iptables-vti-ipsec-full.ipv6

*filter

## Block all traffic silently as default policy
## Take care because this can cause harm if wrongly configured
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP

## Allows all loopback (lo) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d ::1 -j REJECT

## Allow all traffic from and to Calcio network
-A INPUT -i eth0 -j ACCEPT
-A OUTPUT -o eth0 -j ACCEPT

# questionable if FWD for vxlan is needed

## allow incoming and outgoing traffic on vti interface
#-A INPUT -i vti42 -j ACCEPT
#-A OUTPUT -o vti42 -j ACCEPT
## allow routing on vti42 only if gre is not used
#-A FORWARD -i vti42 -j ACCEPT
#-A FORWARD -o vti42 -j ACCEPT

## allow icmp on inet0
-A INPUT -i inet0 -j ACCEPT -p icmp
-A OUTPUT -o inet0 -j ACCEPT -p icmp

## Allow all ICMP messages
-A INPUT  -p icmp -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT
-A FORWARD -p icmp -j ACCEPT

## reject forwarding on inet0 for debugging
#-A FORWARD -i inet0 -j REJECT --reject-with icmp-host-prohibited

## Block and reject traffic on net0 and net1 for debugging (if commented out will be dropped)
#-A INPUT -i net0 -j REJECT --reject-with icmp-host-prohibited
#-A INPUT -i net1 -j REJECT --reject-with icmp-host-prohibited
#-A OUTPUT -o net0 -j REJECT --reject-with icmp-host-prohibited
#-A OUTPUT -o net1 -j REJECT --reject-with icmp-host-prohibited

COMMIT

*mangle
# 1250 needs to be confirmed, 1387 was too much
-A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o inet0 -j TCPMSS --set-mss 1250
COMMIT