8 files changed, 82 insertions, 44 deletions

diff --git a/src/firewall.d/global.d/ipsets-example b/src/firewall.d/global.d/ipsets-example
index 8a6d35f..ff54196 100644
--- a/src/firewall.d/global.d/ipsets-example
+++ b/src/firewall.d/global.d/ipsets-example
@@ -13,26 +13,54 @@
 #     @sysconfdir@/firewall.d/rules6
 #
 
-#######################
-#                     #
-#  Standard Services  #
-#                     #
-#######################
-
-create SERVICES bitmap:port range 1-1024 comment
-add SERVICES 20   comment "FTP data"
-add SERVICES 21   comment "FTP"
-add SERVICES 22   comment "SSH"
-add SERVICES 23   comment "Telnet"
-add SERVICES 25   comment "SMTP"
-add SERVICES 53   comment "DNS"
-add SERVICES 69   comment "TFTP"
-add SERVICES 80   comment "HTTP"
-add SERVICES 110  comment "POP3"
-add SERVICES 123  comment "NTP"
-add SERVICES 143  comment "IMAP"
-add SERVICES 389  comment "LDAP"
-add SERVICES 443  comment "HTTPS"
+######################
+#                    #
+#  Private Networks  #
+#                    #
+######################
+
+create   PRIVATE4             hash:ip family inet  hashsize 1024 comment
+create   PRIVATE6             hash:ip family inet6 hashsize 1024 comment
+create   PRIVATE              list:set
+add      PRIVATE              PRIVATE4
+add      PRIVATE              PRIVATE6
+add      PRIVATE4             10.0.0.0/8      "rfc1918"
+add      PRIVATE4             172.16.0.0/12   "rfc1918"
+add      PRIVATE4             192.168.0.0/1   "rfc1918"
+add      PRIVATE6             fc00::/7        "rfc4193"
+add      PRIVATE6             fe80::/10       "rfc4291"
+
+
+#################
+#               #
+#  Black Holes  #
+#               #
+#################
+
+# dynamic blackhole lists
+create   DYNAMIC_BLACKHOLE4   hash:ip family inet  hashsize 1024 timeout 600
+create   DYNAMIC_BLACKHOLE6   hash:ip family inet6 hashsize 1024 timeout 600
+create   DYNAMIC_BLACKHOLE    list:set 
+add      DYNAMIC_BLACKHOLE    DYNAMIC_BLACKHOLE4
+add      DYNAMIC_BLACKHOLE    DYNAMIC_BLACKHOLE6
+
+# dynamic blackhole exemptions
+create   DYNAMIC_EXEMPTION4   hash:net family inet  hashsize 1024 comment
+create   DYNAMIC_EXEMPTION6   hash:net family inet6 hashsize 1024 comment
+create   DYNAMIC_EXEMPTION    list:set 
+add      DYNAMIC_EXEMPTION    DYNAMIC_EXEMPTION4
+add      DYNAMIC_EXEMPTION    DYNAMIC_EXEMPTION6
+add      DYNAMIC_EXEMPTION    PRIVATE4
+add      DYNAMIC_EXEMPTION    PRIVATE6
+
+# static blackhole lists
+create   BLACKHOLE4           hash:ip family inet  hashsize 1024 
+create   BLACKHOLE6           hash:ip family inet6 hashsize 1024 
+create   BLACKHOLE            list:set
+add      BLACKHOLE            BLACKHOLE4
+add      BLACKHOLE            BLACKHOLE6
+add      BLACKHOLE            DYNAMIC_BLACKHOLE4
+add      BLACKHOLE            DYNAMIC_BLACKHOLE6
 
 
 # end of rules
diff --git a/src/firewall.d/global.d/rules-example b/src/firewall.d/global.d/rules-example
index 66efc0f..e6a598b 100644
--- a/src/firewall.d/global.d/rules-example
+++ b/src/firewall.d/global.d/rules-example
@@ -29,15 +29,31 @@
 # allow all local host traffic
 -I INPUT -i lo   -j ACCEPT
 
-# reject ident loopups (fixes delays when connecting to misconfigured hosts)
--A INPUT  -p tcp   --dport ident   -j REJECT --reject-with tcp-reset
+# drop black hole traffic
+-I INPUT   -m set   --match-set BLACKHOLE src -j DROP
+-I INPUT   -m set   --match-set BLACKHOLE src \
+           -m limit --limit 1/minute \
+           -j LOG   --log-level 7 --log-prefix "iptables blackhole: "
+
+# reject ident lookups (fixes delays when connecting to misconfigured hosts)
+-A INPUT  -m set --match-set PRIVATE src \
+          -p tcp --dport ident \
+          -j REJECT --reject-with tcp-reset
 
