#!/bin/bash
### BEGIN INIT INFO
# Provides:          firewall-ipv6
# Required-Start:    $remote_fs $syslog
# Required-Stop:     $remote_fs $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start daemon at boot time
# Description:       Enable service provided by daemon.
### END INIT INFO

# https://doc.ubuntu-fr.org/creer_un_service_avec_systemd

# --------------------------------------------------------------------------
# Author : O.Romain.Jaillet-ramey (orj@lab3w.fr)
# Description : Firewall IPv6 ICMPv6 - ULA / MULTICAST / SWAN
# Date Created : 2020-02-07
# Date Modified : 2026-09-09
# ------------------------------

#####-------------------------- VARIABLES ----------------------------######

# ip6tables command path

IP6TABLE="/sbin/ip6tables"

# Interface network

LOOP_IF="lo"

NET_IF="eth0"
VPN_IF="eth0"

INCUS_IF="incusbr0"
LXC_IF="lxcbr0"

# Addresses IPv6

NET_IP="2a02:4780:28:5295:0000:0000:0000:0001"
VPN_IP="fee1::1"

INCUS_IP="fc00:4780:28:5295::fd"
LXC_IP="fc00::10:0:3:fd"

# Networks IPv6

LAN_IPs="fc00::10:0:0:0/80 fc00::172:16:0:0/104 fc00::192:168:0:0/104 fc01::10:0:0:0/80 fc01::172:16:0:0/104 fc01::192:168:1:0/104"
SLAN_IPs="fee0::/16 fee1::/16"

# SSH service port

port_ssh="22"

# TCP and UDP ports to open

TCP_OK="514 4949 5201" # SYSLOG MUNIN IPERF
UDP_OK="123 161 514 546 547" # NTP SNMP SYSLOG DHCP

# IPs that normally have SSH access to the server

SSH_OK="fc00::/7 fec0::/10"

# IPs that normally have RSYNC access to the server

RSYNC_OK="fc00::/7 fec0::/10"

# ------------------------------

WAN_ADDR="${NET_IP} ${VPN_IP}"

#####-------------------------- VARIABLES ----------------------------######


#####-------------------------- FONCTIONS ----------------------------######

#####
# Set sysctl parameters
#####
function kernel()
{
        # Don't accept source routed packets.
        /bin/echo "0" > /proc/sys/net/ipv6/conf/all/accept_source_route

         # Disable ICMP redirect acceptance.
        /bin/echo "0" > /proc/sys/net/ipv6/conf/all/accept_redirects

        # Enable the following lines only if a router!
        # Enabling IPv6 forwarding disables route-advertisement reception.
        # A static gateway will need to be assigned.
        #
        echo "1" >/proc/sys/net/ipv6/conf/all/forwarding
        #
        #End router forwarding rules

        echo "   "+ KERNEL : [OK]
}

#####
# We log the rest of the communications
#####

function logging()
{
        # Log
        $IP6TABLE -A INPUT -j LOG --log-prefix "INPUT-v6:"
        $IP6TABLE -A FORWARD -j LOG  --log-prefix "FORWARD-v6:"
        $IP6TABLE -A OUTPUT -j LOG  --log-prefix "OUTPUT-v6:"

        echo "   "+ LOGGING  : [OK]
}

#####
# We accept everything from and for the local "lo"
#####

function loopback()
{
        $IP6TABLE -A INPUT  -i lo -j ACCEPT
        $IP6TABLE -A FORWARD  -i lo -j ACCEPT
        $IP6TABLE -A FORWARD  -o lo -j ACCEPT
        $IP6TABLE -A OUTPUT -o lo -j ACCEPT

        echo "   "+ LOOPBACK : [OK]
}

#####
# We set the general rules (DROP||ACCEPT)
#####

function policy()
{
        $IP6TABLE -P INPUT $1
        $IP6TABLE -P FORWARD $1
        $IP6TABLE -P OUTPUT $1

        echo "   "+ POLICY $1 : [OK]
}

#####
# Set the RT (routage) rules (DROP||ACCEPT)
#####

function policy_rt()
{
        # Filter all packets that have RH0 headers:
        $IP6TABLE -A INPUT -m rt --rt-type 0 --rt-segsleft :2 -j LOG --log-prefix "IPv6-RH0-ATTACK-2-HOPS: "
        $IP6TABLE -A INPUT -m rt --rt-type 0 --rt-segsleft :2 --rt-0-addrs ::1,::2 --rt-0-not-strict -j $1


