<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><p data-start="134" data-end="137" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Hi,</p><p data-start="139" data-end="293" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">I\u2019m running a single-node NGCP system on <strong data-start="180" data-end="194">mr13.2.1.3</strong> with both IPv4 and IPv6 enabled (A and AAAA records), using the ngcp <span data-start="259" data-end="292">built-in firewall integration</span>.</p><p data-start="295" data-end="371" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">I\u2019m applying patchtt templates to <code data-start="334" data-end="348"><font face="Helvetica">rules.v4.tt2</font></code> and <code data-start="353" data-end="367"><font face="Helvetica">rules.v6.tt2</font></code> to:</p><p data-start="295" data-end="371" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">- Close Admin Portal / Customer Portal / LDAP, and XMPP.</p><p data-start="295" data-end="371" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">- SIP and RTP remain open</p><p data-start="295" data-end="371" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">- SSH remains restricted to IPs listed on the corresponding config.yml variable.</p><p data-start="295" data-end="371" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">- ICMP and all else remains as-is.</p><p data-start="295" data-end="371" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">SIP/RTP over IPv4 and IPv6 works and rtpengine seems fine (daemon is running, <code data-start="625" data-end="639">xt_RTPENGINE</code> is loaded, SDP shows <code data-start="661" data-end="676">a=oldmediaip:</code> and the <code data-start="685" data-end="696">rtpengine</code> chains\u2019 counters increase).</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">However, when I dump the rules via iptables/nft, I see this on IPv6:</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">table ip6 filter {</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> chain INPUT {</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> type filter hook input priority filter; policy drop;</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> ip6 nexthdr udp jump rtpengine</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> iifname "lo" accept</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> ct state related,established accept</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> meta l4proto ipv6-icmp accept</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> ...</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> iifname "eth0" udp dport 5060 accept</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> iifname "eth0" tcp dport 5060 accept</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> iifname "eth0" tcp dport 5061 accept</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">:XT target RTPENGINE not found</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> iifname "eth0" udp dport 30000-44999 accept</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> ...</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> }</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br></p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> chain rtpengine {</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> counter packets X bytes Y</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> }</p><p data-start="726" data-end="794" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">}</p><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">A</span><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">nd running </span><code data-start="1380" data-end="1395" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><font face="Helvetica">iptables-save</font></code><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> fails with:</span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br></span></div><div><div>Error: target extension not found</div><div>iptables-save (nf_tables): Parsing nftables rule failed</div><div>Perhaps iptables-save or your kernel needs to be upgraded.</div></div><div><br></div><div><p data-start="1571" data-end="1584" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">My questions:</p><ol data-start="1586" data-end="2057" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><li data-start="1586" data-end="1813"><p data-start="1589" data-end="1813">Is the \u201c:XT target RTPENGINE not found\u201d line in the ip6<font face="Helvetica"> </font>table expected/harmless when using the NGCP firewall + rtpengine on mr13.2.1.3, or does it indicate a partially translated RTPENGINE rule that should be fixed?</p></li><li data-start="1815" data-end="2057"><p data-start="1818" data-end="2057">Are there any known caveats or recommended adjustments for rtpengine + the integrated firewall (especially on IPv6) when applying minimal hardening patches like this that only touch web/API/XMPP/admin rules, but leave SIP/RTP rules intact?</p></li></ol><p data-start="2059" data-end="2222" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">If needed I can provide the <font face="Helvetica"><code data-start="2093" data-end="2115"><font face="Helvetica">rules.v4.patchtt.tt2</font></code> / <code data-start="2118" data-end="2140"><font face="Helvetica">rules.v6.patchtt.tt2</font></code></font> diffs, but I wanted to check first if this behavior is already known or expected.</p><p data-start="2224" data-end="2239" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Thanks,<br data-start="2231" data-end="2234">Cesar</p></div></body></html>