29 lines
1.6 KiB
Bash
Executable file
29 lines
1.6 KiB
Bash
Executable file
#!/bin/sh
|
|
iptables -F FIREWALL_FORWARD
|
|
iptables -Z FIREWALL_FORWARD
|
|
ip6tables -F FIREWALL_FORWARD
|
|
ip6tables -Z FIREWALL_FORWARD
|
|
iptables -t filter -A FIREWALL_FORWARD -i br+ -j RETURN
|
|
ip6tables -t filter -A FIREWALL_FORWARD -i br+ -j RETURN
|
|
iptables -t filter -A FIREWALL_FORWARD -i ! br+ -p udp -m iprange --dst-range 224.0.0.0-239.255.255.255 -j RETURN
|
|
iptables -t filter -A FIREWALL_FORWARD -i ! br+ -m state --state NEW,INVALID -j DROP
|
|
ip6tables -t filter -A FIREWALL_FORWARD -i ! br+ -m state --state NEW,INVALID -j DROP
|
|
|
|
iptables -F FIREWALL_INPUT
|
|
iptables -Z FIREWALL_INPUT
|
|
iptables -t filter -A FIREWALL_INPUT -p all -i lo -j ACCEPT
|
|
iptables -t filter -A FIREWALL_INPUT -p UDP -m multiport --dport 520 -j ACCEPT
|
|
ip6tables -F FIREWALL_INPUT
|
|
ip6tables -Z FIREWALL_INPUT
|
|
ip6tables -t filter -A FIREWALL_INPUT -p all -i lo -j ACCEPT
|
|
iptables -t filter -A FIREWALL_INPUT -i br+ -j RETURN
|
|
ip6tables -t filter -A FIREWALL_INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
|
|
ip6tables -t filter -A FIREWALL_INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
|
|
ip6tables -t filter -A FIREWALL_INPUT -p icmpv6 --icmpv6-type router-solicitation -j ACCEPT
|
|
ip6tables -t filter -A FIREWALL_INPUT -p icmpv6 --icmpv6-type router-advertisement -j ACCEPT
|
|
ip6tables -t filter -A FIREWALL_INPUT -i br+ -j RETURN
|
|
iptables -t filter -A FIREWALL_INPUT -i ! br+ -p UDP -m multiport --dport 67,68,500 -j RETURN
|
|
ip6tables -t filter -A FIREWALL_INPUT -i ! br+ -p UDP -m multiport --dport 546,547,500 -j RETURN
|
|
iptables -t filter -A FIREWALL_INPUT -i ! br+ -m state --state NEW,INVALID -j DROP
|
|
ip6tables -t filter -A FIREWALL_INPUT -i ! br+ -m state --state NEW,INVALID -j DROP
|
|
|