This example shows how to set up a 3 way firewall using a tunnel to HE, two /64 subnets and a /48 address allocation from HE.
The private network is for client PC’s. The DMZ network is for servers, and the Tunnel interface is for a tunnel to the HE tunnel broker.
The way this is set up is to allow hosts on the private network to get to the IPV6 internet, or to the server DMZ. Hosts on server DMZ
can get to the IPV6 Internet, but not to the Private network. Incoming connections from HE have to be established or related.
Note: Please make sure your kernel is > 2.6.20 or the stateful firewall will not work correctly.
#!/bin/bash
# Tunnel Interface
TUNIF=he-ipv6
# DMZ interface (Where servers live)
DMZIF=eth1
# Private interface ( Where PC’s in the house live)
PRIVIF=eth0
# Clean Start
ip6tables -F
# Default Policy
ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT ACCEPT
# Input to the router
# Allow all loopback traffic
ip6tables -A INPUT -i lo -j ACCEPT
#Allow unrestricted access on private network
ip6tables -A INPUT -i $PRIVIF -j ACCEPT
# Allow restricted incoming connections
ip6tables -A INPUT -i $TUNIF -m state –state RELATED,ESTABLISHED -j ACCEPT
# Allow icmp, but throttle it.
ip6tables -A INPUT -j ACCEPT -p ipv6-icmp –match limit –limit 50/minute
# Allow SSH on port x (disabled in this example)
#ip6tables -A INPUT -i $TUNIF -p tcp –dport x -j ACCEPT
# IPV6 FORWARDING RULES
ip6tables -A FORWARD -i $PRIVIF -o $TUNIF -j ACCEPT
ip6tables -A FORWARD -i $TUNIF -o $PRIVIF -p ipv6-icmp –match limit –limit 50/minute -j ACCEPT
ip6tables -A FORWARD -i $TUNIF -o $PRIVIF -m state –state RELATED,ESTABLISHED -j ACCEPT
ip6tables -A FORWARD -i $DMZIF -o $PRIVIF -p ipv6-icmp –match limit –limit 50/minute -j ACCEPT
ip6tables -A FORWARD -i $DMZIF -o $PRIVIF -m state –state RELATED,ESTABLISHED -j ACCEPT
ip6tables -A FORWARD -i $PRIVIF -o $DMZIF -j ACCEPT
ip6tables -A FORWARD -i $TUNIF -o $DMZIF -m state –state RELATED,ESTABLISHED -j ACCEPT
ip6tables -A FORWARD -i $DMZIF -o $TUNIF -j ACCEPT
viaExample Forwarding between 3 interfaces using ipv6 for those interested.