Skip to content
Browse files

Add an ip6tables sample script.

  • Loading branch information...
1 parent 258cfc1 commit 9a5f77c8962eddc0f301039bcae99bfd53c31ecc @rbtcollins rbtcollins committed
Showing with 75 additions and 0 deletions.
  1. +75 −0 contrib/bash/
75 contrib/bash/
@@ -0,0 +1,75 @@
+#!/bin/sh -e
+# You may redistribute this program and/or modify it under the terms of
+# the GNU General Public License as published by the Free Software Foundation,
+# either version 3 of the License, or (at your option) any later version.
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <>.
+# Simple example IPv6 Firewall configuration.
+# Derived from
+# permits only outbound, connected and core ICMP messages on tun0
+# - does not filter other interfaces at all.
+# - Adds one rule to the INPUT chain
+# - Adds a new chain for tun0
+# - edit and change the INPUT_PORTS rules to run services.
+# - there is no stop facility - if you can't figure out how to reset an
+# ip6tables firewall, you shouldn't do so!
+# Error if ip6tables is not in the path.
+which ip6tables
+# Inbound TCP ports
+# Inbound UDP ports
+# Allowed ICMP messages
+echo-request \
+echo-reply \
+# There is no 'assert a chain exists.
+ip6tables -N CJD || ip6tables -F CJD
+# Link the new table into the master INPUT table.
+ip6tables -C INPUT -i tun0 -j CJD || ip6tables -I INPUT -i tun0 -j CJD
+# Allow related and established connection.
+ip6tables -A CJD -m state --state RELATED,ESTABLISHED -j ACCEPT
+# Allow ICMP as defined in ALLOWED_ICMP
+if [ -n "$ALLOWED_ICMP" ] ; then
+ ip6tables -A CJD -p icmpv6 --icmpv6-type ${ICMP_TYPE} -j ACCEPT
+ done
+# Open allowed TCP ports if any
+if [ -n "$TCP_INPUT_PORTS" ] ; then
+ for PORT in $TCP_INPUT_PORTS; do
+ ip6tables -A CJD -m state --state NEW -p tcp --dport ${PORT} \
+ done
+# Open allowed UDP ports if any
+if [ -n "$UDP_INPUT_PORTS" ] ; then
+ for PORT in $UDP_INPUT_PORTS; do
+ ip6tables -A CJD -m state --state NEW -p udp --dport ${PORT} \
+ done
+# Deny all other traffic on tun0
+ip6tables -A CJD -j LOG
+ip6tables -A CJD -j DROP

0 comments on commit 9a5f77c

Please sign in to comment.
Something went wrong with that request. Please try again.