onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-03-18 17:27:20 +01:00
Code Issues Releases Wiki Activity

see #2367 upgraded unit test files and made sure tests pass. Some chain names have changed after this change but overall script structure has improved. Still need to add more tests for various combinations of Classify, Tag and Route options with different actions

Browse Source
This commit is contained in:
Vadim Kurland 2011-05-03 20:43:38 -07:00
parent 48e32aef5d
commit 49e65c2775
12 changed files with 8135 additions and 7960 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
src/iptlib/PolicyCompiler_ipt.cpp
View File

@ -275,12 +275,13 @@ string PolicyCompiler_ipt::getNewChainName(PolicyRule *rule,
str << iface_name.substr(0,n) << "_"; str << iface_name.substr(0,n) << "_";
} }
switch (rule->getDirection()) { switch (rule->getDirection())
{
case PolicyRule::Inbound: str << "In_"; break; case PolicyRule::Inbound: str << "In_"; break;
case PolicyRule::Outbound: str << "Out_"; break; case PolicyRule::Outbound: str << "Out_"; break;
default: ; default: ;
} }
int pos=rule->getPosition(); int pos = rule->getPosition();
string ruleset_name = getRuleSetName(); string ruleset_name = getRuleSetName();
@ -294,7 +295,7 @@ string PolicyCompiler_ipt::getNewChainName(PolicyRule *rule,
else // special case: position == -1 else // special case: position == -1
str << "000"; str << "000";
string suffix=rule->getStr("subrule_suffix"); string suffix = rule->getStr("subrule_suffix");
if (!suffix.empty()) str << "_" << suffix; if (!suffix.empty()) str << "_" << suffix;
chain_no++; chain_no++;
@ -4275,8 +4276,6 @@ void PolicyCompiler_ipt::compile()
add( new Route("process route rules")); add( new Route("process route rules"));
add( new storeAction("store original action of this rule")); add( new storeAction("store original action of this rule"));
//add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
add( new Logging1("check global logging override option")); add( new Logging1("check global logging override option"));
add( new expandGroupsInItf("expand groups in Interface" )); add( new expandGroupsInItf("expand groups in Interface" ));
@ -4363,6 +4362,14 @@ void PolicyCompiler_ipt::compile()
add( new swapMultiAddressObjectsInDst( add( new swapMultiAddressObjectsInDst(
" swap MultiAddress -> MultiAddressRunTime in Dst")); " swap MultiAddress -> MultiAddressRunTime in Dst"));
// #2367
add( new splitTagClassifyOrRouteIfAction(
"split rules with options Tag, Classify or Route when action "
"is not Continue" ) );
add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
add( new accounting("Accounting") );
add( new splitIfSrcAny("split rule if src is any") ); add( new splitIfSrcAny("split rule if src is any") );
if (my_table == "mangle") if (my_table == "mangle")
@ -4374,8 +4381,6 @@ void PolicyCompiler_ipt::compile()
add( new setChainPostroutingForTag("chain POSTROUTING for Tag")); add( new setChainPostroutingForTag("chain POSTROUTING for Tag"));
add( new processMultiAddressObjectsInSrc( add( new processMultiAddressObjectsInSrc(
"process MultiAddress objects in Src")); "process MultiAddress objects in Src"));
add( new processMultiAddressObjectsInDst( add( new processMultiAddressObjectsInDst(
@ -4487,6 +4492,8 @@ void PolicyCompiler_ipt::compile()
add( new optimize1("optimization 1, pass 2")); add( new optimize1("optimization 1, pass 2"));
add( new optimize1("optimization 1, pass 3")); add( new optimize1("optimization 1, pass 3"));
add( new groupServicesByProtocol("split on services")); add( new groupServicesByProtocol("split on services"));
add( new separateTCPWithFlags("split on TCP services with flags")); add( new separateTCPWithFlags("split on TCP services with flags"));
add( new verifyCustomServices("verify custom services")); add( new verifyCustomServices("verify custom services"));
@ -4500,16 +4507,14 @@ void PolicyCompiler_ipt::compile()
add( new optimize2("optimization 2") ); add( new optimize2("optimization 2") );
// add( new splitTagClassifyOrRouteIfAction(
// "split rules with options Tag, Classify or Route when action "
// "is not Continue" ) );
// add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
// add( new accounting("Accounting") ); // add( new accounting("Accounting") );
// add( new prepareForMultiport("prepare for multiport") );
add( new splitTagClassifyOrRouteIfAction(
"split rules with options Tag, Classify or Route when action "
"is not Continue" ) );
add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
add( new accounting("Accounting") );
add( new prepareForMultiport("prepare for multiport") ); add( new prepareForMultiport("prepare for multiport") );
add( new ConvertToAtomicForAddresses( add( new ConvertToAtomicForAddresses(

2
test/ipt/cluster-tests.fwb
View File

@ -1,6 +1,6 @@
<?xml version="1.0" encoding="utf-8"?> <?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd"> <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="18" lastModified="1272731422" id="root"> <FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="19" lastModified="1272731422" id="root">
<Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True"> <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
<AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/> <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
<AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/> <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>

14
test/ipt/firewall1.fw.orig
View File

@ -2,9 +2,9 @@
# #
# This is automatically generated file. DO NOT MODIFY ! # This is automatically generated file. DO NOT MODIFY !
# #
# Firewall Builder fwb_ipt v4.2.0.3529 # Firewall Builder fwb_ipt v4.2.1.ma_1
# #
# Generated Tue Apr 19 14:11:00 2011 PDT by vadim # Generated Tue May 3 19:32:00 2011 PDT by vadim
# #
# files: * firewall1.fw /etc/fw/firewall1.fw # files: * firewall1.fw /etc/fw/firewall1.fw
# #
@ -682,14 +682,10 @@ script_body() {
# #
echo "Rule 11 (global)" echo "Rule 11 (global)"
# #
$IPTABLES -N Out_RULE_11
$IPTABLES -A Out_RULE_11 -j RETURN
$IPTABLES -A OUTPUT -j Out_RULE_11
$IPTABLES -N In_RULE_11
$IPTABLES -A In_RULE_11 -j RETURN
$IPTABLES -A INPUT -j In_RULE_11
$IPTABLES -N RULE_11 $IPTABLES -N RULE_11
$IPTABLES -A RULE_11 -j RETURN $IPTABLES -A RULE_11 -j RETURN
$IPTABLES -A OUTPUT -j RULE_11
$IPTABLES -A INPUT -j RULE_11
$IPTABLES -A FORWARD -j RULE_11 $IPTABLES -A FORWARD -j RULE_11
# #
# Rule 12 (global) # Rule 12 (global)
@ -1252,7 +1248,7 @@ test -z "$cmd" && {
case "$cmd" in case "$cmd" in
start) start)
log "Activating firewall script generated Tue Apr 19 14:11:00 2011 by vadim" log "Activating firewall script generated Tue May 3 19:32:00 2011 by vadim"
check_tools check_tools
check_run_time_address_table_files check_run_time_address_table_files

18
test/ipt/firewall2-6.fw.orig
View File

@ -2,9 +2,9 @@
# #
# This is automatically generated file. DO NOT MODIFY ! # This is automatically generated file. DO NOT MODIFY !
# #
# Firewall Builder fwb_ipt v4.2.0.3529 # Firewall Builder fwb_ipt v4.2.1.ma_1
# #
# Generated Tue Apr 19 14:11:39 2011 PDT by vadim # Generated Tue May 3 19:32:31 2011 PDT by vadim
# #
# files: * firewall2-6.fw /etc/fw/firewall2-6.fw # files: * firewall2-6.fw /etc/fw/firewall2-6.fw
# #
@ -19,12 +19,12 @@
# firewall2-6:NAT:10: error: Can not use inbound interface specification with rules that translate source because iptables does not allow "-i" in POSTROUTING chain # firewall2-6:NAT:10: error: Can not use inbound interface specification with rules that translate source because iptables does not allow "-i" in POSTROUTING chain
# firewall2-6:NAT:11: error: Can not use inbound interface specification with rules that translate source because iptables does not allow "-i" in POSTROUTING chain # firewall2-6:NAT:11: error: Can not use inbound interface specification with rules that translate source because iptables does not allow "-i" in POSTROUTING chain
# firewall2-6:NAT:12: error: Can not use inbound interface specification with rules that translate source because iptables does not allow "-i" in POSTROUTING chain # firewall2-6:NAT:12: error: Can not use inbound interface specification with rules that translate source because iptables does not allow "-i" in POSTROUTING chain
# firewall2-6:NAT:17: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain # firewall2-6:NAT:17: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
# firewall2-6:NAT:17: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain # firewall2-6:NAT:17: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
# firewall2-6:NAT:18: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain # firewall2-6:NAT:18: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
# firewall2-6:NAT:19: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain # firewall2-6:NAT:19: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
# firewall2-6:NAT:20: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain # firewall2-6:NAT:20: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
# firewall2-6:NAT:21: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain # firewall2-6:NAT:21: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
# firewall2-6::: warning: Can not add virtual address 22.22.22.0 (object external_net) # firewall2-6::: warning: Can not add virtual address 22.22.22.0 (object external_net)
@ -482,7 +482,7 @@ test -z "$cmd" && {
case "$cmd" in case "$cmd" in
start) start)
log "Activating firewall script generated Tue Apr 19 14:11:39 2011 by vadim" log "Activating firewall script generated Tue May 3 19:32:31 2011 by vadim"
check_tools check_tools
check_run_time_address_table_files check_run_time_address_table_files

