ꦫꦣꦺꦤ꧀ꦄꦤ꧀ꦠꦱꦺꦤ

PATH: var / lib / ucf / cache

#
# rules.before
#
# Rules that should be run before the ufw command line added rules. Custom
# rules should be added to one of these chains:
#   ufw6-before-input
#   ufw6-before-output
#   ufw6-before-forward
#

# Don't delete these required lines, otherwise there will be errors
*filter
:ufw6-before-input - [0:0]
:ufw6-before-output - [0:0]
:ufw6-before-forward - [0:0]
# End required lines

# allow all on loopback
-A ufw6-before-input -i lo -j ACCEPT
-A ufw6-before-output -o lo -j ACCEPT

# drop packets with RH0 headers
-A ufw6-before-input -m rt --rt-type 0 -j DROP
-A ufw6-before-forward -m rt --rt-type 0 -j DROP
-A ufw6-before-output -m rt --rt-type 0 -j DROP

# quickly process packets for which we already have a connection
-A ufw6-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw6-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw6-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# multicast ping replies are part of the ok icmp codes for INPUT (rfc4890,
# 4.4.1 and 4.4.2), but don't have an associated connection and are otherwise
# be marked INVALID, so allow here instead.
-A ufw6-before-input -p icmpv6 --icmpv6-type echo-reply -j ACCEPT

# drop INVALID packets (logs these in loglevel medium and higher)
-A ufw6-before-input -m conntrack --ctstate INVALID -j ufw6-logging-deny
-A ufw6-before-input -m conntrack --ctstate INVALID -j DROP

# ok icmp codes for INPUT (rfc4890, 4.4.1 and 4.4.2)
-A ufw6-before-input -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
# codes 0 and 1
-A ufw6-before-input -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
# codes 0-2 (echo-reply needs to be before INVALID, see above)
-A ufw6-before-input -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type echo-request -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
-A ufw6-before-input -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
# IND solicitation
-A ufw6-before-input -p icmpv6 --icmpv6-type 141 -m hl --hl-eq 255 -j ACCEPT
# IND advertisement
-A ufw6-before-input -p icmpv6 --icmpv6-type 142 -m hl --hl-eq 255 -j ACCEPT
# MLD query
-A ufw6-before-input -p icmpv6 --icmpv6-type 130 -s fe80::/10 -j ACCEPT
# MLD report
-A ufw6-before-input -p icmpv6 --icmpv6-type 131 -s fe80::/10 -j ACCEPT
# MLD done
-A ufw6-before-input -p icmpv6 --icmpv6-type 132 -s fe80::/10 -j ACCEPT
# MLD report v2
-A ufw6-before-input -p icmpv6 --icmpv6-type 143 -s fe80::/10 -j ACCEPT
# SEND certificate path solicitation
-A ufw6-before-input -p icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -j ACCEPT
# SEND certificate path advertisement
-A ufw6-before-input -p icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -j ACCEPT
# MR advertisement
-A ufw6-before-input -p icmpv6 --icmpv6-type 151 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
# MR solicitation
-A ufw6-before-input -p icmpv6 --icmpv6-type 152 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
# MR termination
-A ufw6-before-input -p icmpv6 --icmpv6-type 153 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT

# ok icmp codes for OUTPUT (rfc4890, 4.4.1 and 4.4.2)
-A ufw6-before-output -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
# codes 0 and 1
-A ufw6-before-output -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
# codes 0-2
-A ufw6-before-output -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type echo-request -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
-A ufw6-before-output -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
# IND solicitation
-A ufw6-before-output -p icmpv6 --icmpv6-type 141 -m hl --hl-eq 255 -j ACCEPT
# IND advertisement
-A ufw6-before-output -p icmpv6 --icmpv6-type 142 -m hl --hl-eq 255 -j ACCEPT
# MLD query
-A ufw6-before-output -p icmpv6 --icmpv6-type 130 -s fe80::/10 -j ACCEPT
# MLD report
-A ufw6-before-output -p icmpv6 --icmpv6-type 131 -s fe80::/10 -j ACCEPT
# MLD done
-A ufw6-before-output -p icmpv6 --icmpv6-type 132 -s fe80::/10 -j ACCEPT
# MLD report v2
-A ufw6-before-output -p icmpv6 --icmpv6-type 143 -s fe80::/10 -j ACCEPT
# SEND certificate path solicitation
-A ufw6-before-output -p icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -j ACCEPT
# SEND certificate path advertisement
-A ufw6-before-output -p icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -j ACCEPT
# MR advertisement
-A ufw6-before-output -p icmpv6 --icmpv6-type 151 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
# MR solicitation
-A ufw6-before-output -p icmpv6 --icmpv6-type 152 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT
# MR termination
-A ufw6-before-output -p icmpv6 --icmpv6-type 153 -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT

# ok icmp codes for FORWARD (rfc4890, 4.3.1)
-A ufw6-before-forward -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
-A ufw6-before-forward -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
# codes 0 and 1
-A ufw6-before-forward -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
# codes 0-2
-A ufw6-before-forward -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
-A ufw6-before-forward -p icmpv6 --icmpv6-type echo-request -j ACCEPT
-A ufw6-before-forward -p icmpv6 --icmpv6-type echo-reply -j ACCEPT
# ok icmp codes for FORWARD (rfc4890, 4.3.2)
# Home Agent Address Discovery Reques
-A ufw6-before-input -p icmpv6 --icmpv6-type 144 -j ACCEPT
# Home Agent Address Discovery Reply
-A ufw6-before-input -p icmpv6 --icmpv6-type 145 -j ACCEPT
# Mobile Prefix Solicitation
-A ufw6-before-input -p icmpv6 --icmpv6-type 146 -j ACCEPT
# Mobile Prefix Advertisement
-A ufw6-before-input -p icmpv6 --icmpv6-type 147 -j ACCEPT

# allow dhcp client to work
-A ufw6-before-input -p udp -s fe80::/10 --sport 547 -d fe80::/10 --dport 546 -j ACCEPT

# allow MULTICAST mDNS for service discovery
-A ufw6-before-input -p udp -d ff02::fb --dport 5353 -j ACCEPT

# allow MULTICAST UPnP for service discovery
-A ufw6-before-input -p udp -d ff02::f --dport 1900 -j ACCEPT

# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT

[-] :etc:php:8.0:mods-available:phar.ini [edit]
[-] :etc:php:8.0:mods-available:opcache.ini [edit]
[-] :etc:php:8.0:mods-available:ffi.ini [edit]
[-] :etc:php:7.4:mods-available:sysvshm.ini [edit]
[-] :etc:php:8.0:mods-available:mysqlnd.ini [edit]
[-] :etc:php:8.0:mods-available:xml.ini [edit]
[-] :etc:php:7.4:mods-available:sysvsem.ini [edit]
[-] :etc:php:7.4:mods-available:bz2.ini [edit]
[-] :etc:php:8.0:mods-available:fileinfo.ini [edit]
[-] :etc:php:7.4:mods-available:phar.ini [edit]
[-] :etc:php:8.0:mods-available:shmop.ini [edit]
[-] :etc:php:7.4:mods-available:opcache.ini [edit]
[-] :etc:ufw:before.rules [edit]
[-] :etc:php:8.0:mods-available:readline.ini [edit]
[-] :etc:php:8.0:mods-available:sockets.ini [edit]
[-] :etc:ufw:after.rules [edit]
[-] :etc:php:7.4:mods-available:exif.ini [edit]
[-] :etc:php:8.0:mods-available:curl.ini [edit]
[-] :etc:apt:apt.conf.d:50unattended-upgrades [edit]
[-] :etc:php:7.4:mods-available:mysqlnd.ini [edit]
[-] :etc:php:7.4:mods-available:tokenizer.ini [edit]
[-] :etc:php:8.0:mods-available:gettext.ini [edit]
[-] :etc:php:8.0:mods-available:tokenizer.ini [edit]
[-] :etc:dbconfig-common:config [edit]
[-] :etc:default:grub [edit]
[-] :etc:php:7.4:mods-available:pdo_sqlite.ini [edit]
[-] :etc:php:8.0:mods-available:xmlreader.ini [edit]
