#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |

# LinkLocal "fe80::/64" | "fe80::/8"
#local network="$network;${net6}"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

# dhcpv6 client (546) / serveur ou relais (547)
# Réponse unicast du serveur/relais vers le client (cas que tu as capturé : SPT=547 DPT=546)
local ruleIn="$ruleIn          ;dhcpv6 | -s fe80::/10           -d "${ll6}/128"        -p udp -m udp --sport 547 --dport 546 -m state --state NEW,ESTABLISHED,RELATED"
# Advertise/Reply renvoyé en multicast par certains relais (rare, mais prévu par la RFC 8415 / oki mais alors uniquement en source du serveur dhcp fichier type ilinklocal)
#local ruleIn="$ruleIn          ;dhcpv6 | -s fe80::/10           -d ff02::1:2/128       -p udp -m udp --sport 547 --dport 546 -m state --state NEW,ESTABLISHED,RELATED"
# Solicit/Request/Confirm/Rebind/Decline/Release envoyés en multicast (adresse serveur inconnue)
local ruleOut="$ruleOut        ;dhcpv6 | -s "${ll6}/128"        -d ff02::1:2/128       -p udp -m udp --sport 546 --dport 547 -m state --state NEW"
# Renew/Release en unicast si le serveur a fourni son adresse (option "Server Unicast")
local ruleOut="$ruleOut        ;dhcpv6 | -s "${ll6}/128"        -d fe80::/10           -p udp -m udp --sport 546 --dport 547 -m state --state NEW,ESTABLISHED,RELATED"
 

#local  ruleOut="$ruleOut ;dhcclient	| -s "${ll6}/128" -d ff02::/16	-p udp -m udp --sport 546 --dport 547 -m state --state NEW"
##NETFILTER6_INPUTIN=eth0 OUT= MAC=00:1d:72:aa:49:e3:00:23:ae:00:6f:6a:86:dd SRC=fe80:0000:0000:0000:0223:aeff:fe00:6f6a
## DST=fe80:0000:0000:0000:021d:72ff:feaa:49e3 LEN=122 TC=0 HOPLIMIT=64 FLOWLBL=211442 PROTO=UDP SPT=547 DPT=546
#local  ruleIn="$ruleIn ;dhcclient	| -s "${ll6}/10" -d "${ll6}/128"	-p udp -m udp --sport 547 --dport 546 -m state --state NEW,ESTABLISHED,RELATED"

#				-- CLIENT --
# apprentissage ipv6
#local clients="$clients|UDP	;0:65535	;root/root"
#local clients="$clients|TCP	;0:65535	;root/root"

#				-- SERVER --
#local servers="$servers|UDP	;0:65535	;root/root"
#local servers="$servers|TCP	;0:65535	;root/root"