diff options
| author | Andreas Steffen <andreas.steffen@strongswan.org> | 2013-01-14 04:08:29 +0100 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2013-01-17 16:55:03 +0100 |
| commit | 5c09942d54a06cefb8d12b39c9188e79ed451152 (patch) | |
| tree | 1c0aff837de90d744f27d6d060fe7bc89319f83a /testing/hosts | |
| parent | a0ffe67fabc7e84ba5cdb533533668833231caf8 (diff) | |
| download | strongswan-5c09942d54a06cefb8d12b39c9188e79ed451152.tar.bz2 strongswan-5c09942d54a06cefb8d12b39c9188e79ed451152.tar.xz | |
converted all ipv6 iptables/ip6tables scenarios
Diffstat (limited to 'testing/hosts')
| -rw-r--r-- | testing/hosts/default/etc/ip6tables.rules | 4 | ||||
| -rw-r--r-- | testing/hosts/default/etc/iptables.drop | 12 |
2 files changed, 16 insertions, 0 deletions
diff --git a/testing/hosts/default/etc/ip6tables.rules b/testing/hosts/default/etc/ip6tables.rules index f793cb10d..6a2c6af8e 100644 --- a/testing/hosts/default/etc/ip6tables.rules +++ b/testing/hosts/default/etc/ip6tables.rules @@ -28,6 +28,10 @@ -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT -A OUTPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT +# allow crl and certficate fetch from winnetou +-A INPUT -i eth0 -p tcp --sport 80 -s fec0::15 -j ACCEPT +-A OUTPUT -o eth0 -p tcp --dport 80 -d fec0::15 -j ACCEPT + # log dropped packets -A INPUT -j LOG --log-prefix " IN: " -A OUTPUT -j LOG --log-prefix " OUT: " diff --git a/testing/hosts/default/etc/iptables.drop b/testing/hosts/default/etc/iptables.drop new file mode 100644 index 000000000..445c45669 --- /dev/null +++ b/testing/hosts/default/etc/iptables.drop @@ -0,0 +1,12 @@ +*filter + +# default policy is DROP +-P INPUT DROP +-P OUTPUT DROP +-P FORWARD DROP + +# allow ssh +-A INPUT -p tcp --dport 22 -j ACCEPT +-A OUTPUT -p tcp --sport 22 -j ACCEPT + +COMMIT |