1 files changed, 40 insertions, 0 deletions
diff --git a/roles/linux-ns/files/iptables/ip6tables.save b/roles/linux-ns/files/iptables/ip6tables.save
new file mode 100644
index 0000000..4c3ea11
--- /dev/null
+++ b/roles/linux-ns/files/iptables/ip6tables.save
@@ -0,0 +1,40 @@
+*filter
+:INPUT DROP [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+
+-A INPUT -i lo -j ACCEPT
+-A INPUT -i tinc_dn42 -j ACCEPT
+
+-A INPUT -p icmpv6 -j ACCEPT
+
+# traceroute
+-A INPUT -p udp -m multiport --dports 33434:33534 -j REJECT --reject-with icmp6-port-unreachable
+# DNS
+-A INPUT -p udp --dport 53 -j ACCEPT
+-A INPUT -p tcp --dport 53 -j ACCEPT
+# BGP
+-A INPUT -p tcp --dport 179 -j ACCEPT
+# LG
+-A INPUT -i eth0 -p tcp --dport 6042 -j ACCEPT
+-A INPUT -i eth0 -p tcp --dport 6142 -j ACCEPT
+
+
+-A INPUT -j REJECT --reject-with icmp6-port-unreachable
+
+-A FORWARD -s fd00::/8 -d fd00::/8 -j ACCEPT
+-A FORWARD -s fd00::/8 -d fd00::/8 -j ACCEPT
+
+COMMIT
+
+*mangle
+-A PREROUTING -i eth0 -j MARK --set-mark 0x4242
+COMMIT
+
+*nat
+-A PREROUTING -d fd3e:bc05:2d6::80/128 -p tcp --dport 80 -j DNAT --to-destination fcee::1
+-A PREROUTING -d fd3e:bc05:2d6::80/128 -p tcp --dport 443 -j DNAT --to-destination fcee::1
+-A POSTROUTING -d fd00::/8 -m mark --mark 0x4242 -j MASQUERADE
+COMMIT