#!/bin/sh
# LinkLocal "fe80::/64" | "fe80::/10"
local network="$network;${net6}"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

# === TYPE 128 : Echo Request
#NETFILTER6_INPUTIN=inbox0 OUT= MAC=33:33:00:00:00:01:7c:c1:77:eb:e7:e0:86:dd SRC=fe80:0000:0000:0000:7ec1:77ff:feeb:e7e0
# DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=14083 SEQ=0 MARK=0xe
##NETFILTER6_INPUTIN=inbox0 OUT= MAC=33:33:00:00:00:01:7c:c1:77:eb:e7:e0:86:dd SRC=fe80:0000:0000:0000:7ec1:77ff:feeb:e7e0
## DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=14083 SEQ=0 MARK=0x18
local  icmpIn="$icmpIn	;icmp	| -s "${gw6}/128" -d ff02::1/128	-p icmpv6 --icmpv6-type 128/0 -m hl --hl-eq 255 -m state --state ESTABLISHED,RELATED,NEW"
#local  icmpIn="$icmpIn ;icmp	| -s "${gw6}/128" -d ff02::1/128	-p icmpv6 --icmpv6-type 128/0 -m hl --hl-eq 255"

# === TYPE 129 : Echo Reply
#NETFILTER6_OUTPUTIN= OUT=inbox0 SRC=fe80:0000:0000:0000:0218:8bff:fe8f:48eb
# DST=fe80:0000:0000:0000:7ec1:77ff:feeb:e7e0 LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=737686 PROTO=ICMPv6 TYPE=129 CODE=0 ID=14083 SEQ=0 MARK=0xb
local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${gw6}/128"	-p icmpv6 --icmpv6-type 129/0 -m hl --hl-eq 64"

# === TYPE 130 : Multicast Listener Query
# SRC=fe80:0000:0000:0000:0000:0000:0000:0001
# DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=130 CODE=0 MARK=0x10
#NETFILTER6_INPUTIN=eth0 OUT= MAC=33:33:00:00:00:01:b4:9d:fd:18:bf:d1:86:dd SRC=fe80:0000:0000:0000:0000:0000:0000:0001
# DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=130 CODE=0 MARK=0xc
#NETFILTER6_INPUTIN=internet0 OUT= MAC=33:33:00:00:00:01:b4:9d:fd:18:bf:d1:86:dd SRC=fe80:0000:0000:0000:0000:0000:0000:0001
# DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=130 CODE=0
local  icmpIn="$icmpIn	;icmp	| -s "${gw6}/128" -d ff02::1/128	-p icmpv6 --icmpv6-type 130/0 -m hl --hl-eq 1"

# INPUT <= TYPE 131/132 show linklocal6-routeur.client

# === TYPE 134 : Router Advertisement ===
#NETFILTER6_INPUTIN=enx2887ba045465 OUT= MAC=33:33:00:00:00:01:d0:5a:00:4c:f8:2c:86:dd SRC=fe80:0000:0000:0000:d25a:00ff:fe4c:f82c
# DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=128 TC=0 HOPLIMIT=255 FLOWLBL=314497 PROTO=ICMPv6 TYPE=134 CODE=0 MARK=0xf
local  icmpIn="$icmpIn ;icmp	| -s "${gw6}/128" -d ff02::/16		-p icmpv6 --icmpv6-type 134/0 -m hl --hl-eq 255"
#[ 3254.694498] NETFILTER6_INPUTIN=macvlan0 OUT= MAC=cc:2d:1b:b4:fd:c7:68:ab:09:9c:01:73:86:dd SRC=fe80:0000:0000:0000:0000:0000:0000:5555
# DST=fe80:0000:0000:0000:ce2d:1bff:feb4:fdc7 LEN=64 TC=192 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=134 CODE=0 MARK=0x154
local  icmpIn="$icmpIn ;icmp	| -s "${gw6}/128" -d "${ll6}/128"	-p icmpv6 --icmpv6-type 134/0 -m hl --hl-eq 255"

