# Generated by ip6tables-save v1.4.12.2 on Sun Mar  4 16:30:11 2012
*mangle
:PREROUTING ACCEPT [637523:238303210]
:INPUT ACCEPT [619109:236976813]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [205951:26654094]
:POSTROUTING ACCEPT [234229:31720444]
:fairq - [0:0]
:nomangle - [0:0]
-A PREROUTING -j fairq
-A OUTPUT -j nomangle
-A OUTPUT -j fairq
-A fairq -p ospf -j MARK --set-xmark 0x1/0xffffffff
-A fairq -p ospf -j MARK --set-xmark 0x1/0xffffffff
-A fairq -p udp -m udp --dport 520 -j MARK --set-xmark 0x1/0xffffffff
-A fairq -p udp -m udp --sport 520 -j MARK --set-xmark 0x1/0xffffffff
-A fairq -p tcp -m tcp --dport 179 -j MARK --set-xmark 0x1/0xffffffff
-A fairq -p tcp -m tcp --sport 179 -j MARK --set-xmark 0x1/0xffffffff
-A fairq -p tcp -m tcp --dport 53 -j MARK --set-xmark 0x1/0xffffffff
-A fairq -p tcp -m tcp --sport 53 -j MARK --set-xmark 0x1/0xffffffff
-A fairq -p udp -m udp --dport 53 -j MARK --set-xmark 0x1/0xffffffff
-A fairq -p udp -m udp --sport 53 -j MARK --set-xmark 0x1/0xffffffff
-A fairq -p tcp -m tcp --dport 23 -j MARK --set-xmark 0x2/0xffffffff
-A fairq -p tcp -m tcp --sport 23 -j MARK --set-xmark 0x2/0xffffffff
-A fairq -p tcp -m tcp --dport 22 -j MARK --set-xmark 0x2/0xffffffff
-A fairq -p tcp -m tcp --sport 22 -j MARK --set-xmark 0x2/0xffffffff
-A nomangle -p gre -j ACCEPT
-A nomangle -p esp -j ACCEPT
-A nomangle -p ipip -j ACCEPT
-A nomangle -p encap -j ACCEPT
COMMIT
# Completed on Sun Mar  4 16:30:11 2012
# Generated by ip6tables-save v1.4.12.2 on Sun Mar  4 16:30:11 2012
*filter
:INPUT ACCEPT [66:5920]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [33:3448]
:ipsec-in - [0:0]
:log - [0:0]
-A INPUT -m policy --dir in --pol ipsec -j ipsec-in
-A ipsec-in -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ipsec-in -p udp -m udp --sport 500 --dport 500 -j ACCEPT
-A ipsec-in -p ipv6-icmp -m icmp6 --icmpv6-type 129 -j ACCEPT
-A ipsec-in -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
-A ipsec-in -p udp -m state --state NEW -m udp --dport 514 -j ACCEPT
-A ipsec-in -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
-A ipsec-in -p tcp -m tcp --dport 53 -m state --state NEW -m frag --fragid 0 --fragfirst -j ACCEPT
-A ipsec-in -s fd14:828:ba69::/48 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A ipsec-in -s fd14:828:ba69::/48 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A ipsec-in -j log
-A log -m limit --limit 3/sec -j LOG --log-prefix "Def log:  - " --log-tcp-options --log-ip-options
-A log -p icmp -j DROP
-A log -j REJECT --reject-with icmp6-port-unreachable
COMMIT
# Completed on Sun Mar  4 16:30:11 2012
