Compiling using Shorewall 5.2.3.3...
IN===> 5.2.3.3
Processing /etc/shorewall/params ...
Params:
export HOME="/root"
export LANG="en_US.UTF-8"
export LC_CTYPE="en_US.UTF-8"
export LOGNAME="root"
export LS_COLORS="rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:"
export MAIL="/var/mail/root"
export OLDPWD
export PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin"
export PWD="/home/wolferz"
export SHELL="/bin/zsh"
export SHLVL="2"
export SUDO_COMMAND="/usr/sbin/shorewall trace compile"
export SUDO_GID="1000"
export SUDO_UID="1000"
export SUDO_USER="wolferz"
export SW_CONFDIR="/etc/shorewall"
export TERM="tmux-256color"
export USER="root"
PARAMS:
   LOGNAME='root'
   USER='root'
   SUDO_COMMAND='/usr/sbin/shorewall trace compile'
   SUDO_USER='wolferz'
   PATH='/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin'
   PWD='/home/wolferz'
   SUDO_UID='1000'
   LC_CTYPE='en_US.UTF-8'
   LANG='en_US.UTF-8'
   LS_COLORS='rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:'
   TERM='tmux-256color'
   SUDO_GID='1000'
   SW_CONFDIR='/etc/shorewall'
   SHELL='/bin/zsh'
   MAIL='/var/mail/root'
   HOME='/root'
Processing /etc/shorewall/shorewall.conf...
IN===> STARTUP_ENABLED=Yes
IN===> VERBOSITY=1
IN===> PAGER=/usr/bin/less
IN===> FIREWALL=
IN===> LOG_LEVEL="NFLOG(1,0,1)"
IN===> BLACKLIST_LOG_LEVEL=
IN===> INVALID_LOG_LEVEL="$LOG_LEVEL:invalid"
IN===> LOG_BACKEND=netlink
IN===> LOG_MARTIANS=Yes
IN===> LOG_VERBOSITY=2
IN===> LOG_ZONE=Both
IN===> LOGALLNEW=
IN===> LOGFILE=systemd
IN===> LOGFORMAT="IPv4 %s %s "
IN===> LOGTAGONLY=No
IN===> LOGLIMIT="s:1/sec:10"
IN===> MACLIST_LOG_LEVEL="$LOG_LEVEL:mac"
IN===> RELATED_LOG_LEVEL=
IN===> RPFILTER_LOG_LEVEL="$LOG_LEVEL:rpfilter"
IN===> SFILTER_LOG_LEVEL="$LOG_LEVEL:sfilter"
IN===> SMURF_LOG_LEVEL="$LOG_LEVEL:smurf"
IN===> STARTUP_LOG=/var/log/shorewall-init.log
IN===> TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL:tcpflags"
IN===> UNTRACKED_LOG_LEVEL=
IN===> ARPTABLES=
IN===> CONFIG_PATH=":${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
IN===> GEOIPDIR=/usr/share/xt_geoip/LE
IN===> IPTABLES=/usr/bin/iptables
IN===> IP=/usr/bin/ip
IN===> IPSET=/usr/bin/ipset
IN===> LOCKFILE=${VARDIR}/lock
IN===> MODULESDIR=
IN===> NFACCT=
IN===> PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin"
IN===> PERL=/usr/bin/perl
IN===> RESTOREFILE=restore
IN===> SHOREWALL_SHELL=/bin/sh
IN===> SUBSYSLOCK=/var/lock/shorewall
IN===> TC=/usr/bin/tc
IN===> ACCEPT_DEFAULT="none"
IN===> BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
IN===> DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)"
IN===> NFQUEUE_DEFAULT="none"
IN===> QUEUE_DEFAULT="none"
IN===> REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)"
IN===> RCP_COMMAND='/usr/bin/scp ${files} ${root}@${system}:${destination}'
IN===> RSH_COMMAND='/usr/bin/ssh ${root}@${system} ${command}'
IN===> ACCOUNTING=Yes
IN===> ACCOUNTING_TABLE=filter
IN===> ADD_IP_ALIASES=No
IN===> ADD_SNAT_ALIASES=No
IN===> ADMINISABSENTMINDED=No
IN===> AUTOCOMMENT=Yes
IN===> AUTOHELPERS=No
IN===> AUTOMAKE=Yes
IN===> BALANCE_PROVIDERS=No
IN===> BASIC_FILTERS=Yes
IN===> BLACKLIST=ALL
IN===> CLAMPMSS=No
IN===> CLEAR_TC=Yes
IN===> COMPLETE=No
IN===> DEFER_DNS_RESOLUTION=No
IN===> DELETE_THEN_ADD=Yes
IN===> DETECT_DNAT_IPADDRS=No
IN===> DISABLE_IPV6=No
IN===> DOCKER=No
IN===> DONT_LOAD=
IN===> DYNAMIC_BLACKLIST=No
IN===> EXPAND_POLICIES=Yes
IN===> EXPORTMODULES=Yes
IN===> FASTACCEPT=No
IN===> FORWARD_CLEAR_MARK=Yes
IN===> HELPERS=none
IN===> IGNOREUNKNOWNVARIABLES=No
IN===> IMPLICIT_CONTINUE=Yes
IN===> IPSET_WARNINGS=Yes
IN===> IP_FORWARDING=On
IN===> KEEP_RT_TABLES=No
IN===> MACLIST_TABLE=filter
IN===> MACLIST_TTL=
IN===> MANGLE_ENABLED=Yes
IN===> MARK_IN_FORWARD_CHAIN=No
IN===> MINIUPNPD=No
IN===> MULTICAST=No
IN===> MUTEX_TIMEOUT=60
IN===> NULL_ROUTE_RFC1918=unreachable
IN===> OPTIMIZE=All
IN===> OPTIMIZE_ACCOUNTING=No
IN===> PERL_HASH_SEED=random
IN===> REJECT_ACTION=
IN===> RENAME_COMBINED=Yes
IN===> REQUIRE_INTERFACE=No
IN===> RESTART=restart
IN===> RESTORE_DEFAULT_ROUTE=Yes
IN===> RESTORE_ROUTEMARKS=Yes
IN===> RETAIN_ALIASES=No
IN===> ROUTE_FILTER=No
IN===> SAVE_ARPTABLES=No
IN===> SAVE_IPSETS=No
IN===> TC_ENABLED=No
IN===> TC_EXPERT=No
IN===> TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
IN===> TRACK_PROVIDERS=Yes
IN===> TRACK_RULES=File
IN===> USE_DEFAULT_RT=Yes
IN===> USE_NFLOG_SIZE=No
IN===> USE_PHYSICAL_NAMES=No
IN===> USE_RT_NAMES=No
IN===> VERBOSE_MESSAGES=Yes
IN===> WARNOLDCAPVERSION=Yes
IN===> WORKAROUNDS=Yes
IN===> ZERO_MARKS=No
IN===> ZONE2ZONE=-
IN===> BLACKLIST_DISPOSITION=DROP
IN===> INVALID_DISPOSITION=DROP
IN===> MACLIST_DISPOSITION=REJECT
IN===> RELATED_DISPOSITION=ACCEPT
IN===> RPFILTER_DISPOSITION=DROP
IN===> SMURF_DISPOSITION=DROP
IN===> SFILTER_DISPOSITION=DROP
IN===> TCP_FLAGS_DISPOSITION=DROP
IN===> UNTRACKED_DISPOSITION=CONTINUE
IN===> TC_BITS=
IN===> PROVIDER_BITS=
IN===> PROVIDER_OFFSET=
IN===> MASK_BITS=
IN===> ZONE_BITS=0
SYS----> /usr/bin/iptables -w -L -n
Chain INPUT (policy DROP)
target     prot opt source               destination         
wan-fw     all  --  0.0.0.0/0            0.0.0.0/0           
lan_in     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip nflog-prefix  "IPv4 INPUT REJECT " nflog-group 3 nflog-threshold 1
reject     all  --  0.0.0.0/0            0.0.0.0/0           [goto] 

Chain FORWARD (policy DROP)
target     prot opt source               destination         
wan_frwd   all  --  0.0.0.0/0            0.0.0.0/0           
lan_frwd   all  --  0.0.0.0/0            0.0.0.0/0           
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip nflog-prefix  "IPv4 FORWARD REJECT " nflog-group 3 nflog-threshold 1
reject     all  --  0.0.0.0/0            0.0.0.0/0           [goto] 

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
fw-wan     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip nflog-prefix  "IPv4 OUTPUT REJECT " nflog-group 2 nflog-threshold 1
reject     all  --  0.0.0.0/0            0.0.0.0/0           [goto] 

Chain fw-wan (1 references)
target     prot opt source               destination         
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpts:67:68
~comb2     all  --  0.0.0.0/0            0.0.0.0/0            ctstate ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:53 /* Tiphares Allowed Out */
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 53,21,9418,80,443 /* Tiphares Allowed Out */
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:123 /* Tiphares Allowed Out */
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 8 /* Tiphares Allowed Out */
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22,43 /* Tiphares Allowed Out */
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip nflog-prefix  "IPv4 fw-wan REJECT " nflog-group 2 nflog-threshold 1
reject     all  --  0.0.0.0/0            0.0.0.0/0           [goto] 

Chain lan-wan (1 references)
target     prot opt source               destination         
~comb2     all  --  0.0.0.0/0            0.0.0.0/0            ctstate ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED
NFQUEUE    all  --  0.0.0.0/0            0.0.0.0/0            NFQUEUE balance 0:1 cpu-fanout

Chain lan_frwd (1 references)
target     prot opt source               destination         
tcpflags   tcp  --  0.0.0.0/0            0.0.0.0/0           
lan-wan    all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain lan_in (1 references)
target     prot opt source               destination         
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpts:67:68
tcpflags   tcp  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain logflags (7 references)
target     prot opt source               destination         
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip nflog-prefix  "IPv4 logflags DROP tcpflags " nflog-group 1 nflog-threshold 1
DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain reject (6 references)
target     prot opt source               destination         
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match src-type BROADCAST
DROP       all  --  224.0.0.0/4          0.0.0.0/0           
DROP       2    --  0.0.0.0/0            0.0.0.0/0           
REJECT     tcp  --  0.0.0.0/0            0.0.0.0/0            reject-with tcp-reset
REJECT     udp  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
REJECT     icmp --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-unreachable
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain sha-lh-53585302c52d2f755f06 (0 references)
target     prot opt source               destination         

Chain sha-rh-f1e38c3b34e48df2a338 (0 references)
target     prot opt source               destination         

Chain shorewall (0 references)
target     prot opt source               destination         
           all  --  0.0.0.0/0            0.0.0.0/0            recent: SET name: %CURRENTTIME side: source mask: 255.255.255.255

Chain smurflog (2 references)
target     prot opt source               destination         
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip nflog-prefix  "IPv4 smurfs DROP smurf " nflog-group 1 nflog-threshold 1
DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain smurfs (2 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0              0.0.0.0/0           
smurflog   all  --  0.0.0.0/0            0.0.0.0/0           [goto]  ADDRTYPE match src-type BROADCAST
smurflog   all  --  224.0.0.0/4          0.0.0.0/0           [goto] 

Chain tcpflags (4 references)
target     prot opt source               destination         
logflags   tcp  --  0.0.0.0/0            0.0.0.0/0           [goto]  tcp flags:0x3F/0x29
logflags   tcp  --  0.0.0.0/0            0.0.0.0/0           [goto]  tcp flags:0x3F/0x00
logflags   tcp  --  0.0.0.0/0            0.0.0.0/0           [goto]  tcp flags:0x06/0x06
logflags   tcp  --  0.0.0.0/0            0.0.0.0/0           [goto]  tcp flags:0x05/0x05
logflags   tcp  --  0.0.0.0/0            0.0.0.0/0           [goto]  tcp flags:0x03/0x03
logflags   tcp  --  0.0.0.0/0            0.0.0.0/0           [goto]  tcp flags:0x19/0x09
logflags   tcp  --  0.0.0.0/0            0.0.0.0/0           [goto]  tcp spt:0 flags:0x17/0x02

Chain wan-fw (1 references)
target     prot opt source               destination         
smurfs     all  --  0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpts:67:68
tcpflags   tcp  --  0.0.0.0/0            0.0.0.0/0           
~comb2     all  --  0.0.0.0/0            0.0.0.0/0            ctstate ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip nflog-prefix  "IPv4 wan-fw REJECT " nflog-group 1 nflog-threshold 1
reject     all  --  0.0.0.0/0            0.0.0.0/0           [goto] 

Chain wan-lan (1 references)
target     prot opt source               destination         
~comb2     all  --  0.0.0.0/0            0.0.0.0/0            ctstate ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED
ACCEPT     tcp  --  0.0.0.0/0            10.5.1.1             tcp dpts:6881:6999 /* Scrapyard DNAT */
ACCEPT     udp  --  0.0.0.0/0            10.5.1.1             udp dpt:6881 /* Scrapyard DNAT */
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type ANYCAST
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip nflog-prefix  "IPv4 wan-lan REJECT " nflog-group 1 nflog-threshold 1
reject     all  --  0.0.0.0/0            0.0.0.0/0           [goto] 

Chain wan_frwd (1 references)
target     prot opt source               destination         
smurfs     all  --  0.0.0.0/0            0.0.0.0/0            ctstate INVALID,NEW,UNTRACKED
tcpflags   tcp  --  0.0.0.0/0            0.0.0.0/0           
wan-lan    all  --  0.0.0.0/0            0.0.0.0/0           

Chain ~comb2 (4 references)
target     prot opt source               destination         
NFQUEUE    all  --  0.0.0.0/0            0.0.0.0/0            ctstate ESTABLISHED NFQUEUE balance 0:1 bypass cpu-fanout
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
Loading Modules...
IN===> loadmodule nf_conntrack_ftp
IN===> loadmodule nf_conntrack_h323
IN===> loadmodule nf_conntrack_irc
IN===> loadmodule nf_conntrack_netbios_ns
IN===> loadmodule nf_conntrack_netlink
IN===> loadmodule nf_conntrack_pptp
IN===> loadmodule nf_conntrack_proto_gre
IN===> loadmodule nf_conntrack_proto_sctp
IN===> loadmodule nf_conntrack_proto_udplite
IN===> loadmodule nf_conntrack_sip         sip_direct_media=0
IN===> loadmodule nf_conntrack_tftp
IN===> loadmodule nf_conntrack_sane
IN===> loadmodule nf_nat_amanda
IN===> loadmodule nf_nat_ftp
IN===> loadmodule nf_nat_h323
IN===> loadmodule nf_nat_irc
IN===> loadmodule nf_nat
IN===> loadmodule nf_nat_pptp
IN===> loadmodule nf_nat_proto_gre
IN===> loadmodule nf_nat_sip
IN===> loadmodule nf_nat_snmp_basic
IN===> loadmodule nf_nat_tftp
IN===> loadmodule ipt_LOG
IN===> loadmodule nf_log_ipv4
IN===> loadmodule xt_LOG
IN===> loadmodule xt_NFLOG
IN===> loadmodule nfnetlink_log
SYS----> /usr/bin/iptables -w -N fooX16630
SYS----> /usr/bin/iptables -w -N foo1X16630
SYS----> /usr/bin/iptables -w -A fooX16630 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
SYS----> /usr/bin/iptables -w -A fooX16630 -p tcp -m multiport --dports 21,22 -j ACCEPT
SYS----> /usr/bin/iptables -w -A fooX16630 -p tcp -m multiport --sports 60 -m multiport --dports 99 -j ACCEPT
SYS----> /usr/bin/iptables -w -t raw -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
SYS----> /usr/bin/iptables -w -t raw -N fooX16630
SYS----> /usr/bin/iptables -w -t raw -A fooX16630 -j CT --notrack
SYS----> /usr/bin/iptables -w -A fooX16630 -m conntrack --ctorigdst 192.168.1.1 -j ACCEPT
SYS----> /usr/bin/iptables -w -A fooX16630 -m hashlimit --hashlimit-upto 3/min --hashlimit-burst 3 --hashlimit-name fooX16630 --hashlimit-mode srcip -j ACCEPT
SYS----> /usr/bin/iptables -A fooX16630 -j ACCEPT -m comment --comment "This is a comment" 
SYS----> /usr/bin/iptables -w -t mangle -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
rpfilter   all  --  0.0.0.0/0            0.0.0.0/0           

