Le firewall iptables ne gère que le filtrage des paquets en IPv4. Toutefois il existe une de iptables pour IPv6, on l'utilise grâce à la commande ip6tables. Le script qui suit est simplement une version adaptée pour IPv6 du script présenté pour IPv4.

Note : Pour plus d'informations sur le firewall iptables, se référer à la page de la version IPv4 du firewall.

#!/bin/bash
 
. /lib/lsb/init-functions
 
deny_everything() {
    log_action_begin_msg "Denying connections"
 
    ip6tables -t filter -P INPUT   DROP
    ip6tables -t filter -P FORWARD DROP
    ip6tables -t filter -P OUTPUT  DROP
 
    log_action_end_msg $?
}
 
accept_everything() {
  log_action_begin_msg "Accepting all connections"
 
  ip6tables -t filter -P INPUT   ACCEPT
  ip6tables -t filter -P FORWARD ACCEPT
  ip6tables -t filter -P OUTPUT  ACCEPT
 
  log_action_end_msg $?
}
 
 
cleanup_tables() {
    log_action_begin_msg "Cleaning up tables"
 
    ip6tables -t filter -F
    ip6tables -t filter -X
 
    log_action_end_msg $?
}
 
dont_break_connections() {
    log_action_begin_msg "Keeping active connections"
 
    ip6tables -A INPUT  -m state --state RELATED,ESTABLISHED -j ACCEPT
    ip6tables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 
    log_action_end_msg $?
}
 
allow_loopback() {
    log_action_begin_msg "Allowing loopback"
 
    ip6tables -t filter -A INPUT  -i lo -j ACCEPT
    ip6tables -t filter -A OUTPUT -o lo -j ACCEPT
 
    log_action_end_msg $?
}
 
open_input_port() {
    if [ $# -ne 2 ]; then
        exit 1
    fi
 
    log_action_begin_msg "Opening input port ${2} in ${1}"
 
    ip6tables -t filter -A INPUT -p "${1}" --dport "${2}" -j ACCEPT
 
    log_action_end_msg $?
}
 
open_output_port() {
    if [ $# -ne 2 ]; then
        exit 1
    fi
 
    log_action_begin_msg "Opening output port ${2} in ${1}"
 
    ip6tables -t filter -A OUTPUT -p "${1}" --dport "${2}" -j ACCEPT
 
    log_action_end_msg $?
}
 
allow_input_protocol() {
    if [ $# -ne 1 ]; then
        exit 1
    fi
 
    log_action_begin_msg "Allowing input protocol ${1}"
 
    ip6tables -t filter -A INPUT -p "${1}" -j ACCEPT
 
    log_action_end_msg $?
}
 
allow_output_protocol() {
    if [ $# -ne 1 ]; then
        exit 1
    fi
 
    log_action_begin_msg "Allowing output protocol ${1}"
 
    ip6tables -t filter -A OUTPUT -p "${1}" -j ACCEPT
 
    log_action_end_msg $?
}
 
case ${1} in
  start)
    # Stop fail to ban before configuring firewall
    /etc/init.d/fail2ban stop
    echo "Starting firewall configuration"
 
    deny_everything
    cleanup_tables
    dont_break_connections
 
    # Loopback
    allow_loopback
 
    # SSH
    open_input_port  tcp 22
    open_output_port tcp 22
 
    # DNS, FTP, HTTP, NTP
    open_output_port tcp  21
    open_output_port tcp  80
    open_output_port tcp  53
    open_output_port tcp 443
    open_output_port udp  53
    open_output_port udp 123
 
    # ICMP
    allow_input_protocol  icmpv6
    allow_output_protocol icmpv6
 
    # HTTP
    open_input_port tcp   80
    open_input_port tcp  443
 
    # MySQL
    open_input_port  tcp 3306
    open_output_port tcp 3306
 
    # POP, IMAP
    open_input_port  tcp  25
    open_input_port  tcp 110
    open_input_port  tcp 995
    open_input_port  tcp 143
    open_input_port  tcp 993
    open_output_port tcp  25
    open_output_port tcp 110
    open_output_port tcp 995
    open_output_port tcp 143
    open_output_port tcp 993
 
    # Mumble
    open_input_port  tcp 64738
    open_input_port  udp 64738
    open_output_port tcp 64738
    open_output_port udp 64738
 
    # Bazaar
    open_input_port  tcp 4155
    open_output_port tcp 4155
 
    # Keys server
    open_input_port  tcp 11371
    open_output_port tcp 11371
 
    # OpenVPN
    open_input_port  tcp 1194
    open_output_port tcp 1194
 
    # Transmission
    open_input_port  tcp  9091
    open_input_port  tcp 51413
    open_output_port tcp  9091
    open_output_port tcp 51413
 
    # Irssi
    open_input_port  tcp 6667
    open_input_port  udp 6667
    open_output_port tcp 6667
    open_output_port udp 6667
 
    # Minecraft
    for i in 25565 25566; do
        open_input_port  tcp ${i}
        open_input_port  udp ${i}
        open_output_port tcp ${i}
        open_output_port udp ${i}
    done
 
    # Steam
    for i in 7707 7708 7717 20560 28852; do
        open_input_port  udp ${i}
        open_output_port udp ${i}
    done
 
    for i in 8075 20560 28852; do
        open_input_port  tcp ${i}
        open_output_port tcp ${i}
    done
 
    for i in 27011 27900; do
        open_input_port  tcp ${i}
        open_input_port  udp ${i}
        open_output_port tcp ${i}
        open_output_port udp ${i}
    done
 
    # Starting fail2ban again
    /etc/init.d/fail2ban start
    echo "Firewall configuration done."
    exit 0
  ;;
 
  stop)
    echo "Stopping firewall configuration"
 
    accept_everything
    cleanup_tables
 
    echo "Success"
    exit 0
  ;;
 
  *)
    echo "Usage: /etc/init.d/firewall6 {start|stop}"
    exit 1
  ;;

Ce script peut être placé dans /etc/init.d/ et doit avoir les droits d'exécution pour être exécuté par root. Il est aussi recommandé de d'utiliser ce script lors du démarrage du système.

update-rc.d firewall6 defaults

L'utilisation manuel s'effectue par “start” pour démarrer le firewall, et par “stop” pour accepter toutes les connexions et vider toutes les règles.