2 files changed, 62 insertions, 0 deletions
diff --git a/roles/linux_ns/files/iptables/ip6tables.save b/roles/linux_ns/files/iptables/ip6tables.save
new file mode 100644
index 0000000..036e5a5
--- /dev/null
+++ b/roles/linux_ns/files/iptables/ip6tables.save
@@ -0,0 +1,38 @@
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+
+-A INPUT -i lo -j ACCEPT
+-A INPUT -i tinc_dn42 -j ACCEPT
+
+-A INPUT -p icmpv6 -j ACCEPT
+
+# traceroute
+-A INPUT -p udp -m multiport --dports 33434:33534 -j REJECT --reject-with icmp6-port-unreachable
+# DNS
+-A INPUT -p udp --dport 53 -j ACCEPT
+-A INPUT -p tcp --dport 53 -j ACCEPT
+# BGP
+-A INPUT -p tcp --dport 179 -j ACCEPT
+# LG
+-A INPUT -i eth0 -p tcp --dport 6042 -j ACCEPT
+-A INPUT -i eth0 -p tcp --dport 6142 -j ACCEPT
+
+-A INPUT -j REJECT --reject-with icmp6-port-unreachable
+
+-A FORWARD -s fd00::/8 -d fd00::/8 -j ACCEPT
+
+-A FORWARD -j REJECT --reject-with icmp6-port-unreachable
+
+COMMIT
+
+*mangle
+-A PREROUTING -i eth0 -j MARK --set-mark 0x4242
+COMMIT
+
+*nat
+-A POSTROUTING -d fd00::/8 -m mark --mark 0x4242 -j MASQUERADE
+COMMIT
diff --git a/roles/linux_ns/files/iptables/iptables.save b/roles/linux_ns/files/iptables/iptables.save
new file mode 100644
index 0000000..4f72cc5
--- /dev/null
+++ b/roles/linux_ns/files/iptables/iptables.save
@@ -0,0 +1,24 @@
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+
+-A INPUT -i lo -j ACCEPT
+-A INPUT -i tinc_dn42 -j ACCEPT
+
+-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
+-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
+-A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT
+-A INPUT -p icmp --icmp-type echo-request -j ACCEPT
+
+# traceroute
+-A INPUT -p udp -m multiport --dports 33434:33534 -j REJECT --reject-with icmp-port-unreachable
+# DNS
+-A INPUT -p udp --dport 53 -j ACCEPT
+-A INPUT -p tcp --dport 53 -j ACCEPT
+
+-A FORWARD -j REJECT --reject-with icmp-port-unreachable
+
+COMMIT