OpenWrt Forum Archive

Topic: How do I translate a ip6tables command to a ipv6 firewall rule?

The content of this topic has been archived on 17 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hi all,

    I am trying to figure out a way to translate the equivalent firewall rule configured through ip6tables.

    My requirement is that my board has two interfaces: wired interface eth0 (lan) and wireless interface wlan0(mynet)
    Whatever I receive on wlan0 from outside should be sent to a server connected the eth0 of my board.

    For eg:
   
     To enable forwarding between two interfaces the ip6tables command looks like

     

ip6tables -A FORWARD -s xxxx:xxxx:xxxx:xxxx::/64 -d yyyy:yyyy:yyyy:yyyy::/64 -j ACCEPT

     How do I translate this to firewall rule, so that I can add it to the firewall config file?

     I tried following with no luck

config zone
    option name         mynet                                
    option network     lan
    option family        ipv6
    option input         ACCEPT
    option output       ACCEPT
    option forward     ACCEPT
                                                                    
config zone 
    option name         lan                                 
    option network     mynet                        
    option family        ipv6                                  
    option input         ACCEPT                         
    option output       ACCEPT
    option forward     ACCEPT                                   
           
config forward                                             
    option src             mynet                       
    option src_ip        xxxx:xxxx:xxxx:xxxx::/64              
    option dest           lan                           
    option dest_ip      yyyy:yyyy:yyyy:yyyy::/64
    option proto         all
    option family        ipv6
    option target        ACCEPT                             
    option forward     ACCEPT                         
                                                            
config forward                                        
    option src            lan
    option src_ip       yyyy:yyyy:yyyy:yyyy::/64
    option dest          mynet
    option dest_ip     xxxx:xxxx:xxxx:xxxx::/64            
    option proto        all                             
    option family       ipv6     
    option target       ACCEPT 
    option forward    ACCEPT

(Last edited by rams8055 on 23 Aug 2017, 08:23)

You have a zone called "mynet" that contains a network called "lan", and a zone called "lan" that contains a network called "mynet"... why?

The discussion might have continued from here.