Comments (6)
First, let's use the documentation prefix 2001:db8::/32 for examples so we don't get confused.
Take a look at the default firewall.conf file, lots of example there:
https://raw.githubusercontent.com/arno-iptables-firewall/aif/master/etc/arno-iptables-firewall/firewall.conf
Look for INET_FORWARD_TCP, you should see an example for what you want to do.
# TCP/UDP port forward examples:
# Simple (IPv6 forward port 80 to internal host 2001:db8::2):
# INET_FORWARD_TCP="::/0>2001:db8::2~80"
Additionally, the # (hash) character is to specify an interface, and a ~ (tilde) denotes a port or protocol.
Hope that helps.
from aif.
Additionally, the # (hash) character is to specify an interface, and a ~ (tilde) denotes a port or protocol.
With the FORWARD
rules, this is true and I have been using rules such as 1.2.3.4#0/0~80>5.6.7.8
for a while now.
With the OPEN_{TCP,UDP}
rules, not so. The OPEN
rules really do use a #
to separate IP and port. Attempting to use a ~
to separate IP and port in the OPEN
rules breaks them. I cannot remember how I found out about this, as it is not documented (or I can't find it anymore) but I have been using those rules for a number of years now.
The version of AIF that I'm running is 2.0.1e included in Debian Stretch (testing).
from aif.
This works for me...
OPEN_TCP="2001:db8::2,2001:db8::3#80"
$ ip6tables -nvL EXT_INPUT_CHAIN
Chain EXT_INPUT_CHAIN (4 references)
pkts bytes target prot opt in out source destination
...
0 0 ACCEPT tcp + * ::/0 2001:db8::2 tcp dpt:80
0 0 ACCEPT tcp + * ::/0 2001:db8::3 tcp dpt:80
Note that by using the # (hash) you are selecting only specific destination IP's in such cases where the external interface has multiple IP's assigned to it.
OPEN_{TCP,UDP} typically only contains port numbers unless the interface or destination IP is also defined and as such the # (hash) is used as the delimiter.
Is there something that is not working or you want to filter something specific ?
from aif.
@phyber I checked and a fix to handling IPv6 addresses before a '#' was added to AIF 2.0.1f with commit b0476a5
So that explains your initial issue you stated and why it works now.
@arnova Do you know how Debian can get updated to 2.0.1f ?
from aif.
Oof, wow. Over a year ago. I guess the Debian packager just needs a prod. Apologies for wasting your time on this :)
Edit: Just applied the patch from b0476a5 and it works great, thanks.
from aif.
@abelbeck : Normally the Debian maintainer will upload a new version as soon as we've released a new stable. As an alternative (in the meantime) one could simply uninstall the debian package and just use our tarball (fairly easy with the install script that comes with it).
from aif.
Related Issues (20)
- TCP_OPEN restrict to certain interfaces HOT 4
- AIF - Feature request - chain load other script/command HOT 2
- Error: either "to" is duplicate, or "equalize" is garbage HOT 5
- Plugin loopback_nat not loading properly? HOT 1
- Missing support for docker HOT 3
- support for AnyIP? HOT 1
- No iptables/ip6tables found at Debian 10 (2021/03/26) HOT 8
- IPSET/NETSET support in HOST_OPEN_TCP HOT 2
- aif 2.03 doesn't start on debian buster HOT 5
- Ubuntu 22.04 with libvirtd, the bridge interface 'virbr0' does not start automatically HOT 3
- AIF falling back to conntrack legacy automatic helper in Debian with kernel 6.0 and higher HOT 5
- nftables as aif backend HOT 1
- Disable "Dropped INPUT packet" logging? HOT 5
- AIF blocking nimble HOT 2
- Pings on the internal network to the firewall server are being blocked. HOT 5
- # Warning: iptables-legacy tables present, use iptables-legacy-save to see them HOT 1
- One "catch all" LOGging is still in effect after disabling ALL LOGs in the config HOT 2
- Manpages still mention Arno's previous email address
- multiroute multiple ISP, individual snat and multiple routing tables HOT 1
- Proxmox unprivileged container problem
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aif.