Shorewall 5.1.10.2 Dump at pc4-svp - So 11. Feb 14:45:47 CET 2018

Shorewall is running
State:Started So 4. Feb 15:07:50 CET 2018 from /etc/shorewall/ (/var/lib/shorewall/firewall compiled So 4. Feb 15:07:49 CET 2018 by Shorewall version 5.1.10.2)

Counters reset So 4. Feb 15:07:50 CET 2018

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
80246 7015K UMP_IF_in  all  --  vmbr0  *       0.0.0.0/0            0.0.0.0/0           
 109K  357M UMB_IF_in  all  --  eno1   *       0.0.0.0/0            0.0.0.0/0           
50513   81M INT_IF_in  all  --  vmbr1  *       0.0.0.0/0            0.0.0.0/0           
    0     0 ~comb0     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           
 371K   22M ~comb0     all  --  vmbr2  *       0.0.0.0/0            0.0.0.0/0           
  157 68092 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip LOG flags 0 level 6 prefix "INPUT REJECT "
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 126K  343M UMP_IF_fwd  all  --  vmbr0  *       0.0.0.0/0            0.0.0.0/0           
 207K  293M UMB_IF_fwd  all  --  eno1   *       0.0.0.0/0            0.0.0.0/0           
 134K  332M INT_IF_fwd  all  --  vmbr1  *       0.0.0.0/0            0.0.0.0/0           
    0     0 vpn_frwd   all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           
 252K   76M dmz_frwd   all  --  vmbr2  *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip LOG flags 0 level 6 prefix "FORWARD REJECT "
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
57801   43M ACCEPT     all  --  *      vmbr0   0.0.0.0/0            0.0.0.0/0           
68846 2787K ACCEPT     all  --  *      eno1    0.0.0.0/0            0.0.0.0/0           
24310 1492K INT_IF_out  all  --  *      vmbr1   0.0.0.0/0            0.0.0.0/0           
 399K   19M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain INT_IF_fwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
15944 1193K dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
 118K  331M tcpflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
 134K  332M loc_frwd   all  --  *      *       192.168.100.0/24     0.0.0.0/0           

Chain INT_IF_in (1 references)
 pkts bytes target     prot opt in     out     source               destination         
38438 9010K dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
24192 8008K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:67:68
17105   73M tcpflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     udp  --  *      *       0.0.0.0              0.0.0.0/0            udp dpts:67:68
26321   73M loc-fw     all  --  *      *       192.168.100.0/24     0.0.0.0/0           

Chain INT_IF_out (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:67:68
24310 1492K ACCEPT     all  --  *      *       0.0.0.0/0            192.168.100.0/24    
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            255.255.255.255     
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            224.0.0.0/4         

Chain UMB_IF_fwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 sfilter    all  --  *      eno1    0.0.0.0/0            0.0.0.0/0           [goto] 
 5456  316K dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
 5456  316K smurfs     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
 191K  291M tcpflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
 207K  293M net_frwd   all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain UMB_IF_in (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 1514 72231 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
 1514 72231 smurfs     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
 109K  357M tcpflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
 109K  357M net-fw     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain UMP_IF_fwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 9887  593K dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
 9887  593K smurfs     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
 115K  341M tcpflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
20891 1475K fb_frwd    all  --  *      *       192.168.1.0/24       0.0.0.0/0           
 106K  341M net_frwd   all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain UMP_IF_in (1 references)
 pkts bytes target     prot opt in     out     source               destination         
32260 4357K dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
32260 4357K smurfs     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
48532 2673K tcpflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
76188 5607K fb-fw      all  --  *      *       192.168.1.0/24       0.0.0.0/0           
 4058 1407K net-fw     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain dmz-loc (2 references)
 pkts bytes target     prot opt in     out     source               destination         
38180 2028K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
   49  2940 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.100.9        tcp dpt:3142
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.100.10       tcp dpt:389
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22,2200:22999
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.100.3        tcp dpt:3306
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.100.13       tcp dpt:3306
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain dmz-net (2 references)
 pkts bytes target     prot opt in     out     source               destination         
94409   26M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
 2047  123K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443 /* HTTP, HTTPS */
   13   780 ACCEPT     tcp  --  *      *       10.0.0.4             0.0.0.0/0            multiport dports 25,143,587,4190
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:587
    0     0 ACCEPT     tcp  --  *      *       10.0.0.100           0.0.0.0/0            multiport dports 80,443
    0     0 ACCEPT     tcp  --  *      *       10.0.0.8             0.0.0.0/0            tcp dpt:5232
11450  909K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 /* DNS */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 /* DNS */
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 /* Ping */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:33434:33524 /* Trcrt */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:11371
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:11371
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
 5494  375K reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain dmz_frwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
19181 1421K dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
 239K   75M tcpflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
 100K   46M ~comb1     all  --  *      vmbr0   0.0.0.0/0            192.168.1.0/24      
93751   26M dmz-net    all  --  *      eno1    0.0.0.0/0            0.0.0.0/0           
19662 1701K dmz-net    all  --  *      vmbr0   0.0.0.0/0            0.0.0.0/0           
38229 2031K dmz-loc    all  --  *      vmbr1   0.0.0.0/0            192.168.100.0/24    
    0     0 dmz-loc    all  --  *      vmbr1   0.0.0.0/0            224.0.0.0/4         
    0     0 ~comb1     all  --  *      tun+    0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      vmbr2   0.0.0.0/0            0.0.0.0/0           

Chain dynamic (9 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain fb-dmz (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 6193  531K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
  563 33780 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.0.0.2             multiport dports 80,443
  563 33780 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.0.0.4             multiport dports 25,143,587,4190,80,443
 1149 68652 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.0.0.100           multiport dports 80,443,9000,2375
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.0.0.8             tcp dpt:5232
  199 11924 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22,2200:22999
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 /* Ping */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:33434:33524 /* Trcrt */
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
 3339  200K reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain fb-fw (1 references)
 pkts bytes target     prot opt in     out     source               destination         
47788 2567K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    6   344 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:2214
    1    60 reject     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto]  tcp dpt:22 /* SSH */
   90  4680 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8006
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 443,5900:5999
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 /* Ping */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:33434:33524 /* Trcrt */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:111
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:111
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:2049
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:2049
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:32764:32769
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:32764:32769
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10809
22329 2792K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
 4838  174K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
 1136 68160 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip LOG flags 0 level 6 prefix "fb-fw REJECT "
 1136 68160 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain fb-loc (2 references)
 pkts bytes target     prot opt in     out     source               destination         
 4811  351K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
   16   960 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.100.9        tcp dpt:3142
  567 33988 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.100.10       multiport dports 80,443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.100.10       tcp dpt:389
  152  9120 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22,2200:22999
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 /* Ping */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:33434:33524 /* Trcrt */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.100.3        tcp dpt:3306
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.100.13       tcp dpt:3306
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
 3339  200K reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain fb-net (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443,587 /* HTTP, HTTPS and others */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 /* DNS */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 /* DNS */
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 /* Ping */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:33434:33524 /* Trcrt */
    0     0 ACCEPT     tcp  --  *      *       192.168.1.123        0.0.0.0/0            tcp dpt:5938
    0     0 ACCEPT     tcp  --  *      *       192.168.1.48         0.0.0.0/0            tcp dpt:5938
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:11371
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:11371
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip LOG flags 0 level 6 prefix "fb-net REJECT "
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain fb-vpn (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 /* Ping */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:33434:33524 /* Trcrt */
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip LOG flags 0 level 6 prefix "fb-vpn REJECT "
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain fb_frwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 fb-net     all  --  *      eno1    0.0.0.0/0            0.0.0.0/0           
    0     0 fb-net     all  --  *      vmbr0   0.0.0.0/0            0.0.0.0/0           
 8885  596K fb-loc     all  --  *      vmbr1   0.0.0.0/0            192.168.100.0/24    
    0     0 fb-loc     all  --  *      vmbr1   0.0.0.0/0            224.0.0.0/4         
    0     0 fb-vpn     all  --  *      tun+    0.0.0.0/0            0.0.0.0/0           
12006  879K fb-dmz     all  --  *      vmbr2   0.0.0.0/0            0.0.0.0/0           

