#!/bin/sh
# LinkLocal "fe80::/64" | "fe80::/10"
local network="$network;${net6}"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

# === TYPE 131 : Multicast Listener Report ===
#NETFILTER6_OUTPUTIN= OUT=eth0 SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
# DST=ff02:0000:0000:0000:0000:0001:ff00:0000 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=131 CODE=0 MARK=0xc
local icmpOut="$icmpOut ;icmp	| -s "${ll6}/128" -d ff02::/16		-p icmpv6 --icmpv6-type 131/0 -m hl --hl-eq 1"
local icmpOut="$icmpOut ;icmp	| -s "${ll6}/128" -d ff05::2/128	-p icmpv6 --icmpv6-type 131/0 -m hl --hl-eq 1"

# === TYPE 133 : Router Solicitation
#NETFILTER6_OUTPUTIN= OUT=enx2887ba045465 SRC=fe80:0000:0000:0000:2a87:baff:fe04:5465
# DST=ff02:0000:0000:0000:0000:0000:0000:0002 LEN=56 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=133 CODE=0 MARK=0xd
local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d ff02::/16		-p icmpv6 --icmpv6-type 133/0 -m hl --hl-eq 255"

# === TYPE 134 : Router Advertisement ===
#NETFILTER6_OUTPUTIN= OUT=eth0 SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
# DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=134 CODE=0 UID=0 GID=0 MARK=0xa
local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d ff02::1/128	-p icmpv6 --icmpv6-type 134/0 -m hl --hl-eq 255"

# === TYPE 135 : Neighbor Solicitation

#NETFILTER6_OUTPUTIN= OUT=eth0 SRC=fe80:0000:0000:0000:021d:72ff:feaa:49e3
# DST=ff02:0000:0000:0000:0000:0001:ff79:24fe LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xc
local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d ff02::/16	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
#NETFILTER6_OUTPUTIN= OUT=internet0 SRC=0000:0000:0000:0000:0000:0000:0000:0000
# DST=ff02:0000:0000:0000:0000:0001:ffa0:2af3 LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0x16
local icmpOut="$icmpOut;icmp	| -s "::/128" -d ff02::/16	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
#NETFILTER6_OUTPUTIN= OUT=internet0 SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
# DST=ff02:0000:0000:0000:0000:0001:ff00:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0
local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d ff02::/16	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
# === TYPE 143 : Version 2 Multicast Listener Report

#NETFILTER6_OUTPUTIN= OUT=enx2887ba045465 SRC=fe80:0000:0000:0000:2a87:baff:fe04:5465
# DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=116 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=143 CODE=0 MARK=0xd4
#NETFILTER6_OUTPUTIN= OUT=inbox0 SRC=fe80:0000:0000:0000:0218:8bff:fe8f:48eb
# DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=116 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=143 CODE=0 MARK=0xd4
local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d ff02::16/128	-p icmpv6 --icmpv6-type 143/0 -m hl --hl-eq 1"

for subnet in "fe80::/10" "${net6}";do
 # === TYPE 131 : Multicast Listener Report ===
 #NETFILTER6_OUTPUTIN= OUT=eth0 SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
 # DST=ff05:0000:0000:0000:0000:0000:0000:0002 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=131 CODE=0 MARK=0xa
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff02::/16		-p icmpv6 --icmpv6-type 131/0 -m hl --hl-eq 1"
 #NETFILTER6_INPUTIN=eth0 OUT= MAC= SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
 # DST=ff05:0000:0000:0000:0000:0000:0000:0002 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=131 CODE=0 MARK=0xb
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff05::2/128		-p icmpv6 --icmpv6-type 131/0 -m hl --hl-eq 1"
 
 # === TYPE 132 : Multicast Listener Done
 #NETFILTER6_INPUTIN=eth0 OUT= MAC=33:33:00:00:00:02:d4:6a:6a:43:ac:69:86:dd SRC=fe80:0000:0000:0000:663e:11e2:2c43:3657
 # DST=ff02:0000:0000:0000:0000:0000:0000:0002 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=132 CODE=0 MARK=0xe
 #NETFILTER6_INPUTIN=eth0 OUT= MAC=33:33:00:00:00:02:b4:9d:fd:18:bf:d1:86:dd SRC=fe80:0000:0000:0000:0000:0000:0000:0001
 # DST=ff02:0000:0000:0000:0000:0000:0000:0002 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=132 CODE=0 MARK=0xb
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff02::2/16		-p icmpv6 --icmpv6-type 132/0 -m hl --hl-eq 1"
 
