#!/sbin/iptables

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# Loopback
-A INPUT -i lo -j ACCEPT

# États invalides
-A INPUT -m conntrack --ctstate INVALID -j DROP

# Connexions établies
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# ICMPv6 conforme RFC 4890
-A INPUT -p ipv6-icmp --icmpv6-type destination-unreachable -j ACCEPT
-A INPUT -p ipv6-icmp --icmpv6-type packet-too-big -j ACCEPT
-A INPUT -p ipv6-icmp --icmpv6-type time-exceeded -j ACCEPT
-A INPUT -p ipv6-icmp --icmpv6-type parameter-problem -j ACCEPT
-A INPUT -p ipv6-icmp --icmpv6-type echo-reply -j ACCEPT
-A INPUT -p ipv6-icmp --icmpv6-type nd-neighbor-solicit -j ACCEPT
-A INPUT -p ipv6-icmp --icmpv6-type nd-neighbor-advert -j ACCEPT

# Anti-flood ICMPv6 echo
-A INPUT -p ipv6-icmp --icmpv6-type echo-request -m limit --limit 5/second --limit-burst 5 -j ACCEPT

# SSH IPv6 avec rate-limit
-A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m limit --limit 10/minute --limit-burst 20 -j ACCEPT
