example: add ipv6 filters examples

Signed-off-by: Aleksandr Alekseev <alexander.alekseev@virtuozzo.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
This commit is contained in:
Aleksandr Alekseev 2020-10-22 21:15:51 +03:00 committed by Ján Tomko
parent 113ccac237
commit 2d90e34a6f
7 changed files with 87 additions and 0 deletions

View File

@ -0,0 +1,27 @@
<filter name='allow-dhcpv6-server' chain='ipv6'>
<!-- accept outgoing DHCP requests.
note, this rule must be evaluated before general MAC broadcast
traffic is discarded since DHCP requests use MAC broadcast.
according to https://tools.ietf.org/html/rfc3315#section-14,
client sends messages to FF02::1:2 from link-local addresses -->
<rule action='accept' direction='out' priority='100'>
<ipv6 protocol='udp'
srcipaddr='FE80::'
srcipmask='10'
dstipaddr='FF02::1:2'
srcportstart='546'
dstportstart='547'/>
</rule>
<!-- accept incoming DHCP responses from a specific DHCP server
parameter DHPCSERVER needs to be passed from where this filter is
referenced -->
<rule action='accept' direction='in' priority='100' >
<ipv6 srcipaddr='$DHCPSERVER'
protocol='udp'
srcportstart='547'
dstportstart='546'/>
</rule>
</filter>

View File

@ -0,0 +1,24 @@
<filter name='allow-dhcpv6' chain='ipv6'>
<!-- accept outgoing DHCP requests.
note, this rule must be evaluated before general MAC broadcast
traffic is discarded since DHCP requests use MAC broadcast.
according to https://tools.ietf.org/html/rfc3315#section-14,
client sends messages to FF02::1:2 from link-local addresses -->
<rule action='accept' direction='out' priority='100'>
<ipv6 protocol='udp'
srcipaddr='FE80::'
srcipmask='10'
dstipaddr='FF02::1:2'
srcportstart='546'
dstportstart='547'/>
</rule>
<!-- accept incoming DHCP responses from any DHCP server -->
<rule action='accept' direction='in' priority='100' >
<ipv6 protocol='udp'
srcportstart='547'
dstportstart='546'/>
</rule>
</filter>

View File

@ -0,0 +1,3 @@
<filter name='allow-incoming-ipv6' chain='ipv6'>
<rule direction='in' action='accept'/>
</filter>

View File

@ -0,0 +1,3 @@
<filter name='allow-ipv6' chain='ipv6'>
<rule direction='inout' action='accept'/>
</filter>

View File

@ -2,8 +2,12 @@ nwfilter_xml_files = [
'allow-arp.xml',
'allow-dhcp-server.xml',
'allow-dhcp.xml',
'allow-dhcpv6-server.xml',
'allow-dhcpv6.xml',
'allow-incoming-ipv4.xml',
'allow-incoming-ipv6.xml',
'allow-ipv4.xml',
'allow-ipv6.xml',
'clean-traffic-gateway.xml',
'clean-traffic.xml',
'no-arp-ip-spoofing.xml',
@ -11,6 +15,8 @@ nwfilter_xml_files = [
'no-arp-spoofing.xml',
'no-ip-multicast.xml',
'no-ip-spoofing.xml',
'no-ipv6-multicast.xml',
'no-ipv6-spoofing.xml',
'no-mac-broadcast.xml',
'no-mac-spoofing.xml',
'no-other-l2-traffic.xml',

View File

@ -0,0 +1,9 @@
<filter name='no-ipv6-multicast' chain='ipv6'>
<!-- drop if destination IP address is in the ff00::/8 subnet -->
<rule action='drop' direction='out'>
<ipv6 dstipaddr='FF00::' dstipmask='8' />
</rule>
<!-- not doing anything with receiving side ... -->
</filter>

View File

@ -0,0 +1,15 @@
<filter name='no-ipv6-spoofing' chain='ipv6-ip' priority='-610'>
<!-- allow UDP sent from link-local addresses (DHCP);
filter more exact later -->
<rule action='return' direction='out' priority='100'>
<ipv6 srcipaddr='FE80::' srcipmask='10' protocol='udp'/>
</rule>
<!-- allow all known IP addresses -->
<rule direction='out' action='return' priority='500'>
<ipv6 srcipaddr='$IPV6'/>
</rule>
<!-- drop everything else -->
<rule direction='out' action='drop' priority='1000'/>
</filter>