Hello,
here I am again and I hope you can help me as you did in January this
year and give me THE crucial tip.
My environment:
### Internet ###
^
|
V
+-----------+
| |
| FWA |
| |
+-----------+
^
|
--EDMZ--+----------------- [special devices]
|
V eth0
+-----------+
| |
| FWB | vml000210
| |
+-----------+
^ eth1
|
--IDMZ--+------------------ [web, mail ...]
|
V eth0
+-----------+
| |
| FWC | vml000110
| |
+-----------+
^ eth1
|
--------+-----Intranet----- [mobile devices, notebooks, phones ...]
Okay, so far so good, the diagram roughly shows my infrastructure at
home. The two firewalls/routers FWB and FWC are virtual Archlinux hosts
in a KVM environment.
The good thing is that I can access the internet from both VMs (FWB and
FWC) and reach all services, such as DNS, WEB, MAIL, without any
problems. I can also access services/daemons (ssh, smtp, http...) from
the outside that are offered on these two VMs, for example!
But now comes the big BUT and my problems begin! If I connect my laptop
to the interface eth1 of my internal firewall, I can access it via ICMP
or SSH, for example. But everything else “behind” it, i.e. the FWB or
even out to the internet, is starved across the board or blocked and not
routed through by something or someone. But I currently have absolutely
no other explanation than PEBCAK for my problem!
So now we come to the configuration:
=======================================================================
First, let's take a look at the external firewall
(EDMZ ← → IDMZ) Virtual KVM Host vml000210
firewall FWB:
-----------------------------------------------------------------------
I: IP Forwarding
root@vml000210:~# sysctl net.ipv4.ip_forward net.ipv6.conf.all.forwarding
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
-----------------------------------------------------------------------
II: NETWORK
root@vml000210:~# ip -6 -br addr
lo UNKNOWN ::1/128
eth0 UP 2003:a:bcd:ef00:1720:17:2:210/64
fd00::172:17:2:210/64
fe80::1720:17ff:fe02:210/64
eth1 UP 2003:a:bcd:ef03:10::210/64
fd00::3:10:0:0:210/64
fe80::5054:ff:fe41:2102/64
-----------------------------------------------------------------------
III: ROUTING
root@vml000210:~# ip -6 route
2003:a:bcd:ef00::/64 dev eth0 proto kernel metric 256 pref medium
2003:a:bcd:ef03::/64 dev eth1 proto kernel metric 256 pref medium
fd00::/64 dev eth0 proto kernel metric 256 pref medium
fd00:0:0:3::/64 dev eth1 proto kernel metric 256 pref medium
fe80::/64 dev eth1 proto kernel metric 256 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
default via fe80::7ac5:7dff:fefd:1c10 dev eth0 proto static metric
1024 pref medium
The default gateway with the address fe80::7ac5:7dff:fefd:1c10 that is
entered here is the LLA of the external FWA!
-----------------------------------------------------------------------
IV: FIREWALL-DAEMON
root@vml000210:~# firewall-cmd --zone=edmz --list-all
edmz (default, active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: eth0
sources:
services:
ports:
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" forward-port port="25" protocol="tcp" to-port="25"
to-addr="10.0.0.110"
rule family="ipv6" source address="2003:a:bcd:ef00::/64" service
name="ssh" accept
rule family="ipv6" forward-port port="465" protocol="tcp" to-port="465"
to-addr="2003:a:bcd:ef03:10::110"
rule family="ipv4" forward-port port="587" protocol="tcp" to-port="587"
to-addr="10.0.0.110"
