ipv6 allow firewall

[automated-distro-installer] / wrt-setup-local

diff --git a/wrt-setup-local b/wrt-setup-local
index 8b7e4c98bcce3e4092f8ae247e8bc0e4555692a5..f5711d074b8aebd81b95cfcfbcc0d159e0b09ef3 100755 (executable)
--- a/wrt-setup-local
+++ b/wrt-setup-local
@@ -256,6 +256,10 @@ EOF
 uset dropbear.@dropbear[0].PasswordAuth 0
 uset dropbear.@dropbear[0].RootPasswordAuth 0
 uset dropbear.@dropbear[0].Port 2220
+if ! cmp -s /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key; then
+  cp /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key
+  dropbear_restart=true
+fi
 
 wireless_restart=false
 key=pictionary49
@@ -312,82 +316,125 @@ v cedit /etc/config/firewall <<EOF || firewall_restart=true
 
 
 config redirect
-    option name ssh
-    option src              wan
-    option src_dport        22
-    option dest_ip          $l.8
-    option dest             lan
+ option name ssh
+ option src              wan
+ option src_dport        22
+ option dest_ip          $l.8
+ option dest             lan
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        22
+ option src              wan
+ option target           ACCEPT
+ option dest_port        22
 
 config redirect
-    option name sshalt
-    option src              wan
-    option src_dport        2222
-    option dest_port        22
-    option dest_ip          $l.3
-    option dest             lan
+ option name sshalt
+ option src              wan
+ option src_dport        2222
+ option dest_port        22
+ option dest_ip          $l.3
+ option dest             lan
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        2222
+ option src              wan
+ option target           ACCEPT
+ option dest_port        2222
 
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        2220
+ option src              wan
+ option target           ACCEPT
+ option dest_port        2220
 
 
 config redirect
-    option src              wan
-    option src_dport        443
-    option dest             lan
-    option dest_ip          $l.8
-    option proto            tcp
+ option src              wan
+ option src_dport        443
+ option dest             lan
+ option dest_ip          $l.8
+ option proto            tcp
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        443
-    option proto            tcp
+ option src              wan
+ option target           ACCEPT
+ option dest_port        443
+ option proto            tcp
 
 config redirect
-    option src              wan
-    option src_dport        1196
-    option dest             lan
-    option dest_ip          $l.8
-    option proto            udp
+ option src              wan
+ option src_dport        1196
+ option dest             lan
+ option dest_ip          $l.8
+ option proto            udp
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        1196
-    option proto            udp
+ option src              wan
+ option target           ACCEPT
+ option dest_port        1196
+ option proto            udp
 
 
 config redirect
-    option src              wan
-    option src_dport        80
-    option dest             lan
-    option dest_ip          $l.8
-    option proto            tcp
+ option src              wan
+ option src_dport        80
+ option dest             lan
+ option dest_ip          $l.8
+ option proto            tcp
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        80
-    option proto            tcp
+ option src              wan
+ option target           ACCEPT
+ option dest_port        80
+ option proto            tcp
 
 config redirect
-    option name syncthing
-    option src              wan
-    option src_dport        22001
-    option dest_ip          $l.8
-    option dest             lan
+ option name syncthing
+ option src              wan
+ option src_dport        22001
+ option dest_ip          $l.8
+ option dest             lan
+config rule
+ option src              wan
+ option target           ACCEPT
+ option dest_port        22001
+
+
+config rule
+ option name ssh-ipv6
+ option src wan
+ option dest lan
+ # note, using mac transform, we could allow all traffic to a host like this,
+ # replacing 1 as appropriate
+ #option dest_ip ::111:11ff:fe11:1111/::ffff:ffff:ffff:ffff
+ option dest_port 22
+ option target ACCEPT
+ option family ipv6
+
 config rule
-    option src              wan
-    option target           ACCEPT
-    option dest_port        22001
+ option name http-ipv6
+ option src wan
+ option dest lan
+ option dest_port 80
+ option target ACCEPT
+ option family ipv6
 
+config rule
+ option name http-ipv6
+ option src wan
+ option dest lan
+ option dest_port 80
+ option target ACCEPT
+ option family ipv6
+
+config rule
+ option name node-exporter
+ option src wan
+ option dest lan
+ option dest_port 9101
+ option target ACCEPT
+ option family ipv6
+
+config rule
+ option name mail587-ipv6
+ option src wan
+ option dest lan
+ option dest_port 587
+ option target ACCEPT
+ option family ipv6
 
 
 EOF
@@ -524,6 +571,7 @@ EOF
 uset network.lan.ipaddr $l.$lanip
 uset network.lan.netmask $mask
 uset dhcp.wan.ignore $dev2 # default is false
+uset dhcp.lan.ignore $dev2 # default is false
 if $dev2; then
   uset network.lan.gateway $l.1
   uset network.wan.proto none