################################################################################
*nat
################################################################################

:PREROUTING  ACCEPT [0:0]
:INPUT       ACCEPT [0:0]
:OUTPUT      ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

# Remove all rules from all chains.
-F
# Delete all user-defined chains.
-X

{{ iptables__nat_v6 }}
{{ iptables__nat_all }}

COMMIT



################################################################################
*filter
################################################################################

:INPUT   {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
:FORWARD DROP [0:0]
:OUTPUT  {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]

# Remove all rules from all chains.
-F
# Delete all user-defined chains.
-X

##########
# Custom #
##########

{{ iptables__filter_prepend0_v4 }}
{{ iptables__filter_prepend0_all }}
{{ iptables__filter_prepend1_v4 }}
{{ iptables__filter_prepend1_all }}
{{ iptables__filter_prepend2_v4 }}
{{ iptables__filter_prepend2_all }}

#######
# SSH #
#######

{{ iptables__filter_ssh_before_v4 }}
{{ iptables__filter_ssh_before_all }}

# Allow incoming SSH.
{% if iptables__ssh_ifaces %}
{% for iface in iptables__ssh_ifaces %}
-A INPUT  -i {{ iface }} -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o {{ iface }} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT
{% endfor %}
{% else %}
-A INPUT  -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT
{% endif %}

{{ iptables__filter_ssh_after_v4 }}
{{ iptables__filter_ssh_after_all }}

############
# Loopback #
############

{{ iptables__filter_loop_before_v4 }}
{{ iptables__filter_loop_before_all }}

# Allow all loopback (lo) traffic and reject anything
# to localhost that does not originate from lo.
-A INPUT   -i lo           -j ACCEPT
-A INPUT ! -i lo -s ::/128 -j REJECT
-A OUTPUT  -o lo           -j ACCEPT

{{ iptables__filter_loop_after_v4 }}
{{ iptables__filter_loop_after_all }}

############
# Outgoing #
############

{{ iptables__filter_out_before_v4 }}
{{ iptables__filter_out_before_all }}

# Allow all outgoing traffic.
{% if iptables__allow_output_ifaces %}
{% for iface in iptables__allow_output_ifaces %}
-A OUTPUT -o {{ iface }} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT  -i {{ iface }} -m conntrack --ctstate ESTABLISHED     -j ACCEPT
{% endfor %}
{% else %}
-A OUTPUT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT  -m conntrack --ctstate ESTABLISHED     -j ACCEPT
{% endif %}

{{ iptables__filter_out_after_v4 }}
{{ iptables__filter_out_after_all }}

########
# ICMP #
########

# Allow some important ICMP.
-A INPUT  -p icmpv6 --icmpv6-type echo-request   -j ACCEPT
-A OUTPUT -p icmpv6 --icmpv6-type echo-request   -j ACCEPT
-A INPUT  -p icmpv6 --icmpv6-type echo-reply     -j ACCEPT
-A OUTPUT -p icmpv6 --icmpv6-type echo-reply     -j ACCEPT
-A INPUT  -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
-A OUTPUT -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
-A INPUT  -p icmpv6 --icmpv6-type time-exceeded  -j ACCEPT
-A OUTPUT -p icmpv6 --icmpv6-type time-exceeded  -j ACCEPT
# TODO: maybe it's better to only allow these inside private network?
-A INPUT  -p icmpv6 --icmpv6-type router-solicitation     -j ACCEPT
-A OUTPUT -p icmpv6 --icmpv6-type router-solicitation     -j ACCEPT
-A INPUT  -p icmpv6 --icmpv6-type router-advertisement    -j ACCEPT
-A OUTPUT -p icmpv6 --icmpv6-type router-advertisement    -j ACCEPT
-A INPUT  -p icmpv6 --icmpv6-type neighbour-solicitation  -j ACCEPT
-A OUTPUT -p icmpv6 --icmpv6-type neighbour-solicitation  -j ACCEPT
-A INPUT  -p icmpv6 --icmpv6-type neighbour-advertisement -j ACCEPT
-A OUTPUT -p icmpv6 --icmpv6-type neighbour-advertisement -j ACCEPT
-A INPUT  -p icmpv6 --icmpv6-type redirect                -j ACCEPT
-A OUTPUT -p icmpv6 --icmpv6-type redirect                -j ACCEPT

# Deny other ICMPv6.
-A INPUT  -p icmpv6 -j DROP
-A OUTPUT -p icmpv6 -j DROP

##########
# Custom #
##########

{{ iptables__filter_append0_v4 }}
{{ iptables__filter_append0_all }}
{{ iptables__filter_append1_v4 }}
{{ iptables__filter_append1_all }}
{{ iptables__filter_append2_v4 }}
{{ iptables__filter_append2_all }}

COMMIT