        $IP6TABLE -A INPUT -m rt --rt-type 0 --rt-segsleft 0 -j LOG --log-prefix "IPv6-RH0-ATTACK: "
        ip6tables -A INPUT -m rt --rt-type 0 --rt-segsleft 0 -j $1
        ip6tables -A FORWARD -m rt --rt-type 0 --rt-segsleft 0 -j $1
        ip6tables -A OUTPUT -m rt --rt-type 0 --rt-segsleft 0 -j $1

        echo "   "+ POLICY RT $1 : [OK]
}

#####
# Set the RT (routage) rules (DROP||ACCEPT)
#####

function mypolicy_rt()
{
        # https://manpages.debian.org/testing/manpages-fr/iptables-extensions.8.fr.html
        # 6. Les nouveaux match IPv6 pour netfilter : https://www.netfilter.org/documentation/HOWTO/fr/netfilter-extensions-HOWTO.html#toc6.7 and more

        # Role: Checks for the presence of specific IPv6 addresses in the header's Type 0 routing path.
        # - Syntax: --rt-0-addrs ADDR[,ADDR...] (accepts up to 16 addresses).
        # - Strict mode: Matching is strict by default. Use the --rt-0-not-strict option if the order or exclusive presence of the addresses in the list does not need to be strictly identical.

        # Usage example:
        # - To drop (DROP) packets with a Type 0 routing header where the path contains the addresses ::1 and ::2, without enforcing a strict order:

        # ip6tables -A INPUT -m rt --rt-type 0 --rt-segsleft :2 --rt-0-addrs ::1,::2 --rt-0-not-strict -j $1

        echo "   "+ EXAMPLE POLICY RT $1 : [OK]
}


#####
# Block SYN-ACK type attacks
#####

function synflood()
{
        ## SYN-FLOODING PROTECTION
        $IP6TABLE -N Syn-FLOOD
        # tcp flags:0x17/0x02
        $IP6TABLE -A INPUT -i $NET_IF -p tcp --syn -j Syn-FLOOD
        $IP6TABLE -A Syn-FLOOD -m limit --limit 1/s --limit-burst 4 -j RETURN
        $IP6TABLE -A Syn-FLOOD -j DROP
        ## Make sure NEW tcp connections are SYN packets
        # tcp flags:!0x17/0x02 state NEW
        $IP6TABLE -I INPUT -i $NET_IF -p tcp ! --syn -m state --state NEW -j DROP
        ########

        ########
        # ip6tables v1.8.11 (nf_tables): `-f' is not supported in IPv6, use -m frag instead
#        $IP6TABLE -A INPUT -f -j DROP
        $IP6TABLE -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
        $IP6TABLE -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

        echo "   "+ SYNFLOOD PROTECTION : [OK]
}

#####
# Accepts responses to requests sent from itself.
#####

function generique()
{
        # Allow established, related packets back in
        $IP6TABLE -A INPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
        $IP6TABLE -A OUTPUT -j ACCEPT

        echo "   "+ GENERIQUE : [OK]

}

#####
# Set the rules for IPv6 addresses
#####

function ipv6_link_local()
{
        echo "   |";
        echo "   + IPv6 - Addrs Link-Local Unicast -----------------------";

        # Allow Link-Local addresses
        # network range : fe80:0000:0000:0000:0000:0000:0000:0000-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff

        echo "   |\\";
        $IP6TABLE -A INPUT -s fe80::/10 -j ACCEPT
        $IP6TABLE -A FORWARD -s fe80::/10 -d fe80::/10 -j ACCEPT
        $IP6TABLE -A OUTPUT -d fe80::/10 -j ACCEPT
        echo "   | +--→ "fe80::/10 : ACCEPT;
        echo "   | |";
        echo "   | "+ IPv6 - Addrs Link-Local : [OK]

}

#####
# Set rules for Multicast
#####

function ipv6_multicast()
{
        echo "   |";
        echo "   + IPv6 - Addrs Multicast -----------------------";

