<commit_before>#!/bin/bash

set -e

GREP=/bin/grep
EGREP=/bin/egrep
SED=/bin/sed
IP=/sbin/ip
CUT=/usr/bin/cut
AWK=/usr/bin/awk
SORT=/usr/bin/sort
XARGS=/usr/bin/xargs
IFCONFIG=/sbin/ifconfig
IPTABLES=/sbin/iptables
WGET=/usr/bin/wget
ECHO=/bin/echo
HOST=/usr/bin/host

for i in $GREP $SED $IP $CUT $AWK $SORT $XARGS $IFCONFIG $IPTABLES $WGET $ECHO
do
	if ! test -x "$i"
	then
		$ECHO "E: Cannot execute '$i'."
		exit 1
	fi
done

WWWip="172.16.31.10"
Mailip="172.16.31.10"

ThisIsGateway="no"
ThisIsWebserver="no"
ThisIsMailserver="no"
FreifunkDevices=$($IP route |$EGREP "dev bat[0-9]" | $CUT -f3 -d\  )
echo "Freifunk Devices: " $(echo $FreifunkDevices | tr '\n' ' ')

FreifunkServerIp4List="192.168.127.12"
#                        server2
FreifunkServerIp6List="fc00:e968:6179::de52:7100"
#                        server2

GatewayIp4List="172.16.31.10 192.168.127.12 192.168.3.11 192.168.127.12 192.168.127.12 172.16.58.3 192.168.3.11"
#                     gw1          gw2          gw3            gw4          gw5           gw6         gw-test

GatewayIp6List="fdf8:f53e:61e4::18:1 fdf8:f53e:61e4::18 fdf8:f53e:61e4::18:2 fdf8:f53e:61e4::18:3 fc00:e968:6179::de52:7100 fdf8:f53e:61e4::18 fd00:c2b6:b24b:be67:2827:688d:e6a1:6a3b fdf8:f53e:61e4::18:7 fd00:a516:7c1b:17cd:6d81:2137:bd2a:2c5b"
#                     gw1                                     gw2                       gw3                   gw4                       gw5                gw6                                        gw-test

LocalGatewayHostnames="gattywatty01.ffoh.de gattywatty02.ffoh.de gattywatty03.ffoh.de"
LocalGatewayIpv4List="192.168.178.42 192.168.178.44 192.168.178.32 192.168.178.23"
RemoteGatewayIPv4List=""
RemoteGatewayIPv6List=""

echo "I: Iterating over local gateway hostnames - start"

for i in $LocalGatewayHostnames
do
	echo -n "I:     $i : IPv4 -> "
	remoteIPv4=$(LANG=C $HOST -4 $i  8.8.8.8 | $GREP address | $GREP -v IPv6 | $GREP -v alias | $CUT -f4 -d\ )
	if [ -n "$remoteIPv4" ]; then
		echo $remoteIPv4
		if [ -z "$RemoteGatewayIPv4List" ]; then
			#echo "I: Added 4"
			RemoteGatewayIPv4List=$remoteIPv4
		else
			RemoteGatewayIPv4List="$RemoteGatewayIPv4List $remoteIPv4"
		fi
	else
		echo "<no IPv4 address found>"
	fi

	echo -n "I:     $i : IPv6 -> "

	remoteIPv6=$(LANG=C $HOST -4 $i 8.8.8.8 | $GREP IPv6 | $GREP -v alias | $CUT -f5 -d\ )
        if [ -n "$remoteIPv6" ]; then
		echo $remoteIPv6
		#echo "remoteIPv6: $remoteIPv6"
		if [ -z "$RemoteGatewayIPv6List" ]; then
			#echo "I: Added 6"
			RemoteGatewayIPv6List=$remoteIPv6
		else
			RemoteGatewayIPv6List="$RemoteGatewayIPv6List $remoteIPv6"
		fi
	else
		echo "<no IPv6 address found>"
	fi
done
echo "I: Iterating over local gateway hostnames - end"