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
MARK       all  --  0.0.0.0/0            0.0.0.0/0            MARK and 0xffffff00

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain rpfilter (1 references)
target     prot opt source               destination         
RETURN     udp  --  0.0.0.0              0.0.0.0/0            udp spt:68 dpt:67
rplog      all  --  0.0.0.0/0            0.0.0.0/0            rpfilter validmark invert ctstate INVALID,NEW,RELATED

Chain rplog (1 references)
target     prot opt source               destination         
NFLOG      all  --  0.0.0.0/0            0.0.0.0/0            limit: up to 1/sec burst 10 mode srcip nflog-prefix  "IPv4 rplog DROP rpfilter " nflog-group 1 nflog-threshold 1
DROP       all  --  0.0.0.0/0            0.0.0.0/0           
SYS----> /usr/bin/iptables -w -t mangle -A fooX16630 -j MARK --set-mark 1
SYS----> /usr/bin/iptables -w -A fooX16630 -j NFLOG
SYS----> /usr/bin/iptables -w -A fooX16630 -p tcp -m multiport --dports 21:22 -j ACCEPT
                NF-(N)-> raw:OUTPUT             
                NF-(N)-> raw:PREROUTING         
                NF-(N)-> filter:INPUT           
                NF-(N)-> filter:OUTPUT          
                NF-(N)-> filter:FORWARD         
                NF-(N)-> nat:PREROUTING         
                NF-(N)-> nat:POSTROUTING        
                NF-(N)-> nat:OUTPUT             
SYS----> /usr/bin/iptables -w -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
wan_dnat   all  --  0.0.0.0/0            0.0.0.0/0           

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  10.5.0.0/16          0.0.0.0/0           

