# Note: Order of the interfaces declarations matters

auto lo
iface lo inet loopback

auto uap0
iface uap0 inet static
       post-up /usr/bin/uaputl sys_cfg_ssid dream-uAP-XXXX
       # Modus WPA2
       post-up /usr/bin/uaputl sys_cfg_protocol 32
       # WLAN password
       post-up /usr/bin/uaputl sys_cfg_wpa_passphrase "WHATEVER PASSWORD"
       # Set the Cipher
       post-up /usr/bin/uaputl sys_cfg_cipher 8 8
       # automatic channel
       post-up /usr/bin/uaputl sys_cfg_channel 0 1
       post-up /usr/bin/uaputl bss_start
       # we deliver addresses for the Wifi with DHCP
       post-up /usr/sbin/service udhcpd start
       address 192.168.3.1
       netmask 255.255.255.0

# Only IP6 traffic passes through the router between the Freebox on eth0 and the LAN on eth1
auto br0
iface br0 inet manual
      bridge_ports eth0 eth1
      bridge_maxwait 0
      pre-up ebtables -t broute -A BROUTING -p ! ipv6 -j DROP
      down ebtables -t broute -F

# Connected to the FreeBox, with DHCP in IPv4, masquerading outgoing IPv4 traffic
auto eth0
iface eth0 inet dhcp
        up iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
        down iptables -t nat -F
        post-up sysctl -q -w net.ipv4.ip_forward=1
iface eth0 inet6 auto

# Connected to the LAN with a static IPv4 address
auto eth1
iface eth1 inet static
      address 192.168.4.1
      netmask 255.255.255.0

start 192.168.3.100
end 192.168.3.200
interface uap0
opt      lease  86400
opt     router  192.168.3.1
opt     subnet  255.255.255.0
opt     dns     192.168.3.1
opt     domain     localdomain
max_leases     101
lease_file     /var/lib/udhcpd.leases
auto_time       5

## Interfaces of the router

# Our LAN on a switch
@def $DEV_PRIVATE = eth1;

# The ISP router
@def $DEV_WORLD = eth0;

# Our Wifi LAN
@def $DEV_WIFI = uap0;


## IP networks of our LAN

# IPv4 (includes ethernet switch and wifi)
@def $NET_PRIVATE = 192.168.0.0/16;

# IPv6 (the prefix granted by the ISP)
@def $NET6_PRIVATE = 2a01:e35:1234:5678::/64;

# IPv6 Local link
@def $LINK6 = fe80::/10;

# Specific machines on the LAN
@def $MACHINE_MYDESKTOP = 2a01:0e35:1234:5678:1234:5678:9abc:def0;

# Special function to log dropped packets
@def &DROP() =  
  mod limit limit 1/second limit-burst 10 LOG log-prefix "$DOMAIN-$CHAIN: ";
  DROP;
 

# IPv4 iptables rules
table filter  
  chain INPUT  
  policy DROP;

  # connection tracking
  mod state state INVALID DROP;
  mod state state (ESTABLISHED RELATED) ACCEPT;

  # allow local packet
  interface lo ACCEPT;

  # respond to ping
  #proto icmp ACCEPT; 
  proto icmp icmp-type echo-request ACCEPT;

  # allow IPsec
  proto udp dport 500 ACCEPT;
  proto (esp ah) ACCEPT;

  # allow SSH connections from the private network and from some
  # well-known internet hosts
  #saddr ($NET_PRIVATE 123.45.67.89) proto tcp dport ssh ACCEPT;
  saddr $NET_PRIVATE proto tcp dport ssh ACCEPT;

  # we provide DNS and SMTP services for the internal net
  interface $DEV_PRIVATE saddr $NET_PRIVATE  
  proto (udp tcp) dport domain ACCEPT;
  proto tcp dport smtp ACCEPT;
   

  interface $DEV_WIFI  
  # DHCP
  proto udp dport 67:68 ACCEPT;
  proto (udp tcp) dport domain ACCEPT;

  proto udp dport netbios-dgm DROP;
   

  # LOG all dropped packets
  proto (udp tcp) &DROP();

   

  # outgoing connections are not limited
  chain OUTPUT policy ACCEPT;

  chain FORWARD  
  policy DROP;

  # connection tracking
  mod state state INVALID DROP;
  mod state state (ESTABLISHED RELATED) ACCEPT;

  # connections from the internal net to the internet or to other
  # internal nets are allowed
  interface $DEV_PRIVATE ACCEPT;
  interface $DEV_WIFI ACCEPT;

  # LOG all dropped packets
  proto (udp tcp) &DROP();
   
 

# IPv4 masquerade / NAT support

table nat  
  chain POSTROUTING  
  # masquerade private IP addresses
  saddr $NET_PRIVATE outerface $DEV_WORLD MASQUERADE;
   
 

## IPv6:

domain ip6  
  table filter  

  chain INPUT  
  policy DROP;

  # Internal traffic authorized
  saddr $NET6_PRIVATE ACCEPT;
  saddr $LINK6 ACCEPT;

  # accept multicast
  daddr ff00::/8 ACCEPT;

  interface lo ACCEPT;

  # For public traffic
  # Only DNS resolution + NTP acceped for UDP
  interface br0  
  proto udp  

  sport domain ACCEPT;

  dport ntp ACCEPT;

  &DROP();
   

  # TCP on ports < 1024 forbidden except for SSH
  proto tcp  

  dport ssh ACCEPT;

  dport 0:1023 DROP;
   

  # Accepted established traffic
  mod state state INVALID DROP;
  mod state state (ESTABLISHED RELATED) ACCEPT;

  # incoming connections forbidden
  proto tcp syn DROP;

  # Accept ping
  proto icmpv6 ACCEPT;
   

  proto (udp tcp) &DROP();
   
  chain FORWARD  
  policy DROP;

  # All local traffic accepted
  saddr $LINK6 ACCEPT;

  # All ping accepted unless coming from internet
  saddr ! $NET6_PRIVATE proto icmpv6 icmp-type echo-request DROP;
  proto icmpv6 ACCEPT;

  # Allow SSH to specific machines
  proto tcp daddr $MACHINE_MYDESKTOP dport ssh ACCEPT;

  # Accept established traffic
  mod state state INVALID DROP;
  mod state state (ESTABLISHED RELATED) ACCEPT;

  # Accept outgoing traffic
  saddr $NET6_PRIVATE ACCEPT;

  # Accept local outgoing traffic
  saddr ::1 ACCEPT;

  proto (udp tcp) &DROP();
   
   
 

# ebtables
domain eb chain FORWARD  
  policy DROP;

  # Only accept bridged traffic for IPv6
  logical-in br0 logical-out br0   
  #ebtables -t broute -A BROUTING -p ! ipv6 -j DROP
  proto IPv6 ACCEPT;
   
 

auto eth1
iface eth1 inet static
  address 192.168.4.42
  netmask 255.255.255.0
  gateway 192.168.4.1
  dns-nameservers 212.27.40.241 212.27.40.240

iface eth1 inet6 auto