 # allow established connections
--A INPUT  -m conntrack --ctstate ESTABLISHED,RELATED   -j ACCEPT
+-I INPUT  -m conntrack --ctstate ESTABLISHED,RELATED   -j ACCEPT
+
+# allow local networks to access services
+-A INPUT  -m set --match-set PRIVATE src  -p tcp  --dport ssh     -j ACCEPT
+-A INPUT  -m set --match-set PRIVATE src  -p tcp  --dport domain  -j ACCEPT
+-A INPUT  -m set --match-set PRIVATE src  -p udp  --dport domain  -j ACCEPT
 
 # log everything else
 -A INPUT  -m limit --limit 10/minute -j LOG --log-level 7 --log-prefix "iptables drop input: "
 
+# blackhole filter misses
+-A INPUT   -m set ! --match-set DYNAMIC_EXEMPTION src -j SET --add-set DYNAMIC_BLACKHOLE src
+
 COMMIT
 
 
diff --git a/src/firewall.d/global.d/rules4-example b/src/firewall.d/global.d/rules4-example
index 5f73887..2736754 100644
--- a/src/firewall.d/global.d/rules4-example
+++ b/src/firewall.d/global.d/rules4-example
@@ -19,11 +19,6 @@
 #                       #
 #########################
 *filter
-
-# allow all ICMP traffic
--I INPUT   -p icmp   -j ACCEPT
--I FORWARD -p icmp   -j ACCEPT
-
 COMMIT
 
 
@@ -42,11 +37,6 @@ COMMIT
 #                    #
 ######################
 *raw
-
-# ICMP traffic
--I PREROUTING -p icmp   -j NOTRACK
--I OUTPUT     -p icmp   -j NOTRACK
-
 COMMIT
 
 # end of rules
diff --git a/src/firewall.d/global.d/rules6-example b/src/firewall.d/global.d/rules6-example
index 8591787..cf5dd1a 100644
--- a/src/firewall.d/global.d/rules6-example
+++ b/src/firewall.d/global.d/rules6-example
@@ -20,11 +20,6 @@
 #                       #
 #########################
 *filter
-
-# allow all ICMPv6 traffic
--I INPUT   -p icmpv6   -j ACCEPT
--I FORWARD -p icmpv6   -j ACCEPT
-
 COMMIT
 
 
@@ -34,11 +29,6 @@ COMMIT
 #                    #
 ######################
 *raw
-
-# ICMP traffic
--I PREROUTING -p icmpv6   -j NOTRACK
--I OUTPUT     -p icmpv6   -j NOTRACK
-
 COMMIT
 
 # end of rules
diff --git a/src/firewall.d/ipsets-example b/src/firewall.d/ipsets-example
index 437676b..fb2785b 100644
--- a/src/firewall.d/ipsets-example
+++ b/src/firewall.d/ipsets-example
@@ -40,7 +40,7 @@ add PRIVATE4 10.0.0.0/8    "rfc1918"
 add PRIVATE4 172.16.0.0/12 "rfc1918"
 add PRIVATE4 192.168.0.0/1 "rfc1918"
 add PRIVATE6 fc00::/7      "rfc4193"
-add PRIVATE6 fe80::/10     "rfc4291""
+add PRIVATE6 fe80::/10     "rfc4291"
 
 
 # end of rules
diff --git a/src/firewall.d/rules-example b/src/firewall.d/rules-example
index d892e9a..806098b 100644
--- a/src/firewall.d/rules-example
+++ b/src/firewall.d/rules-example
@@ -32,6 +32,14 @@
 ##############################
 *filter
 
+# set default policies
+:INPUT DROP
+:FORWARD DROP
+:OUTPUT ACCEPT
+
+# allow all local host traffic
+-I INPUT -i lo  -j ACCEPT
+
 ## accept HTTP/HTTPS connections
 #-A INPUT -p tcp --dport http   -j  ACCEPT
 #-A INPUT -p tcp --dport https  -j  ACCEPT
diff --git a/src/firewall.d/rules4-example b/src/firewall.d/rules4-example
index 238b8ca..2b5c0bc 100644
--- a/src/firewall.d/rules4-example
+++ b/src/firewall.d/rules4-example
@@ -31,6 +31,9 @@
 #########################
 *filter
 
+# allow all ICMP traffic
+-I INPUT   -p icmp   -j ACCEPT
+
 ## accept SSH connections from RFC1918 addresses
 #-A INPUT -p tcp   -s 10.0.0.0/8       --dport ssh   -j ACCEPT
 #-A INPUT -p tcp   -s 172.16.0.0/12    --dport ssh   -j ACCEPT
diff --git a/src/firewall.d/rules6-example b/src/firewall.d/rules6-example
index 732a635..595e72d 100644
--- a/src/firewall.d/rules6-example
+++ b/src/firewall.d/rules6-example
@@ -31,6 +31,9 @@
 #########################
 *filter
 
+# allow all ICMPv6 traffic
+-I INPUT   -p icmpv6   -j ACCEPT
+
 ## accept SSH connections from link-local and RFC4193 addresses
 #-A INPUT -p tcp   -s fc00::/7    --dport ssh   -j ACCEPT
 #-A INPUT -p tcp   -s fe80::/10   --dport ssh   -j ACCEPT