DEVICE=eth0
if $IFCONFIG|$GREP -q eth0.101; then
    DEVICE=eth0.101
    ThisIsGateway="yes"
elif $IFCONFIG|$GREP -q enp4s0; then
    DEVICE=enp4s0
    ThisIsGateway="yes"
fi

myIP=$(LANG=C $IP addr show $DEVICE|$GREP "inet "| $SED -e 's/addr://'|$AWK '{print $2}'|$CUT -f1 -d/)

if [ -z "$myIP" ]; then
    $ECHO "E: Could not determine this machine's IP address"
    exit
fi

$ECHO "I: myIP=$myIP"

for gw in $GatewayIp4List $RemoteGatewayIpv4List $LocalGatewayIpv4List
do
    if [ "x$gw" = "x$myIP" ]; then
       # this is a gateway machine
       ThisIsGateway="yes"
       break
    fi
done

if [ -x /usr/sbin/apache2 -o "x$myIP"="x$WWWIP" ]; then
    ThisIsWebserver="yes"
else
    for www in $WWWip
    do
        if [ "x$www" = "x$myIP" ]; then
            # this is a Webserver
            ThisIsWebserver="yes"
        fi
    done
fi

if [ "x$myIP" = "x$Mailip" ]; then
    ThisIsMailserver="yes"
fi

iptablesoptions=""
iptablesversion=$(iptables --version | cut -f2 -d\  | cut -f1,2 -d.)
if [ "v1.4" = "$iptablesversion" ]; then
   iptablesoptions=""
else
   iptablesoptions="-w 5"
fi

cat <<EOCAT
ThisIsMailserver: $ThisIsMailserver
ThisIsWebserver: $ThisIsWebserver
ThisIsGateway: $ThisIsGateway
myIP: $myIP
RemoteGatewayIPv4List: $RemoteGatewayIPv4List
RemoteGatewayIPv6List: $RemoteGatewayIPv6List
iptablesversion: '$iptablesversion'
iptablesoptions: '$iptablesoptions'
EOCAT

function FWboth {
   FW4="/sbin/iptables $iptablesoptions "
   FW6="/sbin/ip6tables $iptablesoptions "
   comment=$1
   if [ -n "$comment" ];then
       shift 1
       $ECHO $FW4 -m comment --comment "$comment" $*
       $FW4 -m comment --comment "$comment" $*
       $ECHO $FW6 -m comment --comment "$comment" $*
       $FW6 -m comment --comment "$comment" $*
   else
       $ECHO $FW4 $*
       $FW4 $*
       $FW6 $*
   fi
}

function FW4 {
   FW4="/sbin/iptables $iptablesoptions "
   #$ECHO $FW4 $*
   comment=$1
   if [ -n "$comment" ]; then
       shift 1
       $ECHO $FW4 -m comment --comment "$comment" $*
       $FW4 -m comment --comment "$comment" $*
   else
       $ECHO $FW4 $*
       $FW4 $*
   fi
}

function FW6 {
   FW6="/sbin/ip6tables $iptablesoptions "
   #$ECHO $FW6 $*
   comment=$1
   if [ -n "$comment" ];then
       shift 1
       $ECHO $FW6 -m comment --comment "$comment" $*
       $FW6 -m comment --comment "$comment" $*
   else
       $ECHO $FW6 $*
       $FW6 $*
   fi
}

$ECHO "I: reset all prior rules"

FWboth "" -F
FWboth "" -X
FW4 "" -t nat -F

$ECHO "I: Starting with a permissive default, restricted later to have guaranteed access in case script fails"

FWboth "" -P INPUT   ACCEPT
FWboth "" -P FORWARD ACCEPT
FWboth "" -P OUTPUT  ACCEPT

