ip6tables (Source) 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
 
# Adapted from http://madduck.net/docs/ipv6/
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:in-new - [0:0]

### INPUT chain

# allow all loopback traffic
-A INPUT -i lo -j ACCEPT

# allow all ICMP traffic (see link above for discussion of security implications)
-A INPUT -p icmpv6 -j ACCEPT

# allow packets belonging to an established connection or related to one
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# packets that are out-of-sequence are silently dropped
-A INPUT -m conntrack --ctstate INVALID -j DROP
# new connections unknown to the kernel are handled in a separate chain
-A INPUT -m conntrack --ctstate NEW -j in-new

# ...and here's that separate chain:

# allow SYN packets for SSH and HTTPS (RELATED,ESTABLISHED above handles it from there)
-A in-new -p tcp -m tcp --dport 22 --syn -j ACCEPT
-A in-new -p tcp -m tcp --dport 443 --syn -j ACCEPT
# allow DHCPv6 traffic
-A in-new -p udp -m udp --dport 546 -j ACCEPT

# log and reject everything else
-A INPUT -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[INPUT6]: "
-A INPUT -j REJECT

### OUTPUT chain

# allow outgoing traffic, explicitly (despite chain policy)
-A OUTPUT -j ACCEPT

### FORWARD chain

# for fowarded traffic, allow outgoing and related incoming
-A FORWARD -i eth0 -o eth1 -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

COMMIT