[firewall] / local.m4

### -*-sh-*-
###
### Local firewall configuration
###
### (c) 2008 Mark Wooding
###

###----- Licensing notice ---------------------------------------------------
###
### This program is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### This program is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with this program; if not, write to the Free Software Foundation,
### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

###--------------------------------------------------------------------------
### Local configuration.

m4_divert(6)m4_dnl
## Default NTP servers.
defconf(ntp_servers,
	"158.152.1.76 158.152.1.204 194.159.253.2 195.173.57.232")

m4_divert(-1)
###--------------------------------------------------------------------------
### Packet classification.

## IPv4 addressing.
##
## There are two small blocks of publicly routable IPv4 addresses, and a
## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN.
## The former are as follows.
##
## 62.49.204.144/28
##		House border network (dmz).  We have all of these, but .145
##		is reserved for the router.
##
## 212.13.18.64/28
##		Jump colocated network (jump).  .65--68 are used by Jump
##		network infrastructure; we get the rest.
##
## The latter is the block 172.29.196.0/22.  Currently the low half is
## unallocated (and may be returned to the G-RIN); the remaining addresses
## are allocated as follows.
##
## 172.29.198.0/24  Untrusted networks.
##	.0/25		house wireless net
##	.128/28		iodine (IP-over-DNS) network
##
## 172.29.199.0/24  Trusted networks.
##	.0/25		house wired network
##	.128/27		mobile VPN hosts
##	.160/28		reserved, except .160/30 allocated for ITS
##	.176/28		internal colocated network
##	.192/27		house safe network
##	.224/27		anycast services

## IPv6 addressing.
##
## There are five blocks of publicly routable IPv6 addresses, though some of
## them aren't very interesting.  The ranges are as follows.
##
## 2001:470:1f08:1b98::/64
##		Hurricane Electric tunnel network: only :1 (HE) and :2
##		(radius) are used.
##
## 2001:470:1f09:1b98::/64
##		House border network (dmz).
##
## 2001:470:9740::/48
##		Main house range.  See below for allocation policy.
##
## 2001:ba8:0:1d9::/64
##		Jump border network (jump): :1 is the router (supplied by
##		Jump); other addresses are ours.
##
## 2001:ba8:1d9::/48
##		Main colocated range.  See below for allocation policy.
##
## Addresses in the /64 networks are simply allocated in ascending order.
## The /48s are split into /64s by appending a 16-bit network number.  The
## top nibble of the network number classifies the network, as follows.
##
## 8xxx		Untrusted
## 6xxx		Virtual
## 4xxx		Safe
## 0xxx		Unsafe, trusted
##
## These have been chosen so that network properties can be deduced by
## inspecting bits of the network number:
##
## Bit 15	If set, the network is untrusted; otherwise it is trusted.
## Bit 14	If set, the network is safe; otherwise it is unsafe.
##
## Finally, the low-order nibbles identify the site.
##
## 0		No specific site: mobile VPN endpoints or anycast addresses.
## 1		House.
## 2		Jump colocation.
##
## Usually site-0 networks are allocated from the Jump range to improve
## expected performance from/to external sites which don't engage in our
## dynamic routing protocols.

## Define the available network classes.
m4_divert(42)m4_dnl
defnetclass untrusted untrusted trusted mcast
defnetclass trusted untrusted trusted safe noloop mcast
defnetclass safe trusted safe noloop mcast
defnetclass noloop trusted safe mcast
defnetclass link
defnetclass mcast
m4_divert(-1)

m4_divert(26)m4_dnl
###--------------------------------------------------------------------------
### Network layout.

