The firewall filters IPv6 as well as IPv4: the same rules, the same interface policies and the same objects apply to both versions of the protocol.
Without it, an appliance with an IPv6 address would accept on IPv6 everything its IPv4 rules refuse.
When IPv6 filtering is off, only the CrowdSec and SSH black lists apply to IPv6 traffic; everything else is accepted.
The IPv6 rules are built even when IPv6 is disabled in the system settings: an IPv6 address enabled later never finds an open firewall. On a kernel without IPv6 support, nothing is done for IPv6.
| Feature | In IPv6 |
|---|---|
| Interface policies | Incoming and outgoing default policies, behavior (LAN/WAN) and DHCP protection apply as in IPv4 (DHCPv6 ports 546–547). |
| Ping policy | Applies to ICMPv6 echo requests. Trusted networks only uses the IPv6 trusted networks (see below). |
| Essential ICMPv6 | Always accepted, before any rule or policy: neighbor discovery, router advertisements, packet too big, errors and multicast listener messages. Without them IPv6 stops working. |
| Rules | Applied to both versions, unless the rule is limited to one (field IP version). |
| Objects | IPv6 addresses and networks of an object are used in IPv6, IPv4 ones in IPv4. Host-name (FQDN) objects are also resolved in IPv6 (AAAA records). |
| Connection limits, automatic blocking, transit policy | Applied in IPv6 too. Banned IPv6 addresses appear in the same list. |
| Countries (GeoIP) | Applied in IPv6 when the GeoIP database has IPv6 data. When the kernel GeoIP module is not used, Artica downloads the IPv6 country ranges as well. |
| Trusted networks | The IPv6 networks declared as trusted in Your networks. There is no implicit IPv6 trusted network (in IPv4, an empty list means the private networks). |
| Packet tester | Tests IPv6 packets. |
| NAT, masquerading, transparent proxy, link balancer, traffic duplication, marks, proxy rules, DNS amplification protection, Web console protection | IPv4 only. |
In the rule form, IP version accepts:
The rules list shows a label IPv4 or IPv6 when a rule is limited to one version. NAT rules and the actions Mark packets, Tproxy, Forward to another gateway, Duplicate traffic and Send through a link are IPv4 only.
A rule restricted to an object is applied in IPv6 only if the object contains IPv6 entries: a rule from group G never becomes from everywhere in IPv6. The same goes for a criterion that has no IPv6 meaning (an IPv4 address written in the rule, an application filter, a country without IPv6 data): the IPv6 line is left out rather than applied without the criterion. A rule set to IPv6 only of which no line can be built is reported as refused.
Add an IPv6 network (for example 2001:db8:10::/48) to the trusted networks of Your networks, as you would add an IPv4 one. It is accepted before the black lists and used by the Trusted networks only ping policy and by the Act as LAN behavior.
Before switching an interface reachable in IPv6 to Finally deny all, declare your IPv6 administration network as trusted, or create a rule that accepts it.
# IPv6 rules
ip6tables -S | grep -c ARTICA.BUILD
ip6tables -S in_ens18
# IPv6 objects (twin sets ending with 6)
ipset list -n | grep '6$'