~fkooman/vpn-documentation

ref: 13ed958d65981a2744683ffbffae1c0d2c51e36d vpn-documentation/resources/firewall/ip6tables -rw-r--r-- 1.8 KiB
13ed958dFrançois Kooman make clear that "the only difference" now refers only to OAuth 5 months ago
                                                                                
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
##########
# FILTER #
##########
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

#########
# INPUT #
#########
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT

# SSH
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
# HTTP
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
# HTTPS
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
# OpenVPN
-A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1194 -j ACCEPT
# More OpenVPN ports
#-A INPUT -p udp -m state --state NEW -m udp --dport 1194:1197 -j ACCEPT
#-A INPUT -p tcp -m state --state NEW -m tcp --dport 1194:1197 -j ACCEPT
# Local DNS for VPN clients
#-A INPUT -s fd00::/8 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
#-A INPUT -s fd00::/8 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp6-adm-prohibited

###########
# FORWARD #
###########
-A FORWARD -i tun+ ! -o tun+ -j ACCEPT
-A FORWARD ! -i tun+ -o tun+ -j ACCEPT

# Be more specific through which interfaces routing is allowed
#-A FORWARD -i tun+ -o eth0 -j ACCEPT
#-A FORWARD -i eth0 -o tun+ -j ACCEPT

# Do not allow VPN clients to be contacted from the outside
#-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
#-A FORWARD -i tun+ -o eth0 -j ACCEPT

-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited
COMMIT

#######
# NAT #
#######
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

-A POSTROUTING -s fd00::/8 -j MASQUERADE
#-A POSTROUTING -s fd00::/8 -j SNAT --to-source 2001:db8::1
# Distribute NAT over IPs between 2001:db8::1 and 2001:db8::4 (inclusive)
#-A POSTROUTING -s fd00::/8 -j SNAT --to-source 2001:db8::1-2001:db8::4
COMMIT