## House networks.
defnet dmz trusted
	addr 62.49.204.144/28 2001:470:1f09:1b98::/64
	forwards unsafe untrusted
defnet unsafe trusted
	addr 172.29.199.0/25 2001:470:9740:1::/64
	forwards househub
defnet safe safe
	addr 172.29.199.192/27 2001:470:9740:4001::/64
	forwards househub
defnet untrusted untrusted
	addr 172.29.198.0/25 2001:470:9740:8001::/64
	forwards househub

defnet househub virtual
	forwards housebdry dmz unsafe safe untrusted
defnet housebdry virtual
	forwards househub hub
	noxit dmz

## House hosts.
defhost radius
	hosttype router
	iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default
	iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default
	iface eth2 dmz unsafe safe untrusted vpn sgo colobdry
	iface eth3 untrusted vpn default
	iface ppp0 default
	iface t6-he default
	iface vpn-precision colobdry vpn sgo
	iface vpn-chiark sgo
	iface vpn-+ vpn
defhost roadstar
	iface eth0 dmz unsafe
	iface eth1 dmz unsafe
defhost jem
	iface eth0 dmz unsafe
	iface eth1 dmz unsafe
defhost artist
	hosttype router
	iface eth0 dmz unsafe untrusted
	iface eth1 dmz unsafe untrusted
	iface eth3 untrusted
defhost vampire
	hosttype router
	iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry
	iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry
	iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry
	iface eth0.7 untrusted
	iface vpn-precision colobdry vpn sgo
	iface vpn-chiark sgo
	iface vpn-+ vpn
defhost ibanez
	iface br-dmz dmz unsafe
	iface br-unsafe unsafe
defhost orange
	iface wlan0 untrusted
	iface vpn-radius unsafe

defhost gibson
	hosttype client
	iface eth0 unsafe

## Colocated networks.
defnet jump trusted
	addr 212.13.198.64/28 2001:ba8:0:1d9::/64
	forwards colohub
defnet colo trusted
	addr 172.29.199.176/28 2001:ba8:1d9:2::/64
	forwards colohub
defnet colohub virtual
	forwards colobdry jump colo iodine
defnet colobdry virtual
	forwards colohub hub
	noxit jump
defnet iodine untrusted
	addr 172.29.198.128/28
	forwards colohub

## Colocated hosts.
defhost fender
	iface br-jump jump colo
	iface br-colo jump colo
defhost precision
	hosttype router
	iface eth0 jump colo vpn sgo
	iface eth1 jump colo vpn sgo
	iface vpn-radius housebdry vpn sgo
	iface vpn-chiark sgo
	iface vpn-+ vpn
defhost telecaster
	iface eth0 jump colo
	iface eth1 jump colo
defhost stratocaster
	iface eth0 jump colo
	iface eth1 jump colo
defhost jazz
	hosttype router
	iface eth0 jump colo vpn
	iface eth1 jump colo vpn
	iface dns0 iodine
	iface vpn-+ vpn

## Other networks.
defnet hub virtual
	forwards housebdry colobdry
defnet sgo noloop
	addr !172.29.198.0/23
	addr 10.0.0.0/8
	addr 172.16.0.0/12
	addr 192.168.0.0/16
	forwards househub colohub
defnet vpn safe
	addr 172.29.199.128/27 2001:ba8:1d9:6000::/64
	forwards househub colohub
	host crybaby 1
	host terror 2
	host orange 3
defnet anycast trusted
	addr 172.29.199.224/27 2001:ba8:1d9:0::/64
	forwards dmz unsafe safe untrusted jump colo vpn
defnet default untrusted
	addr 62.49.204.144/28 2001:470:1f09:1b98::/64
	addr 212.13.198.64/28 2001:ba8:0:1d9::/64
	addr 2001:ba8:1d9::/48 #temporary
	forwards dmz unsafe untrusted jump colo

m4_divert(80)m4_dnl
###--------------------------------------------------------------------------
### Special forwarding exemptions.

case $forward in
  1)

