Почему все так не любят defconf, может, по религиозным каким соображениям? 
01 | /ipv6 firewall address-list |
02 | add address=::/128 comment="defconf: unspecified address" list=bad_ipv6 |
03 | add address=::1/128 comment="defconf: lo" list=bad_ipv6 |
04 | add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6 |
05 | add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6 |
06 | add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6 |
07 | add address=100::/64 comment="defconf: discard only " list=bad_ipv6 |
08 | add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6 |
09 | add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6 |
10 | add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6 |
11 | add address=::224.0.0.0/100 comment="defconf: other" list=bad_ipv6 |
12 | add address=::127.0.0.0/104 comment="defconf: other" list=bad_ipv6 |
13 | add address=::/104 comment="defconf: other" list=bad_ipv6 |
14 | add address=::255.0.0.0/104 comment="defconf: other" list=bad_ipv6 |
15 | |
16 | /ipv6 firewall filter |
17 | add action=accept chain=input comment=\ |
18 | "defconf: accept established,related,untracked" connection-state=\ |
19 | established,related,untracked |
20 | add action=drop chain=input comment="defconf: drop invalid" connection-state=\ |
21 | invalid |
22 | add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\ |
23 | icmpv6 |
24 | add action=accept chain=input comment="defconf: accept UDP traceroute" port=\ |
25 | 33434-33534 protocol=udp |
26 | add action=accept chain=input comment=\ |
27 | "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\ |
28 | udp src-address=fe80::/10 |
29 | add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \ |
30 | protocol=udp |
31 | add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\ |
32 | ipsec-ah |
33 | add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\ |
34 | ipsec-esp |
35 | add action=accept chain=input comment=\ |
36 | "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec |
37 | add action=drop chain=input comment=\ |
38 | "defconf: drop everything else not coming from LAN" in-interface-list=\ |
39 | !LAN |
40 | add action=accept chain=forward comment=\ |
41 | "defconf: accept established,related,untracked" connection-state=\ |
42 | established,related,untracked |
43 | add action=drop chain=forward comment="defconf: drop invalid" \ |
44 | connection-state=invalid |
45 | add action=drop chain=forward comment=\ |
46 | "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6 |
47 | add action=drop chain=forward comment=\ |
48 | "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6 |
49 | add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \ |
50 | hop-limit=equal:1 protocol=icmpv6 |
51 | add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\ |
52 | icmpv6 |
53 | add action=accept chain=forward comment="defconf: accept HIP" protocol=139 |
54 | add action=accept chain=forward comment="defconf: accept IKE" dst-port=\ |
55 | 500,4500 protocol=udp |
56 | add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\ |
57 | ipsec-ah |
58 | add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\ |
59 | ipsec-esp |
60 | add action=accept chain=forward comment=\ |
61 | "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec |
62 | add action=drop chain=forward comment=\ |
63 | "defconf: drop everything else not coming from LAN" in-interface-list=\ |
64 | !LAN |
