mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-03-18 09:18:23 +01:00
see #2367 upgraded unit test files and made sure tests pass. Some chain names have changed after this change but overall script structure has improved. Still need to add more tests for various combinations of Classify, Tag and Route options with different actions
This commit is contained in:
Vadim Kurland
parent
48e32aef5d
commit
49e65c2775
@ -275,12 +275,13 @@ string PolicyCompiler_ipt::getNewChainName(PolicyRule *rule,
|
||||
str << iface_name.substr(0,n) << "_";
|
||||
}
|
||||
|
||||
switch (rule->getDirection()) {
|
||||
switch (rule->getDirection())
|
||||
{
|
||||
case PolicyRule::Inbound: str << "In_"; break;
|
||||
case PolicyRule::Outbound: str << "Out_"; break;
|
||||
default: ;
|
||||
}
|
||||
int pos=rule->getPosition();
|
||||
int pos = rule->getPosition();
|
||||
|
||||
string ruleset_name = getRuleSetName();
|
||||
|
||||
@ -294,7 +295,7 @@ string PolicyCompiler_ipt::getNewChainName(PolicyRule *rule,
|
||||
else // special case: position == -1
|
||||
str << "000";
|
||||
|
||||
string suffix=rule->getStr("subrule_suffix");
|
||||
string suffix = rule->getStr("subrule_suffix");
|
||||
if (!suffix.empty()) str << "_" << suffix;
|
||||
|
||||
chain_no++;
|
||||
@ -4275,8 +4276,6 @@ void PolicyCompiler_ipt::compile()
|
||||
add( new Route("process route rules"));
|
||||
add( new storeAction("store original action of this rule"));
|
||||
|
||||
//add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
|
||||
|
||||
add( new Logging1("check global logging override option"));
|
||||
|
||||
add( new expandGroupsInItf("expand groups in Interface" ));
|
||||
@ -4363,6 +4362,14 @@ void PolicyCompiler_ipt::compile()
|
||||
add( new swapMultiAddressObjectsInDst(
|
||||
" swap MultiAddress -> MultiAddressRunTime in Dst"));
|
||||
|
||||
// #2367
|
||||
add( new splitTagClassifyOrRouteIfAction(
|
||||
"split rules with options Tag, Classify or Route when action "
|
||||
"is not Continue" ) );
|
||||
add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
|
||||
add( new accounting("Accounting") );
|
||||
|
||||
|
||||
add( new splitIfSrcAny("split rule if src is any") );
|
||||
|
||||
if (my_table == "mangle")
|
||||
@ -4374,8 +4381,6 @@ void PolicyCompiler_ipt::compile()
|
||||
add( new setChainPostroutingForTag("chain POSTROUTING for Tag"));
|
||||
|
||||
|
||||
|
||||
|
||||
add( new processMultiAddressObjectsInSrc(
|
||||
"process MultiAddress objects in Src"));
|
||||
add( new processMultiAddressObjectsInDst(
|
||||
@ -4487,6 +4492,8 @@ void PolicyCompiler_ipt::compile()
|
||||
add( new optimize1("optimization 1, pass 2"));
|
||||
add( new optimize1("optimization 1, pass 3"));
|
||||
|
||||
|
||||
|
||||
add( new groupServicesByProtocol("split on services"));
|
||||
add( new separateTCPWithFlags("split on TCP services with flags"));
|
||||
add( new verifyCustomServices("verify custom services"));
|
||||
@ -4500,16 +4507,14 @@ void PolicyCompiler_ipt::compile()
|
||||
|
||||
add( new optimize2("optimization 2") );
|
||||
|
||||
// add( new splitTagClassifyOrRouteIfAction(
|
||||
// "split rules with options Tag, Classify or Route when action "
|
||||
// "is not Continue" ) );
|
||||
// add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
|
||||
|
||||
// add( new accounting("Accounting") );
|
||||
// add( new prepareForMultiport("prepare for multiport") );
|
||||
|
||||
add( new splitTagClassifyOrRouteIfAction(
|
||||
"split rules with options Tag, Classify or Route when action "
|
||||
"is not Continue" ) );
|
||||
|
||||
add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
|
||||
|
||||
add( new accounting("Accounting") );
|
||||
add( new prepareForMultiport("prepare for multiport") );
|
||||
|
||||
add( new ConvertToAtomicForAddresses(
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
|
||||
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="18" lastModified="1272731422" id="root">
|
||||
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="19" lastModified="1272731422" id="root">
|
||||
<Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
|
||||
<AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
|
||||
<AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:11:00 2011 PDT by vadim
|
||||
# Generated Tue May 3 19:32:00 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall1.fw /etc/fw/firewall1.fw
|
||||
#
|
||||
@ -682,14 +682,10 @@ script_body() {
|
||||
#
|
||||
echo "Rule 11 (global)"
|
||||
#
|
||||
$IPTABLES -N Out_RULE_11
|
||||
$IPTABLES -A Out_RULE_11 -j RETURN
|
||||
$IPTABLES -A OUTPUT -j Out_RULE_11
|
||||
$IPTABLES -N In_RULE_11
|
||||
$IPTABLES -A In_RULE_11 -j RETURN
|
||||
$IPTABLES -A INPUT -j In_RULE_11
|
||||
$IPTABLES -N RULE_11
|
||||
$IPTABLES -A RULE_11 -j RETURN
|
||||
$IPTABLES -A OUTPUT -j RULE_11
|
||||
$IPTABLES -A INPUT -j RULE_11
|
||||
$IPTABLES -A FORWARD -j RULE_11
|
||||
#
|
||||
# Rule 12 (global)
|
||||
@ -1252,7 +1248,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:11:00 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 19:32:00 2011 by vadim"
|
||||
check_tools
|
||||
|
||||
check_run_time_address_table_files
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:11:39 2011 PDT by vadim
|
||||
# Generated Tue May 3 19:32:31 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall2-6.fw /etc/fw/firewall2-6.fw
|
||||
#
|
||||
@ -19,12 +19,12 @@
|
||||
# firewall2-6:NAT:10: error: Can not use inbound interface specification with rules that translate source because iptables does not allow "-i" in POSTROUTING chain
|
||||
# firewall2-6:NAT:11: error: Can not use inbound interface specification with rules that translate source because iptables does not allow "-i" in POSTROUTING chain
|
||||
# firewall2-6:NAT:12: error: Can not use inbound interface specification with rules that translate source because iptables does not allow "-i" in POSTROUTING chain
|
||||
# firewall2-6:NAT:17: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:17: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:18: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:19: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:20: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:21: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:17: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:17: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:18: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:19: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:20: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:21: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
|
||||
# firewall2-6::: warning: Can not add virtual address 22.22.22.0 (object external_net)
|
||||
|
||||
@ -482,7 +482,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:11:39 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 19:32:31 2011 by vadim"
|
||||
check_tools
|
||||
|
||||
check_run_time_address_table_files
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:12:07 2011 PDT by vadim
|
||||
# Generated Tue May 3 20:22:31 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall37-1.fw /etc/fw/firewall37-1.fw
|
||||
#
|
||||
@ -329,7 +329,7 @@ script_body() {
|
||||
$IPTABLES -N rule27_branch -t mangle
|
||||
$IPTABLES -N Cid45AB5C2E25451.0 -t mangle
|
||||
$IPTABLES -t mangle -A rule27_branch -p tcp -m tcp --tcp-flags ALL ACK -j Cid45AB5C2E25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5C2E25451.0 -j CLASSIFY --set-class 1:16
|
||||
$IPTABLES -t mangle -A Cid45AB5C2E25451.0 -j CLASSIFY --set-class 1:16
|
||||
$IPTABLES -t mangle -A Cid45AB5C2E25451.0 -j ACCEPT
|
||||
#
|
||||
# Rule rule27_branch 1 (global)
|
||||
@ -349,20 +349,11 @@ script_body() {
|
||||
# terminating target
|
||||
