# Generated by ip6tables-save v1.8.11 (nf_tables) on Sat Jul 18 12:57:27 2026
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [4:296]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 135 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 136 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 133 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 134 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 1 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 2 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 3 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 4 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 2/sec -j ACCEPT
-A INPUT -s 2a02:1210:4098:9400::/64 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m limit --limit 3/min -j LOG --log-prefix "SSH6_DENY: "
-A INPUT -p tcp -m tcp --dport 22 -j DROP
-A INPUT -p tcp -m multiport --dports 80,443 -m connlimit --connlimit-above 50 --connlimit-mask 128 --connlimit-saddr -j DROP
-A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW -m recent --set --name WEB_FLOOD_V6 --mask ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --rsource
-A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW -m recent --update --seconds 5 --hitcount 25 --name WEB_FLOOD_V6 --mask ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --rsource -j DROP
-A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "IP6T_DROP: "
-A INPUT -j DROP
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j ACCEPT
COMMIT
# Completed on Sat Jul 18 12:57:27 2026