">Kernel 2.6.24 or later</ulink>.</para> </listitem> <listitem> <para>Iptables 1.4.0 or later (1.4.1.1 is strongly recommended)</para> </listitem> <listitem> <para>If you wish to include DNS names in your IPv6 configuration files, you must have Perl 5.10 and must install the Perl Socket6 library.</para> </listitem> </orderedlist> </section> <section> <title>Packages</title> <para>Shorewall IPv6 support introduced two new packages:</para> <orderedlist> <listitem> <para>Shorewall6. This package provides <filename>/sbin/shorewall6</filename> which is the IPv6 equivalent of <filename>/sbin/shorewall</filename>. <filename>/sbin/shorewall</filename> only handles IPv4 while <filename>/sbin/shorewall6</filename> handles only IPv6.. Shorewall6 depends on Shorewall. The Shorewall6 configuration is stored in <filename class="directory">/etc/shorewall6</filename>.</para> </listitem> <listitem> <para>Shorewall6 Lite. This package is to IPv6 what Shorewall Lite is to IPv4. The package stores its configuration in <filename class="directory">/etc/shorewall6-lite</filename>. As with Shorewall Lite, Shorewall6 Lite usually requires no configuration changes on the firewall system.</para> </listitem> </orderedlist> </section> <section> <title>IPv4/IPv6 Interaction</title> <para>IP connections are either IPv4 or IPv6; there is no such thing as a mixed IPv4/6 connecton. IPv4 connections are controlled by Shorewall (or Shorewall-lite); IPv6 connections are controlled by Shorewall6 (or Shorewall6-lite). Starting and stopping the firewall for one address family has no effect on the other address family.</para> <para>As a consequence, there is very little interaction between Shorewall and Shorewall6.</para> <section> <title>DISABLE_IPV6</title> <para>An obvious area where the configuration of Shorewall affects Shorewall6 is the DISABLE_IPV6 setting in <filename>/etc/shorewall/shorewall.conf</filename>. When configuring Shorewall6, you will want to set DISABLE_IPV6=No and restart Shorewall or Shorewall-lite.</para> </section> <section> <title>TC_ENABLED</title> <para>Another area where their configurations overlap is in traffic shaping; the <filename>tcdevices</filename> and tcclasses files do exactly the same thing in both Shorewall and Shorewall6. Consequently, you will have TC_ENABLED=Internal in Shorewall or in Shorewall6 and TC_ENABLED=No in the other product. Also, you will want CLEAR_TC=No in the configuration with TC_ENABLED=No.</para> <para>Regardless of which product has TC_ENABLED=Internal:</para> <itemizedlist> <listitem> <para>IPv4 packet marking is controlled by /etc/shorewall/tcrules</para> </listitem> <listitem> <para>IPv6 packet marking is controlled by /etc/shorewall6/tcrules</para> </listitem> </itemizedlist> </section> <section> <title>KEEP_RT_TABLES</title> <para>Multi-ISP users will need to be aware of this one. When there are entries in the providers file, Shorewall normally installs a modified <filename>/etc/iproute2/rt_tables</filename> during <command>shorewall start</command> and <command>shorewall restart</command> and restores a default file during <command>shorewall stop</command>. Setting KEEP_RT_TABLES=Yes in <ulink url="manpages/shorewall.conf.html">shorewall.conf</ulink>(5) stops Shorewall (Shorewall lite) from modifying <filename>/etc/iproute2/rt_tables</filename>.</para> <para>Shorewall6 is also capable of modifying <filename>/etc/iproute2/rt_tables</filename> in a similar way.</para> <para>Our recommendation to Multi-ISP users is to:</para> <itemizedlist> <listitem> <para>Select the same names for similar providers.</para> </listitem> <listitem> <para>Set KEEP_RT_TABLES=No in <ulink url="manpages/shorewall.conf.html">shorewall.conf</ulink>(5) and set KEEP_RT_TABLES=Yes in <ulink url="manpages6/shorewall6.conf.html">shorewall6.conf</ulink>(5).</para> </listitem> </itemizedlist> <para>These setting allow Shorewall to control the contents of <filename>/etc/iproute2/rt_tables</filename>.</para> </section> <section> <title>6TO4</title> <para>If you are using a 6to4 tunnel for your IPv6 connectivity, you need an entry in <filename>/etc/shorewall/tunnels</filename>.