Bug 190590 - Connection tracking fails with iptables-ipv6
Connection tracking fails with iptables-ipv6
Product: Fedora
Classification: Fedora
Component: iptables (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Thomas Woerner
Ben Levenson
Depends On:
  Show dependency treegraph
Reported: 2006-05-03 15:23 EDT by Per Steinar Iversen
Modified: 2007-11-30 17:11 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-08-29 08:28:55 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Per Steinar Iversen 2006-05-03 15:23:41 EDT
Description of problem:

Version-Release number of selected component (if applicable): 


How reproducible: Always

Steps to Reproduce:

1. Create a ruleset for ip6tables, something like this:

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmpv6 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j DROP

2. Stsrt ip6tables and load the rules.

3. TCP connections now fail, both outgoing and incoming. Adding a LOG target
seems to indicate that the connection tracking fails.
Actual results:

IPv6/tcp is blocked both incoming and outgoing.

Expected results:

Outgoing IPv6/tcp connections should work, incoming connections to port 22
should work in this case.

Additional info:
Comment 1 Thomas Woerner 2006-05-10 05:25:15 EDT
Is there any error or warning message when you apply the filter rules?

Is the output of ip6tables-save the same as the the input, you gave to

Comment 2 Per Steinar Iversen 2006-05-10 05:34:40 EDT
No, there are no warnings:

# service ip6tables start
Applying ip6tables firewall rules:                         [  OK  ]

In the syslog there is only:

kernel: ip6_tables: (C) 2000-2006 Netfilter Core Team

There are some slight formatting differences with ip6tables-save compared to my
example, but this does not seem to matter, this version too has the same problem.
Comment 3 Thomas Woerner 2006-05-10 05:53:50 EDT
Ok, then this is a kernel netfilter problem and not a iptables userland problem.

Assigning to kernel.
Comment 4 Jay Cliburn 2006-07-30 16:29:19 EDT
I disagree with comment #3.  I believe this is a userland problem.  I just ran
across this issue and the problem isn't that netfilter doesn't do stateful
filtering (I wish it did, but it doesn't); the problem is that
system-config-securitylevel (or whatever generates ip6tables rules in Fedora)
writes ip6tables rules that *assume* netfilter has functionality it doesn't have.

The bottom line is this: if a user activates ip6tables on a Fedora system, the
default rules generated by Fedora will prevent the proper functioning of IPv6
traffic to and from that system.  This is not netfilter's fault, it's the rule
generator's fault.
Comment 5 Dave Jones 2006-10-16 16:49:49 EDT
A new kernel update has been released (Version: 2.6.18-1.2200.fc5)
based upon a new upstream kernel release.

Please retest against this new kernel, as a large number of patches
go into each upstream release, possibly including changes that
may address this problem.

This bug has been placed in NEEDINFO state.
Due to the large volume of inactive bugs in bugzilla, if this bug is
still in this state in two weeks time, it will be closed.

Should this bug still be relevant after this period, the reporter
can reopen the bug at any time. Any other users on the Cc: list
of this bug can request that the bug be reopened by adding a
comment to the bug.

In the last few updates, some users upgrading from FC4->FC5
have reported that installing a kernel update has left their
systems unbootable. If you have been affected by this problem
please check you only have one version of device-mapper & lvm2
installed.  See bug 207474 for further details.

If this bug is a problem preventing you from installing the
release this version is filed against, please see bug 169613.

If this bug has been fixed, but you are now experiencing a different
problem, please file a separate bug for the new problem.

Thank you.
Comment 6 Paul Black 2006-10-20 15:20:54 EDT
Still failing with the ipv6 firewall below (ipv4 firewall disabled).

Oct 20 20:19:06 zippy kernel: IN=sit1 OUT=
TUNNEL=> SRC=2001:06b0:0001:00ea:0202:a5ff:fecd:13a6
DST=2001:0618:0400:0000:0000:0000:5860:9761 LEN=84 TC=8 HOPLIMIT=52

:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -j LOG
-A RH-Firewall-1-INPUT -j DROP
Comment 7 Dave Jones 2006-10-20 15:35:03 EDT
ipv6 connection tracking is incomplete in current kernels (and isn't likely to
get upstream until at least 2.6.20).  Userspace shouldn't be trying to use it yet.
Comment 8 Peter Bieringer 2007-06-18 15:38:47 EDT
2.6.21 of FC6 and F7 now supports IPv6 connection tracking, see also 
Comment 9 Paul Black 2007-06-21 10:55:41 EDT
Works for me.
Comment 11 Thomas Woerner 2007-08-24 07:57:58 EDT
Is this fixed for you now?
Can this bug get closed?
Comment 12 Per Steinar Iversen 2007-08-27 03:13:36 EDT
Connection tracking work fine now with Fedora 7. The only current issue is that
the ip6tables service starts before the ipv6 setup has completed. The result is
that the firewall rules are inactive after a reboot. Doing "service ip6tables
restart" fixes this.
Comment 13 Thomas Woerner 2007-08-29 08:28:55 EDT
You last suggested problem is a different one. This has been addressed in the
iptables-1.3.8-2 pakage in F-7-testing.

Closing this one as "NOT A BUG".

Note You need to log in before you can comment on or make changes to this bug.