SixXS Static 6in4 IPv6 Tunnel on Ubuntu / Debian vi if-up script /etc/network/if-up.d/startipv6tunnel

install.sh

#!/bin/sh
# by Philipp Klaus in 2011 on <http://wp.me/p1fyOX-V1>
cat << EOF
This script installs the if-up script /etc/network/if-up.d/startipv6tunnel
which helps your set up a SixXS 6in4 static IPv6 tunnel on Ubuntu / Debian.
EOF
wget https://gist.github.com/raw/965020/startipv6tunnel.sh
cat << EOF
Please configure the script to your needs. I will open the vi text editor, so you
can adjust the setup to your needs. To exit the vi editor enter :q and press [Enter].
EOF
read -p "Press enter when ready to change the script."
vi startipv6tunnel.sh
echo "Copying the script to /etc/network/if-up.d/ and making it executable."
sudo cp startipv6tunnel.sh /etc/network/if-up.d/startipv6tunnel
chmod 750 /etc/network/if-up.d/startipv6tunnel
cat << "EOF"
You may run `/etc/init.d/networking restart` in order to start the tunnel for now.
"EOF"

startipv6tunnel.sh

#!/bin/bash

# file: /etc/network/if-up.d/startipv6tunnel

###  This script helps you to set up a SixXS 6in4 static IPv6 tunnel on Ubuntu / Debian.
###  As it is a if-up script, the tunnel will be started automatically on network startup
###   and may directly contain the associated IPv6 firewall rules.
###  (The script must be executable: chmod 750 /etc/network/if-up.d/startipv6tunnel ).
###  
###  Republished by Philipp Klaus in 2011 on <http://wp.me/p1fyOX-V1>
###  Originally published by Wolfgang Ninaus on <http://bit.ly/hdND7m>

# The IPv4 address of the SixXS PoP you're using
SIXXS4="yyy.yyy.yy.73"
EXTIP="yy.yy.yyy.yy9"
TUNNELPREFIX="2001:15c0:xxxx:xxxx::"
INTPREFIX="2001:15c0:xxxx:xxxx::"
EXTERNALIF="eth0"

MYTUNNELIP="${TUNNELPREFIX}2"
SIXXSTUNNELIP="${TUNNELPREFIX}1"
MTU=1280
IPTABLES="/sbin/iptables"
IPT6="/sbin/ip6tables"
IP6DEV="sixxs"
## ENABLING IPv6 Tunnel ##

$IPTABLES -A INPUT -p 41  -s $SIXXS4 -d $EXTIP -j ACCEPT
$IPTABLES -A OUTPUT -p 41 -d $SIXXS4 -s $EXTIP -j ACCEPT
$IPTABLES -A POSTROUTING -o $EXTERNALIF -t nat -d $SIXXS4 -p all -j SNAT --to-source $EXTIP

## ENABLING IPv6 Tunnel ##

/sbin/ip tunnel add $IP6DEV mode sit local ${EXTIP} remote ${SIXXS4}
/sbin/ip link set $IP6DEV up

/sbin/ip link set mtu ${MTU} dev $IP6DEV
/sbin/ip tunnel change $IP6DEV ttl 64
/sbin/ip -6 addr add ${MYTUNNELIP}/64 dev $IP6DEV
/sbin/ip -6 ro add default via ${SIXXSTUNNELIP} dev $IP6DEV

echo "Starting IPv6 firewall..."
$IPT6 -F
$IPT6 -X
$IPT6 -t mangle -F
$IPT6 -t mangle -X

## DROP all incomming traffic
$IPT6 -P INPUT DROP
$IPT6 -P OUTPUT DROP
$IPT6 -P FORWARD DROP

#unlimited access to loopback
$IPT6 -A INPUT -i lo -j ACCEPT
$IPT6 -A OUTPUT -o lo -j ACCEPT

# Allow full outgoing connection but no incomming stuff
$IPT6 -A INPUT -i $IP6DEV -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT6 -A OUTPUT -o $IP6DEV -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# allow incoming ICMP ping pong stuff
$IPT6 -A INPUT -i $IP6DEV -p ipv6-icmp -j ACCEPT
$IPT6 -A OUTPUT -o $IP6DEV -p ipv6-icmp -j ACCEPT

############## add your custom rules below ############
#### open IPv6  port 80
##$IPT6 -A INPUT -i $IP6DEV -p tcp --destination-port 80 -j ACCEPT
#### open IPv6  port 22
##$IPT6 -A INPUT -i $IP6DEV -p tcp --destination-port 22 -j ACCEPT
#### open IPv6  port 25
##$IPT6 -A INPUT -i $IP6DEV -p tcp --destination-port 25 -j ACCEPT
############# End custom rules ################
#
##### no need to edit below ###
## log everything else
$IPT6 -A INPUT -i $IP6DEV -j LOG
$IPT6 -A INPUT -i $IP6DEV -j DROP