Chain wan_dnat (1 references)
target     prot opt source               destination         
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpts:6881:6999 /* Scrapyard DNAT */ to:10.5.1.1
DNAT       udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:6881 /* Scrapyard DNAT */ to:10.5.1.1
SYS----> /usr/bin/iptables -w -t nat -L INPUT -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
                NF-(N)-> nat:INPUT              
                NF-(N)-> mangle:PREROUTING      
                NF-(N)-> mangle:INPUT           
                NF-(N)-> mangle:OUTPUT          
SYS----> /usr/bin/iptables -w -t mangle -L FORWARD -n
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
MARK       all  --  0.0.0.0/0            0.0.0.0/0            MARK and 0xffffff00
                NF-(N)-> mangle:FORWARD         
                NF-(N)-> mangle:POSTROUTING     
                NF-(N)-> filter:reject          
Compiling /etc/shorewall/zones...
IN===> fw			firewall
IN===> wan			ipv4
IN===> lan			ipv4
CD===> ?FORMAT 2
Compiling /etc/shorewall/interfaces...
IN===> wan			wan					dhcp,optional,wait=30,logmartians,nosmurfs,rpfilter
SYS----> /usr/bin/iptables -w -t mangle -A fooX16630 -m rpfilter
IN===> lan			lan					dhcp,optional,wait=30,routeback=1
Determining Hosts in Zones...
Locating Action Files...
IN===> A_REJECT     noinline,logjump
IN===> A_REJECT!    inline
IN===> AllowICMPs   inline
IN===> allowBcast   inline
IN===> allowinUPnP  inline
IN===> allowInvalid inline
IN===> allowMcast   inline
IN===> AutoBL	     noinline
IN===> AutoBLL	     noinline
IN===> BLACKLIST    logjump,section
CD===> ?if __ADDRTYPE
SYS----> /usr/bin/iptables -w -A fooX16630 -m addrtype --src-type BROADCAST -j ACCEPT
EXPR=> 1
IN===> Broadcast    inline,audit
CD===> ?else
OMIT=> Broadcast    noinline,audit	# Handles Broadcast/Anycast
CD===> ?endif
IN===> DNSAmp	     proto=17
IN===> dropBcast    inline
IN===> dropBcasts   inline
IN===> dropInvalid  inline
IN===> dropMcast    inline
IN===> dropNotSyn   noinline,proto=6
IN===> DropDNSrep   inline,proto=17
IN===> DropSmurfs   noinline
IN===> Established  inline,state=ESTABLISHED
IN===> FIN	     inline,audit,proto=6
IN===> forwardUPnP  noinline
IN===> GlusterFS    inline
IN===> IfEvent	     noinline
IN===> Invalid	     inline,audit,state=INVALID
IN===> Limit	     noinline
CD===> ?if __ADDRTYPE
EXPR=> 1
IN===> Multicast    inline,audit
CD===> ?else
OMIT=> Multicast    noinline,audit	# Handles Multicast
CD===> ?endif
IN===> New	     inline,state=NEW
IN===> NotSyn	     inline,audit,proto=6
IN===> rejNotSyn    noinline,proto=6
IN===> Related	     inline,state=RELATED
IN===> ResetEvent   inline
IN===> RST	     inline,audit,proto=6
IN===> SetEvent     inline
IN===> TCPFlags     proto=6
IN===> Untracked    inline,state=UNTRACKED
IN===> DNATNFQ     inline
                NF-(N)-> filter:fw-fw           
                NF-(N)-> filter:wan-wan         
                NF-(N)-> filter:lan-lan         
Compiling /etc/shorewall/policy...
IN===> lan             lan         ACCEPT
IN===> lan             fw          ACCEPT
                NF-(N)-> filter:lan-fw          
IN===> lan             wan         NFQUEUE(0:1c)
SYS----> /usr/bin/iptables -w -A fooX16630 -j NFQUEUE --queue-num 4
SYS----> /usr/bin/iptables -A fooX16630 -j NFQUEUE --queue-balance 0:3 --queue-cpu-fanout
                NF-(N)-> filter:lan-wan         
IN===> lan             all         REJECT  NFLOG(2,0,1)
                NF-(N)-> filter:lan-all         
IN===> wan             all         REJECT  NFLOG(1,0,1)
                NF-(N)-> filter:wan-all         
                NF-(N)-> filter:wan-fw          
                NF-(N)-> filter:wan-lan         
IN===> fw              fw          ACCEPT
IN===> fw              lan         ACCEPT
                NF-(N)-> filter:fw-lan          
IN===> fw              all         REJECT  NFLOG(2,0,1)
                NF-(N)-> filter:fw-all          
                NF-(N)-> filter:fw-wan          
IN===> all             all         REJECT  NFLOG(3,0,1)
                NF-(N)-> filter:all-all         
GS-----> #!/bin/sh
GS-----> #
GS-----> # Compiled firewall script generated by Shorewall 5.2.3.3 - Wed 21 Aug 2019 05:12:00 PM CDT
GS-----> #
GS-----> #   (c) 1999-2019 - Tom Eastep (teastep@shorewall.net)
GS-----> #
GS-----> #	This program is part of Shorewall.
GS-----> #
GS-----> #	This program is free software; you can redistribute it and/or modify
GS-----> #	it under the terms of the GNU General Public License as published by the
GS-----> #	Free Software Foundation, either version 2 of the license or, at your
GS-----> #	option, any later version.
GS-----> #
GS-----> #	This program is distributed in the hope that it will be useful,
GS-----> #	but WITHOUT ANY WARRANTY; without even the implied warranty of
GS-----> #	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GS-----> #	GNU General Public License for more details.
GS-----> #
GS-----> #	You should have received a copy of the GNU General Public License
GS-----> #	along with this program; if not, see <http://www.gnu.org/licenses/>.
GS-----> #
GS-----> #	Options are:
GS-----> #
GS-----> #	    -n				Do not alter Routing
GS-----> #	    -v and -q			Standard Shorewall Verbosity control
GS-----> #	    -t				Timestamp progress messages
GS-----> #	    -p				Purge conntrack table
GS-----> #	    -r				Recover from failed start/reload
GS-----> #	    -V <verbosity>		Set verbosity level explicitly
GS-----> #	    -R <restore>		Overrides RESTOREFILE setting
GS-----> #
GS-----> #	Commands are:
GS-----> #
GS-----> #	    clear			Removes all firewall rules
GS-----> #	    disable			Disable an optional interface
GS-----> #	    down			Stop an optional interface
GS-----> #	    enable			Enable an optional interface
GS-----> #	    help			Show command syntax
GS-----> #	    reenable			Disable then enable an optional
GS-----> #					interface
GS-----> #	    refresh			Refresh the firewall
GS-----> #	    reload			Reload the firewall
GS-----> #	    restart			Restarts the firewall
GS-----> #	    restore			Restore a saved configuration
GS-----> #	    reset			Reset byte and packet counters
GS-----> #	    run				Call a function in this program
GS-----> #	    savesets			Save the ipset contents
GS-----> #	    status			Displays firewall status
GS-----> #	    start			Starts the firewall
GS-----> #	    stop			Stops the firewall
GS-----> #	    up				Start an optional interface
GS-----> #	    version			Displays the version of Shorewall that
GS-----> #					generated this program
GS-----> #
GS-----> ################################################################################
GS-----> # Functions imported from /usr/share/shorewall/lib.runtime
GS-----> ################################################################################
GS-----> #		      Address family-neutral Functions
GS-----> ################################################################################
GS-----> #
GS-----> # Conditionally produce message
GS-----> #
GS-----> progress_message() # $* = Message
GS-----> {
GS----->     local timestamp
GS----->     timestamp=
GS----->     if [ $VERBOSITY -gt 1 ]; then
GS-----> 	[ -n "$g_timestamp" ] && timestamp="$(date +%H:%M:%S) "
GS-----> 	echo "${timestamp}$@"
GS----->     fi
GS----->     if [ $LOG_VERBOSITY -gt 1 ]; then
GS----->         timestamp="$(date +'%b %e %T') "
GS----->         echo "${timestamp}$@" >> $STARTUP_LOG
GS----->     fi
GS-----> }
GS-----> progress_message2() # $* = Message
GS-----> {
GS----->     local timestamp
GS----->     timestamp=
GS----->     if [ $VERBOSITY -gt 0 ]; then
GS-----> 	[ -n "$g_timestamp" ] && timestamp="$(date +%H:%M:%S) "
GS-----> 	echo "${timestamp}$@"
GS----->     fi
GS----->     if [ $LOG_VERBOSITY -gt 0 ]; then
GS----->         timestamp="$(date +'%b %e %T') "
GS----->         echo "${timestamp}$@" >> $STARTUP_LOG
GS----->     fi
GS-----> }
GS-----> progress_message3() # $* = Message
GS-----> {
GS----->     local timestamp
GS----->     timestamp=
GS----->     if [ $VERBOSITY -ge 0 ]; then
GS-----> 	[ -n "$g_timestamp" ] && timestamp="$(date +%H:%M:%S) "
GS-----> 	echo "${timestamp}$@"
GS----->     fi
GS----->     if [ $LOG_VERBOSITY -ge 0 ]; then
GS----->         timestamp="$(date +'%b %e %T') "
GS----->         echo "${timestamp}$@" >> $STARTUP_LOG
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Set a standard chain's policy
GS-----> #
GS-----> setpolicy() # $1 = name of chain, $2 = policy
GS-----> {
GS----->     run_iptables -P $1 $2
GS-----> }
GS-----> #
GS-----> # Generate a list of all network interfaces on the system
GS-----> #
GS-----> find_all_interfaces() {
GS----->     ${IP:-ip} link list | egrep '^[[:digit:]]+:' | cut -d ' ' -f2 | sed -r 's/(@.*)?:$//'
GS-----> }
GS-----> #
GS-----> # Generate a list of all network interfaces on the system that have an ipvX address
GS-----> #
GS-----> find_all_interfaces1() {
GS----->     ${IP:-ip} -$g_family addr list | egrep '^[[:digit:]]+:' | cut -d ' ' -f2 | sed -r 's/(@.*)?:$//'
GS-----> }
GS-----> #
GS-----> # Find the value 'dev' in the passed arguments then echo the next value
GS-----> #
GS-----> find_device() {
GS----->     while [ $# -gt 1 ]; do
GS-----> 	[ "x$1" = xdev ] && echo $2 && return
GS-----> 	shift
GS----->     done
GS-----> }
GS-----> #
GS-----> # Find the value 'via' in the passed arguments then echo the next value
GS-----> #
GS-----> find_gateway() {
GS----->     while [ $# -gt 1 ]; do
GS-----> 	[ "x$1" = xvia ] && echo $2 && return
GS-----> 	shift
GS----->     done
GS-----> }
GS-----> #
GS-----> # Find the value 'mtu' in the passed arguments then echo the next value
GS-----> #
GS-----> find_mtu() {
GS----->     while [ $# -gt 1 ]; do
GS-----> 	[ "x$1" = xmtu ] && echo $2 && return
GS-----> 	shift
GS----->     done
GS-----> }
GS-----> #
GS-----> # Find the value 'peer' in the passed arguments then echo the next value up to
GS-----> # "/"
GS-----> #
GS-----> find_peer() {
GS----->     while [ $# -gt 1 ]; do
GS-----> 	[ "x$1" = xpeer ] && echo ${2%/*} && return
GS-----> 	shift
GS----->     done
GS-----> }
GS-----> #
GS-----> # Try to find the gateway through an interface looking for 'nexthop'
GS-----> find_nexthop() # $1 = interface
GS-----> {
GS----->     echo $(find_gateway `$IP -$g_family route list | grep "[[:space:]]nexthop.* $1"`)
GS-----> }
GS-----> #
GS-----> # Find the default route's interface
GS-----> #
GS-----> find_default_interface() {
GS----->     $IP -$g_family route list | while read first rest; do
GS-----> 	[ "$first" = default ] && echo $(find_device $rest) && return
GS----->     done
GS-----> }
GS-----> #
GS-----> # Determine if Interface is up
GS-----> #
GS-----> interface_is_up() {
GS----->     [ -n "$($IP -$g_family link list dev $1 2> /dev/null | grep -e '[<,]UP[,>]')" ]
GS-----> }
GS-----> #
GS-----> #  echo the list of networks routed out of a given interface
GS-----> #
GS-----> get_routed_networks() # $1 = interface name, $2-n = Fatal error message
GS-----> {
GS----->     local address
GS----->     local rest
GS----->     local mask
GS----->     [ $g_family -eq 4 ] && mask=32 || mask=128
GS----->     $IP -$g_family route show dev $1 2> /dev/null |
GS-----> 	while read address rest; do
GS-----> 	    case "$address" in
GS-----> 		default)
GS-----> 		    if [ $# -gt 1 ]; then
GS-----> 			shift
GS-----> 			fatal_error "$@"
GS-----> 		    else
GS-----> 			echo "WARNING: default route ignored on interface $1" >&2
GS-----> 		    fi
GS-----> 		    ;;
GS-----> 		multicast|broadcast|prohibit|nat|throw|nexthop)
GS-----> 		    ;;
GS-----> 		[2-3]*)
GS-----> 		    [ "$address" = "${address%/*}" ] && address="${address}/${mask}"
GS-----> 		    echo $address
GS-----> 		    ;;
GS-----> 		*)
GS-----> 		    if [ $g_family -eq 4 ]; then
GS-----> 			[ "$address" = "${address%/*}" ] && address="${address}/${mask}"
GS-----> 			echo $address
GS-----> 		    fi
GS-----> 		    ;;
GS-----> 	    esac
GS----->         done
GS-----> }
GS-----> #
GS-----> # Clear the current traffic shaping configuration
GS-----> #
GS-----> delete_tc1()
GS-----> {
GS----->     clear_one_tc() {
GS----->         $TC qdisc del dev ${1%@*} root 2> /dev/null
GS----->         $TC qdisc del dev ${1%@*} ingress 2> /dev/null
GS----->     }
GS----->     run_tcclear_exit
GS----->     run_ip link list | \
GS----->     while read inx interface details; do
GS----->         case $inx in
GS----->             [0-9]*)
GS----->                 clear_one_tc ${interface%:}
GS----->                 ;;
GS----->             *)
GS----->                 ;;
GS----->         esac
GS----->     done
GS-----> }
GS-----> #
GS-----> # Detect a device's MTU -- echos the passed device's MTU
GS-----> #
GS-----> get_device_mtu() # $1 = device
GS-----> {
GS----->     local output
GS----->     output="$($IP link list dev $1 2> /dev/null)" # quotes required for /bin/ash
GS----->     if [ -n "$output" ]; then
GS-----> 	echo $(find_mtu $output)
GS----->     else
GS-----> 	echo 1500
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Version of the above that doesn't generate any output for MTU 1500.
GS-----> # Generates 'mtu <mtu+>' otherwise, where <mtu+> is the device's MTU + 100
GS-----> #
GS-----> get_device_mtu1() # $1 = device
GS-----> {
GS----->     local output
GS----->     output="$($IP link list dev $1 2> /dev/null)" # quotes required for /bin/ash
GS----->     local mtu
GS----->     if [ -n "$output" ]; then
GS-----> 	mtu=$(find_mtu $output)
GS-----> 	if [ -n "$mtu" ]; then
GS-----> 	    [ $mtu = 1500 ] || echo mtu $(($mtu + 100))
GS-----> 	fi
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Undo changes to routing
GS-----> #
GS-----> undo_routing() {
GS----->     local undofiles
GS----->     local f
GS----->     if [ -z "$g_noroutes"  ]; then
GS-----> 	#
GS-----> 	# Restore rt_tables database
GS-----> 	#
GS-----> 	if [ -f ${VARDIR}/rt_tables ]; then
GS-----> 	    [ -w /etc/iproute2/rt_table -a -z "$KEEP_RT_TABLES" ] && cp -f ${VARDIR}/rt_tables /etc/iproute2/ && progress_message "/etc/iproute2/rt_tables database restored"
GS-----> 	    rm -f ${VARDIR}/rt_tables
GS-----> 	fi
GS-----> 	#
GS-----> 	# Restore the rest of the routing table
GS-----> 	#
GS-----> 	undofiles="$(ls ${VARDIR}/undo_*routing 2> /dev/null)"
GS-----> 	if [ -n "$undofiles" ]; then
GS-----> 	    for f in $undofiles; do
GS-----> 		. $f
GS-----> 	    done
GS-----> 	    rm -f $undofiles
GS----->             progress_message "Shorewall-generated routing tables and routing rules removed"
GS-----> 	fi
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Save the default route
GS-----> #
GS-----> save_default_route() {
GS----->     awk \
GS----->     'BEGIN        {defroute=0;};
GS----->      /^default /  {defroute=1; print; next};
GS----->      /nexthop/    {if (defroute == 1 ) {print ; next} };
GS----->                   { defroute=0; };'
GS-----> }
GS-----> #
GS-----> # Restore the default route that was in place before the initial 'shorewall start'
GS-----> #
GS-----> replace_default_route() # $1 = USE_DEFAULT_RT
