diff --git a/minifirewall.d/default-input-v6 b/minifirewall.d/default-input-v6 index 38cfe3f..6ec4fd4 100644 --- a/minifirewall.d/default-input-v6 +++ b/minifirewall.d/default-input-v6 @@ -1,7 +1,9 @@ # shellcheck shell=sh disable=SC2034 # allow input HTTP/HTTPS/SMTP/DNS traffic -/sbin/ip6tables -A INPUT -i $INT -p tcp --sport 80 --match state --state ESTABLISHED,RELATED -j ACCEPT -/sbin/ip6tables -A INPUT -i $INT -p tcp --sport 443 --match state --state ESTABLISHED,RELATED -j ACCEPT -/sbin/ip6tables -A INPUT -i $INT -p tcp --sport 25 --match state --state ESTABLISHED,RELATED -j ACCEPT -/sbin/ip6tables -A INPUT -i $INT -p udp --sport 53 --match state --state ESTABLISHED,RELATED -j ACCEPT -/sbin/ip6tables -A INPUT -i $INT -p tcp --sport 53 --match state --state ESTABLISHED,RELATED -j ACCEPT +if [ "${IPV6}" != "off" ]; then + /sbin/ip6tables -A INPUT -i ${INT} -p tcp --sport 80 --match state --state ESTABLISHED,RELATED -j ACCEPT + /sbin/ip6tables -A INPUT -i ${INT} -p tcp --sport 443 --match state --state ESTABLISHED,RELATED -j ACCEPT + /sbin/ip6tables -A INPUT -i ${INT} -p tcp --sport 25 --match state --state ESTABLISHED,RELATED -j ACCEPT + /sbin/ip6tables -A INPUT -i ${INT} -p udp --sport 53 --match state --state ESTABLISHED,RELATED -j ACCEPT + /sbin/ip6tables -A INPUT -i ${INT} -p tcp --sport 53 --match state --state ESTABLISHED,RELATED -j ACCEPT +fi \ No newline at end of file diff --git a/minifirewall.d/dhcp-v6.example b/minifirewall.d/dhcp-v6.example index f2a60df..84e0438 100644 --- a/minifirewall.d/dhcp-v6.example +++ b/minifirewall.d/dhcp-v6.example @@ -1,4 +1,6 @@ # shellcheck shell=sh disable=SC2034 # allow DHCPv6 -/sbin/ip6tables -A INPUT -i $INT -p udp --dport 546 -d fe80::/64 -j ACCEPT -/sbin/ip6tables -A OUTPUT -o $INT -p udp --dport 547 -j ACCEPT \ No newline at end of file +if [ "${IPV6}" != "off" ]; then + /sbin/ip6tables -A INPUT -i ${INT} -p udp --dport 546 -d fe80::/64 -j ACCEPT + /sbin/ip6tables -A OUTPUT -o ${INT} -p udp --dport 547 -j ACCEPT +fi \ No newline at end of file diff --git a/minifirewall.d/dns-output-v6 b/minifirewall.d/dns-output-v6 index ac966ff..6711eb5 100644 --- a/minifirewall.d/dns-output-v6 +++ b/minifirewall.d/dns-output-v6 @@ -1,3 +1,5 @@ # shellcheck shell=sh disable=SC2034 # allow DNS output -/sbin/ip6tables -A OUTPUT -o $INT -p udp --dport 53 --match state --state NEW -j ACCEPT \ No newline at end of file +if [ "${IPV6}" != "off" ]; then + /sbin/ip6tables -A OUTPUT -o ${INT} -p udp --dport 53 --match state --state NEW -j ACCEPT +fi \ No newline at end of file diff --git a/minifirewall.d/ntp-output-v6 b/minifirewall.d/ntp-output-v6 index e1a27e1..dc7b1c4 100644 --- a/minifirewall.d/ntp-output-v6 +++ b/minifirewall.d/ntp-output-v6 @@ -1,3 +1,5 @@ # shellcheck shell=sh disable=SC2034 # allow NTP output -/sbin/ip6tables -A OUTPUT -o $INT -p udp --dport 123 --match state --state NEW -j ACCEPT \ No newline at end of file +if [ "${IPV6}" != "off" ]; then + /sbin/ip6tables -A OUTPUT -o ${INT} -p udp --dport 123 --match state --state NEW -j ACCEPT +fi \ No newline at end of file diff --git a/minifirewall.d/traceroute-output-v6.example b/minifirewall.d/traceroute-output-v6.example index 786f352..73696ae 100644 --- a/minifirewall.d/traceroute-output-v6.example +++ b/minifirewall.d/traceroute-output-v6.example @@ -1,3 +1,5 @@ # shellcheck shell=sh disable=SC2034 # allow traceroute output -#/sbin/ip6tables -A OUTPUT -o $INT -p udp --dport 33434:33523 --match state --state NEW -j ACCEPT \ No newline at end of file +if [ "${IPV6}" != "off" ]; then + /sbin/ip6tables -A OUTPUT -o ${INT} -p udp --dport 33434:33523 --match state --state NEW -j ACCEPT +fi \ No newline at end of file