161
test/ipt/firewall37-1.fw.orig
View File

@ -2,9 +2,9 @@
# #
# This is automatically generated file. DO NOT MODIFY ! # This is automatically generated file. DO NOT MODIFY !
# #
# Firewall Builder fwb_ipt v4.2.0.3529 # Firewall Builder fwb_ipt v4.2.1.ma_1
# #
# Generated Tue Apr 19 14:12:07 2011 PDT by vadim # Generated Tue May 3 20:22:31 2011 PDT by vadim
# #
# files: * firewall37-1.fw /etc/fw/firewall37-1.fw # files: * firewall37-1.fw /etc/fw/firewall37-1.fw
# #
@ -329,7 +329,7 @@ script_body() {
$IPTABLES -N rule27_branch -t mangle $IPTABLES -N rule27_branch -t mangle
$IPTABLES -N Cid45AB5C2E25451.0 -t mangle $IPTABLES -N Cid45AB5C2E25451.0 -t mangle
$IPTABLES -t mangle -A rule27_branch -p tcp -m tcp --tcp-flags ALL ACK -j Cid45AB5C2E25451.0 $IPTABLES -t mangle -A rule27_branch -p tcp -m tcp --tcp-flags ALL ACK -j Cid45AB5C2E25451.0
$IPTABLES -t mangle -A Cid45AB5C2E25451.0 -j CLASSIFY --set-class 1:16 $IPTABLES -t mangle -A Cid45AB5C2E25451.0 -j CLASSIFY --set-class 1:16
$IPTABLES -t mangle -A Cid45AB5C2E25451.0 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5C2E25451.0 -j ACCEPT
# #
# Rule rule27_branch 1 (global) # Rule rule27_branch 1 (global)
@ -349,20 +349,11 @@ script_body() {
# terminating target # terminating target
$IPTABLES -N Cid45AB5AAD25451.0 -t mangle $IPTABLES -N Cid45AB5AAD25451.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid45AB5AAD25451.0 $IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid45AB5AAD25451.0
$IPTABLES -t mangle -A Cid45AB5AAD25451.0 -j MARK --set-mark 16 $IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid45AB5AAD25451.0
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid45AB5AAD25451.0
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5AAD25451.0
$IPTABLES -t mangle -A Cid45AB5AAD25451.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid45AB5AAD25451.0 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5AAD25451.0 -j ACCEPT
$IPTABLES -N Cid45AB5AAD25451.1 -t mangle
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid45AB5AAD25451.1
$IPTABLES -t mangle -A Cid45AB5AAD25451.1 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid45AB5AAD25451.1 -j ACCEPT
$IPTABLES -N Cid45AB5AAD25451.2 -t mangle
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid45AB5AAD25451.2
$IPTABLES -t mangle -A Cid45AB5AAD25451.2 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid45AB5AAD25451.2 -j ACCEPT
$IPTABLES -N Cid45AB5AAD25451.3 -t mangle
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5AAD25451.3
$IPTABLES -t mangle -A Cid45AB5AAD25451.3 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid45AB5AAD25451.3 -j ACCEPT
# #
# Rule 1 (global) # Rule 1 (global)
# #
@ -374,8 +365,8 @@ script_body() {
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_1 $IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_1
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_1 $IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_1
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_1 $IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_1
$IPTABLES -t mangle -A RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- TAG " $IPTABLES -t mangle -A RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- ACCEPT "
$IPTABLES -t mangle -A RULE_1 -j MARK --set-mark 16 $IPTABLES -t mangle -A RULE_1 -j MARK --set-mark 16
$IPTABLES -t mangle -A RULE_1 -j ACCEPT $IPTABLES -t mangle -A RULE_1 -j ACCEPT
# #
# Rule 2 (global) # Rule 2 (global)
@ -392,8 +383,8 @@ script_body() {
$IPTABLES -t mangle -A Cid45AB5AC525451.0 -s 192.168.2.0/24 -j RETURN $IPTABLES -t mangle -A Cid45AB5AC525451.0 -s 192.168.2.0/24 -j RETURN
$IPTABLES -N RULE_2_3 -t mangle $IPTABLES -N RULE_2_3 -t mangle
$IPTABLES -t mangle -A Cid45AB5AC525451.0 -j RULE_2_3 $IPTABLES -t mangle -A Cid45AB5AC525451.0 -j RULE_2_3
$IPTABLES -t mangle -A RULE_2_3 -j LOG --log-level info --log-prefix "RULE 2 -- TAG " $IPTABLES -t mangle -A RULE_2_3 -j LOG --log-level info --log-prefix "RULE 2 -- ACCEPT "
$IPTABLES -t mangle -A RULE_2_3 -j MARK --set-mark 16 $IPTABLES -t mangle -A RULE_2_3 -j MARK --set-mark 16
$IPTABLES -t mangle -A RULE_2_3 -j ACCEPT $IPTABLES -t mangle -A RULE_2_3 -j ACCEPT
# #
# Rule 3 (eth1) # Rule 3 (eth1)
@ -403,12 +394,9 @@ script_body() {
# terminating target # terminating target
$IPTABLES -N Cid45AB5AD225451.0 -t mangle $IPTABLES -N Cid45AB5AD225451.0 -t mangle
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid45AB5AD225451.0 $IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid45AB5AD225451.0
$IPTABLES -t mangle -A Cid45AB5AD225451.0 -j MARK --set-mark 16 $IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid45AB5AD225451.0
$IPTABLES -t mangle -A Cid45AB5AD225451.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid45AB5AD225451.0 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5AD225451.0 -j ACCEPT
$IPTABLES -N Cid45AB5AD225451.1 -t mangle
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid45AB5AD225451.1
$IPTABLES -t mangle -A Cid45AB5AD225451.1 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid45AB5AD225451.1 -j ACCEPT
# #
# Rule 4 (eth1) # Rule 4 (eth1)
# #
@ -417,34 +405,25 @@ script_body() {
# temrinating target # temrinating target
$IPTABLES -N Cid45AB5ADE25451.0 -t mangle $IPTABLES -N Cid45AB5ADE25451.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid45AB5ADE25451.0 $IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid45AB5ADE25451.0
$IPTABLES -t mangle -A Cid45AB5ADE25451.0 -j MARK --set-mark 16 $IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid45AB5ADE25451.0
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid45AB5ADE25451.0
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid45AB5ADE25451.0
$IPTABLES -t mangle -A Cid45AB5ADE25451.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid45AB5ADE25451.0 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5ADE25451.0 -j ACCEPT
$IPTABLES -N Cid45AB5ADE25451.1 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid45AB5ADE25451.1
$IPTABLES -t mangle -A Cid45AB5ADE25451.1 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid45AB5ADE25451.1 -j ACCEPT
$IPTABLES -N Cid45AB5ADE25451.2 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid45AB5ADE25451.2
$IPTABLES -t mangle -A Cid45AB5ADE25451.2 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid45AB5ADE25451.2 -j ACCEPT
$IPTABLES -N Cid45AB5ADE25451.3 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid45AB5ADE25451.3
$IPTABLES -t mangle -A Cid45AB5ADE25451.3 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid45AB5ADE25451.3 -j ACCEPT
# #
# Rule 5 (global) # Rule 5 (global)
# #
echo "Rule 5 (global)" echo "Rule 5 (global)"
# #
# terminating and CONNMARK # terminating and CONNMARK
$IPTABLES -N RULE_5 -t mangle $IPTABLES -N Cid45AB5AEA25451.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j RULE_5 $IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid45AB5AEA25451.0
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_5 $IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid45AB5AEA25451.0
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_5 $IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid45AB5AEA25451.0
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_5 $IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5AEA25451.0
$IPTABLES -t mangle -A RULE_5 -j MARK --set-mark 10 $IPTABLES -t mangle -A Cid45AB5AEA25451.0 -j MARK --set-mark 10
$IPTABLES -t mangle -A RULE_5 -j CONNMARK --save-mark $IPTABLES -t mangle -A Cid45AB5AEA25451.0 -j CONNMARK --save-mark
$IPTABLES -t mangle -A RULE_5 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5AEA25451.0 -j ACCEPT
# #
# Rule 6 (global) # Rule 6 (global)
# #
@ -456,8 +435,8 @@ script_body() {
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_6 $IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_6
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_6 $IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_6
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_6 $IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_6
$IPTABLES -t mangle -A RULE_6 -j LOG --log-level info --log-prefix "RULE 6 -- TAG " $IPTABLES -t mangle -A RULE_6 -j LOG --log-level info --log-prefix "RULE 6 -- ACCEPT "
$IPTABLES -t mangle -A RULE_6 -j MARK --set-mark 10 $IPTABLES -t mangle -A RULE_6 -j MARK --set-mark 10
$IPTABLES -t mangle -A RULE_6 -j CONNMARK --save-mark $IPTABLES -t mangle -A RULE_6 -j CONNMARK --save-mark
$IPTABLES -t mangle -A RULE_6 -j ACCEPT $IPTABLES -t mangle -A RULE_6 -j ACCEPT
# #
@ -473,38 +452,38 @@ script_body() {
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5B0225451.0 $IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5B0225451.0
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -s 192.168.1.0/24 -j RETURN $IPTABLES -t mangle -A Cid45AB5B0225451.0 -s 192.168.1.0/24 -j RETURN
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -s 192.168.2.0/24 -j RETURN $IPTABLES -t mangle -A Cid45AB5B0225451.0 -s 192.168.2.0/24 -j RETURN
$IPTABLES -N RULE_7 -t mangle $IPTABLES -N RULE_7_3 -t mangle
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -j RULE_7 $IPTABLES -t mangle -A Cid45AB5B0225451.0 -j RULE_7_3
$IPTABLES -t mangle -A RULE_7 -j LOG --log-level info --log-prefix "RULE 7 -- TAG " $IPTABLES -t mangle -A RULE_7_3 -j LOG --log-level info --log-prefix "RULE 7 -- ACCEPT "
$IPTABLES -t mangle -A RULE_7 -j MARK --set-mark 10 $IPTABLES -t mangle -A RULE_7_3 -j MARK --set-mark 10
$IPTABLES -t mangle -A RULE_7 -j CONNMARK --save-mark $IPTABLES -t mangle -A RULE_7_3 -j CONNMARK --save-mark
$IPTABLES -t mangle -A RULE_7 -j ACCEPT $IPTABLES -t mangle -A RULE_7_3 -j ACCEPT
# #
# Rule 8 (eth1) # Rule 8 (eth1)
# #
echo "Rule 8 (eth1)" echo "Rule 8 (eth1)"
# #
# terminating and CONNMARK # terminating and CONNMARK
$IPTABLES -N In_RULE_8 -t mangle $IPTABLES -N Cid45AB5B0F25451.0 -t mangle
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j In_RULE_8 $IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid45AB5B0F25451.0
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j In_RULE_8 $IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid45AB5B0F25451.0
$IPTABLES -t mangle -A In_RULE_8 -i eth1 -j MARK --set-mark 8 $IPTABLES -t mangle -A Cid45AB5B0F25451.0 -j MARK --set-mark 8
$IPTABLES -t mangle -A In_RULE_8 -i eth1 -j CONNMARK --save-mark $IPTABLES -t mangle -A Cid45AB5B0F25451.0 -j CONNMARK --save-mark
