From 78f70f3b4d2dd8cdc3810e0b2ac4322961a60189 Mon Sep 17 00:00:00 2001
From: Swrup <swrup@protonmail.com>
Date: Wed, 2 Sep 2026 04:27:23 +0200
Subject: [PATCH] add iptables rules example

---
 ip6tables.rules.example | 26 ++++++++++++++++++++++++++
 iptables.rules.example  | 23 +++++++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 ip6tables.rules.example
 create mode 100644 iptables.rules.example

diff --git a/ip6tables.rules.example b/ip6tables.rules.example
new file mode 100644
index 00000000..5a5fe5e0
--- /dev/null
+++ b/ip6tables.rules.example
@@ -0,0 +1,26 @@
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+:TCP - [0:0]
+:UDP - [0:0]
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m conntrack --ctstate INVALID -j DROP
+
+# for ICMPv6 Neighbor Discovery Protocol
+# (note: need a corresponding line for each directly attached subnet)
+-A INPUT -p ipv6-icmp --icmpv6-type 128 -m conntrack --ctstate NEW -j ACCEPT
+-A INPUT -s fe80::/10 -p ipv6-icmp -j ACCEPT
+
+-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
+-A INPUT -p udp -j REJECT --reject-with icmp6-port-unreachable
+-A INPUT -p tcp -j REJECT --reject-with tcp-reset
+-A INPUT -j REJECT
+
+#  accept incoming connections on UDP port 546, to enable DHCPv6
+-A UDP -p udp --sport 547 --dport 546 -j ACCEPT
+
+
+COMMIT
diff --git a/iptables.rules.example b/iptables.rules.example
new file mode 100644
index 00000000..88d3637f
--- /dev/null
+++ b/iptables.rules.example
@@ -0,0 +1,23 @@
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+:TCP - [0:0]
+:UDP - [0:0]
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m conntrack --ctstate INVALID -j DROP
+-A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
+-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
+-A INPUT -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
+-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
+-A INPUT -p tcp -j REJECT --reject-with tcp-reset
+-A INPUT -j REJECT --reject-with icmp-proto-unreachable
+
+-A UDP -p udp --dport 53 -j ACCEPT
+-A TCP -p tcp --dport 53 -j ACCEPT
+-A TCP -p tcp --dport 3434 -j ACCEPT
+-A TCP -p tcp --dport 5432 -j ACCEPT
+
+
+COMMIT