$IPTABLES -N Cid45AB5AAD25451.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid45AB5AAD25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid45AB5AAD25451.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid45AB5AAD25451.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5AAD25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.0 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5AAD25451.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid45AB5AAD25451.1
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.1 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5AAD25451.2 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid45AB5AAD25451.2
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.2 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5AAD25451.3 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5AAD25451.3
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.3 -j ACCEPT
|
||||
#
|
||||
# Rule 1 (global)
|
||||
#
|
||||
@ -374,8 +365,8 @@ script_body() {
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_1
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_1
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_1
|
||||
$IPTABLES -t mangle -A RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_1 -j ACCEPT
|
||||
#
|
||||
# Rule 2 (global)
|
||||
@ -392,8 +383,8 @@ script_body() {
|
||||
$IPTABLES -t mangle -A Cid45AB5AC525451.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -N RULE_2_3 -t mangle
|
||||
$IPTABLES -t mangle -A Cid45AB5AC525451.0 -j RULE_2_3
|
||||
$IPTABLES -t mangle -A RULE_2_3 -j LOG --log-level info --log-prefix "RULE 2 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_2_3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_2_3 -j LOG --log-level info --log-prefix "RULE 2 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_2_3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_2_3 -j ACCEPT
|
||||
#
|
||||
# Rule 3 (eth1)
|
||||
@ -403,12 +394,9 @@ script_body() {
|
||||
# terminating target
|
||||
$IPTABLES -N Cid45AB5AD225451.0 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid45AB5AD225451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5AD225451.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid45AB5AD225451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5AD225451.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5AD225451.0 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5AD225451.1 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid45AB5AD225451.1
|
||||
$IPTABLES -t mangle -A Cid45AB5AD225451.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5AD225451.1 -j ACCEPT
|
||||
#
|
||||
# Rule 4 (eth1)
|
||||
#
|
||||
@ -417,34 +405,25 @@ script_body() {
|
||||
# temrinating target
|
||||
$IPTABLES -N Cid45AB5ADE25451.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid45AB5ADE25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid45AB5ADE25451.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid45AB5ADE25451.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid45AB5ADE25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.0 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5ADE25451.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid45AB5ADE25451.1
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.1 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5ADE25451.2 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid45AB5ADE25451.2
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.2 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5ADE25451.3 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid45AB5ADE25451.3
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.3 -j ACCEPT
|
||||
#
|
||||
# Rule 5 (global)
|
||||
#
|
||||
echo "Rule 5 (global)"
|
||||
#
|
||||
# terminating and CONNMARK
|
||||
$IPTABLES -N RULE_5 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j RULE_5
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_5
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_5
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_5
|
||||
$IPTABLES -t mangle -A RULE_5 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_5 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_5 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5AEA25451.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid45AB5AEA25451.0
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid45AB5AEA25451.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid45AB5AEA25451.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5AEA25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5AEA25451.0 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A Cid45AB5AEA25451.0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Cid45AB5AEA25451.0 -j ACCEPT
|
||||
#
|
||||
# Rule 6 (global)
|
||||
#
|
||||
@ -456,8 +435,8 @@ script_body() {
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_6
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_6
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_6
|
||||
$IPTABLES -t mangle -A RULE_6 -j LOG --log-level info --log-prefix "RULE 6 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_6 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_6 -j LOG --log-level info --log-prefix "RULE 6 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_6 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_6 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_6 -j ACCEPT
|
||||
#
|
||||
@ -473,38 +452,38 @@ script_body() {
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5B0225451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -s 192.168.1.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -N RULE_7 -t mangle
|
||||
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -j RULE_7
|
||||
$IPTABLES -t mangle -A RULE_7 -j LOG --log-level info --log-prefix "RULE 7 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_7 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_7 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_7 -j ACCEPT
|
||||
$IPTABLES -N RULE_7_3 -t mangle
|
||||
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -j RULE_7_3
|
||||
$IPTABLES -t mangle -A RULE_7_3 -j LOG --log-level info --log-prefix "RULE 7 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_7_3 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_7_3 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_7_3 -j ACCEPT
|
||||
#
|
||||
# Rule 8 (eth1)
|
||||
#
|
||||
echo "Rule 8 (eth1)"
|
||||
#
|
||||
# terminating and CONNMARK
|
||||
$IPTABLES -N In_RULE_8 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j In_RULE_8
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j In_RULE_8
|
||||
$IPTABLES -t mangle -A In_RULE_8 -i eth1 -j MARK --set-mark 8
|
||||
$IPTABLES -t mangle -A In_RULE_8 -i eth1 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A In_RULE_8 -i eth1 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5B0F25451.0 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid45AB5B0F25451.0
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid45AB5B0F25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5B0F25451.0 -j MARK --set-mark 8
|
||||
$IPTABLES -t mangle -A Cid45AB5B0F25451.0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Cid45AB5B0F25451.0 -j ACCEPT
|
||||
#
|
||||
# Rule 9 (eth1)
|
||||
#
|
||||
echo "Rule 9 (eth1)"
|
||||
#
|
||||
# terminating and CONNMARK
|
||||
$IPTABLES -N Out_RULE_9 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Out_RULE_9
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Out_RULE_9
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Out_RULE_9
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Out_RULE_9
|
||||
$IPTABLES -t mangle -A Out_RULE_9 -o eth1 -j MARK --set-mark 9
|
||||
$IPTABLES -t mangle -A Out_RULE_9 -o eth1 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Out_RULE_9 -o eth1 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5B1B25451.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid45AB5B1B25451.0
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid45AB5B1B25451.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid45AB5B1B25451.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid45AB5B1B25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5B1B25451.0 -j MARK --set-mark 9