$ECHO "I: Creating chain named 'log-drop'"
FWboth "" -N log-drop
# may not be a good idea to drop ICMP, in particular not for IPv6
FWboth "log and drop ICMP" '-A log-drop -m limit --limit 5/min -j LOG --log-prefix Denied_IN: --log-level 7'
FWboth "" -A log-drop -j DROP

FWboth "" -N log-drop-out
FWboth "log and drop TCP" '-A log-drop-out -m limit --limit 5/min -j LOG --log-prefix Denied_OUT: --log-level 7'
FWboth "" -A log-drop-out -j DROP

FWboth "Allow related packages" -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

set n=0
for i in 192.168.3.11/8 172.16.17.32/8 172.16.17.32/8 192.168.127.12/8 172.16.31.10/8 172.16.17.32/10 172.16.31.10/8 172.16.17.32/8 172.16.58.3/8 172.16.17.32/8 192.168.127.12/8 172.16.17.32/10 
	# 192.168.3.11/8 - too strict, https://source.codeaurora.org/ affected
do
	set n=$(($n+1))
	FW4 "Dropping Chinese/American/Korean attacker $n" -s $i -I INPUT -j DROP
	FW4 "Dropping Chinese/American/Korean attacker $n" -d $i -I OUTPUT -j DROP
done

FWboth "dropping telnet " -p tcp --dport 23 -I INPUT -j DROP
FW4 "Portmap from localhost is ok" -p tcp -s 127.0.0.0/24 --dport 111 -A INPUT -j ACCEPT
FW4 "Portmap from localhost is ok" -p udp -s 127.0.0.0/24 --dport 111 -A INPUT -j ACCEPT
FW4 "Portmap from local IP" -p tcp -s $myIP --dport 111 -A INPUT -j ACCEPT
FW4 "Portmap from local IP" -p udp -s $myIP --dport 111 -A INPUT -j ACCEPT
FW4 "Portmap from elsewhere is not ok" -p tcp --dport 111 -A INPUT -j DROP
FW4 "Portmap from elsewhere is not ok" -p udp --dport 111 -A INPUT -j DROP

$ECHO "I: JA: trust myself on lo"
FWboth "Trusting local host on loopback dev" -A  INPUT -i lo -j ACCEPT

$ECHO "I: JA: trusting all gateway IP4 gateway addresses, also the local ones - debateable"
for gw in $GatewayIp4List $RemoteGatewayIPv4List
do
	$ECHO -n "       gateway $gw "
	if echo $gw | grep -q out; then
		echo "Skipping gw $gw"
	else
		FW4 "Fully_trusting_gateway IPv4" -A INPUT -s $gw/32 -j ACCEPT
	fi
	$ECHO "- trusted"
done

if [ "yes" = "$ThisIsMailserver" ]; then
    FWboth "Mailservers accept on port 25" -A INPUT -p tcp -m multiport --dports smtp,ssmtp -j ACCEPT 
fi

#$ECHO "I: JA: trusting all gateway IP6 gateway addresses on $DEVICE"
FW6 "Fully trusting all our other gateways - filoo.de" -A INPUT -s fdf8:f53e:61e4::18:1/120 -j ACCEPT
FW6 "Fully trusting all our other gateways - hetzner" -A INPUT -s $($HOST -t AAAA gw6.ffoh.de | cut -f5 -d\  ) -j ACCEPT

for gw in $RemoteGatewayIPv6List
do
	$ECHO -n "       gateway $gw "
	FW6 "Fully_trusting_gateway IPv6" -A INPUT -s $gw -j ACCEPT
done

