Match Traffic Destination MAC using nftables for Remote IPv6 LAN Access with Dynamic IP

Using nftables to match destination MAC addresses for remote IPv6 access is technically flawed because inbound packets from the internet carry the router’s MAC address, not the client’s. This article explains why this approach fails and provides correct alternatives using stateful connection tracking or static DHCP reservations to manage dynamic IPv6 addresses securely.

The Flaw in Destination MAC Matching

The core misunderstanding lies in how Ethernet frames are constructed when traffic traverses multiple network segments. When a remote user initiates a connection to your home server over the public internet, the packet travels through several routers before reaching your local gateway. At each hop, the source and destination MAC addresses are rewritten. For any packet arriving at your LAN interface from the WAN side, the destination MAC address will always be the MAC address of your router’s interface on that LAN segment. It will never be the MAC address of the specific internal client you wish to reach. Therefore, an nftables rule attempting to filter based on ether daddr for inbound traffic effectively matches against your own hardware, rendering the rule useless for distinguishing between different clients on your local network. This misconception often arises when users try to apply Layer 2 filtering logic to Layer 3 or Layer 4 problems. While matching MAC addresses is valid for local bridging or preventing ARP spoofing within a single broadcast domain, it cannot identify end-hosts across routed boundaries.

Why Dynamic IPv6 Makes Routing Tricky

IPv6 was designed to eliminate the need for NAT by providing abundant address space. However, most residential ISPs assign dynamic IPv6 prefixes via SLAAC (Stateless Address Autoconfiguration) or DHCPv6. Your device’s global IPv6 address changes whenever the prefix renews or the device reconnects. Without a fixed IP, establishing consistent remote access requires either: 1. A mechanism to track the current IP address of the device. 2. A way to route traffic to the device regardless of its changing address. Relying on MAC addresses does not solve the routing problem because the upstream provider does not know your internal MAC addresses, nor do they forward them to you in a usable format for firewall rules targeting specific hosts.

Correct Approaches for Remote Access

To achieve secure remote access to a machine with a dynamic IPv6 address, you must use methods that operate at higher layers of the OSI model or leverage existing infrastructure.

Option 1: Use Connection Tracking (Recommended)

Instead of trying to pre-filter based on MAC, allow established connections to pass through. nftables handles stateful inspection automatically if configured correctly. You can define a set of allowed services and rely on the fact that only initiated sessions will return traffic.

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        # Allow established and related connections
        ct state established,related accept

        # Allow new SSH connections from anywhere
        tcp dport 22 ct state new accept

        # Drop everything else
        drop
    }
}

This method works because the kernel tracks the state of connections. When a remote client connects to your SSH service, the return traffic is matched by the ct state established rule. No MAC address matching is required.

Option 2: Static DHCP Reservations

If you need to restrict access to specific devices, configure your DHCPv6 server (often part of your router’s firmware like dnsmasq or radvd) to assign a static IPv6 address to a specific MAC address. This ensures that the device always gets the same global IPv6 address, even if the prefix changes. You can then create an nftables rule that allows traffic only to that specific IPv6 address.

table inet filter {
    set trusted_hosts {
        type ipv6_addr
        flags interval
        elements = { 2001:db8::100/128 }
    }

    chain input {
        type filter hook input priority 0; policy drop;

        ip6 saddr @trusted_hosts tcp dport 22 accept
        drop
    }
}

This approach combines the stability of static assignment with the security of explicit IP-based filtering.

Option 3: Reverse Proxy or Tunneling

For more complex setups, consider using a reverse proxy (like Nginx or Caddy) or a tunneling solution (like Tailscale or ZeroTier). These tools abstract away the underlying network configuration entirely. They provide a stable hostname or virtual network interface, allowing you to connect without worrying about dynamic IPs or MAC addresses. See also: How to Connect to a Home Server Running on a DS-Lite Network from an IPv4 Network for insights into handling difficult network topologies.

Security Considerations

When exposing IPv6 services, ensure you are not inadvertently opening ports to the entire world. Unlike IPv4, where NAT provides a degree of obscurity, IPv6 exposes every interface directly. Always verify your firewall rules using nft list ruleset and test connectivity from external sources. Avoid relying on "security through obscurity" by hiding your IPv6 prefix. Instead, focus on strong authentication (SSH keys, MFA) and minimal open ports. If you are unsure about your current IPv6 configuration, check for common issues like repeating link-local messages. See IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready message repeating every minute for troubleshooting tips.

Conclusion

Matching destination MAC addresses in nftables for remote IPv6 access is a fundamental error due to the nature of routed Ethernet frames. The destination MAC is always the next-hop router, not the final host. To securely access a machine with a dynamic IPv6 address, use stateful connection tracking for general access, static DHCP reservations for specific IP targeting, or tunneling solutions for simplified management. These methods respect the layered architecture of networking protocols and provide robust, maintainable solutions.

Frequently Asked Questions

Can I use iptables instead of nftables for this?

No, the fundamental issue remains the same regardless of the firewall tool. Both iptables and nftables operate on the same packet headers, and the destination MAC address in an inbound packet will still be your router’s MAC. Switching tools does not change the behavior of Ethernet frames across routers.

How do I find my device's current IPv6 address?

You can find your current global IPv6 address by running ip -6 addr show on the target machine. Look for the address associated with your public-facing interface that starts with 2001:, 2600:, or similar global unicast prefixes. Note that this address may change if your ISP renews the prefix.

Is it safe to expose IPv6 SSH to the internet?

It is safe if properly secured. Ensure you disable password authentication and use SSH keys instead. Additionally, limit the allowed IP ranges in your firewall if possible, or use fail2ban to block brute-force attempts. Never expose services with weak passwords or outdated software versions.

What if my ISP doesn't provide IPv6?

If your ISP does not provide native IPv6, you can use an IPv6-over-IPv4 tunnel service like Hurricane Electric’s Tunnel Broker or commercial solutions like Cloudflare Tunnel. These services provide you with a stable IPv6 endpoint that forwards traffic to your home network, bypassing the need for direct IPv6 connectivity.

Does disabling IPv6 improve security?

Disabling IPv6 removes one attack surface but does not significantly improve overall security if your IPv4 firewall is misconfigured. It also breaks compatibility with modern web services and some applications that prefer IPv6. It is better to properly configure your IPv6 firewall than to disable the protocol entirely.