Patch to have compatibility with poor non-IPv6 server
This commit is contained in:
parent
11ca1d1599
commit
e7a7f26951
|
@ -6,6 +6,8 @@
|
|||
# Interface concernee
|
||||
INT='eth0'
|
||||
|
||||
IPV6=on
|
||||
|
||||
# IP associee (plus utilisee dans les scripts)
|
||||
# INTIP='192.168.0.2'
|
||||
# reseau beneficiant d'acces privilegies
|
||||
|
|
14
minifirewall
14
minifirewall
|
@ -152,7 +152,7 @@ $IPT -N NEEDRESTRICT
|
|||
|
||||
# On autorise tout sur l'interface loopback
|
||||
$IPT -A INPUT -i lo -j ACCEPT
|
||||
$IPT6 -A INPUT -i lo -j ACCEPT
|
||||
[ $IPV6 != 'off' ] && $IPT6 -A INPUT -i lo -j ACCEPT
|
||||
# if OUTPUTDROP
|
||||
#$IPT -A OUTPUT -o lo -j ACCEPT
|
||||
|
||||
|
@ -185,13 +185,13 @@ for x in $SERVICESUDP1p
|
|||
for x in $SERVICESTCP1
|
||||
do
|
||||
$IPT -A INPUT -p tcp --dport $x -j ACCEPT
|
||||
$IPT6 -A INPUT -p tcp --dport $x -j ACCEPT
|
||||
[ $IPV6 != 'off' ] && $IPT6 -A INPUT -p tcp --dport $x -j ACCEPT
|
||||
done
|
||||
|
||||
for x in $SERVICESUDP1
|
||||
do
|
||||
$IPT -A INPUT -p udp --dport $x -j ACCEPT
|
||||
$IPT6 -A INPUT -p udp --dport $x -j ACCEPT
|
||||
[ $IPV6 != 'off' ] && $IPT6 -A INPUT -p udp --dport $x -j ACCEPT
|
||||
done
|
||||
|
||||
# Services semi-publics
|
||||
|
@ -282,13 +282,13 @@ for x in $NTPOK
|
|||
|
||||
# ICMP
|
||||
$IPT -A INPUT -p icmp -j ACCEPT
|
||||
$IPT6 -A INPUT -p icmpv6 -j ACCEPT
|
||||
[ $IPV6 != 'off' ] && $IPT6 -A INPUT -p icmpv6 -j ACCEPT
|
||||
|
||||
# politique
|
||||
|
||||
# par defaut rien ne rentre
|
||||
$IPT -P INPUT DROP
|
||||
$IPT6 -P INPUT DROP
|
||||
[ $IPV6 != 'off' ] && $IPT6 -P INPUT DROP
|
||||
|
||||
# par defaut rien ne transite (obsolete, notamment pour les VM)
|
||||
#echo 0 > /proc/sys/net/ipv4/ip_forward
|
||||
|
@ -297,7 +297,7 @@ $IPT6 -P INPUT DROP
|
|||
|
||||
# par defaut tout peut sortir (sinon voir OUTPUTDROP)
|
||||
$IPT -P OUTPUT ACCEPT
|
||||
$IPT6 -P OUTPUT ACCEPT
|
||||
[ $IPV6 != 'off' ] && $IPT6 -P OUTPUT ACCEPT
|
||||
|
||||
trap - INT TERM EXIT
|
||||
|
||||
|
@ -346,7 +346,6 @@ trap - INT TERM EXIT
|
|||
$IPT -t nat -L -n -v --line-numbers
|
||||
$IPT -t mangle -L -n -v --line-numbers
|
||||
$IPT6 -L -n -v --line-numbers
|
||||
$IPT6 -t nat -L -n -v --line-numbers
|
||||
$IPT6 -t mangle -L -n -v --line-numbers
|
||||
;;
|
||||
|
||||
|
@ -358,7 +357,6 @@ trap - INT TERM EXIT
|
|||
$IPT -t nat -Z
|
||||
$IPT -t mangle -Z
|
||||
$IPT6 -Z
|
||||
$IPT6 -t nat -Z
|
||||
$IPT6 -t mangle -Z
|
||||
;;
|
||||
|
||||
|
|
Loading…
Reference in New Issue