#!/bin/sh
# network	: ipv6:ipv6:::ipv6/mask || dns6/mask
# Local is all ips registered
#local network="$( ip6toolsGetIps | $cmdTr -s '[[:blank:]]' ';' );"
local network="${ip6};"

# ruleOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# ruleIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""
# dropOut	: iptables -t filter -A OUTPUT   -o ""$eth"" -j ""$rulesOut""
# dropIn	: iptables -t filter -A INPUT    -i ""$eth"" -j ""$rulesIn""

for subnet in $( $cmdEcho "$network" | $cmdTr -s ';' ' ');do
 # icmp (Type 1 - Destination Unreachable)
 for code in $(seq 1 7);do
#  local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${ip6}/128" -p icmpv6 --icmpv6-type 1/"${code}""
#  local  icmpIn="$icmpIn ;icmp	| -d "${ip6}/128" -s "${ip6}/128" -p icmpv6 --icmpv6-type 1/"${code}""
  local icmpOut="$icmpOut;icmp	| -p icmpv6 --icmpv6-type 1/"${code}""
  local  icmpIn="$icmpIn ;icmp	| -p icmpv6 --icmpv6-type 1/"${code}""
 done
 
 # icmp (Type 2 - Packet Too Big )
 local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 2/0 -m state --state ESTABLISHED,RELATED,NEW"
 local  icmpIn="$icmpIn ;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 2/0 -m state --state ESTABLISHED,RELATED,NEW"
 # icmp (Type 3 - Time Exceeded )
 for code in 0 1;do
  local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 3/"${code}" -m state --state ESTABLISHED,RELATED,NEW"
  local  icmpIn="$icmpIn ;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 3/"${code}" -m state --state ESTABLISHED,RELATED,NEW"
 done
 # icmp (Type 4 - Parameter Problem )
 for code in 0 1 2;do
  local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 4/"${code}" -m state --state ESTABLISHED,RELATED,NEW"
  local  icmpIn="$icmpIn ;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 4/"${code}" -m state --state ESTABLISHED,RELATED,NEW"
 done
 # icmp (echo-reply:0/0, echo-request:8/0)
 local  icmpIn="$icmpIn	;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 128/0 -m state --state ESTABLISHED,RELATED,NEW"
 local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 129/0 -m state --state ESTABLISHED,RELATED,NEW"
 local  icmpIn="$icmpIn	;icmp	| -d "${ip6}/128" -s "${subnet}" -p icmpv6 --icmpv6-type 129/0 -m state --state ESTABLISHED,RELATED,NEW"
 local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${subnet}" -p icmpv6 --icmpv6-type 128/0 -m state --state ESTABLISHED,RELATED,NEW"
 
 # icmp (echo-reply:129/0, echo-request:128/0)
# local  icmpIn="$icmpIn	;icmp	| -d "${ip6}/128" -s "${ip6}/128" -p icmpv6 --icmpv6-type 128/0 -m state --state ESTABLISHED,RELATED,NEW"
# local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${ip6}/128" -p icmpv6 --icmpv6-type 129/0 -m state --state ESTABLISHED,RELATED,NEW"
 local  icmpIn="$icmpIn	;icmp	| -p icmpv6 --icmpv6-type 128/0 -m state --state ESTABLISHED,RELATED,NEW"
 local icmpOut="$icmpOut;icmp	| -p icmpv6 --icmpv6-type 129/0 -m state --state ESTABLISHED,RELATED,NEW"

# local icmpOut="$icmpOut;icmp	| -s "${ip6}/128" -d "${ip6}/128" -p icmpv6 --icmpv6-type 128/0 -m state --state ESTABLISHED,RELATED,NEW"
# local  icmpIn="$icmpIn	;icmp	| -d "${ip6}/128" -s "${ip6}/128" -p icmpv6 --icmpv6-type 129/0 -m state --state ESTABLISHED,RELATED,NEW"
 local icmpOut="$icmpOut;icmp	| -p icmpv6 --icmpv6-type 128/0 -m state --state ESTABLISHED,RELATED,NEW"
 local  icmpIn="$icmpIn	;icmp	| -p icmpv6 --icmpv6-type 129/0 -m state --state ESTABLISHED,RELATED,NEW"
done

# clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
# forward	: PROTO ; PORT |

#				-- CLIENT --
#local clients="$clients|TCP	;ssh		;root/root"
#local clients="$clients|UDP	;domain		;root/root;root/Debian-exim"

#				-- SERVER --
#local servers="$servers|TCP	;ssh		;root/root"