implemented ip6tables.rules
This commit is contained in:
parent
136f74161b
commit
cedc96c2c4
|
@ -0,0 +1,15 @@
|
|||
*filter
|
||||
|
||||
-F
|
||||
|
||||
-P INPUT ACCEPT
|
||||
-P OUTPUT ACCEPT
|
||||
-P FORWARD ACCEPT
|
||||
|
||||
COMMIT
|
||||
|
||||
*mangle
|
||||
|
||||
-F
|
||||
|
||||
COMMIT
|
|
@ -0,0 +1,35 @@
|
|||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# allow esp
|
||||
-A INPUT -i eth0 -p 50 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p 50 -j ACCEPT
|
||||
|
||||
# allow IKE
|
||||
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||
|
||||
# allow MobIKE
|
||||
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
||||
|
||||
# allow last UDP fragment
|
||||
-A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT
|
||||
|
||||
# allow ICMPv6 neighbor-solicitations
|
||||
-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
|
||||
-A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
|
||||
|
||||
# allow ICMPv6 neighbor-advertisements
|
||||
-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
|
||||
-A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
|
||||
|
||||
# log dropped packets
|
||||
-A INPUT -j LOG --log-prefix " IN: "
|
||||
-A OUTPUT -j LOG --log-prefix " OUT: "
|
||||
|
||||
COMMIT
|
|
@ -0,0 +1,16 @@
|
|||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# allow ssh
|
||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
COMMIT
|
|
@ -0,0 +1,16 @@
|
|||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# allow ssh
|
||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
COMMIT
|
|
@ -0,0 +1,16 @@
|
|||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# allow ssh
|
||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
COMMIT
|
|
@ -4,6 +4,9 @@ dave::ipsec stop
|
|||
moon::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
dave::iptables-restore < /etc/iptables.flush
|
||||
moon::ip6tables-restore < /etc/ip6tables.flush
|
||||
carol::ip6tables-restore < /etc/ip6tables.flush
|
||||
dave::ip6tables-restore < /etc/ip6tables.flush
|
||||
alice::"ip route del fec0:\:/16 via fec1:\:1"
|
||||
carol::"ip route del fec1:\:/16 via fec0:\:1"
|
||||
dave::"ip route del fec1:\:/16 via fec0:\:1"
|
||||
|
|
|
@ -10,6 +10,9 @@ dave::cat /etc/ipsec.d/ipsec.sql | sqlite3 /etc/ipsec.d/ipsec.db
|
|||
moon::iptables-restore < /etc/iptables.rules
|
||||
carol::iptables-restore < /etc/iptables.rules
|
||||
dave::iptables-restore < /etc/iptables.rules
|
||||
moon::ip6tables-restore < /etc/ip6tables.rules
|
||||
carol::ip6tables-restore < /etc/ip6tables.rules
|
||||
dave::ip6tables-restore < /etc/ip6tables.rules
|
||||
alice::"ip route add fec0:\:/16 via fec1:\:1"
|
||||
carol::"ip route add fec1:\:/16 via fec0:\:1"
|
||||
dave::"ip route add fec1:\:/16 via fec0:\:1"
|
||||
|
|
Loading…
Reference in New Issue