Chain loc-dmz (1 references)
 pkts bytes target     prot opt in     out     source               destination         
46659  317M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.0.0.2             multiport dports 80,443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.0.0.4             multiport dports 25,143,587,4190,80,443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.0.0.100           multiport dports 80,443,9000,2375
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.0.0.8             tcp dpt:5232
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22,2200:22999
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 /* Ping */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:33434:33524 /* Trcrt */
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain loc-fb (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 4381 8599K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.1.9          multiport dports 80,443,9100
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.1.1          udp dpt:123
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22,2200:22999
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 /* Ping */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:33434:33524 /* Trcrt */
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain loc-fw (1 references)
 pkts bytes target     prot opt in     out     source               destination         
12075   72M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:2214
    0     0 reject     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto]  tcp dpt:22 /* SSH */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 443,5900:5999
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 /* Ping */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:33434:33524 /* Trcrt */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:111
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:111
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:2049
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:2049
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:32764:32769
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:32764:32769
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10809
 9216  700K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
 5030  302K reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain loc-net (2 references)
 pkts bytes target     prot opt in     out     source               destination         
66597 4727K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
  471 28240 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443,587 /* HTTP, HTTPS and others */
15473 1165K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 /* DNS */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 /* DNS */
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 /* Ping */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:33434:33524 /* Trcrt */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:11371
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:11371
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain loc-vpn (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 /* Ping */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:33434:33524 /* Trcrt */
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain loc_frwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 4381 8599K loc-fb     all  --  *      vmbr0   0.0.0.0/0            192.168.1.0/24      
28834 2232K loc-net    all  --  *      eno1    0.0.0.0/0            0.0.0.0/0           
53707 3688K loc-net    all  --  *      vmbr0   0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      vmbr1   0.0.0.0/0            192.168.100.0/24    
    0     0 loc-vpn    all  --  *      tun+    0.0.0.0/0            0.0.0.0/0           
46659  317M loc-dmz    all  --  *      vmbr2   0.0.0.0/0            0.0.0.0/0           

Chain logdrop (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain logflags (7 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip LOG flags 4 level 6 prefix "logflags DROP "
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain logreject (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain net-dmz (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 183K  228M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
 2894  165K ACCEPT     tcp  --  *      *       0.0.0.0/0            10.0.0.2             multiport dports 80,443
 2552  151K ACCEPT     tcp  --  eno1   *       0.0.0.0/0            10.0.0.4             multiport dports 25,143,465,587,993,995,4190 limit: avg 5/sec burst 10
    0     0 ACCEPT     tcp  --  eno1   *       0.0.0.0/0            10.0.0.2             multiport dports 80,443 limit: avg 5/sec burst 10
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
   10   600 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip LOG flags 0 level 6 prefix "net-dmz DROP "
   10   600 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain net-fb (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip LOG flags 0 level 6 prefix "net-fb DROP "
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain net-fw (2 references)
 pkts bytes target     prot opt in     out     source               destination         
 107K  357M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
 1514 72231 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 reject     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto]  tcp dpt:22 /* SSH */
 3860 1317K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip LOG flags 0 level 6 prefix "net-fw DROP "
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain net-loc (2 references)
 pkts bytes target     prot opt in     out     source               destination         
 125K  406M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip LOG flags 0 level 6 prefix "net-loc DROP "
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain net-vpn (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip LOG flags 0 level 6 prefix "net-vpn DROP "
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain net_frwd (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 net-fb     all  --  *      vmbr0   0.0.0.0/0            192.168.1.0/24      
    0     0 ACCEPT     all  --  *      eno1    0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      vmbr0   0.0.0.0/0            0.0.0.0/0           
 125K  406M net-loc    all  --  *      vmbr1   0.0.0.0/0            192.168.100.0/24    
    0     0 net-loc    all  --  *      vmbr1   0.0.0.0/0            224.0.0.0/4         
    0     0 net-vpn    all  --  *      tun+    0.0.0.0/0            0.0.0.0/0           
 188K  228M net-dmz    all  --  *      vmbr2   0.0.0.0/0            0.0.0.0/0           

Chain reject (22 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match src-type BROADCAST
    0     0 DROP       all  --  *      *       224.0.0.0/4          0.0.0.0/0           
    0     0 DROP       2    --  *      *       0.0.0.0/0            0.0.0.0/0           
 379K   23M REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with tcp-reset
  990 98089 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-unreachable
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain sfilter (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip LOG flags 0 level 6 prefix "sfilter DROP "
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain sha-lh-24b5debdfcce332a6854 (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain sha-rh-8cc83b877c2769f34c94 (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain shorewall (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0            all  --  *      *       0.0.0.0/0            0.0.0.0/0            recent: SET name: %CURRENTTIME side: source mask: 255.255.255.255

Chain smurflog (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip LOG flags 0 level 6 prefix "smurfs DROP "
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain smurfs (4 references)
 pkts bytes target     prot opt in     out     source               destination         
 3860 1317K RETURN     all  --  *      *       0.0.0.0              0.0.0.0/0           
    0     0 smurflog   all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto]  ADDRTYPE match src-type BROADCAST
    0     0 smurflog   all  --  *      *       224.0.0.0/4          0.0.0.0/0           [goto] 

Chain tcpflags (9 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 logflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto]  tcp flags:0x3F/0x29
    0     0 logflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto]  tcp flags:0x3F/0x00
    0     0 logflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto]  tcp flags:0x06/0x06
    0     0 logflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto]  tcp flags:0x05/0x05
    0     0 logflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto]  tcp flags:0x03/0x03
    0     0 logflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto]  tcp flags:0x19/0x09
    0     0 logflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto]  tcp spt:0 flags:0x17/0x02

