Weird issue specific to chain ALLOWDYNIN in ip6tables

This forum is only for reproducible bugs with csf and lfd (i.e. not iptables problems, lack of understanding how to use a feature, etc). Posts must be accompanied with full technical details of the problem and how it can be recreated. Any posts not adhering to this, or not considered bugs, will be moved to the General Discussion (csf) forum.
Post Reply
Junior Member
Posts: 1
Joined: 12 Mar 2024, 15:45

Weird issue specific to chain ALLOWDYNIN in ip6tables

Post by Jacky »


So for a while now I was annoyed that my servers are blocked between each other, but I never bothered to check why. After a while, I decided to configure DYNDNS domains between them (as we change IPs quiet often) and it all worked. On IPv4. Since some of our servers also use IPv6 obviously that wasn't working. So I tried allowing specific IP and that worked.

Again after some time (2-3 months), I decided to check, why the heck IPv6 isn't blocking. So I found a very strange issue with IPv6 tables specifically. When CSF sets rules, the rule for IPV6 IPSET isn't added. I tried the wait lock and the same thing happened. So I also tried adding these two rules into
ip6tables -A ALLOWDYNOUT -m set --match-set chain_6_ALLOWDYN dst -j ACCEPT
ip6tables -A ALLOWDYNIN -m set --match-set chain_6_ALLOWDYN src -j ACCEPT

And while running them manually works, the postscript (even though the console says executed) doesn't. Not sure what is going on here. This happens on a few machines so it's not a specific issue to my server. I run iptables v1.8.7 (nf_tables) on Ubuntu 22.04. Also same happens on Debian 12 running ip6tables v1.8.9 (nf_tables).

Anyone has the same issue? Any solutions?
Post Reply