Skip to content

Add IPv6 support #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adrelanos merged 6 commits into from
Sep 13, 2025
+154 −39
Merged

Add IPv6 support #10

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
e7de2a0
Add IPv6 support
DanWin Oct 11, 2024
4e202b1
Add qubes IPs
DanWin Oct 28, 2024
aa02720
Switch 127.0.0.0/24 to 127.0.0.0/8
DanWin Dec 8, 2024
2d7f21f
Add Non-Qubes-Whonix-Gateway IP to qubes destinations
DanWin Dec 8, 2024
1183916
Add missing network to LOCAL_NET_IP6
DanWin Dec 8, 2024
b74c956
Fix systemcheck_user rule
DanWin Dec 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
92 changes: 84 additions & 8 deletions usr/bin/whonix-gateway-firewall
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,26 @@ variables_defaults() {
fi
fi

if [ -z "${NON_TOR_GATEWAY_IP6:-}" ]; then
if test -f /usr/share/qubes/marker-vm; then
NON_TOR_GATEWAY_IP6=""
else
## 10.0.2.2/24: VirtualBox DHCP
## IP HARDCODED. If you want to change IP, set variable GATEWAY_IP through a
## drop-in configuration snippet in /etc/whonix_firewall.d
## configuration folder instead.
NON_TOR_GATEWAY_IP6="\
::1/128 \
fd19:c33d:88bc::0/96 \
::ffff:127.0.0.0/120 \
Comment thread
DanWin marked this conversation as resolved.
Outdated
::ffff:192.168.0.0/120 \
::ffff:192.168.1.0/120 \
::ffff:10.152.152.0/120 \
::ffff:10.0.2.2/120 \
"
fi
fi

## Destinations you do not routed through VPN, only for Whonix-Gateway.
if [ -z "${LOCAL_NET:-}" ]; then
if test -f /usr/share/qubes/marker-vm; then
Expand All @@ -139,6 +159,35 @@ variables_defaults() {
fi
fi


## Destinations you do not routed through VPN, only for Whonix-Gateway.
if [ -z "${LOCAL_NET_IP6:-}" ]; then
if test -f /usr/share/qubes/marker-vm; then
LOCAL_NET_IP6="\
::1/128 \
fd09:24ef:4179::a8a:/112 \
fd09:24ef:4179::a89:/112 \
Comment thread
DanWin marked this conversation as resolved.
::ffff:127.0.0.0/120 \
::ffff:10.137.0.0/112 \
::ffff:10.138.0.0/112 \
"
else
## 10.0.2.2/24: VirtualBox DHCP
## IP HARDCODED. If you want to change IP, set variable GATEWAY_IP through a
## drop-in configuration snippet in /etc/whonix_firewall.d
## configuration folder instead.
LOCAL_NET_IP6="\
::1/128 \
fd19:c33d:88bc::0/96 \
::ffff:127.0.0.0/120 \
::ffff:192.168.0.0/120 \
::ffff:192.168.1.0/120 \
::ffff:10.152.152.0/120 \
::ffff:10.0.2.2/120 \
"
fi
fi

if [ -z "${WORKSTATION_DEST_SOCKSIFIED:-}" ]; then
## 10.152.152.10 - Non-Qubes-Whonix-Gateway IP
##
Expand All @@ -153,7 +202,27 @@ variables_defaults() {
10.138.0.0/16 \
10.152.152.10 \
"
else
## Non-Qubes-Whonix:
## IP HARDCODED. If you want to change IP, set variable GATEWAY_IP through a
## drop-in configuration snippet in /etc/whonix_firewall.d
## configuration folder instead.
WORKSTATION_DEST_SOCKSIFIED="10.152.152.10"
fi
fi

if [ -z "${WORKSTATION_DEST_SOCKSIFIED_IPV6:-}" ]; then
## 10.152.152.10 - Non-Qubes-Whonix-Gateway IP
##
## fd09:24ef:4179::a89/112 - persistent Qubes-Whonix-Gateway IP range
## fd09:24ef:4179::a8a/112 - DispVM Qubes-Whonix-Gateway IP range
Comment on lines +217 to +218

@ArrayBolt3 ArrayBolt3 Mar 28, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
## fd09:24ef:4179::a89/112 - persistent Qubes-Whonix-Gateway IP range
## fd09:24ef:4179::a8a/112 - DispVM Qubes-Whonix-Gateway IP range
## fd09:24ef:4179::a89:/112 - persistent Qubes-Whonix-Gateway IP range
## fd09:24ef:4179::a8a:/112 - DispVM Qubes-Whonix-Gateway IP range

