SRFirewall/etc/ipv6.conf

127 lines
4.4 KiB
Plaintext
Raw Normal View History

# IPv4 Specific Configuration File
2014-03-30 10:16:22 -06:00
#
# Allow everything over loopback (lo ::1/28)
# Good idea to keep this turned on, but if you so wish to,
# you can disable it here.
2014-03-30 10:40:28 -06:00
# Values: no | yes (default)
2014-03-30 10:53:31 -06:00
AllowAllv6Loopback="yes"
# Very early on rules to allow for trusted machines to access
# this machine. Rather important and helps keep you from getting
# locked out should the firewalling rules go bad.
#
# IMPORTANT: Hosts put in the trusted file will have complete
# and unfettered access to the host, ignoring all other rules.
#
# Config file: ipv6/trusted.conf
2014-03-30 10:53:31 -06:00
# Values: no | yes (default)
EnableTrustedv6Hosts="yes"
# Enable MSS clamping to work around MTU size issues
# on network links such as PPPoE and wireless
# Config file: ipv6/mss-clamp.conf
2014-03-30 13:18:45 -06:00
# Values: no | yes (default)
Enablev6MSSClamp="yes"
2014-04-05 16:56:00 -06:00
# Enable connection tracking features of netfilter/iptables
# conntracking allows the firewall to be smart about what
# packets it allows and refuses. On highly loaded systems or
# ones with low memory, this may be desirable. Everyone else
# should probably leave this on.
2014-04-06 11:59:17 -06:00
# Depended on by: Enablev6NAT Enablev6ConnTrackInterfaces
2014-04-05 16:56:00 -06:00
# Values: no | yes (default)
Enablev6ConnectionTracking="yes"
2014-04-06 11:59:17 -06:00
# Interfaces to enable connection tracking by default
# List of interfaces to enable ESTABLISHED, RELATED, and INVALID on
# by default. Normally, this is helpful and a good idea. Some
# people with specific requirements may want to disable and do manually
# in the custom rules.
# Values: none | all (default)| interface name
Enablev6ConnTrackInterfaces="all"
2014-03-30 13:18:45 -06:00
# Use /etc/resolv.conf as source for DNS servers that we communicate
# with as a client. If you turn this off (recommended if on static IP),
# then you will need to manually define the DNS servers you use.
# Without conntrack rules allowing established/related, DNS traffic may
# be blocked and cause issues.
# Values: no | yes (default)
DNSClientUsev6ResolvConf="yes"
ResolvConfv6File="/etc/resolv.conf"
2014-03-30 13:36:55 -06:00
# Uncomment below if you set above to no. You can still manually define your servers
# here if you want. Useful at times.
# Values: space separated IP list of DNS servers
2014-03-31 17:37:38 -06:00
#DNSClientManualv6Servers=""
2014-04-06 11:06:11 -06:00
# Enable the Services access list
# This allows you to define services on the local
# machine that you want to be accessible to the world.
# Config file: ipv6/services.conf
# Values: no | yes (default)
Enablev6Services="yes"
2014-03-31 17:37:38 -06:00
# Enable the EasyBlock access list
# This is a simple/easy way to block traffic in or out,
# no complex options. Use the Filter options for more
# complex ACLs
# Config file: ipv6/easyblock.conf
# Values: no | yes (default)
2014-04-05 11:26:08 -06:00
Enablev6EasyBlock="yes"
# Enable IPv6 filtering rules
# This allows you to define complex access control list /
# filtering rules.
# Config file: ipv6/acl.conf
# Values: no | yes (default)
2014-04-05 14:53:01 -06:00
Enablev6Filtering="yes"
2014-04-05 16:39:57 -06:00
# Enable IPv6 forwarding rules
# This allows you to define forwarding rules
2014-04-06 12:37:40 -06:00
# Config file: ipv6/forward.conf
2014-04-05 16:39:57 -06:00
# Values: No | yes (default)
Enablev6Forwarding="yes"
2014-04-05 14:53:01 -06:00
# Enable IPv6 NAT/NETMAP rules
# This allows you to set up NAT rules, SNAT, MASQ, and NETMAP
2014-04-06 12:37:40 -06:00
# Config file: ipv6/nat.conf
2014-04-05 16:56:00 -06:00
# Requires: Enablev6ConnectionTracking="yes"
2014-04-05 14:53:01 -06:00
# Values: no | yes (default)
2014-04-06 12:37:40 -06:00
Enablev6NAT="yes"
# Enable IPv6 Port Forwarding rules
# This allows you to set up port forwarding rules to allow
# external access to internal machines
# Config file: ipv6/portfw.conf
# Values: no | yes (default)
Enablev6PortForwarding="yes"
2014-04-12 09:09:08 -06:00
# Enable loading of helper modules
# Load kernel modules for various helpers/ALGs that netfilter
# has available. You may need to modify the Loadv4NetfilterModules
# option as sometimes kernel modules may not exist or be renamed on
# a particular system.
# This is set to no by default on ipv6 because on my test system, I do not
# see any usable helper modules for ipv6 use. Obviously this may change
# in the future.
# Values: no (default) | yes
Enablev6NetfilterModules="no"
# List of kernel netfilter modules to Load
# Default: none
Loadv6NetfilterModules=""
# These are loaded as well if you have Enablev4NAT set to yes
# Default: none
Loadv6NetfilterModulesNAT=""
# Default policy for filtering rules
# netfilter/iptables has a default policy that can be set, such as
# DROP all unless it is explicitly allowed via rules.
# Values: ACCEPT (default) | DROP
# Please note if you do not specify policies, they will default to
# ACCEPT, which may not be what you want.
Defaultv6InPolicy="ACCEPT"
Defaultv6OutPolicy="ACCEPT"
Defaultv6FwdPolicy="ACCEPT"