rules6-save 4.86 KB
Newer Older
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
1 2 3 4 5 6 7
# rules6-save generated by awall
*filter
:FORWARD DROP [0:0]
:INPUT DROP [0:0]
:OUTPUT DROP [0:0]
:icmp-routing - [0:0]
:logaccept-0 - [0:0]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
8
:logaccept-1 - [0:0]
9 10
:logaccept-2 - [0:0]
:logaccept-3 - [0:0]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
11 12
:logdrop-0 - [0:0]
:logdrop-1 - [0:0]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
13
:logdrop-2 - [0:0]
14 15
:logdrop-3 - [0:0]
:logdrop-4 - [0:0]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
16
:logpass-0 - [0:0]
17 18
:logpass-1 - [0:0]
:logpass-2 - [0:0]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
19 20 21 22 23 24 25 26 27 28
-A FORWARD -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A FORWARD -j ACCEPT
-A FORWARD -j logdrop-0
-A FORWARD 
-A FORWARD -j ACCEPT
-A FORWARD -j DROP
-A FORWARD 
-A FORWARD -j logaccept-0
-A FORWARD -j logdrop-1
-A FORWARD -j logpass-0
29 30 31 32 33 34
-A FORWARD -j logaccept-1
-A FORWARD -j logdrop-2
-A FORWARD -j logpass-1
-A FORWARD -j logaccept-2
-A FORWARD -j logdrop-3
-A FORWARD -j logpass-2
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
35 36 37
-A FORWARD -j ACCEPT
-A FORWARD -j DROP
-A FORWARD 
38 39
-A FORWARD -j logaccept-3
-A FORWARD -j logdrop-4
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65
-A FORWARD -i eth0 -j ACCEPT
-A FORWARD -o eth1 -d fc00::/7 -j ACCEPT
-A FORWARD -i eth0 -o eth1 -d fc00::/7 -j ACCEPT
-A FORWARD -i eth0 -o eth4 -j ACCEPT
-A FORWARD -i eth0 -o eth5 -j ACCEPT
-A FORWARD -i eth0 -m policy --dir out --pol ipsec -j ACCEPT
-A FORWARD -i eth1 -s fc00::/7 -o eth0 -j ACCEPT
-A FORWARD -i eth1 -s fc00::/7 -o eth4 -j ACCEPT
-A FORWARD -i eth1 -s fc00::/7 -o eth5 -j ACCEPT
-A FORWARD -i eth1 -s fc00::/7 -m policy --dir out --pol ipsec -j ACCEPT
-A FORWARD -i eth4 -o eth0 -j ACCEPT
-A FORWARD -i eth5 -o eth0 -j ACCEPT
-A FORWARD -i eth4 -o eth1 -d fc00::/7 -j ACCEPT
-A FORWARD -i eth5 -o eth1 -d fc00::/7 -j ACCEPT
-A FORWARD -i eth4 -o eth4 -j ACCEPT
-A FORWARD -i eth4 -o eth5 -j ACCEPT
-A FORWARD -i eth5 -o eth4 -j ACCEPT
-A FORWARD -i eth5 -o eth5 -j ACCEPT
-A FORWARD -i eth4 -m policy --dir out --pol ipsec -j ACCEPT
-A FORWARD -i eth5 -m policy --dir out --pol ipsec -j ACCEPT
-A FORWARD -m policy --dir in --pol ipsec -o eth0 -j ACCEPT
-A FORWARD -m policy --dir in --pol ipsec -o eth1 -d fc00::/7 -j ACCEPT
-A FORWARD -m policy --dir in --pol ipsec -o eth4 -j ACCEPT
-A FORWARD -m policy --dir in --pol ipsec -o eth5 -j ACCEPT
-A FORWARD -m policy --dir in --pol ipsec -m policy --dir out --pol ipsec -j ACCEPT
-A FORWARD -p icmpv6 -j icmp-routing
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
66
-A INPUT -j NFLOG --nflog-group 1 --nflog-size 128
67
-A INPUT -j TEE --gateway fc00::2
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
68
-A INPUT -m limit --limit 1/second -j LOG
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
69 70 71 72 73 74 75 76 77 78 79
-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j ACCEPT
-A INPUT -j logdrop-0
-A INPUT 
-A INPUT -j ACCEPT
-A INPUT -j DROP
-A INPUT 