<programlisting>#TYPE ZONE GATEWAY GATEWAY # ZONE 6to4 net #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE</programlisting></para> </section> </section> </section> <section> <title>Shorewall6 Differences from Shorewall</title> <para>Configuring and operating Shorewall6 is very similar to configuring Shorewall with some notable exceptions:</para> <variablelist> <varlistentry> <term>No NAT</term> <listitem> <para>In Shorewall6, there is no NAT of any kind (Netfilter6 doesn't support any form of NAT). Most people consider this to be a giant step forward.</para> <para>When an ISP assigns you an IPv6 address, you are actually assigned an IPv6 <firstterm>prefix</firstterm> (similar to a subnet). A 64-bit prefix defines a subnet with 4 billion hosts squared (the size of the IPv4 address space squared). Regardless of the length of your prefix, you get to assign local addresses within that prefix.</para> </listitem> </varlistentry> <varlistentry> <term>Default Zone Type</term> <listitem> <para>The default zone type in Shorewall6 is <firstterm>ipv6</firstterm>. It is suggested that you specify <emphasis role="bold">ipv6</emphasis> in the TYPE column of <filename>/etc/shorewall6/zones</filename> and a type of <emphasis role="bold">ipv4</emphasis> in <filename>/etc/shorewall/zones</filename>; that way, if you run the wrong utility on a configuration, you will get an instant error.</para> </listitem> </varlistentry> <varlistentry> <term>Interface Options</term> <listitem> <para>The following interface options are available in <filename>/etc/shorewall6/interfaces</filename>:</para> <variablelist> <varlistentry> <term>blacklist</term> <listitem> <para>Same as in Shorewall</para> </listitem> </varlistentry> <varlistentry> <term>bridge</term> <listitem> <para>Same as in Shorewall</para> </listitem> </varlistentry> <varlistentry> <term>dhcp</term> <listitem> <para>Interface is assigned by IPv6 DHCP or the firewall hosts an IPv6 DHCP server on the interface.</para> </listitem> </varlistentry> <varlistentry> <term>maclist</term> <listitem> <para>Same as in Shorewall</para> </listitem> </varlistentry> <varlistentry> <term>nosmurfs</term> <listitem> <para>Checks the source IP address of packets arriving on the interface and drops packets whose SOURCE address is:</para> <itemizedlist> <listitem> <para>An IPv6 multicast address</para> </listitem> <listitem> <para>The subnet-router anycast address for any of the global unicast addresses assigned to the interface.</para> </listitem> <listitem> <para>An RFC 2526 anycast address for any of the global unicast addresses assigned to the interface.</para> </listitem> </itemizedlist> </listitem> </varlistentry> <varlistentry> <term>optional</term> <listitem> <para>Same as in Shorewall</para> </listitem> </varlistentry> <varlistentry> <term>routeback</term> <listitem> <para>Same as in Shorewall</para> </listitem> </varlistentry> <varlistentry> <term>sourceroute[={0|1}]</term> <listitem> <para>Same as in Shorewall</para> </listitem> </varlistentry> <varlistentry> <term>tcpflags</term> <listitem> <para>Same as in Shorewall</para> </listitem> </varlistentry> <varlistentry> <term>mss=<replaceable>mss</replaceable></term> <listitem> <para>Same as in Shorewall</para> </listitem> </varlistentry> <varlistentry> <term>forward[={0|1}]</term> <listitem> <para>Override the setting of IP_FORWARDING in shorewall6.conf with respect to how the system behaves on this interface. If 1, behave as a router; if 0, behave as a host.</para> </listitem> </varlistentry> </variablelist> </listitem> </varlistentry> <varlistentry> <term>Host Options</term> <listitem> <para>The following host options are available in<filename> /etc/shorewall6/hosts</filename>:</para> <variablelist> <varlistentry> <term>blacklist</term> <listitem> <para>Same as in Shorewall</para> </listitem> </varlistentry> <varlistentry> <term>maclist</term> <listitem> <para>Same as in Shorewall</para> </listitem> </varlistentry> <varlistentry> <term>routeback</term> <listitem> <para>Same as in Shorewall</para> </listitem> </varlistentry> <varlistentry> <term>tcpflags</term> <listitem> <para>Same as in Shorewall</para> </listitem> </varlistentry> </variablelist> </listitem> </varlistentry> <varlistentry> <term>Specifying Addresses</term> <listitem> <para>Anywhere that an address or address list follows a colon (":"), the address or list may be enclosed in angled brackets ("<" and ">") to improve readability.