# ip6tables ruleset for the RackNerd VPN hub.
# The VPS has a public IPv6 address; all tunnel/VPN traffic is IPv4-only,
# so v6 is locked down to SSH + the same public services as v4.
# ${PUBIF} is substituted by host/setup.sh / Ansible.
# Installed to /etc/iptables/rules.v6 (iptables-persistent).

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP

# ICMPv6 is mandatory (NDP, PMTUD) — dropping it breaks IPv6 entirely
-A INPUT -p ipv6-icmp -j ACCEPT
# DHCPv6 replies from link-local, if the provider uses it
-A INPUT -s fe80::/10 -p udp --dport 546 -j ACCEPT

# Same public exposure as v4: SSH, WireGuard, OpenVPN — nothing else.
# Technitium :53/:5380 and RADIUS stay unreachable over v6.
-A INPUT -i ${PUBIF} -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -i ${PUBIF} -p udp --dport 51820 -j ACCEPT
-A INPUT -i ${PUBIF} -p udp --dport 1194 -j ACCEPT

COMMIT