I am writing the iplock tool to help me setup my Linux firewall. For the most part, my current strategy, since I don't yet use IPv6 much, is to pretty block everything IPv6 ("simple").

I would like to switch all my public facing services to using IPv6. So for that to happen, I first need a good plan for my firewall.

I know I can map an IPv4 address inside an IPv6 address (in other words, IPv6 includes all IPv4 addresses). Here is how an IPv4 is mapped inside an IPv6:


What I'm wondering is whether such an IPv6 address is routed through the iptables rules (IPv4) or the ip6tables (IPv6)? Since it would come through an IPv6 address, it would make sense to run it through ip6tables, but at the same time, I think it should go through the iptables since that special IPv6 address is supposed to just be an encapsulation. I could not find anything about such in the iptables(8) and ip6tables(8) man pages.

  • 1
    lwn.net/Articles/688462 sysctl-explorer.net/net/ipv6/bindv6only Better check it youself by adding simple log rules via iptables and see is it match ipv4mappedipv6 and you will be 100% sure
    – gapsf
    Sep 18, 2022 at 11:06
  • @gapsf One problem with "testing myself" is, did I really test it correctly? I won't really ever be 100% sure... Anyway, that is my next solution indeed. Sep 18, 2022 at 18:11
  • Just add -I INPUT -j LOG to both iptables v4 and v6, send v6 packet with your ipv6ipv4 address (telnet, ping) and check logs. Thats all. You will see in logs entries for just v6 or both v4 and v6. Its 5 minutes to check
    – gapsf
    Sep 18, 2022 at 18:15
  • @gapsf I tried ping ::ffff:xxxx:xxxx and also ping 64:ff9b::xxxx:xxxx and nothing happens. It looks like my host doesn't find a route for those IPs. Just in case, I tried with ping -i eth1 ... and also ping6 ..., but that doesn't help. So I'm not sure how to send such packets. Maybe it's already forbidden on Linux (which would not prevent a hacker from doing such, though) or as I mentioned, it doesn't know where to send the packets because it can't determine a valid route. Sep 18, 2022 at 19:49

1 Answer 1


I found a comment here

You cannot use IPv4-mapped Addresses (::ffff:0:0/96) as source or destination addresses [...]

Those addresses are just used to allow for an IPv4 address to be defined within an IPv6. Both are distinct protocol so you cannot send IPv4 traffic over an IPv6 interface.

However, you can use NAT64 and allow an IPv6-only device to communicate with an IPv4-only device. But that's a different discussion altogether.

So the answer to the question is: sending a packet with an ::ffff:x.x.x.x address over IPv6 is not possible. There is no routing for those addresses so they fail. As a result, there is no way to receive such in either iptables or ip6tables.

To make 100% that you do not accept such invalid packets, you can safely DROP it with this rule:

ip6tables -A INPUT --source ::ffff:0:0/96 -j DROP

But it should never happen so there is probably no need to encumber your firewall.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .