Cfrtjryk

does anyone have a solution to make reverse path filtering work (in loose mode) also for IPv6 and not only for IPv4?

The setup I am having is a machine1 connected directly to a machine2, while machine1 being also connected to outside net.

The targetted traffic is this:
Client (from the outside net) sends a request to the machine1 which then forwards the request to the machine2.

Obvious problem: When packet gets handled by machine1, it forwards it to a port connected to machine2, but with source IP of a client. This would normally be seen as a spoofed ip - but that's what rp_filter is for, right?

Normally on machine1 I would do (for IPv4):

echo 2 > /proc/sys/net/ipv4/conf/<interface_to_outside_net>/rp_filter

and everything would work, but for IPv6 this is not the case since rp_filter is not implemented in the kernel for IPv6 as of yet.
The only solution I know of would be to set up ip6tables.

Current settings:

ip6tables -t raw -N RPFILTER
ip6tables -t raw -A RPFILTER -m rpfilter -j RETURN
ip6tables -t raw -A RPFILTER -m rpfilter --loose -j ACCEPT
ip6tables -t raw -A PREROUTING -j RPFILTER

But for some reason traffic never reaches machine2 and on the client side I get timeout.

Using tcpdump on machine1 I get only the SYN of TCP handshake.:

14:18:50.390292 IP6 fd11:3456:789a:1::4.34184 > fd12:3456:789a:1::1.1111: Flags [S], seq 701159610, win 28800, options [mss 1440,sackOK,TS val 6066549 ecr 0,nop,wscale 7], length 0

nothing else...

Any advice?

SPOILER

The problem was actually related to the fact that I did not set up the IPv6 addresses using /etc/network/interfaces/ but "only" using ip a a ....
I never thought that this could somehow be a different, but it turned out to be the case this time.

STEPS leading to SOLUTION:

During the investigation I did a simple ping6 from machine2 towards machine1 which strangely fixed the problem I was having.

After this, the TCP handshake got correctly created and I was able to do a curl -g -6 .. which was the target command I wanted to do and I was like YES finally!

But then I was like ...this doesn't make sense, why is ICMPv6 not taking care of this?
This made me thinking that I should check ndp (ip -6 neigh show) table which actually showed me that entry for machine1 had FAILED.

Which means that for some reason ICMPv6 was failing to exchange neighbor solicitations/advertisements.

At the end I remembered that simple pc reboot usually fixes all the problems, but since I configured my interfaces using only ip a a ... this would flush my configuration, so what I did was configured /etc/network/interfaces/ with proper IPv6 addresses and rebooted machines.

This was the source of all the problems ;)

SOLUTION:

Don't do anything in regards of rp_filter in loose mode for IPv6 ==> it's enabled by default.

Just make sure, that you have properly configured your interfaces :)

PS: Does anyone know what I messed up? Why wasn't I able to simply use ip address add....? Thanks.