#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |

# LinkLocal "fe80::/64" | "fe80::/8"
local network="$network;${net6}"

#				-- CLIENT --
# apprentissage ipv6
#local clients="$clients|UDP	;0:65535	;root/root"
#local clients="$clients|TCP	;0:65535	;root/root"

#				-- SERVER --
#local servers="$servers|UDP	;0:65535	;root/root"
#local servers="$servers|TCP	;0:65535	;root/root"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

local  ruleIn="$ruleIn ;dhcserver	| -s "fe80::/10" -d ff02::/16 -p udp -m udp --sport 546  --dport 547 -m state --state NEW,ESTABLISHED,RELATED"
local  ruleOut="$ruleOut ;dhcserver	| -s "${ll6}" -d "fe80::/10" -p udp -m udp --sport 547 --dport 546 -m state --state NEW,ESTABLISHED,RELATED"

#NETFILTER6_OUTPUTIN= OUT=enp9s0 SRC=fe80:0000:0000:0000:0223:aeff:fe00:6f6a
# DST=fe80:0000:0000:0000:021d:72ff:feaa:49e3 LEN=188 TC=0 HOPLIMIT=64 FLOWLBL=220117 PROTO=UDP SPT=547 DPT=546 LEN=148 UID=0 GID=0 MARK=0x10

#for subnet in $(echo "$network" | tr -s ';' ' ');do
#
# # LET's PING OUT
# # DHCP
# # TYPE 135 : Neighbor Solicitation
# local  ruleIn="$ruleIn ;icmp	| -d ff02::/16 -s "$subnet" -p icmpv6 --icmpv6-type 135/0"
# local ruleOut="$ruleOut;icmp	| -s "$ip" -d ff02::/16 -p icmpv6 --icmpv6-type 135/0"
# local ruleOut="$ruleOut;icmp	| -s "$ip" -d "${subnet}" -p icmpv6 --icmpv6-type 135/0"
# # TYPE 136 : Neighbor Advertisement
# local ruleOut="$ruleOut;icmp	| -s "$ip" -d "${subnet}" -p icmpv6 --icmpv6-type 136/0"
# local  ruleIn="$ruleIn ;icmp	| -d "${ip6}" -s "${subnet}" -p icmpv6 --icmpv6-type 136/0"
#
# # Inverse Neighbor Discovery Advertisement Message
# local ruleOut="$ruleOut;icmp	| -s "$ip" -d ff02::/16 -p icmpv6 --icmpv6-type 142/0 -m state --state ESTABLISHED,RELATED,NEW"
#
# # icmp (echo-reply:0/0, echo-request:8/0)
# local  ruleIn="$ruleIn	;icmp	| -d "$ip" -s "$subnet" -p icmpv6 --icmpv6-type 128/0 -m state --state ESTABLISHED,RELATED,NEW"
# local ruleOut="$ruleOut;icmp	| -s "$ip" -d "$subnet" -p icmpv6 --icmpv6-type 129/0 -m state --state ESTABLISHED,RELATED"
# local  ruleIn="$ruleIn	;icmp	| -d "$ip" -s "$subnet" -p icmpv6 --icmpv6-type 129/0 -m state --state ESTABLISHED,RELATED"
# local ruleOut="$ruleOut;icmp	| -s "$ip" -d "$subnet" -p icmpv6 --icmpv6-type 128/0 -m state --state ESTABLISHED,RELATED,NEW"
# # icmp (Type 1 - Destination Unreachable)
# for code in $(seq 1 7);do
#  local ruleOut="$ruleOut;icmp	| -s "$ip" -d "$subnet" -p icmpv6 --icmpv6-type 1/"$code" -m state --state ESTABLISHED,RELATED,NEW"
#  local  ruleIn="$ruleIn ;icmp	| -d "$ip" -s "$subnet" -p icmpv6 --icmpv6-type 1/"$code" -m state --state ESTABLISHED,RELATED,NEW"
# done
#done