rule family="ipv4" forward-port port="41022" protocol="tcp" to-port="22"
rule family="ipv6" forward-port port="41022" protocol="tcp" to-port="22"
rule family="ipv6" forward-port port="587" protocol="tcp" to-port="587"
to-addr="2003:a:bcd:ef03:10::110"
rule family="ipv4" source address="172.17.2.0/24" service name="ssh" accept
rule family="ipv6" forward-port port="25" protocol="tcp" to-port="25"
to-addr="2003:a:bcd:ef03:10::110"
rule family="ipv4" forward-port port="465" protocol="tcp" to-port="465"
to-addr="10.0.0.110"
rule family="ipv6" icmp-type name="echo-request" accept
root@vml000210:~# firewall-cmd --policy=edmz_2_idmz --list-all
edmz_2_idmz (active)
priority: -1
target: REJECT
ingress-zones: edmz
egress-zones: idmz
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv6" destination address="2003:a:bcd:ef03:10::110"
icmp-type name="echo-request" accept
rule family="ipv4" destination address="10.0.0.110" port port="25"
protocol="tcp" accept
rule family="ipv6" destination address="2003:a:bcd:ef03:10::110" port
port="25" protocol="tcp" accept
rule family="ipv4" destination address="10.0.0.110" port port="465"
protocol="tcp" accept
rule family="ipv6" destination address="2003:a:bcd:ef03:10::110" port
port="465" protocol="tcp" accept
rule family="ipv4" destination address="10.0.0.110" port port="587"
protocol="tcp" accept
rule family="ipv6" destination address="2003:a:bcd:ef03:10::110" port
port="587" protocol="tcp" accept
root@vml000210:~# firewall-cmd --zone=idmz --list-all
idmz (active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: eth1
sources:
services: ssh
ports:
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv6" forward-port port="41022" protocol="tcp" to-port="22"
rule family="ipv4" forward-port port="41022" protocol="tcp" to-port="22"
root@vml000210:~# firewall-cmd --policy=idmz_2_edmz --list-all
idmz_2_edmz (active)
priority: -1
target: ACCEPT
ingress-zones: idmz
egress-zones: edmz
services:
ports:
protocols:
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:
=======================================================================
And here we have the configuration details for the internal firewall.
(IDMZ ←→ INTRANET) Virtual KVM Host vml000110
firewall FWC:
-----------------------------------------------------------------------
I: IP Forwarding
root@vml000110:~# sysctl net.ipv4.ip_forward net.ipv6.conf.all.forwarding
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
-----------------------------------------------------------------------
II: NETWORK
root@vml000110:~# ip -6 -br addr
lo UNKNOWN ::1/128
eth0 UP 2003:a:bcd:ef03:10::110/64
fd00::3:10:0:0:110/64
fe80::5054:ff:fe41:1101/64
eth1 UP 2003:a:bcd:ef07:10:0:10:110/64
fd00::7:10:0:10:110/64
fe80::5054:ff:fe41:1102/64
-----------------------------------------------------------------------
III: ROUTING
root@vml000110:~# ip -6 route
2003:a:bcd:ef03::/64 dev eth0 proto kernel metric 256 pref medium
2003:a:bcd:ef07::/64 dev eth1 proto kernel metric 256 pref medium
fd00:0:0:3::/64 dev eth0 proto kernel metric 256 pref medium
fd00:0:0:7::/64 dev eth1 proto kernel metric 256 pref medium
fe80::/64 dev eth0 proto kernel metric 256 pref medium
fe80::/64 dev eth1 proto kernel metric 256 pref medium
default via fd00::3:10:0:0:210 dev eth0 proto static metric
1024 pref medium
The default gateway with the address fd00::3:10:0:0:210 is here the ULA
of firewall FWB!
