mirror of https://github.com/trailofbits/algo
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
58 lines
2.8 KiB
Django/Jinja
58 lines
2.8 KiB
Django/Jinja
*mangle
|
|
:PREROUTING ACCEPT [0:0]
|
|
:INPUT ACCEPT [0:0]
|
|
:FORWARD ACCEPT [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
:POSTROUTING ACCEPT [0:0]
|
|
{% if max_mss is defined %}
|
|
-A FORWARD -s {{ vpn_network_ipv6 }} -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss {{ max_mss }}
|
|
{% endif %}
|
|
COMMIT
|
|
*nat
|
|
:PREROUTING ACCEPT [0:0]
|
|
:POSTROUTING ACCEPT [0:0]
|
|
-A POSTROUTING -s {{ vpn_network_ipv6 }} -m policy --pol none --dir out -j MASQUERADE
|
|
COMMIT
|
|
*filter
|
|
:INPUT DROP [0:0]
|
|
:FORWARD DROP [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
:ICMPV6-CHECK - [0:0]
|
|
:ICMPV6-CHECK-LOG - [0:0]
|
|
-A INPUT -i lo -j ACCEPT
|
|
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
-A INPUT -p esp -j ACCEPT
|
|
-A INPUT -m ah -j ACCEPT
|
|
# rate limit ICMP traffic per source
|
|
-A INPUT -p icmpv6 --icmpv6-type echo-request -m hashlimit --hashlimit-upto 5/s --hashlimit-mode srcip --hashlimit-srcmask 32 --hashlimit-name icmp-echo-drop -j DROP
|
|
-A INPUT -p udp -m multiport --dports 500,4500 -j ACCEPT
|
|
-A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
|
|
-A INPUT -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
|
|
-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
|
|
-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
|
|
-A INPUT -p icmpv6 --icmpv6-type redirect -m hl --hl-eq 255 -j ACCEPT
|
|
# TODO:
|
|
# The IP of the resolver should be bound to a DUMMY interface.
|
|
# DUMMY interfaces are the proper way to install IPs without assigning them any
|
|
# particular virtual (tun,tap,...) or physical (ethernet) interface.
|
|
-A INPUT -d fcaa::1 -p udp --dport 53 -j ACCEPT
|
|
{% if BetweenClients_DROP is defined and BetweenClients_DROP == "Y" %}
|
|
-A FORWARD -s {{ vpn_network_ipv6 }} -d {{ vpn_network_ipv6 }} -j DROP
|
|
{% endif %}
|
|
-A FORWARD -j ICMPV6-CHECK
|
|
-A FORWARD -p tcp --dport 445 -j DROP
|
|
-A FORWARD -p udp -m multiport --ports 137,138 -j DROP
|
|
-A FORWARD -p tcp -m multiport --ports 137,139 -j DROP
|
|
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
-A FORWARD -m conntrack --ctstate NEW -s {{ vpn_network_ipv6 }} -m policy --pol ipsec --dir in -j ACCEPT
|
|
# this is so potential malicious traffic can not reach anywhere over the server
|
|
# https://www.insinuator.net/2016/05/cve-2016-1409-ipv6-ndp-dos-vulnerability-in-cisco-software/
|
|
# other software implementations might be at least as broken as the one in CISCO gear.
|
|
-A ICMPV6-CHECK -p icmpv6 -m hl ! --hl-eq 255 --icmpv6-type router-solicitation -j ICMPV6-CHECK-LOG
|
|
-A ICMPV6-CHECK -p icmpv6 -m hl ! --hl-eq 255 --icmpv6-type router-advertisement -j ICMPV6-CHECK-LOG
|
|
-A ICMPV6-CHECK -p icmpv6 -m hl ! --hl-eq 255 --icmpv6-type neighbor-solicitation -j ICMPV6-CHECK-LOG
|
|
-A ICMPV6-CHECK -p icmpv6 -m hl ! --hl-eq 255 --icmpv6-type neighbor-advertisement -j ICMPV6-CHECK-LOG
|
|
-A ICMPV6-CHECK-LOG -j LOG --log-prefix "ICMPV6-CHECK-LOG DROP "
|
|
-A ICMPV6-CHECK-LOG -j DROP
|
|
COMMIT
|