Scope#
Raspberry is exposed to the internet for my backup solution. I want to enable ipv6 access only and enable access only from my home computer.Steps:
- register your home computer (Windows) at a dyndns service to provide the current ipv6, see dynv6.com
- Windows: create windows batch script to update dynv6
- Windows schedule script to run each time the PC is booted, see "Aufgabenplanung" (task scheduler)
- Raspberry: create and set iptables ruleset
- Raspberry: use python script to query the current ipv6 from dynv6 (Windows) and replace in iptables ruleset
- Raspberry: schedule the ipv6 update in firewall (ip6tables)
2. Windows batch script to update dynv6 service#
REM update_dynv6.bat
REM set utf-8
chcp 65001
echo off
set domain=<your.domain.here>
set token=<youtTokenHere>
echo ---- check and update local ipv6 address at dynv6.com for %domain% ----
rem ping -n 1 -6 %domain%
for /F "tokens=3" %%i in ('"ping -n 1 -6 %domain% | findstr Antwort"') do set dynv6_ipv6=%%i
rem cut last colon, example 2a02:5a0:4110:f590:29f6:40ba:51b4:b4da:
set dynv6_ipv6=%dynv6_ipv6:~0,-1%
echo dynv6 ipv6= %dynv6_ipv6%
rem ipconfig
rem echo ---------- extracting Temporäre IPv6-Adresse ----------
for /F "tokens=9" %%i in ('"ipconfig | findstr Temp | findstr 2a02"') do set local_ipv6=%%i
echo local ipv6= %local_ipv6%
if %local_ipv6% == %dynv6_ipv6% (
echo ipv6 at dynv6 is up to date, update skipped
) else (
set url="https://dynv6.com/api/update?hostname=%domain%^&token=%token%&ipv6=%ipv6%"
ECHO updating IPv6
curl "%url%"
)
echo:
echo done
pause
iptables#
Commands#
> ls -la /usr/sbin/ip* # list all commands, there are many > iptables* # for ipv4 (in debian busters = nft) > ip6tables* # for ipv6 (in debian busters = nft) > iptables-legacy # former ones, not nft > iptables-nft # directly use nftNotes:
- all iptables commands (for ipv4) have an ip6tabbles* equivalent (for ipv6)
- see info on nft
> who -u # get all sessions with ip and pid > sudo netstat -pantW # list network connections, p=programs,a=all,n=IPs,t=tcp,W=wide(not truncate IP address) > ip a # list all ips > sudo ip6tables -L -v # list all ipv6 rules > sudo ip6tables -n -v --line-numbers -L # list all ipv6 rules with numeric IPs and rule number
Syntax#
see docu
> sudo ip6tables -nvL --line-numbers -L
4. my general ruleset#
We also need to enable the local interface and the DNS nameservers.
I use a custom DNS server setting, because the fritzbox does not resolve my dynv6 domains (?).
> sudo nmcli -o device show # show interfaces settings > sudo nmcli -p connection show # show interface status #THIS IS NECESSARY > sudo nmcli con mod "Wired connection 1" ipv4.dns "1.1.1.1,8.8.8.8" # add cloudflare and google dns > sudo nmcli con mod "Wired connection 1" ipv4.ignore-auto-dns no # this adds "search fritz.box" to get ips at all from frit.box > sudo nmcli con mod "Wired connection 1" ipv6.ignore-auto-dns yes # we skip ipv6 dns > sudo nmcli c down "Wired connection 1" && sudo nmcli c up "Wired connection 1" # restart > sudo vi /etc/resolv.conf # validate settings
Python#
- package "python3-iptables" manages legacy ones only, docu1, docu2
- package "python3-nftables" manages nft tables, docu
- alternatively you can use subprocess.run to call the original system commands
5. subprocess#
#!/usr/bin/env python
import socket # determine ipv6
import subprocess
tupel = socket.getaddrinfo('your.pc.com', None, socket.AF_INET6)
# tupel like [(<AddressFamily.AF_INET6: 23>, 0, 0, '', ('2a02:5a0:4110:f590:4670:d3e6:f2bc:ee', 8384, 0, 0))]
print("tupel=", tupel)
ipv6=tupel[0][4][0]
print("ipv6=", ipv6)
subprocess.run(["/usr/sbin/ip6tables", "-R", "INPUT", "1", "-s", ipv6, "-j", "ACCEPT"])
subprocess.run(["/usr/sbin/ip6tables", "-R", "OUTPUT", "1", "-d", ipv6, "-j", "ACCEPT"])
6. Schedule script with crontab#
Run every 15 minutes
> sudo crontab -u root -e # add following */15 * * * * /home/markus/update_ip6tables.py