Guides / IPv6 firewall

Firewall your IPv6

About 5 minutes. Recommended for every server.

Over IPv4 only your own forwarded ports reach you. Over IPv6 your whole /80 is routed straight to your server, on every port, and we do not filter it. So anything listening on all addresses (a database, an admin panel) is public over IPv6 unless you block it.

Option A: nftables (any OS)

Save as /etc/nftables.conf, change the ports in allowed to the ones you serve, then load it:

#!/usr/sbin/nft -f
flush ruleset
table inet filter {
	set allowed { type inet_service; elements = { 22, 80, 443, 10001 } }
	chain input {
		type filter hook input priority 0; policy accept;
		ct state established,related accept
		iif lo accept
		meta nfproto ipv6 icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert, nd-router-advert, echo-request, packet-too-big, destination-unreachable, time-exceeded } accept
		meta nfproto ipv6 udp dport 546 accept
		meta nfproto ipv6 tcp dport @allowed accept
		meta nfproto ipv6 udp dport @allowed accept
		meta nfproto ipv6 drop
	}
}

apt install -y nftables      # or: apk add nftables / dnf install -y nftables
nft -f /etc/nftables.conf && systemctl enable nftables

This only filters IPv6 and leaves IPv4 alone. Keep the ICMPv6 and DHCPv6 (UDP 546) lines: without them your server loses its IPv6 address and route.

Option B: ufw (Ubuntu, Debian)

apt install -y ufw
ufw default deny incoming
ufw allow 22/tcp
ufw allow 80,443/tcp
ufw allow 10001        # your other ports, TCP and UDP
ufw enable

ufw filters IPv4 too. That is fine as long as SSH (port 22 inside) stays allowed, because your SSH port is forwarded to 22.

Check it

From another machine with IPv6, nc -zv 2a02:…:N::1 3306 should time out for a port you did not allow, and ssh -6 root@2a02:…:N::1 should still work.