        # Allow multicast
        # network range : ff00:0000:0000:0000:0000:0000:0000:0000-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff

        echo "   |\\";
        $IP6TABLE -A INPUT -d ff00::/8 -j ACCEPT
        $IP6TABLE -A FORWARD -s ff00::/8 -d ff00::/8 -j ACCEPT
        $IP6TABLE -A OUTPUT -d ff00::/8 -j ACCEPT

        echo "   | +--→ "ff00::/8 : ACCEPT;
        echo "   | |";
        echo "   |" + IPv6 - Addrs Multicast : [OK]
}

#####
# Set the rules for (ULA) Local IPv6 addresses (DROP||ACCEPT)
#####

function ipv6_ula()
{
        echo "   |";
        echo "   + IPv6 - Addrs Unique Locale Area -----------------------";

        # Allow Link-Local addresses
        # network range : fe80:0000:0000:0000:0000:0000:0000:0000-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff

        echo "   |\\";
        $IP6TABLE -A INPUT -s fc00::/7 -j $1
        $IP6TABLE -A FORWARD -s fc00::/7 -d fc00::/7 -j $1
        $IP6TABLE -A OUTPUT -d fc00::/7 -j DROP

        echo "   | +--→ "fc00::/7 : DROP;
        echo "   | |";
        echo "   |" + IPv6 - Addrs Unique Locale Area : [OK]

}

#####
# Set rules for (SLA) secure IPv6 addresses  (DROP||ACCEPT)
#####

function ipv6_strongswan()
{
        # Default ------------------
        echo "   |";
        echo "   + IPv6 - Addrs Site-Local Secure Area Network -------------------------";

        # Allow  Secure Area Network addresses
        # network range : fec0:0000:0000:0000:0000:0000:0000:0000-feff:ffff:ffff:ffff:ffff:ffff:ffff:ffff

        echo "   |\\";
        $IP6TABLE -A INPUT -s fec0::/10 -j $1
        $IP6TABLE -A FORWARD -s fec0::/10 -d fec0::/10 -j $1
        $IP6TABLE -A OUTPUT -d fec0::/10 -j $1
        echo "   | +--→ "fec0::/10 : DROP;
        echo "   | |";
        echo "   | "+ IPv6 - Addrs Secure Area Network : [OK]

        # Add ------------------

        echo "   |";
        # Allow  Forwarding SLAN (fec0::/10) <> ULA (fc00::/7)
        # network range : fc00:0000:0000:0000:0000:0000:0000:0000-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff

        echo "   + IPv6 - Forwarding Addrs SWAN 2 ULA Networks -------------------------";
        echo "   |\\";
        $IP6TABLE -A FORWARD -s fec0::/10 -d fc00::/7 -j ACCEPT
        $IP6TABLE -A FORWARD -d fec0::/10 -s fc00::/7 -j ACCEPT

#       $IP6TABLE -I FORWARD -s fec0::/10 -d fc00::/7 -p icmpv6 -j ACCEPT
#       $IP6TABLE -I FORWARD -d fec0::/10 -s fc00::/7 -p icmpv6 -j ACCEPT

        echo "   | +--→ fec0::/10 <←> fc00::/7 : ACCEPT";
        echo "   | |";
        echo "   | "+ IPv6 - Forwarding Addrs SWAN 2 ULA Networks : [OK]
        echo "   |";

}

#####
# Set rules for your Local IPv6 addresses (ULA)
#####

function ipv6_lan()
{
        echo "   |";
        echo "   + IPv6 - Addrs Unique Locale Area - On Site -----------------------";

        # Allow Link-Local addresses
        # network range : fe80:0000:0000:0000:0000:0000:0000:0000-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff

        echo "   |\\";
        for ip in $LAN_IPs ;
        do

        $IP6TABLE -A INPUT -s $ip -j ACCEPT
        $IP6TABLE -A FORWARD -s $ip -d fc00::/7 -j ACCEPT
        $IP6TABLE -A FORWARD -d $ip -s fc00::/7 -j ACCEPT

        $IP6TABLE -A FORWARD -s $ip -d fec0::/10 -j ACCEPT
        $IP6TABLE -A FORWARD -d $ip -s fec0::/10 -j ACCEPT