    ## Only allow these packets if they're not fragmented.  (Don't trust safe
    ## hosts's fragment reassembly to be robust against malicious fragments.)
    ## There's a hideous bug in iptables 1.4.11.1 which botches the meaning
    ## of `! -f', so we do the negation using early return from a subchain.
    clearchain fwd-spec-nofrag
    run iptables -A fwd-spec-nofrag -j RETURN --fragment
    run ip6tables -A fwd-spec-nofrag -j RETURN \
	    -m ipv6header --soft --header frag
    run ip46tables -A FORWARD -j fwd-spec-nofrag

    ## Allow ping from safe/noloop to untrusted networks.
    run iptables -A fwd-spec-nofrag -j ACCEPT \
	    -p icmp --icmp-type echo-request \
	    -m mark --mark $to_untrusted/$MASK_TO
    run iptables -A fwd-spec-nofrag -j ACCEPT \
	    -p icmp --icmp-type echo-reply \
	    -m mark --mark $from_untrusted/$MASK_FROM \
	    -m state --state ESTABLISHED
    run ip6tables -A fwd-spec-nofrag -j ACCEPT \
	    -p icmpv6 --icmpv6-type echo-request \
	    -m mark --mark $to_untrusted/$MASK_TO
    run ip6tables -A fwd-spec-nofrag -j ACCEPT \
	    -p icmpv6 --icmpv6-type echo-reply \
	    -m mark --mark $from_untrusted/$MASK_FROM \
	    -m state --state ESTABLISHED

    ## Allow SSH from safe/noloop to untrusted networks.
    run ip46tables -A fwd-spec-nofrag -j ACCEPT \
	    -p tcp --destination-port $port_ssh \
	    -m mark --mark $to_untrusted/$MASK_TO
    run ip46tables -A fwd-spec-nofrag -j ACCEPT \
	    -p tcp --source-port $port_ssh \
	    -m mark --mark $from_untrusted/$MASK_FROM \
	    -m state --state ESTABLISHED

    ;;
esac

m4_divert(80)m4_dnl
###--------------------------------------------------------------------------
### Kill things we don't understand properly.
###
### I don't like having to do this, but since I don't know how to do proper
### multicast filtering, I'm just going to ban it from being forwarded.

errorchain poorly-understood REJECT

## Ban multicast destination addresses in forwarding.
case $forward in
  1)
    run iptables -A FORWARD -g poorly-understood \
	    -d 224.0.0.0/4
    run ip6tables -A FORWARD -g poorly-understood \
	    -d ff::/8
    ;;
esac

m4_divert(84)m4_dnl
###--------------------------------------------------------------------------
### Locally-bound packet inspection.

clearchain inbound

## Track connections.
commonrules inbound
conntrack inbound

## Allow incoming bootp.  Bootp won't be forwarded, so this is obviously a
## local request.
run iptables -A inbound -j ACCEPT \
	-s 0.0.0.0 -d 255.255.255.255 \
	-p udp --source-port $port_bootpc --destination-port $port_bootps
run iptables -A inbound -j ACCEPT \
	-s 172.29.198.0/23 \
	-p udp --source-port $port_bootpc --destination-port $port_bootps

## Allow incoming ping.  This is the only ICMP left.
run ip46tables -A inbound -j ACCEPT -p icmp

m4_divert(88)m4_dnl
## Allow unusual things.
openports inbound

## Inspect inbound packets from untrusted sources.
run ip46tables -A inbound -j forbidden
run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound

## Otherwise process as indicated by the mark.
for i in $inchains; do
  run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT
done