|
||||
$IPTABLES -t mangle -A Cid45AB5B1B25451.0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Cid45AB5B1B25451.0 -j ACCEPT
|
||||
#
|
||||
# Rule 11 (global)
|
||||
#
|
||||
@ -516,7 +495,7 @@ script_body() {
|
||||
# and pass control to it using -g
|
||||
$IPTABLES -N Cid45AB5B9525451.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5B9525451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5B9525451.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid45AB5B9525451.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid45AB5B9525451.0 -j ACCEPT
|
||||
#
|
||||
# Rule 12 (eth0)
|
||||
@ -526,7 +505,7 @@ script_body() {
|
||||
# second rule for bug #1618381
|
||||
$IPTABLES -N Cid45AB5BA125451.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -j Cid45AB5BA125451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5BA125451.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5BA125451.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5BA125451.0 -j ACCEPT
|
||||
#
|
||||
# Rule 13 (global)
|
||||
@ -538,7 +517,7 @@ script_body() {
|
||||
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5BAD25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5BAD25451.0 -s 192.168.1.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid45AB5BAD25451.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid45AB5BAD25451.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid45AB5BAD25451.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid45AB5BAD25451.0 -j ACCEPT
|
||||
#
|
||||
# Rule 14 (global)
|
||||
@ -551,7 +530,7 @@ script_body() {
|
||||
$IPTABLES -t mangle -A POSTROUTING -p tcp -m tcp --dport 80 -j Cid45AB5BBA25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5BBA25451.0 -s 192.168.1.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid45AB5BBA25451.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid45AB5BBA25451.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid45AB5BBA25451.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid45AB5BBA25451.0 -j ACCEPT
|
||||
#
|
||||
# Rule 15 (eth0)
|
||||
@ -564,16 +543,10 @@ script_body() {
|
||||
# of that
|
||||
$IPTABLES -N Cid45AB5BC825451.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp --dport 10000:11000 -j Cid45AB5BC825451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5BC825451.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid45AB5BC825451.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid45AB5BC825451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5BC825451.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5BC825451.0 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5BC825451.1 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid45AB5BC825451.1
|
||||
$IPTABLES -t mangle -A Cid45AB5BC825451.1 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5BC825451.1 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5BC825451.2 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid45AB5BC825451.2
|
||||
$IPTABLES -t mangle -A Cid45AB5BC825451.2 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5BC825451.2 -j ACCEPT
|
||||
#
|
||||
# Rule 16 (global)
|
||||
#
|
||||
@ -585,7 +558,7 @@ script_body() {
|
||||
# and pass control to it using -g
|
||||
$IPTABLES -N Cid45AB5BD525451.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5BD525451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5BD525451.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid45AB5BD525451.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid45AB5BD525451.0 -j ACCEPT
|
||||
#
|
||||
# Rule 17 (eth0)
|
||||
@ -595,7 +568,7 @@ script_body() {
|
||||
# second rule for bug #1618381
|
||||
$IPTABLES -N Cid45AB5BE125451.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -j Cid45AB5BE125451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5BE125451.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5BE125451.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5BE125451.0 -j ACCEPT
|
||||
#
|
||||
# Rule 18 (eth0)
|
||||
@ -604,8 +577,8 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Out_RULE_18 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -s 192.168.1.0/24 -j Out_RULE_18
|
||||
$IPTABLES -t mangle -A Out_RULE_18 -j LOG --log-level info --log-prefix "RULE 18 -- CLASSIFY "
|
||||
$IPTABLES -t mangle -A Out_RULE_18 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Out_RULE_18 -j LOG --log-level info --log-prefix "RULE 18 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A Out_RULE_18 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Out_RULE_18 -j ACCEPT
|
||||
#
|
||||
# Rule 19 (global)
|
||||
@ -617,7 +590,7 @@ script_body() {
|
||||
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5BF925451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5BF925451.0 -s 192.168.1.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid45AB5BF925451.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid45AB5BF925451.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid45AB5BF925451.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid45AB5BF925451.0 -j ACCEPT
|
||||
#
|
||||
# Rule 20 (global)
|
||||
@ -630,7 +603,7 @@ script_body() {
|
||||
$IPTABLES -t mangle -A POSTROUTING -p tcp -m tcp --dport 80 -j Cid45AB5C0625451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5C0625451.0 -s 192.168.1.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid45AB5C0625451.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid45AB5C0625451.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid45AB5C0625451.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid45AB5C0625451.0 -j ACCEPT
|
||||
#
|
||||
# Rule 21 (eth0)
|
||||
@ -643,16 +616,10 @@ script_body() {
|
||||
# of that
|
||||
$IPTABLES -N Cid45AB5C1425451.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp --dport 10000:11000 -j Cid45AB5C1425451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5C1425451.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid45AB5C1425451.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid45AB5C1425451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5C1425451.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5C1425451.0 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5C1425451.1 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid45AB5C1425451.1
|
||||
$IPTABLES -t mangle -A Cid45AB5C1425451.1 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5C1425451.1 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5C1425451.2 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid45AB5C1425451.2
|
||||
$IPTABLES -t mangle -A Cid45AB5C1425451.2 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5C1425451.2 -j ACCEPT
|
||||
#
|
||||
# Rule 22 (global)
|
||||
#
|
||||
@ -769,7 +736,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:12:07 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 20:22:31 2011 by vadim"
|
||||
check_tools
|
||||
prolog_commands
|
||||
check_run_time_address_table_files
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:12:04 2011 PDT by vadim
|
||||
# Generated Tue May 3 20:28:13 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall37.fw /etc/fw/firewall37.fw
|
||||
#
|
||||
@ -14,11 +14,11 @@
|
||||
|
||||
# normal script mode (not using iptables-restore)
|
||||
|
||||
# firewall37:mangle_rules:4: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
|
||||
# firewall37:mangle_rules:4: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
|
||||
# firewall37:mangle_rules:7: warning: Empty group or address table object 'empty Ogroup'
|
||||
# firewall37:mangle_rules:7: warning: After removal of all empty groups and address table objects rule element Src becomes 'any' in the rule mangle_rules 7 (global)
|
||||
# Dropping rule mangle_rules 7 (global) because option 'Ignore rules with empty groups' is in effect
|
||||
# firewall37:mangle_rules:4: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
|