GS-----> {
GS----->     #
GS----->     # default_route and result are inherited from the caller
GS----->     #
GS----->     if [ -n "$default_route" ]; then
GS-----> 	case "$default_route" in
GS-----> 	    *metric*)
GS-----> 	        #
GS-----> 	        # Don't restore a default route with a metric unless USE_DEFAULT_RT=Yes or =Exact. Otherwise, we only replace the one with metric 0
GS-----> 	        #
GS-----> 		[ -n "$1" ] && qt $IP -$g_family route replace $default_route && progress_message "Default Route (${default_route# }) restored"
GS-----> 		default_route=
GS-----> 		;;
GS-----> 	    *)
GS-----> 		qt $IP -$g_family route replace $default_route && progress_message "Default Route (${default_route# }) restored"
GS-----> 		result=0
GS-----> 		default_route=
GS-----> 		;;
GS-----> 	esac
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Delete default routes with metric 0 from the passed routing table
GS-----> #
GS-----> delete_default_routes() # $1 = table number
GS-----> {
GS----->     $IP -$g_family route ls table $1 | grep -F default | grep -vF metric | while read route; do
GS-----> 	qt $IP -$g_family route del $route table $1
GS----->     done
GS-----> } 
GS-----> restore_default_route() # $1 = USE_DEFAULT_RT
GS-----> {
GS----->     local result
GS----->     result=1
GS----->     if [ -z "$g_noroutes" -a -f ${VARDIR}/default_route ]; then
GS-----> 	local default_route
GS-----> 	default_route=
GS-----> 	local route
GS-----> 	while read route ; do
GS-----> 	    case $route in
GS-----> 		default*)
GS-----> 		    replace_default_route $1
GS-----> 		    default_route="$default_route $route"
GS-----> 		    ;;
GS-----> 		*)
GS-----> 		    default_route="$default_route $route"
GS-----> 		    ;;
GS-----> 	    esac
GS-----> 	done < ${VARDIR}/default_route
GS-----> 	replace_default_route $1
GS-----> 	if [ $result = 1 ]; then
GS-----> 	    #
GS-----> 	    # We didn't restore a default route with metric 0
GS-----> 	    #
GS-----> 	    if $IP -$g_family -o route list 2> /dev/null | grep -F default | grep -qvF metric; then
GS-----> 	       #
GS-----> 	       # But we added a default route with metric 0
GS-----> 	       #
GS-----> 	       qt $IP -$g_family route del default metric 0 && progress_message "Default route with metric 0 deleted"
GS-----> 	    fi
GS-----> 	fi
GS-----> 	rm -f ${VARDIR}/default_route
GS----->     fi
GS----->     return $result
GS-----> }
GS-----> #
GS-----> # Flush the conntrack table if $g_purge is non-empty
GS-----> #
GS-----> conditionally_flush_conntrack() {
GS----->     if [ -n "$g_purge" ]; then
GS-----> 	if [ -n "$(mywhich conntrack)" ]; then
GS----->             conntrack -F
GS-----> 	else
GS----->             error_message "WARNING: The '-p' option requires the conntrack utility which does not appear to be installed on this system"
GS-----> 	fi
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Issue a message and stop/restore the firewall.
GS-----> #
GS-----> fatal_error()
GS-----> {
GS----->     echo "   ERROR: $@" >&2
GS----->     if [ $LOG_VERBOSITY -ge 0 ]; then
GS----->         timestamp="$(date +'%b %e %T') "
GS----->         echo "${timestamp}  ERROR: $@" >> $STARTUP_LOG
GS----->     fi
GS----->     stop_firewall
GS----->     [ -n "$TEMPFILE" ] && rm -f $TEMPFILE
GS----->     mutex_off
GS----->     exit 2
GS-----> }
GS-----> #
GS-----> # Run iptables/ip6tables and if an error occurs, stop/restore the firewall
GS-----> #
GS-----> run_iptables()
GS-----> {
GS----->     local status
GS----->     while [ 1 ]; do
GS-----> 	eval $g_tool $@
GS-----> 	status=$?
GS-----> 	[ $status -ne 4 ] && break
GS----->     done
GS----->     if [ $status -ne 0 ]; then
GS----->         error_message "ERROR: Command \"$g_tool $@\" Failed"
GS-----> 	stop_firewall
GS----->         exit 2
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Run iptables/ip6tables retrying exit status 4
GS-----> #
GS-----> do_iptables()
GS-----> {
GS----->     local status
GS----->     while [ 1 ]; do
GS-----> 	$g_tool $@
GS-----> 	status=$?
GS-----> 	[ $status -ne 4 ] && return $status;
GS----->     done
GS-----> }
GS-----> #
GS-----> # Run ip and if an error occurs, stop/restore the firewall
GS-----> #
GS-----> run_ip()
GS-----> {
GS----->     if ! $IP -$g_family $@; then
GS-----> 	error_message "ERROR: Command \"$IP -$g_family $@\" Failed"
GS-----> 	stop_firewall
GS-----> 	exit 2
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Run tc and if an error occurs, stop/restore the firewall
GS-----> #
GS-----> run_tc() {
GS----->     if ! $TC $@ ; then
GS-----> 	error_message "ERROR: Command \"$TC $@\" Failed"
GS-----> 	stop_firewall
GS-----> 	exit 2
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Run the .iptables_restore_input as a set of discrete iptables commands
GS-----> #
GS-----> debug_restore_input() {
GS----->     local first second rest table chain
GS----->     #
GS----->     # Clear the ruleset
GS----->     #
GS----->     qt1 $g_tool -t mangle -F
GS----->     qt1 $g_tool -t mangle -X
GS----->     for chain in PREROUTING INPUT FORWARD POSTROUTING; do
GS-----> 	qt1 $g_tool -t mangle -P $chain ACCEPT
GS----->     done
GS----->     qt1 $g_tool -t raw    -F
GS----->     qt1 $g_tool -t raw    -X
GS----->     for chain in PREROUTING OUTPUT; do
GS-----> 	qt1 $g_tool -t raw -P $chain ACCEPT
GS----->     done
GS----->     qt1 $g_tool -t nat    -F
GS----->     qt1 $g_tool -t nat    -X
GS----->     for chain in PREROUTING POSTROUTING; do
GS----->         qt1 $g_tool -t nat -P $chain ACCEPT
GS----->     done
GS----->     qt1 $g_tool -t filter -F
GS----->     qt1 $g_tool -t filter -X
GS----->     for chain in INPUT FORWARD OUTPUT; do
GS-----> 	qt1 $g_tool -t filter -P $chain -P ACCEPT
GS----->     done
GS----->     while read first second rest; do
GS-----> 	case $first in
GS-----> 	    -*)
GS-----> 		#
GS-----> 		# We can't call run_iptables() here because the rules may contain quoted strings
GS-----> 		#
GS-----> 		eval $g_tool -t $table $first $second $rest
GS-----> 		if [ $? -ne 0 ]; then
GS-----> 		    error_message "ERROR: Command \"$g_tool -t $table $first $second $rest\" Failed"
GS-----> 		    stop_firewall
GS-----> 		    exit 2
GS-----> 		fi
GS-----> 		;;
GS-----> 	    :*)
GS-----> 		chain=${first#:}
GS-----> 		if [ "x$second" = x- ]; then
GS-----> 		    do_iptables -t $table -N $chain
GS-----> 		else
GS-----> 		    do_iptables -t $table -P $chain $second
GS-----> 		fi
GS-----> 		if [ $? -ne 0 ]; then
GS-----> 		    error_message "ERROR: Command \"$g_tool $first $second $rest\" Failed"
GS-----> 		    stop_firewall
GS-----> 		    exit 2
GS-----> 		fi
GS-----> 		;;
GS-----> 	    #
GS-----> 	    # This grotesque hack with the table names works around a bug/feature with ash
GS-----> 	    #
GS-----> 	    '*'raw)
GS-----> 		table=raw
GS-----> 		;;
GS-----> 	    '*'mangle)
GS-----> 		table=mangle
GS-----> 		;;
GS-----> 	    '*'nat)
GS-----> 		table=nat
GS-----> 		;;
GS-----> 	    '*'filter)
GS-----> 		table=filter
GS-----> 		;;
GS-----> 	esac
GS----->     done
GS-----> }
GS-----> interface_enabled() {
GS----->     status=0
GS----->     if [ -f ${VARDIR}/${1}_disabled ]; then
GS-----> 	status=1
GS----->     elif [ -f ${VARDIR}/${1}.status ]; then
GS-----> 	status=$(cat ${VARDIR}/${1}.status)
GS----->     fi
GS----->     return $status
GS-----> }
GS-----> distribute_load() {
GS----->     local provider
GS----->     local interface
GS----->     local currentload # Total load of enabled providers
GS----->     local load        # Specified load of an enabled provider
GS----->     local mark        # Mark of an enabled provider
GS----->     local totalload   # Total load of all providers - usually 1.000000
GS----->     local nload       # Normalized load of an enabled provider
GS----->     totalload=$1
GS----->     shift
GS----->     currentload=0
GS----->     for provider in $@; do
GS-----> 	interface=$(cat ${VARDIR}/${provider}_interface)
GS-----> 	eval ${provider}_interface=$interface
GS-----> 	if interface_enabled $interface; then
GS-----> 	    load=$(cat ${VARDIR}/${provider}_load)
GS-----> 	    eval ${provider}_load=$load
GS-----> 	    mark=$(cat ${VARDIR}/${provider}_mark)
GS-----> 	    eval ${provider}_mark=$mark
GS-----> 	    currentload=$( bc <<EOF
GS-----> scale=8
GS-----> $currentload + $load
GS-----> EOF
GS-----> )
GS-----> 	fi
GS----->     done
GS----->     if [ $currentload ]; then
GS-----> 	for provider in $@; do
GS-----> 	    eval interface=\$${provider}_interface
GS-----> 	    qt $g_tool -t mangle -F ~$provider
GS-----> 	    eval load=\$${provider}_load
GS-----> 	    eval mark=\$${provider}_mark
GS-----> 	    if [ -n "$load" ]; then
GS-----> 		nload=$(bc <<EOF
GS-----> scale=8
GS-----> ( $load / $currentload ) * $totalload
GS-----> EOF
GS-----> )
GS-----> 		currentload=$(bc <<EOF
GS-----> scale=8
GS-----> $currentload - $load
GS-----> EOF
GS-----> )
GS-----> 		case $nload in
GS-----> 		    .*|0.*)
GS-----> 			run_iptables -t mangle -A ~$provider -m statistic --mode random --probability $nload -j MARK --set-mark $mark
GS-----> 			;;
GS-----> 		    *)
GS-----> 			run_iptables -t mangle -A ~$provider -j MARK --set-mark $mark
GS-----> 			;;
GS-----> 		esac
GS-----> 	    fi
GS-----> 	done
GS----->     fi
GS-----> }
CD===> ?if __IPV4
EXPR=> 1
GS-----> #################################################################################
GS-----> #                        IPv4-specific Functions
GS-----> #################################################################################
GS-----> #
GS-----> # Determine if interface is usable from a Netfilter perspective
GS-----> #
GS-----> interface_is_usable() # $1 = interface
GS-----> {
GS----->     local status;
GS----->     status=0
GS----->     if ! loopback_interface $1; then
GS-----> 	if interface_is_up $1 && [ "$(find_first_interface_address_if_any $1)" != 0.0.0.0 ] && [ -z "$($IP -$g_family link list dev $1 2> /dev/null | fgrep 'state DOWN')" ]; then
GS-----> 	    if [ "$COMMAND" != enable ]; then
GS-----> 		[ ! -f ${VARDIR}/${1}_disabled ] && run_isusable_exit $1
GS-----> 		status=$?
GS-----> 	    fi
GS-----> 	else
GS-----> 	    status=1
GS-----> 	fi
GS----->     fi
GS----->     return $status
GS-----> }
GS-----> #
GS-----> # Find interface addresses--returns the set of addresses assigned to the passed device
GS-----> #
GS-----> find_interface_addresses() # $1 = interface
GS-----> {
GS----->     $IP -f inet addr show $1 2> /dev/null | grep inet\  | sed 's/\s*inet //;s/\/.*//;s/ peer.*//'
GS-----> }
GS-----> #
GS-----> # Find the value 'weight' in the passed arguments then echo the next value
GS-----> #
GS-----> find_weight() {
GS----->     while [ $# -gt 1 ]; do
GS-----> 	[ "x$1" = xweight ] && echo $2 && return
GS-----> 	shift
GS----->     done
GS-----> }
GS-----> #
GS-----> # Find the interfaces that have a route to the passed address - the default
GS-----> # route is not used.
GS-----> #
GS-----> find_rt_interface() {
GS----->     $IP -4 route list | while read addr rest; do
GS-----> 	case $addr in
GS-----> 	    */*)
GS-----> 		in_network ${1%/*} $addr && echo $(find_device $rest)
GS-----> 		;;
GS-----> 	    default)
GS-----> 		;;
GS-----> 	    *)
GS-----> 		if [ "$addr" = "$1" -o "$addr/32" = "$1" ]; then
GS-----> 		    echo $(find_device $rest)
GS-----> 		fi
GS-----> 		;;
GS-----> 	esac
GS----->     done
GS-----> }
GS-----> #
GS-----> # Echo the name of the interface(s) that will be used to send to the
GS-----> # passed address
GS-----> #
GS-----> find_interface_by_address() {
GS----->     local dev
GS----->     dev="$(find_rt_interface $1)"
GS----->     local first
GS----->     local rest
GS----->     [ -z "$dev" ] && dev=$(find_default_interface)
GS----->     [ -n "$dev" ] && echo $dev
GS-----> }
GS-----> #
GS-----> #  echo the list of networks routed out of a given interface
GS-----> #
GS-----> get_routed_networks() # $1 = interface name, $2-n = Fatal error message
GS-----> {
GS----->     local address
GS----->     local rest
GS----->     $IP -4 route show dev $1 2> /dev/null |
GS-----> 	while read address rest; do
GS-----> 	    case "$address" in
GS-----> 		default)
GS-----> 		    if [ $# -gt 1 ]; then
GS-----> 			shift
GS-----> 			fatal_error "$@"
GS-----> 		    else
GS-----> 			echo "WARNING: default route ignored on interface $1" >&2
GS-----> 		    fi
GS-----> 		    ;;
GS-----> 		multicast|broadcast|prohibit|nat|throw|nexthop)
GS-----> 		    ;;
GS-----> 		*)
GS-----> 		    [ "$address" = "${address%/*}" ] && address="${address}/32"
GS-----> 		    echo $address
GS-----> 		    ;;
GS-----> 	    esac
GS----->         done
GS-----> }
GS-----> #
GS-----> # Get the broadcast addresses associated with an interface
GS-----> #
GS-----> get_interface_bcasts() # $1 = interface
GS-----> {
GS----->     local addresses
GS----->     addresses=
GS----->     $IP -f inet addr show dev $1 2> /dev/null | grep 'inet.*brd' | sed 's/inet.*brd //; s/scope.*//;' | sort -u
GS-----> }
GS-----> #
GS-----> # Delete IP address
GS-----> #
GS-----> del_ip_addr() # $1 = address, $2 = interface
GS-----> {
GS----->     [ $(find_first_interface_address_if_any $2) = $1 ] || qtnoin $IP addr del $1 dev $2
GS-----> }
GS-----> # Add IP Aliases
GS-----> #
GS-----> add_ip_aliases() # $* = List of addresses
GS-----> {
GS----->     local local
GS----->     local addresses
GS----->     local external
GS----->     local interface
GS----->     local inet
GS----->     local cidr
GS----->     local rest
GS----->     local val
GS----->     local arping
GS----->     arping=$(mywhich arping)
GS----->     address_details()
GS----->     {
GS-----> 	#
GS-----> 	# Folks feel uneasy if they don't see all of the same
GS-----> 	# decoration on these IP addresses that they see when their
GS-----> 	# distro's net config tool adds them. In an attempt to reduce
GS-----> 	# the anxiety level, we have the following code which sets
GS-----> 	# the VLSM and BRD from an existing address in the same network
GS-----> 	#
GS-----> 	# Get all of the lines that contain inet addresses with broadcast
GS-----> 	#
GS-----> 	$IP -f inet addr show $interface 2> /dev/null | grep 'inet.*brd' | while read inet cidr rest ; do
GS-----> 	    case $cidr in
GS-----> 		*/*)
GS-----> 		    if in_network $external $cidr; then
GS-----> 			echo "/${cidr#*/} brd $(broadcastaddress $cidr)"
GS-----> 			break
GS-----> 		    fi
GS-----> 		    ;;
GS-----> 	    esac
GS-----> 	done
GS----->     }
GS----->     do_one()
GS----->     {
GS-----> 	val=$(address_details)
GS-----> 	$IP addr add ${external}${val} dev $interface $label
GS-----> 	[ -n "$arping" ] && qt $arping -U -c 2 -I $interface $external
GS-----> 	echo "$external $interface" >> $VARDIR/nat
GS-----> 	[ -n "$label" ] && label="with $label"
GS-----> 	progress_message "   IP Address $external added to interface $interface $label"
GS----->     }
GS----->     progress_message "Adding IP Addresses..."
GS----->     while [ $# -gt 0 ]; do
GS-----> 	external=$1
GS-----> 	interface=$2
GS-----> 	label=
GS-----> 	if [ "$interface" != "${interface%:*}" ]; then
GS-----> 	    label="${interface#*:}"
