28 lines
1.0 KiB
Plaintext
28 lines
1.0 KiB
Plaintext
# ip6tables ruleset for the RackNerd VPN hub.
|
|
# The VPS has a public IPv6 address; all tunnel/VPN traffic is IPv4-only,
|
|
# so v6 is locked down to SSH + the same public services as v4.
|
|
# ${PUBIF} is substituted by host/setup.sh / Ansible.
|
|
# Installed to /etc/iptables/rules.v6 (iptables-persistent).
|
|
|
|
*filter
|
|
:INPUT DROP [0:0]
|
|
:FORWARD DROP [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
|
|
-A INPUT -i lo -j ACCEPT
|
|
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
-A INPUT -m conntrack --ctstate INVALID -j DROP
|
|
|
|
# ICMPv6 is mandatory (NDP, PMTUD) — dropping it breaks IPv6 entirely
|
|
-A INPUT -p ipv6-icmp -j ACCEPT
|
|
# DHCPv6 replies from link-local, if the provider uses it
|
|
-A INPUT -s fe80::/10 -p udp --dport 546 -j ACCEPT
|
|
|
|
# Same public exposure as v4: SSH, WireGuard, OpenVPN — nothing else.
|
|
# Technitium :53/:5380 and RADIUS stay unreachable over v6.
|
|
-A INPUT -i ${PUBIF} -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
|
|
-A INPUT -i ${PUBIF} -p udp --dport 51820 -j ACCEPT
|
|
-A INPUT -i ${PUBIF} -p udp --dport 1194 -j ACCEPT
|
|
|
|
COMMIT
|