||||
# firewall37:mangle_rules:4: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
|
||||
# firewall37:mangle_rules:13: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
|
||||
|
||||
|
||||
@ -334,14 +334,14 @@ script_body() {
|
||||
$IPTABLES -N mymark -t mangle
|
||||
$IPTABLES -N Cid29866X28575.0 -t mangle
|
||||
$IPTABLES -t mangle -A mymark -d 192.168.2.0/24 -m state --state NEW -j Cid29866X28575.0
|
||||
$IPTABLES -t mangle -A Cid29866X28575.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid29866X28575.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid29866X28575.0 -j ACCEPT
|
||||
#
|
||||
# Rule mymark 1 (global)
|
||||
#
|
||||
echo "Rule mymark 1 (global)"
|
||||
#
|
||||
$IPTABLES -t mangle -A mymark -j MARK --set-mark 2
|
||||
$IPTABLES -t mangle -A mymark -j MARK --set-mark 2
|
||||
$IPTABLES -t mangle -A mymark -j ACCEPT
|
||||
# ================ Table 'mangle', rule set Policy
|
||||
#
|
||||
@ -351,20 +351,11 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid43BBA6A09745.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid43BBA6A09745.0
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid43BBA6A09745.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid43BBA6A09745.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid43BBA6A09745.0
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.0 -j ACCEPT
|
||||
$IPTABLES -N Cid43BBA6A09745.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid43BBA6A09745.1
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.1 -j ACCEPT
|
||||
$IPTABLES -N Cid43BBA6A09745.2 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid43BBA6A09745.2
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.2 -j ACCEPT
|
||||
$IPTABLES -N Cid43BBA6A09745.3 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid43BBA6A09745.3
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.3 -j ACCEPT
|
||||
#
|
||||
# Rule 1 (global)
|
||||
#
|
||||
@ -375,8 +366,8 @@ script_body() {
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_1
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_1
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_1
|
||||
$IPTABLES -t mangle -A RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_1 -j ACCEPT
|
||||
#
|
||||
# Rule 2 (global)
|
||||
@ -385,12 +376,9 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid483502D710047.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid483502D710047.0
|
||||
$IPTABLES -t mangle -A Cid483502D710047.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid483502D710047.0
|
||||
$IPTABLES -t mangle -A Cid483502D710047.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid483502D710047.0 -j ACCEPT
|
||||
$IPTABLES -N Cid483502D710047.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid483502D710047.1
|
||||
$IPTABLES -t mangle -A Cid483502D710047.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid483502D710047.1 -j ACCEPT
|
||||
#
|
||||
# Rule 3 (eth1)
|
||||
#
|
||||
@ -398,12 +386,9 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid30009X2275.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid30009X2275.0
|
||||
$IPTABLES -t mangle -A Cid30009X2275.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid30009X2275.0
|
||||
$IPTABLES -t mangle -A Cid30009X2275.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid30009X2275.0 -j ACCEPT
|
||||
$IPTABLES -N Cid30009X2275.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid30009X2275.1
|
||||
$IPTABLES -t mangle -A Cid30009X2275.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid30009X2275.1 -j ACCEPT
|
||||
#
|
||||
# Rule 4 (global)
|
||||
#
|
||||
@ -412,39 +397,33 @@ script_body() {
|
||||
$IPTABLES -N RULE_4 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j RULE_4
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_4
|
||||
$IPTABLES -t mangle -A RULE_4 -j LOG --log-level info --log-prefix "RULE 4 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_4 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_4 -j LOG --log-level info --log-prefix "RULE 4 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_4 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_4 -j ACCEPT
|
||||
#
|
||||
# Rule 5 (eth1)
|
||||
#
|
||||
echo "Rule 5 (eth1)"
|
||||
#
|
||||
$IPTABLES -N Cid43501X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -m state --state NEW -j Cid43501X5007.0
|
||||
$IPTABLES -N Cid43501X5007.1 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43501X5007.0 -p 50 -j Cid43501X5007.1
|
||||
$IPTABLES -t mangle -A Cid43501X5007.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43501X5007.1 -j ACCEPT
|
||||
$IPTABLES -N Cid43501X5007.2 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43501X5007.0 -p ah -j Cid43501X5007.2
|
||||
$IPTABLES -t mangle -A Cid43501X5007.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43501X5007.2 -j ACCEPT
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -m state --state NEW -j Cid43501X5007.1
|
||||
$IPTABLES -N Cid43501X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43501X5007.1 -p 50 -j Cid43501X5007.0
|
||||
$IPTABLES -t mangle -A Cid43501X5007.1 -p ah -j Cid43501X5007.0
|
||||
$IPTABLES -t mangle -A Cid43501X5007.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43501X5007.0 -j ACCEPT
|
||||
#
|
||||
# Rule 6 (eth1)
|
||||
#
|
||||
echo "Rule 6 (eth1)"
|
||||
#
|
||||
$IPTABLES -N Cid43518X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -m state --state NEW -j Cid43518X5007.0
|
||||
$IPTABLES -N Cid43518X5007.1 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43518X5007.0 -p 50 -j Cid43518X5007.1
|
||||
$IPTABLES -t mangle -A Cid43518X5007.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43518X5007.1 -j ACCEPT
|
||||
$IPTABLES -N Cid43518X5007.2 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43518X5007.0 -p ah -j Cid43518X5007.2
|
||||
$IPTABLES -t mangle -A Cid43518X5007.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43518X5007.2 -j ACCEPT
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -m state --state NEW -j Cid43518X5007.1
|
||||
$IPTABLES -N Cid43518X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43518X5007.1 -p 50 -j Cid43518X5007.0
|
||||
$IPTABLES -t mangle -A Cid43518X5007.1 -p ah -j Cid43518X5007.0
|
||||
$IPTABLES -t mangle -A Cid43518X5007.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43518X5007.0 -j ACCEPT
|
||||
#
|
||||
# Rule 7 (eth1)
|
||||
#
|
||||
@ -452,42 +431,33 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid43535X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid43535X5007.0
|
||||
$IPTABLES -t mangle -A Cid43535X5007.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid43535X5007.0
|
||||
$IPTABLES -t mangle -A Cid43535X5007.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43535X5007.0 -j ACCEPT
|
||||
$IPTABLES -N Cid43535X5007.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid43535X5007.1
|
||||
$IPTABLES -t mangle -A Cid43535X5007.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43535X5007.1 -j ACCEPT
|
||||
#
|
||||
# Rule 8 (eth1)
|
||||
#
|
||||
echo "Rule 8 (eth1)"
|
||||
#
|
||||
$IPTABLES -N Cid43554X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -j Cid43554X5007.0
|
||||
$IPTABLES -N Cid43554X5007.1 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43554X5007.0 -p 50 -j Cid43554X5007.1
|
||||
$IPTABLES -t mangle -A Cid43554X5007.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43554X5007.1 -j ACCEPT
|
||||
$IPTABLES -N Cid43554X5007.2 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43554X5007.0 -p ah -j Cid43554X5007.2
|
||||
$IPTABLES -t mangle -A Cid43554X5007.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43554X5007.2 -j ACCEPT
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -j Cid43554X5007.1
|
||||
$IPTABLES -N Cid43554X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43554X5007.1 -p 50 -j Cid43554X5007.0
|
||||
$IPTABLES -t mangle -A Cid43554X5007.1 -p ah -j Cid43554X5007.0
|
||||
