chiark / gitweb /
Merge branch 'master' of git.distorted.org.uk:~mdw/publish/public-git/firewall
[firewall] / ibanez.m4
CommitLineData
775bd287 1### -*-sh-*-
bfdc045d 2###
a3972fea 3### Firewall configuration for ibanez
bfdc045d
MW
4###
5### (c) 2008 Mark Wooding
6###
7
8###----- Licensing notice ---------------------------------------------------
9###
10### This program is free software; you can redistribute it and/or modify
11### it under the terms of the GNU General Public License as published by
12### the Free Software Foundation; either version 2 of the License, or
13### (at your option) any later version.
14###
15### This program is distributed in the hope that it will be useful,
16### but WITHOUT ANY WARRANTY; without even the implied warranty of
17### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18### GNU General Public License for more details.
19###
20### You should have received a copy of the GNU General Public License
21### along with this program; if not, write to the Free Software Foundation,
22### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
23
bfdc045d 24###--------------------------------------------------------------------------
a3972fea 25### ibanez-specific rules.
bfdc045d 26
1a42af95 27m4_divert(86)m4_dnl
bfdc045d
MW
28## Externally visible services.
29allowservices inbound tcp \
6f74cc82
MW
30 ssh \
31 ident
dd2c8474
MW
32allowservices inbound udp \
33 udpkey
bfdc045d 34
36307da9 35## We have to provide NTP service. The guests sync to our clock.
1ee6211d 36ntpclient inbound $ntp_servers
36307da9 37
f5a0901e
MW
38## Provide NTP service to untrusted clients.
39iptables -A inbound -p udp -j ACCEPT \
40 --source-port 123 --destination-port 123 \
41 -s 172.29.198.0/23
42ip6tables -A inbound -p udp -j ACCEPT \
43 --source-port 123 --destination-port 123 \
295959ea
MW
44 -s 2001:ba8:1d9::/48
45ip6tables -A inbound -p udp -j ACCEPT \
46 --source-port 123 --destination-port 123 \
47 -s 2001:8b0:c92::/48
f5a0901e 48
bfdc045d
MW
49m4_divert(-1)
50###----- That's all, folks --------------------------------------------------