From 94d1fb39630a443f35811e18f72098e5e5dc6976 Mon Sep 17 00:00:00 2001 From: Bob Mottram Date: Sun, 14 Jan 2018 12:36:04 +0000 Subject: [PATCH] Additional mesh ipv6 firewall configuration --- src/freedombone-utils-firewall | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/freedombone-utils-firewall b/src/freedombone-utils-firewall index f9b02827..2a369c3c 100755 --- a/src/freedombone-utils-firewall +++ b/src/freedombone-utils-firewall @@ -350,28 +350,42 @@ function mesh_firewall { echo 'iptables -P INPUT DROP' >> $MESH_FIREWALL_SCRIPT echo 'ip6tables -P INPUT DROP' >> $MESH_FIREWALL_SCRIPT echo 'iptables -A INPUT -i lo -j ACCEPT' >> $MESH_FIREWALL_SCRIPT + echo 'ip6tables -A INPUT -i lo -j ACCEPT' >> $MESH_FIREWALL_SCRIPT echo 'iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT' >> $MESH_FIREWALL_SCRIPT + echo 'ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT' >> $MESH_FIREWALL_SCRIPT echo '' >> $MESH_FIREWALL_SCRIPT echo '# Make sure incoming tcp connections are SYN packets' >> $MESH_FIREWALL_SCRIPT echo 'iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP' >> $MESH_FIREWALL_SCRIPT + echo 'ip6tables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP' >> $MESH_FIREWALL_SCRIPT echo '' >> $MESH_FIREWALL_SCRIPT echo '# Drop packets with incoming fragments' >> $MESH_FIREWALL_SCRIPT echo 'iptables -A INPUT -f -j DROP' >> $MESH_FIREWALL_SCRIPT + echo 'ip6tables -A INPUT -f -j DROP' >> $MESH_FIREWALL_SCRIPT echo '' >> $MESH_FIREWALL_SCRIPT echo '# Drop bogons' >> $MESH_FIREWALL_SCRIPT echo 'iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP' >> $MESH_FIREWALL_SCRIPT + echo 'ip6tables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP' >> $MESH_FIREWALL_SCRIPT echo 'iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP' >> $MESH_FIREWALL_SCRIPT + echo 'ip6tables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP' >> $MESH_FIREWALL_SCRIPT echo 'iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP' >> $MESH_FIREWALL_SCRIPT + echo 'ip6tables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP' >> $MESH_FIREWALL_SCRIPT echo '' >> $MESH_FIREWALL_SCRIPT echo '# Incoming malformed NULL packets:' >> $MESH_FIREWALL_SCRIPT echo 'iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP' >> $MESH_FIREWALL_SCRIPT + echo 'ip6tables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP' >> $MESH_FIREWALL_SCRIPT echo '' >> $MESH_FIREWALL_SCRIPT echo "iptables -A INPUT -p tcp --dport $TOX_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT + echo "ip6tables -A INPUT -p tcp --dport $TOX_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $ZERONET_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT + echo "ip6tables -A INPUT -i $WIFI_INTERFACE -p udp --dport $ZERONET_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT echo "iptables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $ZERONET_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT + echo "ip6tables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $ZERONET_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport $TRACKER_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT + echo "ip6tables -A INPUT -i $WIFI_INTERFACE -p udp --dport $TRACKER_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT echo "iptables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $TRACKER_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT + echo "ip6tables -A INPUT -i $WIFI_INTERFACE -p tcp --dport $TRACKER_PORT -j ACCEPT" >> $MESH_FIREWALL_SCRIPT echo "iptables -A INPUT -i $WIFI_INTERFACE -p udp --dport 1900 -j ACCEPT" >> $MESH_FIREWALL_SCRIPT + echo "ip6tables -A INPUT -i $WIFI_INTERFACE -p udp --dport 1900 -j ACCEPT" >> $MESH_FIREWALL_SCRIPT chmod +x $MESH_FIREWALL_SCRIPT echo '[Unit]' > $FIREWALL_FILENAME