diff options
| author | uvok cheetah | 2025-06-18 19:27:05 +0200 |
|---|---|---|
| committer | uvok cheetah | 2025-06-18 19:27:05 +0200 |
| commit | 1e690360c57f6a442252b654f237bfed84aaa778 (patch) | |
| tree | 9db836346f3246961ae7e48cbc5723d8ad7d98a6 | |
| parent | 65100dc7eb3913b182fc9cef064f1f362d8e02ad (diff) | |
| -rw-r--r-- | roles/linux_ns/files/iptables/ip6tables.save | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/roles/linux_ns/files/iptables/ip6tables.save b/roles/linux_ns/files/iptables/ip6tables.save index 036e5a5..ca67633 100644 --- a/roles/linux_ns/files/iptables/ip6tables.save +++ b/roles/linux_ns/files/iptables/ip6tables.save @@ -24,7 +24,17 @@ -A INPUT -j REJECT --reject-with icmp6-port-unreachable -A FORWARD -s fd00::/8 -d fd00::/8 -j ACCEPT +# don't match source alone - will prevent outer system from doing stuff. +-A FORWARD -i eth0 -d fd00::/8 -j ACCEPT +# replies! +-A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT +# post/prerouting, must allow forward +# formerly for HTTP/S +#-A FORWARD -s fd00::/8 -d fcee::1/128 -j ACCEPT +#-A FORWARD -s fcee::1/128 -d fd00::/8 -j ACCEPT + +#-A FORWARD -j LOG --log-prefix "[dn42] forward" -A FORWARD -j REJECT --reject-with icmp6-port-unreachable COMMIT |