allsky-rodgau.de

While IPv4 is structurally protected by NAT, IPv6 is always globally accessible without a firewall – completely without port sharing. This is precisely why an IPv6 firewall is not a “nice to have”, but a must.

IPv6: secure global reach and allow ICMPv6

I was surprised that my Raspberry Pi was immediately given a global IPv6 address. This means that it can be reached from outside without NAT. Without ip6tables, all IPv6 services are open – often without you even noticing.

The solution is an IPv6 firewall similar to the IPv4 configuration, but with one important difference: ICMPv6 should not be blocked, as otherwise functions such as neighbor discovery, router advertisements or MTU detection will no longer work reliably.

Since my Allsky camera is publicly available via Apache, secured with Let’s Encrypt and its own subdomain, I also wanted to harden the Raspberry Pi a little at network level – without risky experiments or unnecessary complexity. NAT provides basic protection for IPv4, but ports 80 and 443 in particular are publicly accessible. In addition, bots, scanners and automated requests generate unnecessary traffic.

My goal: a pragmatic firewall that allows real access, reduces bot noise and does not interfere with Let’s Encrypt. Here is the IPv4 part first – you can find an additional post about IPv6 here!

The standard SSH port 22 is a popular target for attackers. If you want to additionally secure your Raspberry Pi, you can simply change the port for SSH access. In this guide, I will show you step by step how to do this.