[CentOS] IPv6 under Centos?

[Louis Lagendijk]

On Tue, 2009-03-10 at 10:25 -0400, Robert Moskowitz wrote:
> Timothy Murphy wrote:
> > I wonder if anyone is running IPv6 under Centos-5.2?
> >   
> 
> YES!!! On some systems it is strictly IPv6. IPv4 only on lo loopback.
> 
Running IPv4 + IPv6 here....But see below...
> > Particularly with shorewall?
> >   
> 
> NO!!!
yes, but see below.
> 
> > I see that shorewall6 is specifically designed for updating shorewall
> > to IPv6, as described in <http://www.shorewall.net/IPv6Support.html>.
> >
> > Unfortunately, this explicity requires kernel 2.6.25 or later,
> > and iptables 1.4.0 or later,
> > both of which are later than any versions I've seen on a Centos repository.
> >   
> 
> Tom was rather explicit about why we will NOT see Shorewall6 with Centos 
> and the 2.6.18 kernel:
> 
> "2.6.18 doesn't support stateful IPv6 firewalling at all!"
> 
> 
> I think that says it. You want stateful IPv6 firewalling, then you will 
> get a newer kernel which means most likely Centos 6.0...
> > I'm wondering how safe it would be to install Fedora versions
> > of the required kernel and iptables?
> >   
> 
> I seem to recall kernel discussions here on this list and why this is a 
> VERY bad idea.
> 
It is definitively NOT recommended.If it breaks you get to keep all the
pieces.... That being said, I really wanted to have some ipv6 firewall
on my Centos box. At first I thought of running a Fedora VM in Xen. I
ran into some issues with my Sun quad fast ethernet card. So in the end
I compiled an RPM from the stock kernel and  compiled some RPMs myself
from Fedora RPMs:
iptables
iptables-ipv6
lmsensors
I am not sure that this is the complete list of kernel dependent rpms
that are needed. It can be done when you compile your own stuff, but is
definitely NOT recommended. If you want to go this route you will need a
pretty good background on compiling your own RPMs etc.

Running Fedora kernels is still more tricky: there are way too many
dependencies. Don't even try!!!!

> > Or is there any alternative to shorewall that is IPv6 compatible?
> > I don't really want to run iptables directly, unless forced to do so,
> > as I have found shorewall very reliable and simple to configure.
> >   
> 
> What I am working on is a FC9 system with shorewall6, then doing a 
> ip6tables -L and copying those rules that do not require stateful 
> firewalling...
> 
If you do not use a kernel that has statefull ipv6 firealling I would
recommend 6wall. This is a pretty old shorewall-shell derived package
that does ipv6 fire walling. The syntax should be familiar to old
shorewall users. It does however not offer macros or actions. 
And you will have to write rules for incoming and outgoing traffic
separately. Something like:
ACCEPT          all             all             tcp     domain
ACCEPT          all             all             tcp     -       domain


It is still probably easier to use 6wall than porting just the
shorewall6 generated ip6tables rules. 

I am personally considering  going back to running the firewall in a
Fedora VM now that I have a managed vlan capable swith. Simply being
able to update using yum is so much easier and more reliable. 

Louis