$ECHO "I: JA fuer Freifunk: PING, FASTD, DNS"
if [ "yes"="$ThisIsGateway" ]; then
   $ECHO "I: Machine recognised as gateway"
   FW4 "Freifunk ICVPN" "-A INPUT -s 10.207.0.0/16 -j ACCEPT"
   # Trust WWW machine to ping
   FW4 "Freifunk Network - ping from WWW external IP" "-A INPUT -p icmp -s ${WWWip}/32 -j ACCEPT"
   # DNS service
   FWboth "Freifunk Network - DNS" '-A INPUT -i bat0 -p udp --dport bootps -j ACCEPT'
   FWboth "Freifunk Network - DNS" '-A INPUT -i bat0 -p tcp --dport bootps -j ACCEPT'
   FWboth "Freifunk Network - DNS" '-A INPUT -i bat0 -p udp --dport domain -j ACCEPT'
   FWboth "Freifunk Network - DNS" '-A INPUT -i bat0 -p tcp --dport domain -j ACCEPT'
   FWboth "Freifunk Network - DNS" '-A INPUT -i bat0 -p udp --dport mdns -j ACCEPT'
   FWboth "Freifunk Network - DNS" '-A INPUT -i bat0 -p tcp --dport mdns -j ACCEPT'
   # Gateways are gateways for fastd and always listen to port 10000 or 11280 or 11281 or 11426
   FWboth "Freifunk Network - fastd always served" '-A INPUT -p udp --dport 10000 -j ACCEPT'
   FWboth "Freifunk Network - fastd always served" '-A INPUT -p udp --dport 11280 -j ACCEPT'
   FWboth "Freifunk Network - fastd always served" '-A INPUT -p udp --dport 11281 -j ACCEPT'
   FWboth "Freifunk Network - fastd always served" '-A INPUT -p udp --dport 11426 -j ACCEPT'
   # Multicast
   FWboth "Freifunk Network - multicast" '-i bat0 -A INPUT -m pkttype --pkt-type multicast -j ACCEPT'
   # Intercity Gateway
   FWboth "Freifunk Network - tinc for ICVPN" '-A INPUT -p udp --dport 656 -j ACCEPT'
   FWboth "Freifunk Network - tinc for ICVPN" '-A INPUT -p tcp --dport 656 -j ACCEPT'

   for FreifunkDevice in $FreifunkDevices
   do
      #FWboth "Freifunk Network - Web access" -A INPUT -p tcp -i $FreifunkDevice --dport http -j ACCEPT
      FWboth "Freifunk Network - Web access secure from $FreifunkDevice" -A INPUT -p tcp -i $FreifunkDevice --dport https -j ACCEPT
      FWboth "Freifunk Network - nodogsplash web from $FreifunkDevice" -A INPUT -p tcp -i $FreifunkDevice --dport 2050 -j ACCEPT
      FWboth "Freifunk Network - iperf tests from $FreifunkDevice" -A INPUT -p tcp -i $FreifunkDevice --dport 5001 -j ACCEPT
   done
fi

if [ "yes"="$ThisIsWebserver" ]; then
   $ECHO "I: Machine is a webserver"

   for FreifunkDevice in $FreifunkDevices
   do
      # Accept port 10000 when it comes from the network's IP Address
      FWboth "Freifunk Network - fastd from $FreifunkDevice" "-A INPUT -p udp -i $FreifunkDevice --dport 10000 -j ACCEPT"
      # Accept port 11280 when it comes from the network's IP Address - for that MTU
      FWboth "Freifunk Network - fastd from $FreifunkDevice" "-A INPUT -p udp -i $FreifunkDevice --dport 11280 -j ACCEPT"<commit_msg>No longer allowing de novo connected from outside<commit_after>#!/bin/bash

set -e

GREP=/bin/grep
EGREP=/bin/egrep
SED=/bin/sed
IP=/sbin/ip
CUT=/usr/bin/cut
AWK=/usr/bin/awk
SORT=/usr/bin/sort
XARGS=/usr/bin/xargs
IFCONFIG=/sbin/ifconfig
IPTABLES=/sbin/iptables
WGET=/usr/bin/wget
ECHO=/bin/echo
HOST=/usr/bin/host

for i in $GREP $SED $IP $CUT $AWK $SORT $XARGS $IFCONFIG $IPTABLES $WGET $ECHO
do
	if ! test -x "$i"
	then
		$ECHO "E: Cannot execute '$i'."
		exit 1
	fi
done