        $IP6TABLE -A OUTPUT -d $ip -j ACCEPT

        echo "   | +--→ "$ip : ACCEPT;

        done

        echo "   | |";
        echo "   |" + IPv6 - Addrs Unique Locale Area - On Site : [OK]

}

#####
# Set rules for your secure IPv6 addresses (SLA)
#####

function ipv6_slan()
{
        echo "   |";
        echo "   + IPv6 - Addrs Unique Locale Area - On Secure Sites -----------------------";

        # Allow Link-Local addresses
        # network range : fe80:0000:0000:0000:0000:0000:0000:0000-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff

        echo "   |\\";
        for ip in $SLAN_IPs ;
        do

        $IP6TABLE -A INPUT -s $ip -j ACCEPT
        $IP6TABLE -A FORWARD -s $ip -d fc00::/7 -j ACCEPT
        $IP6TABLE -A FORWARD -d $ip -s fc00::/7 -j ACCEPT

        $IP6TABLE -A FORWARD -s $ip -d fec0::/10 -j ACCEPT
        $IP6TABLE -A FORWARD -d $ip -s fec0::/10 -j ACCEPT

        $IP6TABLE -A OUTPUT -d $ip -j ACCEPT

        echo "   | +--→ "$ip : ACCEPT;

        done

        echo "   | |";
        echo "   |" + IPv6 - Addrs Unique Locale Area - On Secure Sites : [OK]

}


#####
# Global Unicast IPv6 addresses are accepted; they can be audited.
#####

function ipv6_addrs()
{
        echo "   |";
        echo "   + IPv6 - Addrs WAN ----------------------------------------------------";
        echo "   |\\";

        for ip in ${WAN_ADDR};
        do
                # Allow established, related packets back in
#                $IP6TABLE -A INPUT  -d $ip -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
                $IP6TABLE -A INPUT  -d $ip -j ACCEPT
                # Allow anything out on the internet
                $IP6TABLE -A OUTPUT -s $ip -j ACCEPT

                echo "   | +--> "${ip} : ACCEPT;
        done
        echo "   | |";
        echo "   | "+ IPv6 - Addrs WAN : [OK]
        echo "   |";
}


####
# Stéphane Bortzmeyer's rule: DROP ICMP LIMIT 1/sec per IPv6 /128
# To be inserted after the aICMPv6 chain (so it takes precedence via -I)
####

function icmpv6_limit()
{

        $IP6TABLE -I INPUT -p icmpv6 --icmpv6-type echo-request \
                -m hashlimit --hashlimit-name ICMP \
                --hashlimit-above 1/second --hashlimit-burst 1 \
                --hashlimit-mode srcip \
                --hashlimit-srcmask 128 -j DROP

        echo "   "+ ICMPV6 - LIMIT 1/second DROP : [OK]
}

#####
# Script to capture ICMPv6 packets by type, by Stephane Huc
#####

function icmpv6_huc()
{
        # Allow dedicated  ICMPv6 packettypes, do this in an extra chain because we need it everywhere
        $IP6TABLE -N aICMPs
        # Destination unreachable
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 1 -j ACCEPT # destination-unreachable; Must Not Be Dropped
        # Packet too big
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 2/0 -j ACCEPT # packet too big; Must Not Be Dropped
        # Time exceeded
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 3/0 -j ACCEPT # time exceeded
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 3/1 -j ACCEPT # time exceeded
        # Parameter problem
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 4/0 -j ACCEPT # parameter pb: Erroneous header field encountered
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 4/1 -j ACCEPT # parameter pb: Unrecognized Next Header Type encountered
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 4/2 -j ACCEPT # parameter pb: Unrecognized IPv6 option encountered

        # Echo Request (protect against flood)
#       $IP6TABLE -I aICMPs -p icmpv6 --icmpv6-type 128/0 -m hashlimit --hashlimit-name ICMP --hashlimit-above 1/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-srcmask 128 -j DROP
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 128/0 -j ACCEPT
#        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 128/0 -m limit --limit 1/sec --limit-burst 1 -j ACCEPT # ping tool: echo request message
        # Echo Reply
#        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 129/0 -m limit --limit 1/sec --limit-burst 1 -j ACCEPT # ping tool: echo reply message
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 129/0 -j ACCEPT
        echo "   "+ ICMPV6 - DEFAULT : [OK]