Chain vpn-net (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 /* DNS */
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 53,11371 /* DNS and others */
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:11371
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
    0     0 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain vpn_frwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 sfilter    all  --  *      tun+    0.0.0.0/0            0.0.0.0/0           [goto] 
    0     0 dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
    0     0 tcpflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ~comb1     all  --  *      vmbr0   0.0.0.0/0            192.168.1.0/24      
    0     0 vpn-net    all  --  *      eno1    0.0.0.0/0            0.0.0.0/0           
    0     0 vpn-net    all  --  *      vmbr0   0.0.0.0/0            0.0.0.0/0           
    0     0 ~comb1     all  --  *      vmbr1   0.0.0.0/0            192.168.100.0/24    
    0     0 ~comb1     all  --  *      vmbr1   0.0.0.0/0            224.0.0.0/4         
    0     0 ~comb1     all  --  *      vmbr2   0.0.0.0/0            0.0.0.0/0           

Chain ~comb0 (2 references)
 pkts bytes target     prot opt in     out     source               destination         
 371K   22M dynamic    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
 362K   22M tcpflags   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 reject     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto]  tcp dpt:22 /* SSH */
 9216  700K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
 362K   22M reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Chain ~comb1 (6 references)
 pkts bytes target     prot opt in     out     source               destination         
 100K   46M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
  128 10392 reject     all  --  *      *       0.0.0.0/0            0.0.0.0/0           [goto] 

Log (/var/log/messages)

Feb 11 09:06:49 fb-fw REJECT IN=vmbr0 OUT= SRC=192.168.1.1 DST=192.168.1.14 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=26749 DF PROTO=TCP SPT=57285 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 MARK=0x20000 
Feb 11 09:13:21 fb-fw REJECT IN=vmbr0 OUT= SRC=192.168.1.1 DST=192.168.1.14 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=42184 DF PROTO=TCP SPT=57803 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 MARK=0x20000 
Feb 11 10:14:00 fb-fw REJECT IN=vmbr0 OUT= SRC=192.168.1.1 DST=192.168.1.14 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=60289 DF PROTO=TCP SPT=46086 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 MARK=0x20000 
Feb 11 10:24:47 fb-fw REJECT IN=vmbr0 OUT= SRC=192.168.1.1 DST=192.168.1.14 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=9862 DF PROTO=TCP SPT=44653 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 MARK=0x20000 
Feb 11 13:31:13 fb-fw REJECT IN=vmbr0 OUT= SRC=192.168.1.1 DST=192.168.1.14 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=62782 DF PROTO=TCP SPT=41082 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 MARK=0x20000 
Feb 11 14:36:05 fb-fw REJECT IN=vmbr0 OUT= SRC=192.168.1.1 DST=192.168.1.14 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=24969 DF PROTO=TCP SPT=47520 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 MARK=0x20000 

NAT Table

Chain PREROUTING (policy ACCEPT 1400 packets, 95090 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 5376  312K UPnP       all  --  eno1   *       0.0.0.0/0            0.0.0.0/0           
97127 7262K UPnP       all  --  vmbr0  *       0.0.0.0/0            0.0.0.0/0           
94939 6515K RETURN     all  --  vmbr0  *       192.168.1.0/24       0.0.0.0/0           
 5376  312K net_dnat   all  --  eno1   *       0.0.0.0/0            0.0.0.0/0           
 2188  746K net_dnat   all  --  vmbr0  *       0.0.0.0/0            0.0.0.0/0           

Chain INPUT (policy ACCEPT 6 packets, 1173 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 51 packets, 3876 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 1086 packets, 46280 bytes)
 pkts bytes target     prot opt in     out     source               destination         
17190 1273K SNAT       all  --  *      eno1    0.0.0.0/0            0.0.0.0/0            to:78.94.230.158

Chain UPnP (2 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain net_dnat (2 references)
 pkts bytes target     prot opt in     out     source               destination         
 2532  150K DNAT       tcp  --  eno1   *       0.0.0.0/0            0.0.0.0/0            multiport dports 25,143,465,587,993,995,4190 to:10.0.0.4
 2844  163K DNAT       tcp  --  eno1   *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443 to:10.0.0.2

Mangle Table

Chain PREROUTING (policy ACCEPT 24274 packets, 28M bytes)
 pkts bytes target     prot opt in     out     source               destination         
1392K 1514M CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0            CONNMARK restore mask 0x30000
24077 2368K routemark  all  --  eno1   *       0.0.0.0/0            0.0.0.0/0            mark match 0x0/0x30000
 109K 9203K routemark  all  --  vmbr0  *       0.0.0.0/0            0.0.0.0/0            mark match 0x0/0x30000

Chain INPUT (policy ACCEPT 3376 packets, 227K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 20560 packets, 27M bytes)
 pkts bytes target     prot opt in     out     source               destination         
 719K 1043M MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            MARK and 0xfffcffff

Chain OUTPUT (policy ACCEPT 3109 packets, 1383K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 550K   65M CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0            CONNMARK restore mask 0x30000

Chain POSTROUTING (policy ACCEPT 23699 packets, 29M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain routemark (2 references)
 pkts bytes target     prot opt in     out     source               destination         
24077 2368K MARK       all  --  eno1   *       0.0.0.0/0            0.0.0.0/0            MARK xset 0x10000/0x30000
 109K 9203K MARK       all  --  vmbr0  *       0.0.0.0/0            0.0.0.0/0            MARK xset 0x20000/0x30000
 133K   12M CONNMARK   all  --  *      *       0.0.0.0/0            0.0.0.0/0            mark match ! 0x0/0x30000 CONNMARK save mask 0x30000

Raw Table

Chain PREROUTING (policy ACCEPT 24274 packets, 28M bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CT         udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:10080 CT helper amanda
    0     0 CT         tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:21 CT helper ftp
    0     0 CT         udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1719 CT helper RAS
    0     0 CT         tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:1720 CT helper Q.931
    0     0 CT         tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6667 CT helper irc
15635 1243K CT         udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:137 CT helper netbios-ns
    0     0 CT         tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:1723 CT helper pptp
    0     0 CT         tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6566 CT helper sane
    0     0 CT         udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:5060 CT helper sip
    0     0 CT         udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:161 CT helper snmp
    0     0 CT         udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:69 CT helper tftp

Chain OUTPUT (policy ACCEPT 3109 packets, 1383K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 CT         udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:10080 CT helper amanda
    0     0 CT         tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:21 CT helper ftp
    0     0 CT         udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1719 CT helper RAS
    0     0 CT         tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:1720 CT helper Q.931
    0     0 CT         tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6667 CT helper irc
    0     0 CT         udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:137 CT helper netbios-ns
    0     0 CT         tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:1723 CT helper pptp
    0     0 CT         tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6566 CT helper sane
    0     0 CT         udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:5060 CT helper sip
    0     0 CT         udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:161 CT helper snmp
    0     0 CT         udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:69 CT helper tftp