$IPTABLES -t mangle -A In_RULE_8 -i eth1 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5B0F25451.0 -j ACCEPT
# #
# Rule 9 (eth1) # Rule 9 (eth1)
# #
echo "Rule 9 (eth1)" echo "Rule 9 (eth1)"
# #
# terminating and CONNMARK # terminating and CONNMARK
$IPTABLES -N Out_RULE_9 -t mangle $IPTABLES -N Cid45AB5B1B25451.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Out_RULE_9 $IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid45AB5B1B25451.0
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Out_RULE_9 $IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid45AB5B1B25451.0
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Out_RULE_9 $IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid45AB5B1B25451.0
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Out_RULE_9 $IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid45AB5B1B25451.0
$IPTABLES -t mangle -A Out_RULE_9 -o eth1 -j MARK --set-mark 9 $IPTABLES -t mangle -A Cid45AB5B1B25451.0 -j MARK --set-mark 9
$IPTABLES -t mangle -A Out_RULE_9 -o eth1 -j CONNMARK --save-mark $IPTABLES -t mangle -A Cid45AB5B1B25451.0 -j CONNMARK --save-mark
$IPTABLES -t mangle -A Out_RULE_9 -o eth1 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5B1B25451.0 -j ACCEPT
# #
# Rule 11 (global) # Rule 11 (global)
# #
@ -516,7 +495,7 @@ script_body() {
# and pass control to it using -g # and pass control to it using -g
$IPTABLES -N Cid45AB5B9525451.0 -t mangle $IPTABLES -N Cid45AB5B9525451.0 -t mangle
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5B9525451.0 $IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5B9525451.0
$IPTABLES -t mangle -A Cid45AB5B9525451.0 -j CLASSIFY --set-class 1:10 $IPTABLES -t mangle -A Cid45AB5B9525451.0 -j CLASSIFY --set-class 1:10
$IPTABLES -t mangle -A Cid45AB5B9525451.0 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5B9525451.0 -j ACCEPT
# #
# Rule 12 (eth0) # Rule 12 (eth0)
@ -526,7 +505,7 @@ script_body() {
# second rule for bug #1618381 # second rule for bug #1618381
$IPTABLES -N Cid45AB5BA125451.0 -t mangle $IPTABLES -N Cid45AB5BA125451.0 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth0 -j Cid45AB5BA125451.0 $IPTABLES -t mangle -A POSTROUTING -o eth0 -j Cid45AB5BA125451.0
$IPTABLES -t mangle -A Cid45AB5BA125451.0 -j CLASSIFY --set-class 1:11 $IPTABLES -t mangle -A Cid45AB5BA125451.0 -j CLASSIFY --set-class 1:11
$IPTABLES -t mangle -A Cid45AB5BA125451.0 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5BA125451.0 -j ACCEPT
# #
# Rule 13 (global) # Rule 13 (global)
@ -538,7 +517,7 @@ script_body() {
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5BAD25451.0 $IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5BAD25451.0
$IPTABLES -t mangle -A Cid45AB5BAD25451.0 -s 192.168.1.0/24 -j RETURN $IPTABLES -t mangle -A Cid45AB5BAD25451.0 -s 192.168.1.0/24 -j RETURN
$IPTABLES -t mangle -A Cid45AB5BAD25451.0 -s 192.168.2.0/24 -j RETURN $IPTABLES -t mangle -A Cid45AB5BAD25451.0 -s 192.168.2.0/24 -j RETURN
$IPTABLES -t mangle -A Cid45AB5BAD25451.0 -j CLASSIFY --set-class 1:10 $IPTABLES -t mangle -A Cid45AB5BAD25451.0 -j CLASSIFY --set-class 1:10
$IPTABLES -t mangle -A Cid45AB5BAD25451.0 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5BAD25451.0 -j ACCEPT
# #
# Rule 14 (global) # Rule 14 (global)
@ -551,7 +530,7 @@ script_body() {
$IPTABLES -t mangle -A POSTROUTING -p tcp -m tcp --dport 80 -j Cid45AB5BBA25451.0 $IPTABLES -t mangle -A POSTROUTING -p tcp -m tcp --dport 80 -j Cid45AB5BBA25451.0
$IPTABLES -t mangle -A Cid45AB5BBA25451.0 -s 192.168.1.0/24 -j RETURN $IPTABLES -t mangle -A Cid45AB5BBA25451.0 -s 192.168.1.0/24 -j RETURN
$IPTABLES -t mangle -A Cid45AB5BBA25451.0 -s 192.168.2.0/24 -j RETURN $IPTABLES -t mangle -A Cid45AB5BBA25451.0 -s 192.168.2.0/24 -j RETURN
$IPTABLES -t mangle -A Cid45AB5BBA25451.0 -j CLASSIFY --set-class 1:10 $IPTABLES -t mangle -A Cid45AB5BBA25451.0 -j CLASSIFY --set-class 1:10
$IPTABLES -t mangle -A Cid45AB5BBA25451.0 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5BBA25451.0 -j ACCEPT
# #
# Rule 15 (eth0) # Rule 15 (eth0)
@ -564,16 +543,10 @@ script_body() {
# of that # of that
$IPTABLES -N Cid45AB5BC825451.0 -t mangle $IPTABLES -N Cid45AB5BC825451.0 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp --dport 10000:11000 -j Cid45AB5BC825451.0 $IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp --dport 10000:11000 -j Cid45AB5BC825451.0
$IPTABLES -t mangle -A Cid45AB5BC825451.0 -j CLASSIFY --set-class 1:11 $IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid45AB5BC825451.0
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid45AB5BC825451.0
$IPTABLES -t mangle -A Cid45AB5BC825451.0 -j CLASSIFY --set-class 1:11
$IPTABLES -t mangle -A Cid45AB5BC825451.0 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5BC825451.0 -j ACCEPT
$IPTABLES -N Cid45AB5BC825451.1 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid45AB5BC825451.1
$IPTABLES -t mangle -A Cid45AB5BC825451.1 -j CLASSIFY --set-class 1:11
$IPTABLES -t mangle -A Cid45AB5BC825451.1 -j ACCEPT
$IPTABLES -N Cid45AB5BC825451.2 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid45AB5BC825451.2
$IPTABLES -t mangle -A Cid45AB5BC825451.2 -j CLASSIFY --set-class 1:11
$IPTABLES -t mangle -A Cid45AB5BC825451.2 -j ACCEPT
# #
# Rule 16 (global) # Rule 16 (global)
# #
@ -585,7 +558,7 @@ script_body() {
# and pass control to it using -g # and pass control to it using -g
$IPTABLES -N Cid45AB5BD525451.0 -t mangle $IPTABLES -N Cid45AB5BD525451.0 -t mangle
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5BD525451.0 $IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5BD525451.0
$IPTABLES -t mangle -A Cid45AB5BD525451.0 -j CLASSIFY --set-class 1:10 $IPTABLES -t mangle -A Cid45AB5BD525451.0 -j CLASSIFY --set-class 1:10
$IPTABLES -t mangle -A Cid45AB5BD525451.0 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5BD525451.0 -j ACCEPT
# #
# Rule 17 (eth0) # Rule 17 (eth0)
@ -595,7 +568,7 @@ script_body() {
# second rule for bug #1618381 # second rule for bug #1618381
$IPTABLES -N Cid45AB5BE125451.0 -t mangle $IPTABLES -N Cid45AB5BE125451.0 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth0 -j Cid45AB5BE125451.0 $IPTABLES -t mangle -A POSTROUTING -o eth0 -j Cid45AB5BE125451.0
$IPTABLES -t mangle -A Cid45AB5BE125451.0 -j CLASSIFY --set-class 1:11 $IPTABLES -t mangle -A Cid45AB5BE125451.0 -j CLASSIFY --set-class 1:11
$IPTABLES -t mangle -A Cid45AB5BE125451.0 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5BE125451.0 -j ACCEPT
# #
# Rule 18 (eth0) # Rule 18 (eth0)
@ -604,8 +577,8 @@ script_body() {
# #
$IPTABLES -N Out_RULE_18 -t mangle $IPTABLES -N Out_RULE_18 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth0 -s 192.168.1.0/24 -j Out_RULE_18 $IPTABLES -t mangle -A POSTROUTING -o eth0 -s 192.168.1.0/24 -j Out_RULE_18
$IPTABLES -t mangle -A Out_RULE_18 -j LOG --log-level info --log-prefix "RULE 18 -- CLASSIFY " $IPTABLES -t mangle -A Out_RULE_18 -j LOG --log-level info --log-prefix "RULE 18 -- ACCEPT "
$IPTABLES -t mangle -A Out_RULE_18 -j CLASSIFY --set-class 1:11 $IPTABLES -t mangle -A Out_RULE_18 -j CLASSIFY --set-class 1:11
$IPTABLES -t mangle -A Out_RULE_18 -j ACCEPT $IPTABLES -t mangle -A Out_RULE_18 -j ACCEPT
# #
# Rule 19 (global) # Rule 19 (global)
@ -617,7 +590,7 @@ script_body() {
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5BF925451.0 $IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5BF925451.0
$IPTABLES -t mangle -A Cid45AB5BF925451.0 -s 192.168.1.0/24 -j RETURN $IPTABLES -t mangle -A Cid45AB5BF925451.0 -s 192.168.1.0/24 -j RETURN
$IPTABLES -t mangle -A Cid45AB5BF925451.0 -s 192.168.2.0/24 -j RETURN $IPTABLES -t mangle -A Cid45AB5BF925451.0 -s 192.168.2.0/24 -j RETURN
$IPTABLES -t mangle -A Cid45AB5BF925451.0 -j CLASSIFY --set-class 1:10 $IPTABLES -t mangle -A Cid45AB5BF925451.0 -j CLASSIFY --set-class 1:10
$IPTABLES -t mangle -A Cid45AB5BF925451.0 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5BF925451.0 -j ACCEPT
# #
# Rule 20 (global) # Rule 20 (global)
@ -630,7 +603,7 @@ script_body() {
$IPTABLES -t mangle -A POSTROUTING -p tcp -m tcp --dport 80 -j Cid45AB5C0625451.0 $IPTABLES -t mangle -A POSTROUTING -p tcp -m tcp --dport 80 -j Cid45AB5C0625451.0
$IPTABLES -t mangle -A Cid45AB5C0625451.0 -s 192.168.1.0/24 -j RETURN $IPTABLES -t mangle -A Cid45AB5C0625451.0 -s 192.168.1.0/24 -j RETURN
$IPTABLES -t mangle -A Cid45AB5C0625451.0 -s 192.168.2.0/24 -j RETURN $IPTABLES -t mangle -A Cid45AB5C0625451.0 -s 192.168.2.0/24 -j RETURN
$IPTABLES -t mangle -A Cid45AB5C0625451.0 -j CLASSIFY --set-class 1:10 $IPTABLES -t mangle -A Cid45AB5C0625451.0 -j CLASSIFY --set-class 1:10
$IPTABLES -t mangle -A Cid45AB5C0625451.0 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5C0625451.0 -j ACCEPT
# #
# Rule 21 (eth0) # Rule 21 (eth0)
@ -643,16 +616,10 @@ script_body() {
# of that # of that
$IPTABLES -N Cid45AB5C1425451.0 -t mangle $IPTABLES -N Cid45AB5C1425451.0 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp --dport 10000:11000 -j Cid45AB5C1425451.0 $IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp --dport 10000:11000 -j Cid45AB5C1425451.0
$IPTABLES -t mangle -A Cid45AB5C1425451.0 -j CLASSIFY --set-class 1:11 $IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid45AB5C1425451.0
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid45AB5C1425451.0
$IPTABLES -t mangle -A Cid45AB5C1425451.0 -j CLASSIFY --set-class 1:11
$IPTABLES -t mangle -A Cid45AB5C1425451.0 -j ACCEPT $IPTABLES -t mangle -A Cid45AB5C1425451.0 -j ACCEPT
$IPTABLES -N Cid45AB5C1425451.1 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid45AB5C1425451.1
$IPTABLES -t mangle -A Cid45AB5C1425451.1 -j CLASSIFY --set-class 1:11
$IPTABLES -t mangle -A Cid45AB5C1425451.1 -j ACCEPT
$IPTABLES -N Cid45AB5C1425451.2 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid45AB5C1425451.2
$IPTABLES -t mangle -A Cid45AB5C1425451.2 -j CLASSIFY --set-class 1:11
$IPTABLES -t mangle -A Cid45AB5C1425451.2 -j ACCEPT
# #
# Rule 22 (global) # Rule 22 (global)
# #
@ -769,7 +736,7 @@ test -z "$cmd" && {
case "$cmd" in case "$cmd" in
start) start)
log "Activating firewall script generated Tue Apr 19 14:12:07 2011 by vadim" log "Activating firewall script generated Tue May 3 20:22:31 2011 by vadim"
check_tools check_tools
prolog_commands prolog_commands
check_run_time_address_table_files check_run_time_address_table_files