        # link-local multicast receive notification mssg (need link-local src address, with hop-limit: 1)
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 130/0 -s fe80::/64 -m conntrack --ctstate NEW -m hl --hl-eq 1 -j ACCEPT
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 131/0 -s fe80::/64 -m conntrack --ctstate NEW -m hl --hl-eq 1 -j ACCEPT
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 132/0 -s fe80::/64 -m conntrack --ctstate NEW -m hl --hl-eq 1 -j ACCEPT
        echo "   "+ ICMPV6 - LINK-LOCAL : [OK]

        # address configuration and routeur selection mssg (received with hop limit = 255)
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 133/0 -m hl --hl-eq 255 -j ACCEPT # Router Solicitation
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 134/0 -s fe80::/64 -m hl --hl-eq 255 -j ACCEPT # Router Advertisement
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255 -j ACCEPT # Neighbor Solicitation
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255 -j ACCEPT # Neighbor Advertisement

        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 137/0 -j DROP # Redirect Message
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 138/0 -j DROP # Router Renumbering (Rechargement du routeur)

        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 139/0 -j DROP # ICMP Node Information Query
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 140/0 -j DROP # ICMP Node Information Response

        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 141/0 -d ff02::1 -m hl --hl-eq 255 -j ACCEPT # Inverse Neighbor Discovery Solicitation Message
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 142/0 -m hl --hl-eq 255 -j ACCEPT # Inverse Neighbor Discovery Advertisement Message
        echo "   "+ ICMPV6 - ADD CONF '&' ROUTEUR SELECTION : [OK]

        # link-local multicast receive notification mssg (need link-local src address, with hop-limit: 1)
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 143 -s fe80::/64 -m conntrack --ctstate NEW -m hl --hl-eq 1 -j ACCEPT
        # needed for mobylity
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 144/0 -j DROP
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 145/0 -j DROP
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 146/0 -j DROP
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 147 -j DROP
        # SEND certificate path notification mssg (received with hop limit = 255)
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -j ACCEPT # Certification Path Solicitation Message
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -j ACCEPT # Certification Path Advertisement Message
        # multicast routeur discovery mssg (need link-local src address and hop limit = 1)
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 151 -s fe80::/64 -m conntrack --ctstate NEW -m hl --hl-eq 1 -j ACCEPT
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 152 -s fe80::/64 -m conntrack --ctstate NEW -m hl --hl-eq 1 -j ACCEPT
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 153 -s fe80::/64 -m conntrack --ctstate NEW -m hl --hl-eq 1 -j ACCEPT
        echo "   "+ ICMPV6 - MULTICAST ROUTEUR DISCOVERY : [OK]
        #
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 200 -j DROP # private experimentation
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 201 -j DROP # private experimentation
        $IP6TABLE -A aICMPs -p icmpv6 --icmpv6-type 255 -j DROP # expansion error messages ICMPv6
        echo "   "+ ICMPV6 - EXPERIMENTATION : [OK]

        #
        # Only the ROUTEUR is allowed to ping us (read FAQ this is a requirement)

#        $IP6TABLE -A INPUT -p icmpv6 -m limit --limit 5/s --limit-burst 4 -j aICMPs
#        $IP6TABLE -A OUTPUT -m state ! --state INVALID -j aICMPs
#       $IP6TABLE -A FORWARD -p icmpv6 -j ACCEPT


        $IP6TABLE -I INPUT -p icmpv6 -j aICMPs
        $IP6TABLE -I FORWARD -p icmpv6 -j aICMPs
        $IP6TABLE -I OUTPUT -p icmpv6 -j aICMPs

        echo "   "+ ICMPV6 - INLIMIT + OUTPUT : [OK]
}

#####
# Enable SSH access for specific IPs + limit access to 3 hits per minute/IP
#####

function ssh_ok()
{
        for host in $SSH_OK
        do
                $IP6TABLE -A INPUT -s $host -p tcp --dport $port_ssh -j ACCEPT
                $IP6TABLE -A OUTPUT -d $host -p tcp --sport $port_ssh -j ACCEPT
        done

