diff options
| author | uvok cheetah | 2025-02-09 17:57:14 +0100 |
|---|---|---|
| committer | uvok cheetah | 2025-02-09 17:57:14 +0100 |
| commit | a3ee42d1dde090c5baad512ff8707f7e2c068433 (patch) | |
| tree | a619ef2f51c548a235b188cac19c7cf337686424 /roles/linux_ns/files/iptables/ip6tables.save | |
| parent | bb989a2148686d1eb4f49b5aa2597c5162436196 (diff) | |
Diffstat (limited to 'roles/linux_ns/files/iptables/ip6tables.save')
| -rw-r--r-- | roles/linux_ns/files/iptables/ip6tables.save | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/roles/linux_ns/files/iptables/ip6tables.save b/roles/linux_ns/files/iptables/ip6tables.save new file mode 100644 index 0000000..036e5a5 --- /dev/null +++ b/roles/linux_ns/files/iptables/ip6tables.save @@ -0,0 +1,38 @@ +*filter +:INPUT DROP [0:0] +:FORWARD DROP [0:0] +:OUTPUT ACCEPT [0:0] + +-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + +-A INPUT -i lo -j ACCEPT +-A INPUT -i tinc_dn42 -j ACCEPT + +-A INPUT -p icmpv6 -j ACCEPT + +# traceroute +-A INPUT -p udp -m multiport --dports 33434:33534 -j REJECT --reject-with icmp6-port-unreachable +# DNS +-A INPUT -p udp --dport 53 -j ACCEPT +-A INPUT -p tcp --dport 53 -j ACCEPT +# BGP +-A INPUT -p tcp --dport 179 -j ACCEPT +# LG +-A INPUT -i eth0 -p tcp --dport 6042 -j ACCEPT +-A INPUT -i eth0 -p tcp --dport 6142 -j ACCEPT + +-A INPUT -j REJECT --reject-with icmp6-port-unreachable + +-A FORWARD -s fd00::/8 -d fd00::/8 -j ACCEPT + +-A FORWARD -j REJECT --reject-with icmp6-port-unreachable + +COMMIT + +*mangle +-A PREROUTING -i eth0 -j MARK --set-mark 0x4242 +COMMIT + +*nat +-A POSTROUTING -d fd00::/8 -m mark --mark 0x4242 -j MASQUERADE +COMMIT |