我的服务器上的 IPv6 存在问题。我已将 nginx 配置为从 IPv4 和 IPv6 监听端口 443。它运行良好:我的网站在启用 TLS 的情况下可通过 Internet 访问。
当我激活 nftables 时事情变得复杂了:当我从 IPv4 访问我的网站时,它可以正常工作,但是当我从 IPv6 访问它时,连接超时 :(
输出sudo nft list ruleset
:
table inet filter {
chain INPUT {
type filter hook input priority filter; policy drop;
meta nftrace set 1
ct state established,related accept comment "allow established connections"
iif "lo" accept comment "allow all from localhost"
iif != "lo" ip daddr 127.0.0.0/8 counter packets 0 bytes 0 drop comment "drop connections to loopback not coming from loopback"
iif != "lo" ip6 daddr ::1 counter packets 0 bytes 0 drop comment "drop connections to loopback not coming from loopback"
iifname "tunnel0" accept comment "allow all from VPN"
udp dport 12345 accept comment "allow VPN on port 12345"
tcp dport { 22, 80, 443 } accept comment "allow HTTP, HTTPS and SSH on classic ports"
}
chain OUTPUT {
type filter hook output priority filter; policy accept;
}
chain FORWARD {
type filter hook forward priority filter; policy drop;
}
}
输出sudo nft monitor trace | grep 443
:
trace id 76d7cb1a inet filter INPUT packet: iif "eth0" ether saddr AA:AA:AA:AA:AA:AA ether daddr BB:BB:BB:BB:BB:BB ip6 saddr 2a01:cb09:804b:cd61:CCCC:CCCC:CCCC:CCCC ip6 daddr 2001:CCCC:CCCC:CCCC::CCCC ip6 dscp cs0 ip6 ecn not-ect ip6 hoplimit 45 ip6 flowlabel 0 ip6 nexthdr tcp ip6 length 40 tcp sport 53184 tcp dport 443 tcp flags == syn tcp window 22240
请注意,我在端口 22 上使用 ssh 时没有遇到此问题。我nftables v0.9.8 (E.D.S.)
在 Debian 11 上运行。
我几乎花了一天时间寻找解决方案。欢迎任何帮助!谢谢
答案1
我缺少一些关键的 IPv6 根元素。添加此语句解决了我的问题:
nft add rule inet filter INPUT 'icmpv6 type { 134, 135, 136, 137 } accept'