-----------------------------------------------------------------------
IV: FIREWALL-DAEMON
root@vml000110:~# firewall-cmd --zone=idmz --list-all
idmz (default, active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: eth0
sources:
services: ssh
ports: 25/tcp 465/tcp 587/tcp
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="10.0.0.0/24" destination
address="10.0.0.110/32" port port="123" protocol="udp" accept
rule family="ipv6" source address="2003:a:bcd:ef03::/64" destination
address="2003:a:bcd:ef03:10::110/64" port port="123" protocol="udp" accept
rule family="ipv6" source address="fd00::/10" destination
address="fd00::3:10:0:0:110/64" port port="123" protocol="udp" accept
rule family="ipv6" icmp-type name="echo-request" accept
root@vml000110:~# firewall-cmd --policy=idmz_2_intra --list-all
idmz_2_intra (active)
priority: -1
target: REJECT
ingress-zones: idmz
egress-zones: intra
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
root@vml000110:~# firewall-cmd --zone=intra --list-all
intra (active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces: eth1
sources:
services: dhcp dhcpv6 smtp ssh
ports:
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv6" source address="2003:a:bcd:ef07::/64" destination
address="2003:a:bcd:ef07:10:0:10:110/64" port port="123" protocol="udp"
accept
rule family="ipv4" source address="10.0.10.0/24" service name="ssh" accept
rule family="ipv6" source address="fd00::/10" destination
address="fd00::7:10:0:0:110/64" port port="123" protocol="udp" accept
rule family="ipv6" source address="2003:a:bcd:ef07::/64" service
name="ssh" accept
rule family="ipv4" source address="10.0.10.0/24" destination
address="10.0.10.110/32" port port="123" protocol="udp" accept
rule family="ipv6" icmp-type name="echo-request" accept
root@vml000110:~# firewall-cmd --policy=intra_2_idmz --list-all
intra_2_idmz (active)
priority: -1
target: ACCEPT
ingress-zones: intra
egress-zones: idmz
services:
ports:
protocols:
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:
=======================================================================
TRAFFIC: IDMZ-FW (FWC) → EDMZ-FW (FWB) "outgoing"
1) ping to LLA (eth1)
root@vml000110:~# ping -6 -c4 fe80::5054:ff:fe41:2102%eth0
PING fe80::5054:ff:fe41:2102%eth0 (fe80::5054:ff:fe41:2102%eth0) 56 data
bytes
64 bytes from fe80::5054:ff:fe41:2102%eth0: icmp_seq=1 ttl=64 time=0.554 ms
64 bytes from fe80::5054:ff:fe41:2102%eth0: icmp_seq=2 ttl=64 time=0.435 ms
64 bytes from fe80::5054:ff:fe41:2102%eth0: icmp_seq=3 ttl=64 time=0.430 ms
64 bytes from fe80::5054:ff:fe41:2102%eth0: icmp_seq=4 ttl=64 time=0.434 ms
--- fe80::5054:ff:fe41:2102%eth0 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3036ms
rtt min/avg/max/mdev = 0.430/0.463/0.554/0.052 ms
2) ping to ULA (eth1)
root@vml000110:~# ping -6 -c4 fd00::3:10:0:0:210
PING fd00::3:10:0:0:210 (fd00::3:10:0:0:210) 56 data bytes
64 bytes from fd00::3:10:0:0:210: icmp_seq=1 ttl=64 time=0.443 ms
64 bytes from fd00::3:10:0:0:210: icmp_seq=2 ttl=64 time=0.433 ms
64 bytes from fd00::3:10:0:0:210: icmp_seq=3 ttl=64 time=0.461 ms
64 bytes from fd00::3:10:0:0:210: icmp_seq=4 ttl=64 time=0.476 ms
--- fd00::3:10:0:0:210 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3040ms
rtt min/avg/max/mdev = 0.433/0.453/0.476/0.016 ms
3) ping to GUA (eth1)
root@vml000110:~# ping -6 -c4 2003:a:bcd:ef03:10::210
PING 2003:a:bcd:ef03:10::210 (2003:a:bcd:ef03:10::210) 56 data bytes
64 bytes from 2003:a:bcd:ef03:10::210: icmp_seq=1 ttl=64 time=0.448 ms
64 bytes from 2003:a:bcd:ef03:10::210: icmp_seq=2 ttl=64 time=0.424 ms
64 bytes from 2003:a:bcd:ef03:10::210: icmp_seq=3 ttl=64 time=0.424 ms
64 bytes from 2003:a:bcd:ef03:10::210: icmp_seq=4 ttl=64 time=0.417 ms
--- 2003:a:bcd:ef03:10::210 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3033ms
rtt min/avg/max/mdev = 0.417/0.428/0.448/0.011 ms