@ArrayBolt3 ArrayBolt3 Sep 14, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixing post-merge.

if test -f /usr/share/qubes/marker-vm; then
## https://forums.whonix.org/t/whonix-gateway-not-reachable/7484/16
## Qubes-Whonix:
## IP HARDCODED. IP 10.152.152.10 is hardcoded in some places.
WORKSTATION_DEST_SOCKSIFIED_IPV6="\
Comment thread
DanWin marked this conversation as resolved.
fd09:24ef:4179::a8a:/112 \
fd09:24ef:4179::a89:/112 \
::ffff:10.137.0.0/112 \
::ffff:10.139.0.0/112 \
::ffff:10.152.152.10 \
Expand All @@ -163,8 +232,7 @@ variables_defaults() {
## IP HARDCODED. If you want to change IP, set variable GATEWAY_IP through a
## drop-in configuration snippet in /etc/whonix_firewall.d
## configuration folder instead.
WORKSTATION_DEST_SOCKSIFIED="10.152.152.10"
WORKSTATION_DEST_SOCKSIFIED_IPV6="::ffff:10.152.152.10"
WORKSTATION_DEST_SOCKSIFIED_IPV6="fd19:c33d:88bc::10"
fi
fi
}
Expand Down Expand Up @@ -242,8 +310,9 @@ nft_output() {
local non_tor_gateway_item
for non_tor_gateway_item in $NON_TOR_GATEWAY; do
$nftables_cmd add rule inet nat output ip daddr "$non_tor_gateway_item" counter return
$nftables_cmd add rule inet nat output ip6 daddr "::ffff:$non_tor_gateway_item" counter return
## TODO: IPv6 test
done
for non_tor_gateway_item in $NON_TOR_GATEWAY_IP6; do
$nftables_cmd add rule inet nat output ip6 daddr "$non_tor_gateway_item" counter return
done
fi

Expand All @@ -257,6 +326,9 @@ nft_output() {
## Existing connections are accepted.
$nftables_cmd add rule inet filter output ct state established counter accept

# Accept ICMPv6 neighbor discovery.
$nftables_cmd add rule inet filter output icmpv6 type "{ nd-neighbor-solicit, nd-neighbor-advert }" counter accept

if [ "$firewall_mode" = "full" ]; then
## Accept outgoing connections to local network, Whonix-Workstation and VirtualBox,
## unless VPN_FIREWALL mode is enabled.
Expand All @@ -265,8 +337,9 @@ nft_output() {
local non_tor_gateway_item
for non_tor_gateway_item in $NON_TOR_GATEWAY; do
$nftables_cmd add rule inet filter output ip daddr "$non_tor_gateway_item" counter accept
$nftables_cmd add rule inet filter output ip6 daddr "::ffff:$non_tor_gateway_item" counter accept
## TODO: IPv6 test
done
for non_tor_gateway_item in $NON_TOR_GATEWAY_IP6; do
$nftables_cmd add rule inet filter output ip6 daddr "$non_tor_gateway_item" counter accept
done
fi
fi
Expand All @@ -279,8 +352,9 @@ nft_output() {
local local_net_item
for local_net_item in $LOCAL_NET; do
$nftables_cmd add rule inet filter output ip daddr "$local_net_item" counter accept
$nftables_cmd add rule inet filter output ip6 daddr "::ffff:$local_net_item" counter accept
## TODO: IPv6 test
done
for local_net_item in $LOCAL_NET_IP6; do
$nftables_cmd add rule inet filter output ip6 daddr "$local_net_item" counter accept
done
fi
fi
Expand Down Expand Up @@ -369,7 +443,9 @@ INTERNAL_OPEN_PORTS
INT_IF
INT_TIF
LOCAL_NET
LOCAL_NET_IP6
NON_TOR_GATEWAY
NON_TOR_GATEWAY_IP6
NO_NAT_USERS
NO_REJECT_INVALID_OUTGOING_PACKAGES
OR_PORT
Expand Down
7 changes: 6 additions & 1 deletion usr/bin/whonix-host-firewall
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,15 @@ variables_defaults(){