WWWip="172.16.31.10"
Mailip="172.16.31.10"

ThisIsGateway="no"
ThisIsWebserver="no"
ThisIsMailserver="no"
FreifunkDevices=$($IP route |$EGREP "dev bat[0-9]" | $CUT -f3 -d\  )
echo "Freifunk Devices: " $(echo $FreifunkDevices | tr '\n' ' ')

FreifunkServerIp4List="192.168.127.12"
#                        server2
FreifunkServerIp6List="fc00:e968:6179::de52:7100"
#                        server2

GatewayIp4List="172.16.31.10 192.168.127.12 192.168.3.11 192.168.127.12 192.168.127.12 172.16.58.3 192.168.3.11"
#                     gw1          gw2          gw3            gw4          gw5           gw6         gw-test

GatewayIp6List="fd00:c2b6:b24b:be67:2827:688d:e6a1:6a3b fdf8:f53e:61e4::18 fdf8:f53e:61e4::18:2 fdf8:f53e:61e4::18:3 fdf8:f53e:61e4::18:4 fdf8:f53e:61e4::18:5 fd00:c2b6:b24b:be67:2827:688d:e6a1:6a3b fdf8:f53e:61e4::18:7 fd00:a516:7c1b:17cd:6d81:2137:bd2a:2c5b"
#                     gw1                                     gw2                       gw3                   gw4                       gw5                gw6                                        gw-test

LocalGatewayHostnames="gattywatty01.ffoh.de gattywatty02.ffoh.de gattywatty03.ffoh.de"
LocalGatewayIpv4List="192.168.178.42 192.168.178.44 192.168.178.32 192.168.178.23"
RemoteGatewayIPv4List=""
RemoteGatewayIPv6List=""

echo "I: Iterating over local gateway hostnames - start"

for i in $LocalGatewayHostnames
do
	echo -n "I:     $i : IPv4 -> "
	remoteIPv4=$(LANG=C $HOST -4 $i  8.8.8.8 | $GREP address | $GREP -v IPv6 | $GREP -v alias | $CUT -f4 -d\ )
	if [ -n "$remoteIPv4" ]; then
		echo $remoteIPv4
		if [ -z "$RemoteGatewayIPv4List" ]; then
			#echo "I: Added 4"
			RemoteGatewayIPv4List=$remoteIPv4
		else
			RemoteGatewayIPv4List="$RemoteGatewayIPv4List $remoteIPv4"
		fi
	else
		echo "<no IPv4 address found>"
	fi

	echo -n "I:     $i : IPv6 -> "

	remoteIPv6=$(LANG=C $HOST -4 $i 8.8.8.8 | $GREP IPv6 | $GREP -v alias | $CUT -f5 -d\ )
        if [ -n "$remoteIPv6" ]; then
		echo $remoteIPv6
		#echo "remoteIPv6: $remoteIPv6"
		if [ -z "$RemoteGatewayIPv6List" ]; then
			#echo "I: Added 6"
			RemoteGatewayIPv6List=$remoteIPv6
		else
			RemoteGatewayIPv6List="$RemoteGatewayIPv6List $remoteIPv6"
		fi
	else
		echo "<no IPv6 address found>"
	fi
done
echo "I: Iterating over local gateway hostnames - end"

DEVICE=eth0
if $IFCONFIG|$GREP -q eth0.101; then
    DEVICE=eth0.101
    ThisIsGateway="yes"
elif $IFCONFIG|$GREP -q enp4s0; then
    DEVICE=enp4s0
    ThisIsGateway="yes"
fi

myIP=$(LANG=C $IP addr show $DEVICE|$GREP "inet "| $SED -e 's/addr://'|$AWK '{print $2}'|$CUT -f1 -d/)

if [ -z "$myIP" ]; then
    $ECHO "E: Could not determine this machine's IP address"
    exit
fi

