jcarr
/
wit-network-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix firewall to support our DNS

This commit is contained in:
toby 2018-09-09 15:42:45 +02:00
parent 4df3901bc2
commit 660343046e
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
files/firewall
View File

@ -21,6 +21,7 @@ case $1 in
iptables -A INPUT -p esp -j ACCEPT # ipsec iptables -A INPUT -p esp -j ACCEPT # ipsec
iptables -A INPUT -p udp --dport 500 --sport 500 -j ACCEPT # ipsec iptables -A INPUT -p udp --dport 500 --sport 500 -j ACCEPT # ipsec
iptables -A INPUT -p udp --dport 4500 --sport 4500 -j ACCEPT # ipsec iptables -A INPUT -p udp --dport 4500 --sport 4500 -j ACCEPT # ipsec
iptables -A INPUT -s 170.199.217.0 -p udp --sport 53 -j ACCEPT # dns
iptables -A INPUT -p icmp -j ACCEPT iptables -A INPUT -p icmp -j ACCEPT
#traffic we want to see encrypted over the VPN #traffic we want to see encrypted over the VPN
iptables -A INPUT -m policy --pol ipsec --dir in -p udp --dport 4789 -m policy --pol ipsec --dir in -j ACCEPT # vxlan traffic iptables -A INPUT -m policy --pol ipsec --dir in -p udp --dport 4789 -m policy --pol ipsec --dir in -j ACCEPT # vxlan traffic
@ -34,13 +35,12 @@ case $1 in
#### IPv6 #### IPv6
ip6tables -P INPUT ACCEPT ip6tables -P INPUT ACCEPT
ip6tables -F INPUT ip6tables -F INPUT
ip6tables -A INPUT -p ipv6-icmp -j ACCEPT ip6tables -A INPUT -p ipv6-icmp -j ACCEPT # ping
ip6tables -A INPUT -s fe80::/10 -p tcp --sport 179 -j ACCEPT ip6tables -A INPUT -s 2604:bbc0:0:113::a01:1301 -p udp --sport 53 -j ACCEPT # dns
ip6tables -A INPUT -s fe80::/10 -p tcp --dport 179 -j ACCEPT ip6tables -A INPUT -s 2001:67c:1560:8003::c7 -p udp --sport 123 -j ACCEPT # ntp
ip6tables -A INPUT -s 2001:4860:4860::8888 -p udp --sport 53 -j ACCEPT ip6tables -A INPUT -s 2001:67c:1560:8003::c8 -p udp --sport 123 -j ACCEPT # ntp
ip6tables -A INPUT -s 2001:4860:4860::8844 -p udp --sport 53 -j ACCEPT ip6tables -A INPUT -s fe80::/10 -p tcp --sport 179 -j ACCEPT # bgp (allow init as well as responding)
ip6tables -A INPUT -s 2001:67c:1560:8003::c7 -p udp --sport 123 -j ACCEPT ip6tables -A INPUT -s fe80::/10 -p tcp --dport 179 -j ACCEPT # bgp (allow init as well as responding)
ip6tables -A INPUT -s 2001:67c:1560:8003::c8 -p udp --sport 123 -j ACCEPT
### DROP the rest ### DROP the rest
ip6tables -P INPUT DROP ip6tables -P INPUT DROP