#!/bin/sh
# network	: ipv6/mask || dns6/mask
#local network="$network;${net6}"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

# === TYPE 135 : Neighbor Solicitation ===
#NETFILTER6_OUTPUTIN= OUT=eth0 SRC=fec0:0010:0090:0006:0000:0000:0000:0010
# DST=ff02:0000:0000:0000:0000:0001:ff79:24fe LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xc
local icmpOut="$icmpOut;icmp	| -s "${net6}" -d ff02::1/16	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"

# === TYPE 136 : Neighbor Advertisement ===
# NETFILTER6_OUTPUTIN= OUT=eth0 SRC=2a02:842a:285a:9201:1d85:6542:8441:d644
# DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0x14
local icmpOut="$icmpOut;icmp	| -s "${net6}" -d ff02::1/128	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"

#NETFILTER6_INPUTIN=enx2887ba045465 OUT= MAC=28:87:ba:04:54:65:7c:c1:77:eb:e7:e0:86:dd SRC=fe80:0000:0000:0000:7ec1:77ff:feeb:e7e0
# DST=2a01:cb10:8ba1:9d00:2a87:baff:fe04:5465 LEN=72 TC=192 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xe
local  icmpIn="$icmpIn ;icmp	| -s "fe80::/10" -d "${net6}"	-p icmpv6 --icmpv6-type 135/0  -m hl --hl-eq 255"
#NETFILTER6_OUTPUTIN= OUT=enx2887ba045465 SRC=2a01:cb10:8ba1:9d00:2a87:baff:fe04:5465
# DST=fe80:0000:0000:0000:7ec1:77ff:feeb:e7e0 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xe
local icmpOut="$icmpOut;icmp	| -s "${net6}" -d "fe80::/10"	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"

for subnet in $(echo "$network" | tr -s ';' ' ');do

 # === TYPE 135 : Neighbor Solicitation ===
 #NETFILTER6_INPUTIN=eth1 OUT= MAC=33:33:ff:00:00:02:ac:f1:df:79:24:fe:86:dd SRC=fec0:0010:0090:0006:0000:0000:0000:0001
 # DST=ff02:0000:0000:0000:0000:0001:ff00:0002 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xf
 #NETFILTER6_INPUTIN=eth0 OUT= MAC=33:33:ff:64:04:75:a8:a7:95:12:9f:6d:86:dd SRC=2a02:842a:285a:9201:c12e:473e:d874:89e6
 # DST=ff02:0000:0000:0000:0000:0001:ff64:0475 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xb
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff02::/16	-p icmpv6 --icmpv6-type 135/0  -m hl --hl-eq 255"
 #NETFILTER6_OUTPUTIN= OUT=eth1 SRC=fe80:0000:0000:0000:0213:20ff:fe16:6a85
 # DST=fec0:0010:0090:0006:0000:0000:0000:0003 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xb
 local icmpOut="$icmpOut;icmp	| -s "fe80::/10" -d "${subnet}"	-p icmpv6 --icmpv6-type 135/0  -m hl --hl-eq 255"
 #NETFILTER6_INPUTIN=eth0 OUT= MAC=00:1b:11:64:04:75:a8:a7:95:12:9f:6d:86:dd SRC=2a02:842a:285a:9201:c12e:473e:d874:89e6
 # DST=2a02:842a:285a:9201:021b:11ff:fe64:0475 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xb
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d "${net6}"	-p icmpv6 --icmpv6-type 135/0  -m hl --hl-eq 255"
 
 # === TYPE 136 : Neighbor Advertisement ===
 #NETFILTER6_INPUTIN=eth0 OUT= MAC=33:33:00:00:00:01:d4:6a:6a:43:ac:69:86:dd SRC=2a02:842a:285a:9201:2c91:6dc5:a847:c58c
 # DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xa
 #NETFILTER6_INPUTIN=eth0 OUT= MAC=33:33:00:00:00:01:d4:6a:6a:43:ac:69:86:dd SRC=2a02:842a:285a:9201:7158:8bc3:dca1:e492
 # DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xa
 #NETFILTER6_INPUTIN=outbox0 OUT= MAC=33:33:00:00:00:01:70:85:c2:4d:42:68:86:dd SRC=fec0:0010:0090:0006:0000:0000:0000:0098
 # DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xc
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff02::1/128	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"
 #NETFILTER6_INPUTIN=outbox0 OUT= MAC=ac:f1:df:79:24:fe:00:13:20:16:6a:85:86:dd SRC=fec0:0010:0090:0006:0000:0000:0000:0002
 # DST=fe80:0000:0000:0000:aef1:dfff:fe79:24fe LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0x12
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d "fe80::/10"	-p icmpv6 --icmpv6-type 136/0  -m hl --hl-eq 255"
 #NETFILTER6_INPUTIN=enp9s0 OUT= MAC=00:23:ae:00:6f:6a:ac:f1:df:79:24:fe:86:dd SRC=fec0:0010:0090:0006:0000:0000:0000:0001
 # DST=fec0:0010:0090:0006:0000:0000:0000:0003 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0x10
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d "${net6}"	-p icmpv6 --icmpv6-type 136/0  -m hl --hl-eq 255"
 #NETFILTER6_OUTPUTIN= OUT=eth1 SRC=fec0:0010:0090:0006:0000:0000:0000:0002
 # DST=fec0:0010:0090:0006:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0x14
 #NETFILTER6_OUTPUTIN= OUT=eth1 SRC=fec0:0010:0090:0006:0000:0000:0000:0002
 # DST=fec0:0010:0090:0006:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xd
 #NETFILTER6_OUTPUTIN= OUT=eth1 SRC=fec0:0010:0090:0006:0000:0000:0000:0002
 # DST=fec0:0010:0090:0006:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xd
 local icmpOut="$icmpOut;icmp	| -s "${net6}" -d "${subnet}"	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"
done