*filter
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
:INPUT DROP
ELSE
:INPUT ACCEPT
FI
:OUTPUT ACCEPT
:FORWARD ACCEPT
IF {SERVICE_HIGH_AVAILABILITY}
:HEARTBEAT_IN -
:HEARTBEAT_OUT -
-A INPUT -j HEARTBEAT_IN
FOREACH HAIF in {HAIFS}
-A OUTPUT -d {PEERIP({HAIF})} -o {PHYSNAME({HAIF})} --opcode 1 -j mangle --mangle-ip-s {IP({HAIF})}
DONE
-A OUTPUT -j HEARTBEAT_OUT
FI
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
IF {SERVICE_HIGH_AVAILABILITY}
# accept the keepalived virtual ip address
-A INPUT -d {VIRTUAL_IP_ADDRESS} -i {VIRTUAL_IP_INTERFACE} -j ACCEPT
# accept the heartbeat service IPs
FOREACH HAIF in {HAIFS}
-A INPUT -d {IP({HAIF})} -i {PHYSNAME({HAIF})} -j ACCEPT
DONE
FI
# -p 1 shmainei Request operation (who-has?)
FOREACH VIF in {LAN}
-A INPUT -d {VLL_GATEWAY}/{VLL_MASK_1} -i {PHYSNAME({VIF})} -j ACCEPT
DONE
FOREACH VIF in {LAN|WAN|VLAN}
-A INPUT -d {IP({VIF})}/32 -i {PHYSNAME({VIF})} -j ACCEPT
DONE
#-A INPUT -i {PHYSNAME({VIF})} -j DROP
FOREACH VIF in {LAN}
FOREACH IPID in {VLL_IP_IDS}
-A OUTPUT -s {IP({VIF})} -d {VLL_IP({IPID})} -o {PHYSNAME({VIF})} -j mangle --mangle-ip-s {VLL_GATEWAY}  
DONE
DONE
FI
