116 lines
12 KiB
Text
116 lines
12 KiB
Text
# / === START OF FIREWALL === \ #
|
|
|
|
# ================== IPv4: Allow established and related connections =====================
|
|
PostUp = iptables -A FORWARD -i wg2 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
PostUp = iptables -A FORWARD -i eth0 -o wg2 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
# ========================================================================================
|
|
# ================== IPv6: Allow established and related connections ======================
|
|
PostUp = ip6tables -A FORWARD -i wg2 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
PostUp = ip6tables -A FORWARD -i eth0 -o wg2 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
# =========================================================================================
|
|
|
|
# ========================================== IPv4: Log outbound traffic from WireGuard VPN to any destination and port ================
|
|
PostUp = iptables -A FORWARD -i wg2 -o eth0 -j ACCEPT
|
|
# =====================================================================================================================================
|
|
# ========================================== IPv6: Log outbound traffic from WireGuard VPN to any destination and port =================
|
|
PostUp = ip6tables -A FORWARD -i wg2 -o eth0 -j ACCEPT
|
|
# ======================================================================================================================================
|
|
# =====================================================================================================================================
|
|
PostUp = ip6tables -A FORWARD -i eth0 -o wg2 -j ACCEPT
|
|
# =====================================================================================================================================
|
|
|
|
# ============================ SNAT for outbound traffic ===================================
|
|
# ============================= IP Reserved for IPv4: [10.9.0.0/24] ===========================
|
|
PostUp = iptables -t nat -A POSTROUTING -o eth0 -s 10.9.0.0/24 -j SNAT --to-source 154.29.72.51
|
|
# =============================================================================================
|
|
# ============================= IP Reserved for IPv6: [fdd4:39b8:8b48::2] ===================================
|
|
PostUp = ip6tables -t nat -A POSTROUTING -o eth0 -s fdd4:39b8:8b48::2 -j SNAT --to-source 2604:f440:1::3:0:10
|
|
# ===========================================================================================================
|
|
# ============================= IP Reserved for IPv6: [fdd4:39b8:8b48::2] ==================================
|
|
PostUp = ip6tables -t nat -A POSTROUTING -o eth0 -s fdd4:39b8:8b48::2 -j SNAT --to-source 2604:f440:1::3:0:e
|
|
# ==========================================================================================================
|
|
# ============================= IP Reserved for IPv6: [fdd4:39b8:8b48::2] ==================================
|
|
PostUp = ip6tables -t nat -A POSTROUTING -o eth0 -s fdd4:39b8:8b48::2 -j SNAT --to-source 2604:f440:1::3:0:f
|
|
# ==========================================================================================================
|
|
# ============================= IP Reserved for IPv6: [fdd4:39b8:8b48::2] ===================================
|
|
PostUp = ip6tables -t nat -A POSTROUTING -o eth0 -s fdd4:39b8:8b48::3 -j SNAT --to-source 2604:f440:1::3:0:11
|
|
# ===========================================================================================================
|
|
# ========================= SNAT for outbound traffic END ===================================
|
|
|
|
# ========================================== IPv6: PORT FORWARDING ======================================================
|
|
# ================================== IP Port Forwarding Reserved for IPv6: [fdd4:39b8:8b48::2] =========================================
|
|
PostUp = ip6tables -t nat -A PREROUTING -i eth0 -p tcp --dport 0:65535 -d 2604:f440:1::3:0:10 -j DNAT --to-destination fdd4:39b8:8b48::2
|
|
PostUp = ip6tables -t nat -A PREROUTING -i eth0 -p udp --dport 0:65535 -d 2604:f440:1::3:0:10 -j DNAT --to-destination fdd4:39b8:8b48::2
|
|
# ======================================================================================================================================
|
|
# ================================== IP Port Forwarding Reserved for IPv6: [fdd4:39b8:8b48::2] ========================================
|
|
PostUp = ip6tables -t nat -A PREROUTING -i eth0 -p tcp --dport 0:65535 -d 2604:f440:1::3:0:e -j DNAT --to-destination fdd4:39b8:8b48::2
|
|
PostUp = ip6tables -t nat -A PREROUTING -i eth0 -p udp --dport 0:65535 -d 2604:f440:1::3:0:e -j DNAT --to-destination fdd4:39b8:8b48::2
|
|
# =====================================================================================================================================
|
|
# ================================== IP Port Forwarding Reserved for IPv6: [fdd4:39b8:8b48::2] ========================================
|
|
PostUp = ip6tables -t nat -A PREROUTING -i eth0 -p tcp --dport 0:65535 -d 2604:f440:1::3:0:f -j DNAT --to-destination fdd4:39b8:8b48::2
|
|
PostUp = ip6tables -t nat -A PREROUTING -i eth0 -p udp --dport 0:65535 -d 2604:f440:1::3:0:f -j DNAT --to-destination fdd4:39b8:8b48::2
|
|
# =====================================================================================================================================
|
|
# ================================== IP Port Forwarding Reserved for IPv6: [fdd4:39b8:8b48::3] =========================================
|
|
PostUp = ip6tables -t nat -A PREROUTING -i eth0 -p tcp --dport 0:65535 -d 2604:f440:1::3:0:11 -j DNAT --to-destination fdd4:39b8:8b48::3
|
|
PostUp = ip6tables -t nat -A PREROUTING -i eth0 -p udp --dport 0:65535 -d 2604:f440:1::3:0:11 -j DNAT --to-destination fdd4:39b8:8b48::3
|
|
# ======================================================================================================================================
|
|
# ========================================== IPv6: PORT FORWARDING END ==================================================
|
|
|
|
# ============= IPv4: DELETE Allow established and related connections ================================================================
|
|
PostDown = iptables -D FORWARD -i wg2 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
