OK, firewall rules aren't in my wheelhouse.
I've got an IPv6 network with a /56 prefix assigned to me by my ISP. This, I
understand,
is rather large and it breaks some functionality. It is meant that this be broken up
into
256 /64 networks or smaller.
On my ISP facing router the LAN has a /64 segment defined and all systems on the same LAN
work just fine.
I created a static route to a host with 2 LAN interfaces. It can be reached by using
either IP address. I have made these additions
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.all.proxy_ndp = 1
to a config file in /etc/sysctl.d
However in order to reach that second system from the internet I need to disable the
firewall on the first. Otherwise I get....
May 12 18:47:59 f30-k kernel: FINAL_REJECT: IN=enp0s3 OUT=enp0s8
MAC=08:00:27:62:b8:24:00:11:32:76:13:a8:86:dd SRC=2001:0470:0066:0cce:0000:0000:0000:0002
DST=2001:b030:112f:0001:0000:0000:0000:0010 LEN=80 TC=0 HOPLIMIT=49 FLOWLBL=875364
PROTO=TCP SPT=54428 DPT=22 WINDOW=65320 RES=0x00 SYN URGP=0
So, I'm sure I need to add a "rich rule" or something to the firewall but
I've no idea
what it should be. :-(
--
Right: I dislike the default color scheme Wrong: What idiot picked the default color
scheme