#!/bin/sh
# network	: ipv6/mask || dns6/mask
#[ -z "$network" ] && local network="${net6}"
# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

#for subnet in $( $cmdEcho "$network" | $cmdTr -s ';' ' ') fe80::/10;do
for subnet in $( echo "$network" | tr -s ';' ' ') fe80::/10;do
 # icmp (Type 1 - Destination Unreachable)
 for code in $(seq 0 8);do
  local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 1/"${code}" -m state --state ESTABLISHED,RELATED,NEW"
  local  icmpIn="$icmpIn ;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 1/"${code}" -m state --state ESTABLISHED,RELATED,NEW"
 done
 
 # icmp (Type 2 - Packet Too Big )
 local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 2/0 -m state --state ESTABLISHED,RELATED,NEW"
 local  icmpIn="$icmpIn ;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 2/0 -m state --state ESTABLISHED,RELATED,NEW"
 # icmp (Type 3 - Time Exceeded )
 for code in 0 1;do
  local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 3/"${code}" -m state --state ESTABLISHED,RELATED,NEW"
  local  icmpIn="$icmpIn ;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 3/"${code}" -m state --state ESTABLISHED,RELATED,NEW"
 done
 # icmp (Type 4 - Parameter Problem )
 for code in 0 1 2;do
  local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 4/"${code}" -m state --state ESTABLISHED,RELATED,NEW"
  local  icmpIn="$icmpIn ;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 4/"${code}" -m state --state ESTABLISHED,RELATED,NEW"
 done
 # icmp (echo-reply:0/0, echo-request:8/0)
 local  icmpIn="$icmpIn	;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 128/0 -m state --state ESTABLISHED,RELATED,NEW"
 local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 129/0 -m state --state ESTABLISHED,RELATED,NEW"
 local  icmpIn="$icmpIn	;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 129/0 -m state --state ESTABLISHED,RELATED,NEW"
 local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 128/0 -m state --state ESTABLISHED,RELATED,NEW"
 
 # icmp (Type 1 - Destination Unreachable)
 for code in $(seq 0 8);do
  local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 1/"${code}""
  local  icmpIn="$icmpIn ;icmp	| -d "${ll6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 1/"${code}""
 done
 
 # icmp (echo-reply:0/0, echo-request:8/0)
 local  icmpIn="$icmpIn	;icmp	| -d "${ll6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 128/0"
 local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 129/0"
 local  icmpIn="$icmpIn	;icmp	| -d "${ll6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 129/0"
 #NETFILTER6_OUTPUTIN= OUT=enx2887ba045465 SRC=fe80:0000:0000:0000:2a87:baff:fe04:5465
 # DST=2606:4700:4700:0000:0000:0000:0000:1111 LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=428239 PROTO=ICMPv6 TYPE=128 CODE=0 ID=38975 SEQ=1 UID=0 GID=0 MARK=0xf
 #NETFILTER6_OUTPUTIN= OUT=enx2887ba045465 SRC=fe80:0000:0000:0000:2a87:baff:fe04:5465
 # DST=2606:4700:4700:0000:0000:0000:0000:1111 LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=402774 PROTO=ICMPv6 TYPE=128 CODE=0 ID=47857 SEQ=1 UID=0 GID=0 MARK=0xc
 local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 128/0"
 
 # === TYPE 135 : Neighbor Solicitation
 #NETFILTER6_INPUTIN=macvlan0 OUT= MAC=33:33:ff:00:00:8c:00:18:8b:8f:48:eb:86:dd SRC=fec0:0010:0090:0006:0000:0000:0000:0001
 #DST=ff02:0000:0000:0000:0000:0001:ff00:008c LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0x19
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ${ip6solicite}/128	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"

 # === TYPE 136 : Neighbor Advertisement ===
 #NETFILTER6_OUTPUTIN= OUT=macvlan0 SRC=fec0:0010:0090:0006:0000:0000:0000:005b
 # DST=fec0:0010:0090:0006:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0x1a
 local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}"	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"
done


# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |

#				-- CLIENT --
# [ TCP/SSH ]
#local clients="$clients|TCP	;ssh		;root/root"
# [ UDP/DOMAIN ]
#local clients="$clients|UDP	;domain		;root/root;1000/1000"
# [ TCP/DOMAIN ]
#local clients="$clients|TCP	;domain		;root/root;1000/1000"
#local clients="$clients|TCP	;domain		;Debian-exim/Debian-exim"

#				-- SERVER --
#local servers="$servers|TCP	;ssh		;root/root"