4) ping to ULA (eth0)
root@vml000110:~# ping -6 -c4 fd00::172:17:2:210
PING fd00::172:17:2:210 (fd00::172:17:2:210) 56 data bytes
64 bytes from fd00::172:17:2:210: icmp_seq=1 ttl=64 time=0.488 ms
64 bytes from fd00::172:17:2:210: icmp_seq=2 ttl=64 time=0.390 ms
64 bytes from fd00::172:17:2:210: icmp_seq=3 ttl=64 time=0.518 ms
64 bytes from fd00::172:17:2:210: icmp_seq=4 ttl=64 time=0.341 ms
--- fd00::172:17:2:210 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3038ms
rtt min/avg/max/mdev = 0.341/0.434/0.518/0.071 ms
5) ping to GUA (eth0)
root@vml000110:~# ping -6 -c4 2003:a:bcd:ef00:1720:17:2:210
PING 2003:a:bcd:ef00:1720:17:2:210 (2003:a:bcd:ef00:1720:17:2:210) 56
data bytes
64 bytes from 2003:a:bcd:ef00:1720:17:2:210: icmp_seq=1 ttl=64 time=0.434 ms
64 bytes from 2003:a:bcd:ef00:1720:17:2:210: icmp_seq=2 ttl=64 time=0.254 ms
64 bytes from 2003:a:bcd:ef00:1720:17:2:210: icmp_seq=3 ttl=64 time=0.410 ms
64 bytes from 2003:a:bcd:ef00:1720:17:2:210: icmp_seq=4 ttl=64 time=0.518 ms
--- 2003:a:bcd:ef00:1720:17:2:210 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3032ms
rtt min/avg/max/mdev = 0.254/0.404/0.518/0.095 ms
=======================================================================
TRAFFIC: IDMZ-FW (FWC) → Internet
1) DNS
root@vml000110:~# host -t AAAA heise.de
heise.de has IPv6 address 2a02:2e0:3fe:1001:302::
2) ping to heise.de
root@vml000110:~# ping -6 -c4 2a02:2e0:3fe:1001:302::
PING 2a02:2e0:3fe:1001:302:: (2a02:2e0:3fe:1001:302::) 56 data bytes
64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=1 ttl=56 time=13.0 ms
64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=2 ttl=56 time=13.6 ms
64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=3 ttl=56 time=13.3 ms
64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=4 ttl=56 time=13.2 ms
--- 2a02:2e0:3fe:1001:302:: ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 12.952/13.245/13.606/0.237 ms
=======================================================================
TRAFFIC: EMZ-FW (FWB) → IDMZ-FW (FWC) "incoming"
1) ping to LLA eth0
root@vml000210:~# ping -6c4 fe80::5054:ff:fe41:1101%eth1
PING fe80::5054:ff:fe41:1101%eth1 (fe80::5054:ff:fe41:1101%eth1) 56 data
bytes
64 bytes from fe80::5054:ff:fe41:1101%eth1: icmp_seq=1 ttl=64 time=0.637 ms
64 bytes from fe80::5054:ff:fe41:1101%eth1: icmp_seq=2 ttl=64 time=0.593 ms
64 bytes from fe80::5054:ff:fe41:1101%eth1: icmp_seq=3 ttl=64 time=0.502 ms
64 bytes from fe80::5054:ff:fe41:1101%eth1: icmp_seq=4 ttl=64 time=0.505 ms
--- fe80::5054:ff:fe41:1101%eth1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3040ms
rtt min/avg/max/mdev = 0.502/0.559/0.637/0.057 ms
2) ping to ULA eth0
root@vml000210:~# ping -6c4 fd00::3:10:0:0:110
PING fd00::3:10:0:0:110 (fd00::3:10:0:0:110) 56 data bytes
64 bytes from fd00::3:10:0:0:110: icmp_seq=1 ttl=64 time=0.438 ms
64 bytes from fd00::3:10:0:0:110: icmp_seq=2 ttl=64 time=0.406 ms
64 bytes from fd00::3:10:0:0:110: icmp_seq=3 ttl=64 time=0.430 ms
64 bytes from fd00::3:10:0:0:110: icmp_seq=4 ttl=64 time=0.434 ms
--- fd00::3:10:0:0:110 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3046ms
rtt min/avg/max/mdev = 0.406/0.427/0.438/0.012 ms
3) ping to GUA eth0
root@vml000210:~# ping -6c4 2003:a:bcd:ef03:10::110
PING 2003:a:bcd:ef03:10::110 (2003:a:bcd:ef03:10::110) 56 data bytes
64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=1 ttl=64 time=0.522 ms
64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=2 ttl=64 time=0.601 ms
64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=3 ttl=64 time=0.387 ms
64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=4 ttl=64 time=0.507 ms
--- 2003:a:bcd:ef03:10::110 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3051ms
rtt min/avg/max/mdev = 0.387/0.504/0.601/0.076 ms
4) ping to ULA eth1 (interface whos shows to the intranet!)
