#!/bin/sh -e
#
# Simple example IPv6 Firewall configuration.
#
# Caveats:
# - This configuration applies to all network interfaces
# if you want to restrict this to only a given interface use
# '-i INTERFACE' in the ip6tables calls.
# - Remote access for TCP/UDP services is granted to any host,
# you probably will want to restrict this using '--source'.
#
# description: Activates/Deactivates the firewall at boot time
#
# You should test this script before applying with safe-restart option
#
IP6TABLES=/sbin/ip6tables
#IP6TABLES="/sbin/ip6tables -i eth0"
[ -x "$IP6TABLES" ] || exit 1
# Inbound TCP ports
TCP_INPUT_PORTS="21 22 25 80 443"
# Inbound UDP ports
UDP_INPUT_PORTS=""
# Allowed ICMP messages
ALLOWED_ICMP="\
packet-too-big \
destination-unreachable \
time-exceeded parameter-problem \
echo-request \
echo-reply \
router-advertisement \
neighbour-solicitation \
neighbour-advertisement"
fw_start () {
# Allow related and established connection.
$IP6TABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow ICMP as defined in ALLOWED_ICMP
if [ -n "$ALLOWED_ICMP" ] ; then
for ICMP_TYPE in $ALLOWED_ICMP; do
$IP6TABLES -A INPUT -p icmpv6 --icmpv6-type ${ICMP_TYPE} -j ACCEPT
done
fi
# Open allowed TCP ports if any
if [ -n "$TCP_INPUT_PORTS" ] ; then
for PORT in $TCP_INPUT_PORTS; do
$IP6TABLES -A INPUT -m state --state NEW -p tcp --dport ${PORT} \
-j ACCEPT
done
fi
# Open allowed UDP ports if any
if [ -n "$UDP_INPUT_PORTS" ] ; then
for PORT in $UDP_INPUT_PORTS; do
$IP6TABLES -A INPUT -m state --state NEW -p udp --dport ${PORT} \
-j ACCEPT
done
fi
$IP6TABLES -A INPUT -p tcp --dport 53 -j ACCEPT
$IP6TABLES -A INPUT -p udp --dport 53 -j ACCEPT
# Allow traffic to the loopback (needed by some applications)
$IP6TABLES -A INPUT -i lo -j ACCEPT
# Log and drop all other packets.
$IP6TABLES -A INPUT -j REJECT --reject-with icmp6-adm-prohibited
#$IP6TABLES -A INPUT -j LOG
#$IP6TABLES -P INPUT DROP
# Los and drop all packet to be forwarded, we're not a router...
$IP6TABLES -A FORWARD -j REJECT --reject-with icmp6-adm-prohibited
#$IP6TABLES -A FORWARD -j LOG
#$IP6TABLES -P FORWARD DROP
# We're not going to filter outgoing packets
# but you can if you're paranoid like I am...
$IP6TABLES -P OUTPUT ACCEPT
}
# fw_stop disables completely the firewall and reset all chains to
# the default policy ACCEPT
fw_stop () {
$IP6TABLES -P INPUT ACCEPT
$IP6TABLES -P FORWARD ACCEPT
$IP6TABLES -P OUTPUT ACCEPT
$IP6TABLES -t mangle -P PREROUTING ACCEPT
$IP6TABLES -t mangle -P POSTROUTING ACCEPT
$IP6TABLES -t mangle -P INPUT ACCEPT
$IP6TABLES -t mangle -P OUTPUT ACCEPT
$IP6TABLES -t mangle -P FORWARD ACCEPT
$IP6TABLES -t mangle -F
$IP6TABLES -t mangle -X
$IP6TABLES -F
$IP6TABLES -X
}
# fw_clear remove the rule set from the firewall and keep the
# current default policy
fw_clear () {
$IP6TABLES -t mangle -F
$IP6TABLES -t mangle -X
$IP6TABLES -F
$IP6TABLES -X
}
case "$1" in
start|restart)
echo -n "Starting IPv6 firewall.."
fw_clear
fw_start
echo "done."
;;
stop)
echo -n "Stopping IPv6 firewall.."
fw_stop
echo "done."
;;
clear)
echo -n "Clearing IPv6 firewall rules.."
fw_clear
echo "done."
;;
test|safe-restart)
echo -n "Safely restarting IPv6 firewall..."
fw_clear
fw_start
test=""; read -t 10 -p "Is it still OK? " test ; \
[ -z "$test" ] && fw_stop
echo "done."
;;
*)
echo "Usage: $0 {start|stop|restart|safe-restart|clear}"
exit 1
;;
esac
exit 0
