我有一台 Debian 11 计算机（计算机 A）用作 IPv6 的路由器，具有 WAN（bond0）和 LAN（bond1）接口，另一台 Debian 11 计算机（计算机 B）连接到其 LAN 接口。此设置按预期正常工作，直到我在计算机 A 中设置防火墙规则：
ip6tables -A FORWARD -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
ip6tables -A FORWARD -p ipv6-icmp -j ACCEPT
ip6tables -P FORWARD DROP
完成此设置后，从机器 B 可以 ping 通，但是其他什么都行不通，例如 http 连接不行：
--2022-11-20 18:25:05-- http://[2a02:16a8:dc41:100::132]/
Connecting to [2a02:16a8:dc41:100::132]:80... connected.
HTTP request sent, awaiting response...
一旦我将默认策略改回接受：
ip6tables -P FORWARD ACCEPT
一切都恢复正常，提到的连接也是如此。所以我猜错误不是出在网络设置上，而可能是缺少防火墙规则。机器 A 中的输入和输出默认策略是接受，没有任何规则：
Chain INPUT (policy ACCEPT 52117 packets, 7950K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0 state NEW,RELATED,ESTABLISHED
0 0 ACCEPT icmpv6 * * ::/0 ::/0
Chain OUTPUT (policy ACCEPT 32646 packets, 2259K bytes)
pkts bytes target prot opt in out source destination
所以我猜这部分没有问题。机器 B 没有设置任何规则。我缺少什么才能让它正常工作？
更新：
将防火墙规则附加ip6tables -A FORWARD -j LOG到过滤规则的末尾后，我收到以下消息/var/log/kern.log
Nov 20 19:08:11 machineA kernel: [64351.126036] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=735930 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK URGP=0
Nov 20 19:08:11 machineA kernel: [64351.126186] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=210 TC=0 HOPLIMIT=63 FLOWLBL=735930 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK PSH URGP=0
Nov 20 19:08:11 machineA kernel: [64351.343310] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=210 TC=0 HOPLIMIT=63 FLOWLBL=735930 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK PSH URGP=0
Nov 20 19:08:11 machineA kernel: [64351.563328] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=210 TC=0 HOPLIMIT=63 FLOWLBL=918248 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK PSH URGP=0
Nov 20 19:08:12 machineA kernel: [64352.007316] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=210 TC=0 HOPLIMIT=63 FLOWLBL=983152 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK PSH URGP=0
Nov 20 19:08:12 machineA kernel: [64352.139854] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=983152 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK URGP=0
Nov 20 19:08:13 machineA kernel: [64352.903316] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=210 TC=0 HOPLIMIT=63 FLOWLBL=286527 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK PSH URGP=0
Nov 20 19:08:13 machineA kernel: [64352.911487] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=286527 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK FIN URGP=0
Nov 20 19:08:14 machineA kernel: [64354.159965] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=286527 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK URGP=0
Nov 20 19:08:14 machineA kernel: [64354.663292] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=210 TC=0 HOPLIMIT=63 FLOWLBL=128197 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK PSH FIN URGP=0
Nov 20 19:08:18 machineA kernel: [64358.247272] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=210 TC=0 HOPLIMIT=63 FLOWLBL=83931 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK PSH FIN URGP=0
Nov 20 19:08:18 machineA kernel: [64358.347769] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=83931 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK URGP=0
Nov 20 19:08:25 machineA kernel: [64365.415153] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=210 TC=0 HOPLIMIT=63 FLOWLBL=504998 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK PSH FIN URGP=0
Nov 20 19:08:26 machineA kernel: [64366.539630] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=504998 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK URGP=0
Nov 20 19:08:39 machineA kernel: [64379.494991] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=210 TC=0 HOPLIMIT=63 FLOWLBL=546713 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK PSH FIN URGP=0
Nov 20 19:08:42 machineA kernel: [64382.667434] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=72 TC=0 HOPLIMIT=63 FLOWLBL=546713 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK URGP=0
Nov 20 19:09:09 machineA kernel: [64409.190482] IN=bond1 OUT=bond0 MAC=<mac snip> SRC=<machine B ipv6> DST=<destination servers ipv6> LEN=210 TC=0 HOPLIMIT=63 FLOWLBL=39670 PROTO=TCP SPT=46848 DPT=80 WINDOW=507 RES=0x00 ACK PSH FIN URGP=0
答案1
看起来问题出在路由本身。根据日志文件和ip6tables计数器，我发现有些数据包没有通过前向链。在源端和目标端进行跟踪路由后，我发现数据包从 机器B经历机器A但数据包到机器 B 以某种方式绕过了。我的提供商修复了这个路由问题后，所有数据包从和到 机器B正在经过 FORWARD 链并且按预期工作。
如果有人想构建“类似 nat”的 IPv6 防火墙，这只是一个参考。仅接受已建立和相关状态是不够的，还需要从 LAN 到 WAN 接口添加新状态。完整命令如下所示：
ip6tables -A FORWARD -i <lan int> -o <wan int> -m conntrack --ctstate NEW -j ACCEPT
ip6tables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
ip6tables -P FORWARD DROP