Return to ip6tables.rules CVS log | Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / testing / hosts / default / etc |
1.1 misho 1: *filter 2: 3: # default policy is DROP 4: -P INPUT DROP 5: -P OUTPUT DROP 6: -P FORWARD DROP 7: 8: # allow esp 9: -A INPUT -i eth0 -p 50 -j ACCEPT 10: -A OUTPUT -o eth0 -p 50 -j ACCEPT 11: 12: # allow IKE 13: -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT 14: -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT 15: 16: # allow MobIKE 17: -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT 18: -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT 19: 20: # allow last UDP fragment 21: -A INPUT -i eth0 -p udp -m frag --fraglast -j ACCEPT 22: 23: # allow ICMPv6 neighbor-solicitations 24: -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT 25: -A OUTPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT 26: 27: # allow ICMPv6 neighbor-advertisements 28: -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT 29: -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT 30: 31: # allow crl and certificate fetch from winnetou 32: -A INPUT -i eth0 -p tcp --sport 80 -s fec0::15 -j ACCEPT 33: -A OUTPUT -o eth0 -p tcp --dport 80 -d fec0::15 -j ACCEPT 34: 35: # log dropped packets 36: -A INPUT -j LOG --log-prefix " IN: " 37: -A OUTPUT -j LOG --log-prefix " OUT: " 38: 39: COMMIT