GS-----> 	    interface="${interface%:*}"
GS-----> 	    label="label $interface:$label"
GS-----> 	fi
GS-----> 	shift 2
GS-----> 	list_search $external $(find_interface_addresses $interface) || do_one
GS----->     done
GS-----> }
GS-----> #
GS-----> # Detect the gateway through a PPP or DHCP-configured interface
GS-----> #
GS-----> detect_dynamic_gateway() { # $1 = interface
GS----->     local interface
GS----->     interface=$1
GS----->     local GATEWAYS
GS----->     GATEWAYS=
GS----->     local gateway
GS----->     local file
GS----->     gateway=$(run_findgw_exit $1);
GS----->     if [ -z "$gateway" ]; then
GS-----> 	gateway=$( find_peer $($IP addr list $interface ) )
GS----->     fi
GS----->     file="${VARLIB}/dhcpcd/dhcpcd-${1}.info"
GS----->     if [ -z "$gateway" -a -f "${file}" ]; then
GS-----> 	eval $(grep ^GATEWAYS= "${file}" 2> /dev/null)
GS-----> 	[ -n "$GATEWAYS" ] && GATEWAYS=${GATEWAYS%,*} && gateway=$GATEWAYS
GS----->     fi
GS----->     for file in \
GS-----> 	"${VARLIB}/dhcp/dhclient-${1}.lease" \
GS-----> 	"${VARLIB}/dhcp/dhclient.${1}.leases"
GS----->     do
GS-----> 	[ -n "$gateway" ] && break
GS-----> 	if [ -f "${file}" ]; then
GS-----> 	    gateway=$(grep 'option routers' "${file}" | tail -n 1 | while read j1 j2 gateway; do echo "${gateway%\;}" ; return 0; done)
GS-----> 	fi
GS----->     done
GS----->     if [ -z "$gateway" -a -n "$(mywhich nmcli)" ]; then
GS-----> 	if [ $g_family = 4 ]; then
GS-----> 	    gateway=$(nmcli --fields DHCP4.OPTION,IP4.GATEWAY device show ${1} 2> /dev/null | sed -rn '/( routers = |IP4.GATEWAY:.*[1-9])/{s/.* //;p;q}')
GS-----> 	else
GS-----> 	    gateway=$(nmcli --terse --fields IP6.GATEWAY device show ${1} 2> /dev/null | cut -f2- -d':')
GS-----> 	fi
GS----->     fi
GS----->     [ -n "$gateway" ] && echo $gateway
GS-----> }
GS-----> #
GS-----> # Detect the gateway through an interface
GS-----> #
GS-----> detect_gateway() # $1 = interface $2 = table number
GS-----> {
GS----->     local interface
GS----->     interface=$1
GS----->     local gateway
GS----->     #
GS----->     # First assume that this is some sort of dynamic interface
GS----->     #
GS----->     gateway=$( detect_dynamic_gateway $interface )
GS----->     #
GS----->     # Maybe there's a default route through this gateway already
GS----->     #
GS----->     [ -n "$gateway" ] || gateway=$(find_gateway $($IP -4 route list dev $interface | grep ^default))
GS----->     [ -z "$gateway" -a -n "$2" ] && gateway=$(find_gateway $($IP -4 route list dev $interface table $2 | grep ^default))
GS----->     #
GS----->     # Last hope -- is there a load-balancing route through the interface?
GS----->     #
GS----->     [ -n "$gateway" ] || gateway=$(find_nexthop $interface)
GS----->     #
GS----->     # Be sure we found one
GS----->     #
GS----->     [ -n "$gateway" ] && echo $gateway
GS-----> }
GS-----> #
GS-----> # Disable IPV6
GS-----> #
GS-----> disable_ipv6() {
GS----->     local temp
GS----->     temp="$($IP -f inet6 addr list 2> /dev/null)"
GS----->     if [ -n "$temp" ]; then
GS-----> 	if [ -x "$IP6TABLES" ]; then
GS-----> 	    $IP6TABLES -P FORWARD DROP
GS-----> 	    $IP6TABLES -P INPUT DROP
GS-----> 	    $IP6TABLES -P OUTPUT DROP
GS-----> 	    $IP6TABLES -F
GS-----> 	    $IP6TABLES -X
GS-----> 	    for temp in $(find_loopback_interfaces); do
GS-----> 		$IP6TABLES -A OUTPUT -o $temp -j ACCEPT
GS-----> 		$IP6TABLES -A INPUT  -i $temp -j ACCEPT
GS-----> 	    done
GS-----> 	else
GS-----> 	    error_message "WARNING: DISABLE_IPV6=Yes in shorewall.conf but this system does not appear to have ip6tables"
GS-----> 	fi
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Add an additional gateway to the default route
GS-----> #
GS-----> add_gateway() # $1 = Delta $2 = Table Number
GS-----> {
GS----->     local route
GS----->     local weight
GS----->     local delta
GS----->     local dev
GS----->     route=`$IP -4 -o route ls table $2 | grep ^default | sed 's/default //; s/linkdown//g; s/[\]//g'`
GS----->     if [ -z "$route" ]; then
GS-----> 	run_ip route add default scope global table $2 $1
GS----->     else
GS-----> 	delta=$1
GS-----> 	if ! echo $route | grep -qF ' nexthop '; then
GS-----> 	    if echo $route | grep -qF via; then
GS-----> 		route=`echo $route | sed 's/via/nexthop via/'`
GS-----> 	    else
GS-----> 		route="nexthop $route"
GS-----> 	    fi
GS-----> 	    dev=$(find_device $route)
GS-----> 	    if [ -f ${VARDIR}/${dev}_weight ]; then
GS-----> 		weight=`cat ${VARDIR}/${dev}_weight`
GS-----> 		route="$route weight $weight"
GS-----> 	    fi
GS-----> 	fi
GS-----> 	run_ip route replace default scope global table $2 $route $delta
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Remove a gateway from the default route
GS-----> #
GS-----> delete_gateway() # $! = Description of the Gateway $2 = table number $3 = device
GS-----> {
GS----->     local route
GS----->     local gateway
GS----->     local dev
GS----->     route=`$IP -4 -o route ls table $2 | grep ^default | sed 's/linkdown//g; s/[\]//g'`
GS----->     gateway=$1
GS----->     if [ -n "$route" ]; then
GS-----> 	if echo $route | grep -qF ' nexthop '; then
GS-----> 	    if interface_is_up $3; then
GS-----> 		gateway="nexthop $gateway"
GS-----> 	    else
GS-----> 		gateway="nexthop $gateway dead"
GS-----> 	    fi
GS-----> 	    if eval echo $route \| fgrep -q \'$gateway\'; then
GS-----> 		eval route=\`echo $route \| sed \'s/$gateway/ /\'\`
GS-----> 		run_ip route replace table $2 $route
GS-----> 	    fi
GS-----> 	else
GS-----> 	    dev=$(find_device $route)
GS-----> 	    [ "$dev" = "$3" ] && run_ip route delete default table $2
GS-----> 	fi
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Determine the MAC address of the passed IP through the passed interface
GS-----> #
GS-----> find_mac() # $1 = IP address, $2 = interface
GS-----> {
GS----->     if interface_is_usable $2 ; then
GS-----> 	qt ping -nc 1 -t 2 -I $2 $1
GS-----> 	local result
GS-----> 	result=$($IP neigh list |  awk "/^$1 / {print \$5}")
GS-----> 	case $result in
GS-----> 	    \<*\>)
GS-----> 		;;
GS-----> 	    *)
GS-----> 		[ -n "$result" ] && echo $result
GS-----> 		;;
GS-----> 	esac
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Clear Proxy Arp
GS-----> #
GS-----> delete_proxyarp() {
GS----->     if [ -f ${VARDIR}/proxyarp ]; then
GS-----> 	while read address interface external haveroute; do
GS-----> 	    qtnoin $IP -4 neigh del proxy $address dev $external
GS-----> 	    [ -z "${haveroute}${g_noroutes}" ] && qtnoin $IP -4 route del $address/32 dev $interface
GS-----> 	    f=/proc/sys/net/ipv4/conf/$interface/proxy_arp
GS-----> 	    [ -f $f ] && echo 0 > $f
GS-----> 	done < ${VARDIR}/proxyarp
GS-----> 	rm -f ${VARDIR}/proxyarp
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Remove all Shorewall-added rules
GS-----> #
GS-----> clear_firewall() {
GS----->     stop_firewall
GS----->     setpolicy INPUT ACCEPT
GS----->     setpolicy FORWARD ACCEPT
GS----->     setpolicy OUTPUT ACCEPT
GS----->     run_iptables -F
GS----->     qt $IPTABLES -t raw -F
GS----->     if [ -n "$DISABLE_IPV6" ]; then
GS-----> 	if [ -x $IP6TABLES ]; then
GS----->     	    $IP6TABLES -P INPUT   ACCEPT 2> /dev/null
GS-----> 	    $IP6TABLES -P OUTPUT  ACCEPT 2> /dev/null
GS-----> 	    $IP6TABLES -P FORWARD ACCEPT 2> /dev/null
GS-----> 	fi
GS----->     fi
GS----->     run_clear_exit
GS----->     set_state "Cleared"
GS----->     logger -p kern.info "$g_product Cleared"
GS-----> }
GS-----> #
GS-----> # Get a list of all configured broadcast addresses on the system
GS-----> #
GS-----> get_all_bcasts()
GS-----> {
GS----->     $IP -f inet addr show 2> /dev/null | grep 'inet.*brd' | grep -v '/32 ' | sed 's/inet.*brd //; s/scope.*//;' | sort -u
GS-----> }
CD===> ?else
CD===> ?endif # IPv6-specific functions.
GS-----> ################################################################################
GS-----> #   Functions imported from /usr/share/shorewall//lib.common
GS-----> ################################################################################
GS-----> 
GS-----> mylogger() {
GS----->     local level
GS----->
GS----->     level=$1
GS----->     shift
GS----->
GS----->     if [ -n "$SW_LOGGERTAG" ]; then
GS-----> 	logger -p $level -t "$SW_LOGGERTAG" $*
GS----->     else
GS-----> 	logger -p $level $*
GS----->     fi
GS-----> }
GS----->
GS-----> #
GS-----> # Issue a message and stop
GS-----> #
GS-----> startup_error() # $* = Error Message
GS-----> {
GS----->     echo "   ERROR: $@: Firewall state not changed" >&2
GS----->
GS----->     if [ $LOG_VERBOSITY -ge 0 ]; then
GS----->         timestamp="$(date +'%b %e %T') "
GS----->         echo "${timestamp}  ERROR: $@" >> $STARTUP_LOG
GS----->     fi
GS----->
GS----->     case $COMMAND in
GS----->         start)
GS-----> 	    mylogger kern.err "ERROR:$g_product start failed:Firewall state not changed"
GS-----> 	    ;;
GS-----> 	restart)
GS-----> 	    mylogger kern.err "ERROR:$g_product restart failed:Firewall state not changed"
GS-----> 	    ;;
GS-----> 	restore)
GS-----> 	    mylogger kern.err "ERROR:$g_product restore failed:Firewall state not changed"
GS-----> 	    ;;
GS----->     esac
GS----->
GS----->     if [ $LOG_VERBOSITY -ge 0 ]; then
GS----->         timestamp="$(date +'%b %e %T') "
GS----->
GS-----> 	case $COMMAND in
GS-----> 	    start)
GS-----> 		echo "${timestamp}  ERROR:$g_product start failed:Firewall state not changed" >> $STARTUP_LOG
GS-----> 		;;
GS-----> 	    restart)
GS-----> 		echo "${timestamp}  ERROR:$g_product restart failed:Firewall state not changed" >> $STARTUP_LOG
GS-----> 		;;
GS-----> 	    restore)
GS-----> 		echo "${timestamp}  ERROR:$g_product restore failed:Firewall state not changed" >> $STARTUP_LOG
GS-----> 		;;
GS-----> 	esac
GS----->     fi
GS----->
GS----->     mutex_off
GS----->     kill $$
GS----->     exit 2
GS-----> }
GS----->
GS-----> #
GS-----> # Create the required option string and run the passed script using
GS-----> # $SHOREWALL_SHELL
GS-----> #
GS-----> run_it() {
GS----->     local script
GS----->     local options
GS----->
GS----->     export VARDIR
GS----->
GS----->     script=$1
GS----->     shift
GS----->
GS----->     if [ x$1 = xtrace -o x$1 = xdebug ]; then
GS-----> 	options="$1 -"
GS-----> 	shift;
GS----->     else
GS-----> 	options='-'
GS----->     fi
GS----->
GS----->     [ -n "$g_noroutes" ]   && options=${options}n
GS----->     [ -n "$g_timestamp" ]  && options=${options}t
GS----->     [ -n "$g_purge" ]      && options=${options}p
GS----->     [ -n "$g_recovering" ] && options=${options}r
GS----->     [ -n "$g_counters" ]   && options=${options}c
GS----->
GS----->     options="${options}V $VERBOSITY"
GS----->
GS----->     [ -n "$RESTOREFILE" ] && options="${options} -R $RESTOREFILE"
GS----->
GS----->     $SHOREWALL_SHELL $script $options $@
GS-----> }
GS----->
GS-----> #
GS-----> # Message to stderr
GS-----> #
GS-----> error_message() # $* = Error Message
GS-----> {
GS----->    echo "   $@" >&2
GS----->    return 1
GS-----> }
GS----->
GS-----> #
GS-----> # Undo the effect of 'split()'
GS-----> #
GS-----> join()
GS-----> {
GS----->     local f
GS----->     local o
GS----->     o=
GS----->
GS----->     for f in $* ; do
GS----->         o="${o:+$o:}$f"
GS----->     done
GS----->
GS----->     echo $o
GS-----> }
GS----->
GS-----> #
GS-----> # Return the number of elements in a list
GS-----> #
GS-----> list_count() # $* = list
GS-----> {
GS----->     return $#
GS-----> }
GS----->
GS-----> #
GS-----> # Split a colon-separated list into a space-separated list
GS-----> #
GS-----> split() {
GS----->     local ifs
GS----->     ifs=$IFS
GS----->     IFS=:
GS----->     echo $*
GS----->     IFS=$ifs
GS-----> }
GS----->
GS-----> #
GS-----> # Split a comma-separated list into a space-separated list
GS-----> #
GS-----> split_list() {
GS----->     local ifs
GS----->     ifs=$IFS
GS----->     IFS=,
GS----->     echo $*
GS----->     IFS=$ifs
GS-----> }
GS----->
GS-----> #
GS-----> # Search a list looking for a match -- returns zero if a match found
GS-----> # 1 otherwise
GS-----> #
GS-----> list_search() # $1 = element to search for , $2-$n = list
GS-----> {
GS----->     local e
GS----->     e=$1
GS----->
GS----->     while [ $# -gt 1 ]; do
GS-----> 	shift
GS-----> 	[ "x$e" = "x$1" ] && return 0
GS----->     done
GS----->
GS----->     return 1
GS-----> }
GS----->
GS-----> #
GS-----> # Suppress all output for a command
GS-----> #
GS-----> qt()
GS-----> {
GS----->     "$@" >/dev/null 2>&1
GS-----> }
GS----->
GS-----> #
GS-----> # Suppress all output and input - mainly for preventing leaked file descriptors
GS-----> # to avoid SELinux denials
GS-----> #
GS-----> qtnoin()
GS-----> {
GS----->     "$@" </dev/null >/dev/null 2>&1
GS-----> }
GS----->
GS-----> qt1()
GS-----> {
GS----->     local status
GS----->
GS----->     while [ 1 ]; do
GS-----> 	"$@" </dev/null >/dev/null 2>&1
GS-----> 	status=$?
GS-----> 	[ $status -ne 4 ] && return $status
GS----->     done
GS-----> }
GS----->
GS-----> #
GS-----> # Determine if Shorewall[6] is "running"
GS-----> #
GS-----> product_is_started() {
GS----->     qt1 $g_tool -L shorewall -n
GS-----> }
GS----->
GS-----> shorewall_is_started() {
GS----->     qt1 $IPTABLES -L shorewall -n
GS-----> }
GS----->
GS-----> shorewall6_is_started() {
GS----->     qt1 $IP6TABLES -L shorewall -n
GS-----> }
GS----->
GS-----> #
GS-----> # Echos the fully-qualified name of the calling shell program
GS-----> #
GS-----> my_pathname() {
GS----->     local pwd
GS----->     pwd=$PWD
GS----->     cd $(dirname $0)
GS----->     echo $PWD/$(basename $0)
GS----->     cd $pwd
GS-----> }
GS----->
GS-----> #
GS-----> # Source a user exit file if it exists
GS-----> #
GS-----> run_user_exit() # $1 = file name
GS-----> {
GS----->     local user_exit
GS----->     user_exit=$(find_file $1)
GS----->
GS----->     if [ -f $user_exit ]; then
GS-----> 	progress_message "Processing $user_exit ..."
GS-----> 	. $user_exit
GS----->     fi
GS-----> }
GS----->
GS-----> #
GS-----> # Load a Kernel Module -- assumes that the variable 'moduledirectories' contains
GS-----> #                         a space-separated list of directories to search for
GS-----> #                         the module and that 'moduleloader' contains the
GS-----> #                         module loader command.
GS-----> #
GS-----> loadmodule() # $1 = module name, $2 - * arguments
GS-----> {
GS----->     local modulename
GS----->     modulename=$1
GS----->     shift
GS----->     local moduleoptions
GS----->     moduleoptions=$*
GS----->     local modulefile
GS----->     local suffix
GS----->
GS----->     if [ -d /sys/module/ ]; then
GS-----> 	if ! list_search $modulename $DONT_LOAD; then
GS-----> 	    if [ ! -d /sys/module/$modulename ]; then
GS-----> 		case $moduleloader in
GS-----> 		    insmod)
GS-----> 			for directory in $moduledirectories; do
GS-----> 			    for modulefile in $directory/${modulename}.*; do
GS-----> 				if [ -f $modulefile ]; then
GS-----> 				    insmod $modulefile $moduleoptions
GS-----> 				    return
GS-----> 				fi