$IPTABLES -t mangle -A Cid43554X5007.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43554X5007.0 -j ACCEPT
|
||||
#
|
||||
# Rule 9 (eth1)
|
||||
#
|
||||
echo "Rule 9 (eth1)"
|
||||
#
|
||||
$IPTABLES -N Cid43571X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -j Cid43571X5007.0
|
||||
$IPTABLES -N Cid43571X5007.1 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43571X5007.0 -p 50 -j Cid43571X5007.1
|
||||
$IPTABLES -t mangle -A Cid43571X5007.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43571X5007.1 -j ACCEPT
|
||||
$IPTABLES -N Cid43571X5007.2 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43571X5007.0 -p ah -j Cid43571X5007.2
|
||||
$IPTABLES -t mangle -A Cid43571X5007.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43571X5007.2 -j ACCEPT
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -j Cid43571X5007.1
|
||||
$IPTABLES -N Cid43571X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43571X5007.1 -p 50 -j Cid43571X5007.0
|
||||
$IPTABLES -t mangle -A Cid43571X5007.1 -p ah -j Cid43571X5007.0
|
||||
$IPTABLES -t mangle -A Cid43571X5007.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43571X5007.0 -j ACCEPT
|
||||
#
|
||||
# Rule 10 (eth1)
|
||||
#
|
||||
@ -495,12 +465,9 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid43588X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -j Cid43588X5007.0
|
||||
$IPTABLES -t mangle -A Cid43588X5007.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -j Cid43588X5007.0
|
||||
$IPTABLES -t mangle -A Cid43588X5007.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43588X5007.0 -j ACCEPT
|
||||
$IPTABLES -N Cid43588X5007.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -j Cid43588X5007.1
|
||||
$IPTABLES -t mangle -A Cid43588X5007.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43588X5007.1 -j ACCEPT
|
||||
#
|
||||
# Rule 11 (global)
|
||||
#
|
||||
@ -515,8 +482,8 @@ script_body() {
|
||||
$IPTABLES -t mangle -A Cid43BBCC139745.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -N RULE_11_3 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43BBCC139745.0 -j RULE_11_3
|
||||
$IPTABLES -t mangle -A RULE_11_3 -j LOG --log-level info --log-prefix "RULE 11 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_11_3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_11_3 -j LOG --log-level info --log-prefix "RULE 11 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_11_3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_11_3 -j ACCEPT
|
||||
#
|
||||
# Rule 12 (eth1)
|
||||
@ -525,28 +492,16 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid4665E24F7765.0 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.0
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid4665E24F7765.0
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.0 -j ACCEPT
|
||||
$IPTABLES -N Cid4665E24F7765.1 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid4665E24F7765.1
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.1
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid4665E24F7765.1
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.1
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid4665E24F7765.1
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.1 -j ACCEPT
|
||||
$IPTABLES -N Cid4665E24F7765.2 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.2
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.2 -j ACCEPT
|
||||
$IPTABLES -N Cid4665E24F7765.3 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid4665E24F7765.3
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.3 -j ACCEPT
|
||||
$IPTABLES -N Cid4665E24F7765.4 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.4
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.4 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.4 -j ACCEPT
|
||||
$IPTABLES -N Cid4665E24F7765.5 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid4665E24F7765.5
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.5 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.5 -j ACCEPT
|
||||
#
|
||||
# Rule 13 (eth1)
|
||||
#
|
||||
@ -554,12 +509,9 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid43BBCC3D9745.0 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid43BBCC3D9745.0
|
||||
$IPTABLES -t mangle -A Cid43BBCC3D9745.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid43BBCC3D9745.0
|
||||
$IPTABLES -t mangle -A Cid43BBCC3D9745.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43BBCC3D9745.0 -j ACCEPT
|
||||
$IPTABLES -N Cid43BBCC3D9745.1 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid43BBCC3D9745.1
|
||||
$IPTABLES -t mangle -A Cid43BBCC3D9745.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43BBCC3D9745.1 -j ACCEPT
|
||||
#
|
||||
# Rule 14 (eth1)
|
||||
#
|
||||
@ -567,34 +519,25 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid459E471C10946.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid459E471C10946.0
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid459E471C10946.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid459E471C10946.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid459E471C10946.0
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.0 -j ACCEPT
|
||||
$IPTABLES -N Cid459E471C10946.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid459E471C10946.1
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.1 -j ACCEPT
|
||||
$IPTABLES -N Cid459E471C10946.2 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid459E471C10946.2
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.2 -j ACCEPT
|
||||
$IPTABLES -N Cid459E471C10946.3 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid459E471C10946.3
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.3 -j ACCEPT
|
||||
#
|
||||
# Rule 15 (global)
|
||||
#
|
||||
echo "Rule 15 (global)"
|
||||
#
|
||||
# using CONNMARK
|
||||
$IPTABLES -N RULE_15 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j RULE_15
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_15
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_15
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_15
|
||||
$IPTABLES -t mangle -A RULE_15 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_15 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_15 -j ACCEPT
|
||||
$IPTABLES -N Cid4483A4BD1810.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid4483A4BD1810.0
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid4483A4BD1810.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid4483A4BD1810.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid4483A4BD1810.0
|
||||
$IPTABLES -t mangle -A Cid4483A4BD1810.0 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A Cid4483A4BD1810.0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Cid4483A4BD1810.0 -j ACCEPT
|
||||
#
|
||||
# Rule 16 (global)
|
||||
#
|
||||
@ -606,8 +549,8 @@ script_body() {
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_16
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_16
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_16
|
||||
$IPTABLES -t mangle -A RULE_16 -j LOG --log-level info --log-prefix "RULE 16 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_16 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_16 -j LOG --log-level info --log-prefix "RULE 16 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_16 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_16 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_16 -j ACCEPT
|
||||
#
|
||||
@ -623,38 +566,38 @@ script_body() {
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid4483A4DF1810.0
|
||||
$IPTABLES -t mangle -A Cid4483A4DF1810.0 -s 192.168.1.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid4483A4DF1810.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -N RULE_17 -t mangle
|
||||
$IPTABLES -t mangle -A Cid4483A4DF1810.0 -j RULE_17
|
||||
$IPTABLES -t mangle -A RULE_17 -j LOG --log-level info --log-prefix "RULE 17 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_17 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_17 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_17 -j ACCEPT