m4_divert(-1)
###----- That's all, folks --------------------------------------------------
Commit	Line	Data
775bd287	1	### --sh--
bfdc045d MW	2	###
	3	### Local firewall configuration
	4	###
	5	### (c) 2008 Mark Wooding
	6	###
	7
	8	###----- Licensing notice ---------------------------------------------------
	9	###
	10	### This program is free software; you can redistribute it and/or modify
	11	### it under the terms of the GNU General Public License as published by
	12	### the Free Software Foundation; either version 2 of the License, or
	13	### (at your option) any later version.
	14	###
	15	### This program is distributed in the hope that it will be useful,
	16	### but WITHOUT ANY WARRANTY; without even the implied warranty of
	17	### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	18	### GNU General Public License for more details.
	19	###
	20	### You should have received a copy of the GNU General Public License
	21	### along with this program; if not, write to the Free Software Foundation,
	22	### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
	23
	24	###--------------------------------------------------------------------------
335b2afe MW	25	### Local configuration.
	26
	27	m4_divert(6)m4_dnl
	28	## Default NTP servers.
	29	defconf(ntp_servers,
	30	"158.152.1.76 158.152.1.204 194.159.253.2 195.173.57.232")
	31
	32	m4_divert(-1)
	33	###--------------------------------------------------------------------------
bfdc045d MW	34	### Packet classification.
bfdc045d MW	35
36e36cc7 MW	36	## IPv4 addressing.
	37	##
	38	## There are two small blocks of publicly routable IPv4 addresses, and a
	39	## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN.
	40	## The former are as follows.
	41	##
	42	## 62.49.204.144/28
	43	## House border network (dmz). We have all of these, but .145
	44	## is reserved for the router.
	45	##
	46	## 212.13.18.64/28
	47	## Jump colocated network (jump). .65--68 are used by Jump
	48	## network infrastructure; we get the rest.
	49	##
	50	## The latter is the block 172.29.196.0/22. Currently the low half is
	51	## unallocated (and may be returned to the G-RIN); the remaining addresses
	52	## are allocated as follows.
	53	##
	54	## 172.29.198.0/24 Untrusted networks.
	55	## .0/25 house wireless net
	56	## .128/28 iodine (IP-over-DNS) network
	57	##
	58	## 172.29.199.0/24 Trusted networks.
	59	## .0/25 house wired network
	60	## .128/27 mobile VPN hosts
	61	## .160/28 reserved, except .160/30 allocated for ITS
	62	## .176/28 internal colocated network
	63	## .192/27 house safe network
	64	## .224/27 anycast services
	65
	66	## IPv6 addressing.
	67	##
	68	## There are five blocks of publicly routable IPv6 addresses, though some of
	69	## them aren't very interesting. The ranges are as follows.
	70	##
	71	## 2001:470:1f08:1b98::/64
	72	## Hurricane Electric tunnel network: only :1 (HE) and :2
	73	## (radius) are used.
	74	##
	75	## 2001:470:1f09:1b98::/64
	76	## House border network (dmz).
	77	##
	78	## 2001:470:9740::/48
	79	## Main house range. See below for allocation policy.
	80	##
	81	## 2001:ba8:0:1d9::/64
	82	## Jump border network (jump): :1 is the router (supplied by
	83	## Jump); other addresses are ours.
	84	##
	85	## 2001:ba8:1d9::/48
	86	## Main colocated range. See below for allocation policy.
	87	##