GS-----> 			    done
GS-----> 			done
GS-----> 			;;
GS-----> 		    *)
GS-----> 			modprobe -q $modulename $moduleoptions
GS-----> 			;;
GS-----> 		esac
GS-----> 	    fi
GS-----> 	fi
GS----->     elif ! list_search $modulename $DONT_LOAD $MODULES; then
GS-----> 	case $moduleloader in
GS-----> 	    insmod)
GS-----> 		for directory in $moduledirectories; do
GS-----> 		    for modulefile in $directory/${modulename}.*; do
GS-----> 			if [ -f $modulefile ]; then
GS-----> 			    insmod $modulefile $moduleoptions
GS-----> 			    return
GS-----> 			fi
GS-----> 		    done
GS-----> 		done
GS-----> 		;;
GS-----> 	    *)
GS-----> 		modprobe -q $modulename $moduleoptions
GS-----> 		;;
GS-----> 	esac
GS----->     fi
GS-----> }
GS----->
GS-----> #
GS-----> # Reload the Modules
GS-----> #
GS-----> reload_kernel_modules() {
GS----->
GS----->     local save_modules_dir
GS----->     save_modules_dir=$MODULESDIR
GS----->     local directory
GS----->     local moduledirectories
GS----->     moduledirectories=
GS----->     local moduleloader
GS----->     moduleloader=modprobe
GS----->     local uname
GS----->     local extras
GS----->
GS----->     if ! qt mywhich modprobe; then
GS-----> 	moduleloader=insmod
GS----->     fi
GS----->
GS----->     if [ -n "$MODULESDIR" ]; then
GS-----> 	case "$MODULESDIR" in
GS-----> 	    +*)
GS-----> 		extras="$MODULESDIR"
GS-----> 		extras=${extras#+}
GS-----> 		MODULESDIR=
GS-----> 		;;
GS-----> 	esac
GS----->     fi
GS----->
GS----->     if [ -z "$MODULESDIR" ]; then
GS-----> 	uname=$(uname -r)
GS-----> 	MODULESDIR=/lib/modules/$uname/kernel/net/ipv${g_family}/netfilter:/lib/modules/$uname/kernel/net/netfilter:/lib/modules/$uname/kernel/net/sched:/lib/modules/$uname/extra:/lib/modules/$uname/extra/ipset
GS-----> 	if [ -n "$extras" ]; then
GS-----> 	    for directory in $(split "$extras"); do
GS-----> 		MODULESDIR="$MODULESDIR:/lib/modules/$uname/$directory"
GS-----> 	    done
GS-----> 	fi
GS----->     fi
GS----->
GS----->     [ -d /sys/module/ ] || MODULES=$(lsmod | cut -d ' ' -f1)
GS----->
GS----->     for directory in $(split $MODULESDIR); do
GS-----> 	[ -d $directory ] && moduledirectories="$moduledirectories $directory"
GS----->     done
GS----->
GS----->     [ -n "$moduledirectories" ] && while read command; do
GS-----> 	eval $command
GS----->     done
GS----->
GS----->     MODULESDIR=$save_modules_dir
GS-----> }
GS----->
GS-----> #
GS-----> # Load kernel modules required for Shorewall
GS-----> #
GS-----> load_kernel_modules() # $1 = Yes, if we are to save moduleinfo in $VARDIR
GS-----> {
GS----->     local save_modules_dir
GS----->     save_modules_dir=$MODULESDIR
GS----->     local directory
GS----->     local moduledirectories
GS----->     moduledirectories=
GS----->     local moduleloader
GS----->     moduleloader=modprobe
GS----->     local savemoduleinfo
GS----->     savemoduleinfo=${1:-Yes} # So old compiled scripts still work
GS----->     local uname
GS----->     local extras
GS----->
GS----->     if ! qt mywhich modprobe; then
GS-----> 	moduleloader=insmod
GS----->     fi
GS----->
GS----->     if [ -n "$MODULESDIR" ]; then
GS-----> 	case "$MODULESDIR" in
GS-----> 	    +*)
GS-----> 		extras="$MODULESDIR"
GS-----> 		extras=${extras#+}
GS-----> 		MODULESDIR=
GS-----> 		;;
GS-----> 	esac
GS----->     fi
GS----->
GS----->     if [ -z "$MODULESDIR" ]; then
GS-----> 	uname=$(uname -r)
GS-----> 	MODULESDIR=/lib/modules/$uname/kernel/net/ipv${g_family}/netfilter:/lib/modules/$uname/kernel/net/netfilter:/lib/modules/$uname/kernel/net/sched:/lib/modules/$uname/extra:/lib/modules/$uname/extra/ipset
GS-----> 	if [ -n "$extras" ]; then
GS-----> 	    for directory in $(split "$extras"); do
GS-----> 		MODULESDIR="$MODULESDIR:/lib/modules/$uname/$directory"
GS-----> 	    done
GS-----> 	fi
GS----->     fi
GS----->
GS----->     for directory in $(split $MODULESDIR); do
GS-----> 	[ -d $directory ] && moduledirectories="$moduledirectories $directory"
GS----->     done
GS----->
GS----->     modules=$(find_file helpers)
GS----->
GS----->     if [ -f $modules -a -n "$moduledirectories" ]; then
GS-----> 	[ -d /sys/module/ ] || MODULES=$(lsmod | cut -d ' ' -f1)
GS-----> 	progress_message "Loading Modules..."
GS-----> 	. $modules
GS-----> 	if [ $savemoduleinfo = Yes ]; then
GS-----> 	    [ -d ${VARDIR} ] || mkdir -p ${VARDIR}
GS-----> 	    echo MODULESDIR=\"$MODULESDIR\" > ${VARDIR}/.modulesdir
GS-----> 	    cp -f $modules ${VARDIR}/.modules
GS-----> 	fi
GS----->     elif [ $savemoduleinfo = Yes ]; then
GS-----> 	[ -d ${VARDIR} ] || mkdir -p ${VARDIR}
GS-----> 	> ${VARDIR}/.modulesdir
GS-----> 	> ${VARDIR}/.modules
GS----->     fi
GS----->
GS----->     MODULESDIR=$save_modules_dir
GS-----> }
GS----->
GS-----> #
GS-----> #  Note: The following set of IP address manipulation functions have anomalous
GS-----> #        behavior when the shell only supports 32-bit signed arithmetic and
GS-----> #        the IP address is 128.0.0.0 or 128.0.0.1.
GS-----> #
GS----->
GS-----> LEFTSHIFT='<<'
GS----->
GS-----> #
GS-----> # Convert an IP address in dot quad format to an integer
GS-----> #
GS-----> decodeaddr() {
GS----->     local x
GS----->     local temp
GS----->     temp=0
GS----->     local ifs
GS----->     ifs=$IFS
GS----->
GS----->     IFS=.
GS----->
GS----->     for x in $1; do
GS-----> 	temp=$(( $(( $temp $LEFTSHIFT 8 )) | $x ))
GS----->     done
GS----->
GS----->     echo $temp
GS----->
GS----->     IFS=$ifs
GS-----> }
GS----->
GS-----> #
GS-----> # convert an integer to dot quad format
GS-----> #
GS-----> encodeaddr() {
GS----->     addr=$1
GS----->     local x
GS----->     local y
GS----->     y=$(($addr & 255))
GS----->
GS----->     for x in 1 2 3 ; do
GS-----> 	addr=$(($addr >> 8))
GS-----> 	y=$(($addr & 255)).$y
GS----->     done
GS----->
GS----->     echo $y
GS-----> }
GS----->
GS-----> #
GS-----> # Netmask from CIDR
GS-----> #
GS-----> ip_netmask() {
GS----->     local vlsm
GS----->     vlsm=${1#*/}
GS----->
GS----->     [ $vlsm -eq 0 ] && echo 0 || echo $(( -1 $LEFTSHIFT $(( 32 - $vlsm )) ))
GS-----> }
GS----->
GS-----> #
GS-----> # Network address from CIDR
GS-----> #
GS-----> ip_network() {
GS----->     local decodedaddr
GS----->     decodedaddr=$(decodeaddr ${1%/*})
GS----->     local netmask
GS----->     netmask=$(ip_netmask $1)
GS----->
GS----->     echo $(encodeaddr $(($decodedaddr & $netmask)))
GS-----> }
GS----->
GS-----> #
GS-----> # The following hack is supplied to compensate for the fact that many of
GS-----> # the popular light-weight Bourne shell derivatives do not support XOR ("^").
GS-----> #
GS-----> ip_broadcast() {
GS----->     local x
GS----->     x=$(( 32 - ${1#*/} ))
GS----->
GS----->     [ $x -eq 32 ] && echo -1 || echo $(( $(( 1 $LEFTSHIFT $x )) - 1 ))
GS-----> }
GS----->
GS-----> #
GS-----> # Calculate broadcast address from CIDR
GS-----> #
GS-----> broadcastaddress() {
GS----->     local decodedaddr
GS----->     decodedaddr=$(decodeaddr ${1%/*})
GS----->     local netmask
GS----->     netmask=$(ip_netmask $1)
GS----->     local broadcast
GS----->     broadcast=$(ip_broadcast $1)
GS----->
GS----->     echo $(encodeaddr $(( $(($decodedaddr & $netmask)) | $broadcast )))
GS-----> }
GS----->
GS-----> #
GS-----> # Test for network membership
GS-----> #
GS-----> in_network() # $1 = IP address, $2 = CIDR network
GS-----> {
GS----->     local netmask
GS----->     netmask=$(ip_netmask $2)
GS----->     #
GS----->     # Use string comparison to work around a broken BusyBox ash in OpenWRT
GS----->     #
GS----->     test $(( $(decodeaddr $1) & $netmask)) = $(( $(decodeaddr ${2%/*}) & $netmask ))
GS-----> }
GS----->
GS-----> #
GS-----> # Query NetFilter about the existence of a filter chain
GS-----> #
GS-----> chain_exists() # $1 = chain name, $2 = table name (optional)
GS-----> {
GS----->     qt1 $g_tool -t ${2:-filter} -L $1 -n
GS-----> }
GS----->
GS-----> #
GS-----> # Find the interface with the passed MAC address
GS-----> #
GS----->
GS-----> find_interface_by_mac() {
GS----->     local mac
GS----->     mac=$1
GS----->     local first
GS----->     local second
GS----->     local rest
GS----->     local dev
GS----->
GS----->     $IP link list | while read first second rest; do
GS-----> 	case $first in
GS-----> 	    *:)
GS----->                 dev=$second
GS-----> 		;;
GS-----> 	    *)
GS-----> 	        if [ "$second" = $mac ]; then
GS-----> 		    echo ${dev%:}
GS-----> 		    return
GS-----> 		fi
GS-----> 	esac
GS----->     done
GS-----> }
GS----->
GS-----> #
GS-----> # Find interface address--returns the first IP address assigned to the passed
GS-----> # device
GS-----> #
GS-----> find_first_interface_address() # $1 = interface
GS-----> {
GS----->     if [ $g_family -eq 4 ]; then
GS-----> 	#
GS-----> 	# get the line of output containing the first IP address
GS-----> 	#
GS-----> 	addr=$(${IP:-ip} -f inet addr show $1 2> /dev/null | grep 'inet .* global' | head -n1)
GS-----> 	#
GS-----> 	# If there wasn't one, bail out now
GS-----> 	#
GS-----> 	[ -n "$addr" ] || startup_error "Can't determine the IP address of $1"
GS-----> 	#
GS-----> 	# Strip off the trailing VLSM mask (or the peer IP in case of a P-t-P link)
GS-----> 	# along with everything else on the line
GS-----> 	#
GS-----> 	echo $addr | sed 's/\s*inet //;s/\/.*//;s/ peer.*//'
GS----->     else
GS-----> 	#
GS-----> 	# get the line of output containing the first IP address
GS-----> 	#
GS-----> 	addr=$(${IP:-ip} -f inet6 addr show dev $1 2> /dev/null | grep -F 'inet6 ' | grep -vF 'scope link' | head -n1)
GS-----> 	#
GS-----> 	# If there wasn't one, bail out now
GS-----> 	#
GS-----> 	[ -n "$addr" ] || startup_error "Can't determine the IPv6 address of $1"
GS-----> 	#
GS-----> 	# Strip off the trailing VLSM mask (or the peer IP in case of a P-t-P link)
GS-----> 	# along with everything else on the line
GS-----> 	#
GS-----> 	echo $addr | sed 's/\s*inet6 //;s/\/.*//;s/ peer.*//'
GS----->     fi
GS-----> }
GS----->
GS-----> find_first_interface_address_if_any() # $1 = interface
GS-----> {
GS----->     if [ $g_family -eq 4 ]; then
GS-----> 	#
GS-----> 	# get the line of output containing the first IP address
GS-----> 	#
GS-----> 	addr=$(${IP:-ip} -f inet addr show $1 2> /dev/null | grep 'inet .* global' | head -n1)
GS-----> 	#
GS-----> 	# Strip off the trailing VLSM mask (or the peer IP in case of a P-t-P link)
GS-----> 	# along with everything else on the line
GS-----> 	#
GS-----> 	[ -n "$addr" ] && echo $addr | sed 's/\s*inet //;s/\/.*//;s/ peer.*//' || echo 0.0.0.0
GS----->     else
GS-----> 	#
GS-----> 	# get the line of output containing the first IP address
GS-----> 	#
GS-----> 	addr=$(${IP:-ip} -f inet6 addr show dev $1 2> /dev/null | grep -F 'inet6 ' | grep -vF 'scope link' | head -n1)
GS-----> 	#
GS-----> 	# Strip off the trailing VLSM mask (or the peer IP in case of a P-t-P link)
GS-----> 	# along with everything else on the line
GS-----> 	#
GS-----> 	[ -n "$addr" ] && echo $addr | sed 's/\s*inet6 //;s/\/.*//;s/ peer.*//' || echo ::
GS----->     fi
GS-----> }
GS----->
GS-----> #
GS-----> #Determines if the passed interface is a loopback interface
GS-----> #
GS-----> loopback_interface() { #$1 = Interface name
GS----->     [ "$1" = lo ] || $IP link show $1 | fgrep -q LOOPBACK
GS-----> }
GS----->
GS-----> #
GS-----> # Find Loopback Interfaces
GS-----> #
GS-----> find_loopback_interfaces() {
GS----->     local interfaces
GS----->
GS----->     [ -x "$IP" ] && interfaces=$($IP link show | fgrep LOOPBACK | sed 's/://g' | cut -d ' ' -f 2)
GS----->
GS----->     [ -n "$interfaces" ] && echo $interfaces || echo lo
GS-----> }
GS----->
GS-----> #
GS-----> # Internal version of 'which'
GS-----> #
GS-----> mywhich() {
GS----->     local dir
GS----->
GS----->     for dir in $(split $PATH); do
GS-----> 	if [ -x $dir/$1 ]; then
GS-----> 	    echo $dir/$1
GS-----> 	    return 0
GS-----> 	fi
GS----->     done
GS----->
GS----->     return 2
GS-----> }
GS----->
GS-----> #
GS-----> # Find a File -- For relative file name, look in each ${CONFIG_PATH} then ${CONFDIR}
GS-----> #
GS-----> find_file()
GS-----> {
GS----->     local saveifs
GS----->     saveifs=
GS----->     local directory
GS----->
GS----->     case $1 in
GS-----> 	/*)
GS-----> 	    echo $1
GS-----> 	    ;;
GS-----> 	*)
GS-----> 	    for directory in $(split $CONFIG_PATH); do
GS-----> 		if [ -f $directory/$1 ]; then
GS-----> 		    echo $directory/$1
GS-----> 		    return
GS-----> 		fi
GS-----> 	    done
GS----->
GS-----> 	    if [ -n "$g_shorewalldir" ]; then
GS-----> 		echo ${g_shorewalldir}/$1
GS-----> 	    else
GS-----> 		echo ${g_confdir}/$1
GS-----> 	    fi
GS-----> 	    ;;
GS----->     esac
GS-----> }
GS----->
GS-----> #
GS-----> # Set the Shorewall state
GS-----> #
GS-----> set_state () # $1 = state
GS-----> {
GS----->     if [ $# -gt 1 ]; then
GS-----> 	echo "$1 $(date) from $2" > ${VARDIR}/state
GS----->     else
GS-----> 	echo "$1 $(date)" > ${VARDIR}/state
GS----->     fi
GS-----> }
GS----->
GS-----> #
GS-----> # Perform variable substitution on the passed argument and echo the result
GS-----> #
GS-----> expand() # $@ = contents of variable which may be the name of another variable
GS-----> {
GS----->     eval echo \"$@\"
GS-----> }
GS----->
GS-----> #
GS-----> # Function for including one file into another
GS-----> #
GS-----> INCLUDE() {
GS----->     . $(find_file $(expand $@))
GS-----> }
GS----->
GS-----> # Function to truncate a string -- It uses 'cut -b -<n>'
GS-----> # rather than ${v:first:last} because light-weight shells like ash and
GS-----> # dash do not support that form of expansion.
GS-----> #
GS----->
GS-----> truncate() # $1 = length
GS-----> {
GS----->     cut -b -${1}
GS-----> }
GS----->
GS-----> #
GS-----> # Call this function to assert mutual exclusion with Shorewall. If you invoke the
GS-----> # /sbin/shorewall program while holding mutual exclusion, you should pass "nolock" as
GS-----> # the first argument. Example "shorewall nolock refresh"
GS-----> #
GS-----> # This function uses the lockfile utility from procmail if it exists.
GS-----> # Otherwise, it uses a somewhat race-prone algorithm to attempt to simulate the
GS-----> # behavior of lockfile.
GS-----> #
GS-----> mutex_on()
GS-----> {
GS----->     local try
GS----->     try=0
GS----->     local lockf
GS----->     lockf=${LOCKFILE:=${VARDIR}/lock}
GS----->     local lockpid
GS----->     local lockd
GS----->     local lockbin
GS----->     local openwrt
GS----->
GS----->     MUTEX_TIMEOUT=${MUTEX_TIMEOUT:-60}
GS----->
GS----->     if [ -z "$g_havemutex" -a $MUTEX_TIMEOUT -gt 0 ]; then
GS----->
GS-----> 	lockd=$(dirname $LOCKFILE)
GS----->
GS-----> 	[ -d "$lockd" ] || mkdir -p "$lockd"
GS----->
GS-----> 	lockbin=$(mywhich lock)
GS-----> 	[ -n "$lockbin" -a -h "$lockbin" ] && openwrt=Yes
GS----->
GS-----> 	if [ -f $lockf ]; then
GS-----> 	    lockpid=`cat ${lockf} 2> /dev/null`
GS-----> 	    if [ -z "$lockpid" ] || [ $lockpid = 0 ]; then
GS-----> 		rm -f ${lockf}
GS-----> 		error_message "WARNING: Stale lockfile ${lockf} removed"
GS-----> 	    elif [ -z "$openwrt" ]; then
GS-----> 		if [ $lockpid -eq $$ ]; then
