TommyBlue.it

~# cat /var/log/syslog | grep aiccu

Apr 28 08:50:19 voyage aiccu[1731]: sock_getline() : "200 Client Identity accepted"
Apr 28 08:50:19 voyage aiccu[1731]: sock_printf()  : "get unixtime"
Apr 28 08:50:19 voyage aiccu[1731]: sock_getline() : "200 1312374039"
Apr 28 08:50:19 voyage aiccu[1731]: The clock is off by 355469420 seconds, use NTP to sync it!
Apr 28 08:50:19 voyage aiccu[1731]: sock_printf()  : "QUIT Aborting: Clock is off by 355469420 seconds "
Apr 28 08:50:19 voyage aiccu[1731]: Couldn't retrieve first tunnel for the above reason, aborting

username MY_USERNAME
password MY_PASSWORD
protocol tic
server tic.sixxs.net
ipv6_interface sixxs
tunnel_id MY_TUNNEL
verbose false
daemonize true
automatic true
requiretls false
makebeats true

auto sixxs
iface sixxs inet6 v4tunnel
address MY_IPV6_IP
netmask 64
endpoint 213.254.12.34
ttl 64
up ip link set mtu 1280 dev sixxs
up ip route add default via MY_IPV6_GATEWAY dev sixxs

iface eth0 inet6 static
address MY_IP_FROM_SUBNET
netmask 64

interface eth0{
  AdvSendAdvert on;
  prefix MY_IP_FROM_SUBNET/64
  {
    AdvOnLink on;
    AdvAutonomous on;
    AdvRouterAddr on;
  };
};

echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.conf
echo "net.ipv6.conf.default.forwarding=1" >> /etc/sysctl.conf
sysctl -p

#! /bin/bash

### BEGIN INIT INFO
# Provides:             firewall-ipv6
# Required-Start:       $remote_fs $syslog
# Required-Stop:        $remote_fs $syslog
# Default-Start:        2 3 4 5
# Default-Stop:         0 1 6
# Short-Description:    IPTables-based IPv6 firewall
### END INIT INFO

set -e

# /etc/init.d/firewall-ipv6: start and stop the ip6tables firewall

IP6="/sbin/ip6tables"

# L'indirizzo IP di questa macchina
THIS_HOST="2001:1418:AAAA:AAAA::2"

# La subnet assegnata da SixXS
SUBNET_PREFIX="2001:1418:BBBB::/48"

stop_firewall() {
# First, delete all:
$IP6 -F
$IP6 -X

$IP6 -P INPUT   ACCEPT
$IP6 -P FORWARD ACCEPT
$IP6 -P OUTPUT  ACCEPT
}

start_firewall() {
stop_firewall

# Allow anything on the local link
$IP6 -A INPUT  -i lo -j ACCEPT
$IP6 -A OUTPUT -o lo -j ACCEPT

# Allow anything out on the internet
$IP6 -A OUTPUT -o sixxs -j ACCEPT

# Allow the localnet access us:
$IP6 -A INPUT    -i eth0   -j ACCEPT
$IP6 -A OUTPUT   -o eth0   -j ACCEPT

# Filter all packets that have RH0 headers:
$IP6 -A INPUT -m rt --rt-type 0 -j DROP
$IP6 -A FORWARD -m rt --rt-type 0 -j DROP
$IP6 -A OUTPUT -m rt --rt-type 0 -j DROP

# Allow Link-Local addresses
$IP6 -A INPUT -s fe80::/10 -j ACCEPT
$IP6 -A OUTPUT -s fe80::/10 -j ACCEPT

# Allow multicast
$IP6 -A INPUT -s ff00::/8 -j ACCEPT
$IP6 -A OUTPUT -s ff00::/8 -j ACCEPT

# Allow ICMPv6 everywhere
$IP6 -I INPUT  -p icmpv6 -j ACCEPT
$IP6 -I OUTPUT -p icmpv6 -j ACCEPT
$IP6 -I FORWARD -p icmpv6 -j ACCEPT

# Allow forwarding
$IP6 -A FORWARD -m state --state NEW -i eth0 -o sixxs -s $SUBNET_PREFIX -j ACCEPT
$IP6 -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# SSH verso questa macchina
$IP6 -A INPUT -i sixxs -p tcp -d $THIS_HOST --dport 22 -j ACCEPT

# Accesso a macchine della rete
#$IP6 -A FORWARD -i sixxs -p tcp -d $IP_DA_RAGGIUNGERE --dport $PORTA_DA_RAGGIUNGERE -j ACCEPT

# Set the default policy
$IP6 -P INPUT   DROP
$IP6 -P FORWARD DROP
$IP6 -P OUTPUT  ACCEPT
}

test -x $IP6 || exit 0

set -e

case "$1" in
start)
echo -e "Starting Firewall"
stop_firewall
start_firewall
;;
stop)
echo -e "Stopping Firewall"
stop_firewall
;;
restart)
echo -e "Restarting Firewall"
stop_firewall
start_firewall
;;
*)
N=/etc/init.d/$NAME
echo "Usage: $N {start|stop|restart}" >&2
exit 1
;;
esac

exit 0