$ECHO "I: myIP=$myIP"

for gw in $GatewayIp4List $RemoteGatewayIpv4List $LocalGatewayIpv4List
do
    if [ "x$gw" = "x$myIP" ]; then
       # this is a gateway machine
       ThisIsGateway="yes"
       break
    fi
done

if [ -x /usr/sbin/apache2 -o "x$myIP"="x$WWWIP" ]; then
    ThisIsWebserver="yes"
else
    for www in $WWWip
    do
        if [ "x$www" = "x$myIP" ]; then
            # this is a Webserver
            ThisIsWebserver="yes"
        fi
    done
fi

if [ "x$myIP" = "x$Mailip" ]; then
    ThisIsMailserver="yes"
fi

iptablesoptions=""
iptablesversion=$(iptables --version | cut -f2 -d\  | cut -f1,2 -d.)
if [ "v1.4" = "$iptablesversion" ]; then
   iptablesoptions=""
else
   iptablesoptions="-w 5"
fi

cat <<EOCAT
ThisIsMailserver: $ThisIsMailserver
ThisIsWebserver: $ThisIsWebserver
ThisIsGateway: $ThisIsGateway
myIP: $myIP
RemoteGatewayIPv4List: $RemoteGatewayIPv4List
RemoteGatewayIPv6List: $RemoteGatewayIPv6List
iptablesversion: '$iptablesversion'
iptablesoptions: '$iptablesoptions'
EOCAT

function FWboth {
   FW4="/sbin/iptables $iptablesoptions "
   FW6="/sbin/ip6tables $iptablesoptions "
   comment=$1
   if [ -n "$comment" ];then
       shift 1
       $ECHO $FW4 -m comment --comment "$comment" $*
       $FW4 -m comment --comment "$comment" $*
       $ECHO $FW6 -m comment --comment "$comment" $*
       $FW6 -m comment --comment "$comment" $*
   else
       $ECHO $FW4 $*
       $FW4 $*
       $FW6 $*
   fi
}

function FW4 {
   FW4="/sbin/iptables $iptablesoptions "
   #$ECHO $FW4 $*
   comment=$1
   if [ -n "$comment" ]; then
       shift 1
       $ECHO $FW4 -m comment --comment "$comment" $*
       $FW4 -m comment --comment "$comment" $*
   else
       $ECHO $FW4 $*
       $FW4 $*
   fi
}

function FW6 {
   FW6="/sbin/ip6tables $iptablesoptions "
   #$ECHO $FW6 $*
   comment=$1
   if [ -n "$comment" ];then
       shift 1
       $ECHO $FW6 -m comment --comment "$comment" $*
       $FW6 -m comment --comment "$comment" $*
   else
       $ECHO $FW6 $*
       $FW6 $*
   fi
}

$ECHO "I: reset all prior rules"

FWboth "" -F
FWboth "" -X
FW4 "" -t nat -F

$ECHO "I: Starting with a permissive default, restricted later to have guaranteed access in case script fails"

FWboth "" -P INPUT   ACCEPT
FWboth "" -P FORWARD ACCEPT
FWboth "" -P OUTPUT  ACCEPT

$ECHO "I: Creating chain named 'log-drop'"
FWboth "" -N log-drop
# may not be a good idea to drop ICMP, in particular not for IPv6
FWboth "log and drop ICMP" '-A log-drop -m limit --limit 5/min -j LOG --log-prefix Denied_IN: --log-level 7'
FWboth "" -A log-drop -j DROP

FWboth "" -N log-drop-out
FWboth "log and drop TCP" '-A log-drop-out -m limit --limit 5/min -j LOG --log-prefix Denied_OUT: --log-level 7'
FWboth "" -A log-drop-out -j DROP

