#!/bin/sh
# network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
# LinkLocal "fe80::/64" | "fe80::/8"
local network="$network;${net6}"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

# === TYPE 130 : Multicast Listener Query ===
#local  icmpIn="$icmpIn ;icmp	| -d ff02::/16 -s "${gw}"	-p icmpv6 --icmpv6-type 130/0"

# === TYPE 131 :Multicast Listener Report ===
#NETFILTER6_OUTPUTIN= OUT=eth0 SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
# DST=ff02:0000:0000:0000:0000:0001:ff64:0475 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=131 CODE=0 MARK=0x11
local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d ff02::/16	-p icmpv6 --icmpv6-type 131/0 -m hl --hl-eq 1"
#NETFILTER6_INPUTIN=eth1 OUT= MAC= SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
# DST=ff02:0000:0000:0000:0000:0000:0000:0202 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=131 CODE=0 MARK=0x14
local  icmpIn="$icmpIn ;icmp	| -s "${ll6}/128" -d ff02::/16	-p icmpv6 --icmpv6-type 131/0 -m hl --hl-eq 1"

# --- FF05::2/128 : ALL ROUTER ON LOCALSITE ----------
#NETFILTER6_OUTPUTIN= OUT=eth0 SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
# DST=ff05:0000:0000:0000:0000:0000:0000:0002 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=131 CODE=0 MARK=0xc
local icmpOut="$icmpOut ;icmp	| -s "${ll6}/128" -d ff05::2/128	-p icmpv6 --icmpv6-type 131/0 -m hl --hl-eq 1"
#NETFILTER6_INPUTIN=eth0 OUT= MAC= SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
# DST=ff05:0000:0000:0000:0000:0000:0000:0002 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=131 CODE=0 MARK=0xb
local  icmpIn="$icmpIn ;icmp	| -s "${ll6}/128" -d ff05::2/128	-p icmpv6 --icmpv6-type 131/0 -m hl --hl-eq 1"

# === TYPE 134 : Router Advertisement ===
#NETFILTER6_OUTPUTIN= OUT=eth1 SRC=fe80:0000:0000:0000:0213:20ff:fe16:6a85
# DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=104 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=134 CODE=0 UID=0 GID=0 MARK=0xb
local icmpOut="$icmpOut ;icmp	| -s "${ll6}/128" -d ff02::1/128	-p icmpv6 --icmpv6-type 134/0 -m hl --hl-eq 255"

# === TYPE 135 : Neighbor Solicitation ===
#NETFILTER6_OUTPUTIN= OUT=eth0 SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
# DST=ff02:0000:0000:0000:0000:0001:ff00:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0x11
local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d ff02::/16	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
# === TYPE 142 : Inverse Neighbor Discovery Advertisement Message ===
#local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d ff02::/16 -p icmpv6 --icmpv6-type 142/0 -m state --state ESTABLISHED,RELATED,NEW"

# === TYPE 143 : Version 2 Multicast Listener Report
#NETFILTER6_OUTPUTIN= OUT=outbox0 SRC=fe80:0000:0000:0000:aef1:dfff:fe79:24fe
# DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=143 CODE=0 MARK=0xd4
local icmpOut="$icmpOut;icmp	| -s "${ll6}/128" -d ff02::/16	-p icmpv6 --icmpv6-type 143/0 -m hl --hl-eq 1"

for subnet in "fe80::/10";do
 # === TYPE 131 :Multicast Listener Report ===
 #NETFILTER6_INPUTIN=outbox0 OUT= MAC=33:33:ff:00:00:00:00:13:20:16:6a:85:86:dd SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
 # DST=ff02:0000:0000:0000:0000:0001:ff00:0000 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=131 CODE=0 MARK=0xa
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff02::/16	-p icmpv6 --icmpv6-type 131/0 -m hl --hl-eq 1"
 #NETFILTER6_INPUTIN=intranet0 OUT= MAC= SRC=fe80:0000:0000:0000:021b:11ff:fe64:0475
 # DST=ff05:0000:0000:0000:0000:0000:0000:0002 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=131 CODE=0 MARK=0x16"
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff05::2/128	-p icmpv6 --icmpv6-type 131/0 -m hl --hl-eq 1"
 