Conntrack Table (14 out of 262144)


IP Configuration

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    inet 78.94.230.158/30 brd 78.94.230.159 scope global eno1
       valid_lft forever preferred_lft forever
6: vmbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168.1.14/24 brd 192.168.1.255 scope global vmbr0
       valid_lft forever preferred_lft forever
7: vmbr1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168.100.1/24 brd 192.168.100.255 scope global vmbr1
       valid_lft forever preferred_lft forever
8: vmbr2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 10.0.0.1/24 brd 10.0.0.255 scope global vmbr2
       valid_lft forever preferred_lft forever

IP Stats

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    RX: bytes  packets  errors  dropped overrun mcast   
    210114070  872741   0       0       0       0       
    TX: bytes  packets  errors  dropped carrier collsns 
    210114070  872741   0       0       0       0       
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether 74:d4:35:1a:f6:0f brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    2437159327 2261613  0       5       0       40      
    TX: bytes  packets  errors  dropped carrier collsns 
    152306223  982374   0       0       0       0       
3: enp1s0f0: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master bond0 state UP mode DEFAULT group default qlen 1000
    link/ether 00:15:17:91:9c:b8 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    18379720101 17780029 0       0       0       1836105 
    TX: bytes  packets  errors  dropped carrier collsns 
    2273581294 8246061  0       0       0       0       
4: enp1s0f1: <NO-CARRIER,BROADCAST,MULTICAST,SLAVE,UP> mtu 1500 qdisc pfifo_fast master bond0 state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:15:17:91:9c:b8 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    4468       63       0       0       0       4       
    TX: bytes  packets  errors  dropped carrier collsns 
    2502       27       0       0       0       0       
5: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue master vmbr0 state UP mode DEFAULT group default qlen 1000
    link/ether 00:15:17:91:9c:b8 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    18379724569 17780092 0       0       0       1836109 
    TX: bytes  packets  errors  dropped carrier collsns 
    2273583796 8246088  0       0       0       0       
6: vmbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 00:15:17:91:9c:b8 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    7300380209 6067867  0       1435479 0       0       
    TX: bytes  packets  errors  dropped carrier collsns 
    1697701149 3165898  0       0       0       0       
7: vmbr1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether fe:6b:ce:d2:a7:f2 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    2826769581 1899680  0       0       0       0       
    TX: bytes  packets  errors  dropped carrier collsns 
    4589130291 2159062  0       0       0       0       
8: vmbr2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether fe:aa:20:0a:61:85 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    430552688  3467856  0       0       0       0       
    TX: bytes  packets  errors  dropped carrier collsns 
    2855010225 3515721  0       0       0       0       
10: veth102i0@if9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master vmbr2 state UP mode DEFAULT group default qlen 1000
    link/ether fe:aa:20:0a:61:85 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    RX: bytes  packets  errors  dropped overrun mcast   
    478855273  5899900  0       0       0       0       
    TX: bytes  packets  errors  dropped carrier collsns 
    289545598  3148096  0       0       0       0       
18: veth108i0@if17: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master vmbr2 state UP mode DEFAULT group default qlen 1000
    link/ether fe:19:a3:72:68:3d brd ff:ff:ff:ff:ff:ff link-netnsid 4
    RX: bytes  packets  errors  dropped overrun mcast   
    110577865  1477839  0       0       0       0       
    TX: bytes  packets  errors  dropped carrier collsns 
    209694367  2894538  0       0       0       0       
19: tap123i0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master vmbr0 state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether ba:92:ed:9d:de:96 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    500059492  4737652  0       0       0       0       
    TX: bytes  packets  errors  dropped carrier collsns 
    10985489591 11330009 0       2173    0       0       
21: veth103i0@if20: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master vmbr2 state UP mode DEFAULT group default qlen 1000
    link/ether fe:93:fd:28:b0:01 brd ff:ff:ff:ff:ff:ff link-netnsid 2
    RX: bytes  packets  errors  dropped overrun mcast   
    145235717  1305463  0       0       0       0       
    TX: bytes  packets  errors  dropped carrier collsns 
    829852817  1480316  0       0       0       0       
25: veth109i0@if24: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master vmbr1 state UP mode DEFAULT group default qlen 1000
    link/ether fe:6b:ce:d2:a7:f2 brd ff:ff:ff:ff:ff:ff link-netnsid 1
    RX: bytes  packets  errors  dropped overrun mcast   
    2429948254 906922   0       0       0       0       
    TX: bytes  packets  errors  dropped carrier collsns 
    2212732083 1213103  0       0       0       0       
27: veth104i0@if26: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master vmbr2 state UP mode DEFAULT group default qlen 1000
    link/ether fe:52:6f:d1:87:ec brd ff:ff:ff:ff:ff:ff link-netnsid 3
    RX: bytes  packets  errors  dropped overrun mcast   
    368131156  3034410  0       0       0       0       
    TX: bytes  packets  errors  dropped carrier collsns 
    1208134991 4105605  0       0       0       0       
33: veth110i0@if32: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master vmbr1 state UP mode DEFAULT group default qlen 1000
    link/ether fe:6f:f1:94:e8:17 brd ff:ff:ff:ff:ff:ff link-netnsid 5
    RX: bytes  packets  errors  dropped overrun mcast   
    6002795    29317    0       0       0       0       
    TX: bytes  packets  errors  dropped carrier collsns 
    88581919   156615   0       0       0       0       
52: tap200i0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master vmbr1 state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether ae:83:16:26:a8:73 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    15262473   88372    0       0       0       0       
    TX: bytes  packets  errors  dropped carrier collsns 
    1207224    13488    0       0       0       0       
55: tap100i0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master vmbr2 state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether c2:23:ed:b0:a0:5f brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast   
    1733753    18698    0       0       0       0       
    TX: bytes  packets  errors  dropped carrier collsns 
    36968051   31466    0       0       0       0       

Bridges

bridge name	bridge id		STP enabled	interfaces
vmbr0		8000.001517919cb8	no		bond0
							tap123i0
vmbr1		8000.fe6bced2a7f2	no		tap200i0
							veth109i0
							veth110i0
vmbr2		8000.feaa200a6185	no		tap100i0
							veth102i0
							veth103i0
							veth104i0
							veth108i0

Routing Rules

0:	from all lookup local 
999:	from all lookup main 
1000:	from 78.94.230.158 lookup um_business 
1000:	from 192.168.1.14 lookup um_private 
10000:	from all fwmark 0x10000/0x30000 lookup um_business 
10001:	from all fwmark 0x20000/0x30000 lookup um_private 
11000:	from 10.0.0.1 lookup um_business 
11000:	from 192.168.100.1 lookup um_private 
20000:	from 78.94.230.158 lookup um_business 
20000:	from 192.168.1.14 lookup um_private 
32765:	from all lookup balance 
32767:	from all lookup default 