-A INPUT -j logaccept-0
-A INPUT -j logdrop-1
-A INPUT -j logpass-0
80 81 82 83 84 85
-A INPUT -j logaccept-1
-A INPUT -j logdrop-2
-A INPUT -j logpass-1
-A INPUT -j logaccept-2
-A INPUT -j logdrop-3
-A INPUT -j logpass-2
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
86 87 88
-A INPUT -j ACCEPT
-A INPUT -j DROP
-A INPUT 
89 90
-A INPUT -j logaccept-3
-A INPUT -j logdrop-4
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
91 92 93 94 95 96 97 98 99 100 101 102 103 104
-A INPUT -i eth0 -j ACCEPT
-A INPUT -j ACCEPT
-A INPUT -p icmpv6 -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -j ACCEPT
-A OUTPUT -j logdrop-0
-A OUTPUT 
-A OUTPUT -j ACCEPT
-A OUTPUT -j DROP
-A OUTPUT 
-A OUTPUT -j logaccept-0
-A OUTPUT -j logdrop-1
-A OUTPUT -j logpass-0
105 106 107 108 109 110
-A OUTPUT -j logaccept-1
-A OUTPUT -j logdrop-2
-A OUTPUT -j logpass-1
-A OUTPUT -j logaccept-2
-A OUTPUT -j logdrop-3
-A OUTPUT -j logpass-2
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
111 112 113
-A OUTPUT -j ACCEPT
-A OUTPUT -j DROP
-A OUTPUT 
114 115
-A OUTPUT -j logaccept-3
-A OUTPUT -j logdrop-4
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
116 117 118 119 120 121 122 123 124
-A OUTPUT -j ACCEPT
-A OUTPUT -o eth1 -d fc00::/7 -j ACCEPT
-A OUTPUT -p icmpv6 -j ACCEPT
-A icmp-routing -p icmpv6 --icmpv6-type 1 -j ACCEPT
-A icmp-routing -p icmpv6 --icmpv6-type 2 -j ACCEPT
-A icmp-routing -p icmpv6 --icmpv6-type 3 -j ACCEPT
-A icmp-routing -p icmpv6 --icmpv6-type 4 -j ACCEPT
-A logaccept-0 -m limit --limit 1/second -j LOG
-A logaccept-0 -j ACCEPT
125 126
-A logaccept-1 -j LOG
-A logaccept-1 -j TEE --gateway fc00::1
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
127
-A logaccept-1 -j ACCEPT
128 129 130
-A logaccept-2 -j TEE --gateway fc00::2
-A logaccept-2 -j ACCEPT
-A logaccept-3 -j ACCEPT
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
131 132 133 134
-A logdrop-0 -m limit --limit 1/second -j LOG
-A logdrop-0 -j DROP
-A logdrop-1 -m limit --limit 1/second -j LOG
-A logdrop-1 -j DROP
135 136
-A logdrop-2 -j LOG
-A logdrop-2 -j TEE --gateway fc00::1
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
137
-A logdrop-2 -j DROP
138 139 140
-A logdrop-3 -j TEE --gateway fc00::2
-A logdrop-3 -j DROP
-A logdrop-4 -j DROP
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
141
-A logpass-0 -m limit --limit 1/second -j LOG
142 143 144
-A logpass-1 -j LOG
-A logpass-1 -j TEE --gateway fc00::1
-A logpass-2 -j TEE --gateway fc00::2
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168
COMMIT
*mangle
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:divert - [0:0]
-A INPUT -j MARK --set-mark 3
-A OUTPUT -j MARK --set-mark 1
-A POSTROUTING -o eth1 -d fc00::/7 -j MARK --set-mark 3
-A PREROUTING -m socket -j divert
-A PREROUTING -i eth1 -s fc00::/7 -p tcp --dport 80 -j TPROXY --tproxy-mark 1 --on-port 0
-A PREROUTING -i eth0 -j MARK --set-mark 1
-A divert -j MARK --set-mark 1
-A divert -j ACCEPT
COMMIT
*raw
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
-A OUTPUT -j CT --notrack
-A PREROUTING -i eth0 -j CT --notrack
-A PREROUTING -i eth1 -s fc00::/7 -j CT --notrack
-A PREROUTING -m addrtype --dst-type LOCAL -j CT --notrack
COMMIT