Self-check your network services

Once your node is running, you are now a newly minted IPv6 host. Your operating system may automatically reconfigure network services to use this new address. Take control of the services your host is offering as described below.

1: Obtain IP address.

Use ifconfig -a to find the IPv6 address of your TUN device. (Assigned by cjdroute.)

2: Scan for open services.

Run nmap to discover which services are accessible from this address. For example, to scan the address fcf7:75f0:82e3:327c:7112:b9ab:d1f9:bbbe:

nmap -6 -n -r -v -p1-65535 -sT fcf7:75f0:82e3:327c:7112:b9ab:d1f9:bbbe

This should result in an output like the following.

Starting Nmap 5.61TEST2 ( http://nmap.org ) at 2011-12-29 20:40 EST
Initiating Connect Scan at 20:40
Scanning fcf7:75f0:82e3:327c:7112:b9ab:d1f9:bbbe [65535 ports]
Completed Connect Scan at 20:40, 4.38s elapsed (65535 total ports)
Nmap scan report for fcf7:75f0:82e3:327c:7112:b9ab:d1f9:bbbe
Host is up (0.00073s latency).
All 65535 scanned ports on fcf7:75f0:82e3:327c:7112:b9ab:d1f9:bbbe are closed

Read data files from: /usr/local/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 4.60 seconds
    Raw packets sent: 0 (0B) | Rcvd: 0 (0B)

If you have open ports, you might see something more like this.

Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-04 09:52 UTC
Initiating Ping Scan at 09:52
Scanning fcde:c974:bde5:a226:b8a9:bd8:3e8:7df5 [2 ports]
Completed Ping Scan at 09:52, 0.00s elapsed (1 total hosts)
Initiating Connect Scan at 09:52
Scanning fcde:c974:bde5:a226:b8a9:bd8:3e8:7df5 [65535 ports]
Discovered open port 40499/tcp on fcde:c974:bde5:a226:b8a9:bd8:3e8:7df5
Discovered open port 53529/tcp on fcde:c974:bde5:a226:b8a9:bd8:3e8:7df5
Completed Connect Scan at 09:52, 4.66s elapsed (65535 total ports)
Nmap scan report for fcde:c974:bde5:a226:b8a9:bd8:3e8:7df5
Host is up (0.00079s latency).
Not shown: 65533 closed ports
PORT      STATE SERVICE
40499/tcp open  unknown
53529/tcp open  unknown

If port 22 were open, you could probably guess that SSH is responsible. But what the heck is using 40499? Here's how you figure that out. First, install netstat (pacman -S net-tools on Arch, for example). Second, run the following netcat command and read the lines that reference those ports.

netstat -tulpn

3: If you see anything open, fix it.

Examples for SSH and Samba are below.

SSH

Edit /etc/ssh/sshd_config:

ListenAddress 192.168.1.1

^ Replace 192.168.1.1 in the example above with your STATIC IP (or map DHCP via MAC).

Samba

Edit /etc/samba/smb.conf:

[global]
interfaces = eth0
bind interfaces only = Yes

^ This will cause Samba to not bind to tun0 (or whichever TUN device you are using).

Apache

You will have to find the Listen directive in your Apache configuration, which is located in different files depending on your distribution and platform. Many distributions make Apache listen to all interfaces, IPv4 as well as IPv6:

Listen 80

You can change this to:

Listen 192.168.1.1:80

For example, to force Apache onto IPv4 addresses only for all of its hosts. If you wish to mix and match virtual hosts, exposing some via IPv6 and others only via IPv4, you can configure each virtual host separately:

<VirtualHost [2001:db8::a00:20ff:fea7:ccea]:80>
    # configuration goes here
</VirtualHost>

Versus a virtual host in IPv4:

<VirtualHost 192.168.1.1:80>
    # configuration goes here
</VirtualHost>

If you keep listening on all IP versions, make sure your default DocumentRoot points to something useful and not something sensitive, since Apache will fall back to that DocumentRoot if none of your virtual hosts matches an incoming request.

Lighttpd

Comment out the following line in /etc/lighttpd/lighttpd.conf:

include_shell "/usr/share/lighttpd/use-ipv6.pl"

Thats it for now! Got More? Tell us on IRC.

network-services.md 4.0 KB Permalink History Raw