Table balance:

default nexthop via 78.94.230.157 dev eno1 weight 1 nexthop via 192.168.1.1 dev vmbr0 weight 1

Table default:


Table local:

local 78.94.230.158 dev eno1 proto kernel scope host src 78.94.230.158
local 192.168.1.14 dev vmbr0 proto kernel scope host src 192.168.1.14
local 192.168.100.1 dev vmbr1 proto kernel scope host src 192.168.100.1
local 127.0.0.1 dev lo proto kernel scope host src 127.0.0.1
local 10.0.0.1 dev vmbr2 proto kernel scope host src 10.0.0.1
broadcast 78.94.230.159 dev eno1 proto kernel scope link src 78.94.230.158
broadcast 78.94.230.156 dev eno1 proto kernel scope link src 78.94.230.158
broadcast 192.168.1.255 dev vmbr0 proto kernel scope link src 192.168.1.14
broadcast 192.168.1.0 dev vmbr0 proto kernel scope link src 192.168.1.14
broadcast 192.168.100.255 dev vmbr1 proto kernel scope link src 192.168.100.1
broadcast 192.168.100.0 dev vmbr1 proto kernel scope link src 192.168.100.1
broadcast 127.255.255.255 dev lo proto kernel scope link src 127.0.0.1
broadcast 127.0.0.0 dev lo proto kernel scope link src 127.0.0.1
broadcast 10.0.0.255 dev vmbr2 proto kernel scope link src 10.0.0.1
broadcast 10.0.0.0 dev vmbr2 proto kernel scope link src 10.0.0.1
local 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1

Table main:

78.94.230.157 dev eno1 scope link src 78.94.230.158
192.168.1.1 dev vmbr0 scope link src 192.168.1.14
78.94.230.156/30 dev eno1 proto kernel scope link src 78.94.230.158
192.168.1.0/24 dev vmbr0 proto kernel scope link src 192.168.1.14
192.168.100.0/24 dev vmbr1 proto kernel scope link src 192.168.100.1
10.0.0.0/24 dev vmbr2 proto kernel scope link src 10.0.0.1

Table um_business:

78.94.230.157 dev eno1 scope link src 78.94.230.158
default via 78.94.230.157 dev eno1 src 78.94.230.158

Table um_private:

192.168.1.1 dev vmbr0 scope link src 192.168.1.14
default via 192.168.1.1 dev vmbr0 src 192.168.1.14

Per-IP Counters

   iptaccount is not installed

NF Accounting

No NF Accounting defined (nfacct not found)

Events


PFKEY SPD


PFKEY SAD


/proc

   /proc/version = Linux version 4.13.13-3-pve (root@evita) (gcc version 6.3.0 20170516 (Debian 6.3.0-18)) #1 SMP PVE 4.13.13-34 (Sun, 7 Jan 2018 13:19:58 +0100)
   /proc/sys/net/ipv4/ip_forward = 1
   /proc/sys/net/ipv4/icmp_echo_ignore_all = 0
   /proc/sys/net/ipv4/conf/all/proxy_arp = 0
   /proc/sys/net/ipv4/conf/all/arp_filter = 0
   /proc/sys/net/ipv4/conf/all/arp_ignore = 0
   /proc/sys/net/ipv4/conf/all/rp_filter = 0
   /proc/sys/net/ipv4/conf/all/log_martians = 0
   /proc/sys/net/ipv4/conf/bond0/proxy_arp = 0
   /proc/sys/net/ipv4/conf/bond0/arp_filter = 0
   /proc/sys/net/ipv4/conf/bond0/arp_ignore = 0
   /proc/sys/net/ipv4/conf/bond0/rp_filter = 0
   /proc/sys/net/ipv4/conf/bond0/log_martians = 1
   /proc/sys/net/ipv4/conf/default/proxy_arp = 0
   /proc/sys/net/ipv4/conf/default/arp_filter = 0
   /proc/sys/net/ipv4/conf/default/arp_ignore = 0
   /proc/sys/net/ipv4/conf/default/rp_filter = 0
   /proc/sys/net/ipv4/conf/default/log_martians = 1
   /proc/sys/net/ipv4/conf/eno1/proxy_arp = 0
   /proc/sys/net/ipv4/conf/eno1/arp_filter = 0
   /proc/sys/net/ipv4/conf/eno1/arp_ignore = 1
   /proc/sys/net/ipv4/conf/eno1/rp_filter = 0
   /proc/sys/net/ipv4/conf/eno1/log_martians = 1
   /proc/sys/net/ipv4/conf/enp1s0f0/proxy_arp = 0
   /proc/sys/net/ipv4/conf/enp1s0f0/arp_filter = 0
   /proc/sys/net/ipv4/conf/enp1s0f0/arp_ignore = 0
   /proc/sys/net/ipv4/conf/enp1s0f0/rp_filter = 0
   /proc/sys/net/ipv4/conf/enp1s0f0/log_martians = 1
   /proc/sys/net/ipv4/conf/enp1s0f1/proxy_arp = 0
   /proc/sys/net/ipv4/conf/enp1s0f1/arp_filter = 0
   /proc/sys/net/ipv4/conf/enp1s0f1/arp_ignore = 0
   /proc/sys/net/ipv4/conf/enp1s0f1/rp_filter = 0
   /proc/sys/net/ipv4/conf/enp1s0f1/log_martians = 1
   /proc/sys/net/ipv4/conf/lo/proxy_arp = 0
   /proc/sys/net/ipv4/conf/lo/arp_filter = 0
   /proc/sys/net/ipv4/conf/lo/arp_ignore = 0
   /proc/sys/net/ipv4/conf/lo/rp_filter = 0
   /proc/sys/net/ipv4/conf/lo/log_martians = 1
   /proc/sys/net/ipv4/conf/tap100i0/proxy_arp = 0
   /proc/sys/net/ipv4/conf/tap100i0/arp_filter = 0
   /proc/sys/net/ipv4/conf/tap100i0/arp_ignore = 0
   /proc/sys/net/ipv4/conf/tap100i0/rp_filter = 0
   /proc/sys/net/ipv4/conf/tap100i0/log_martians = 1
   /proc/sys/net/ipv4/conf/tap123i0/proxy_arp = 0
   /proc/sys/net/ipv4/conf/tap123i0/arp_filter = 0
   /proc/sys/net/ipv4/conf/tap123i0/arp_ignore = 0
   /proc/sys/net/ipv4/conf/tap123i0/rp_filter = 0
   /proc/sys/net/ipv4/conf/tap123i0/log_martians = 1
   /proc/sys/net/ipv4/conf/tap200i0/proxy_arp = 0
   /proc/sys/net/ipv4/conf/tap200i0/arp_filter = 0
   /proc/sys/net/ipv4/conf/tap200i0/arp_ignore = 0
   /proc/sys/net/ipv4/conf/tap200i0/rp_filter = 0
   /proc/sys/net/ipv4/conf/tap200i0/log_martians = 1
   /proc/sys/net/ipv4/conf/veth102i0/proxy_arp = 0
   /proc/sys/net/ipv4/conf/veth102i0/arp_filter = 0
   /proc/sys/net/ipv4/conf/veth102i0/arp_ignore = 0
   /proc/sys/net/ipv4/conf/veth102i0/rp_filter = 0
   /proc/sys/net/ipv4/conf/veth102i0/log_martians = 1
   /proc/sys/net/ipv4/conf/veth103i0/proxy_arp = 0
   /proc/sys/net/ipv4/conf/veth103i0/arp_filter = 0
   /proc/sys/net/ipv4/conf/veth103i0/arp_ignore = 0
   /proc/sys/net/ipv4/conf/veth103i0/rp_filter = 0
   /proc/sys/net/ipv4/conf/veth103i0/log_martians = 1
   /proc/sys/net/ipv4/conf/veth104i0/proxy_arp = 0
   /proc/sys/net/ipv4/conf/veth104i0/arp_filter = 0
   /proc/sys/net/ipv4/conf/veth104i0/arp_ignore = 0
   /proc/sys/net/ipv4/conf/veth104i0/rp_filter = 0
   /proc/sys/net/ipv4/conf/veth104i0/log_martians = 1
   /proc/sys/net/ipv4/conf/veth108i0/proxy_arp = 0
   /proc/sys/net/ipv4/conf/veth108i0/arp_filter = 0
   /proc/sys/net/ipv4/conf/veth108i0/arp_ignore = 0
   /proc/sys/net/ipv4/conf/veth108i0/rp_filter = 0
   /proc/sys/net/ipv4/conf/veth108i0/log_martians = 1
   /proc/sys/net/ipv4/conf/veth109i0/proxy_arp = 0
   /proc/sys/net/ipv4/conf/veth109i0/arp_filter = 0
   /proc/sys/net/ipv4/conf/veth109i0/arp_ignore = 0
   /proc/sys/net/ipv4/conf/veth109i0/rp_filter = 0
   /proc/sys/net/ipv4/conf/veth109i0/log_martians = 1
   /proc/sys/net/ipv4/conf/veth110i0/proxy_arp = 0
   /proc/sys/net/ipv4/conf/veth110i0/arp_filter = 0
   /proc/sys/net/ipv4/conf/veth110i0/arp_ignore = 0
   /proc/sys/net/ipv4/conf/veth110i0/rp_filter = 0
   /proc/sys/net/ipv4/conf/veth110i0/log_martians = 1
   /proc/sys/net/ipv4/conf/vmbr0/proxy_arp = 0
   /proc/sys/net/ipv4/conf/vmbr0/arp_filter = 0
   /proc/sys/net/ipv4/conf/vmbr0/arp_ignore = 1
   /proc/sys/net/ipv4/conf/vmbr0/rp_filter = 0
   /proc/sys/net/ipv4/conf/vmbr0/log_martians = 1
   /proc/sys/net/ipv4/conf/vmbr1/proxy_arp = 0
   /proc/sys/net/ipv4/conf/vmbr1/arp_filter = 0
   /proc/sys/net/ipv4/conf/vmbr1/arp_ignore = 0
   /proc/sys/net/ipv4/conf/vmbr1/rp_filter = 1
   /proc/sys/net/ipv4/conf/vmbr1/log_martians = 1
   /proc/sys/net/ipv4/conf/vmbr2/proxy_arp = 1
   /proc/sys/net/ipv4/conf/vmbr2/arp_filter = 0
   /proc/sys/net/ipv4/conf/vmbr2/arp_ignore = 0
   /proc/sys/net/ipv4/conf/vmbr2/rp_filter = 0
   /proc/sys/net/ipv4/conf/vmbr2/log_martians = 1