GS----->                     fatal_error "Mutex_on confusion"
GS-----> 		elif ! qt ps --pid ${lockpid}; then
GS-----> 		    rm -f ${lockf}
GS-----> 		    error_message "WARNING: Stale lockfile ${lockf} from pid ${lockpid} removed"
GS-----> 		fi
GS-----> 	    fi
GS-----> 	fi
GS----->
GS-----> 	if [ -n "$openwrt" ]; then
GS-----> 	    lock ${lockf} || fatal_error "Can't lock ${lockf}"
GS-----> 	    g_havemutex="lock -u ${lockf}"
GS-----> 	elif qt mywhich lockfile; then
GS-----> 	    lockfile -${MUTEX_TIMEOUT} -r1 ${lockf} || fatal_error "Can't lock ${lockf}"
GS-----> 	    g_havemutex="rm -f ${lockf}"
GS-----> 	    chmod u+w ${lockf}
GS-----> 	    echo $$ > ${lockf}
GS-----> 	    chmod u-w ${lockf}
GS-----> 	else
GS-----> 	    while [ -f ${lockf} -a ${try} -lt ${MUTEX_TIMEOUT} ] ; do
GS-----> 		sleep 1
GS-----> 		try=$((${try} + 1))
GS-----> 	    done
GS----->
GS-----> 	    if  [ ${try} -lt ${MUTEX_TIMEOUT} ] ; then
GS-----> 	        # Create the lockfile
GS-----> 		echo $$ > ${lockf}
GS-----> 		g_havemutex="rm -f ${lockf}"
GS-----> 	    else
GS-----> 		echo "Giving up on lock file ${lockf}" >&2
GS-----> 	    fi
GS-----> 	fi
GS----->
GS-----> 	if [ -n "$g_havemutex" ]; then
GS-----> 	    trap mutex_off EXIT
GS-----> 	fi
GS----->     fi
GS-----> }
GS----->
GS-----> #
GS-----> # Call this function to release mutual exclusion
GS-----> #
GS-----> mutex_off()
GS-----> {
GS----->     if [ -n "$g_havemutex" ]; then
GS-----> 	eval $g_havemutex
GS-----> 	g_havemutex=
GS-----> 	trap '' exit
GS----->     fi
GS-----> }
GS----->
GS-----> ################################################################################
GS-----> #   End of imports from /usr/share/shorewall//lib.common
GS-----> ################################################################################
GS-----> ################################################################################
GS-----> # Functions to execute the various user exits (extension scripts)
GS-----> ################################################################################
GS-----> run_init_exit() {
GS----->     progress_message2 Processing /etc/shorewall/init ...
GS-----> 
GS----->     #
GS----->     # Shorewall -- /etc/shorewall/init
GS----->     #
GS----->     # Add commands below that you want to be executed at the beginning of
GS----->     # a "shorewall start", "shorewall-reload" or "shorewall restart" command.
GS----->     #
GS----->     # For additional information, see
GS----->     # http://shorewall.net/shorewall_extension_scripts.htm
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_start_exit() {
GS----->     progress_message2 Processing /etc/shorewall/start ...
GS-----> 
GS----->     #
GS----->     # Shorewall -- /etc/shorewall/start
GS----->     #
GS----->     # Add commands below that you want to be executed after shorewall has
GS----->     # been started, reloaded or restarted.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS----->
GS----->     return 0
GS-----> }
GS-----> run_tcclear_exit() {
GS----->     progress_message2 Processing /etc/shorewall/tcclear ...
GS-----> 
GS----->     #
GS----->     # Shorewall -- /etc/shorewall/tcclear
GS----->     #
GS----->     # Add commands below that you want to be executed before Shorewall clears
GS----->     # the traffic shaping configuration.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_started_exit() {
GS----->     progress_message2 Processing /etc/shorewall/started ...
GS-----> 
GS----->     #
GS----->     # Shorewall -- /etc/shorewall/started
GS----->     #
GS----->     # Add commands below that you want to be executed after shorewall has
GS----->     # been completely started, reloaded or restarted. The difference between
GS----->     # this extension script and /etc/shorewall/start is that this one is
GS----->     # invoked after the 'shorewall' chain has been created (thus
GS----->     # signaling that the firewall is completely up).
GS----->     #
GS----->     # This script should not change the firewall configuration directly but
GS----->     # may do so indirectly by running /sbin/shorewall with the 'nolock'
GS----->     # option.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_stop_exit() {
GS----->     progress_message2 Processing /etc/shorewall/stop ...
GS-----> 
GS----->     #
GS----->     # Shorewall -- /etc/shorewall/stop
GS----->     #
GS----->     # Add commands below that you want to be executed at the beginning of a
GS----->     # "shorewall stop" command.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_stopped_exit() {
GS----->     progress_message2 Processing /etc/shorewall/stopped ...
GS-----> 
GS----->     #
GS----->     # Shorewall -- /etc/shorewall/stopped
GS----->     #
GS----->     # Add commands below that you want to be executed at the completion of a
GS----->     # "shorewall stop" command.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS----->     conntrack -F
GS-----> }
GS-----> run_clear_exit() {
GS----->     progress_message2 Processing /etc/shorewall/clear ...
GS-----> 
GS----->     #
GS----->     # Shorewall -- /etc/shorewall/clear
GS----->     #
GS----->     # Add commands below that you want to be executed after Shorewall has
GS----->     # processed the 'clear' command.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_restored_exit() {
GS----->     progress_message2 Processing /etc/shorewall/restored ...
GS-----> 
GS----->     #
GS----->     # Shorewall -- /etc/shorewall/restored
GS----->     #
GS----->     # Add commands below that you want to be executed after shorewall has
GS----->     # completed a 'restore' command.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_enabled_exit() {
GS----->     true
GS-----> }
GS-----> run_disabled_exit() {
GS----->     true
GS-----> }
GS-----> run_isusable_exit() {
GS----->     true
GS-----> }
GS-----> run_findgw_exit() {
GS----->     #
GS----->     # Shorewall -- /etc/shorewall/findgw
GS----->     #
GS----->     # The code in this file is executed when Shorewall is trying to detect the
GS----->     # gateway through an interface in /etc/shorewall/providers that has GATEWAY
GS----->     # specified as 'detect'.
GS----->     #
GS----->     # The function should echo the IP address of the gateway if it knows what
GS----->     # it is; the name of the interface is in $1.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS----->     true
GS-----> }
GS-----> ################################################################################
GS-----> # End user exit functions
GS-----> ################################################################################
GS-----> #
GS-----> # Setup Common Rules (/proc)
GS-----> #
GS-----> setup_common_rules() {
                NF-(A)-> filter:reject:1        -A reject -m addrtype --src-type BROADCAST -j DROP
                NF-(A)-> filter:reject:2        -A reject -s 224.0.0.0/4 -j DROP
                NF-(A)-> filter:reject:3        -A reject -p 2 -j DROP
                NF-(A)-> filter:reject:4        -A reject -p 6 -j REJECT --reject-with tcp-reset
SYS----> /usr/bin/iptables -w -A fooX16630 -j REJECT --reject-with icmp-host-prohibited
                NF-(A)-> filter:reject:5        -A reject -p 17 -j REJECT
                NF-(A)-> filter:reject:6        -A reject -p 1 -j REJECT --reject-with icmp-host-unreachable
                NF-(A)-> filter:reject:7        -A reject -j REJECT --reject-with icmp-host-prohibited
                NF-(N)-> filter:sfilter         
                NF-(A)-> filter:sfilter:1       -A sfilter -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 10 --hashlimit-name lograte --hashlimit-mode srcip -j NFLOG --nflog-group 1 --nflog-range 0 --nflog-threshold 1 --nflog-prefix "IPv4 sfilter DROP " 
                NF-(A)-> filter:sfilter:2       -A sfilter -j DROP
                NF-(N)-> filter:wan_fwd         
                NF-(N)-> filter:wan_in          
                NF-(N)-> filter:wan_out         
                NF-(N)-> filter:wan_fop         
                NF-(N)-> filter:wan_iop         
                NF-(N)-> filter:wan_oop         
                NF-(N)-> filter:lan_fwd         
                NF-(N)-> filter:lan_in          
                NF-(N)-> filter:lan_out         
                NF-(N)-> filter:lan_fop         
                NF-(N)-> filter:lan_iop         
                NF-(N)-> filter:lan_oop         
                NF-(N)-> filter:lo_fwd          
                NF-(N)-> filter:lo_in           
                NF-(N)-> filter:lo_out          
                NF-(N)-> filter:lo_fop          
                NF-(N)-> filter:lo_iop          
                NF-(N)-> filter:lo_oop          
                NF-(N)-> mangle:rplog           
                NF-(A)-> mangle:rplog:1         -A rplog -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 10 --hashlimit-name lograte --hashlimit-mode srcip -j NFLOG --nflog-group 1 --nflog-range 0 --nflog-threshold 1 --nflog-prefix "IPv4 rplog DROP rpfilter " 
                NF-(A)-> mangle:rplog:2         -A rplog -j DROP
                NF-(N)-> mangle:rpfilter        
                NF-(A)-> mangle:rpfilter:1      -A rpfilter -s 0.0.0.0 -p 17 --dport 67 --sport 68 -j RETURN
SYS----> /usr/bin/iptables -w -A fooX16630 -g foo1X16630
                NF-(A)-> mangle:rpfilter:2      -A rpfilter -m rpfilter --validmark --invert -m conntrack --ctstate NEW,RELATED,INVALID -j rplog
Running /etc/shorewall/initdone...
Adding Anti-smurf Rules
                NF-(N)-> filter:smurfs          
                NF-(N)-> filter:smurflog        
                NF-(A)-> filter:smurflog:1      -A smurflog -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 10 --hashlimit-name lograte --hashlimit-mode srcip -j NFLOG --nflog-group 1 --nflog-range 0 --nflog-threshold 1 --nflog-prefix "IPv4 smurfs DROP smurf "
                NF-(A)-> filter:smurflog:2      -A smurflog -j DROP
                NF-(A)-> filter:smurfs:1        -A smurfs -s 0.0.0.0 -j RETURN
                NF-(A)-> filter:smurfs:2        -A smurfs -m addrtype --src-type BROADCAST -g smurflog
                NF-(A)-> filter:smurfs:3        -A smurfs -s 224.0.0.0/4 -g smurflog
                NF-(A)-> filter:wan_fop:1       -A wan_fop -m conntrack --ctstate NEW,INVALID,UNTRACKED -j smurfs
                NF-(A)-> filter:wan_iop:1       -A wan_iop -m conntrack --ctstate NEW,INVALID,UNTRACKED -j smurfs
Adding rules for DHCP
                NF-(A)-> filter:wan_iop:2       -A wan_iop -p udp --dport 67:68 -j ACCEPT
                NF-(A)-> filter:wan_oop:1       -A wan_oop -p udp --dport 67:68 -j ACCEPT
                NF-(A)-> filter:lan_iop:1       -A lan_iop -p udp --dport 67:68 -j ACCEPT
                NF-(A)-> filter:lan_oop:1       -A lan_oop -p udp --dport 67:68 -j ACCEPT
Compiling TCP Flags filtering...
                NF-(N)-> filter:tcpflags        
                NF-(N)-> filter:logflags        
                NF-(A)-> filter:logflags:1      -A logflags -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 10 --hashlimit-name lograte --hashlimit-mode srcip -j NFLOG --nflog-group 1 --nflog-range 0 --nflog-threshold 1 --nflog-prefix "IPv4 logflags DROP tcpflags " 
                NF-(A)-> filter:logflags:2      -A logflags -j DROP
                NF-(A)-> filter:tcpflags:1      -A tcpflags -p tcp --tcp-flags ALL FIN,URG,PSH -g logflags
                NF-(A)-> filter:tcpflags:2      -A tcpflags -p tcp --tcp-flags ALL NONE -g logflags
                NF-(A)-> filter:tcpflags:3      -A tcpflags -p tcp --tcp-flags SYN,RST SYN,RST -g logflags
                NF-(A)-> filter:tcpflags:4      -A tcpflags -p tcp --tcp-flags FIN,RST FIN,RST -g logflags
                NF-(A)-> filter:tcpflags:5      -A tcpflags -p tcp --tcp-flags SYN,FIN SYN,FIN -g logflags
                NF-(A)-> filter:tcpflags:6      -A tcpflags -p tcp --tcp-flags ACK,PSH,FIN PSH,FIN -g logflags
                NF-(A)-> filter:tcpflags:7      -A tcpflags -p tcp --syn --sport 0 -g logflags
                NF-(A)-> filter:wan_fop:2       -A wan_fop -p tcp -j tcpflags
                NF-(A)-> filter:wan_iop:3       -A wan_iop -p tcp -j tcpflags
                NF-(A)-> filter:lan_fop:1       -A lan_fop -p tcp -j tcpflags
                NF-(A)-> filter:lan_iop:2       -A lan_iop -p tcp -j tcpflags
Compiling Kernel Route Filtering...
GS----->     progress_message2 Setting up Route Filtering...
GS-----> 
GS----->     for file in /proc/sys/net/ipv4/conf/*; do
GS-----> 	[ -f $file/rp_filter ] && echo 0 > $file/rp_filter
GS----->     done
GS-----> 
GS----->     echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
GS----->     echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
GS----->     [ -n "$g_noroutes" ] || $IP -4 route flush cache
Compiling Martian Logging...
GS----->     progress_message2 Setting up Martian Logging...
GS-----> 
GS----->     for file in /proc/sys/net/ipv4/conf/*; do
GS-----> 	[ -f $file/log_martians ] && echo 1 > $file/log_martians
GS----->     done
GS-----> 
GS----->     echo 0 > /proc/sys/net/ipv4/conf/all/log_martians
GS-----> 
GS----->     if [ -f /proc/sys/net/ipv4/conf/wan/log_martians ]; then
GS-----> 	echo 1 > /proc/sys/net/ipv4/conf/wan/log_martians
GS----->     fi
GS-----> 
GS----->     progress_message2 "Setting up log backend"
GS-----> 
GS----->     if [ -f /proc/sys/net/netfilter/nf_log/2 ]; then
GS-----> 	if echo nfnetlink_log > /proc/sys/net/netfilter/nf_log/2; then
GS-----> 	    progress_message 'Log Backend set to nfnetlink_log'
GS-----> 	else
GS-----> 	    error_message 'WARNING: Unable to set log backend to nfnetlink_log'
GS-----> 	fi
GS----->     else
GS-----> 	error_message 'WARNING: /proc/sys/net/netfilter/nf_log/2 does not exist - log backend not set'
GS----->     fi
GS-----> 
GS----->     progress_message2 Setting up Proxy ARP...
GS-----> 
GS----->     #
GS----->     # Disable automatic helper association on kernel 3.5.0 and later
GS----->     #
GS----->     if [ -f /proc/sys/net/netfilter/nf_conntrack_helper ]; then
GS-----> 	progress_message "Disabling Kernel Automatic Helper Association"
GS-----> 	echo 0 > /proc/sys/net/netfilter/nf_conntrack_helper
GS----->     fi
GS-----> 
GS----->     return 0
GS-----> }
GS-----> 
GS-----> #
GS-----> # Add Optional Interface wan (-65535)
GS-----> #
GS-----> start_interface_wan() {
GS----->     if [ -n "$SW_WAN_IS_USABLE" ]; then
GS-----> 	> ${VARDIR}/undo_wan_routing
GS-----> 
GS-----> 	cat <<EOF >> ${VARDIR}/undo_wan_routing
GS-----> 	if [ $COMMAND = enable ]; then
GS-----> 	    echo 1 > /proc/sys/net/ipv4/conf/wan/log_martians
GS-----> 	fi
GS-----> 
GS-----> 	echo 0 > ${VARDIR}/wan.status
GS-----> 
GS-----> 	if [ $COMMAND = enable ]; then
GS-----> 	    rm -f ${VARDIR}/wan_disabled
GS-----> 	    run_enabled_exit wan wan
GS-----> 	    progress_message2 "Optional interface wan Started"
GS-----> 	fi
GS-----> 
GS----->     else
GS-----> 	echo 1 > ${VARDIR}/wan.status
GS-----> 	error_message "WARNING: Optional Interface wan is not usable -- wan not Started"