## 10.0.2.2/24: VirtualBox DHCP
[ -n "${NON_TOR_GATEWAY:-}" ] || NON_TOR_GATEWAY="192.168.1.0/24 192.168.0.0/24 127.0.0.0/8 10.152.152.0/24 10.0.2.2/24"
[ -n "${NON_TOR_GATEWAY_IP6:-}" ] || NON_TOR_GATEWAY_IP6="::1/128 fd19:c33d:88bc::0/96 ::ffff:192.168.1.0/120 ::ffff:192.168.0.0/120 ::ffff:127.0.0.0/104 ::ffff:10.152.152.0/120 ::ffff:10.0.2.2/120"

## Space separated list of VPN servers, which Whonix-Gateway is allowed to connect to.
[ -n "${VPN_SERVERS:-}" ] || VPN_SERVERS="198.252.153.26"

## Destinations you do not routed through VPN, only for Whonix-Gateway.
## 10.0.2.2/24: VirtualBox DHCP
[ -n "${LOCAL_NET:-}" ] || LOCAL_NET="192.168.1.0/24 192.168.0.0/24 127.0.0.0/8 10.152.152.0/24 10.0.2.2/24"
[ -n "${LOCAL_NET_IP6:-}" ] || LOCAL_NET_IP6="::1/128 fd19:c33d:88bc::0/96 ::ffff:192.168.1.0/120 ::ffff:192.168.0.0/120 ::ffff:127.0.0.0/104 ::ffff:10.152.152.0/120 ::ffff:10.0.2.2/120"

[ -n "${GATEWAY_ALLOW_INCOMING_RELATED_STATE:-}" ] || GATEWAY_ALLOW_INCOMING_RELATED_STATE=""
[ -n "${GATEWAY_ALLOW_INCOMING_ICMP:-}" ] || GATEWAY_ALLOW_INCOMING_ICMP=0
Expand Down Expand Up @@ -90,7 +92,7 @@ nft_output(){
## when VPN_FIREWALL mode is enabled.
## DISABLED BY DEFAULT.
for SERVER in $VPN_SERVERS; do
$nftables_cmd add rule inet filter output ip daddr "$SERVER" counter jump accept
$nftables_cmd add rule inet filter output inet daddr "$SERVER" counter jump accept
done
else
## Accept outgoing connections to local network, Whonix-Workstation and VirtualBox,
Expand All @@ -99,6 +101,9 @@ nft_output(){
for NET in $NON_TOR_GATEWAY; do
$nftables_cmd add rule inet filter output ip daddr "$NET" counter jump accept
done
for NET in $NON_TOR_GATEWAY_IP6; do
$nftables_cmd add rule inet filter output ip6 daddr "$NET" counter jump accept
done
fi

## clearnet user is allowed to connect any outside target.
Expand Down
75 changes: 52 additions & 23 deletions usr/bin/whonix-workstation-firewall
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,18 +39,21 @@ variables_defaults() {
## Would fail if netvm is set to 'none',
## which is the case in Qubes R4 TemplateVMs.
[ -n "${GATEWAY_IP:-}" ] || GATEWAY_IP="$(qubesdb-read /qubes-gateway 2> /dev/null)" || GATEWAY_IP="127.0.0.1"
[ -n "${GATEWAY_IP6:-}" ] || GATEWAY_IP6="::ffff:$(qubesdb-read /qubes-gateway6 2> /dev/null)" || GATEWAY_IP6="::1"

@ArrayBolt3 ArrayBolt3 Mar 28, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe I misunderstood something, but I was under the impression that the /qubes-gateway6 qubesdb entry contained an IPv6 address. This looks like it's being used as an IPv4 address though.

@ArrayBolt3 ArrayBolt3 Sep 14, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on https://github.com/QubesOS/qubes-doc/blob/d9a6e20f3a1ad3ca5215059267df099bfecc6728/user/advanced-topics/standalones-and-hvms.rst?plain=1#L258 it does look like /qubes-gateway6 is a real IPv6 address. Adjusting accordingly.

else
## IP HARDCODED. If you want to change IP, set variable GATEWAY_IP through a
## drop-in configuration snippet in /etc/whonix_firewall.d
## configuration folder instead.
[ -n "${GATEWAY_IP:-}" ] || GATEWAY_IP="10.152.152.10"
[ -n "${GATEWAY_IP6:-}" ] || GATEWAY_IP6="fd19:c33d:88bc::10"
fi

## Since hardcoded in anon-ws-disable-stacked-tor.
## IP HARDCODED. If you want to change IP, set variable GATEWAY_IP through a
## drop-in configuration snippet in /etc/whonix_firewall.d
## configuration folder instead.
[ -n "${GATEWAY_IP_HARDCODED:-}" ] || GATEWAY_IP_HARDCODED="10.152.152.10"
[ -n "${GATEWAY_IP6_HARDCODED:-}" ] || GATEWAY_IP6_HARDCODED="fd19:c33d:88bc::10"