|
||||
$IPTABLES -N RULE_17_3 -t mangle
|
||||
$IPTABLES -t mangle -A Cid4483A4DF1810.0 -j RULE_17_3
|
||||
$IPTABLES -t mangle -A RULE_17_3 -j LOG --log-level info --log-prefix "RULE 17 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_17_3 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_17_3 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_17_3 -j ACCEPT
|
||||
#
|
||||
# Rule 18 (eth1)
|
||||
#
|
||||
echo "Rule 18 (eth1)"
|
||||
#
|
||||
# using CONNMARK
|
||||
$IPTABLES -N In_RULE_18 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j In_RULE_18
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j In_RULE_18
|
||||
$IPTABLES -t mangle -A In_RULE_18 -i eth1 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A In_RULE_18 -i eth1 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A In_RULE_18 -i eth1 -j ACCEPT
|
||||
$IPTABLES -N Cid4483A4F01810.0 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid4483A4F01810.0
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid4483A4F01810.0
|
||||
$IPTABLES -t mangle -A Cid4483A4F01810.0 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A Cid4483A4F01810.0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Cid4483A4F01810.0 -j ACCEPT
|
||||
#
|
||||
# Rule 19 (eth1)
|
||||
#
|
||||
echo "Rule 19 (eth1)"
|
||||
#
|
||||
# using CONNMARK
|
||||
$IPTABLES -N Out_RULE_19 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Out_RULE_19
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Out_RULE_19
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Out_RULE_19
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Out_RULE_19
|
||||
$IPTABLES -t mangle -A Out_RULE_19 -o eth1 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A Out_RULE_19 -o eth1 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Out_RULE_19 -o eth1 -j ACCEPT
|
||||
$IPTABLES -N Cid459E472D10946.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid459E472D10946.0
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid459E472D10946.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid459E472D10946.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid459E472D10946.0
|
||||
$IPTABLES -t mangle -A Cid459E472D10946.0 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A Cid459E472D10946.0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Cid459E472D10946.0 -j ACCEPT
|
||||
#
|
||||
# Rule 22 (global)
|
||||
#
|
||||
@ -662,7 +605,7 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid43BB81879745.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -s 192.168.1.0/24 -j Cid43BB81879745.0
|
||||
$IPTABLES -t mangle -A Cid43BB81879745.0 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A Cid43BB81879745.0 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A Cid43BB81879745.0 -j ACCEPT
|
||||
#
|
||||
# Rule 23 (global)
|
||||
@ -671,8 +614,8 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N RULE_23 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -s 192.168.1.0/24 -j RULE_23
|
||||
$IPTABLES -t mangle -A RULE_23 -j LOG --log-level info --log-prefix "RULE 23 -- CLASSIFY "
|
||||
$IPTABLES -t mangle -A RULE_23 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A RULE_23 -j LOG --log-level info --log-prefix "RULE 23 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_23 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A RULE_23 -j ACCEPT
|
||||
#
|
||||
# Rule 24 (global)
|
||||
@ -683,7 +626,7 @@ script_body() {
|
||||
$IPTABLES -t mangle -A POSTROUTING -j Cid451E56936383.0
|
||||
$IPTABLES -t mangle -A Cid451E56936383.0 -s 192.168.1.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid451E56936383.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid451E56936383.0 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A Cid451E56936383.0 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A Cid451E56936383.0 -j ACCEPT
|
||||
#
|
||||
# Rule 25 (global)
|
||||
@ -696,8 +639,8 @@ script_body() {
|
||||
$IPTABLES -t mangle -A Cid451E56A46383.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -N RULE_25_3 -t mangle
|
||||
$IPTABLES -t mangle -A Cid451E56A46383.0 -j RULE_25_3
|
||||
$IPTABLES -t mangle -A RULE_25_3 -j LOG --log-level info --log-prefix "RULE 25 -- CLASSIFY "
|
||||
$IPTABLES -t mangle -A RULE_25_3 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A RULE_25_3 -j LOG --log-level info --log-prefix "RULE 25 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_25_3 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A RULE_25_3 -j ACCEPT
|
||||
#
|
||||
# Rule 26 (eth1)
|
||||
@ -706,7 +649,7 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid451EAD596383.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -s 192.168.1.0/24 -j Cid451EAD596383.0
|
||||
$IPTABLES -t mangle -A Cid451EAD596383.0 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A Cid451EAD596383.0 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A Cid451EAD596383.0 -j ACCEPT
|
||||
#
|
||||
# Rule 27 (eth1)
|
||||
@ -715,8 +658,8 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Out_RULE_27 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -s 192.168.1.0/24 -j Out_RULE_27
|
||||
$IPTABLES -t mangle -A Out_RULE_27 -j LOG --log-level info --log-prefix "RULE 27 -- CLASSIFY "
|
||||
$IPTABLES -t mangle -A Out_RULE_27 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A Out_RULE_27 -j LOG --log-level info --log-prefix "RULE 27 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A Out_RULE_27 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A Out_RULE_27 -j ACCEPT
|
||||
#
|
||||
# Rule 28 (eth1)
|
||||
@ -725,7 +668,7 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid451ED8E76383.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o ! eth1 -s 192.168.1.0/24 -j Cid451ED8E76383.0
|
||||
$IPTABLES -t mangle -A Cid451ED8E76383.0 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A Cid451ED8E76383.0 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A Cid451ED8E76383.0 -j ACCEPT
|
||||
#
|
||||
# Rule 29 (eth1)
|
||||
@ -734,8 +677,8 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Out_RULE_29 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o ! eth1 -s 192.168.1.0/24 -j Out_RULE_29
|
||||
$IPTABLES -t mangle -A Out_RULE_29 -j LOG --log-level info --log-prefix "RULE 29 -- CLASSIFY "
|
||||
$IPTABLES -t mangle -A Out_RULE_29 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A Out_RULE_29 -j LOG --log-level info --log-prefix "RULE 29 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A Out_RULE_29 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A Out_RULE_29 -j ACCEPT
|
||||
#
|
||||
# Rule 30 (global)
|
||||
@ -747,7 +690,7 @@ script_body() {
|
||||
# in this firewall object
|
||||
$IPTABLES -N Cid4599A9DC19324.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid4599A9DC19324.0
|
||||
$IPTABLES -t mangle -A Cid4599A9DC19324.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid4599A9DC19324.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid4599A9DC19324.0 -j ACCEPT
|
||||
#
|
||||
# Rule 31 (eth0)
|
||||
@ -757,7 +700,7 @@ script_body() {
|
||||
# second rule for bug #1618381
|
||||
$IPTABLES -N Cid4599A9E919324.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -j Cid4599A9E919324.0
|
||||
$IPTABLES -t mangle -A Cid4599A9E919324.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid4599A9E919324.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid4599A9E919324.0 -j ACCEPT
|
||||
#
|
||||
# Rule 32 (global)
|
||||
@ -769,7 +712,7 @@ script_body() {
|
||||
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid459A026219324.0
|
||||
$IPTABLES -t mangle -A Cid459A026219324.0 -s 192.168.1.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid459A026219324.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid459A026219324.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid459A026219324.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid459A026219324.0 -j ACCEPT
