From 9ff5e5e8db715d84b5ae369cc59aa991cea3893c Mon Sep 17 00:00:00 2001
From: Kali Kaneko <kali@leap.se>
Date: Wed, 21 May 2014 08:29:51 -0500
Subject: block ipv6 traffic

---
 pkg/linux/bitmask-root | 11 +++++++++++
 1 file changed, 11 insertions(+)

(limited to 'pkg')

diff --git a/pkg/linux/bitmask-root b/pkg/linux/bitmask-root
index 6badeedd..6d296ecf 100755
--- a/pkg/linux/bitmask-root
+++ b/pkg/linux/bitmask-root
@@ -765,6 +765,17 @@ def firewall_start(args):
                   "--dport", "53", "--destination", allowed_dns,
                   "--jump", "ACCEPT")
 
+    # workaround for ipv6 servers being blocked and not falling back to ipv4.
+    # See #5693
+    ip6tables("--append", "OUTPUT", "--jump", "REJECT",
+              "-s", "::/0",  "-d", "::/0",
+              "-p", "tcp",
+              "--reject-with", "icmp6-port-unreachable")
+    ip6tables("--append", "OUTPUT", "--jump", "REJECT",
+              "-s", "::/0",  "-d", "::/0",
+              "-p", "udp",
+              "--reject-with", "icmp6-port-unreachable")
+
 
 def firewall_stop():
     """
-- 
cgit v1.2.3