Why does Shorewall lPv6 Support Require Kernel 2.6.25 or later?
Shorewall implements a stateful firewall which requires connection tracking be present in ip6tables and in the kernel. Linux kernel’s before 2.6.20 didn’t have connection tracking for IPv6. So we could not even start to develop IPv6 support until 2.6.20. We understand that there were significant problems with the facility until at least kernel 2.6.23. When distributions began offering IPv6 connection tracking support, it was with kernel 2.6.25. So that is what we developed IPv6 support on and that’s all that it has been tested on. If you are running 2.6.20 or later, you can try to run Shorewall6 by hacking /usr/share/shorewall-perl/prog.footer6 and changing the kernel version test to check for your kernel version rather than 2.6.25 (20625). But after that, you are on your own.