|
||||
#
|
||||
# Rule 33 (global)
|
||||
@ -782,7 +725,7 @@ script_body() {
|
||||
$IPTABLES -t mangle -A POSTROUTING -p tcp -m tcp --dport 80 -j Cid459A5AFB19324.0
|
||||
$IPTABLES -t mangle -A Cid459A5AFB19324.0 -s 192.168.1.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid459A5AFB19324.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid459A5AFB19324.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid459A5AFB19324.0 -j CLASSIFY --set-class 1:10
|
||||
$IPTABLES -t mangle -A Cid459A5AFB19324.0 -j ACCEPT
|
||||
#
|
||||
# Rule 34 (eth0)
|
||||
@ -795,16 +738,10 @@ script_body() {
|
||||
# of that
|
||||
$IPTABLES -N Cid459A875F19324.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp --dport 10000:11000 -j Cid459A875F19324.0
|
||||
$IPTABLES -t mangle -A Cid459A875F19324.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid459A875F19324.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid459A875F19324.0
|
||||
$IPTABLES -t mangle -A Cid459A875F19324.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid459A875F19324.0 -j ACCEPT
|
||||
$IPTABLES -N Cid459A875F19324.1 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid459A875F19324.1
|
||||
$IPTABLES -t mangle -A Cid459A875F19324.1 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid459A875F19324.1 -j ACCEPT
|
||||
$IPTABLES -N Cid459A875F19324.2 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid459A875F19324.2
|
||||
$IPTABLES -t mangle -A Cid459A875F19324.2 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid459A875F19324.2 -j ACCEPT
|
||||
#
|
||||
# Rule 36 (global)
|
||||
#
|
||||
@ -830,12 +767,12 @@ script_body() {
|
||||
#
|
||||
echo "Rule mangle_rules 1 (global)"
|
||||
#
|
||||
$IPTABLES -N mangle_rules_1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j mangle_rules_1
|
||||
$IPTABLES -t mangle -A PREROUTING -p tcp -m tcp --dport 80 -m state --state NEW -j mangle_rules_1
|
||||
$IPTABLES -t mangle -A mangle_rules_1 -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A mangle_rules_1 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A mangle_rules_1 -j ACCEPT
|
||||
$IPTABLES -N Cid56804X29169.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j Cid56804X29169.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p tcp -m tcp --dport 80 -m state --state NEW -j Cid56804X29169.0
|
||||
$IPTABLES -t mangle -A Cid56804X29169.0 -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A Cid56804X29169.0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Cid56804X29169.0 -j ACCEPT
|
||||
#
|
||||
# Rule mangle_rules 2 (global)
|
||||
#
|
||||
@ -843,7 +780,7 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid56817X29169.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j Cid56817X29169.0
|
||||
$IPTABLES -t mangle -A Cid56817X29169.0 -j CLASSIFY --set-class 1:12
|
||||
$IPTABLES -t mangle -A Cid56817X29169.0 -j CLASSIFY --set-class 1:12
|
||||
$IPTABLES -t mangle -A Cid56817X29169.0 -j ACCEPT
|
||||
#
|
||||
# Rule mangle_rules 4 (global)
|
||||
@ -1050,7 +987,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:12:04 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 20:28:13 2011 by vadim"
|
||||
check_tools
|
||||
prolog_commands
|
||||
check_run_time_address_table_files
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:12:07 2011 PDT by vadim
|
||||
# Generated Tue May 3 19:32:56 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall38.fw /etc/fw/firewall38.fw
|
||||
#
|
||||
@ -366,10 +366,10 @@ script_body() {
|
||||
# ================ Table 'mangle', rule set Policy
|
||||
#
|
||||
# Rule 0 (global)
|
||||
echo "-A OUTPUT -p 50 -m state --state NEW -j MARK --set-mark 16"
|
||||
echo "-A OUTPUT -p ah -m state --state NEW -j MARK --set-mark 16"
|
||||
echo "-A PREROUTING -p 50 -m state --state NEW -j MARK --set-mark 16"
|
||||
echo "-A PREROUTING -p ah -m state --state NEW -j MARK --set-mark 16"
|
||||
echo "-A OUTPUT -p 50 -m state --state NEW -j MARK --set-mark 16"
|
||||
echo "-A OUTPUT -p ah -m state --state NEW -j MARK --set-mark 16"
|
||||
echo "-A PREROUTING -p 50 -m state --state NEW -j MARK --set-mark 16"
|
||||
echo "-A PREROUTING -p ah -m state --state NEW -j MARK --set-mark 16"
|
||||
#
|
||||
# Rule 1 (global)
|
||||
echo ":RULE_1 - [0:0]"
|
||||
@ -377,8 +377,8 @@ script_body() {
|
||||
echo "-A OUTPUT -p ah -m state --state NEW -j RULE_1 "
|
||||
echo "-A PREROUTING -p 50 -m state --state NEW -j RULE_1 "
|
||||
echo "-A PREROUTING -p ah -m state --state NEW -j RULE_1 "
|
||||
echo "-A RULE_1 -j LOG --log-level info --log-prefix \"RULE 1 -- TAG \""
|
||||
echo "-A RULE_1 -j MARK --set-mark 16"
|
||||
echo "-A RULE_1 -j LOG --log-level info --log-prefix \"RULE 1 -- CONTINUE \""
|
||||
echo "-A RULE_1 -j MARK --set-mark 16"
|
||||
#
|
||||
# Rule 2 (global)
|
||||
echo ":Cid43BBF1AD9745.0 - [0:0]"
|
||||
@ -390,35 +390,35 @@ script_body() {
|
||||
echo "-A PREROUTING -s ! 192.168.1.0/24 -m state --state NEW -j Cid43BBF1AD9745.1 "
|
||||
echo "-A Cid43BBF1AD9745.1 -p 50 -j RULE_2 "
|
||||
echo "-A Cid43BBF1AD9745.1 -p ah -j RULE_2 "
|
||||
echo "-A RULE_2 -j LOG --log-level info --log-prefix \"RULE 2 -- TAG \""
|
||||
echo "-A RULE_2 -j MARK --set-mark 16"
|
||||
echo "-A RULE_2 -j LOG --log-level info --log-prefix \"RULE 2 -- CONTINUE \""
|
||||
echo "-A RULE_2 -j MARK --set-mark 16"
|
||||
#
|
||||
# Rule 3 (eth1)
|
||||
echo "-A PREROUTING -i eth1 -p 50 -m state --state NEW -j MARK --set-mark 16"
|
||||
echo "-A PREROUTING -i eth1 -p ah -m state --state NEW -j MARK --set-mark 16"
|
||||
echo "-A PREROUTING -i eth1 -p 50 -m state --state NEW -j MARK --set-mark 16"
|
||||
echo "-A PREROUTING -i eth1 -p ah -m state --state NEW -j MARK --set-mark 16"
|
||||
#
|
||||
# Rule 4 (global)
|
||||
# rule comment: rule 4
|
||||
echo "-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j MARK --set-mark 2"
|
||||
echo "-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j MARK --set-mark 2"
|
||||
#
|
||||
# Rule 5 (global)
|
||||
echo ":RULE_5 - [0:0]"
|
||||
echo "-A OUTPUT -p tcp -m tcp -s 22.22.23.22 --dport 80 -m state --state NEW -j RULE_5 "
|
||||
echo "-A RULE_5 -j LOG --log-level info --log-prefix \"RULE 5 -- TAG \""
|
||||
echo "-A RULE_5 -j MARK --set-mark 2"
|
||||
echo "-A RULE_5 -j LOG --log-level info --log-prefix \"RULE 5 -- CONTINUE \""
|
||||
echo "-A RULE_5 -j MARK --set-mark 2"
|
||||
#
|
||||
# Rule 6 (eth1)
|
||||
echo "-A OUTPUT -o eth1 -p tcp -m tcp -s 22.22.23.22 --dport 80 -m state --state NEW -j MARK --set-mark 2"
|
||||
echo "-A OUTPUT -o eth1 -p tcp -m tcp -s 22.22.23.22 --dport 80 -m state --state NEW -j MARK --set-mark 2"
|
||||
#
|
||||
# Rule 7 (eth1)
|
||||
echo "-A PREROUTING -i eth1 -p tcp -m tcp -s 22.22.23.22 --dport 80 -m state --state NEW -j MARK --set-mark 2"
|
||||
echo "-A PREROUTING -i eth1 -p tcp -m tcp -s 22.22.23.22 --dport 80 -m state --state NEW -j MARK --set-mark 2"
|
||||
#
|
||||
# Rule 8 (eth1)
|
||||
echo ":Cid462EA8B230547.0 - [0:0]"
|
||||
echo "-A OUTPUT -o eth1 -p tcp -m tcp --dport 80 -m state --state NEW -j Cid462EA8B230547.0 "
|
||||
echo "-A Cid462EA8B230547.0 -s 22.22.23.22 -j RETURN "
|
||||
echo "-A Cid462EA8B230547.0 -j MARK --set-mark 2"
|
||||
echo "-A POSTROUTING -o eth1 -p tcp -m tcp --dport 80 -m state --state NEW -j MARK --set-mark 2"
|
||||
echo "-A Cid462EA8B230547.0 -j MARK --set-mark 2"
|
||||
echo "-A POSTROUTING -o eth1 -p tcp -m tcp --dport 80 -m state --state NEW -j MARK --set-mark 2"
|
||||
#
|
||||
echo COMMIT
|
||||
|
||||
@ -498,7 +498,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:12:07 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 19:32:56 2011 by vadim"
|
||||
check_tools
|
||||
prolog_commands
|
||||
check_run_time_address_table_files
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:12:13 2011 PDT by vadim
|
||||
# Generated Tue May 3 19:33:01 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall40-1.fw /etc/firewall40-1.fw
|
||||
#
|
||||
@ -325,31 +325,27 @@ script_body() {