ARP

? (10.0.0.3) auf 32:65:65:39:30:35 [ether] auf vmbr2
? (10.0.0.9) auf <unvollständig> auf vmbr2
? (10.0.0.100) auf de:0e:8c:c9:7b:31 [ether] auf vmbr2
? (192.168.1.52) auf cc:3a:61:8b:c5:29 [ether] auf vmbr0
? (192.168.1.50) auf 00:90:4c:9d:e8:06 [ether] auf vmbr0
? (192.168.1.48) auf 58:94:6b:a4:2a:cc [ether] auf vmbr0
? (192.168.1.60) auf <unvollständig> auf vmbr0
? (192.168.1.56) auf 70:28:8b:c8:bb:2d [ether] auf vmbr0
? (192.168.1.58) auf 00:bb:3a:6b:87:86 [ether] auf vmbr0
? (192.168.100.9) auf 0e:f0:d7:76:ef:0d [ether] auf vmbr1
? (192.168.1.44) auf 00:90:4c:94:ff:99 [ether] auf vmbr0
? (192.168.1.40) auf 00:90:4c:10:ab:f4 [ether] auf vmbr0
? (192.168.1.42) auf bc:5f:f4:79:98:f2 [ether] auf vmbr0
? (192.168.100.100) auf <unvollständig> auf vmbr1
? (192.168.1.30) auf a8:13:74:42:0c:ba [ether] auf vmbr0
? (192.168.1.123) auf 32:33:64:34:38:63 [ether] auf vmbr0
? (10.0.0.4) auf 32:32:31:33:38:30 [ether] auf vmbr2
? (10.0.0.2) auf d6:b6:21:29:10:e6 [ether] auf vmbr2
? (10.0.0.8) auf 1e:68:fe:40:78:57 [ether] auf vmbr2
? (10.0.0.101) auf <unvollständig> auf vmbr2
? (192.168.1.53) auf 84:8e:df:73:61:3a [ether] auf vmbr0
? (192.168.1.51) auf f0:25:b7:3f:b6:f0 [ether] auf vmbr0
? (192.168.1.61) auf <unvollständig> auf vmbr0
? (192.168.100.10) auf 12:88:60:c7:c8:6b [ether] auf vmbr1
? (192.168.1.47) auf 00:90:4c:59:6a:b4 [ether] auf vmbr0
? (192.168.1.43) auf 00:90:4c:10:11:96 [ether] auf vmbr0
? (192.168.100.250) auf <unvollständig> auf vmbr1
? (192.168.1.1) auf c8:0e:14:de:97:70 [ether] auf vmbr0
? (78.94.230.157) auf c8:0e:14:de:97:70 [ether] auf eno1

