Hacker News Reader

Comment by q3k | Hacker News Reader

> Are there any guides for how to properly secure a home network so that I can re-enable IPv6 with a clear conscience?

    ip6tables -P FORWARD REJECT
    ip6tables -F FORWARD
    ip6tables -A FORWARD -o wan -s 2a42:.../64 -j ACCEPT
    ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

Literally the same as for IPv4.

View on HN

You should also enable ICMP (or at least some of it) - see http://shouldiblockicmp.com/ for explanation on why this is important for IPv6

  ip6tables -A FORWARD -p icmpv6 -j ACCEPT

Why do I get the feeling that some home routers won't NAT or have the established/related rule by default for ipv6.

I don't know. I've never misconfigured/insecure v6 CPEs in Europe. But if you're bringing your own device, all bets are off of course.

This makes sense, considering ISPs might not want to deal with a ton of pwned devices that are now part of botnets.

Reply on news.ycombinator.com