11 IPTABLES
="echo ${IPTABLES}"
12 IP6TABLES
="echo ${IP6TABLES}"
18 echo "Usage: $(basename "$0") external_interface" 1>&2
23 if ! ip link show
"${EXT_IF}" >/dev
/null
2>&1
25 echo "'${EXT_IF}' does not seem to be a valid interface"
38 $IPTABLES -P INPUT DROP
39 $IPTABLES -P OUTPUT ACCEPT
41 $IP6TABLES -P INPUT DROP
42 $IP6TABLES -P OUTPUT ACCEPT
44 # accept local traffic
45 $IPTABLES -A INPUT
-i lo
-j ACCEPT
46 $IP6TABLES -A INPUT
-i lo
-j ACCEPT
49 $IPTABLES -A INPUT
-p icmp
-j ACCEPT
50 $IP6TABLES -A INPUT
-p ipv6
-icmp -j ACCEPT
52 # drop source-route rh0 headery things
53 $IP6TABLES -A INPUT
-m rt
--rt-type 0 -j DROP
|| echo "MISSING RT MATCH" 1>&2
55 # accept things we set up
56 $IPTABLES -A INPUT
-m conntrack
--ctstate RELATED
,ESTABLISHED
-j ACCEPT
57 $IP6TABLES -A INPUT
-m conntrack
--ctstate RELATED
,ESTABLISHED
-j ACCEPT
59 # accept ipv6 link-local traffic
60 $IP6TABLES -A INPUT
-s fe80
::/10 -j ACCEPT
62 # accept ipv6 multicast
63 $IP6TABLES -A INPUT
-s ff00
::/8 -j ACCEPT
65 # log and drop invalid flag combinations
66 for flags
in 'ALL FIN,URG,PSH' 'ALL ALL' 'ALL SYN,RST,ACK,FIN,URG' 'ALL NONE' 'SYN,RST SYN,RST' 'SYN,FIN SYN,FIN'
68 $IPTABLES -A INPUT
-p tcp
--tcp-flags ${flags} -j DROP
71 # accept ESP for IPSec
72 $IPTABLES -A INPUT
-p esp
-j ACCEPT
73 $IP6TABLES -A INPUT
-p esp
-j ACCEPT
75 # accept all IPSec traffic
76 $IPTABLES -A INPUT
-m policy
--dir in --pol ipsec
-j ACCEPT
77 $IP6TABLES -A INPUT
-m policy
--dir in --pol ipsec
-j ACCEPT
79 .
/services.sh
${EXT_IF}
81 create_drop_chain xenophobe
86 # insert persistent-pest-blocker
89 # insert trusted passes