IPv6 working, but not through VPN due to IPv6_rpfilter setting in firewalld

English Network/Internet
1

Backstory
For a couple of months or so I wasn’t able to get any IPv6 connections through ProtonVPN anymore, despite confirming that the server I connected to supports it. After some debugging I gave up and just stopped using a VPN for a while since this broke some WireGuard tunnels which for whatever reason only works with IPv6 endpoints.

Result
I suppose at some point IPv6_rpfilter for firewalld was set to strict (probably through an update), which (if I understand correctly) blocks the responses over IPv6 due to some check mismatch. Regardless, the solution for me was the following:

sudo sed -i 's/IPv6_rpfilter=.*/IPv6_rpfilter=loose/' /etc/firewalld/firewalld.conf
sudo systemctl restart firewalld

Hopefully this helps someone out there, and if there’s anything I’ve misunderstood maybe it’ll be cleared up here.

2 Likes
2

Thanks,

I’ve been trying to use ProtonVPN with wireguard but I could never make it work with ipv6 even with the config files/servers that ProtonVPN says should work

BTW, how did you find out about this?

3

Might not be a popular answer, but after the third time trying with Brave’s LLM (through Brave Search) it finally identified that specific issue citing this bug report.

The first time I tried the LLM I got nowhere. Then a month or something later I tried again without luck. And today it finally got there. This was definitely not the most productive route to figuring it out though. It’s such an easy tool to lazily depend on and waste time with.

4

That’s an interesting rabbit hole to fall through. Thanks for sharing the solution. It also worked for me.

1 Like
5

To be fair, it probably didn’t help that I refused to accept any firewall issues the first two times since I considered it ruled out due to the fact IPv6 would work without the VPN.

6

Good find!

I was wondering why this issue is still open and not solved yet. This Fedora page sheds some light on that.

So the IPv4 the rpfilter setting is already set to loose by default so a default IPv6_rpfilter=loose makes also sense.

7

I have still yet found a single thing firewalld does better than anything else.

It can imho be replaced by the simplest nftables setup similar to how all other firewalls default; Deny IN except established or loopback allow out. Because the user-facing abstraction it provides as firewall-cmd is the worst cli I’ve ever used for firewalls - it lacks basic getters for absolutely anything and makes everything harder than it initially was in nftables…

There’s probably a legit and sound reason - but man… I say this very rarely when systemd obsoletes userspace software;

… but with firewalld and nm its a very welcome change imho - cuz both of them suffer from absolutely wild out-there cli’s that bring little benefits to its enormous abstraction wasting time and adding abstraction load needlessly on the most basic daily function.

1 Like