</para> <para>Example (<filename>/etc/shorewall6/rules</filename>):</para> <programlisting>#ACTION SOURCE DEST PROTO DEST # PORT(S) ACCEPT net $FW:<2002:ce7c:92b4::3> tcp 22</programlisting> <para>When the colon is preceeded by an interface name, <emphasis>the angle brackets are required</emphasis>. This is true even when the address is a MAC address in Shorewall format.</para> <para>Example (<filename>/etc/shorewall6/rules</filename>):</para> <programlisting>#ACTION SOURCE DEST PROTO DEST # PORT(S) ACCEPT net:wlan0:<2002:ce7c:92b4::3> tcp 22</programlisting> <para>Beginning with Shorewall 4.4.6 and 4.5.4, square brackets ("[" and "]") may also be used.</para> <para>Example (<filename>/etc/shorewall6/rules</filename>):</para> <programlisting>#ACTION SOURCE DEST PROTO DEST # PORT(S) ACCEPT net:wlan0:[2002:ce7c:92b4::3] tcp 22</programlisting> </listitem> </varlistentry> <varlistentry> <term>Stopped State</term> <listitem> <para>When Shorewall6 or Shorewall6 Lite is in the stopped state, the following traffic is still allowed.</para> <itemizedlist> <listitem> <para>Traffic with a multicast destination IP address (ff00::/8).</para> </listitem> <listitem> <para>Traffic with a link local source address (ff800::/8)</para> </listitem> <listitem> <para>Traffic with a link local destination address.</para> </listitem> </itemizedlist> </listitem> </varlistentry> <varlistentry> <term>Multi-ISP</term> <listitem> <para>The Linux IPv6 stack does not support balancing (multi-hop) routes. Hence, neither the <option>balance</option> option in <ulink url="manpages6/shorewall6-providers.html">shorewall6-providers</ulink>(5) nor USE_DEFAULT_RT=Yes in <ulink url="manpages6/shorewall.conf.html">shorewall6.conf</ulink>(5) is supported.</para> </listitem> </varlistentry> <varlistentry> <term>/sbin/shorewall6 and /sbin/shorewall6-lite Commands</term> <listitem> <para>Several commands supported by <filename>/sbin/shorewall</filename> and <filename>/sbin/shorewall-lite</filename> are not supported by <filename>/sbin/shorewall6</filename> and <filename>/sbin/shorewall6-lite</filename>:</para> <itemizedlist> <listitem> <para>hits</para> </listitem> <listitem> <para>ipcalc</para> </listitem> <listitem> <para>iprange</para> </listitem> </itemizedlist> <para></para> </listitem> </varlistentry> <varlistentry> <term>Macros</term> <listitem> <para>The Shorewall6 package depends on Shorewall-common for application macros. Only certain address-family specific macros such as macro.AllowICMPs are included in Shorewall6. As a consequence, /usr/share/shorewall/ is included in the default Shorewall6 CONFIG_PATH.</para> </listitem> </varlistentry> </variablelist> </section> <section> <title>Installing IPv6 Support</title> <para>You will need at least the following packages:</para> <itemizedlist> <listitem> <para>Shorewall 4.3.5 or later.</para> </listitem> <listitem> <para>Shorewall6 4.3.5 or later.</para> </listitem> </itemizedlist> <para>You may also with to install Shorewall6-lite 4.3.5 or later on your remote firewalls to allow for central IPv6 firewall administration.</para> </section> <section> <title>More information about IPv6</title> <para>I strongly suggest that you read the<ulink url="http://tldp.org/HOWTO/Linux+IPv6-HOWTO/"> Linux IPv6 HOWTO</ulink>. The <ulink url="6to4.htm">6to4 Tunnels</ulink> page also includes instructions for setting up your first IPv6 environment.</para> <para>In addition to the Linux IPv6 HOWTO, I have found the following two books to be useful:</para> <itemizedlist> <listitem> <para><emphasis>IPv6 Essentials</emphasis>, Silvia Hagen, 2002, O'Reilly Media, Inc, ISBN 0-596-00125-8.</para> <para>O'Reilly published a second edition of this book in 2006.</para> </listitem> <listitem> <para><emphasis>IPV6 Theory, Protocol, and Practice</emphasis>, Second Edition, Pete Loshin, 2004, Morgan-Kaufmann Publishers, IBSN 1-55860-820-9</para> </listitem> </itemizedlist> </section> </article>