root@vml000210:~# ping -6c4 fd00::7:10:0:10:110
PING fd00::7:10:0:10:110 (fd00::7:10:0:10:110) 56 data bytes
--- fd00::7:10:0:10:110 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3035ms
Route to the ULA from eth1 of the IDMZ firewall (FWC):
root@vml000210:~# ip route get fd00::7:10:0:10:110
fd00::7:10:0:10:110 from :: via fe80::7ac5:7dff:fefd:1c10 dev eth0 proto
static src fd00::172:17:2:210 metric 1024 pref medium
5) ping to GUA eth1
root@vml000210:~# ping -6c4 2003:a:bcd:ef07:10:0:10:110
PING 2003:a:bcd:ef07:10:0:10:110 (2003:a:bcd:ef07:10:0:10:110) 56 data bytes
--- 2003:a:bcd:ef07:10:0:10:110 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3035ms
Route to the GUA from eth1 of the IDMZ firewall (FWC):
root@vml000210:~# ip route get 2003:a:bcd:ef07:10:0:10:110
2003:a:bcd:ef07:10:0:10:110 from :: via fe80::7ac5:7dff:fefd:1c10 dev
eth0 proto static src 2003:a:bcd:ef00:1720:17:2:210 metric 1024 pref medium
In both cases, fe80::7ac5:7dff:fefd:1c10 is the default gateway of the
EDMZ firewall in the direction of the DSL router, i.e. the ULA of the
DSL router!
=======================================================================
TRAFFIC: EDMZ-FW (FWB) → Internet
1) DNS
root@vml000210:~# host -t AAAA heise.de
heise.de has IPv6 address 2a02:2e0:3fe:1001:302::
2) ping to heise.de
root@vml000210:~# ping -6 -c4 2a02:2e0:3fe:1001:302::
PING 2a02:2e0:3fe:1001:302:: (2a02:2e0:3fe:1001:302::) 56 data bytes
64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=1 ttl=56 time=13.0 ms
64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=2 ttl=56 time=13.6 ms
64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=3 ttl=56 time=13.3 ms
64 bytes from 2a02:2e0:3fe:1001:302::: icmp_seq=4 ttl=56 time=13.2 ms
--- 2a02:2e0:3fe:1001:302:: ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 12.952/13.245/13.606/0.237 ms
=======================================================================
However, if I now connect my laptop directly to the network interface,
which is connected directly from the KVM host to the virtual machine
vml000110 using a bridge, I get the following configuration parameters
from the host vml000110's radvd and kea-dhcp6:
-----------------------------------------------------------------------
I) NETWORK
root@nitropad:~# ip -6 -br addr
lo UNKNOWN ::1/128
enp0s25 UP fd00::7:10:0:10:73/64
2003:a:bcd:ef07:10:0:10:73/64
fe80::9f6c:de76:b191:9938/64
-----------------------------------------------------------------------
II) ROUTING
root@nitropad:~# ip -6 route
::1 dev lo proto kernel metric 256 pref medium
2003:a:bcd:ef07::/64 dev enp0s25 proto kernel metric 100 pref medium
fd00:0:0:7::/64 dev enp0s25 proto kernel metric 100 pref medium
fe80::/64 dev enp0s25 proto kernel metric 1024 pref medium
default via fe80::5054:ff:fe41:1102 dev enp0s25 proto static metric
20100 pref medium
The default gateway with the address fe80::5054:ff:fe41:1102 is the LLA
of the internal firewall FBC with the network interface eth1, i.e. the
direct partner to which the laptop is connected!
