From 660343046e66b89b122ceb2363ed0bd157325954 Mon Sep 17 00:00:00 2001 From: toby Date: Sun, 9 Sep 2018 15:42:45 +0200 Subject: [PATCH] fix firewall to support our DNS --- files/firewall | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/files/firewall b/files/firewall index b8602f4..a1d01b2 100755 --- a/files/firewall +++ b/files/firewall @@ -21,6 +21,7 @@ case $1 in iptables -A INPUT -p esp -j ACCEPT # ipsec iptables -A INPUT -p udp --dport 500 --sport 500 -j ACCEPT # ipsec iptables -A INPUT -p udp --dport 4500 --sport 4500 -j ACCEPT # ipsec + iptables -A INPUT -s 170.199.217.0 -p udp --sport 53 -j ACCEPT # dns iptables -A INPUT -p icmp -j ACCEPT #traffic we want to see encrypted over the VPN iptables -A INPUT -m policy --pol ipsec --dir in -p udp --dport 4789 -m policy --pol ipsec --dir in -j ACCEPT # vxlan traffic @@ -34,13 +35,12 @@ case $1 in #### IPv6 ip6tables -P INPUT ACCEPT ip6tables -F INPUT - ip6tables -A INPUT -p ipv6-icmp -j ACCEPT - ip6tables -A INPUT -s fe80::/10 -p tcp --sport 179 -j ACCEPT - ip6tables -A INPUT -s fe80::/10 -p tcp --dport 179 -j ACCEPT - ip6tables -A INPUT -s 2001:4860:4860::8888 -p udp --sport 53 -j ACCEPT - ip6tables -A INPUT -s 2001:4860:4860::8844 -p udp --sport 53 -j ACCEPT - ip6tables -A INPUT -s 2001:67c:1560:8003::c7 -p udp --sport 123 -j ACCEPT - ip6tables -A INPUT -s 2001:67c:1560:8003::c8 -p udp --sport 123 -j ACCEPT + ip6tables -A INPUT -p ipv6-icmp -j ACCEPT # ping + ip6tables -A INPUT -s 2604:bbc0:0:113::a01:1301 -p udp --sport 53 -j ACCEPT # dns + ip6tables -A INPUT -s 2001:67c:1560:8003::c7 -p udp --sport 123 -j ACCEPT # ntp + ip6tables -A INPUT -s 2001:67c:1560:8003::c8 -p udp --sport 123 -j ACCEPT # ntp + ip6tables -A INPUT -s fe80::/10 -p tcp --sport 179 -j ACCEPT # bgp (allow init as well as responding) + ip6tables -A INPUT -s fe80::/10 -p tcp --dport 179 -j ACCEPT # bgp (allow init as well as responding) ### DROP the rest ip6tables -P INPUT DROP