# ip6tables, et ICMP recommandations

**URL:** <https://www.debian-fr.org/t/ip6tables-et-icmp-recommandations/56046>\
**Category:** Support Debian\
**Created:** [Février 21, 2016, 1:59 UTC](https://www.debian-fr.org/t/ip6tables-et-icmp-recommandations/56046 "2016-02-21T13:59:36Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![PengouinPdt](https://www.debian-fr.org/user_avatar/www.debian-fr.org/pengouinpdt/32/3978_2.png) [@PengouinPdt](https://www.debian-fr.org/u/PengouinPdt)\
**Post date:** [Mars 16, 2016, 1:09 UTC](https://www.debian-fr.org/t/ip6tables-et-icmp-recommandations/56046/5 "2016-03-16T01:09:51Z")

</div>

Tiens, je remets une couche sur ce sujet - _on ne pourra pas me dire qu’il ne m’intéresse pas_ - 😛

En effet, pour certaines raisons récentes, je me suis replonger dans certaines documentations glanées sur le web, et principalement auprès de l’IETF … dont la fameuse [RFC 4890, et ces recommandations de filtrage ICMPv6 en local,](https://tools.ietf.org/html/rfc4890#section-4.4) ainsi que de ce [document de travail de 2013-2014](https://tools.ietf.org/html/draft-ietf-opsec-icmp-filtering-04) !

Selon lesdites recommandations, il semble intéressant d’écrire ainsi les règles ICMPv6 :

```auto
 ip6tables -N INPUT_ICMPV6
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 1 -m limit --limit 1/second -j ACCEPT # destination-unreachable; Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 2/0 -j ACCEPT # packet too big; Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 3/0 -j ACCEPT # time exceeded; Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 3/1 -j ACCEPT # time exceeded; Should Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 4/0 -m limit --limit 1/second -j ACCEPT # parameter pb: Erroneous header field encountered; Should Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 4/1 -m limit --limit 1/second -j ACCEPT # parameter pb: Unrecognized Next Header Type encountered; Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 4/2 -m limit --limit 1/second -j ACCEPT # parameter pb: Unrecognized IPv6 option encountered; Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 128/0 -m limit --limit 1/second -j ACCEPT # ping tool: echo request message; Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 129/0 -m limit --limit 1/second -j ACCEPT # ping tool: echo reply message; Must Not Be Dropped

# link-local multicast receive notification mssg (need link-local src address)
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 130/0 -s fe80::/64 -j ACCEPT # Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 131/0 -s fe80::/64 -j ACCEPT # Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 132/0 -s fe80::/64 -j ACCEPT # Must Not Be Dropped

# address configuration and routeur selection mssg (received with hop limit = 255)
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 133/0 -m state --state RELATED -m hl --hl-eq 255 -j ACCEPT # Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -s fe80::/64 -p icmpv6 --icmpv6-type 134/0 -m state --state RELATED -m hl --hl-eq 255 -j ACCEPT # Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 135/0 -m state --state RELATED -m hl --hl-eq 255 -j ACCEPT # Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 136/0 -m state --state RELATED -m hl --hl-eq 255 -j ACCEPT # Must Not Be Dropped

ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 141/0 -m state --state RELATED -m hl --hl-eq 255 -j ACCEPT # Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 142/0 -m state --state RELATED -m hl --hl-eq 255 -j ACCEPT # Must Not Be Dropped

# link-local multicast receive notification mssg (need link-local src address)
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 143 -s fe80::/64 -j ACCEPT # Must Not Be Dropped

# SEND certificate path notification mssg (received with hop limit = 255)
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 148 -m state --state RELATED -m hl --hl-eq 255 -j ACCEPT # Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 149 -m state --state RELATED -m hl --hl-eq 255 -j ACCEPT # Must Not Be Dropped
# multicast routeur discovery mssg (need link-local src address and hop limit = 1)
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 151 -s fe80::/64 -m hl --hl-eq 1 -j ACCEPT # Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 152 -s fe80::/64 -m hl --hl-eq 1 -j ACCEPT # Must Not Be Dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 --icmpv6-type 153 -s fe80::/64 -m hl --hl-eq 1 -j ACCEPT # Must Not Be Dropped

# all others are dropped
ip6tables -A INPUT_ICMPV6 -p icmpv6 -j DROP
```

Bien-sûr, l’équivalent en sortie est à traiter …

* * *

Voilà, où j’en suis de mes recherches et compréhensions actuelles, selon lesdites documentations.

---

_[View the full topic](https://www.debian-fr.org/t/ip6tables-et-icmp-recommandations/56046)._