=======================================================================
TRAFFIC: Laptop → IDMZ-FW (FWC) "outgoing"
I can access the internal firewall FWC from my laptop without any problems:
1) ping to LLA eth1 of FWC:
root@nitropad:~# ping -6c4 fe80::5054:ff:fe41:1102%enp0s25
PING fe80::5054:ff:fe41:1102%enp0s25(fe80::5054:ff:fe41:1102%enp0s25) 56
data bytes
64 bytes from fe80::5054:ff:fe41:1102%enp0s25: icmp_seq=1 ttl=64
time=0.511 ms
64 bytes from fe80::5054:ff:fe41:1102%enp0s25: icmp_seq=2 ttl=64
time=0.491 ms
64 bytes from fe80::5054:ff:fe41:1102%enp0s25: icmp_seq=3 ttl=64
time=0.490 ms
64 bytes from fe80::5054:ff:fe41:1102%enp0s25: icmp_seq=4 ttl=64
time=0.574 ms
--- fe80::5054:ff:fe41:1102%enp0s25 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3068ms
rtt min/avg/max/mdev = 0.490/0.516/0.574/0.034 ms
2) ping to ULA of FWC - eth1:
root@nitropad:~# ping -6c4 fd00::7:10:0:10:110
PING fd00::7:10:0:10:110(fd00::7:10:0:10:110) 56 data bytes
64 bytes from fd00::7:10:0:10:110: icmp_seq=1 ttl=64 time=1.01 ms
64 bytes from fd00::7:10:0:10:110: icmp_seq=2 ttl=64 time=0.533 ms
64 bytes from fd00::7:10:0:10:110: icmp_seq=3 ttl=64 time=0.576 ms
64 bytes from fd00::7:10:0:10:110: icmp_seq=4 ttl=64 time=0.543 ms
--- fd00::7:10:0:10:110 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3031ms
rtt min/avg/max/mdev = 0.533/0.666/1.012/0.200 ms
3) ping to GUA of FWC - eth1:
root@nitropad:~# ping -6c4 2003:a:bcd:ef07:10:0:10:110
PING 2003:a:bcd:ef07:10:0:10:110(2003:a:bcd:ef:07:10:0:10:110) 56 data bytes
64 bytes from 2003:a:bcd:ef07:10:0:10:110: icmp_seq=1 ttl=64 time=0.816 ms
64 bytes from 2003:a:bcd:ef07:10:0:10:110: icmp_seq=2 ttl=64 time=0.485 ms
64 bytes from 2003:a:bcd:ef07:10:0:10:110: icmp_seq=3 ttl=64 time=0.496 ms
64 bytes from 2003:a:bcd:ef07:10:0:10:110: icmp_seq=4 ttl=64 time=0.450 ms
--- 2003:a:bcd:ef07:10:0:10:110 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3054ms
rtt min/avg/max/mdev = 0.450/0.561/0.816/0.147 ms
4) ping to GUA of FWC - eth0 (this is the connection to external
firewall EDMZ FWB):
root@nitropad:~# ping -6c4 2003:a:bcd:ef03:10:0:0:110
PING 2003:a:bcd:ef03:10:0:0:110(2003:a:bcd:ef03:10::110) 56 data bytes
64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=1 ttl=64 time=0.458 ms
64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=2 ttl=64 time=0.373 ms
64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=3 ttl=64 time=0.462 ms
64 bytes from 2003:a:bcd:ef03:10::110: icmp_seq=4 ttl=64 time=0.506 ms
--- 2003:a:bcd:ef03:10:0:0:110 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3055ms
rtt min/avg/max/mdev = 0.373/0.449/0.506/0.048 ms
5) But now comes the real HOLY SHIT: When I try to ping the interface
eth1 of the EDMZ firewall (FWB) from my laptop, unfortunately only this
happens:
root@nitropad:~# ping -6c4 2003:a:bcd:ef:03:10:0:0:210
PING 2003:a:bcd:ef03:10:0:0:210(2003:a:bcd:ef03:10::210) 56 data bytes
--- 2003:a:bcd:ef:03:10:0:0:210 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3071ms
6) I see the same crap when I try to ping heise.de, for example:
root@nitropad:~# ping -6c4 2a02:2e0:3fe:1001:302::
PING 2a02:2e0:3fe:1001:302::(2a02:2e0:3fe:1001:302::) 56 data bytes
--- 2a02:2e0:3fe:1001:302:: ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3055ms
=======================================================================
I just don't understand it. I can access the internet without any
problems from both VMs. But as soon as I try to access FWB or the
internet in front of it from the intranet, I mercilessly starve to death
somewhere at the internal firewall FWC. I don't even think that the
firewall is causing problems here, because the configuration of the same
corresponds to that on the FWB (EDMZ-Firewall) My biggest guess is more
in the direction of routing, but only where exactly have I made a
mistake in my thinking and configuration. I just don't understand it.
That's why I'm hoping that someone here can help me out or point me in
the right direction.
I'd like to say a huge thank you in advance for even the tiniest hint!
Best regards
Django
