#!/bin/sh
echo "configure /etc/firewall6.conf first."
exit 1

### Interfaces
WAN=sixxs
LAN=br0
WLAN=wlan0

######################################################################
### Default ruleset
######################################################################

### Create chains
ip6tables -N input_rule
ip6tables -N forwarding_rule

### Default policy
ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT DROP

### INPUT
###  (connections with the router as destination)

# base case
ip6tables -A INPUT -m state --state INVALID -j DROP
ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -A INPUT -p tcp --tcp-flags SYN SYN \! --tcp-option 2 -j DROP

# custom rules
ip6tables -A INPUT -j input_rule

# allow access from anything but WAN
ip6tables -A INPUT ${WAN:+\! -i $WAN} -j ACCEPT
# allow icmp messages
ip6tables -A INPUT -p icmp6 -j ACCEPT

# reject
ip6tables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
ip6tables -A INPUT -j REJECT --reject-with icmp6-port-unreachable

### OUTPUT
###  (connections with the router as source)

# base case
ip6tables -A OUTPUT -m state --state RELATED,ESTABLISHED,NEW -j ACCEPT
ip6tables -A OUTPUT -p icmp6 -j ACCEPT

### FORWARD
###  (connections routed through the router)

# base case
ip6tables -A FORWARD -m state --state INVALID -j DROP
ip6tables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

# fix for broken ISPs blocking ICMPv6 "packet too big" packets
#ip6tables -t mangle -A FORWARD -p tcp -o $WAN --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

# custom rules
ip6tables -A FORWARD -j forwarding_rule

# allow LAN
ip6tables -A FORWARD -i $LAN -o $WAN -j ACCEPT

######################################################################
### Default ruleset end
######################################################################

###
### Connections to the router
###

# ssh
#ip6tables -A input_rule -i $WAN -p tcp -s <a.b.c.d> --dport 22 -j ACCEPT

# IPSec
#ip6tables -A input_rule -i $WAN -p esp -s <a.b.c.d> -j ACCEPT
#ip6tables -A input_rule -i $WAN -p udp -s <a.b.c.d> --dport 500 -j ACCEPT

# OpenVPN
#ip6tables -A input_rule -i $WAN -p udp -s <a.b.c.d> --dport 1194 -j ACCEPT

# PPTP
#ip6tables -A input_rule -i $WAN -p gre -j ACCEPT
#ip6tables -A input_rule -i $WAN -p tcp --dport 1723 -j ACCEPT

###
###  VPN traffic
###

# IPSec
#ip6tables -A forwarding_rule -o ipsec+ -j ACCEPT
#ip6tables -A forwarding_rule -i ipsec+ -j ACCEPT

# OpenVPN
#ip6tables -A forwarding_rule -o tun+ -j ACCEPT
#ip6tables -A forwarding_rule -i tun+ -j ACCEPT