 # === TYPE 132 : Listener Done
 #NETFILTER6_INPUTIN=eth0 OUT= MAC=33:33:00:00:00:02:d4:6a:6a:43:ac:69:86:dd SRC=fe80:0000:0000:0000:663e:11e2:2c43:3657
 # DST=ff02:0000:0000:0000:0000:0000:0000:0002 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=132 CODE=0 MARK=0xa
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff02::2/128	-p icmpv6 --icmpv6-type 132/0 -m hl --hl-eq 1"
 # === TYPE Type 133 : Router Solicitation ===
 #NETFILTER6_INPUTIN=eth1 OUT= MAC=33:33:00:00:00:02:00:1d:72:aa:49:e3:86:dd SRC=fe80:0000:0000:0000:021d:72ff:feaa:49e3
 # DST=ff02:0000:0000:0000:0000:0000:0000:0002 LEN=56 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=133 CODE=0 MARK=0xb
 #NETFILTER6_INPUTIN=eth1 OUT= MAC=33:33:00:00:00:02:c2:ad:63:dc:26:27:86:dd SRC=fe80:0000:0000:0000:c0ad:63ff:fedc:2627
 # DST=ff02:0000:0000:0000:0000:0000:0000:0002 LEN=56 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=133 CODE=0 MARK=0xa
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff02::2/128	-p icmpv6 --icmpv6-type 133/0 -m hl --hl-eq 255"
 
 # === TYPE 134 : Router Advertisement ===
 #NETFILTER6_OUTPUTIN= OUT=outbox0 SRC=fe80:0000:0000:0000:aef1:dfff:fe79:24fe
 # DST=fe80:0000:0000:0000:021d:72ff:feaa:49e3 LEN=232 TC=0 HOPLIMIT=255 FLOWLBL=526663 PROTO=ICMPv6 TYPE=134 CODE=0 UID=0 GID=0 MARK=0xb
 local icmpOut="$icmpOut ;icmp	| -s "${ll6}/128" -d "${subnet}"	-p icmpv6 --icmpv6-type 134/0 -m hl --hl-eq 255"
 #NETFILTER6_INPUTIN=intranet0 OUT= MAC=33:33:00:00:00:01:0a:b3:6b:36:a6:ca:86:dd SRC=fe80:0000:0000:0000:08b3:6bff:fe36:a6ca
 # DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=208 TC=0 HOPLIMIT=255 FLOWLBL=393854 PROTO=ICMPv6 TYPE=134 CODE=0 MARK=0x10 
 #local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff02::1/128		-p icmpv6 --icmpv6-type 134/0 -m hl --hl-eq 255"
 
 # === TYPE 135 : Neighbor Solicitation ===
 #NETFILTER6_OUTPUTIN= OUT=eth1 SRC=fe80:0000:0000:0000:0213:20ff:fe16:6a85
 # DST=fe80:0000:0000:0000:021d:72ff:feaa:49e3 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xb
 local icmpOut="$icmpOut ;icmp	| -s "${ll6}/128" -d "${subnet}"	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
 #NETFILTER6_INPUTIN=outbox0 OUT= MAC=ac:f1:df:79:24:fe:00:13:20:16:6a:85:86:dd SRC=fe80:0000:0000:0000:0213:20ff:fe16:6a85
 # DST=fe80:0000:0000:0000:aef1:dfff:fe79:24fe LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0xa
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d "${ll6}/128"	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
 #NETFILTER6_INPUTIN=outbox0 OUT= MAC=33:33:ff:00:00:01:02:00:02:aa:49:e3:86:dd SRC=fe80:0000:0000:0000:021d:72ff:feaa:49e3
 # DST=ff02:0000:0000:0000:0000:0001:ff00:0001 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 MARK=0x11
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d ff02::/16	-p icmpv6 --icmpv6-type 135/0 -m hl --hl-eq 255"
 
 # === TYPE 136 : Neighbor Advertisement ===
 #NETFILTER6_OUTPUTIN= OUT=eth1 SRC=fe80:0000:0000:0000:0213:20ff:fe16:6a85
 # DST=fe80:0000:0000:0000:021d:72ff:feaa:49e3 LEN=64 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xb
 local icmpOut="$icmpOut ;icmp	| -s "${ll6}/128" -d "${subnet}"	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"
 #NETFILTER6_INPUTIN=outbox0 OUT= MAC=ac:f1:df:79:24:fe:00:1d:72:aa:49:e3:86:dd SRC=fe80:0000:0000:0000:021d:72ff:feaa:49e3
 # DST=fe80:0000:0000:0000:aef1:dfff:fe79:24fe LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 MARK=0xa
 local  icmpIn="$icmpIn ;icmp	| -s "${subnet}" -d "${ll6}/128"	-p icmpv6 --icmpv6-type 136/0 -m hl --hl-eq 255"
done

# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |

#				-- CLIENT --
# apprentissage ipv6
#local clients="$clients|UDP	;0:65535	;root/root"
#local clients="$clients|TCP	;0:65535	;root/root"

#				-- SERVER --
#local servers="$servers|UDP	;0:65535	;root/root"
#local servers="$servers|TCP	;0:65535	;root/root"