From 526797b41c8dfffc7e74a951c17ef96734980e7a Mon Sep 17 00:00:00 2001
From: uvok cheetah
Date: Sun, 2 Feb 2025 15:21:26 +0100
Subject: Add role for Dn42 and network namespace

---
 roles/linux-ns/files/iptables/iptables.save | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 roles/linux-ns/files/iptables/iptables.save

(limited to 'roles/linux-ns/files/iptables/iptables.save')

diff --git a/roles/linux-ns/files/iptables/iptables.save b/roles/linux-ns/files/iptables/iptables.save
new file mode 100644
index 0000000..7a4504f
--- /dev/null
+++ b/roles/linux-ns/files/iptables/iptables.save
@@ -0,0 +1,22 @@
+*filter
+:INPUT DROP [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+
+-A INPUT -i lo -j ACCEPT
+-A INPUT -i tinc_dn42 -j ACCEPT
+
+-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
+-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
+-A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT
+-A INPUT -p icmp --icmp-type echo-request -j ACCEPT
+
+# traceroute
+-A INPUT -p udp -m multiport --dports 33434:33534 -j REJECT --reject-with icmp-port-unreachable
+# DNS
+-A INPUT -p udp --dport 53 -j ACCEPT
+-A INPUT -p tcp --dport 53 -j ACCEPT
+
+COMMIT
-- 
cgit v1.2.3