        $IP6TABLE -A INPUT -p tcp --dport $port_ssh -m state --state NEW -m recent --set --name SSH
        $IP6TABLE -A INPUT -p tcp --dport $port_ssh -m recent --update --seconds 60 --hitcount 3 --rttl --name SSH -j DROP
        $IP6TABLE -A INPUT -p tcp --dport $port_ssh -j ACCEPT

        echo "   "+ SSH : [OK]
}

#####
# Enabling RSYNC access for specific IPs
#####

function rsync_ok()
{
        for host in $RSYNC_OK
        do
        $IP6TABLE -A INPUT -s $host -p tcp --dport 873 -j ACCEPT
        $IP6TABLE -A INPUT -s $host -p udp --dport 873 -j ACCEPT
        $IP6TABLE -A OUTPUT -d $host -p tcp --sport 873 -j ACCEPT
        $IP6TABLE -A OUTPUT -d $host -p udp --sport 873 -j ACCEPT
        done

        echo "   "+ RSYNC : [OK]
}

#####
# Opening TCP and UDP ports
#####

function tcp_ok()
{
        for port in $TCP_OK
        do
        $IP6TABLE -A INPUT -p tcp --dport $port -j ACCEPT
        $IP6TABLE -A OUTPUT -p tcp --sport $port -j ACCEPT
        done

        echo "   "+ TCP : [OK]
}

function udp_ok()
{
        for port in $UDP_OK
        do
        $IP6TABLE -A INPUT -p udp --dport $port -j ACCEPT
        $IP6TABLE -A OUTPUT -p udp --sport $port -j ACCEPT
        done

        echo "   "+ UDP : [OK]
}

#####
# opening HTTP(S) access
#####

function server_http()
{
        HTTP_PORTS="80 443 8443"
        for port in $HTTP_PORTS
        do
                $IP6TABLE -A INPUT -m state --state NEW -m tcp -p tcp --dport $port -j ACCEPT
                $IP6TABLE -A OUTPUT -m state --state ESTABLISHED,RELATED -m tcp -p tcp --sport $port -j ACCEPT
        done
        echo "   "+ HTTP : [OK]
}

#####
# opening DNS on LXC - FOR VPS
#####

function vserver_dns()
{
        DNS_PORTS_TCP="53"
        for port in $DNS_PORTS_TCP
        do
                $IP6TABLE -A INPUT -m state --state NEW -m tcp -p tcp --dport $port -j ACCEPT
                $IP6TABLE -A INPUT -i $NET_IF -p tcp --dport $port -m hashlimit --hashlimit-name NAMED --hashlimit-above 20/second --hashlimit-mode srcip --hashlimit-burst 100 --hashlimit-srcmask 28 -j DROP
                $IP6TABLE -t nat -A PREROUTING -d $NET_IP -p tcp --dport $port -j DNAT --to-destination [$CT_DNS]:$port
                $IP6TABLE -A OUTPUT -m state --state ESTABLISHED,RELATED -m tcp -p tcp --sport $port -j ACCEPT
                $IP6TABLE -A OUTPUT -p tcp --sport $port -j LOG  --log-prefix "OUTPUT-T-NAMED:"
        done

        DNS_PORTS_UDP="53"
        for port in $DNS_PORTS_UDP
        do
#                $IP6TABLE -A INPUT -m state --state NEW -m udp -p udp --dport $port -j ACCEPT
                $IP6TABLE -A INPUT -i $NET_IF -p udp --dport $port -m state --state NEW -m recent --set --name NAMED
                $IP6TABLE -A INPUT -i $NET_IF -p udp --dport $port -m recent --update --seconds 60 --hitcount 10 --rttl --name NAMED -j DROP
                $IP6TABLE -t nat -A PREROUTING -d $NET_IP -p udp --dport $port -j DNAT --to-destination [$CT_DNS]:$port
                $IP6TABLE -A OUTPUT -m state --state ESTABLISHED,RELATED -m udp -p udp --sport $port -j ACCEPT
                $IP6TABLE -A OUTPUT -p udp --sport $port -j LOG  --log-prefix "OUTPUT-U-NAMED:"
        done

        echo "   "+ DNS : [OK]
}


#####
# DROP PORTs
#####

function ports_drop()
{
        network="::0/0"

