• [^] # Re: Mon opinion

    Posté par . En réponse au message Iptables - Ip6tables - avis. Évalué à 1. Dernière modification le 03 mai 2019 à 16:54.

    Tout fonctionne sans, donc je garde ces règles pour mon usage de base. J'ai un autre set de règles autorisant :

    ip6tables -A INPUT -p icmpv6 --icmpv6-type destination-unreachable -m state --state RELATED -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type packet-too-big -m state --state RELATED -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type time-exceeded -m state --state RELATED -j ACCEPT 
ip6tables -A INPUT -p icmpv6 --icmpv6-type parameter-problem -m state --state RELATED -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type destination-unreachable -m state --state RELATED -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type packet-too-big -m state --state RELATED -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type time-exceeded -m state --state RELATED -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type parameter-problem -m state --state RELATED -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type router-advertisement -m state --state UNTRACKED -m hl --hl-eq 255 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbour-advertisement -m state --state UNTRACKED -m hl --hl-eq 255 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbour-solicitation -m state --state UNTRACKED -m hl --hl-eq 255 -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type router-solicitation -m state --state UNTRACKED -m hl --hl-eq 255 -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbour-advertisement -m state --state UNTRACKED -m hl --hl-eq 255 -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbour-solicitation -m state --state UNTRACKED -m hl --hl-eq 255 -j ACCEPT
ip6tables -A INPUT -p icmpv6 -j DROP
ip6tables -A OUTPUT -p icmpv6 -j DROP