domain (ip ip6) {
table filter {
chain INPUT {
- policy DROP;
+ policy ACCEPT;
mod state state (ESTABLISHED RELATED) ACCEPT;
interface lo ACCEPT;
proto icmp ACCEPT;
+ # some of our hosts (e.g. villa and lobos) do ipv6 via tunnels (proto 41)
+ # this requires we allow proto ipv6 to work in all cases.
+ # without this, ipv6 connectivity only works once the host itself
+ # created some ipv6 connectivity to some place.
+ proto ipv6 ACCEPT;
mod state state (INVALID) DROP;
}
}
domain (ip ip6) {
chain INPUT {
- proto udp dport 137 DROP;
- proto tcp mod multiport destination-ports (137 445) DROP;
+ proto (tcp udp) mod multiport destination-ports (135 137 138 139 445 1026 1027 1433) DROP;
jump log_or_drop;
}
}
+# vim:set et: