lhn2ix

1 files changed, 99 insertions, 0 deletions

diff --git a/config/lhn2ix.txt b/config/lhn2ix.txt
index 93c4f83..b05d5d9 100644
--- a/config/lhn2ix.txt
+++ b/config/lhn2ix.txt
@@ -1,3 +1,98 @@
+set firewall all-ping enable
+set firewall broadcast-ping disable
+set firewall ipv6-name DN42v6_IN default-action drop
+set firewall ipv6-name DN42v6_IN description 'DN42 traffic through the router'
+set firewall ipv6-name DN42v6_IN enable-default-log
+set firewall ipv6-name DN42v6_IN rule 10 action accept
+set firewall ipv6-name DN42v6_IN rule 10 description 'Allow established/related sessions'
+set firewall ipv6-name DN42v6_IN rule 10 state established enable
+set firewall ipv6-name DN42v6_IN rule 10 state related enable
+set firewall ipv6-name DN42v6_IN rule 20 action drop
+set firewall ipv6-name DN42v6_IN rule 20 description 'Drop invalid state'
+set firewall ipv6-name DN42v6_IN rule 20 state invalid enable
+set firewall ipv6-name DN42v6_IN rule 30 action accept
+set firewall ipv6-name DN42v6_IN rule 30 description 'Allow IPv6 icmp'
+set firewall ipv6-name DN42v6_IN rule 30 protocol ipv6-icmp
+set firewall ipv6-name DN42v6_IN rule 100 action accept
+set firewall ipv6-name DN42v6_IN rule 100 description 'Allow anything from tnet (tcp)'
+set firewall ipv6-name DN42v6_IN rule 100 protocol tcp
+set firewall ipv6-name DN42v6_IN rule 100 source address 'fdb1:4242:3538:2000::/52'
+set firewall ipv6-name DN42v6_IN rule 101 action accept
+set firewall ipv6-name DN42v6_IN rule 101 description 'Allow anything from tnet (udp)'
+set firewall ipv6-name DN42v6_IN rule 101 protocol udp
+set firewall ipv6-name DN42v6_IN rule 101 source address 'fdb1:4242:3538:2000::/52'
+set firewall ipv6-name DN42v6_IN rule 200 action accept
+set firewall ipv6-name DN42v6_IN rule 200 description 'Allow SSH'
+set firewall ipv6-name DN42v6_IN rule 200 destination port 22
+set firewall ipv6-name DN42v6_IN rule 200 protocol tcp
+set firewall ipv6-name DN42v6_IN rule 201 action accept
+set firewall ipv6-name DN42v6_IN rule 201 description 'Allow HTTP'
+set firewall ipv6-name DN42v6_IN rule 201 destination port 80
+set firewall ipv6-name DN42v6_IN rule 201 protocol tcp
+set firewall ipv6-name DN42v6_IN rule 202 action accept
+set firewall ipv6-name DN42v6_IN rule 202 description 'Allow HTTPS'
+set firewall ipv6-name DN42v6_IN rule 202 destination port https
+set firewall ipv6-name DN42v6_IN rule 202 protocol tcp
+set firewall ipv6-name DN42v6_LOCAL default-action drop
+set firewall ipv6-name DN42v6_LOCAL description 'DN42 inbound traffic to the router'
+set firewall ipv6-name DN42v6_LOCAL enable-default-log
+set firewall ipv6-name DN42v6_LOCAL rule 10 action accept
+set firewall ipv6-name DN42v6_LOCAL rule 10 description 'Allow established/related sessions'
+set firewall ipv6-name DN42v6_LOCAL rule 10 state established enable
+set firewall ipv6-name DN42v6_LOCAL rule 10 state related enable
+set firewall ipv6-name DN42v6_LOCAL rule 20 action drop
+set firewall ipv6-name DN42v6_LOCAL rule 20 description 'Drop invalid state'
+set firewall ipv6-name DN42v6_LOCAL rule 20 state invalid enable
+set firewall ipv6-name DN42v6_LOCAL rule 30 action accept
+set firewall ipv6-name DN42v6_LOCAL rule 30 description 'Allow IPv6 icmp'
+set firewall ipv6-name DN42v6_LOCAL rule 30 protocol ipv6-icmp
+set firewall ipv6-name DN42v6_LOCAL rule 40 action accept
+set firewall ipv6-name DN42v6_LOCAL rule 40 description 'Allow SSH'
+set firewall ipv6-name DN42v6_LOCAL rule 40 destination port 22
+set firewall ipv6-name DN42v6_LOCAL rule 40 protocol tcp
+set firewall ipv6-name DN42v6_LOCAL rule 50 action accept
+set firewall ipv6-name DN42v6_LOCAL rule 50 description 'Allow BGP'
+set firewall ipv6-name DN42v6_LOCAL rule 50 destination port 179
