rules6-save 4.81 KB
Newer Older
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
1 2 3 4 5 6 7
# rules6-save generated by awall
*filter
:FORWARD DROP [0:0]
:INPUT DROP [0:0]
:OUTPUT DROP [0:0]
:icmp-routing - [0:0]
:logaccept-0 - [0:0]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
8
:logaccept-1 - [0:0]
9 10
:logaccept-2 - [0:0]
:logaccept-3 - [0:0]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
11 12
:logdrop-0 - [0:0]
:logdrop-1 - [0:0]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
13
:logdrop-2 - [0:0]
14 15
:logdrop-3 - [0:0]
:logdrop-4 - [0:0]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
16
:logpass-0 - [0:0]
17 18
:logpass-1 - [0:0]
:logpass-2 - [0:0]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
19 20 21 22 23 24 25 26 27 28
-A FORWARD -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A FORWARD -j ACCEPT
-A FORWARD -j logdrop-0
-A FORWARD 
-A FORWARD -j ACCEPT
-A FORWARD -j DROP
-A FORWARD 
-A FORWARD -j logaccept-0
-A FORWARD -j logdrop-1
-A FORWARD -j logpass-0
29 30 31 32 33 34
-A FORWARD -j logaccept-1
-A FORWARD -j logdrop-2
-A FORWARD -j logpass-1
-A FORWARD -j logaccept-2
-A FORWARD -j logdrop-3
-A FORWARD -j logpass-2
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
35 36 37
-A FORWARD -j ACCEPT
-A FORWARD -j DROP
-A FORWARD 
38 39
-A FORWARD -j logaccept-3
-A FORWARD -j logdrop-4
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65
-A FORWARD -i eth0 -j ACCEPT
-A FORWARD -o eth1 -d fc00::/7 -j ACCEPT
-A FORWARD -i eth0 -o eth1 -d fc00::/7 -j ACCEPT
-A FORWARD -i eth0 -o eth4 -j ACCEPT
-A FORWARD -i eth0 -o eth5 -j ACCEPT
-A FORWARD -i eth0 -m policy --dir out --pol ipsec -j ACCEPT
-A FORWARD -i eth1 -s fc00::/7 -o eth0 -j ACCEPT
-A FORWARD -i eth1 -s fc00::/7 -o eth4 -j ACCEPT
-A FORWARD -i eth1 -s fc00::/7 -o eth5 -j ACCEPT
-A FORWARD -i eth1 -s fc00::/7 -m policy --dir out --pol ipsec -j ACCEPT
-A FORWARD -i eth4 -o eth0 -j ACCEPT
-A FORWARD -i eth5 -o eth0 -j ACCEPT
-A FORWARD -i eth4 -o eth1 -d fc00::/7 -j ACCEPT
-A FORWARD -i eth5 -o eth1 -d fc00::/7 -j ACCEPT
-A FORWARD -i eth4 -o eth4 -j ACCEPT
-A FORWARD -i eth4 -o eth5 -j ACCEPT
-A FORWARD -i eth5 -o eth4 -j ACCEPT
-A FORWARD -i eth5 -o eth5 -j ACCEPT
-A FORWARD -i eth4 -m policy --dir out --pol ipsec -j ACCEPT
-A FORWARD -i eth5 -m policy --dir out --pol ipsec -j ACCEPT
-A FORWARD -m policy --dir in --pol ipsec -o eth0 -j ACCEPT
-A FORWARD -m policy --dir in --pol ipsec -o eth1 -d fc00::/7 -j ACCEPT
-A FORWARD -m policy --dir in --pol ipsec -o eth4 -j ACCEPT
-A FORWARD -m policy --dir in --pol ipsec -o eth5 -j ACCEPT
-A FORWARD -m policy --dir in --pol ipsec -m policy --dir out --pol ipsec -j ACCEPT
-A FORWARD -p icmpv6 -j icmp-routing
66
-A INPUT -j TEE --gateway fc00::2
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
67
-A INPUT -m limit --limit 1/second -j LOG
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
68 69 70 71 72 73 74 75 76 77 78
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j ACCEPT
-A INPUT -j logdrop-0
-A INPUT 
-A INPUT -j ACCEPT
-A INPUT -j DROP
-A INPUT 
-A INPUT -j logaccept-0
-A INPUT -j logdrop-1
-A INPUT -j logpass-0
