It seems that IPv6 traffic on my router is being dropped.How do I configure ip6tables appropriately, so that traffic is forwarded/accepted to my machine?Here's the syslog for my IPv6 traffic:Jun 29 18:44:52 kernel: DROP IN=eth3 OUT=br0 MAC=MAC_ADDR_1 SRC=2002:xxxx:ba3d:0000:0000:0000:74ca:ba3d DST=My_IPv6_IP_ADDR LEN=68 TC=0 HOPLIMIT=119 FLOWLBL=0 PROTO=TCP SPT=58154 DPT=63282 SEQ=3810938415 ACK=0 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020404C401010402) Jun 29 18:44:52 kernel: DROP IN=eth3 OUT=br0 MAC=MAC_ADDR_1 SRC=2002:xxxx:ba3d:0000:0000:0000:74ca:ba3d DST=My_IPv6_IP_ADDR LEN=78 TC=0 HOPLIMIT=119 FLOWLBL=0 PROTO=UDP SPT=28798 DPT=63282 LEN=38 Jun 29 18:44:57 kernel: DROP IN=eth3 OUT=br0 MAC=MAC_ADDR_1 SRC=2001:xxxx:0008:e8ad:0000:0000:0000:0001 DST=My_IPv6_IP_ADDR LEN=80 TC=0 HOPLIMIT=50 FLOWLBL=0 PROTO=TCP SPT=40930 DPT=80 SEQ=2391968293 ACK=0 WINDOW=14400 RES=0x00 SYN URGP=0 OPT (020405A00402080A7E7DEFB80000000001030307) Jun 29 18:44:58 kernel: DROP IN=eth3 OUT=br0 MAC=MAC_ADDR_1 SRC=2001:xxxx:0008:e8ad:0000:0000:0000:0001 DST=My_IPv6_IP_ADDR LEN=80 TC=0 HOPLIMIT=50 FLOWLBL=0 PROTO=TCP SPT=40930 DPT=80 SEQ=2391968293 ACK=0 WINDOW=14400 RES=0x00 SYN URGP=0 OPT (020405A00402080A7E7DF0B20000000001030307) Jun 29 18:44:59 kernel: DROP IN=eth3 OUT=br0 MAC=MAC_ADDR_1 SRC=2a02:xxxx:c310:a5a0:81eb:84c7:22af:7539 DST=My_IPv6_IP_ADDR LEN=72 TC=0 HOPLIMIT=43 FLOWLBL=0 PROTO=TCP SPT=58249 DPT=63282 SEQ=1653524828 ACK=0 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405A00103030801010402) Jun 29 18:44:59 kernel: DROP IN=eth3 OUT=br0 MAC=MAC_ADDR_1 SRC=2a02:xxxx:c310:a5a0:81eb:84c7:22af:7539 DST=My_IPv6_IP_ADDR LEN=78 TC=0 HOPLIMIT=43 FLOWLBL=0 PROTO=UDP SPT=23103 DPT=63282 LEN=38 Jun 29 18:45:00 kernel: DROP IN=eth3 OUT=br0 MAC=MAC_ADDR_1 SRC=2001:xxxx:0008:e8ad:0000:0000:0000:0001 DST=My_IPv6_IP_ADDR LEN=80 TC=0 HOPLIMIT=50 FLOWLBL=0 PROTO=TCP SPT=40930 DPT=80 SEQ=2391968293 ACK=0 WINDOW=14400 RES=0x00 SYN URGP=0 OPT (020405A00402080A7E7DF2A70000000001030307) Jun 29 18:45:02 kernel: DROP IN=eth3 OUT=br0 MAC=MAC_ADDR_1 SRC=2a02:xxxx:c310:a5a0:81eb:84c7:22af:7539 DST=My_IPv6_IP_ADDR LEN=72 TC=0 HOPLIMIT=43 FLOWLBL=0 PROTO=TCP SPT=58249 DPT=63282 SEQ=1653524828 ACK=0 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405A00103030801010402) Jun 29 18:45:02 kernel: DROP IN=eth3 OUT=br0 MAC=MAC_ADDR_1 SRC=2a02:xxxx:c310:a5a0:81eb:84c7:22af:7539 DST=My_IPv6_IP_ADDR LEN=78 TC=0 HOPLIMIT=43 FLOWLBL=0 PROTO=UDP SPT=23103 DPT=63282 LEN=38 Jun 29 18:45:06 kernel: DROP IN=eth3 OUT=br0 MAC=MAC_ADDR_1 SRC=2601:xxxx:8380:06b8:5d87:46c7:7e85:08c9 DST=My_IPv6_IP_ADDR LEN=72 TC=0 HOPLIMIT=42 FLOWLBL=0 PROTO=TCP SPT=52362 DPT=63282 SEQ=3069346662 ACK=0 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405A00103030201010402) Jun 29 18:45:08 kernel: DROP IN=eth3 OUT=br0 MAC=MAC_ADDR_1 SRC=2a02:xxxx:c310:a5a0:81eb:84c7:22af:7539 DST=My_IPv6_IP_ADDR LEN=68 TC=0 HOPLIMIT=43 FLOWLBL=0 PROTO=TCP SPT=58249 DPT=63282 SEQ=1653524828 ACK=0 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405A001010402) Jun 29 18:45:09 kernel: DROP IN=eth3 OUT=br0 MAC=MAC_ADDR_1 SRC=2601:xxxx:8380:06b8:5d87:46c7:7e85:08c9 DST=My_IPv6_IP_ADDR LEN=72 TC=0 HOPLIMIT=42 FLOWLBL=0 PROTO=TCP SPT=52362 DPT=63282 SEQ=3069346662 ACK=0 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405A00103030201010402) Here is the contents of the router's ip6t_filter.default file:*filter:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]:maclist - [0:0]:bfplimit - [0:0]:logaccept - [0:0]:logdrop - [0:0]-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT-A INPUT -i lo -j ACCEPT-A INPUT -i br0 -j ACCEPT-A INPUT -p 58 ! --icmpv6-type echo-request -j ACCEPT-A INPUT -m state --state INVALID -j DROP-A INPUT -p udp --sport 547 --dport 546 -j ACCEPT-A INPUT -j DROP-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT-A FORWARD -i br0 -o br0 -j ACCEPT-A FORWARD -p 58 -j ACCEPT-A FORWARD -m state --state INVALID -j DROP-A FORWARD -o br0 -j DROP-A logaccept -m state --state NEW -j LOG --log-prefix ACCEPT  --log-tcp-sequence --log-tcp-options --log-ip-options-A logaccept -j ACCEPT-A logdrop -m state --state NEW -j LOG --log-prefix DROP  --log-tcp-sequence --log-tcp-options --log-ip-options-A