github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2482] netfilter6 default #1625

New issue

Open

opened 2026-05-05 08:16:43 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 08:16:43 -06:00

Owner

Originally created by @smitsohu on GitHub (Feb 26, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2482

Currrently we have a default ipv4 firewall for new network namespaces (netfilter), but no companion for ipv6. Probably it would be good if the netfilter6 option had a default and was added to all profiles that have netfilter already.

Once in place, there could be also a toggle in firefail.config to optionally enforce these firewalls for all new network namespaces. One could even contemplate whether to turn this on by default.

Originally created by @smitsohu on GitHub (Feb 26, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2482 Currrently we have a default ipv4 firewall for new network namespaces (`netfilter`), but no companion for ipv6. Probably it would be good if the `netfilter6` option had a default and was added to all profiles that have `netfilter` already. Once in place, there could be also a toggle in firefail.config to optionally enforce these firewalls for all new network namespaces. One could even contemplate whether to turn this on by default.

gitea-mirror added the

enhancement

networking

labels 2026-05-05 08:16:43 -06:00

gitea-mirror commented

2026-05-05 08:16:45 -06:00

Author

Owner

@FOSSONLY commented on GitHub (Feb 27, 2019):

I would also suggest the same for NFtables, they will replace the outdated IPtables. Btw.: In Debian-Buster NFtables will be the new Standard.

@FOSSONLY commented on GitHub (Feb 27, 2019): I would also suggest the same for NFtables, they will replace the outdated IPtables. Btw.: In Debian-Buster NFtables will be the new Standard.

gitea-mirror commented

2026-05-05 08:16:46 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 28, 2019):

netfilter6

Let's go for it. Anybody has some experience with IPv6? Adding it to the code and making it default should be pretty easy. The problem is I have no idea how to set an IPv6 filter.

NFtables

I'll start working on it and pass a patch file to @reinerh to add it to Debian version once it is released, or even earlier, depending how it goes.

@netblue30 commented on GitHub (Feb 28, 2019): > netfilter6 Let's go for it. Anybody has some experience with IPv6? Adding it to the code and making it default should be pretty easy. The problem is I have no idea how to set an IPv6 filter. > NFtables I'll start working on it and pass a patch file to @reinerh to add it to Debian version once it is released, or even earlier, depending how it goes. NF

gitea-mirror commented

2026-05-05 08:16:47 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Feb 28, 2019):

https://gist.github.com/jirutka/3742890 has a lot of good commented (iptables) examples for both IPv4 and IPv6, licensed MIT.

@SkewedZeppelin commented on GitHub (Feb 28, 2019): https://gist.github.com/jirutka/3742890 has a lot of good commented (iptables) examples for both IPv4 and IPv6, licensed MIT.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1625

No description provided.

Rows
Columns