79 80 81 82 83 84
-A INPUT -j logaccept-1
-A INPUT -j logdrop-2
-A INPUT -j logpass-1
-A INPUT -j logaccept-2
-A INPUT -j logdrop-3
-A INPUT -j logpass-2
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
85 86 87
-A INPUT -j ACCEPT
-A INPUT -j DROP
-A INPUT 
88 89
-A INPUT -j logaccept-3
-A INPUT -j logdrop-4
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
90 91 92 93 94 95 96 97 98 99 100 101 102 103
-A INPUT -i eth0 -j ACCEPT
-A INPUT -j ACCEPT
-A INPUT -p icmpv6 -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -j ACCEPT
-A OUTPUT -j logdrop-0
-A OUTPUT 
-A OUTPUT -j ACCEPT
-A OUTPUT -j DROP
-A OUTPUT 
-A OUTPUT -j logaccept-0
-A OUTPUT -j logdrop-1
-A OUTPUT -j logpass-0
104 105 106 107 108 109
-A OUTPUT -j logaccept-1
-A OUTPUT -j logdrop-2
-A OUTPUT -j logpass-1
-A OUTPUT -j logaccept-2
-A OUTPUT -j logdrop-3
-A OUTPUT -j logpass-2
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
110 111 112
-A OUTPUT -j ACCEPT
-A OUTPUT -j DROP
-A OUTPUT 
113 114
-A OUTPUT -j logaccept-3
-A OUTPUT -j logdrop-4
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
115 116 117 118 119 120 121 122 123
-A OUTPUT -j ACCEPT
-A OUTPUT -o eth1 -d fc00::/7 -j ACCEPT
-A OUTPUT -p icmpv6 -j ACCEPT
-A icmp-routing -p icmpv6 --icmpv6-type 1 -j ACCEPT
-A icmp-routing -p icmpv6 --icmpv6-type 2 -j ACCEPT
-A icmp-routing -p icmpv6 --icmpv6-type 3 -j ACCEPT
-A icmp-routing -p icmpv6 --icmpv6-type 4 -j ACCEPT
-A logaccept-0 -m limit --limit 1/second -j LOG
-A logaccept-0 -j ACCEPT
124 125
-A logaccept-1 -j LOG
-A logaccept-1 -j TEE --gateway fc00::1
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
126
-A logaccept-1 -j ACCEPT
127 128 129
-A logaccept-2 -j TEE --gateway fc00::2
-A logaccept-2 -j ACCEPT
-A logaccept-3 -j ACCEPT
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
130 131 132 133
-A logdrop-0 -m limit --limit 1/second -j LOG
-A logdrop-0 -j DROP
-A logdrop-1 -m limit --limit 1/second -j LOG
-A logdrop-1 -j DROP
134 135
-A logdrop-2 -j LOG
-A logdrop-2 -j TEE --gateway fc00::1
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
136
-A logdrop-2 -j DROP
137 138 139
-A logdrop-3 -j TEE --gateway fc00::2
-A logdrop-3 -j DROP
-A logdrop-4 -j DROP
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
140
-A logpass-0 -m limit --limit 1/second -j LOG
141 142 143
-A logpass-1 -j LOG
-A logpass-1 -j TEE --gateway fc00::1
-A logpass-2 -j TEE --gateway fc00::2
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167
COMMIT
*mangle
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:divert - [0:0]
-A INPUT -j MARK --set-mark 3
-A OUTPUT -j MARK --set-mark 1
-A POSTROUTING -o eth1 -d fc00::/7 -j MARK --set-mark 3
-A PREROUTING -m socket -j divert
-A PREROUTING -i eth1 -s fc00::/7 -p tcp --dport 80 -j TPROXY --tproxy-mark 1 --on-port 0
-A PREROUTING -i eth0 -j MARK --set-mark 1
-A divert -j MARK --set-mark 1
-A divert -j ACCEPT
COMMIT
*raw
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
-A OUTPUT -j CT --notrack
-A PREROUTING -i eth0 -j CT --notrack
-A PREROUTING -i eth1 -s fc00::/7 -j CT --notrack
-A PREROUTING -m addrtype --dst-type LOCAL -j CT --notrack
COMMIT