[ -n "${TUNNEL_FIREWALL_ALLOW_CONTROL_PORT_FILTER_PROXY:-}" ] || TUNNEL_FIREWALL_ALLOW_CONTROL_PORT_FILTER_PROXY=""
[ -n "${TUNNEL_FIREWALL_ALLOW_LOCAL_NET:-}" ] || TUNNEL_FIREWALL_ALLOW_LOCAL_NET=""
Expand Down Expand Up @@ -80,6 +83,30 @@ variables_defaults() {
fi
fi

if [ -z "${LOCAL_NET_IP6:-}" ]; then
if test -f /usr/share/qubes/marker-vm; then
LOCAL_NET_IP6="\
::1/128 \
fd09:24ef:4179::a8a:/112 \
fd09:24ef:4179::a89:/112 \
::ffff:127.0.0.0/120 \
::ffff:10.137.0.0/112 \
::ffff:10.138.0.0/112 \
"
else
## 10.0.2.2/24: VirtualBox DHCP
## IP HARDCODED unfortunately. Use a /etc/whonix_firewall.d configuration folder drop-in if you want to change it.
LOCAL_NET_IP6="\
::1/128 \
Comment thread
DanWin marked this conversation as resolved.
::ffff:127.0.0.0/120 \
::ffff:192.168.0.0/120 \
::ffff:192.168.1.0/120 \
::ffff:10.152.152.0/120 \
::ffff:10.0.2.2/120 \
"
fi
fi

}

nft_defaults() {
Expand Down Expand Up @@ -145,6 +172,9 @@ nft_input_rules() {
## Established incoming connections are accepted.
$nftables_cmd add rule inet filter input ct state established counter accept

# Accept ICMPv6 neighbor discovery.
$nftables_cmd add rule inet filter input icmpv6 type "{ nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect }" counter accept

## Allow all incoming connections on the virtual VPN network interface,
## when TUNNEL_FIREWALL_ENABLE mode is enabled.
## DISABLED BY DEFAULT.
Expand Down Expand Up @@ -246,10 +276,9 @@ nft_output() {
$nftables_cmd add rule inet filter output skuid "$SDWDATE_USER" ip daddr 127.0.0.1 counter accept
$nftables_cmd add rule inet filter output skuid "$SDWDATE_USER" ip6 daddr ::1 counter accept
$nftables_cmd add rule inet filter output skuid "$SDWDATE_USER" ip daddr "$GATEWAY_IP" counter accept
$nftables_cmd add rule inet filter output skuid "$SDWDATE_USER" ip6 daddr "::ffff:$GATEWAY_IP" counter accept
$nftables_cmd add rule inet filter output skuid "$SDWDATE_USER" ip6 daddr "$GATEWAY_IP6" counter accept
$nftables_cmd add rule inet filter output skuid "$SDWDATE_USER" ip daddr "$GATEWAY_IP_HARDCODED" counter accept
$nftables_cmd add rule inet filter output skuid "$SDWDATE_USER" ip6 daddr "::ffff:$GATEWAY_IP_HARDCODED" counter accept
## TODO: IPv6 test
$nftables_cmd add rule inet filter output skuid "$SDWDATE_USER" ip6 daddr "$GATEWAY_IP6_HARDCODED" counter accept
fi
fi

Expand All @@ -258,10 +287,9 @@ nft_output() {
$nftables_cmd add rule inet filter output skuid "$NOTUNNEL_USER" ip daddr 127.0.0.1 counter accept
$nftables_cmd add rule inet filter output skuid "$NOTUNNEL_USER" ip6 daddr ::1 counter accept
$nftables_cmd add rule inet filter output skuid "$NOTUNNEL_USER" ip daddr "$GATEWAY_IP" counter accept
$nftables_cmd add rule inet filter output skuid "$NOTUNNEL_USER" ip6 daddr "::ffff:$GATEWAY_IP" counter accept
$nftables_cmd add rule inet filter output skuid "$NOTUNNEL_USER" ip6 daddr "$GATEWAY_IP6" counter accept
$nftables_cmd add rule inet filter output skuid "$NOTUNNEL_USER" ip daddr "$GATEWAY_IP_HARDCODED" counter accept
$nftables_cmd add rule inet filter output skuid "$NOTUNNEL_USER" ip6 daddr "::ffff:$GATEWAY_IP_HARDCODED" counter accept
## TODO: IPv6 test
$nftables_cmd add rule inet filter output skuid "$NOTUNNEL_USER" ip6 daddr "$GATEWAY_IP6_HARDCODED" counter accept
fi
fi