logdrop -j DROPCOMMITHere's the br0 interface:br0       Link encap:Ethernet  HWaddr AA:BB:49:E3:62:8E          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0          inet6 addr: IPv6_1 Scope:Global          inet6 addr: fe80::e23f:49ff:fee3:628e/64 Scope:Link          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1          RX packets:2233491 errors:0 dropped:0 overruns:0 frame:0          TX packets:1930092 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:0          RX bytes:998010242 (951.7 MiB)  TX bytes:348204643 (332.0 MiB)Here's the eth3 interface:eth3      Link encap:Ethernet  HWaddr MAC_ADDR_1          inet addr:MyIPv4_HOST_ADDR  Bcast:X.Y.223.255  Mask:255.255.224.0          inet6 addr: IPv6_2 Scope:Global          inet6 addr: fe80::e23f:49ff:fee3:628d/64 Scope:Link          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1          RX packets:9909832 errors:0 dropped:0 overruns:0 frame:0          TX packets:15334176 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:1000          RX bytes:1243667320 (1.1 GiB)  TX bytes:19852159929 (18.4 GiB)
How do I enable IPv6 inbound traffic to get forwarded to my machine?
iptables;ip6tables
Your DROPs are all marked as TCP SYN.  SYN means a new TCP connection coming in from the outside world.  So to start with, the naive answer is-A FORWARD -m state --state NEW -j ACCEPTBut (since you have to ask) you don't actually want to do that.  You need something more 'appropriate'.Because someone will naively plug in a printer, NAS, Windows device with firewall set to Home aka private network.  Or any other device which provides a service on your network, which is what networks are for after all.  Then the Internet will pwn the printer or NAS, or tat around on files shared by the Windows device.  Sorry, security sucks.If you look for standards for consumer IPv6 routers (CPE), you'll find they mandate a stateful firewall like your router has.When you want to run a server, ideally you'd use a dedicated machine on a separate DMZ network.  I.e. a separated network port on the main router, that's not bridged onto your home LAN.  For example, if you want to host a blog, this provides a layer of protection for your PCs when someone finds a vulnerability in the blogging software.When you want to run some consumer-targeted device with abject security support[1] like a private cloud NAS, IP camera etc. connected straight to your LAN, it's worth looking at how this commonly works with IPv4.  They'll mostly use uPnP port forwarding[2], and if that fails they'll tell you to manually configure a port forward[3] on your router.  This is also how peer-to-peer filesharing like BitTorrent works.This can work the same in IPv6, except technically you're not forwarding the port, just unblocking it.  (The IP address people connect to will be the machine's IP, instead of the router's).uPnP port forwarding doesn't work for IPv6.  There's an equivalent called PCP (based on Apple's NAT-PMP for IPv4). I'm sure that'll get used for BitTorrent, but my uninformed guess is that's not relevant in your case.For manual port control (both v4/v6), you need to make sure you assign a fixed IP address to the device so you can identify it permanently.  Then you can[4]-A FORWARD -p tcp -d YOUR_MACHINE_IPV6_ADDRESS --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPTand the same for your port 63282, or whatever ports it is that you want to expose to the Internet.This keeps your firewall policy centralized on the router.  (If you unblocked all ports, you'd need to keep an eye on i) running services on the machine ii) the host firewall on the machine iii) the router still).Because your network is bridged I assume this will work even if your machine switches between wireless and wired interfaces of the router.  (Because it will work with the same IP address on either).[1] http://www.wired.com/2014/01/theres-no-good-way-to-patch-the-internet-of-things-and-thats-a-huge-problem/[2] http://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_traversal[3] http://en.wikipedia.org/wiki/Port_forwarding[4] Stolen^W Adapted from the IPv4 version at https://serverfault.com/questions/140622/how-can-i-port-forward-with-iptables