+set firewall ipv6-name DN42v6_LOCAL rule 50 protocol tcp
+set firewall ipv6-name WANv6_IN default-action drop
+set firewall ipv6-name WANv6_IN description 'WAN inbound traffic forwarded to LAN'
+set firewall ipv6-name WANv6_IN rule 10 action accept
+set firewall ipv6-name WANv6_IN rule 10 description 'Allow established/related sessions'
+set firewall ipv6-name WANv6_IN rule 10 state established enable
+set firewall ipv6-name WANv6_IN rule 10 state related enable
+set firewall ipv6-name WANv6_IN rule 20 action drop
+set firewall ipv6-name WANv6_IN rule 20 description 'Drop invalid state'
+set firewall ipv6-name WANv6_IN rule 20 state invalid enable
+set firewall ipv6-name WANv6_LOCAL default-action drop
+set firewall ipv6-name WANv6_LOCAL description 'WAN inbound traffic to the router'
+set firewall ipv6-name WANv6_LOCAL enable-default-log
+set firewall ipv6-name WANv6_LOCAL rule 10 action accept
+set firewall ipv6-name WANv6_LOCAL rule 10 description 'Allow established/related sessions'
+set firewall ipv6-name WANv6_LOCAL rule 10 state established enable
+set firewall ipv6-name WANv6_LOCAL rule 10 state related enable
+set firewall ipv6-name WANv6_LOCAL rule 20 action drop
+set firewall ipv6-name WANv6_LOCAL rule 20 description 'Drop invalid state'
+set firewall ipv6-name WANv6_LOCAL rule 20 state invalid enable
+set firewall ipv6-name WANv6_LOCAL rule 30 action accept
+set firewall ipv6-name WANv6_LOCAL rule 30 description 'Allow IPv6 icmp'
+set firewall ipv6-name WANv6_LOCAL rule 30 protocol ipv6-icmp
+set firewall ipv6-name WANv6_LOCAL rule 40 action accept
+set firewall ipv6-name WANv6_LOCAL rule 40 description 'Allow DHCPv6'
+set firewall ipv6-name WANv6_LOCAL rule 40 destination port 546
+set firewall ipv6-name WANv6_LOCAL rule 40 protocol udp
+set firewall ipv6-name WANv6_LOCAL rule 40 source port 547
+set firewall ipv6-name WANv6_LOCAL rule 50 action accept
+set firewall ipv6-name WANv6_LOCAL rule 50 description 'Allow SSH'
+set firewall ipv6-name WANv6_LOCAL rule 50 destination port 22
+set firewall ipv6-name WANv6_LOCAL rule 50 protocol tcp
+set firewall ipv6-receive-redirects disable
+set firewall ipv6-src-route disable
+set firewall ip-src-route disable
+set firewall log-martians enable
+set firewall receive-redirects disable
+set firewall send-redirects enable
+set firewall source-validation disable
+set firewall syn-cookies enable
 set interfaces ethernet eth0 address dhcp
 set interfaces ethernet eth0 description Internet
 set interfaces ethernet eth0 dhcpv6-pd pd 0 interface switch0 host-address '::1'
@@ -6,6 +101,8 @@ set interfaces ethernet eth0 dhcpv6-pd pd 0 interface switch0 service slaac
 set interfaces ethernet eth0 dhcpv6-pd pd 0 prefix-length 56
 set interfaces ethernet eth0 dhcpv6-pd rapid-commit enable
 set interfaces ethernet eth0 duplex auto
+set interfaces ethernet eth0 firewall in ipv6-name WANv6_IN
+set interfaces ethernet eth0 firewall local ipv6-name WANv6_LOCAL
 set interfaces ethernet eth0 ipv6 address
 set interfaces ethernet eth0 ipv6 dup-addr-detect-transmits 1
 set interfaces ethernet eth0 poe output off
@@ -57,6 +154,8 @@ set interfaces switch switch0 switch-port interface eth4
 set interfaces switch switch0 switch-port vlan-aware disable
 set interfaces wireguard wg1 address 'fdb1:4242:3538:2f02::b/64'
 set interfaces wireguard wg1 description tnet-knot
+set interfaces wireguard wg1 firewall in ipv6-name DN42v6_IN
+set interfaces wireguard wg1 firewall local ipv6-name DN42v6_LOCAL
 set interfaces wireguard wg1 mtu 1420
 set interfaces wireguard wg1 peer Up8+DhBlMp+/fpaxyGDQBnH/4tZnHojcAKZWCr5sSAk= allowed-ips '::0/0'
 set interfaces wireguard wg1 peer Up8+DhBlMp+/fpaxyGDQBnH/4tZnHojcAKZWCr5sSAk= endpoint 'knot.inamo.no:51002'