299
test/ipt/firewall37.fw.orig
View File

@ -2,9 +2,9 @@
# #
# This is automatically generated file. DO NOT MODIFY ! # This is automatically generated file. DO NOT MODIFY !
# #
# Firewall Builder fwb_ipt v4.2.0.3529 # Firewall Builder fwb_ipt v4.2.1.ma_1
# #
# Generated Tue Apr 19 14:12:04 2011 PDT by vadim # Generated Tue May 3 20:28:13 2011 PDT by vadim
# #
# files: * firewall37.fw /etc/fw/firewall37.fw # files: * firewall37.fw /etc/fw/firewall37.fw
# #
@ -14,11 +14,11 @@
# normal script mode (not using iptables-restore) # normal script mode (not using iptables-restore)
# firewall37:mangle_rules:4: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
# firewall37:mangle_rules:4: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
# firewall37:mangle_rules:7: warning: Empty group or address table object 'empty Ogroup' # firewall37:mangle_rules:7: warning: Empty group or address table object 'empty Ogroup'
# firewall37:mangle_rules:7: warning: After removal of all empty groups and address table objects rule element Src becomes 'any' in the rule mangle_rules 7 (global) # firewall37:mangle_rules:7: warning: After removal of all empty groups and address table objects rule element Src becomes 'any' in the rule mangle_rules 7 (global)
# Dropping rule mangle_rules 7 (global) because option 'Ignore rules with empty groups' is in effect # Dropping rule mangle_rules 7 (global) because option 'Ignore rules with empty groups' is in effect
# firewall37:mangle_rules:4: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
# firewall37:mangle_rules:4: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
# firewall37:mangle_rules:13: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode # firewall37:mangle_rules:13: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
@ -334,14 +334,14 @@ script_body() {
$IPTABLES -N mymark -t mangle $IPTABLES -N mymark -t mangle
$IPTABLES -N Cid29866X28575.0 -t mangle $IPTABLES -N Cid29866X28575.0 -t mangle
$IPTABLES -t mangle -A mymark -d 192.168.2.0/24 -m state --state NEW -j Cid29866X28575.0 $IPTABLES -t mangle -A mymark -d 192.168.2.0/24 -m state --state NEW -j Cid29866X28575.0
$IPTABLES -t mangle -A Cid29866X28575.0 -j MARK --set-mark 16 $IPTABLES -t mangle -A Cid29866X28575.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid29866X28575.0 -j ACCEPT $IPTABLES -t mangle -A Cid29866X28575.0 -j ACCEPT
# #
# Rule mymark 1 (global) # Rule mymark 1 (global)
# #
echo "Rule mymark 1 (global)" echo "Rule mymark 1 (global)"
# #
$IPTABLES -t mangle -A mymark -j MARK --set-mark 2 $IPTABLES -t mangle -A mymark -j MARK --set-mark 2
$IPTABLES -t mangle -A mymark -j ACCEPT $IPTABLES -t mangle -A mymark -j ACCEPT
# ================ Table 'mangle', rule set Policy # ================ Table 'mangle', rule set Policy
# #
@ -351,20 +351,11 @@ script_body() {
# #
$IPTABLES -N Cid43BBA6A09745.0 -t mangle $IPTABLES -N Cid43BBA6A09745.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid43BBA6A09745.0 $IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid43BBA6A09745.0
$IPTABLES -t mangle -A Cid43BBA6A09745.0 -j MARK --set-mark 16 $IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid43BBA6A09745.0
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid43BBA6A09745.0
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid43BBA6A09745.0
$IPTABLES -t mangle -A Cid43BBA6A09745.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid43BBA6A09745.0 -j ACCEPT $IPTABLES -t mangle -A Cid43BBA6A09745.0 -j ACCEPT
$IPTABLES -N Cid43BBA6A09745.1 -t mangle
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid43BBA6A09745.1
$IPTABLES -t mangle -A Cid43BBA6A09745.1 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid43BBA6A09745.1 -j ACCEPT
$IPTABLES -N Cid43BBA6A09745.2 -t mangle
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid43BBA6A09745.2
$IPTABLES -t mangle -A Cid43BBA6A09745.2 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid43BBA6A09745.2 -j ACCEPT
$IPTABLES -N Cid43BBA6A09745.3 -t mangle
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid43BBA6A09745.3
$IPTABLES -t mangle -A Cid43BBA6A09745.3 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid43BBA6A09745.3 -j ACCEPT
# #
# Rule 1 (global) # Rule 1 (global)
# #
@ -375,8 +366,8 @@ script_body() {
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_1 $IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_1
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_1 $IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_1
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_1 $IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_1
$IPTABLES -t mangle -A RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- TAG " $IPTABLES -t mangle -A RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- ACCEPT "
$IPTABLES -t mangle -A RULE_1 -j MARK --set-mark 16 $IPTABLES -t mangle -A RULE_1 -j MARK --set-mark 16
$IPTABLES -t mangle -A RULE_1 -j ACCEPT $IPTABLES -t mangle -A RULE_1 -j ACCEPT
# #
# Rule 2 (global) # Rule 2 (global)
@ -385,12 +376,9 @@ script_body() {
# #
$IPTABLES -N Cid483502D710047.0 -t mangle $IPTABLES -N Cid483502D710047.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid483502D710047.0 $IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid483502D710047.0
$IPTABLES -t mangle -A Cid483502D710047.0 -j MARK --set-mark 16 $IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid483502D710047.0
$IPTABLES -t mangle -A Cid483502D710047.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid483502D710047.0 -j ACCEPT $IPTABLES -t mangle -A Cid483502D710047.0 -j ACCEPT
$IPTABLES -N Cid483502D710047.1 -t mangle
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid483502D710047.1
$IPTABLES -t mangle -A Cid483502D710047.1 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid483502D710047.1 -j ACCEPT
# #
# Rule 3 (eth1) # Rule 3 (eth1)
# #
@ -398,12 +386,9 @@ script_body() {
# #
$IPTABLES -N Cid30009X2275.0 -t mangle $IPTABLES -N Cid30009X2275.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid30009X2275.0 $IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid30009X2275.0
$IPTABLES -t mangle -A Cid30009X2275.0 -j MARK --set-mark 16 $IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid30009X2275.0
$IPTABLES -t mangle -A Cid30009X2275.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid30009X2275.0 -j ACCEPT $IPTABLES -t mangle -A Cid30009X2275.0 -j ACCEPT
$IPTABLES -N Cid30009X2275.1 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid30009X2275.1
$IPTABLES -t mangle -A Cid30009X2275.1 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid30009X2275.1 -j ACCEPT
# #
# Rule 4 (global) # Rule 4 (global)
# #
@ -412,39 +397,33 @@ script_body() {
$IPTABLES -N RULE_4 -t mangle $IPTABLES -N RULE_4 -t mangle
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j RULE_4 $IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j RULE_4
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_4 $IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_4
$IPTABLES -t mangle -A RULE_4 -j LOG --log-level info --log-prefix "RULE 4 -- TAG " $IPTABLES -t mangle -A RULE_4 -j LOG --log-level info --log-prefix "RULE 4 -- ACCEPT "
$IPTABLES -t mangle -A RULE_4 -j MARK --set-mark 16 $IPTABLES -t mangle -A RULE_4 -j MARK --set-mark 16
$IPTABLES -t mangle -A RULE_4 -j ACCEPT $IPTABLES -t mangle -A RULE_4 -j ACCEPT
# #
# Rule 5 (eth1) # Rule 5 (eth1)
# #
echo "Rule 5 (eth1)" echo "Rule 5 (eth1)"
# #
$IPTABLES -N Cid43501X5007.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -m state --state NEW -j Cid43501X5007.0
$IPTABLES -N Cid43501X5007.1 -t mangle $IPTABLES -N Cid43501X5007.1 -t mangle
$IPTABLES -t mangle -A Cid43501X5007.0 -p 50 -j Cid43501X5007.1 $IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -m state --state NEW -j Cid43501X5007.1
$IPTABLES -t mangle -A Cid43501X5007.1 -j MARK --set-mark 16 $IPTABLES -N Cid43501X5007.0 -t mangle
$IPTABLES -t mangle -A Cid43501X5007.1 -j ACCEPT $IPTABLES -t mangle -A Cid43501X5007.1 -p 50 -j Cid43501X5007.0
$IPTABLES -N Cid43501X5007.2 -t mangle $IPTABLES -t mangle -A Cid43501X5007.1 -p ah -j Cid43501X5007.0
$IPTABLES -t mangle -A Cid43501X5007.0 -p ah -j Cid43501X5007.2 $IPTABLES -t mangle -A Cid43501X5007.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid43501X5007.2 -j MARK --set-mark 16 $IPTABLES -t mangle -A Cid43501X5007.0 -j ACCEPT
$IPTABLES -t mangle -A Cid43501X5007.2 -j ACCEPT
# #
# Rule 6 (eth1) # Rule 6 (eth1)
# #
echo "Rule 6 (eth1)" echo "Rule 6 (eth1)"
# #
$IPTABLES -N Cid43518X5007.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -m state --state NEW -j Cid43518X5007.0
$IPTABLES -N Cid43518X5007.1 -t mangle $IPTABLES -N Cid43518X5007.1 -t mangle
$IPTABLES -t mangle -A Cid43518X5007.0 -p 50 -j Cid43518X5007.1 $IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -m state --state NEW -j Cid43518X5007.1
$IPTABLES -t mangle -A Cid43518X5007.1 -j MARK --set-mark 16 $IPTABLES -N Cid43518X5007.0 -t mangle
$IPTABLES -t mangle -A Cid43518X5007.1 -j ACCEPT $IPTABLES -t mangle -A Cid43518X5007.1 -p 50 -j Cid43518X5007.0
$IPTABLES -N Cid43518X5007.2 -t mangle $IPTABLES -t mangle -A Cid43518X5007.1 -p ah -j Cid43518X5007.0
$IPTABLES -t mangle -A Cid43518X5007.0 -p ah -j Cid43518X5007.2 $IPTABLES -t mangle -A Cid43518X5007.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid43518X5007.2 -j MARK --set-mark 16 $IPTABLES -t mangle -A Cid43518X5007.0 -j ACCEPT
$IPTABLES -t mangle -A Cid43518X5007.2 -j ACCEPT
# #
# Rule 7 (eth1) # Rule 7 (eth1)
# #
@ -452,42 +431,33 @@ script_body() {
# #
$IPTABLES -N Cid43535X5007.0 -t mangle $IPTABLES -N Cid43535X5007.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid43535X5007.0 $IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid43535X5007.0
$IPTABLES -t mangle -A Cid43535X5007.0 -j MARK --set-mark 16 $IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid43535X5007.0
$IPTABLES -t mangle -A Cid43535X5007.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid43535X5007.0 -j ACCEPT $IPTABLES -t mangle -A Cid43535X5007.0 -j ACCEPT
$IPTABLES -N Cid43535X5007.1 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid43535X5007.1
$IPTABLES -t mangle -A Cid43535X5007.1 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid43535X5007.1 -j ACCEPT
# #
# Rule 8 (eth1) # Rule 8 (eth1)
# #
echo "Rule 8 (eth1)" echo "Rule 8 (eth1)"
# #
$IPTABLES -N Cid43554X5007.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -j Cid43554X5007.0
$IPTABLES -N Cid43554X5007.1 -t mangle $IPTABLES -N Cid43554X5007.1 -t mangle
$IPTABLES -t mangle -A Cid43554X5007.0 -p 50 -j Cid43554X5007.1 $IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -j Cid43554X5007.1
$IPTABLES -t mangle -A Cid43554X5007.1 -j MARK --set-mark 16 $IPTABLES -N Cid43554X5007.0 -t mangle
$IPTABLES -t mangle -A Cid43554X5007.1 -j ACCEPT $IPTABLES -t mangle -A Cid43554X5007.1 -p 50 -j Cid43554X5007.0
$IPTABLES -N Cid43554X5007.2 -t mangle $IPTABLES -t mangle -A Cid43554X5007.1 -p ah -j Cid43554X5007.0
$IPTABLES -t mangle -A Cid43554X5007.0 -p ah -j Cid43554X5007.2 $IPTABLES -t mangle -A Cid43554X5007.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid43554X5007.2 -j MARK --set-mark 16 $IPTABLES -t mangle -A Cid43554X5007.0 -j ACCEPT
$IPTABLES -t mangle -A Cid43554X5007.2 -j ACCEPT
# #
# Rule 9 (eth1) # Rule 9 (eth1)
# #
echo "Rule 9 (eth1)" echo "Rule 9 (eth1)"
# #
$IPTABLES -N Cid43571X5007.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -j Cid43571X5007.0