FWboth "Allow related packages" -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

set n=0
for i in 192.168.3.11/8 172.16.17.32/8 172.16.17.32/8 192.168.127.12/8 172.16.31.10/8 172.16.17.32/10 172.16.31.10/8 172.16.17.32/8 172.16.58.3/8 172.16.17.32/8 192.168.127.12/8 172.16.17.32/10 
	# 192.168.3.11/8 - too strict, https://source.codeaurora.org/ affected
do
	set n=$(($n+1))
	FW4 "Dropping Chinese/American/Korean attacker $n" -s $i -I INPUT -j DROP
	FW4 "Dropping Chinese/American/Korean attacker $n" -d $i -I OUTPUT -j DROP
done

FWboth "dropping telnet " -p tcp --dport 23 -I INPUT -j DROP
FW4 "Portmap from localhost is ok" -p tcp -s 127.0.0.0/24 --dport 111 -A INPUT -j ACCEPT
FW4 "Portmap from localhost is ok" -p udp -s 127.0.0.0/24 --dport 111 -A INPUT -j ACCEPT
FW4 "Portmap from local IP" -p tcp -s $myIP --dport 111 -A INPUT -j ACCEPT
FW4 "Portmap from local IP" -p udp -s $myIP --dport 111 -A INPUT -j ACCEPT
FW4 "Portmap from elsewhere is not ok" -p tcp --dport 111 -A INPUT -j DROP
FW4 "Portmap from elsewhere is not ok" -p udp --dport 111 -A INPUT -j DROP

$ECHO "I: JA: trust myself on lo"
FWboth "Trusting local host on loopback dev" -A  INPUT -i lo -j ACCEPT

$ECHO "I: JA: trusting all gateway IP4 gateway addresses, also the local ones - debateable"
for gw in $GatewayIp4List $RemoteGatewayIPv4List
do
	$ECHO -n "       gateway $gw "
	if echo $gw | grep -q out; then
		echo "Skipping gw $gw"
	else
		FW4 "Fully_trusting_gateway IPv4" -A INPUT -s $gw/32 -j ACCEPT
	fi
	$ECHO "- trusted"
done

if [ "yes" = "$ThisIsMailserver" ]; then
    FWboth "Mailservers accept on port 25" -A INPUT -p tcp -m multiport --dports smtp,ssmtp -j ACCEPT 
fi

#$ECHO "I: JA: trusting all gateway IP6 gateway addresses on $DEVICE"
FW6 "Fully trusting all our other gateways - filoo.de" -A INPUT -s fdf8:f53e:61e4::18:1/120 -j ACCEPT
FW6 "Fully trusting all our other gateways - hetzner" -A INPUT -s $($HOST -t AAAA gw6.ffoh.de | cut -f5 -d\  ) -j ACCEPT

for gw in $RemoteGatewayIPv6List
do
	$ECHO -n "       gateway $gw "
	FW6 "Fully_trusting_gateway IPv6" -A INPUT -s $gw -j ACCEPT
done