Expand All @@ -273,8 +301,9 @@ nft_output() {
local local_net_item
for local_net_item in $LOCAL_NET; do
$nftables_cmd add rule inet filter output ip daddr "$local_net_item" counter accept
$nftables_cmd add rule inet filter output ip6 daddr "::ffff:$local_net_item" counter accept
## TODO: IPv6 test
done
for local_net_item in $LOCAL_NET_IP6; do
$nftables_cmd add rule inet filter output ip6 daddr "$local_net_item" counter accept
done
fi
fi
Expand All @@ -283,10 +312,9 @@ nft_output() {
$nftables_cmd add rule inet filter output ip daddr 127.0.0.1 tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
$nftables_cmd add rule inet filter output ip6 daddr ::1 tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
$nftables_cmd add rule inet filter output ip daddr "$GATEWAY_IP" tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
$nftables_cmd add rule inet filter output ip6 daddr "::ffff:$GATEWAY_IP" tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
$nftables_cmd add rule inet filter output ip6 daddr "$GATEWAY_IP6" tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
$nftables_cmd add rule inet filter output ip daddr "$GATEWAY_IP_HARDCODED" tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
$nftables_cmd add rule inet filter output ip6 daddr "::ffff:$GATEWAY_IP_HARDCODED" tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
## TODO: IPv6 test
$nftables_cmd add rule inet filter output ip6 daddr "$GATEWAY_IP6_HARDCODED" tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
fi

if [ "$TUNNEL_FIREWALL_ALLOW_TB_UPDATER" = "true" ]; then
Expand All @@ -295,10 +323,9 @@ nft_output() {
else
## SOCKS_PORT_TBB_DOWNLOAD
$nftables_cmd add rule inet filter output ip daddr "$GATEWAY_IP" tcp dport 9115 counter accept
$nftables_cmd add rule inet filter output ip6 daddr "::ffff:$GATEWAY_IP" tcp dport 9115 counter accept
$nftables_cmd add rule inet filter output ip6 daddr "$GATEWAY_IP6" tcp dport 9115 counter accept
$nftables_cmd add rule inet filter output ip daddr "$GATEWAY_IP_HARDCODED" tcp dport 9115 counter accept
$nftables_cmd add rule inet filter output ip6 daddr "::ffff:$GATEWAY_IP_HARDCODED" tcp dport 9115 counter accept
## TODO: IPv6 test
$nftables_cmd add rule inet filter output ip6 daddr "$GATEWAY_IP6_HARDCODED" tcp dport 9115 counter accept
fi
fi