$IPTABLES -N Cid43571X5007.1 -t mangle $IPTABLES -N Cid43571X5007.1 -t mangle
$IPTABLES -t mangle -A Cid43571X5007.0 -p 50 -j Cid43571X5007.1 $IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -j Cid43571X5007.1
$IPTABLES -t mangle -A Cid43571X5007.1 -j MARK --set-mark 16 $IPTABLES -N Cid43571X5007.0 -t mangle
$IPTABLES -t mangle -A Cid43571X5007.1 -j ACCEPT $IPTABLES -t mangle -A Cid43571X5007.1 -p 50 -j Cid43571X5007.0
$IPTABLES -N Cid43571X5007.2 -t mangle $IPTABLES -t mangle -A Cid43571X5007.1 -p ah -j Cid43571X5007.0
$IPTABLES -t mangle -A Cid43571X5007.0 -p ah -j Cid43571X5007.2 $IPTABLES -t mangle -A Cid43571X5007.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid43571X5007.2 -j MARK --set-mark 16 $IPTABLES -t mangle -A Cid43571X5007.0 -j ACCEPT
$IPTABLES -t mangle -A Cid43571X5007.2 -j ACCEPT
# #
# Rule 10 (eth1) # Rule 10 (eth1)
# #
@ -495,12 +465,9 @@ script_body() {
# #
$IPTABLES -N Cid43588X5007.0 -t mangle $IPTABLES -N Cid43588X5007.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -j Cid43588X5007.0 $IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -j Cid43588X5007.0
$IPTABLES -t mangle -A Cid43588X5007.0 -j MARK --set-mark 16 $IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -j Cid43588X5007.0
$IPTABLES -t mangle -A Cid43588X5007.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid43588X5007.0 -j ACCEPT $IPTABLES -t mangle -A Cid43588X5007.0 -j ACCEPT
$IPTABLES -N Cid43588X5007.1 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -j Cid43588X5007.1
$IPTABLES -t mangle -A Cid43588X5007.1 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid43588X5007.1 -j ACCEPT
# #
# Rule 11 (global) # Rule 11 (global)
# #
@ -515,8 +482,8 @@ script_body() {
$IPTABLES -t mangle -A Cid43BBCC139745.0 -s 192.168.2.0/24 -j RETURN $IPTABLES -t mangle -A Cid43BBCC139745.0 -s 192.168.2.0/24 -j RETURN
$IPTABLES -N RULE_11_3 -t mangle $IPTABLES -N RULE_11_3 -t mangle
$IPTABLES -t mangle -A Cid43BBCC139745.0 -j RULE_11_3 $IPTABLES -t mangle -A Cid43BBCC139745.0 -j RULE_11_3
$IPTABLES -t mangle -A RULE_11_3 -j LOG --log-level info --log-prefix "RULE 11 -- TAG " $IPTABLES -t mangle -A RULE_11_3 -j LOG --log-level info --log-prefix "RULE 11 -- ACCEPT "
$IPTABLES -t mangle -A RULE_11_3 -j MARK --set-mark 16 $IPTABLES -t mangle -A RULE_11_3 -j MARK --set-mark 16
$IPTABLES -t mangle -A RULE_11_3 -j ACCEPT $IPTABLES -t mangle -A RULE_11_3 -j ACCEPT
# #
# Rule 12 (eth1) # Rule 12 (eth1)
@ -525,28 +492,16 @@ script_body() {
# #
$IPTABLES -N Cid4665E24F7765.0 -t mangle $IPTABLES -N Cid4665E24F7765.0 -t mangle
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.0 $IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.0
$IPTABLES -t mangle -A Cid4665E24F7765.0 -j MARK --set-mark 16 $IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid4665E24F7765.0
$IPTABLES -t mangle -A Cid4665E24F7765.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid4665E24F7765.0 -j ACCEPT $IPTABLES -t mangle -A Cid4665E24F7765.0 -j ACCEPT
$IPTABLES -N Cid4665E24F7765.1 -t mangle $IPTABLES -N Cid4665E24F7765.1 -t mangle
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid4665E24F7765.1 $IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.1
$IPTABLES -t mangle -A Cid4665E24F7765.1 -j MARK --set-mark 16 $IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid4665E24F7765.1
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.1
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid4665E24F7765.1
$IPTABLES -t mangle -A Cid4665E24F7765.1 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid4665E24F7765.1 -j ACCEPT $IPTABLES -t mangle -A Cid4665E24F7765.1 -j ACCEPT
$IPTABLES -N Cid4665E24F7765.2 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.2
$IPTABLES -t mangle -A Cid4665E24F7765.2 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid4665E24F7765.2 -j ACCEPT
$IPTABLES -N Cid4665E24F7765.3 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid4665E24F7765.3
$IPTABLES -t mangle -A Cid4665E24F7765.3 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid4665E24F7765.3 -j ACCEPT
$IPTABLES -N Cid4665E24F7765.4 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.4
$IPTABLES -t mangle -A Cid4665E24F7765.4 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid4665E24F7765.4 -j ACCEPT
$IPTABLES -N Cid4665E24F7765.5 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid4665E24F7765.5
$IPTABLES -t mangle -A Cid4665E24F7765.5 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid4665E24F7765.5 -j ACCEPT
# #
# Rule 13 (eth1) # Rule 13 (eth1)
# #
@ -554,12 +509,9 @@ script_body() {
# #
$IPTABLES -N Cid43BBCC3D9745.0 -t mangle $IPTABLES -N Cid43BBCC3D9745.0 -t mangle
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid43BBCC3D9745.0 $IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid43BBCC3D9745.0
$IPTABLES -t mangle -A Cid43BBCC3D9745.0 -j MARK --set-mark 16 $IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid43BBCC3D9745.0
$IPTABLES -t mangle -A Cid43BBCC3D9745.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid43BBCC3D9745.0 -j ACCEPT $IPTABLES -t mangle -A Cid43BBCC3D9745.0 -j ACCEPT
$IPTABLES -N Cid43BBCC3D9745.1 -t mangle
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid43BBCC3D9745.1
$IPTABLES -t mangle -A Cid43BBCC3D9745.1 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid43BBCC3D9745.1 -j ACCEPT
# #
# Rule 14 (eth1) # Rule 14 (eth1)
# #
@ -567,34 +519,25 @@ script_body() {
# #
$IPTABLES -N Cid459E471C10946.0 -t mangle $IPTABLES -N Cid459E471C10946.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid459E471C10946.0 $IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid459E471C10946.0
$IPTABLES -t mangle -A Cid459E471C10946.0 -j MARK --set-mark 16 $IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid459E471C10946.0
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid459E471C10946.0
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid459E471C10946.0
$IPTABLES -t mangle -A Cid459E471C10946.0 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid459E471C10946.0 -j ACCEPT $IPTABLES -t mangle -A Cid459E471C10946.0 -j ACCEPT
$IPTABLES -N Cid459E471C10946.1 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid459E471C10946.1
$IPTABLES -t mangle -A Cid459E471C10946.1 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid459E471C10946.1 -j ACCEPT
$IPTABLES -N Cid459E471C10946.2 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid459E471C10946.2
$IPTABLES -t mangle -A Cid459E471C10946.2 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid459E471C10946.2 -j ACCEPT
$IPTABLES -N Cid459E471C10946.3 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid459E471C10946.3
$IPTABLES -t mangle -A Cid459E471C10946.3 -j MARK --set-mark 16
$IPTABLES -t mangle -A Cid459E471C10946.3 -j ACCEPT
# #
# Rule 15 (global) # Rule 15 (global)
# #
echo "Rule 15 (global)" echo "Rule 15 (global)"
# #
# using CONNMARK # using CONNMARK
$IPTABLES -N RULE_15 -t mangle $IPTABLES -N Cid4483A4BD1810.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j RULE_15 $IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid4483A4BD1810.0
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_15 $IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid4483A4BD1810.0
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_15 $IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid4483A4BD1810.0
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_15 $IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid4483A4BD1810.0
$IPTABLES -t mangle -A RULE_15 -j MARK --set-mark 10 $IPTABLES -t mangle -A Cid4483A4BD1810.0 -j MARK --set-mark 10
$IPTABLES -t mangle -A RULE_15 -j CONNMARK --save-mark $IPTABLES -t mangle -A Cid4483A4BD1810.0 -j CONNMARK --save-mark
$IPTABLES -t mangle -A RULE_15 -j ACCEPT $IPTABLES -t mangle -A Cid4483A4BD1810.0 -j ACCEPT
# #
# Rule 16 (global) # Rule 16 (global)
# #
@ -606,8 +549,8 @@ script_body() {
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_16 $IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_16
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_16 $IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_16
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_16 $IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_16
$IPTABLES -t mangle -A RULE_16 -j LOG --log-level info --log-prefix "RULE 16 -- TAG " $IPTABLES -t mangle -A RULE_16 -j LOG --log-level info --log-prefix "RULE 16 -- ACCEPT "
$IPTABLES -t mangle -A RULE_16 -j MARK --set-mark 10 $IPTABLES -t mangle -A RULE_16 -j MARK --set-mark 10
$IPTABLES -t mangle -A RULE_16 -j CONNMARK --save-mark $IPTABLES -t mangle -A RULE_16 -j CONNMARK --save-mark
$IPTABLES -t mangle -A RULE_16 -j ACCEPT $IPTABLES -t mangle -A RULE_16 -j ACCEPT
# #
@ -623,38 +566,38 @@ script_body() {
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid4483A4DF1810.0 $IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid4483A4DF1810.0
$IPTABLES -t mangle -A Cid4483A4DF1810.0 -s 192.168.1.0/24 -j RETURN $IPTABLES -t mangle -A Cid4483A4DF1810.0 -s 192.168.1.0/24 -j RETURN
$IPTABLES -t mangle -A Cid4483A4DF1810.0 -s 192.168.2.0/24 -j RETURN $IPTABLES -t mangle -A Cid4483A4DF1810.0 -s 192.168.2.0/24 -j RETURN
$IPTABLES -N RULE_17 -t mangle $IPTABLES -N RULE_17_3 -t mangle
$IPTABLES -t mangle -A Cid4483A4DF1810.0 -j RULE_17 $IPTABLES -t mangle -A Cid4483A4DF1810.0 -j RULE_17_3
$IPTABLES -t mangle -A RULE_17 -j LOG --log-level info --log-prefix "RULE 17 -- TAG " $IPTABLES -t mangle -A RULE_17_3 -j LOG --log-level info --log-prefix "RULE 17 -- ACCEPT "
$IPTABLES -t mangle -A RULE_17 -j MARK --set-mark 10 $IPTABLES -t mangle -A RULE_17_3 -j MARK --set-mark 10
$IPTABLES -t mangle -A RULE_17 -j CONNMARK --save-mark $IPTABLES -t mangle -A RULE_17_3 -j CONNMARK --save-mark
$IPTABLES -t mangle -A RULE_17 -j ACCEPT $IPTABLES -t mangle -A RULE_17_3 -j ACCEPT
# #
# Rule 18 (eth1) # Rule 18 (eth1)
# #
echo "Rule 18 (eth1)" echo "Rule 18 (eth1)"
# #
# using CONNMARK # using CONNMARK
$IPTABLES -N In_RULE_18 -t mangle $IPTABLES -N Cid4483A4F01810.0 -t mangle
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j In_RULE_18 $IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid4483A4F01810.0
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j In_RULE_18 $IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid4483A4F01810.0
$IPTABLES -t mangle -A In_RULE_18 -i eth1 -j MARK --set-mark 10 $IPTABLES -t mangle -A Cid4483A4F01810.0 -j MARK --set-mark 10
$IPTABLES -t mangle -A In_RULE_18 -i eth1 -j CONNMARK --save-mark $IPTABLES -t mangle -A Cid4483A4F01810.0 -j CONNMARK --save-mark
$IPTABLES -t mangle -A In_RULE_18 -i eth1 -j ACCEPT $IPTABLES -t mangle -A Cid4483A4F01810.0 -j ACCEPT
# #
# Rule 19 (eth1) # Rule 19 (eth1)
# #
echo "Rule 19 (eth1)" echo "Rule 19 (eth1)"
# #
# using CONNMARK # using CONNMARK
$IPTABLES -N Out_RULE_19 -t mangle $IPTABLES -N Cid459E472D10946.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Out_RULE_19 $IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid459E472D10946.0
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Out_RULE_19 $IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid459E472D10946.0
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Out_RULE_19 $IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid459E472D10946.0
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Out_RULE_19 $IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid459E472D10946.0
$IPTABLES -t mangle -A Out_RULE_19 -o eth1 -j MARK --set-mark 10 $IPTABLES -t mangle -A Cid459E472D10946.0 -j MARK --set-mark 10
