How to Allow IPV4 and IPv6 IP for any port restriction?

Bugs
1

Dear Team

Here is one of my configurations. I have set a restriction on the RDP port, allowing only client-end IPv4 static IPs.

Now, I need to allow client-end IPv6 static IPs as well. However, when I try to add the client-end IPv6 static IPs, it gives an error.

Do we have a solution to allow both IPv4 and IPv6 simultaneously?

set firewall ipv4 name FIREWALL_IN rule 30 action ‘accept’
set firewall ipv4 name FIREWALL_IN rule 30 description ‘wsrv150’
set firewall ipv4 name FIREWALL_IN rule 30 destination address ‘192.168.10.150’
set firewall ipv4 name FIREWALL_IN rule 30 destination port ‘3389’
set firewall ipv4 name FIREWALL_IN rule 30 log
set firewall ipv4 name FIREWALL_IN rule 30 protocol ‘tcp’
set nat destination rule 30 description ‘DNAT for wsrv150-ind - One To One’
set nat destination rule 30 destination address ‘115.169.125.150’
set nat destination rule 30 destination port ‘9296’
set nat destination rule 30 inbound-interface name eth1
set nat destination rule 30 protocol ‘tcp’
set nat destination rule 30 translation address ‘192.168.10.150’
set nat destination rule 30 translation port ‘3389’
set nat source rule 30 description ‘SNAT wsrv150’
set nat source rule 30 outbound-interface name ‘eth1’
set nat source rule 30 protocol ‘all’
set nat source rule 30 source address ‘192.168.10.150’
set nat source rule 30 translation address ‘115.169.125.150’

set firewall group address-group RDP-Restriction

set firewall group address-group RDP-Restriction address ‘104.25.176.24’

set firewall name FIREWALL_IN rule 30 source group address-group ‘RDP-Restriction’

2

You would probably need to make firewall ipv6 rules as well as NAT64 or NAT66 rules.

1 Like
3

You can allow both IPv4 and IPv6 by creating separate rules for each. Add the IPv6 addresses to a group like you did for IPv4, then set up parallel IPv6 firewall and NAT rules. VyOS treats IPv4 and IPv6 independently, so both need their own configurations.

4

Why i need to configure IPv6 on destination end where only IPv4 running , i just want to allow IPv6 on restriction , there is no sense to configure IPv6 address where only allow IPv6 IP address on restriction rule.