Differences

This shows you the differences between two versions of the page.

--- linux:apps:kvm:client-ipv6 [2026/09/16 13:55] – oscar
+++ linux:apps:kvm:client-ipv6 [2026/09/16 14:02] (current) – oscar
@@ Line 149: / Line 149: @@
 To include strict anti-spoofing protection for both IPv4 and IPv6, you should replace <filterref filter='allow-ipv6'/> with <filterref filter='no-ipv6-spoofing'/>. Do not keep allow-ipv6 in the file. The allow-ipv6 filter acts as a blanket permit for all IPv6 traffic, which would completely override and disable the security rules created by no-ipv6-spoofing.
+#### Important Requirement: Passing the IPv6 Parameter
 If you require strict IPv6 source filtering, you must define the <parameter name='IPV6' value='...'/> inside the <filterref> block using an anti-spoofing filter like no-ipv6-spoofing.
+The no-ipv6-spoofing filter requires libvirt to know exactly which IPv6 address belongs to the virtual machine. Unlike IPv4 (where libvirt can automatically learn the IP via DHCP snooping), you must explicitly pass the allowed IPv6 address as a parameter inside your VM's XML configuration. Update your VM interface via virsh edit Debian13-ESP32-ARMHF to look like this:
 Here is exactly how your /etc/libvirt/nwfilter/clean-traffic-ipv6.xml file should look:
 ```xml
-<filter name='clean-traffic-ipv6' chain='root'>
-  <filterref filter='clean-traffic'/>
-  <filterref filter='no-ipv6-spoofing'/>
-</filter>
-```
-#### Important Requirement: Passing the IPv6 Parameter
-The no-ipv6-spoofing filter requires libvirt to know exactly which IPv6 address belongs to the virtual machine. Unlike IPv4 (where libvirt can automatically learn the IP via DHCP snooping), you must explicitly pass the allowed IPv6 address as a parameter inside your VM's XML configuration.
-Update your VM interface via virsh edit Debian13-ESP32-ARMHF to look like this:
 <interface type='network'>
   <mac address='52:54:00:7e:d3:ee'/>
@@ Line 167: / Line 160: @@
   <model type='virtio'/>
   <filterref filter='clean-traffic-ipv6'>
-    <!-- Replace with the actual IPv6 address assigned to this VM -->
+    <!-- Replace with the actual IPv4 + IPv6 address assigned to this VM -->
+    <parameter name='IP' value='129.97.134.3'/>
     <parameter name='IPV6' value='2001:db8:1::50'/>
   </filterref>
   <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
 </interface>
+</filter>
+```
 #### How this functions at the host level:
 * clean-traffic builds filters to block any IPv4 or MAC spoofing attempts.
 * no-ipv6-spoofing builds filters that drop any outgoing IPv6 packets whose source address does not match the exact IPV6 parameter value you provided.
-Would you like to know how to specify multiple IPv6 addresses if your VM uses both a global unicast address (GUA) and a link-local address, or are you assigning a single static address?
+## Links
+[1] (https://github.com/fsinf/libvirt-fsinf) \\
+[2] (https://wiki.csclub.uwaterloo.ca/KVM) \\
+[3] (https://cubepath.com/docs/virtualization-vps/virtual-network-configuration-with-libvirt) \\