Bug#682612: /sbin/ip6tables-multi: Cannot restore ip6tables, fails at Commit line

[Bart Dieterman]

Package: iptables
Version: 1.4.8-3
Severity: grave
File: /sbin/ip6tables-multi
Tags: security ipv6
Justification: user security hole


I have the following file /etc/ip6tables.firewall.rules

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m rt --rt-type 0 --rt-segsleft 0 -j DROP
-A FORWARD -m rt --rt-type 0 --rt-segsleft 0 -j DROP
-A OUTPUT -m rt --rt-type 0 --rt-segsleft 0 -j DROP
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 546 -d fe80::/64 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp6-port-unreachable
-A FORWARD -j REJECT --reject-with icmp6-port-unreachable
COMMIT

Then I run:
sudo ip6tables-restore < /etc/ip6tables.firewall.rules
And I get:
ip6tables-restore: line 18 failed

Any idea how to fix this?

-- System Information:
Debian Release: 6.0.5
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 2.6.32-042stab057.1 (SMP w/1 CPU core)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/bash

Versions of packages iptables depends on:
ii libc6 2.11.3-3 Embedded GNU C Library: Shared lib
ii libnfnetlink0 1.0.0-1 Netfilter netlink library

iptables recommends no packages.

iptables suggests no packages.

-- no debconf information


--
To UNSUBSCRIBE, email to debian-bugs-...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org

[Ulrich Dangel]

* Michael Stapelberg wrote [03.08.12 17:13]:
Hi Michael & Bart,
> In [1], womble notes that your OpenVZ provider might have disabled
> iptables. I think that's very likely the cause for your problem.
> [1] http://serverfault.com/questions/101022

I think this bug could be closed as it is probably not a Debian bug and
works for me in Sid as well as Squeeze.

cheers,
Ulrich