        PORTS_DROP=$1

        for port in $PORTS_DROP
        do
        $IP6TABLE -A INPUT -s $network -p tcp --dport $port -j DROP
        $IP6TABLE -A INPUT -s $network -p udp --dport $port -j DROP
        $IP6TABLE -A OUTPUT -d $network -p tcp --sport $port -j DROP
        $IP6TABLE -A OUTPUT -d $network -p udp --sport $port -j DROP
        done
        echo "   "+ DROP PROTOCOL UDP/TCP : $PORTS_DROP [OK]
}

function ports_blacklist()
{
#        $IP6TABLE -X black
        $IP6TABLE -N BLACK
        $IP6TABLE -A BLACK   -m recent --set --name BLACKLIST -j DROP

        # UDP/TCP (port/47)
#        $IP6TABLE -X CHECK_GRE
        $IP6TABLE -N CHECK_GRE
        $IP6TABLE -I CHECK_GRE 1   -m recent --update --name BLACKLIST --reap --seconds 86400 -j DROP

        $IP6TABLE -I CHECK_GRE 2   -m recent --update --name TIMER --reap --seconds 60 --hitcount 3 -j BLACK
        $IP6TABLE -I CHECK_GRE 3   -m recent --set --name TIMER -j ACCEPT

        # UDP/TCP (port/47)
        $IP6TABLE -A INPUT -p TCP --dport 47 -m state --state NEW -j CHECK_GRE
        $IP6TABLE -A INPUT -p UDP --dport 47 -m state --state NEW -j CHECK_GRE

        echo "   "+ BLACKLIST PROTOCOL : [OK]
}


#####
# Checking protocol for UPDATE
#####

function blacklist_chain()
{

#        $IP6TABLE -X black
        $IP6TABLE -N BLACK
        $IP6TABLE -A BLACK   -m recent --set --name BLACKLIST -j DROP

        echo "   "+ BLACK CHAIN : [OK]
}

function proto_check()
{
        CHAIN=$1

        # UDP/TCP (port/47)
#        $IP6TABLE -X CHECK_GRE
        $IP6TABLE -N $CHAIN
        $IP6TABLE -I $CHAIN 1   -m recent --update --name BLACKLIST --reap --seconds 86400 -j DROP

        $IP6TABLE -I $CHAIN 2   -m recent --update --name TIMER --reap --seconds 60 --hitcount 3 -j BLACK
        $IP6TABLE -I $CHAIN 3   -m recent --set --name TIMER -j ACCEPT

        echo "   "+ PROTOCOL VERFIF : $CHAIN [OK]
}

function checking_gre()
{
        network="::0/0"

        # UDP/TCP (port/47)
        ip6tables -A INPUT -p TCP --dport 47 -m state --state NEW -j CHECK_GRE
        ip6tables -A INPUT -p UDP --dport 47 -m state --state NEW -j CHECK_GRE

        ip6tables -A OUTPUT -p TCP --sport 47 -m state --state NEW -j CHECK_GRE
        ip6tables -A OUTPUT -p UDP --sport 47 -m state --state NEW -j CHECK_GRE

        echo "   "+ BLACKLIST PROTOCOL : [OK]
}



#####-------------------------- FONCTIONS ----------------------------######





#####-------------------------- START / STOP ----------------------------######
case "$1" in

start|restart)
$0 stop
echo "$0 Starting"
        kernel
 #       loopback
	synflood

#       mypolicy_rt DROP
	policy_rt DROP

        blacklist_chain
        proto_check CHECK_GRE
        checking_gre

        ports_drop 81

        icmpv6_huc
        icmpv6_limit

	loopback

        ipv6_multicast

        ssh_ok
        rsync_ok
        tcp_ok
        udp_ok

        server_http
	vserver_dns

        ipv6_lan
        ipv6_slan

        ipv6_strongswan DROP
        ipv6_ula DROP

        ipv6_addrs

        generique

        logging

        policy DROP
;;

stop)
        echo "$0 Stop"
        $IP6TABLE -F
        $IP6TABLE -t nat -F
        $IP6TABLE -Z
        $IP6TABLE -X
        policy ACCEPT
        ;;
status)
        echo "$0 Status"
        $IP6TABLE -L -vn
        $IP6TABLE -t nat -vn
        ;;

*)
echo "usage : $0 (status|start|stop|restart)"
;;

esac

#####-------------------------- START / STOP ----------------------------######