iptables denied; no IPv6 routers present?

JosephS · 05-20-2014, 12:30 PM

Using Crunchbang Waldorf

I installed a firewall (iptables) from https://wiki.debian.org/iptables

I noticed an error message when I booted up afterwards:

Code:

dmesg|tail

[   16.929151] iptables denied: IN=eth0 OUT= MAC= SRC=70.73.100.115 DST=255.255.iptables denied:255.255 LEN=65 TOS=0x00 PREC=0x00 TTL=64 ID=46533 DF PROTO=UDP SPT=51467 DPT=1124 LEN=45 
[   17.179459] iptables denied: IN=eth0 OUT= MAC= SRC=70.73.100.115 DST=224.0.0.251 LEN=182 TOS=0x00 PREC=0x00 TTL=255 ID=43605 DF PROTO=UDP SPT=5353 DPT=5353 LEN=162 
[   17.430418] iptables denied: IN=eth0 OUT= MAC= SRC=70.73.100.115 DST=224.0.0.251 LEN=182 TOS=0x00 PREC=0x00 TTL=255 ID=43606 DF PROTO=UDP SPT=5353 DPT=5353 LEN=162 
[   17.483256] iptables deniptables denied:ied: IN=eth0 OUT= MAC= SRC=70.73.100.115 DST=70.73.103.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=57858 DF PROTO=UDP SPT=8610 DPT=8612 LEN=24 
[   25.912016] eth0: no IPv6 routers present
[   35.014950] iptables denied: IN=eth0 OUT= MAC= SRC=70.73.100.115 DST=224.0.0.251 LEN=67 TOS=0x00 PREC=0x00 TTL=255 ID=43617 DF PROTO=UDP SPT=5353 DPT=5353 LEN=47 
[   45.814530] fuse init (API version 7.17)
[   51.016998] iptables denied: IN=eth0 OUT= MAC= SRC=70.73.100.115 DST=224.0.0.251 LEN=67 TOS=0x00 PREC=0x00 TTL=255 ID=43618 DF PROTO=UDP SPT=5353 DPT=5353 LEN=47 
[   71.038522] iptables denied: IN=eth0 OUT= MAC=01:00:5e:00:00:01:c8:4c:75:77:25:d9:08:00 SRC=22.1.96.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=14595 PROTO=2 
[   83.049337] iptables denied: IN=eth0 OUT= MAC= SRC=70.73.100.115 DST=224.0.0.251 LEN=67 TOS=0x00 PREC=0x00 TTL=255 ID=43619 DF PROTO=UDP SPT=5353 DPT=5353 LEN=47

Quote:

This my iptables running:
root@crunchbang:~# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
REJECT all -- anywhere loopback/8 reject-with icmp-port-unreachable
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT icmp -- anywhere anywhere icmp echo-request
LOG all -- anywhere anywhere limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

I'm assuming this is the problem :no IPv6 routers present. Where do I change the settings to fix this?

Thanks

Ser Olmy · 05-20-2014, 05:15 PM

iptables filters/NATs IPv4 traffic, not IPv6. None of the rules listed will have any effect on IPv6 packets.

IPv6 works differently from IPv4 with regards to routers. An IPv6 router announces its presence to the network by sending an ICMPv6 Router Advertisement packet to an IPv6 multicast address. The message "no IPv6 routers present" simply means that your system received no Router Advertisement packet in response to an ICMPv6 Router Solicitation packet, which is to be expected if your network isn't configured to use IPv6.

JosephS · 05-21-2014, 11:07 PM

I did a bit of searching, but am not clear on things.
Does this mean that Linux is sending out a signal with IPV6 and it is not working because my ISP doesn't support it?

If different websites use IPV4 or IPV6 then would I need to setup a firewall for each on my computer?

Thanks

psycroptic · 05-22-2014, 01:33 AM

Quote:

Originally Posted by JosephS

Does this mean that Linux is sending out a signal with IPV6 and it is not working because my ISP doesn't support it?

that would be one reason, though there could be others.

Quote:

Originally Posted by JosephS

If different websites use IPV4 or IPV6 then would I need to setup a firewall for each on my computer?

you most certainly do. ip6tables is the requisite utility, and it has largely the same syntax as iptables.