# === TYPE 135 : Neighbor Solicitation ===
# SRC=fe80:0000:0000:0000:7ec1:77ff:feeb:e7e0
# DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=192 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0x1a
#NETFILTER6_INPUTIN=inbox0 OUT= MAC=33:33:00:00:00:01:7c:c1:77:eb:e7:e0:86:dd SRC=fe80:0000:0000:0000:7ec1:77ff:feeb:e7e0
# DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=192 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xd
#NETFILTER6_INPUTIN=inbox0 OUT= MAC=33:33:ff:8f:48:eb:7c:c1:77:eb:e7:e0:86:dd SRC=fe80:0000:0000:0000:7ec1:77ff:feeb:e7e0
# DST=ff02:0000:0000:0000:0000:0001:ff8f:48eb LEN=72 TC=192 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xa
#NETFILTER6_INPUTIN=inbox0 OUT= MAC=33:33:00:00:00:01:7c:c1:77:eb:e7:e0:86:dd SRC=fe80:0000:0000:0000:7ec1:77ff:feeb:e7e0
# DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=192 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xa
local  icmpIn="$icmpIn ;icmp	| -s "${gw6}/128" -d ff02::1/16	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
#NETFILTER6_INPUTIN=eth0 OUT= MAC=00:1b:11:64:04:75:b4:9d:fd:18:bf:d1:86:dd SRC=fe80:0000:0000:0000:0000:0000:0000:0001
# DST=fe80:0000:0000:0000:021b:11ff:fe64:0475 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0x14
#NETFILTER6_INPUTIN=enx2887ba045465 OUT= MAC=28:87:ba:04:54:65:d0:5a:00:4c:f8:2c:86:dd SRC=fe80:0000:0000:0000:d25a:00ff:fe4c:f82c
# DST=fe80:0000:0000:0000:2a87:baff:fe04:5465 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xf
local  icmpIn="$icmpIn ;icmp	| -s "${gw6}/128" -d "${ll6}/128"	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
#NETFILTER6_OUTPUTIN= OUT=eth0 SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
# DST=fe80:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0x11
local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${gw6}/128"	-p icmpv6 --icmpv6-type 135/0  -m hl --hl-eq 255"

# === TYPE 136 : Neighbor Advertisement ===
#NETFILTER6_OUTPUTIN= OUT=eth0 SRC=2a02:842a:285a:9201:021b:11ff:fe64:0475
# DST=fe80:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0x14
local icmpOut="$icmpOut ;icmp	| -s "${ip6}/128" -d "${gw6}/128"	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"

#NETFILTER6_INPUTIN=eth0 OUT= MAC=00:1b:11:64:04:75:b4:9d:fd:18:bf:d1:86:dd SRC=fe80:0000:0000:0000:0000:0000:0000:0001
# DST=fe80:0000:0000:0000:021b:11ff:fe64:0475 LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0x11
#NETFILTER6_INPUTIN=eth0 OUT= MAC=00:1b:11:64:04:75:b4:9d:fd:18:bf:d1:86:dd SRC=fe80:0000:0000:0000:0000:0000:0000:0001
# DST=fe80:0000:0000:0000:021b:11ff:fe64:0475 LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0x11
#NETFILTER6_INPUTIN=eth0 OUT= MAC=00:1b:11:64:04:75:b4:9d:fd:18:bf:d1:86:dd SRC=fe80:0000:0000:0000:0000:0000:0000:0001
# DST=fe80:0000:0000:0000:021b:11ff:fe64:0475 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xc
local  icmpIn="$icmpIn ;icmp	| -s "${gw6}/128" -d "${ll6}/128" -p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"
#NETFILTER6_OUTPUTIN= OUT=eth0 SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
# DST=fe80:0000:0000:0000:0000:0000:0000:0001 LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0x14
#NETFILTER6_OUTPUTIN= OUT=eth0 SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
# DST=fe80:0000:0000:0000:0000:0000:0000:0001 LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xc
local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${gw6}/128" -p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"

#NETFILTER6_INPUTIN=eth0 OUT= MAC=00:1d:72:aa:49:e3:00:13:20:16:6a:85:86:dd SRC=fe80:0000:0000:0000:0213:20ff:fe16:6a85
# DST=fe80:0000:0000:0000:021d:72ff:feaa:49e3 LEN=200 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=137 CODE=0 MARK=0x17
local  icmpIn="$icmpIn ;icmp	| -s "${gw6}/128" -d "${ll6}/128" -p icmpv6 --icmpv6-type 137/0 -m hl --hl-eq 255"
#NETFILTER6_OUTPUTIN= OUT=br0 SRC=fe80:0000:0000:0000:ce2d:1bff:feb4:fdc7
# DST=fe80:0000:0000:0000:0000:0000:0000:5555 LEN=248 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=137 CODE=0 MARK=0xd
local  icmpOut="$icmpOut ;icmp	| -s "${ll6}/128" -d "${gw6}/128" -p icmpv6 --icmpv6-type 137/0 -m hl --hl-eq 255"

#for subnet in $(echo "$network" | tr -s ';' ' ');do
 
#done
# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |

#				-- CLIENT --
# apprentissage ipv6
#local clients="$clients|UDP	;0:65535	;root/root"
#local clients="$clients|TCP	;0:65535	;root/root"

#				-- SERVER --
#local servers="$servers|UDP	;0:65535	;root/root"
#local servers="$servers|TCP	;0:65535	;root/root"

# TYPE 130 : Multicast Listener Query
#local  icmpIn="$icmpIn ;icmp	| -d ff02::/16 -s "${ll6}" -p icmpv6 --icmpv6-type 130/0"