ALERT IPv6 Firewall Rules Patch

[wardmundy]

IPv6 Firewall Rule Patch

During our most recent security audit, we found a problem in the IPv6 firewall rules on the XiVO platform as well as Incredible PBX for Ubuntu, Debian, and Raspberry Pi platforms. While most are not yet using IPv6, we think it is worth fixing an inadvertent oversight in the existing IPv6 firewall rules. Installation scripts also have been modified accordingly.

Just run the following commands to update your server. We will also push this out through the Automatic Update Utility later this week:

sed -i 's|1024|9999|' /etc/iptables/rules.v6.ubuntu14
sed -i 's|1024|9999|' /etc/iptables/rules.v6
iptables-restart

 

[restamp]

I realize RedHat was not mentioned above, but strictly as an FYI, I was surprised to find while I was poking around on my CentOS 6 server that my Google Voice trunks were using IPv6 to XMPP-register with their mother ship. It would be interesting to test this sometime to see if IPv6 has better numbers for things like jitter than IPv4. It's no doubt implementation dependent, but has anyone ever done this?

 

[chris_c_]

I realize RedHat was not mentioned above, but strictly as an FYI, I was surprised to find while I was poking around on my CentOS 6 server that my Google Voice trunks were using IPv6 to XMPP-register with their mother ship. It would be interesting to test this sometime to see if IPv6 has better numbers for things like jitter than IPv4. It's no doubt implementation dependent, but has anyone ever done this?

Yes and from my tests, I love IPv6, it gives better jitter ping and latency, it's just a bit more efficient than IPv4.

 

[billsimon]

I don't think the protocol itself (IPv6 vs IPv4) will make any clear difference in latency and jitter, but the routing might be better on the IPv6 network, leading to better VoIP performance. Try using 'mtr' with the -4 and -6 options to your targets to see the difference. For me, mtr -4 and mtr -6 to talk.l.google.com (the Google Chat cluster) produces almost identical results in ping time. 14 hops over IPv4 and 15 hops over IPv6.

I started using IPv6 with SIP providers that offer it, and from my SIP phones to the PBX. No NAT to deal with!