if_untrusted=eth0.1
if_trusted=eth0.0
if_vpn=vpn-+
+if_iodine=dns+
if_its_mz=eth0.0
if_its_pi=eth0.0
###--------------------------------------------------------------------------
### vampire-specific rules.
-m4_divert(35)m4_dnl
-errorchain ddos-evil-dns DROP
-## Invalid DNS request with probably-forged sender address, with intent to
-## cause DDOS.
-
m4_divert(82)m4_dnl
-## Repelling evil DDos attack.
-run ipset -N ddos-evil-dns iphash 2>/dev/null || :
-run iptables -A inbound -g ddos-evil-dns \
- -m set --set ddos-evil-dns src \
- -p udp --destination-port $port_dns
-
## Externally visible services.
allowservices inbound tcp \
finger ident \
- dns \
+ dns iodine \
ssh \
smtp \
gnutella_svc \
ftp ftp_data \
rsync \
+ disorder mpd \
http https \
- git
-allowservices inbound tcp \
- tor_public tor_directory
+ git \
+ tor_public tor_directory i2p
allowservices inbound udp \
- dns \
+ dns iodine \
tripe \
- gnutella_svc
+ gnutella_svc \
+ i2p
## Provide DNS resolution to local untrusted hosts.
for p in tcp udp; do