	88	## Addresses in the /64 networks are simply allocated in ascending order.
	89	## The /48s are split into /64s by appending a 16-bit network number. The
	90	## top nibble of the network number classifies the network, as follows.
	91	##
	92	## 8xxx Untrusted
	93	## 6xxx Virtual
	94	## 4xxx Safe
	95	## 0xxx Unsafe, trusted
	96	##
	97	## These have been chosen so that network properties can be deduced by
	98	## inspecting bits of the network number:
	99	##
100	## Bit 15 If set, the network is untrusted; otherwise it is trusted.
101	## Bit 14 If set, the network is safe; otherwise it is unsafe.
102	##
103	## Finally, the low-order nibbles identify the site.
104	##
105	## 0 No specific site: mobile VPN endpoints or anycast addresses.
106	## 1 House.
107	## 2 Jump colocation.
108	##
109	## Usually site-0 networks are allocated from the Jump range to improve
110	## expected performance from/to external sites which don't engage in our
111	## dynamic routing protocols.
112
bfdc045d MW	113	## Define the available network classes.
bfdc045d MW	114	m4_divert(42)m4_dnl
44f95827 MW	115	defnetclass untrusted untrusted trusted mcast
	116	defnetclass trusted untrusted trusted safe noloop mcast
	117	defnetclass safe trusted safe noloop mcast
	118	defnetclass noloop trusted safe mcast
	119	defnetclass link
	120	defnetclass mcast
a4d8cae3	121	m4_divert(-1)
bfdc045d	122
a4d8cae3	123	m4_divert(26)m4_dnl
bfdc045d MW	124	###--------------------------------------------------------------------------
	125	### Network layout.
	126
beb4f0ee MW	127	## House networks.
beb4f0ee MW	128	defnet dmz trusted
b9e891b5	129	addr 62.49.204.144/28 2001:470:1f09:1b98::/64
beb4f0ee MW	130	forwards unsafe untrusted
beb4f0ee MW	131	defnet unsafe trusted
b9e891b5	132	addr 172.29.199.0/25 2001:470:9740:1::/64
beb4f0ee MW	133	forwards househub
beb4f0ee MW	134	defnet safe safe
216285e1	135	addr 172.29.199.192/27 2001:470:9740:4001::/64
beb4f0ee MW	136	forwards househub
beb4f0ee MW	137	defnet untrusted untrusted
b9e891b5	138	addr 172.29.198.0/25 2001:470:9740:8001::/64
beb4f0ee	139	forwards househub
bfdc045d	140
beb4f0ee MW	141	defnet househub virtual
	142	forwards housebdry dmz unsafe safe untrusted
	143	defnet housebdry virtual
	144	forwards househub hub
	145	noxit dmz
	146
	147	## House hosts.
	148	defhost radius
4eb9f4df	149	hosttype router
68f0829f MW	150	iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default
68f0829f MW	151	iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default
960a9996	152	iface eth2 dmz unsafe safe untrusted vpn sgo colobdry
68f0829f	153	iface eth3 untrusted vpn default
8506ff83	154	iface ppp0 default
a7e48c06	155	iface t6-he default
68f0829f MW	156	iface vpn-precision colobdry vpn sgo
	157	iface vpn-chiark sgo
	158	iface vpn-+ vpn
beb4f0ee	159	defhost roadstar
ce6434f7 MW	160	iface eth0 dmz unsafe
ce6434f7 MW	161	iface eth1 dmz unsafe
beb4f0ee	162	defhost jem
ce6434f7 MW	163	iface eth0 dmz unsafe
ce6434f7 MW	164	iface eth1 dmz unsafe
beb4f0ee	165	defhost artist
564c6939	166	hosttype router
490003e4 MW	167	iface eth0 dmz unsafe untrusted
490003e4 MW	168	iface eth1 dmz unsafe untrusted
564c6939	169	iface eth3 untrusted
beb4f0ee	170	defhost vampire
4eb9f4df	171	hosttype router
2b17ac87 MW	172	iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry
	173	iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry
	174	iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry
	175	iface eth0.7 untrusted
68f0829f	176	iface vpn-precision colobdry vpn sgo
ebaa31a7 MW	177	iface vpn-chiark sgo
ebaa31a7 MW	178	iface vpn-+ vpn
beb4f0ee	179	defhost ibanez
06ff8082	180	iface br-dmz dmz unsafe
beb4f0ee	181	iface br-unsafe unsafe
6fd217ae MW	182	defhost orange
	183	iface wlan0 untrusted
	184	iface vpn-radius unsafe
beb4f0ee MW	185
beb4f0ee MW	186	defhost gibson
4eb9f4df	187	hosttype client
beb4f0ee MW	188	iface eth0 unsafe
	189
	190	## Colocated networks.
	191	defnet jump trusted
b9e891b5	192	addr 212.13.198.64/28 2001:ba8:0:1d9::/64
beb4f0ee MW	193	forwards colohub
beb4f0ee MW	194	defnet colo trusted
b9e891b5	195	addr 172.29.199.176/28 2001:ba8:1d9:2::/64
beb4f0ee MW	196	forwards colohub
beb4f0ee MW	197	defnet colohub virtual
148d527c	198	forwards colobdry jump colo iodine
beb4f0ee MW	199	defnet colobdry virtual
	200	forwards colohub hub
	201	noxit jump
148d527c MW	202	defnet iodine untrusted
	203	addr 172.29.198.128/28
	204	forwards colohub
beb4f0ee MW	205
	206	## Colocated hosts.
	207	defhost fender
ce6434f7 MW	208	iface br-jump jump colo
ce6434f7 MW	209	iface br-colo jump colo
beb4f0ee	210	defhost precision
4eb9f4df	211	hosttype router
560ae309 MW	212	iface eth0 jump colo vpn sgo
560ae309 MW	213	iface eth1 jump colo vpn sgo
68f0829f	214	iface vpn-radius housebdry vpn sgo
ebaa31a7 MW	215	iface vpn-chiark sgo
ebaa31a7 MW	216	iface vpn-+ vpn
beb4f0ee	217	defhost telecaster
ce6434f7 MW	218	iface eth0 jump colo
ce6434f7 MW	219	iface eth1 jump colo
beb4f0ee	220	defhost stratocaster
ce6434f7 MW	221	iface eth0 jump colo
ce6434f7 MW	222	iface eth1 jump colo
beb4f0ee	223	defhost jazz
560ae309 MW	224	hosttype router
	225	iface eth0 jump colo vpn
	226	iface eth1 jump colo vpn
148d527c	227	iface dns0 iodine
560ae309	228	iface vpn-+ vpn
beb4f0ee MW	229
	230	## Other networks.
	231	defnet hub virtual
	232	forwards housebdry colobdry
ebaa31a7 MW	233	defnet sgo noloop
	234	addr !172.29.198.0/23
	235	addr 10.0.0.0/8
	236	addr 172.16.0.0/12
	237	addr 192.168.0.0/16
	238	forwards househub colohub
7dff2754 MW	239	defnet vpn safe
	240	addr 172.29.199.128/27 2001:ba8:1d9:6000::/64
	241	forwards househub colohub
	242	host crybaby 1
	243	host terror 2
6fd217ae	244	host orange 3
c68b8ecc MW	245	defnet anycast trusted
	246	addr 172.29.199.224/27 2001:ba8:1d9:0::/64
	247	forwards dmz unsafe safe untrusted jump colo vpn
beb4f0ee	248	defnet default untrusted
b9e891b5 MW	249	addr 62.49.204.144/28 2001:470:1f09:1b98::/64
	250	addr 212.13.198.64/28 2001:ba8:0:1d9::/64
	251	addr 2001:ba8:1d9::/48 #temporary
793937d8	252	forwards dmz unsafe untrusted jump colo
1ee6211d	253
a4d8cae3	254	m4_divert(80)m4_dnl
bfdc045d MW	255	###--------------------------------------------------------------------------
	256	### Special forwarding exemptions.
	257
78af294c MW	258	case $forward in
	259	1)
	260
	261	## Only allow these packets if they're not fragmented. (Don't trust safe
	262	## hosts's fragment reassembly to be robust against malicious fragments.)
	263	## There's a hideous bug in iptables 1.4.11.1 which botches the meaning
	264	## of `! -f', so we do the negation using early return from a subchain.
	265	clearchain fwd-spec-nofrag
	266	run iptables -A fwd-spec-nofrag -j RETURN --fragment
	267	run ip6tables -A fwd-spec-nofrag -j RETURN \
	268	-m ipv6header --soft --header frag
87bf1592	269	run ip46tables -A FORWARD -j fwd-spec-nofrag
78af294c MW	270
	271	## Allow ping from safe/noloop to untrusted networks.
	272	run iptables -A fwd-spec-nofrag -j ACCEPT \
	273	-p icmp --icmp-type echo-request \
	274	-m mark --mark $to_untrusted/$MASK_TO
	275	run iptables -A fwd-spec-nofrag -j ACCEPT \
	276	-p icmp --icmp-type echo-reply \
	277	-m mark --mark $from_untrusted/$MASK_FROM \
	278	-m state --state ESTABLISHED
	279	run ip6tables -A fwd-spec-nofrag -j ACCEPT \
8b021091	280	-p icmpv6 --icmpv6-type echo-request \
78af294c MW	281	-m mark --mark $to_untrusted/$MASK_TO
78af294c MW	282	run ip6tables -A fwd-spec-nofrag -j ACCEPT \
8b021091	283	-p icmpv6 --icmpv6-type echo-reply \
78af294c MW	284	-m mark --mark $from_untrusted/$MASK_FROM \
	285	-m state --state ESTABLISHED
	286
	287	## Allow SSH from safe/noloop to untrusted networks.
cbbd5e39	288	run ip46tables -A fwd-spec-nofrag -j ACCEPT \
78af294c MW	289	-p tcp --destination-port $port_ssh \
78af294c MW	290	-m mark --mark $to_untrusted/$MASK_TO
cbbd5e39	291	run ip46tables -A fwd-spec-nofrag -j ACCEPT \
78af294c MW	292	-p tcp --source-port $port_ssh \
	293	-m mark --mark $from_untrusted/$MASK_FROM \
	294	-m state --state ESTABLISHED
	295
	296	;;
	297	esac
	298
a4d8cae3	299	m4_divert(80)m4_dnl
ade2c052 MW	300	###--------------------------------------------------------------------------
	301	### Kill things we don't understand properly.
	302	###
	303	### I don't like having to do this, but since I don't know how to do proper
	304	### multicast filtering, I'm just going to ban it from being forwarded.
	305
	306	errorchain poorly-understood REJECT
	307
	308	## Ban multicast destination addresses in forwarding.
78af294c MW	309	case $forward in
	310	1)
	311	run iptables -A FORWARD -g poorly-understood \
	312	-d 224.0.0.0/4
	313	run ip6tables -A FORWARD -g poorly-understood \
	314	-d ff::/8
	315	;;
	316	esac
ade2c052	317
a4d8cae3	318	m4_divert(84)m4_dnl
bfdc045d MW	319	###--------------------------------------------------------------------------
	320	### Locally-bound packet inspection.
	321
	322	clearchain inbound
	323
	324	## Track connections.
ecdca131	325	commonrules inbound
bfdc045d MW	326	conntrack inbound
	327
	328	## Allow incoming bootp. Bootp won't be forwarded, so this is obviously a
	329	## local request.
	330	run iptables -A inbound -j ACCEPT \
	331	-s 0.0.0.0 -d 255.255.255.255 \
	332	-p udp --source-port $port_bootpc --destination-port $port_bootps
	333	run iptables -A inbound -j ACCEPT \
	334	-s 172.29.198.0/23 \
	335	-p udp --source-port $port_bootpc --destination-port $port_bootps
	336
	337	## Allow incoming ping. This is the only ICMP left.
0291d6d5	338	run ip46tables -A inbound -j ACCEPT -p icmp
bfdc045d MW	339
	340	m4_divert(88)m4_dnl
	341	## Allow unusual things.
	342	openports inbound
	343
	344	## Inspect inbound packets from untrusted sources.
0291d6d5 MW	345	run ip46tables -A inbound -j forbidden
0291d6d5 MW	346	run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound
bfdc045d MW	347
bfdc045d MW	348	## Otherwise process as indicated by the mark.
f0033e07 MW	349	for i in $inchains; do
	350	run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT
	351	done
bfdc045d MW	352
	353	m4_divert(-1)
	354	###----- That's all, folks --------------------------------------------------