filtering casual dual-stack

descr

here we do simple dual-stack, namely nat44 + routed ip6. but here’s the catch: we don’t want our internal nodes' services to be rachable from outside! we’re possibly talking about a DMZ!

taking over the nat4466 PoC, we simply disable nat66 and filter ip6 before routing happens. here’s the trick: we simply added filtering in prerouting along with the ip4 dnat rule. an alternative is to filter ipv6 within the forward chain but doing so in prerouting helps: - avoid duplicates in input and forward chains in case you also want to protect the router itself - make the syntax cleaner by avoiding yet another table and hook

architecture

workstation kvm host
 ┌─────────────┐
 │             │
 │             │
192.168.122.1/24                     guest1 
baaf::baaf:1/112                 ┌─────────────┐
 │    kvmbr0   ┬─────────────────┤ eth0        │
 └─────────────┘                 192.168.122.21/24                   guest2
                                 baaf::baaf:21/112              ┬──────────────┐
                                 │             │                │              │
                                 │        eth1 ┼────────────────┤ eth0         │
                                 └─────────────┘                │ 10.0.0.22/24 │
                                     10.0.0.254/24              │ fc00::beef:22/112
                                     fc00::beef:254/112         │              │
                                                                └──────────────┘

setup

on guest1

vi /etc/nftables.conf

see nftables.conf.nat4400

preliminary acceptance

let the kvm host know how to reach that internal network

on kvm host

ip route add beef::beef:0/122 via baaf::baaf:21

notice both the gateway and a node behind are reachable

ping -c1 baaf::baaf:21
ping -c1 fc00::beef:22

notice that host’s ssh port is available, meaning anything that listens is available and routed! (this is NOT necessarily what we want)

nmap -6np 22 fc00::beef:22

also the router itself is reachable through SSH

nmap -6np 22 baaf::baaf:21

acceptance

comment out the tcp port 22 rule, reload nftables and see if the service finally gets blocked.