Modules

ip_set                 36864  2 xt_set,ip_set_hash_ip
ip_set_hash_ip         32768  0
iptable_filter         16384  3
iptable_mangle         16384  1
iptable_nat            16384  1
iptable_raw            16384  1
ip_tables              28672  4 iptable_mangle,iptable_filter,iptable_raw,iptable_nat
ipt_MASQUERADE         16384  0
ipt_REJECT             16384  4
ipt_rpfilter           16384  0
nf_conntrack          131072  33 nf_nat_pptp,nf_conntrack_sip,nf_conntrack_snmp,nf_conntrack_irc,xt_nat,nf_nat_h323,nf_conntrack_ftp,nf_nat_snmp_basic,nf_nat_sip,nf_conntrack_ipv4,nf_conntrack_tftp,xt_NETMAP,ipt_MASQUERADE,nf_nat_irc,xt_connmark,nf_conntrack_pptp,nf_conntrack_amanda,xt_helper,nf_conntrack_broadcast,nf_nat_ftp,nf_conntrack_sane,nf_nat_amanda,xt_connlimit,nf_conntrack_netlink,nf_conntrack_netbios_ns,nf_conntrack_proto_gre,xt_CT,nf_nat_masquerade_ipv4,nf_conntrack_h323,xt_conntrack,nf_nat_ipv4,nf_nat_tftp,nf_nat
nf_conntrack_amanda    16384  3 nf_nat_amanda
nf_conntrack_broadcast    16384  2 nf_conntrack_snmp,nf_conntrack_netbios_ns
nf_conntrack_ftp       20480  3 nf_nat_ftp
nf_conntrack_h323      73728  5 nf_nat_h323
nf_conntrack_ipv4      16384  67
nf_conntrack_irc       16384  3 nf_nat_irc
nf_conntrack_netbios_ns    16384  2
nf_conntrack_netlink    40960  0
nf_conntrack_pptp      16384  3 nf_nat_pptp
nf_conntrack_proto_gre    16384  1 nf_conntrack_pptp
nf_conntrack_sane      16384  2
nf_conntrack_sip       28672  3 nf_nat_sip
nf_conntrack_snmp      16384  3 nf_nat_snmp_basic
nf_conntrack_tftp      16384  3 nf_nat_tftp
nf_defrag_ipv4         16384  2 nf_conntrack_ipv4,xt_TPROXY
nf_defrag_ipv6         36864  1 xt_TPROXY
nf_log_common          16384  1 nf_log_ipv4
nf_log_ipv4            16384  13
nf_nat                 28672  12 nf_nat_pptp,nf_nat_proto_gre,xt_nat,nf_nat_h323,nf_nat_sip,xt_NETMAP,nf_nat_irc,nf_nat_ftp,nf_nat_amanda,nf_nat_masquerade_ipv4,nf_nat_ipv4,nf_nat_tftp
nf_nat_amanda          16384  0
nf_nat_ftp             16384  0
nf_nat_h323            20480  0
nf_nat_ipv4            16384  1 iptable_nat
nf_nat_irc             16384  0
nf_nat_masquerade_ipv4    16384  1 ipt_MASQUERADE
nf_nat_pptp            16384  0
nf_nat_proto_gre       16384  1 nf_nat_pptp
nf_nat_sip             20480  0
nf_nat_snmp_basic      20480  0
nf_nat_tftp            16384  0
nf_reject_ipv4         16384  1 ipt_REJECT
xt_addrtype            16384  68
xt_AUDIT               16384  0
xt_CHECKSUM            16384  0
xt_CLASSIFY            16384  0
xt_comment             16384  37
xt_connlimit           16384  0
xt_connmark            16384  3
xt_conntrack           16384  38
xt_CT                  16384  22
xt_dscp                16384  0
xt_DSCP                16384  0
xt_hashlimit           20480  13
xt_helper              16384  0
xt_iprange             16384  0
xt_length              16384  0
xt_limit               16384  2
xt_LOG                 16384  13
xt_mark                16384  6
xt_multiport           16384  28
xt_nat                 16384  3
xt_NETMAP              16384  0
xt_NFLOG               16384  0
xt_NFQUEUE             16384  0
xt_owner               16384  0
xt_physdev             16384  0
xt_pkttype             16384  0
xt_policy              16384  0
xt_realm               16384  0
xt_recent              20480  1
xt_set                 16384  0
xt_statistic           16384  0
xt_tcpmss              16384  0
xt_TCPMSS              16384  0
xt_tcpudp              16384  93
xt_time                16384  0
xt_TPROXY              20480  0

Shorewall has detected the following iptables/netfilter capabilities:
   ACCOUNT Target (ACCOUNT_TARGET): Not available
   Address Type Match (ADDRTYPE): Available
   Amanda Helper: Available
   Arptables JF (ARPTABLESJF): Not available
   AUDIT Target (AUDIT_TARGET): Available
   Basic Ematch (BASIC_EMATCH): Available
   Basic Filter (BASIC_FILTER): Available
   Capabilities Version (CAPVERSION): 50106
   Checksum Target (CHECKSUM_TARGET): Available
   CLASSIFY Target (CLASSIFY_TARGET): Available
   Comments (COMMENTS): Available
   Condition Match (CONDITION_MATCH): Not available
   Connection Tracking Match (CONNTRACK_MATCH): Available
   Connlimit Match (CONNLIMIT_MATCH): Available
   Connmark Match (CONNMARK_MATCH): Available
   CONNMARK Target (CONNMARK): Available
   CT Target (CT_TARGET): Available
   DSCP Match (DSCP_MATCH): Available
   DSCP Target (DSCP_TARGET): Available
   Enhanced Multi-port Match (EMULIPORT): Available
   Extended Connection Tracking Match Support (NEW_CONNTRACK_MATCH): Available
   Extended Connmark Match (XCONNMARK_MATCH): Available
   Extended CONNMARK Target (XCONNMARK): Available
   Extended MARK Target 2 (EXMARK): Available
   Extended MARK Target (XMARK): Available
   Extended Multi-port Match (XMULIPORT): Available
   Extended REJECT (ENHANCED_REJECT): Available
   FLOW Classifier (FLOW_FILTER): Available
   FTP-0 Helper: Not available
   FTP Helper: Available
   fwmark route mask (FWMARK_RT_MASK): Available
   Geo IP Match (GEOIP_MATCH): Not available
   Goto Support (GOTO_TARGET): Available
   H323 Helper: Available
   Hashlimit Match (HASHLIMIT_MATCH): Available
   Header Match (HEADER_MATCH): Not available
   Helper Match (HELPER_MATCH): Available
   Iface Match (IFACE_MATCH): Not available
   IMQ Target (IMQ_TARGET): Not available
   IPMARK Target (IPMARK_TARGET): Not available
   IPP2P Match (IPP2P_MATCH): Not available
   IP range Match(IPRANGE_MATCH): Available
   Ipset Match Counters (IPSET_MATCH_COUNTERS): Available
   Ipset Match (IPSET_MATCH): Available
   Ipset Match Nomatch (IPSET_MATCH_NOMATCH): Available
   ipset V5 (IPSET_V5): Available
   iptables-restore --wait option (RESTORE_WAIT_OPTION): Not available
   iptables -S (IPTABLES_S): Available
   iptables --wait option (WAIT_OPTION): Available
   IRC-0 Helper: Not available
   IRC Helper: Available
   Kernel Version (KERNELVERSION): 41313
   LOGMARK Target (LOGMARK_TARGET): Not available
   LOG Target (LOG_TARGET): Available
   Mangle FORWARD Chain (MANGLE_FORWARD): Available
   Mark in the filter table (MARK_ANYWHERE): Available
   MARK Target (MARK): Available
   MASQUERADE Target (MASQUERADE_TGT): Available
   Multi-port Match (MULTIPORT): Available
   NAT (NAT_ENABLED): Available
   Netbios_ns Helper: Available
   NETMAP Target (NETMAP_TARGET): Available
   New tos Match (NEW_TOS_MATCH): Available
   NFAcct Match: Not available
   --nflog-size support (NFLOG_SIZE): Available
   NFLOG Target (NFLOG_TARGET): Available
   NFQUEUE CPU Fanout (CPU_FANOUT): Available
   NFQUEUE Target (NFQUEUE_TARGET): Available
   Owner Match (OWNER_MATCH): Available
   Owner Name Match (OWNER_NAME_MATCH): Available
   Packet length Match (LENGTH_MATCH): Available
   Packet Mangling (MANGLE_ENABLED): Available
   Packet Type Match (USEPKTTYPE): Available
   Persistent SNAT (PERSISTENT_SNAT): Available
   Physdev-is-bridged Support (PHYSDEV_BRIDGE): Available
   Physdev Match (PHYSDEV_MATCH): Available
   Policy Match (POLICY_MATCH): Available
   PPTP Helper: Available
   Raw Table (RAW_TABLE): Available
   Realm Match (REALM_MATCH): Available
   Recent Match "--reap" option (REAP_OPTION): Available
   Recent Match (RECENT_MATCH): Available
   Repeat match (KLUDGEFREE): Available
   RPFilter Match (RPFILTER_MATCH): Available
   SANE-0 Helper: Not available
   SANE Helper: Available
   SIP-0 Helper: Not available
   SIP Helper: Available
   SNMP Helper: Available
   Statistic Match (STATISTIC_MATCH): Available
   TARPIT Target (TARPIT_TARGET): Not available
   TCPMSS Match (TCPMSS_MATCH): Available
   TCPMSS Target (TCPMSS_TARGET): Available
   TFTP-0 Helper: Not available
   TFTP Helper: Available
   Time Match (TIME_MATCH): Available
   TPROXY Target (TPROXY_TARGET): Available
   UDPLITE Port Redirection (UDPLITEREDIRECT): Not available
   ULOG Target (ULOG_TARGET): Not available

