next ai changes

host/rules.v6.template

@@ -0,0 +1,27 @@
+# ip6tables ruleset for the RackNerd VPN hub.
+# The VPS has a public IPv6 address; all tunnel/VPN traffic is IPv4-only,
+# so v6 is locked down to SSH + the same public services as v4.
+# ${PUBIF} is substituted by host/setup.sh / Ansible.
+# Installed to /etc/iptables/rules.v6 (iptables-persistent).
+
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+-A INPUT -m conntrack --ctstate INVALID -j DROP
+
+# ICMPv6 is mandatory (NDP, PMTUD) — dropping it breaks IPv6 entirely
+-A INPUT -p ipv6-icmp -j ACCEPT
+# DHCPv6 replies from link-local, if the provider uses it
+-A INPUT -s fe80::/10 -p udp --dport 546 -j ACCEPT
+
+# Same public exposure as v4: SSH, WireGuard, OpenVPN — nothing else.
+# Technitium :53/:5380 and RADIUS stay unreachable over v6.
+-A INPUT -i ${PUBIF} -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
+-A INPUT -i ${PUBIF} -p udp --dport 51820 -j ACCEPT
+-A INPUT -i ${PUBIF} -p udp --dport 1194 -j ACCEPT
+
+COMMIT