$IPTABLES -t mangle -A Out_RULE_19 -o eth1 -j CONNMARK --save-mark $IPTABLES -t mangle -A Cid459E472D10946.0 -j CONNMARK --save-mark
$IPTABLES -t mangle -A Out_RULE_19 -o eth1 -j ACCEPT $IPTABLES -t mangle -A Cid459E472D10946.0 -j ACCEPT
# #
# Rule 22 (global) # Rule 22 (global)
# #
@ -662,7 +605,7 @@ script_body() {
# #
$IPTABLES -N Cid43BB81879745.0 -t mangle $IPTABLES -N Cid43BB81879745.0 -t mangle
$IPTABLES -t mangle -A POSTROUTING -s 192.168.1.0/24 -j Cid43BB81879745.0 $IPTABLES -t mangle -A POSTROUTING -s 192.168.1.0/24 -j Cid43BB81879745.0
$IPTABLES -t mangle -A Cid43BB81879745.0 -j CLASSIFY --set-class 1:2 $IPTABLES -t mangle -A Cid43BB81879745.0 -j CLASSIFY --set-class 1:2
$IPTABLES -t mangle -A Cid43BB81879745.0 -j ACCEPT $IPTABLES -t mangle -A Cid43BB81879745.0 -j ACCEPT
# #
# Rule 23 (global) # Rule 23 (global)
@ -671,8 +614,8 @@ script_body() {
# #
$IPTABLES -N RULE_23 -t mangle $IPTABLES -N RULE_23 -t mangle
$IPTABLES -t mangle -A POSTROUTING -s 192.168.1.0/24 -j RULE_23 $IPTABLES -t mangle -A POSTROUTING -s 192.168.1.0/24 -j RULE_23
$IPTABLES -t mangle -A RULE_23 -j LOG --log-level info --log-prefix "RULE 23 -- CLASSIFY " $IPTABLES -t mangle -A RULE_23 -j LOG --log-level info --log-prefix "RULE 23 -- ACCEPT "
$IPTABLES -t mangle -A RULE_23 -j CLASSIFY --set-class 1:2 $IPTABLES -t mangle -A RULE_23 -j CLASSIFY --set-class 1:2
$IPTABLES -t mangle -A RULE_23 -j ACCEPT $IPTABLES -t mangle -A RULE_23 -j ACCEPT
# #
# Rule 24 (global) # Rule 24 (global)
@ -683,7 +626,7 @@ script_body() {
$IPTABLES -t mangle -A POSTROUTING -j Cid451E56936383.0 $IPTABLES -t mangle -A POSTROUTING -j Cid451E56936383.0
$IPTABLES -t mangle -A Cid451E56936383.0 -s 192.168.1.0/24 -j RETURN $IPTABLES -t mangle -A Cid451E56936383.0 -s 192.168.1.0/24 -j RETURN
$IPTABLES -t mangle -A Cid451E56936383.0 -s 192.168.2.0/24 -j RETURN $IPTABLES -t mangle -A Cid451E56936383.0 -s 192.168.2.0/24 -j RETURN
$IPTABLES -t mangle -A Cid451E56936383.0 -j CLASSIFY --set-class 1:2 $IPTABLES -t mangle -A Cid451E56936383.0 -j CLASSIFY --set-class 1:2
$IPTABLES -t mangle -A Cid451E56936383.0 -j ACCEPT $IPTABLES -t mangle -A Cid451E56936383.0 -j ACCEPT
# #
# Rule 25 (global) # Rule 25 (global)
@ -696,8 +639,8 @@ script_body() {
$IPTABLES -t mangle -A Cid451E56A46383.0 -s 192.168.2.0/24 -j RETURN $IPTABLES -t mangle -A Cid451E56A46383.0 -s 192.168.2.0/24 -j RETURN
$IPTABLES -N RULE_25_3 -t mangle $IPTABLES -N RULE_25_3 -t mangle
$IPTABLES -t mangle -A Cid451E56A46383.0 -j RULE_25_3 $IPTABLES -t mangle -A Cid451E56A46383.0 -j RULE_25_3
$IPTABLES -t mangle -A RULE_25_3 -j LOG --log-level info --log-prefix "RULE 25 -- CLASSIFY " $IPTABLES -t mangle -A RULE_25_3 -j LOG --log-level info --log-prefix "RULE 25 -- ACCEPT "
$IPTABLES -t mangle -A RULE_25_3 -j CLASSIFY --set-class 1:2 $IPTABLES -t mangle -A RULE_25_3 -j CLASSIFY --set-class 1:2
$IPTABLES -t mangle -A RULE_25_3 -j ACCEPT $IPTABLES -t mangle -A RULE_25_3 -j ACCEPT
# #
# Rule 26 (eth1) # Rule 26 (eth1)
@ -706,7 +649,7 @@ script_body() {
# #
$IPTABLES -N Cid451EAD596383.0 -t mangle $IPTABLES -N Cid451EAD596383.0 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth1 -s 192.168.1.0/24 -j Cid451EAD596383.0 $IPTABLES -t mangle -A POSTROUTING -o eth1 -s 192.168.1.0/24 -j Cid451EAD596383.0
$IPTABLES -t mangle -A Cid451EAD596383.0 -j CLASSIFY --set-class 1:2 $IPTABLES -t mangle -A Cid451EAD596383.0 -j CLASSIFY --set-class 1:2
$IPTABLES -t mangle -A Cid451EAD596383.0 -j ACCEPT $IPTABLES -t mangle -A Cid451EAD596383.0 -j ACCEPT
# #
# Rule 27 (eth1) # Rule 27 (eth1)
@ -715,8 +658,8 @@ script_body() {
# #
$IPTABLES -N Out_RULE_27 -t mangle $IPTABLES -N Out_RULE_27 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth1 -s 192.168.1.0/24 -j Out_RULE_27 $IPTABLES -t mangle -A POSTROUTING -o eth1 -s 192.168.1.0/24 -j Out_RULE_27
$IPTABLES -t mangle -A Out_RULE_27 -j LOG --log-level info --log-prefix "RULE 27 -- CLASSIFY " $IPTABLES -t mangle -A Out_RULE_27 -j LOG --log-level info --log-prefix "RULE 27 -- ACCEPT "
$IPTABLES -t mangle -A Out_RULE_27 -j CLASSIFY --set-class 1:2 $IPTABLES -t mangle -A Out_RULE_27 -j CLASSIFY --set-class 1:2
$IPTABLES -t mangle -A Out_RULE_27 -j ACCEPT $IPTABLES -t mangle -A Out_RULE_27 -j ACCEPT
# #
# Rule 28 (eth1) # Rule 28 (eth1)
@ -725,7 +668,7 @@ script_body() {
# #
$IPTABLES -N Cid451ED8E76383.0 -t mangle $IPTABLES -N Cid451ED8E76383.0 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o ! eth1 -s 192.168.1.0/24 -j Cid451ED8E76383.0 $IPTABLES -t mangle -A POSTROUTING -o ! eth1 -s 192.168.1.0/24 -j Cid451ED8E76383.0
$IPTABLES -t mangle -A Cid451ED8E76383.0 -j CLASSIFY --set-class 1:2 $IPTABLES -t mangle -A Cid451ED8E76383.0 -j CLASSIFY --set-class 1:2
$IPTABLES -t mangle -A Cid451ED8E76383.0 -j ACCEPT $IPTABLES -t mangle -A Cid451ED8E76383.0 -j ACCEPT
# #
# Rule 29 (eth1) # Rule 29 (eth1)
@ -734,8 +677,8 @@ script_body() {
# #
$IPTABLES -N Out_RULE_29 -t mangle $IPTABLES -N Out_RULE_29 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o ! eth1 -s 192.168.1.0/24 -j Out_RULE_29 $IPTABLES -t mangle -A POSTROUTING -o ! eth1 -s 192.168.1.0/24 -j Out_RULE_29
$IPTABLES -t mangle -A Out_RULE_29 -j LOG --log-level info --log-prefix "RULE 29 -- CLASSIFY " $IPTABLES -t mangle -A Out_RULE_29 -j LOG --log-level info --log-prefix "RULE 29 -- ACCEPT "
$IPTABLES -t mangle -A Out_RULE_29 -j CLASSIFY --set-class 1:2 $IPTABLES -t mangle -A Out_RULE_29 -j CLASSIFY --set-class 1:2
$IPTABLES -t mangle -A Out_RULE_29 -j ACCEPT $IPTABLES -t mangle -A Out_RULE_29 -j ACCEPT
# #
# Rule 30 (global) # Rule 30 (global)
@ -747,7 +690,7 @@ script_body() {
# in this firewall object # in this firewall object
$IPTABLES -N Cid4599A9DC19324.0 -t mangle $IPTABLES -N Cid4599A9DC19324.0 -t mangle
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid4599A9DC19324.0 $IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid4599A9DC19324.0
$IPTABLES -t mangle -A Cid4599A9DC19324.0 -j CLASSIFY --set-class 1:10 $IPTABLES -t mangle -A Cid4599A9DC19324.0 -j CLASSIFY --set-class 1:10
$IPTABLES -t mangle -A Cid4599A9DC19324.0 -j ACCEPT $IPTABLES -t mangle -A Cid4599A9DC19324.0 -j ACCEPT
# #
# Rule 31 (eth0) # Rule 31 (eth0)
@ -757,7 +700,7 @@ script_body() {
# second rule for bug #1618381 # second rule for bug #1618381
$IPTABLES -N Cid4599A9E919324.0 -t mangle $IPTABLES -N Cid4599A9E919324.0 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth0 -j Cid4599A9E919324.0 $IPTABLES -t mangle -A POSTROUTING -o eth0 -j Cid4599A9E919324.0
$IPTABLES -t mangle -A Cid4599A9E919324.0 -j CLASSIFY --set-class 1:11 $IPTABLES -t mangle -A Cid4599A9E919324.0 -j CLASSIFY --set-class 1:11
$IPTABLES -t mangle -A Cid4599A9E919324.0 -j ACCEPT $IPTABLES -t mangle -A Cid4599A9E919324.0 -j ACCEPT
# #
# Rule 32 (global) # Rule 32 (global)
@ -769,7 +712,7 @@ script_body() {
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid459A026219324.0 $IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid459A026219324.0
$IPTABLES -t mangle -A Cid459A026219324.0 -s 192.168.1.0/24 -j RETURN $IPTABLES -t mangle -A Cid459A026219324.0 -s 192.168.1.0/24 -j RETURN
$IPTABLES -t mangle -A Cid459A026219324.0 -s 192.168.2.0/24 -j RETURN $IPTABLES -t mangle -A Cid459A026219324.0 -s 192.168.2.0/24 -j RETURN
$IPTABLES -t mangle -A Cid459A026219324.0 -j CLASSIFY --set-class 1:10 $IPTABLES -t mangle -A Cid459A026219324.0 -j CLASSIFY --set-class 1:10
$IPTABLES -t mangle -A Cid459A026219324.0 -j ACCEPT $IPTABLES -t mangle -A Cid459A026219324.0 -j ACCEPT
# #
# Rule 33 (global) # Rule 33 (global)
@ -782,7 +725,7 @@ script_body() {
$IPTABLES -t mangle -A POSTROUTING -p tcp -m tcp --dport 80 -j Cid459A5AFB19324.0 $IPTABLES -t mangle -A POSTROUTING -p tcp -m tcp --dport 80 -j Cid459A5AFB19324.0
$IPTABLES -t mangle -A Cid459A5AFB19324.0 -s 192.168.1.0/24 -j RETURN $IPTABLES -t mangle -A Cid459A5AFB19324.0 -s 192.168.1.0/24 -j RETURN
$IPTABLES -t mangle -A Cid459A5AFB19324.0 -s 192.168.2.0/24 -j RETURN $IPTABLES -t mangle -A Cid459A5AFB19324.0 -s 192.168.2.0/24 -j RETURN
$IPTABLES -t mangle -A Cid459A5AFB19324.0 -j CLASSIFY --set-class 1:10 $IPTABLES -t mangle -A Cid459A5AFB19324.0 -j CLASSIFY --set-class 1:10
$IPTABLES -t mangle -A Cid459A5AFB19324.0 -j ACCEPT $IPTABLES -t mangle -A Cid459A5AFB19324.0 -j ACCEPT
# #
# Rule 34 (eth0) # Rule 34 (eth0)
@ -795,16 +738,10 @@ script_body() {
# of that # of that
$IPTABLES -N Cid459A875F19324.0 -t mangle $IPTABLES -N Cid459A875F19324.0 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp --dport 10000:11000 -j Cid459A875F19324.0 $IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp --dport 10000:11000 -j Cid459A875F19324.0
$IPTABLES -t mangle -A Cid459A875F19324.0 -j CLASSIFY --set-class 1:11 $IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid459A875F19324.0
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid459A875F19324.0
$IPTABLES -t mangle -A Cid459A875F19324.0 -j CLASSIFY --set-class 1:11
$IPTABLES -t mangle -A Cid459A875F19324.0 -j ACCEPT $IPTABLES -t mangle -A Cid459A875F19324.0 -j ACCEPT
$IPTABLES -N Cid459A875F19324.1 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid459A875F19324.1
$IPTABLES -t mangle -A Cid459A875F19324.1 -j CLASSIFY --set-class 1:11
$IPTABLES -t mangle -A Cid459A875F19324.1 -j ACCEPT
$IPTABLES -N Cid459A875F19324.2 -t mangle
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid459A875F19324.2
$IPTABLES -t mangle -A Cid459A875F19324.2 -j CLASSIFY --set-class 1:11
$IPTABLES -t mangle -A Cid459A875F19324.2 -j ACCEPT
# #
# Rule 36 (global) # Rule 36 (global)
# #
@ -830,12 +767,12 @@ script_body() {
# #
echo "Rule mangle_rules 1 (global)" echo "Rule mangle_rules 1 (global)"
# #
$IPTABLES -N mangle_rules_1 -t mangle $IPTABLES -N Cid56804X29169.0 -t mangle
$IPTABLES -t mangle -A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j mangle_rules_1 $IPTABLES -t mangle -A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j Cid56804X29169.0
$IPTABLES -t mangle -A PREROUTING -p tcp -m tcp --dport 80 -m state --state NEW -j mangle_rules_1 $IPTABLES -t mangle -A PREROUTING -p tcp -m tcp --dport 80 -m state --state NEW -j Cid56804X29169.0
$IPTABLES -t mangle -A mangle_rules_1 -j MARK --set-mark 1 $IPTABLES -t mangle -A Cid56804X29169.0 -j MARK --set-mark 1
$IPTABLES -t mangle -A mangle_rules_1 -j CONNMARK --save-mark $IPTABLES -t mangle -A Cid56804X29169.0 -j CONNMARK --save-mark
$IPTABLES -t mangle -A mangle_rules_1 -j ACCEPT $IPTABLES -t mangle -A Cid56804X29169.0 -j ACCEPT
# #
# Rule mangle_rules 2 (global) # Rule mangle_rules 2 (global)
# #
@ -843,7 +780,7 @@ script_body() {
# #
$IPTABLES -N Cid56817X29169.0 -t mangle $IPTABLES -N Cid56817X29169.0 -t mangle
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j Cid56817X29169.0 $IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j Cid56817X29169.0
$IPTABLES -t mangle -A Cid56817X29169.0 -j CLASSIFY --set-class 1:12 $IPTABLES -t mangle -A Cid56817X29169.0 -j CLASSIFY --set-class 1:12
$IPTABLES -t mangle -A Cid56817X29169.0 -j ACCEPT $IPTABLES -t mangle -A Cid56817X29169.0 -j ACCEPT
# #
# Rule mangle_rules 4 (global) # Rule mangle_rules 4 (global)
@ -1050,7 +987,7 @@ test -z "$cmd" && {
case "$cmd" in case "$cmd" in
start) start)
log "Activating firewall script generated Tue Apr 19 14:12:04 2011 by vadim" log "Activating firewall script generated Tue May 3 20:28:13 2011 by vadim"
check_tools check_tools
prolog_commands prolog_commands
check_run_time_address_table_files check_run_time_address_table_files