GS----->     fi
GS-----> } # End of start_interface_wan();
GS-----> 
GS-----> #
GS-----> # Stop interface wan
GS-----> #
GS-----> stop_interface_wan() {
GS----->     if [ -f ${VARDIR}/undo_wan_routing ]; then
GS-----> 	. ${VARDIR}/undo_wan_routing
GS-----> 	rm -f ${VARDIR}/undo_wan_routing
GS-----> 	echo 1 > ${VARDIR}/wan.status
GS-----> 	run_disabled_exit wan wan
GS-----> 	progress_message2 "Optional Interface wan stopped"
GS----->     else
GS-----> 	startup_error "${VARDIR}/undo_wan_routing does not exist"
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Add Optional Interface lan (-65534)
GS-----> #
GS-----> start_interface_lan() {
GS----->     if [ -n "$SW_LAN_IS_USABLE" ]; then
GS-----> 	> ${VARDIR}/undo_lan_routing
GS-----> 
GS-----> 	cat <<EOF >> ${VARDIR}/undo_lan_routing
GS-----> 
GS-----> 	echo 0 > ${VARDIR}/lan.status
GS-----> 
GS-----> 	if [ $COMMAND = enable ]; then
GS-----> 	    rm -f ${VARDIR}/lan_disabled
GS-----> 	    run_enabled_exit lan lan
GS-----> 	    progress_message2 "Optional interface lan Started"
GS-----> 	fi
GS-----> 
GS----->     else
GS-----> 	echo 1 > ${VARDIR}/lan.status
GS-----> 	error_message "WARNING: Optional Interface lan is not usable -- lan not Started"
GS----->     fi
GS-----> } # End of start_interface_lan();
GS-----> 
GS-----> #
GS-----> # Stop interface lan
GS-----> #
GS-----> stop_interface_lan() {
GS----->     if [ -f ${VARDIR}/undo_lan_routing ]; then
GS-----> 	. ${VARDIR}/undo_lan_routing
GS-----> 	rm -f ${VARDIR}/undo_lan_routing
GS-----> 	echo 1 > ${VARDIR}/lan.status
GS-----> 	run_disabled_exit lan lan
GS-----> 	progress_message2 "Optional Interface lan stopped"
GS----->     else
GS-----> 	startup_error "${VARDIR}/undo_lan_routing does not exist"
GS----->     fi
GS-----> }
GS-----> #
GS-----> # Enable an optional provider
GS-----> #
GS-----> enable_provider() {
GS----->     g_interface=$1;
GS-----> 
GS----->     case $g_interface in
GS-----> 	wan)
GS-----> 	    if [ ! -f ${VARDIR}/undo_wan_routing ]; then
GS-----> 		start_interface_wan
GS-----> 	    elif [ -z "$2" ]; then
GS-----> 		startup_error "Interface wan is already enabled"
GS-----> 	    fi
GS-----> 	    ;;
GS-----> 	lan)
GS-----> 	    if [ ! -f ${VARDIR}/undo_lan_routing ]; then
GS-----> 		start_interface_lan
GS-----> 	    elif [ -z "$2" ]; then
GS-----> 		startup_error "Interface lan is already enabled"
GS-----> 	    fi
GS-----> 	    ;;
GS-----> 	*)
GS-----> 	    startup_error "$g_interface is not an optional provider or interface"
GS-----> 	    ;;
GS----->     esac
GS-----> }
GS-----> 
GS-----> #
GS-----> # Disable an optional provider
GS-----> #
GS-----> disable_provider() {
GS----->     g_interface=$1;
GS-----> 
GS----->     case $g_interface in
GS-----> 	wan)
GS-----> 	    if [ -f ${VARDIR}/undo_wan_routing ]; then
GS-----> 		stop_interface_wan
GS-----> 	    elif [ -z "$2" ]; then
GS-----> 		startup_error "Interface wan is already disabled"
GS-----> 	    fi
GS-----> 	    ;;
GS-----> 	lan)
GS-----> 	    if [ -f ${VARDIR}/undo_lan_routing ]; then
GS-----> 		stop_interface_lan
GS-----> 	    elif [ -z "$2" ]; then
GS-----> 		startup_error "Interface lan is already disabled"
GS-----> 	    fi
GS-----> 	    ;;
GS-----> 	*)
GS-----> 	    startup_error "$g_interface is not an optional provider interface"
GS-----> 	    ;;
GS----->     esac
GS-----> }
GS-----> 
Compiling /etc/shorewall/snat...
IN===> MASQUERADE	10.5.0.0/16	wan
                NF-(N)-> nat:wan_masq           
                NF-(A)-> nat:wan_masq:1         -A wan_masq -s 10.5.0.0/16  -j MASQUERADE
Compiling MAC Filtration -- Phase 1...
                NF-(N)-> filter:lan_frwd        
                NF-(A)-> filter:wan_in:1        -A wan_in -m conntrack --ctstate NEW,INVALID,UNTRACKED -j smurfs
                NF-(A)-> filter:wan_in:2        -A wan_in -p udp --dport 67:68 -j ACCEPT
                NF-(A)-> filter:wan_in:3        -A wan_in -p tcp -j tcpflags
                NF-(X)-> filter:wan_iop         
                NF-(A)-> filter:wan_fwd:1       -A wan_fwd -m conntrack --ctstate NEW,INVALID,UNTRACKED -j smurfs
                NF-(A)-> filter:wan_fwd:2       -A wan_fwd -p tcp -j tcpflags
                NF-(X)-> filter:wan_fop         
                NF-(A)-> filter:wan_out:1       -A wan_out -p udp --dport 67:68 -j ACCEPT
                NF-(X)-> filter:wan_oop         
                NF-(A)-> filter:lan_in:1        -A lan_in -p udp --dport 67:68 -j ACCEPT
                NF-(A)-> filter:lan_in:2        -A lan_in -p tcp -j tcpflags
                NF-(X)-> filter:lan_iop         
                NF-(A)-> filter:lan_fwd:1       -A lan_fwd -p tcp -j tcpflags
                NF-(X)-> filter:lan_fop         
                NF-(A)-> filter:lan_out:1       -A lan_out -p udp --dport 67:68 -j ACCEPT
                NF-(X)-> filter:lan_oop         
Compiling /etc/shorewall/rules...
IN===> NFQUEUE(0:1c,bypass)                wan                   lan
                NF-(N)-> filter:^wan-lan        
                NF-(A)-> filter:wan-lan:1       -A wan-lan -m conntrack --ctstate ESTABLISHED -j ^wan-lan
SYS----> /usr/bin/iptables -w -A fooX16630 -m conntrack -p tcp --ctorigdstport 22 -j ACCEPT
                NF-(A)-> filter:^wan-lan:1      -A ^wan-lan  -m conntrack --ctstate ESTABLISHED -j NFQUEUE --queue-balance 0:1 --queue-cpu-fanout --queue-bypass
IN===> NFQUEUE(0:1c,bypass)                wan                   fw
                NF-(N)-> filter:^wan-fw         
                NF-(A)-> filter:wan-fw:1        -A wan-fw -m conntrack --ctstate ESTABLISHED -j ^wan-fw
                NF-(A)-> filter:^wan-fw:1       -A ^wan-fw  -m conntrack --ctstate ESTABLISHED -j NFQUEUE --queue-balance 0:1 --queue-cpu-fanout --queue-bypass
IN===> NFQUEUE(0:1c,bypass)                lan                   wan
                NF-(N)-> filter:^lan-wan        
                NF-(A)-> filter:lan-wan:1       -A lan-wan -m conntrack --ctstate ESTABLISHED -j ^lan-wan
                NF-(A)-> filter:^lan-wan:1      -A ^lan-wan  -m conntrack --ctstate ESTABLISHED -j NFQUEUE --queue-balance 0:1 --queue-cpu-fanout --queue-bypass
IN===> NFQUEUE(0:1c,bypass)                fw                    wan
                NF-(N)-> filter:^fw-wan         
                NF-(A)-> filter:fw-wan:1        -A fw-wan -m conntrack --ctstate ESTABLISHED -j ^fw-wan
                NF-(A)-> filter:^fw-wan:1       -A ^fw-wan  -m conntrack --ctstate ESTABLISHED -j NFQUEUE --queue-balance 0:1 --queue-cpu-fanout --queue-bypass
CD===> ?COMMENT Tiphares Allowed Out
IN===> DNS(ACCEPT)                         fw                    wan
                NF-(A)-> filter:^fw-wan:2       -A ^fw-wan -j ACCEPT
                NF-(A)-> filter:fw-wan:2        -A fw-wan -m conntrack --ctstate RELATED -j ACCEPT
                NF-(A)-> filter:^wan-fw:2       -A ^wan-fw -j ACCEPT
                NF-(A)-> filter:wan-fw:2        -A wan-fw -m conntrack --ctstate RELATED -j ACCEPT
                NF-(A)-> filter:^wan-lan:2      -A ^wan-lan -j ACCEPT
                NF-(A)-> filter:wan-lan:2       -A wan-lan -m conntrack --ctstate RELATED -j ACCEPT
                NF-(A)-> filter:^lan-wan:2      -A ^lan-wan -j ACCEPT
                NF-(A)-> filter:lan-wan:2       -A lan-wan -m conntrack --ctstate RELATED -j ACCEPT
IN===> PARAM	-	-	udp	53
                NF-(A)-> filter:fw-wan:3        -A fw-wan  -p 17 --dport 53  -j ACCEPT -m comment --comment "Tiphares Allowed Out"
IN===> PARAM	-	-	tcp	53
                NF-(A)-> filter:fw-wan:4        -A fw-wan  -p 6 --dport 53  -j ACCEPT -m comment --comment "Tiphares Allowed Out"
IN===> FTP(ACCEPT)                         fw                    wan
CD===> ?if ( __CT_TARGET && ! $AUTOHELPERS && __FTP_HELPER  )
EXPR=> ( 1 && ! '' && 0  )
OMIT=>  PARAM	-	-	tcp	21 { helper=ftp }
CD===> ?else
IN===>  PARAM	-	-	tcp	21
                NF-(A)-> filter:fw-wan:5        -A fw-wan  -p 6 --dport 21  -j ACCEPT -m comment --comment "Tiphares Allowed Out"
CD===> ?endif
IN===> Git(ACCEPT)                         fw                    wan
IN===> PARAM	-	-	tcp	9418
                NF-(A)-> filter:fw-wan:6        -A fw-wan  -p 6 --dport 9418  -j ACCEPT -m comment --comment "Tiphares Allowed Out"
IN===> HTTP(ACCEPT)                        fw                    wan
IN===> PARAM	-	-	tcp	80
                NF-(A)-> filter:fw-wan:7        -A fw-wan  -p 6 --dport 80  -j ACCEPT -m comment --comment "Tiphares Allowed Out"
IN===> HTTPS(ACCEPT)                       fw                    wan
IN===> PARAM	-	-	tcp	443
                NF-(A)-> filter:fw-wan:8        -A fw-wan  -p 6 --dport 443  -j ACCEPT -m comment --comment "Tiphares Allowed Out"
IN===> NTP(ACCEPT)                         fw                    wan
IN===> PARAM	-	-	udp	123
                NF-(A)-> filter:fw-wan:9        -A fw-wan  -p 17 --dport 123  -j ACCEPT -m comment --comment "Tiphares Allowed Out"
IN===> Ping(ACCEPT)                        fw                    wan
IN===> PARAM	-	-	icmp	8
                NF-(A)-> filter:fw-wan:10       -A fw-wan  -p 1 --icmp-type 8  -j ACCEPT -m comment --comment "Tiphares Allowed Out"
IN===> SSH(ACCEPT)                         fw                    wan
IN===> PARAM	-	-	tcp	22
                NF-(A)-> filter:fw-wan:11       -A fw-wan  -p 6 --dport 22  -j ACCEPT -m comment --comment "Tiphares Allowed Out"
IN===> Whois(ACCEPT)                       fw                    wan
IN===> PARAM	-	-	tcp	43
                NF-(A)-> filter:fw-wan:12       -A fw-wan  -p 6 --dport 43  -j ACCEPT -m comment --comment "Tiphares Allowed Out"
CD===> ?COMMENT Scrapyard DNAT
IN===> BitTorrent(DNAT-)                   wan                   lan:10.5.1.1
IN===> PARAM	-	-	tcp	6881:6889
   WARNING: The destination zone (lan) is ignored in DNAT rules /usr/share/shorewall/macro.BitTorrent (line 12)
      from /etc/shorewall/rules (line 39) at /usr/share/shorewall/Shorewall/Rules.pm line 2949, <$currentfile> line 12.
	Shorewall::Rules::process_rule(undef, " ", "", "DNAT-", "DNAT-", "wan", "lan:10.5.1.1", "tcp", ...) called at /usr/share/shorewall/Shorewall/Rules.pm line 2364
	Shorewall::Rules::process_macro("BitTorrent", undef, " ", "", "BitTorrent(DNAT-)", "DNAT-", "wan", "lan:10.5.1.1", ...) called at /usr/share/shorewall/Shorewall/Rules.pm line 2682
	Shorewall::Rules::process_rule(undef, "", "", "BitTorrent(DNAT-)", "", "wan", "lan:10.5.1.1", "-", ...) called at /usr/share/shorewall/Shorewall/Rules.pm line 3822
	Shorewall::Rules::process_raw_rule1("BitTorrent(DNAT-)", "wan", "lan:10.5.1.1", "-", "-", "-", "-", "-", ...) called at /usr/share/shorewall/Shorewall/Rules.pm line 3891
	Shorewall::Rules::process_raw_rule() called at /usr/share/shorewall/Shorewall/Rules.pm line 3991
	Shorewall::Rules::process_rules() called at /usr/share/shorewall/Shorewall/Compiler.pm line 802
	Shorewall::Compiler::compiler("script", "/var/lib/shorewall/firewall", "directory", "", "verbosity", 1, "timestamp", 0, ...) called at /usr/share/shorewall/compiler.pl line 137
                NF-(N)-> nat:wan_dnat           
                NF-(A)-> nat:wan_dnat:1         -A wan_dnat  -p 6 --dport 6881:6889  -j DNAT --to-destination 10.5.1.1 -m comment --comment "Scrapyard DNAT"
IN===> PARAM	-	-	udp	6881
   WARNING: The destination zone (lan) is ignored in DNAT rules /usr/share/shorewall/macro.BitTorrent (line 16)
      from /etc/shorewall/rules (line 39) at /usr/share/shorewall/Shorewall/Rules.pm line 2949, <$currentfile> line 16.
	Shorewall::Rules::process_rule(undef, " ", "", "DNAT-", "DNAT-", "wan", "lan:10.5.1.1", "udp", ...) called at /usr/share/shorewall/Shorewall/Rules.pm line 2364
	Shorewall::Rules::process_macro("BitTorrent", undef, " ", "", "BitTorrent(DNAT-)", "DNAT-", "wan", "lan:10.5.1.1", ...) called at /usr/share/shorewall/Shorewall/Rules.pm line 2682
	Shorewall::Rules::process_rule(undef, "", "", "BitTorrent(DNAT-)", "", "wan", "lan:10.5.1.1", "-", ...) called at /usr/share/shorewall/Shorewall/Rules.pm line 3822
	Shorewall::Rules::process_raw_rule1("BitTorrent(DNAT-)", "wan", "lan:10.5.1.1", "-", "-", "-", "-", "-", ...) called at /usr/share/shorewall/Shorewall/Rules.pm line 3891
	Shorewall::Rules::process_raw_rule() called at /usr/share/shorewall/Shorewall/Rules.pm line 3991
	Shorewall::Rules::process_rules() called at /usr/share/shorewall/Shorewall/Compiler.pm line 802
	Shorewall::Compiler::compiler("script", "/var/lib/shorewall/firewall", "directory", "", "verbosity", 1, "timestamp", 0, ...) called at /usr/share/shorewall/compiler.pl line 137
                NF-(A)-> nat:wan_dnat:2         -A wan_dnat  -p 17 --dport 6881  -j DNAT --to-destination 10.5.1.1 -m comment --comment "Scrapyard DNAT"
IN===> BitTorrent(NFQUEUE(0:1c,bypass))    wan                   lan:10.5.1.1
IN===> PARAM	-	-	tcp	6881:6889
SYS----> /usr/bin/iptables -w -F fooX16630
SYS----> /usr/bin/iptables -w -X fooX16630
SYS----> /usr/bin/iptables -w -F foo1X16630
SYS----> /usr/bin/iptables -w -X foo1X16630
SYS----> /usr/bin/iptables -w -t mangle -F fooX16630
SYS----> /usr/bin/iptables -w -t mangle -X fooX16630
SYS----> /usr/bin/iptables -w -t nat -F fooX16630
iptables: No chain/target/match by that name.
SYS----> /usr/bin/iptables -w -t nat -X fooX16630
iptables: No chain/target/match by that name.
SYS----> /usr/bin/iptables -w -t raw -F fooX16630
SYS----> /usr/bin/iptables -w -t raw -X fooX16630
   ERROR: Invalid ACTION (PARAM:1c,bypass))) /usr/share/shorewall/macro.BitTorrent (line 12)
      from /etc/shorewall/rules (line 40) at /usr/share/shorewall/Shorewall/Config.pm line 1576.
	Shorewall::Config::fatal_error("Invalid ACTION (PARAM:1c,bypass)))") called at /usr/share/shorewall/Shorewall/Config.pm line 2236
	Shorewall::Config::split_list2("PARAM:1c,bypass))", "ACTION") called at /usr/share/shorewall/Shorewall/Chains.pm line 9530
	Shorewall::Chains::split_action("PARAM:1c,bypass))") called at /usr/share/shorewall/Shorewall/Rules.pm line 1679
	Shorewall::Rules::substitute_param("NFQUEUE(0:1c,bypass)", "PARAM:1c,bypass))") called at /usr/share/shorewall/Shorewall/Rules.pm line 2325
	Shorewall::Rules::process_macro("BitTorrent", undef, " ", "", "BitTorrent(NFQUEUE(0:1c,bypass))", "NFQUEUE(0:1c,bypass)", "wan", "lan:10.5.1.1", ...) called at /usr/share/shorewall/Shorewall/Rules.pm line 2682
	Shorewall::Rules::process_rule(undef, "", "", "BitTorrent(NFQUEUE(0:1c,bypass))", "", "wan", "lan:10.5.1.1", "-", ...) called at /usr/share/shorewall/Shorewall/Rules.pm line 3822
	Shorewall::Rules::process_raw_rule1("BitTorrent(NFQUEUE(0:1c,bypass))", "wan", "lan:10.5.1.1", "-", "-", "-", "-", "-", ...) called at /usr/share/shorewall/Shorewall/Rules.pm line 3891
	Shorewall::Rules::process_raw_rule() called at /usr/share/shorewall/Shorewall/Rules.pm line 3991
	Shorewall::Rules::process_rules() called at /usr/share/shorewall/Shorewall/Compiler.pm line 802
	Shorewall::Compiler::compiler("script", "/var/lib/shorewall/firewall", "directory", "", "verbosity", 1, "timestamp", 0, ...) called at /usr/share/shorewall/compiler.pl line 137
eval() called 1 times