$ECHO "I: JA fuer Freifunk: PING, FASTD, DNS"
if [ "yes"="$ThisIsGateway" ]; then
   $ECHO "I: Machine recognised as gateway"
   FW4 "Freifunk ICVPN" "-A INPUT -s 10.207.0.0/16 -j ACCEPT"
   # Trust WWW machine to ping
   FW4 "Freifunk Network - ping from WWW external IP" "-A INPUT -p icmp -s ${WWWip}/32 -j ACCEPT"
   # DNS service
   FWboth "Freifunk Network - DNS" '-A INPUT -i bat0 -p udp --dport bootps -j ACCEPT'
   FWboth "Freifunk Network - DNS" '-A INPUT -i bat0 -p tcp --dport bootps -j ACCEPT'
   FWboth "Freifunk Network - DNS" '-A INPUT -i bat0 -p udp --dport domain -j ACCEPT'
   FWboth "Freifunk Network - DNS" '-A INPUT -i bat0 -p tcp --dport domain -j ACCEPT'
   FWboth "Freifunk Network - DNS" '-A INPUT -i bat0 -p udp --dport mdns -j ACCEPT'
   FWboth "Freifunk Network - DNS" '-A INPUT -i bat0 -p tcp --dport mdns -j ACCEPT'
   # Gateways are gateways for fastd and always listen to port 10000 or 11280 or 11281 or 11426
   FWboth "Freifunk Network - fastd always served" '-A INPUT -p udp --dport 10000 -j ACCEPT'
   FWboth "Freifunk Network - fastd always served" '-A INPUT -p udp --dport 11280 -j ACCEPT'
   FWboth "Freifunk Network - fastd always served" '-A INPUT -p udp --dport 11281 -j ACCEPT'
   FWboth "Freifunk Network - fastd always served" '-A INPUT -p udp --dport 11426 -j ACCEPT'
   # Multicast
   FWboth "Freifunk Network - multicast" '-i bat0 -A INPUT -m pkttype --pkt-type multicast -j ACCEPT'
   # Intercity Gateway
   FWboth "Freifunk Network - tinc for ICVPN" '-A INPUT -p udp --dport 656 -j ACCEPT'
   FWboth "Freifunk Network - tinc for ICVPN" '-A INPUT -p tcp --dport 656 -j ACCEPT'

   FWboth "Log new TCP connect from outside"    "-A FORWARD -m limit --limit 2/s -p tcp -o bat0 -m state --state=NEW  -j LOG --log-prefix DROP_TCP_from_outside:  --log-level 4"
   FWboth "Denied new TCP connect from outside" "-A FORWARD                      -p tcp -o bat0 -m state --state=NEW  -j DROP"
   FWboth "Log new UDP connect from outside"    "-A FORWARD -m limit --limit 2/s -p udp -o bat0 -m state --state=NEW  -j LOG --log-prefix DROP_UDP_from_outside:  --log-level 4"
   FWboth "Denied new UDP connect from outside" "-A FORWARD                      -p udp -o bat0 -m state --state=NEW  -j DROP"

   for FreifunkDevice in $FreifunkDevices
   do
      #FWboth "Freifunk Network - Web access" -A INPUT -p tcp -i $FreifunkDevice --dport http -j ACCEPT
      FWboth "Freifunk Network - Web access secure from $FreifunkDevice" -A INPUT -p tcp -i $FreifunkDevice --dport https -j ACCEPT
      FWboth "Freifunk Network - nodogsplash web from $FreifunkDevice" -A INPUT -p tcp -i $FreifunkDevice --dport 2050 -j ACCEPT
      FWboth "Freifunk Network - iperf tests from $FreifunkDevice" -A INPUT -p tcp -i $FreifunkDevice --dport 5001 -j ACCEPT
   done
fi

if [ "yes"="$ThisIsWebserver" ]; then
   $ECHO "I: Machine is a webserver"

   for FreifunkDevice in $FreifunkDevices
   do
      # Accept port 10000 when it comes from the network's IP Address
      FWboth "Freifunk Network - fastd from $FreifunkDevice" "-A INPUT -p udp -i $FreifunkDevice --dport 10000 -j ACCEPT"
      # Accept port 11280 when it comes from the network's IP Address - for that MTU
      FWboth "Freifunk Network - fastd from $FreifunkDevice" "-A INPUT -p udp -i $FreifunkDevice --dport 11280 -j ACCEPT"
{'fraction_non_alphanumeric': 0.12937747620565598, 'fraction_numerical': 0.06452935015255704, 'mean_word_length': 2.7327893931667515, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 11, 'https://': 2, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 64, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 20, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1395606', 'n_tokens_mistral': 9741, 'n_tokens_neox': 8692, 'n_words': 2664}