40
test/ipt/firewall38.fw.orig
View File

@ -2,9 +2,9 @@
# #
# This is automatically generated file. DO NOT MODIFY ! # This is automatically generated file. DO NOT MODIFY !
# #
# Firewall Builder fwb_ipt v4.2.0.3529 # Firewall Builder fwb_ipt v4.2.1.ma_1
# #
# Generated Tue Apr 19 14:12:07 2011 PDT by vadim # Generated Tue May 3 19:32:56 2011 PDT by vadim
# #
# files: * firewall38.fw /etc/fw/firewall38.fw # files: * firewall38.fw /etc/fw/firewall38.fw
# #
@ -366,10 +366,10 @@ script_body() {
# ================ Table 'mangle', rule set Policy # ================ Table 'mangle', rule set Policy
# #
# Rule 0 (global) # Rule 0 (global)
echo "-A OUTPUT -p 50 -m state --state NEW -j MARK --set-mark 16" echo "-A OUTPUT -p 50 -m state --state NEW -j MARK --set-mark 16"
echo "-A OUTPUT -p ah -m state --state NEW -j MARK --set-mark 16" echo "-A OUTPUT -p ah -m state --state NEW -j MARK --set-mark 16"
echo "-A PREROUTING -p 50 -m state --state NEW -j MARK --set-mark 16" echo "-A PREROUTING -p 50 -m state --state NEW -j MARK --set-mark 16"
echo "-A PREROUTING -p ah -m state --state NEW -j MARK --set-mark 16" echo "-A PREROUTING -p ah -m state --state NEW -j MARK --set-mark 16"
# #
# Rule 1 (global) # Rule 1 (global)
echo ":RULE_1 - [0:0]" echo ":RULE_1 - [0:0]"
@ -377,8 +377,8 @@ script_body() {
echo "-A OUTPUT -p ah -m state --state NEW -j RULE_1 " echo "-A OUTPUT -p ah -m state --state NEW -j RULE_1 "
echo "-A PREROUTING -p 50 -m state --state NEW -j RULE_1 " echo "-A PREROUTING -p 50 -m state --state NEW -j RULE_1 "
echo "-A PREROUTING -p ah -m state --state NEW -j RULE_1 " echo "-A PREROUTING -p ah -m state --state NEW -j RULE_1 "
echo "-A RULE_1 -j LOG --log-level info --log-prefix \"RULE 1 -- TAG \"" echo "-A RULE_1 -j LOG --log-level info --log-prefix \"RULE 1 -- CONTINUE \""
echo "-A RULE_1 -j MARK --set-mark 16" echo "-A RULE_1 -j MARK --set-mark 16"
# #
# Rule 2 (global) # Rule 2 (global)
echo ":Cid43BBF1AD9745.0 - [0:0]" echo ":Cid43BBF1AD9745.0 - [0:0]"
@ -390,35 +390,35 @@ script_body() {
echo "-A PREROUTING -s ! 192.168.1.0/24 -m state --state NEW -j Cid43BBF1AD9745.1 " echo "-A PREROUTING -s ! 192.168.1.0/24 -m state --state NEW -j Cid43BBF1AD9745.1 "
echo "-A Cid43BBF1AD9745.1 -p 50 -j RULE_2 " echo "-A Cid43BBF1AD9745.1 -p 50 -j RULE_2 "
echo "-A Cid43BBF1AD9745.1 -p ah -j RULE_2 " echo "-A Cid43BBF1AD9745.1 -p ah -j RULE_2 "
echo "-A RULE_2 -j LOG --log-level info --log-prefix \"RULE 2 -- TAG \"" echo "-A RULE_2 -j LOG --log-level info --log-prefix \"RULE 2 -- CONTINUE \""
echo "-A RULE_2 -j MARK --set-mark 16" echo "-A RULE_2 -j MARK --set-mark 16"
# #
# Rule 3 (eth1) # Rule 3 (eth1)
echo "-A PREROUTING -i eth1 -p 50 -m state --state NEW -j MARK --set-mark 16" echo "-A PREROUTING -i eth1 -p 50 -m state --state NEW -j MARK --set-mark 16"
echo "-A PREROUTING -i eth1 -p ah -m state --state NEW -j MARK --set-mark 16" echo "-A PREROUTING -i eth1 -p ah -m state --state NEW -j MARK --set-mark 16"
# #
# Rule 4 (global) # Rule 4 (global)
# rule comment: rule 4 # rule comment: rule 4
echo "-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j MARK --set-mark 2" echo "-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j MARK --set-mark 2"
# #
# Rule 5 (global) # Rule 5 (global)
echo ":RULE_5 - [0:0]" echo ":RULE_5 - [0:0]"
echo "-A OUTPUT -p tcp -m tcp -s 22.22.23.22 --dport 80 -m state --state NEW -j RULE_5 " echo "-A OUTPUT -p tcp -m tcp -s 22.22.23.22 --dport 80 -m state --state NEW -j RULE_5 "
echo "-A RULE_5 -j LOG --log-level info --log-prefix \"RULE 5 -- TAG \"" echo "-A RULE_5 -j LOG --log-level info --log-prefix \"RULE 5 -- CONTINUE \""
echo "-A RULE_5 -j MARK --set-mark 2" echo "-A RULE_5 -j MARK --set-mark 2"
# #
# Rule 6 (eth1) # Rule 6 (eth1)
echo "-A OUTPUT -o eth1 -p tcp -m tcp -s 22.22.23.22 --dport 80 -m state --state NEW -j MARK --set-mark 2" echo "-A OUTPUT -o eth1 -p tcp -m tcp -s 22.22.23.22 --dport 80 -m state --state NEW -j MARK --set-mark 2"
# #
# Rule 7 (eth1) # Rule 7 (eth1)
echo "-A PREROUTING -i eth1 -p tcp -m tcp -s 22.22.23.22 --dport 80 -m state --state NEW -j MARK --set-mark 2" echo "-A PREROUTING -i eth1 -p tcp -m tcp -s 22.22.23.22 --dport 80 -m state --state NEW -j MARK --set-mark 2"
# #
# Rule 8 (eth1) # Rule 8 (eth1)
echo ":Cid462EA8B230547.0 - [0:0]" echo ":Cid462EA8B230547.0 - [0:0]"
echo "-A OUTPUT -o eth1 -p tcp -m tcp --dport 80 -m state --state NEW -j Cid462EA8B230547.0 " echo "-A OUTPUT -o eth1 -p tcp -m tcp --dport 80 -m state --state NEW -j Cid462EA8B230547.0 "
echo "-A Cid462EA8B230547.0 -s 22.22.23.22 -j RETURN " echo "-A Cid462EA8B230547.0 -s 22.22.23.22 -j RETURN "
echo "-A Cid462EA8B230547.0 -j MARK --set-mark 2" echo "-A Cid462EA8B230547.0 -j MARK --set-mark 2"
echo "-A POSTROUTING -o eth1 -p tcp -m tcp --dport 80 -m state --state NEW -j MARK --set-mark 2" echo "-A POSTROUTING -o eth1 -p tcp -m tcp --dport 80 -m state --state NEW -j MARK --set-mark 2"
# #
echo COMMIT echo COMMIT
@ -498,7 +498,7 @@ test -z "$cmd" && {
case "$cmd" in case "$cmd" in
start) start)
log "Activating firewall script generated Tue Apr 19 14:12:07 2011 by vadim" log "Activating firewall script generated Tue May 3 19:32:56 2011 by vadim"
check_tools check_tools
prolog_commands prolog_commands
check_run_time_address_table_files check_run_time_address_table_files

