2 echo "configure /etc/firewall6.conf first."
10 ######################################################################
12 ######################################################################
15 ip6tables
-N input_rule
16 ip6tables
-N forwarding_rule
19 ip6tables
-P INPUT DROP
20 ip6tables
-P FORWARD DROP
21 ip6tables
-P OUTPUT DROP
24 ### (connections with the router as destination)
27 ip6tables
-A INPUT
-m state
--state INVALID
-j DROP
28 ip6tables
-A INPUT
-m state
--state RELATED
,ESTABLISHED
-j ACCEPT
29 ip6tables
-A INPUT
-p tcp
--tcp-flags SYN SYN \
! --tcp-option 2 -j DROP
32 ip6tables
-A INPUT
-j input_rule
34 # allow access from anything but WAN
35 ip6tables
-A INPUT
${WAN:+\! -i $WAN} -j ACCEPT
37 ip6tables
-A INPUT
-p icmp6
-j ACCEPT
40 ip6tables
-A INPUT
-p tcp
-j REJECT
--reject-with tcp-reset
41 ip6tables
-A INPUT
-j REJECT
--reject-with icmp6-port-unreachable
44 ### (connections with the router as source)
47 ip6tables
-A OUTPUT
-m state
--state RELATED
,ESTABLISHED
,NEW
-j ACCEPT
48 ip6tables
-A OUTPUT
-p icmp6
-j ACCEPT
51 ### (connections routed through the router)
54 ip6tables
-A FORWARD
-m state
--state INVALID
-j DROP
55 ip6tables
-A FORWARD
-m state
--state RELATED
,ESTABLISHED
-j ACCEPT
57 # fix for broken ISPs blocking ICMPv6 "packet too big" packets
58 #ip6tables -t mangle -A FORWARD -p tcp -o $WAN --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
61 ip6tables
-A FORWARD
-j forwarding_rule
64 ip6tables
-A FORWARD
-i $LAN -o $WAN -j ACCEPT
66 ######################################################################
67 ### Default ruleset end
68 ######################################################################
71 ### Connections to the router
75 #ip6tables -A input_rule -i $WAN -p tcp -s <a.b.c.d> --dport 22 -j ACCEPT
78 #ip6tables -A input_rule -i $WAN -p esp -s <a.b.c.d> -j ACCEPT
79 #ip6tables -A input_rule -i $WAN -p udp -s <a.b.c.d> --dport 500 -j ACCEPT
82 #ip6tables -A input_rule -i $WAN -p udp -s <a.b.c.d> --dport 1194 -j ACCEPT
85 #ip6tables -A input_rule -i $WAN -p gre -j ACCEPT
86 #ip6tables -A input_rule -i $WAN -p tcp --dport 1723 -j ACCEPT
93 #ip6tables -A forwarding_rule -o ipsec+ -j ACCEPT
94 #ip6tables -A forwarding_rule -i ipsec+ -j ACCEPT
97 #ip6tables -A forwarding_rule -o tun+ -j ACCEPT
98 #ip6tables -A forwarding_rule -i tun+ -j ACCEPT