Greetings all,
I hope some of the experts here can shed some light on this mystery i'm facing.
I'm running a webservice (https) on my libreelec machine through default TCP port 443. I have a dual stack ipv4/ipv6 internet connection. I have forwarded port 443 in my network firewall and all has been working flawless for both ipv4 and ipv6.
Now, since the release of LE 9 there is a basic firewall introduced. So I thought I'll have a play with it. I copied over the standard 'home' rules for both ipv4 and ipv6 and placed them in the appropriate file in (/storage/.config/iptables/rules.v4 and rules.v6).
I added one line in the rules to open up TCP port 443. Below you can see my rules.v4 file for ipv4 with the added line (--dport 443)
# Completed on Thu May 30 22:42:56 2019
# Generated by iptables-save v1.8.2 on Thu May 30 22:42:56 2019
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [146:18063]
:DOCKER-USER - [0:0]
:private-subnets - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i tether -p udp -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -j private-subnets
-A FORWARD -i tether -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o tether -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-USER -j private-subnets
-A private-subnets -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A private-subnets -s 192.168.0.0/16 -i eth+ -m conntrack --ctstate NEW -j ACCEPT
-A private-subnets -s 192.168.0.0/16 -i en+ -m conntrack --ctstate NEW -j ACCEPT
-A private-subnets -s 192.168.0.0/16 -i wl+ -m conntrack --ctstate NEW -j ACCEPT
-A private-subnets -s 192.168.0.0/16 -i tether -m conntrack --ctstate NEW -j ACCEPT
-A private-subnets -s 192.168.0.0/16 -i docker+ -m conntrack --ctstate NEW -j ACCEPT
-A private-subnets -j REJECT --reject-with icmp-port-unreachable
COMMIT
Display More
This works perfectly. Hower, I cannot - for the life of me - get this same line to work with ipv6.
Below you can see my rules.v6 file with the same rule I've added to open up port 443 (which is basically the same file, except saved with ip6tables instead op iptables):
# Completed on Thu May 30 22:42:03 2019
# Generated by ip6tables-save v1.8.2 on Thu May 30 22:42:03 2019
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [72:7296]
:DOCKER-USER - [0:0]
:private-subnets - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i tether -p udp -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -j private-subnets
-A FORWARD -i tether -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o tether -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-USER -j private-subnets
-A private-subnets -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A private-subnets -s fc00::/7 -i eth+ -m conntrack --ctstate NEW -j ACCEPT
-A private-subnets -s fc00::/7 -i en+ -m conntrack --ctstate NEW -j ACCEPT
-A private-subnets -s fc00::/7 -i wl+ -m conntrack --ctstate NEW -j ACCEPT
-A private-subnets -s fc00::/7 -i tether -m conntrack --ctstate NEW -j ACCEPT
-A private-subnets -s fc00::/7 -i docker+ -m conntrack --ctstate NEW -j ACCEPT
-A private-subnets -j REJECT --reject-with icmp6-port-unreachable
COMMIT
# Completed on Thu May 30 22:42:03 2019
Display More
This however, does not work. If I reboot the machine i can see both rules get applied correctly with iptables -L and ip6tables -L, but only on ipv4 the port is open, while on ipv6 port 443 stays closed.
When I turn off the firewall in LE settings the port suddenly opens up for both ipv4 and ipv6, so there must be something wrong with the ipv6 rules, I just can't seem to figure out what it is.
I always thought basic iptable rules or the same for both ipv4 and ipv6
Can someone please be so kind and tell me where i'm failing here?