26
test/ipt/firewall40-1.fw.orig
View File

@ -2,9 +2,9 @@
# #
# This is automatically generated file. DO NOT MODIFY ! # This is automatically generated file. DO NOT MODIFY !
# #
# Firewall Builder fwb_ipt v4.2.0.3529 # Firewall Builder fwb_ipt v4.2.1.ma_1
# #
# Generated Tue Apr 19 14:12:13 2011 PDT by vadim # Generated Tue May 3 19:33:01 2011 PDT by vadim
# #
# files: * firewall40-1.fw /etc/firewall40-1.fw # files: * firewall40-1.fw /etc/firewall40-1.fw
# #
@ -325,31 +325,27 @@ script_body() {
echo "Rule Policy_1 0 (eth0)" echo "Rule Policy_1 0 (eth0)"
# #
$IPTABLES -N Policy_1 -t mangle $IPTABLES -N Policy_1 -t mangle
$IPTABLES -N In_Policy_1_0 -t mangle $IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j MARK --set-mark 1
$IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j In_Policy_1_0 $IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j CONNMARK --save-mark
$IPTABLES -t mangle -A In_Policy_1_0 -i eth0 -j MARK --set-mark 1
$IPTABLES -t mangle -A In_Policy_1_0 -i eth0 -j CONNMARK --save-mark
# #
# Rule Policy_1 1 (eth2) # Rule Policy_1 1 (eth2)
# #
echo "Rule Policy_1 1 (eth2)" echo "Rule Policy_1 1 (eth2)"
# #
$IPTABLES -N In_Policy_1_1 -t mangle $IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j MARK --set-mark 2
$IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j In_Policy_1_1 $IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j CONNMARK --save-mark
$IPTABLES -t mangle -A In_Policy_1_1 -i eth2 -j MARK --set-mark 2
$IPTABLES -t mangle -A In_Policy_1_1 -i eth2 -j CONNMARK --save-mark
# #
# Rule Policy_1 3 (global) # Rule Policy_1 3 (global)
# #
echo "Rule Policy_1 3 (global)" echo "Rule Policy_1 3 (global)"
# #
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j ROUTE --oif eth0 --continue $IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j ROUTE --oif eth0 --continue
# #
# Rule Policy_1 4 (global) # Rule Policy_1 4 (global)
# #
echo "Rule Policy_1 4 (global)" echo "Rule Policy_1 4 (global)"
# #
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 2 -j ROUTE --oif eth2 --continue $IPTABLES -t mangle -A POSTROUTING -m mark --mark 2 -j ROUTE --oif eth2 --continue
# #
# Rule Policy_1 6 (global) # Rule Policy_1 6 (global)
# #
@ -360,8 +356,8 @@ script_body() {
$IPTABLES -N Policy_1_6 -t mangle $IPTABLES -N Policy_1_6 -t mangle
$IPTABLES -t mangle -A Cid55038X29165.0 -d 22.22.22.0/24 -j Policy_1_6 $IPTABLES -t mangle -A Cid55038X29165.0 -d 22.22.22.0/24 -j Policy_1_6
$IPTABLES -t mangle -A Cid55038X29165.0 -d 33.33.33.0/24 -j Policy_1_6 $IPTABLES -t mangle -A Cid55038X29165.0 -d 33.33.33.0/24 -j Policy_1_6
$IPTABLES -t mangle -A Policy_1_6 -j LOG --log-level info --log-prefix "RULE 6 -- TAG " $IPTABLES -t mangle -A Policy_1_6 -j LOG --log-level info --log-prefix "RULE 6 -- CONTINUE "
$IPTABLES -t mangle -A Policy_1_6 -j MARK --set-mark 8 $IPTABLES -t mangle -A Policy_1_6 -j MARK --set-mark 8
# ================ Table 'filter', rule set Policy_1 # ================ Table 'filter', rule set Policy_1
# #
@ -450,7 +446,7 @@ test -z "$cmd" && {
case "$cmd" in case "$cmd" in
start) start)
log "Activating firewall script generated Tue Apr 19 14:12:13 2011 by vadim" log "Activating firewall script generated Tue May 3 19:33:01 2011 by vadim"
check_tools check_tools
prolog_commands prolog_commands
check_run_time_address_table_files check_run_time_address_table_files

26
test/ipt/firewall40-2.fw.orig
View File

@ -2,9 +2,9 @@
# #
# This is automatically generated file. DO NOT MODIFY ! # This is automatically generated file. DO NOT MODIFY !
# #
# Firewall Builder fwb_ipt v4.2.0.3529 # Firewall Builder fwb_ipt v4.2.1.ma_1
# #
# Generated Tue Apr 19 14:12:14 2011 PDT by vadim # Generated Tue May 3 19:33:02 2011 PDT by vadim
# #
# files: * firewall40-2.fw /etc/firewall40-2.fw # files: * firewall40-2.fw /etc/firewall40-2.fw
# #
@ -325,31 +325,27 @@ script_body() {
echo "Rule Policy_1 0 (eth0)" echo "Rule Policy_1 0 (eth0)"
# #
$IPTABLES -N Policy_1 -t mangle $IPTABLES -N Policy_1 -t mangle
$IPTABLES -N In_Policy_1_0 -t mangle $IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j MARK --set-mark 1
$IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j In_Policy_1_0 $IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j CONNMARK --save-mark
$IPTABLES -t mangle -A In_Policy_1_0 -i eth0 -j MARK --set-mark 1
$IPTABLES -t mangle -A In_Policy_1_0 -i eth0 -j CONNMARK --save-mark
# #
# Rule Policy_1 1 (eth2) # Rule Policy_1 1 (eth2)
# #
echo "Rule Policy_1 1 (eth2)" echo "Rule Policy_1 1 (eth2)"
# #
$IPTABLES -N In_Policy_1_1 -t mangle $IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j MARK --set-mark 2
$IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j In_Policy_1_1 $IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j CONNMARK --save-mark
$IPTABLES -t mangle -A In_Policy_1_1 -i eth2 -j MARK --set-mark 2
$IPTABLES -t mangle -A In_Policy_1_1 -i eth2 -j CONNMARK --save-mark
# #
# Rule Policy_1 3 (global) # Rule Policy_1 3 (global)
# #
echo "Rule Policy_1 3 (global)" echo "Rule Policy_1 3 (global)"
# #
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j ROUTE --oif eth0 --continue $IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j ROUTE --oif eth0 --continue
# #
# Rule Policy_1 4 (global) # Rule Policy_1 4 (global)
# #
echo "Rule Policy_1 4 (global)" echo "Rule Policy_1 4 (global)"
# #
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 2 -j ROUTE --oif eth2 --continue $IPTABLES -t mangle -A POSTROUTING -m mark --mark 2 -j ROUTE --oif eth2 --continue
# #
# Rule Policy_1 6 (global) # Rule Policy_1 6 (global)
# #
@ -360,8 +356,8 @@ script_body() {
$IPTABLES -N Policy_1_6 -t mangle $IPTABLES -N Policy_1_6 -t mangle
$IPTABLES -t mangle -A Cid55227X22068.0 -d 22.22.22.0/24 -j Policy_1_6 $IPTABLES -t mangle -A Cid55227X22068.0 -d 22.22.22.0/24 -j Policy_1_6
$IPTABLES -t mangle -A Cid55227X22068.0 -d 33.33.33.0/24 -j Policy_1_6 $IPTABLES -t mangle -A Cid55227X22068.0 -d 33.33.33.0/24 -j Policy_1_6
$IPTABLES -t mangle -A Policy_1_6 -j LOG --log-level info --log-prefix "RULE 6 -- TAG " $IPTABLES -t mangle -A Policy_1_6 -j LOG --log-level info --log-prefix "RULE 6 -- CONTINUE "
$IPTABLES -t mangle -A Policy_1_6 -j MARK --set-mark 8 $IPTABLES -t mangle -A Policy_1_6 -j MARK --set-mark 8
# ================ Table 'filter', rule set Policy_1 # ================ Table 'filter', rule set Policy_1
# #
@ -437,7 +433,7 @@ test -z "$cmd" && {
case "$cmd" in case "$cmd" in
start) start)
log "Activating firewall script generated Tue Apr 19 14:12:14 2011 by vadim" log "Activating firewall script generated Tue May 3 19:33:02 2011 by vadim"
check_tools check_tools
prolog_commands prolog_commands
check_run_time_address_table_files check_run_time_address_table_files

26
test/ipt/firewall40.fw.orig
View File

@ -2,9 +2,9 @@
# #
# This is automatically generated file. DO NOT MODIFY ! # This is automatically generated file. DO NOT MODIFY !
# #
# Firewall Builder fwb_ipt v4.2.0.3529 # Firewall Builder fwb_ipt v4.2.1.ma_1
# #
# Generated Tue Apr 19 14:12:13 2011 PDT by vadim # Generated Tue May 3 19:33:00 2011 PDT by vadim
# #
# files: * firewall40.fw /etc/firewall40.fw # files: * firewall40.fw /etc/firewall40.fw
# #
@ -324,31 +324,27 @@ script_body() {
# #
echo "Rule 0 (eth0)" echo "Rule 0 (eth0)"
# #
$IPTABLES -N In_RULE_0 -t mangle $IPTABLES -t mangle -A PREROUTING -i eth0 -m state --state NEW -j MARK --set-mark 1
$IPTABLES -t mangle -A PREROUTING -i eth0 -m state --state NEW -j In_RULE_0 $IPTABLES -t mangle -A PREROUTING -i eth0 -m state --state NEW -j CONNMARK --save-mark
$IPTABLES -t mangle -A In_RULE_0 -i eth0 -j MARK --set-mark 1
$IPTABLES -t mangle -A In_RULE_0 -i eth0 -j CONNMARK --save-mark
# #
# Rule 1 (eth2) # Rule 1 (eth2)
# #
echo "Rule 1 (eth2)" echo "Rule 1 (eth2)"
# #
$IPTABLES -N In_RULE_1 -t mangle $IPTABLES -t mangle -A PREROUTING -i eth2 -m state --state NEW -j MARK --set-mark 2
$IPTABLES -t mangle -A PREROUTING -i eth2 -m state --state NEW -j In_RULE_1 $IPTABLES -t mangle -A PREROUTING -i eth2 -m state --state NEW -j CONNMARK --save-mark
$IPTABLES -t mangle -A In_RULE_1 -i eth2 -j MARK --set-mark 2
$IPTABLES -t mangle -A In_RULE_1 -i eth2 -j CONNMARK --save-mark
# #
# Rule 3 (global) # Rule 3 (global)
# #
echo "Rule 3 (global)" echo "Rule 3 (global)"
# #
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j ROUTE --oif eth0 --continue $IPTABLES -t mangle -A POSTROUTING -m mark --mark 1 -j ROUTE --oif eth0 --continue
# #
# Rule 4 (global) # Rule 4 (global)
# #
echo "Rule 4 (global)" echo "Rule 4 (global)"
# #
$IPTABLES -t mangle -A POSTROUTING -m mark --mark 2 -j ROUTE --oif eth2 --continue $IPTABLES -t mangle -A POSTROUTING -m mark --mark 2 -j ROUTE --oif eth2 --continue
# #
# Rule 6 (global) # Rule 6 (global)
# #
@ -359,8 +355,8 @@ script_body() {
$IPTABLES -N RULE_6 -t mangle $IPTABLES -N RULE_6 -t mangle
$IPTABLES -t mangle -A Cid37084X26841.0 -d 22.22.22.0/24 -j RULE_6 $IPTABLES -t mangle -A Cid37084X26841.0 -d 22.22.22.0/24 -j RULE_6
$IPTABLES -t mangle -A Cid37084X26841.0 -d 33.33.33.0/24 -j RULE_6 $IPTABLES -t mangle -A Cid37084X26841.0 -d 33.33.33.0/24 -j RULE_6
$IPTABLES -t mangle -A RULE_6 -j LOG --log-level info --log-prefix "RULE 6 -- TAG " $IPTABLES -t mangle -A RULE_6 -j LOG --log-level info --log-prefix "RULE 6 -- CONTINUE "
$IPTABLES -t mangle -A RULE_6 -j MARK --set-mark 8 $IPTABLES -t mangle -A RULE_6 -j MARK --set-mark 8
# ================ Table 'filter', rule set Policy # ================ Table 'filter', rule set Policy
# #
@ -439,7 +435,7 @@ test -z "$cmd" && {
case "$cmd" in case "$cmd" in
start) start)
log "Activating firewall script generated Tue Apr 19 14:12:13 2011 by vadim" log "Activating firewall script generated Tue May 3 19:33:00 2011 by vadim"
check_tools check_tools
prolog_commands prolog_commands
check_run_time_address_table_files check_run_time_address_table_files

15446
test/ipt/objects-for-regression-tests.fwb
View File

File diff suppressed because it is too large Load Diff

4
test/ipt/rc.firewall.local
View File

@ -2,9 +2,9 @@
# #
# This is automatically generated file. DO NOT MODIFY ! # This is automatically generated file. DO NOT MODIFY !
# #
# Firewall Builder fwb_ipt v4.2.0.3529 # Firewall Builder fwb_ipt v4.2.1.ma_1
# #
# Generated Tue Apr 19 14:13:40 2011 PDT by vadim # Generated Tue May 3 19:34:11 2011 PDT by vadim
# #
# files: * rc.firewall.local /etc/rc.d//rc.firewall.local # files: * rc.firewall.local /etc/rc.d//rc.firewall.local
# #