#!/bin/sh
# network	: ipv6/mask || dns6/mask
# Net "fec0:10:90:6::/64"
#local network="$network;${net6}"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

# === TYPE 135 : Neighbor Solicitation ===
#NETFILTER6_OUTPUTIN= OUT=outbox0 SRC=fec0:0010:0090:0006:0000:0000:0000:0001
# DST=ff02:0000:0000:0000:0000:0001:ff00:0002 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xa
local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d ff02::/16	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
#NETFILTER6_INPUTIN=outbox0 OUT= MAC=ac:f1:df:79:24:fe:00:13:20:16:6a:85:86:dd SRC=fe80:0000:0000:0000:0213:20ff:fe16:6a85
# DST=fec0:0010:0090:0006:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xa
local  icmpIn="$icmpIn ;icmp	| -s fe80::/10 -d "${ip6}/128"	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"

# === TYPE 136 : Neighbor Advertisement ===
#NETFILTER6_OUTPUTIN= OUT=outbox0 SRC=fec0:0010:0090:0006:0000:0000:0000:0001
# DST=fe80:0000:0000:0000:7fd5:3d8c:2c67:d46a LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xa
#NETFILTER6_OUTPUTIN= OUT=outbox0 SRC=fec0:0010:0090:0006:0000:0000:0000:0001
# DST=fe80:0000:0000:0000:7fd5:3d8c:2c67:d46a LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xa
local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d fe80::/10	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"

for subnet in $(echo "$network" | tr -s ';' ' ');do
 #NETFILTER6_INPUTIN=eth1 OUT= MAC=00:13:20:16:6a:85:48:ba:4e:58:a8:fe:86:dd SRC=fec0:0010:0090:0006:0000:0000:0000:0150
 # DST=fec0:0010:0090:0006:0000:0000:0000:0002 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0x12
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d "${ip6}/128"	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
 # === TYPE 135 : Neighbor Solicitation ===
 #NETFILTER6_INPUTIN=eth1 OUT= MAC=33:33:ff:00:00:02:ac:f1:df:79:24:fe:86:dd SRC=fec0:0010:0090:0006:0000:0000:0000:0001
 # DST=ff02:0000:0000:0000:0000:0001:ff00:0002 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xb
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff02::/16	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
 #NETFILTER6_OUTPUTIN= OUT=eth1 SRC=fe80:0000:0000:0000:0213:20ff:fe16:6a85
 # DST=fec0:0010:0090:0006:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xa
 local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${subnet}"	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
 
 # === TYPE 136 : Neighbor Advertisement ===
 # NETFILTER6_OUTPUTIN= OUT=outbox0 SRC=fe80:0000:0000:0000:aef1:dfff:fe79:24fe
 # DST=fec0:0010:0090:0006:0000:0000:0000:0010 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xc
 local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${subnet}"	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"
 #NETFILTER6_INPUTIN=outbox0 OUT= MAC=ac:f1:df:79:24:fe:00:13:20:16:6a:85:86:dd SRC=fec0:0010:0090:0006:0000:0000:0000:0002
 # DST=fe80:0000:0000:0000:aef1:dfff:fe79:24fe LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xa
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d "${ll6}/128"	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"
 #NETFILTER6_OUTPUTIN= OUT=eth1 SRC=fec0:0010:0090:0006:0000:0000:0000:0002
 # DST=fec0:0010:0090:0006:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xa
 local icmpOut="$icmpOut ;icmp	| -s "${ip6}/128" -d "${subnet}"	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"
 #NETFILTER6_INPUTIN=outbox0 OUT= MAC=ac:f1:df:79:24:fe:00:13:20:16:6a:85:86:dd SRC=fec0:0010:0090:0006:0000:0000:0000:0002
 # DST=fec0:0010:0090:0006:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xb
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d "${ip6}/128"	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"
 #NETFILTER6_INPUTIN=intranet0 OUT= MAC=33:33:00:00:00:01:48:ba:4e:58:a8:fe:86:dd SRC=fec0:0010:0090:0006:0000:0000:0000:0098
 # DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0x1c
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d "ff02::1/128" -p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"
 
 # === TYPE 137 : Redirect ===
 #NETFILTER6_OUTPUTIN= OUT=eth1 SRC=fe80:0000:0000:0000:0213:20ff:fe16:6a85
 # DST=fec0:0010:0090:0006:0000:0000:0000:0001 LEN=200 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=137 CODE=0 MARK=0x13
 local icmpOut="$icmpOut ;icmp	| -s "${ll6}/128" -d "${subnet}"	-p icmpv6 --icmpv6-type 137/0 -m hl --hl-eq 255"
done