Netid  State      Recv-Q Send-Q Local Address:Port               Peer Address:Port              
udp    UNCONN     0      0         *:111                   *:*                   users:(("rpcbind",pid=711,fd=6))
udp    UNCONN     0      0      78.94.230.158:123                   *:*                   users:(("ntpd",pid=19745,fd=19))
udp    UNCONN     0      0      192.168.100.1:123                   *:*                   users:(("ntpd",pid=19745,fd=21))
udp    UNCONN     0      0      10.0.0.1:123                   *:*                   users:(("ntpd",pid=19745,fd=22))
udp    UNCONN     0      0      192.168.1.14:123                   *:*                   users:(("ntpd",pid=19745,fd=20))
udp    UNCONN     0      0      127.0.0.1:123                   *:*                   users:(("ntpd",pid=19745,fd=18))
udp    UNCONN     0      0         *:123                   *:*                   users:(("ntpd",pid=19745,fd=17))
udp    UNCONN     0      0         *:887                   *:*                   users:(("rpcbind",pid=711,fd=7))
tcp    LISTEN     0      128       *:8006                  *:*                   users:(("pveproxy worker",pid=20469,fd=6),("pveproxy worker",pid=20468,fd=6),("pveproxy worker",pid=20467,fd=6),("pveproxy",pid=1928,fd=6))
tcp    LISTEN     0      128       *:2214                  *:*                   users:(("sshd",pid=1546,fd=3))
tcp    LISTEN     0      32     127.0.0.1:5900                  *:*                   users:(("lxc-console",pid=23103,fd=3),("dtach",pid=23102,fd=3))
tcp    LISTEN     0      32     127.0.0.1:5901                  *:*                   users:(("lxc-console",pid=18088,fd=3),("dtach",pid=18087,fd=3))
tcp    LISTEN     0      128       *:111                   *:*                   users:(("rpcbind",pid=711,fd=8))
tcp    LISTEN     0      32     127.0.0.1:5904                  *:*                   users:(("lxc-console",pid=21813,fd=3),("dtach",pid=21812,fd=3))
tcp    LISTEN     0      128    127.0.0.1:85                    *:*                   users:(("pvedaemon worke",pid=14359,fd=6),("pvedaemon worke",pid=14358,fd=6),("pvedaemon worke",pid=14357,fd=6),("pvedaemon",pid=1865,fd=6))
tcp    LISTEN     0      128       *:3128                  *:*                   users:(("spiceproxy work",pid=20518,fd=6),("spiceproxy",pid=1957,fd=6))
tcp    ESTAB      0      0      192.168.1.14:2214               192.168.1.48:55460               users:(("sshd",pid=8542,fd=3),("sshd",pid=8315,fd=3))

Traffic Control

Device lo:
qdisc noqueue 0: root refcnt 2 
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device eno1:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 146251517 bytes 982374 pkt (dropped 0, overlimits 0 requeues 175) 
 backlog 0b 0p requeues 175 


Device enp1s0f0:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 2219004857 bytes 8246061 pkt (dropped 0, overlimits 0 requeues 705) 
 backlog 0b 0p requeues 705 


Device enp1s0f1:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 2346 bytes 27 pkt (dropped 0, overlimits 0 requeues 1) 
 backlog 0b 0p requeues 1 


Device bond0:
qdisc noqueue 0: root refcnt 2 
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device vmbr0:
qdisc noqueue 0: root refcnt 2 
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device vmbr1:
qdisc noqueue 0: root refcnt 2 
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device vmbr2:
qdisc noqueue 0: root refcnt 2 
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device veth102i0:
qdisc noqueue 0: root refcnt 2 
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device veth108i0:
qdisc noqueue 0: root refcnt 2 
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device tap123i0:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 10985648106 bytes 11332182 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device veth103i0:
qdisc noqueue 0: root refcnt 2 
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device veth109i0:
qdisc noqueue 0: root refcnt 2 
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device veth104i0:
qdisc noqueue 0: root refcnt 2 
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device veth110i0:
qdisc noqueue 0: root refcnt 2 
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device tap200i0:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 1207224 bytes 13488 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 


Device tap100i0:
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 37858349 bytes 46881 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0 



TC Filters

Device lo:

Device eno1:

Device enp1s0f0:

Device enp1s0f1:

Device bond0:

Device vmbr0:

Device vmbr1:

Device vmbr2:

Device veth102i0:

Device veth108i0:

Device tap123i0:

Device veth103i0:

Device veth109i0:

Device veth104i0:

Device veth110i0:

Device tap200i0:

Device tap100i0:

