9

The current Ubuntu LTS does not support NAT tables for IPv6 (i.e. there is no ip6tables -t nat), and I'm fine with that, in fact, a NAT-less environment is the "core" of my networks.

But, the next Ubuntu LTS will add support for IPv6 NAT tables and, the problem is, I have "orders" to not allow it within my IPv6 network, I mean, we'll not support NAT66 (NAT for IPv6).

So, I need to make sure that ip6tables -t nat will not work here. How can I disable it?

Can I just blacklist some kernel modules? Sysctl?

Seth
  • 59,332
ThiagoCMC
  • 869
  • 4
  • 13
  • 28

2 Answers2

6

The IPv6 NAT module is named nf_nat_ipv6, so it should be sufficient to blacklist that module.

sudo sh -c 'echo blacklist nf_nat_ipv6 >> /etc/modprobe.d/blacklist'
Community
  • 1
Michael Hampton
  • 1,860
  • 1
  • 16
  • 27
0

The proper way to blacklist modules such as this is as follows:

In your blacklist file, insert the following line, replacing "(module_name)" with the name of the module as it shows in lsmod

install (module_name) /bin/false

This is a kernel-level directive and not specific to any distribution. You can find more about the install directive in man modprobe.conf.

David Foerster
  • 36,890
  • 56
  • 97
  • 151
Speeddymon
  • 182