Is it possible for a host to have different open ports for IPv4 and IPv6 stack? For example, is it feasible to have the port 22 open only for IPv6 and not for IPv4 and vice versa? Also when I tried to block a port only for IPv6 it had no effect:
ip6tables -A INPUT -p tcp --dport 22 -j REJECT5 Answers
Yes, definitely. In fact, there is even a difference between a port on TCP vs that same port on UDP on the same IPv6 address, which is why you specify -p tcp as well.
IPv4 is a different mechanism than IPv6 and they have separate interfaces, with separate IP addresses with separate ports. In fact, you cannot use IPv6 to connect to an IPv4 address unless you have some kind of intermediator in between that does it for you. But such intermediator would simply accept IPv4 then bridge that connection to a new IPv6.
It would also be the same case if you have 2 network cards, both having a different IP address. You would then also have to specify the correct IP address.
But it basically all boils down to this: you have a program that hosts a server, look in its configuration what ports it open, and block according to its ipv4, ipv6 and port usage on either or both tcp or udp.
2Yes, they’re entirely separate. In POSIX, you create sockets using the socket(2) system call, and you pass AF_INET or AF_INET6 to it to choose between IPv4 and IPv6, respectively. Such sockets can use the same port numbers without any interference.
However, Linux has the feature where an IPv6 socket listening on a certain port will also get IPv4 traffic with the source address mapped into the IPv6 address. This can be switched off by setting IPV6_V6ONLY.
1In short
Yes
Note that application doesn't have to bind to both IPv4 and IPv6 so you could do this even without IP tables.
Look at the ListenAddress directive in your sshd config or other application.
Not that you'd want to do this, but it is entirely possible to have an ssh server listening on TCP/IP6 port 22 while a web server listens on TCP/IP4 port 22.
iptables and ip6tables are configured separately.
Note as pointed out in the comments, IP itself does not have ports, but some of the transport protocols most commonly used with it, TCP and UDP, do have ports. This is why iptables requires something like -p tcp before you can filter by port, otherwise port is meaningless.
I'd like to answer from a technical perspective.
Are IPv4 ports separated from IPv6 ports?
The concept of ports is at "transport layer", where as the IP protocols are at "internet layer". As IP addresses are separate (for most parts, see below), the ports are also naturally separate.
However, it should be noted that, to ease migration from IPv4 to IPv6, some addresses in the IPv6 address space are mapped onto IPv4. This means when some IPv4 sockets are taken, their IPv6 counter parts may also become unavailable. The details are dependent on specific operating system implementations.
First, IPv4 and IPv6 don't have "ports."
Ports are a concept added by the TCP and UDP transport protocols.
Second, TCP/UDP addresses are separate for IPv4 and IPv6, since the address is the ip_address:port combination. 127.0.0.1:8000 is a different address than ::1:8000. Two different programs can be communicating on those two different addresses.
Third, you need to use ip6tables to affect IPv6 traffic.
