1
0

firewall6.conf 2.5 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798
  1. #!/bin/sh
  2. echo "configure /etc/firewall6.conf first."
  3. exit 1
  4. ### Interfaces
  5. WAN=sixxs
  6. LAN=br0
  7. WLAN=wlan0
  8. ######################################################################
  9. ### Default ruleset
  10. ######################################################################
  11. ### Create chains
  12. ip6tables -N input_rule
  13. ip6tables -N forwarding_rule
  14. ### Default policy
  15. ip6tables -P INPUT DROP
  16. ip6tables -P FORWARD DROP
  17. ip6tables -P OUTPUT DROP
  18. ### INPUT
  19. ### (connections with the router as destination)
  20. # base case
  21. ip6tables -A INPUT -m state --state INVALID -j DROP
  22. ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
  23. ip6tables -A INPUT -p tcp --tcp-flags SYN SYN \! --tcp-option 2 -j DROP
  24. # custom rules
  25. ip6tables -A INPUT -j input_rule
  26. # allow access from anything but WAN
  27. ip6tables -A INPUT ${WAN:+\! -i $WAN} -j ACCEPT
  28. # allow icmp messages
  29. ip6tables -A INPUT -p icmp6 -j ACCEPT
  30. # reject
  31. ip6tables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
  32. ip6tables -A INPUT -j REJECT --reject-with icmp6-port-unreachable
  33. ### OUTPUT
  34. ### (connections with the router as source)
  35. # base case
  36. ip6tables -A OUTPUT -m state --state RELATED,ESTABLISHED,NEW -j ACCEPT
  37. ip6tables -A OUTPUT -p icmp6 -j ACCEPT
  38. ### FORWARD
  39. ### (connections routed through the router)
  40. # base case
  41. ip6tables -A FORWARD -m state --state INVALID -j DROP
  42. ip6tables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
  43. # fix for broken ISPs blocking ICMPv6 "packet too big" packets
  44. #ip6tables -t mangle -A FORWARD -p tcp -o $WAN --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
  45. # custom rules
  46. ip6tables -A FORWARD -j forwarding_rule
  47. # allow LAN
  48. ip6tables -A FORWARD -i $LAN -o $WAN -j ACCEPT
  49. ######################################################################
  50. ### Default ruleset end
  51. ######################################################################
  52. ###
  53. ### Connections to the router
  54. ###
  55. # ssh
  56. #ip6tables -A input_rule -i $WAN -p tcp -s <a.b.c.d> --dport 22 -j ACCEPT
  57. # IPSec
  58. #ip6tables -A input_rule -i $WAN -p esp -s <a.b.c.d> -j ACCEPT
  59. #ip6tables -A input_rule -i $WAN -p udp -s <a.b.c.d> --dport 500 -j ACCEPT
  60. # OpenVPN
  61. #ip6tables -A input_rule -i $WAN -p udp -s <a.b.c.d> --dport 1194 -j ACCEPT
  62. # PPTP
  63. #ip6tables -A input_rule -i $WAN -p gre -j ACCEPT
  64. #ip6tables -A input_rule -i $WAN -p tcp --dport 1723 -j ACCEPT
  65. ###
  66. ### VPN traffic
  67. ###
  68. # IPSec
  69. #ip6tables -A forwarding_rule -o ipsec+ -j ACCEPT
  70. #ip6tables -A forwarding_rule -i ipsec+ -j ACCEPT
  71. # OpenVPN
  72. #ip6tables -A forwarding_rule -o tun+ -j ACCEPT
  73. #ip6tables -A forwarding_rule -i tun+ -j ACCEPT