Managing IPv6 Firewall Chains

In this lesson, you will learn how to adapt your existing Netfilter security policies to the unique requirements of the IPv6 address space.

The IPv6 Shift in Firewalling

When moving from IPv4 to IPv6, the fundamental architecture of nftables remains consistent, but the "logic" of your chains must evolve. IPv6 is not just a longer address; it changes how we handle ICMP, neighbor discovery, and broadcast-less communication. Because IPv6 relies heavily on ICMPv6 for critical network operations (like Neighbor Discovery Protocol or NDP), you cannot simply drop all ICMP traffic as you might cautiously do in IPv4.

Adapting Chain Logic

In IPv4, we often use broad subnet masks to filter traffic. In IPv6, the address space is vast, meaning we typically deal with /64 prefixes. Managing chains effectively requires moving away from host-based filtering toward prefix-based rules.

Consider this example of a typical input chain for an IPv6-enabled interface:

table ip6 filter {
    chain input {
        type filter hook input priority filter; policy drop;
        
        # Allow critical ICMPv6 for neighbor discovery (NDP)
        ip6 nexthdr icmpv6 accept
        
        # Stateful inspection for established connections
        ct state established,related accept
        
        # Allow SSH only from a specific management prefix
        ip6 saddr 2001:db8:cafe:1::/64 tcp dport 22 accept
    }
}

Critical Considerations

1. ICMPv6 is Mandatory: Unlike IPv4, where blocking ICMP might only hinder "ping" or path MTU discovery, blocking ICMPv6 effectively breaks the IPv6 network stack. You must ensure neighbor-solicitation and neighbor-advertisement types are permitted.
2. Stateless vs. Stateful: Since IPv6 often involves Global Unicast Addresses (GUA) that are reachable directly from the internet (avoiding NAT), the "stateful" part of your firewall rules becomes your primary line of defense. Always ensure that ct state established,related is placed early in your input chain to handle return traffic efficiently.
3. Prefix Filtering: Because we use larger subnets, focus your rules on defining clear boundaries for administrative subnets (saddr) rather than trying to track individual client addresses.

Key Takeaway: Effective IPv6 firewall management requires transitioning from broad NAT-based trust models to explicit, prefix-aware policies that treat ICMPv6 as a foundational protocol rather than an optional diagnostic tool.