[-] :etc:php:7.4:mods-available:sysvmsg.ini [edit]
[-] :etc:rsyslog.d:50-default.conf [edit]
[-] :etc:ssh:sshd_config [edit]
[-] :etc:php:8.0:mods-available:sysvshm.ini [edit]
[+] ..
[-] :etc:ufw:before6.rules [edit]
[-] :etc:php:8.0:mods-available:sysvmsg.ini [edit]
[-] :etc:php:8.0:mods-available:pdo.ini [edit]
[-] :etc:php:7.4:mods-available:dom.ini [edit]
[-] :etc:php:8.0:mods-available:ctype.ini [edit]
[-] :etc:dbconfig-common:phpmyadmin.conf [edit]
[-] :etc:php:8.0:mods-available:simplexml.ini [edit]
[-] :etc:php:7.4:mods-available:intl.ini [edit]
[-] :etc:php:8.0:mods-available:calendar.ini [edit]
[-] :etc:php:7.4:mods-available:iconv.ini [edit]
[-] :etc:php:7.4:mods-available:simplexml.ini [edit]
[-] :etc:ufw:after6.rules [edit]
[-] :etc:php:7.4:mods-available:mysqli.ini [edit]
[-] :etc:php:7.4:mods-available:xmlwriter.ini [edit]
[-] :etc:php:7.4:mods-available:posix.ini [edit]
[-] :etc:php:7.4:mods-available:pdo.ini [edit]
[-] :etc:php:7.4:mods-available:ffi.ini [edit]
[-] :etc:php:7.4:mods-available:mbstring.ini [edit]
[-] :etc:php:7.4:mods-available:pdo_mysql.ini [edit]
[-] :etc:php:8.0:mods-available:ftp.ini [edit]
[-] :etc:apt:apt.conf.d:20auto-upgrades [edit]
[-] :etc:php:8.0:mods-available:mbstring.ini [edit]
[-] :etc:php:7.4:mods-available:gettext.ini [edit]
[-] :etc:php:7.4:mods-available:fileinfo.ini [edit]
[-] :etc:php:7.4:mods-available:bcmath.ini [edit]
[-] :etc:php:7.4:mods-available:json.ini [edit]
[-] :etc:php:8.0:mods-available:iconv.ini [edit]
[-] :etc:php:7.4:mods-available:xml.ini [edit]
[-] :etc:php:7.4:mods-available:readline.ini [edit]
[-] :etc:php:7.4:mods-available:shmop.ini [edit]
[-] :etc:php:8.0:mods-available:pdo_mysql.ini [edit]
[-] :etc:php:8.0:mods-available:xmlwriter.ini [edit]
[-] :etc:php:8.0:mods-available:sysvsem.ini [edit]
[-] :etc:php:8.0:mods-available:exif.ini [edit]
[-] :etc:php:7.4:mods-available:xmlreader.ini [edit]
[-] :etc:php:7.4:mods-available:calendar.ini [edit]
[-] :etc:php:8.0:mods-available:posix.ini [edit]
[-] :etc:php:8.0:mods-available:dom.ini [edit]
[-] :etc:php:8.0:mods-available:mysqli.ini [edit]
[-] :etc:php:7.4:mods-available:sqlite3.ini [edit]
[-] :etc:php:7.4:mods-available:xsl.ini [edit]
[-] :etc:php:7.4:mods-available:gd.ini [edit]
[-] :etc:php:7.4:mods-available:zip.ini [edit]
[-] :etc:php:8.0:mods-available:gd.ini [edit]
[-] :etc:php:7.4:mods-available:ctype.ini [edit]
[-] :etc:php:7.4:mods-available:ftp.ini [edit]
[-] :etc:php:7.4:mods-available:curl.ini [edit]
[-] :etc:php:8.0:mods-available:xsl.ini [edit]
[-] :etc:php:8.0:mods-available:zip.ini [edit]
[-] :etc:php:7.4:mods-available:sockets.ini [edit]
[-] :etc:phpmyadmin:config-db.php [edit]