# =====================================================================================================================================
|
|
PostDown = iptables -D FORWARD -i eth0 -o wg2 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
# =====================================================================================================================================
|
|
# =======================================================================================================================================
|
|
# PostDown = iptables -D FORWARD -i wg2 -o eth0 -j LOG --log-prefix "OUTBOUND_TRAFFIC: " --log-ip-options --log-tcp-options --log-level 7
|
|
PostDown = iptables -D FORWARD -i wg2 -o eth0 -j ACCEPT
|
|
# =======================================================================================================================================
|
|
|
|
# ============= IPv6: DELETE Allow established and related connections ================================================================
|
|
PostDown = ip6tables -D FORWARD -i wg2 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
# =====================================================================================================================================
|
|
PostDown = ip6tables -D FORWARD -i eth0 -o wg2 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
# =====================================================================================================================================
|
|
# ========================================================================================================================================
|
|
# PostDown = ip6tables -D FORWARD -i wg2 -o eth0 -j LOG --log-prefix "OUTBOUND_TRAFFIC: " --log-ip-options --log-tcp-options --log-level 7
|
|
PostDown = ip6tables -D FORWARD -i wg2 -o eth0 -j ACCEPT
|
|
# ========================================================================================================================================
|
|
|
|
# ========================================== IPv6: PORT FORWARDING ====================================================
|
|
# ================================== IP Port Forwarding Reserved for IPv6: [fdd4:39b8:8b48::2] ===========================================
|
|
PostDown = ip6tables -t nat -D PREROUTING -i eth0 -p tcp --dport 0:65535 -d 2604:f440:1::3:0:10 -j DNAT --to-destination fdd4:39b8:8b48::2
|
|
PostDown = ip6tables -t nat -D PREROUTING -i eth0 -p udp --dport 0:65535 -d 2604:f440:1::3:0:10 -j DNAT --to-destination fdd4:39b8:8b48::2
|
|
# ========================================================================================================================================
|
|
# ================================== IP Port Forwarding Reserved for IPv6: [fdd4:39b8:8b48::2] ==========================================
|
|
PostDown = ip6tables -t nat -D PREROUTING -i eth0 -p tcp --dport 0:65535 -d 2604:f440:1::3:0:e -j DNAT --to-destination fdd4:39b8:8b48::2
|
|
PostDown = ip6tables -t nat -D PREROUTING -i eth0 -p udp --dport 0:65535 -d 2604:f440:1::3:0:e -j DNAT --to-destination fdd4:39b8:8b48::2
|
|
# =======================================================================================================================================
|
|
# ================================== IP Port Forwarding Reserved for IPv6: [fdd4:39b8:8b48::2] ==========================================
|
|
PostDown = ip6tables -t nat -D PREROUTING -i eth0 -p tcp --dport 0:65535 -d 2604:f440:1::3:0:f -j DNAT --to-destination fdd4:39b8:8b48::2
|
|
PostDown = ip6tables -t nat -D PREROUTING -i eth0 -p udp --dport 0:65535 -d 2604:f440:1::3:0:f -j DNAT --to-destination fdd4:39b8:8b48::2
|
|
# =======================================================================================================================================
|
|
# ================================== IP Port Forwarding Reserved for IPv6: [fdd4:39b8:8b48::3] ===========================================
|
|
PostDown = ip6tables -t nat -D PREROUTING -i eth0 -p tcp --dport 0:65535 -d 2604:f440:1::3:0:11 -j DNAT --to-destination fdd4:39b8:8b48::3
|
|
PostDown = ip6tables -t nat -D PREROUTING -i eth0 -p udp --dport 0:65535 -d 2604:f440:1::3:0:11 -j DNAT --to-destination fdd4:39b8:8b48::3
|
|
# ========================================================================================================================================
|
|
# ========================================== IPv6: PORT FORWARDING END ==================================================
|
|
|
|
# ============================ SNAT for outbound traffic ===================================
|
|
# ============================= IP Reserved for IPv4: [10.9.0.0/24] =============================
|
|
PostDown = iptables -t nat -D POSTROUTING -o eth0 -s 10.9.0.0/24 -j SNAT --to-source 154.29.72.51
|
|
# ===============================================================================================
|
|
# ============================= IP Reserved for IPv6: [fdd4:39b8:8b48::2] =====================================
|
|
PostDown = ip6tables -t nat -D POSTROUTING -o eth0 -s fdd4:39b8:8b48::2 -j SNAT --to-source 2604:f440:1::3:0:10
|
|
# =============================================================================================================
|
|
# ============================= IP Reserved for IPv6: [fdd4:39b8:8b48::2] ====================================
|
|
PostDown = ip6tables -t nat -D POSTROUTING -o eth0 -s fdd4:39b8:8b48::2 -j SNAT --to-source 2604:f440:1::3:0:e
|
|
# ============================================================================================================
|
|
# ============================= IP Reserved for IPv6: [fdd4:39b8:8b48::2] ====================================
|
|
PostDown = ip6tables -t nat -D POSTROUTING -o eth0 -s fdd4:39b8:8b48::2 -j SNAT --to-source 2604:f440:1::3:0:f
|
|
# ============================================================================================================
|
|
# ============================= IP Reserved for IPv6: [fdd4:39b8:8b48::2] =====================================
|
|
PostDown = ip6tables -t nat -D POSTROUTING -o eth0 -s fdd4:39b8:8b48::3 -j SNAT --to-source 2604:f440:1::3:0:11
|
|
# =============================================================================================================
|
|
# ========================= SNAT for outbound traffic END ===================================
|
|
|
|
# / === END OF FIREWALL === \ #
|