 # === TYPE 134 : Router Advertisement ===
 #NETFILTER6_INPUTIN=inbox0 OUT= MAC=33:33:00:00:00:01:7c:c1:77:eb:e7:e0:86:dd SRC=fe80:0000:0000:0000:7ec1:77ff:feeb:e7e0
 # DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=160 TC=192 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=134 CODE=0 MARK=0xd
 #NETFILTER6_INPUTIN=enx2887ba045465 OUT= MAC=33:33:00:00:00:01:d0:5a:00:4c:f8:2c:86:dd SRC=fe80:0000:0000:0000:d25a:00ff:fe4c:f82c
 # DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=128 TC=0 HOPLIMIT=255 FLOWLBL=456657 PROTO=ICMPv6 TYPE=134 CODE=0 MARK=0xd
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff02::1/128	-p icmpv6 --icmpv6-type 134/0 -m hl --hl-eq 255"
 #NETFILTER6_INPUTIN=internet0 OUT= MAC=cc:2d:1b:b4:fd:c7:68:ab:09:9c:01:73:86:dd SRC=fe80:0000:0000:0000:0000:0000:0000:5555
 # DST=fe80:0000:0000:0000:ce2d:1bff:feb4:fdc7 LEN=64 TC=192 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=134 CODE=0 MARK=0x154
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d "${ll6}/128"	-p icmpv6 --icmpv6-type 134/0 -m hl --hl-eq 255"

 # === TYPE 135 : Neighbor Solicitation
 #NETFILTER6_INPUTIN=enx2887ba045465 OUT= MAC=33:33:00:00:00:01:7c:c1:77:eb:e7:e0:86:dd SRC=fe80:0000:0000:0000:7ec1:77ff:feeb:e7e0
 # DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=192 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0x12
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff02::1/128	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
 #NETFILTER6_INPUTIN=eth0 OUT= MAC=00:1b:11:64:04:75:a8:a7:95:12:9f:6d:86:dd SRC=fe80:0000:0000:0000:05c4:2bfd:8d3c:e05c
 # DST=fe80:0000:0000:0000:021b:11ff:fe64:0475 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xc
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d "${ll6}/128"	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
 #NETFILTER6_OUTPUTIN= OUT=enx2887ba045465 SRC=fe80:0000:0000:0000:2a87:baff:fe04:5465
 # DST=fe80:0000:0000:0000:7ec1:77ff:feeb:e7e0 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xf
 local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${subnet}"	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"

 # === TYPE 136 : Neighbor Advertisement ===
 #NETFILTER6_OUTPUTIN= OUT=eth0 SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
 # DST=fe80:0000:0000:0000:05c4:2bfd:8d3c:e05c LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xb
 local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${subnet}"	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"
 #NETFILTER6_INPUTIN=enx2887ba045465 OUT= MAC=28:87:ba:04:54:65:7c:c1:77:eb:e7:e0:86:dd SRC=fe80:0000:0000:0000:7ec1:77ff:feeb:e7e0
 # DST=fe80:0000:0000:0000:2a87:baff:fe04:5465 LEN=64 TC=192 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0x13
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d "${ll6}/128"	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"

 # icmp (Type 1 - Destination Unreachable)
 for code in $(seq 0 8);do
  local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 1/"${code}""
  local  icmpIn="$icmpIn ;icmp	| -d "${ll6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 1/"${code}""
 done
 
 # icmp (echo-reply:129/0, echo-request:1288/0)
 local  icmpIn="$icmpIn	;icmp	| -d "${ll6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 128/0"
 local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 129/0"
 local  icmpIn="$icmpIn	;icmp	| -d "${ll6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 129/0"
 local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 128/0"
 #NETFILTER6_INPUTIN=enx2887ba045465 OUT= MAC=33:33:00:00:00:01:7c:c1:77:eb:e7:e0:86:dd SRC=fe80:0000:0000:0000:7ec1:77ff:feeb:e7e0
 # DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=14083 SEQ=0 MARK=0xe
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff02::1/128	-p icmpv6 --icmpv6-type 128/0 -m hl --hl-eq 255"
done
# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |

#				-- CLIENT --
# apprentissage ipv6
#local clients="$clients|UDP	;0:65535	;root/root"
#local clients="$clients|TCP	;0:65535	;root/root"

#				-- SERVER --
#local servers="$servers|UDP	;0:65535	;root/root"
#local servers="$servers|TCP	;0:65535	;root/root"

# TYPE 130 : Multicast Listener Query
#local  icmpIn="$icmpIn ;icmp	| -d ff02::/16 -s "${ll6}" -p icmpv6 --icmpv6-type 130/0"