Setup Firewall-D for Ipv6

@curtntech writes:

Since I have nginx listening for IPv6, do I also need to setup Firewall-D for IPv6?

I would assume so… It depends on how serious you take threats using IPv6 as an attack vector on your web server. I have a firewall protecting both IPv4/IPv6 but it passes all http/https traffic. My web server has other protections in place for that. See:

https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker

I use the version for apache2(8). I update it via cron(8) daily.

With respect to the firewall though, I also use blacklisting and fail2ban(1) so any traffic from sources I consider or determine to be malevolent is blocked. My blacklists are updated every 8 hours.

-- sw

Hi @curtntech - It depends on how you have it set up. In some cases, it'll already be taken care of. You can configure FirewallD via service/protocol or via rich language rules. There's an official reference on rich language rules here:

https://jpopelka.fedorapeople.org/firewalld/doc/firewalld.richlanguage.html

Specifically you can set the rule to be in the IPv6 rule family: rule family="ipv6"

We have an intro guide to Firewall D here:

Introduction to FirewallD on CentOS