Expand All @@ -309,7 +336,9 @@ nft_output() {
if [ -n "$SYSTEMCHECK_USER" ]; then
$nftables_cmd add rule inet filter output skuid "$SYSTEMCHECK_USER" inet daddr 127.0.0.1 counter accept
Comment thread
DanWin marked this conversation as resolved.
Outdated
$nftables_cmd add rule inet filter output skuid "$SYSTEMCHECK_USER" inet daddr "$GATEWAY_IP" counter accept
$nftables_cmd add rule inet filter output skuid "$SYSTEMCHECK_USER" inet daddr "$GATEWAY_IP6" counter accept
$nftables_cmd add rule inet filter output skuid "$SYSTEMCHECK_USER" inet daddr "$GATEWAY_IP_HARDCODED" counter accept
$nftables_cmd add rule inet filter output skuid "$SYSTEMCHECK_USER" inet daddr "$GATEWAY_IP6_HARDCODED" counter accept
fi
fi
fi
Expand All @@ -320,10 +349,9 @@ nft_output() {
true "firewall_mode is $firewall_mode, therefore allowing DNS traffic."
## Allow Whonix-Workstation to query Whonix-Gateway for DNS.
$nftables_cmd add rule inet filter output ip daddr "$GATEWAY_IP" udp dport 53 counter accept
$nftables_cmd add rule inet filter output ip6 daddr "::ffff:$GATEWAY_IP" udp dport 53 counter accept
$nftables_cmd add rule inet filter output ip6 daddr "$GATEWAY_IP6" udp dport 53 counter accept
$nftables_cmd add rule inet filter output ip daddr "$GATEWAY_IP_HARDCODED" udp dport 53 counter accept
$nftables_cmd add rule inet filter output ip6 daddr "::ffff:$GATEWAY_IP_HARDCODED" udp dport 53 counter accept
## TODO: IPv6 test
$nftables_cmd add rule inet filter output ip6 daddr "$GATEWAY_IP6_HARDCODED" udp dport 53 counter accept
if test -f /usr/share/qubes/marker-vm; then
qubes_dns
fi
Expand Down Expand Up @@ -365,19 +393,17 @@ nft_output() {
$nftables_cmd add rule inet filter output skuid "$allowed_user_list_item" ip daddr 127.0.0.1 counter accept
$nftables_cmd add rule inet filter output skuid "$allowed_user_list_item" ip6 daddr ::1 counter accept
$nftables_cmd add rule inet filter output skuid "$allowed_user_list_item" ip daddr "$GATEWAY_IP" counter accept
$nftables_cmd add rule inet filter output skuid "$allowed_user_list_item" ip6 daddr "::ffff:$GATEWAY_IP" counter accept
$nftables_cmd add rule inet filter output skuid "$allowed_user_list_item" ip6 daddr "$GATEWAY_IP6" counter accept
$nftables_cmd add rule inet filter output skuid "$allowed_user_list_item" ip daddr "$GATEWAY_IP_HARDCODED" counter accept
$nftables_cmd add rule inet filter output skuid "$allowed_user_list_item" ip6 daddr "::ffff:$GATEWAY_IP_HARDCODED" counter accept
## TODO: IPv6 test
$nftables_cmd add rule inet filter output skuid "$allowed_user_list_item" ip6 daddr "$GATEWAY_IP6_HARDCODED" counter accept
done

$nftables_cmd add rule inet filter output ip daddr 127.0.0.1 tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
$nftables_cmd add rule inet filter output ip6 daddr ::1 tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
$nftables_cmd add rule inet filter output ip daddr "$GATEWAY_IP" tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
$nftables_cmd add rule inet filter output ip6 daddr "::ffff:$GATEWAY_IP" tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
$nftables_cmd add rule inet filter output ip6 daddr "$GATEWAY_IP6" tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
$nftables_cmd add rule inet filter output ip daddr "$GATEWAY_IP_HARDCODED" tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
$nftables_cmd add rule inet filter output ip6 daddr "::ffff:$GATEWAY_IP_HARDCODED" tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
## TODO: IPv6 test
$nftables_cmd add rule inet filter output ip6 daddr "$GATEWAY_IP6_HARDCODED" tcp dport "$CONTROL_PORT_FILTER_PROXY_PORT" counter accept
else
if [ -z "$outgoing_allow_ip_list" ]; then
true "firewall_mode is $firewall_mode and outgoing_allow_ip_list is empty, therefore allowing all outgoing traffic."
Expand Down Expand Up @@ -408,10 +434,13 @@ EXTERNAL_OPEN_PORTS
EXTERNAL_UDP_OPEN_PORTS
EXT_IF
GATEWAY_IP
GATEWAY_IP6
GATEWAY_IP_HARDCODED
GATEWAY_IP6_HARDCODED
INTERNAL_OPEN_PORTS
INT_IF
LOCAL_NET
LOCAL_NET_IP6
NOTUNNEL_USER
NO_REJECT_INVALID_OUTGOING_PACKAGES
SDWDATE_USER
Expand Down
4 changes: 3 additions & 1 deletion usr/libexec/whonix-firewall/firewall-common
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -353,13 +353,15 @@ nft_input_rules_gateway() {
$nftables_cmd add rule inet filter input icmp type destination-unreachable icmp code frag-needed ct state related counter accept
fi

# Accept ICMPv6 neighbor discovery.
$nftables_cmd add rule inet filter input icmpv6 type "{ nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect }" counter accept

## Drop all incoming ICMP traffic by default.
## All incoming connections are dropped by default anyway, but should a user
## allow incoming ports (such as for incoming SSH or FlashProxy), ICMP should
## still be dropped to filter for example ICMP time stamp requests.
if [ ! "$GATEWAY_ALLOW_INCOMING_ICMP" = "1" ]; then
$nftables_cmd add rule inet filter input ip protocol icmp counter drop
## TODO: IPv6 test
$nftables_cmd add rule inet filter input ip6 nexthdr icmpv6 counter drop
fi

Expand Down