|
||||
echo "Rule Policy_1 0 (eth0)"
|
||||
#
|
||||
$IPTABLES -N Policy_1 -t mangle
|
||||
$IPTABLES -N In_Policy_1_0 -t mangle
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j In_Policy_1_0
|
||||
$IPTABLES -t mangle -A In_Policy_1_0 -i eth0 -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A In_Policy_1_0 -i eth0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j CONNMARK --save-mark
|
||||
#
|
||||
# Rule Policy_1 1 (eth2)
|
||||
#
|
||||
echo "Rule Policy_1 1 (eth2)"
|
||||
#
|
||||
$IPTABLES -N In_Policy_1_1 -t mangle
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j In_Policy_1_1
|
||||
$IPTABLES -t mangle -A In_Policy_1_1 -i eth2 -j MARK --set-mark 2
|
||||
$IPTABLES -t mangle -A In_Policy_1_1 -i eth2 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j MARK --set-mark 2
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j CONNMARK --save-mark
|
||||
#
|
||||
# Rule Policy_1 3 (global)
|
||||
#
|
||||
echo "Rule Policy_1 3 (global)"
|
||||
#
|
||||
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j ROUTE --oif eth0 --continue
|
||||
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j ROUTE --oif eth0 --continue
|
||||
#
|
||||
# Rule Policy_1 4 (global)
|
||||
#
|
||||
echo "Rule Policy_1 4 (global)"
|
||||
#
|
||||
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 2 -j ROUTE --oif eth2 --continue
|
||||
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 2 -j ROUTE --oif eth2 --continue
|
||||
#
|
||||
# Rule Policy_1 6 (global)
|
||||
#
|
||||
@ -360,8 +356,8 @@ script_body() {
|
||||
$IPTABLES -N Policy_1_6 -t mangle
|
||||
$IPTABLES -t mangle -A Cid55038X29165.0 -d 22.22.22.0/24 -j Policy_1_6
|
||||
$IPTABLES -t mangle -A Cid55038X29165.0 -d 33.33.33.0/24 -j Policy_1_6
|
||||
$IPTABLES -t mangle -A Policy_1_6 -j LOG --log-level info --log-prefix "RULE 6 -- TAG "
|
||||
$IPTABLES -t mangle -A Policy_1_6 -j MARK --set-mark 8
|
||||
$IPTABLES -t mangle -A Policy_1_6 -j LOG --log-level info --log-prefix "RULE 6 -- CONTINUE "
|
||||
$IPTABLES -t mangle -A Policy_1_6 -j MARK --set-mark 8
|
||||
|
||||
# ================ Table 'filter', rule set Policy_1
|
||||
#
|
||||
@ -450,7 +446,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:12:13 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 19:33:01 2011 by vadim"
|
||||
check_tools
|
||||
prolog_commands
|
||||
check_run_time_address_table_files
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:12:14 2011 PDT by vadim
|
||||
# Generated Tue May 3 19:33:02 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall40-2.fw /etc/firewall40-2.fw
|
||||
#
|
||||
@ -325,31 +325,27 @@ script_body() {
|
||||
echo "Rule Policy_1 0 (eth0)"
|
||||
#
|
||||
$IPTABLES -N Policy_1 -t mangle
|
||||
$IPTABLES -N In_Policy_1_0 -t mangle
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j In_Policy_1_0
|
||||
$IPTABLES -t mangle -A In_Policy_1_0 -i eth0 -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A In_Policy_1_0 -i eth0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j CONNMARK --save-mark
|
||||
#
|
||||
# Rule Policy_1 1 (eth2)
|
||||
#
|
||||
echo "Rule Policy_1 1 (eth2)"
|
||||
#
|
||||
$IPTABLES -N In_Policy_1_1 -t mangle
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j In_Policy_1_1
|
||||
$IPTABLES -t mangle -A In_Policy_1_1 -i eth2 -j MARK --set-mark 2
|
||||
$IPTABLES -t mangle -A In_Policy_1_1 -i eth2 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j MARK --set-mark 2
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j CONNMARK --save-mark
|
||||
#
|
||||
# Rule Policy_1 3 (global)
|
||||
#
|
||||
echo "Rule Policy_1 3 (global)"
|
||||
#
|
||||
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j ROUTE --oif eth0 --continue
|
||||
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j ROUTE --oif eth0 --continue
|
||||
#
|
||||
# Rule Policy_1 4 (global)
|
||||
#
|
||||
echo "Rule Policy_1 4 (global)"
|
||||
#
|
||||
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 2 -j ROUTE --oif eth2 --continue
|
||||
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 2 -j ROUTE --oif eth2 --continue
|
||||
#
|
||||
# Rule Policy_1 6 (global)
|
||||
#
|
||||
@ -360,8 +356,8 @@ script_body() {
|
||||
$IPTABLES -N Policy_1_6 -t mangle
|
||||
$IPTABLES -t mangle -A Cid55227X22068.0 -d 22.22.22.0/24 -j Policy_1_6
|
||||
$IPTABLES -t mangle -A Cid55227X22068.0 -d 33.33.33.0/24 -j Policy_1_6
|
||||
$IPTABLES -t mangle -A Policy_1_6 -j LOG --log-level info --log-prefix "RULE 6 -- TAG "
|
||||
$IPTABLES -t mangle -A Policy_1_6 -j MARK --set-mark 8
|
||||
$IPTABLES -t mangle -A Policy_1_6 -j LOG --log-level info --log-prefix "RULE 6 -- CONTINUE "
|
||||
$IPTABLES -t mangle -A Policy_1_6 -j MARK --set-mark 8
|
||||
|
||||
# ================ Table 'filter', rule set Policy_1
|
||||
#
|
||||
@ -437,7 +433,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:12:14 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 19:33:02 2011 by vadim"
|
||||
check_tools
|
||||
prolog_commands
|
||||
check_run_time_address_table_files
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:12:13 2011 PDT by vadim
|
||||
# Generated Tue May 3 19:33:00 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall40.fw /etc/firewall40.fw
|
||||
#
|
||||
@ -324,31 +324,27 @@ script_body() {
|
||||
#
|
||||
echo "Rule 0 (eth0)"
|
||||
#
|
||||
$IPTABLES -N In_RULE_0 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth0 -m state --state NEW -j In_RULE_0
|
||||
$IPTABLES -t mangle -A In_RULE_0 -i eth0 -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A In_RULE_0 -i eth0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth0 -m state --state NEW -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth0 -m state --state NEW -j CONNMARK --save-mark
|
||||
#
|
||||
# Rule 1 (eth2)
|
||||
#
|
||||
echo "Rule 1 (eth2)"
|
||||
#
|
||||
$IPTABLES -N In_RULE_1 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth2 -m state --state NEW -j In_RULE_1
|
||||
$IPTABLES -t mangle -A In_RULE_1 -i eth2 -j MARK --set-mark 2
|
||||
$IPTABLES -t mangle -A In_RULE_1 -i eth2 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth2 -m state --state NEW -j MARK --set-mark 2
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth2 -m state --state NEW -j CONNMARK --save-mark
|
||||
#
|
||||
# Rule 3 (global)
|
||||
#
|
||||
echo "Rule 3 (global)"
|
||||
#
|
||||
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j ROUTE --oif eth0 --continue
|
||||
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j ROUTE --oif eth0 --continue
|
||||
#
|
||||
# Rule 4 (global)
|
||||
#
|
||||
echo "Rule 4 (global)"
|
||||
#
|
||||
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 2 -j ROUTE --oif eth2 --continue
|
||||
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 2 -j ROUTE --oif eth2 --continue
|
||||
#
|
||||
# Rule 6 (global)
|
||||
#
|
||||
@ -359,8 +355,8 @@ script_body() {
|
||||
$IPTABLES -N RULE_6 -t mangle
|
||||
$IPTABLES -t mangle -A Cid37084X26841.0 -d 22.22.22.0/24 -j RULE_6
|
||||
$IPTABLES -t mangle -A Cid37084X26841.0 -d 33.33.33.0/24 -j RULE_6
|
||||
$IPTABLES -t mangle -A RULE_6 -j LOG --log-level info --log-prefix "RULE 6 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_6 -j MARK --set-mark 8
|
||||
$IPTABLES -t mangle -A RULE_6 -j LOG --log-level info --log-prefix "RULE 6 -- CONTINUE "
|
||||
$IPTABLES -t mangle -A RULE_6 -j MARK --set-mark 8
|
||||
|
||||
# ================ Table 'filter', rule set Policy
|
||||
#
|
||||
@ -439,7 +435,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:12:13 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 19:33:00 2011 by vadim"
|
||||
check_tools
|
||||
prolog_commands
|
||||
check_run_time_address_table_files
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:13:40 2011 PDT by vadim
|
||||
# Generated Tue May 3 19:34:11 2011 PDT by vadim
|
||||
#
|
||||
# files: * rc.firewall.local /etc/rc.d//rc.firewall.local
|
||||
#
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user