# Created by Protonyx Data Services on Wed Jan 20 14:00:00 2010
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
#TESTPEPSAL#:PEPDNAT - [0:0]
#TESTPEPSAL#:PEPSNAT - [0:0]
:POSTROUTING ACCEPT [0:0]
#TESTPEPSAL#:PEP-NAT-BB - [0:0]
#TESTPEPSAL#:SKIPPEPSAL-NAT - [0:0]
:NAT_USER_FORWARDS - [0:0]
#TESTPEPSAL#:FILTER_PEPDNAT - [0:0]
#TESTPEPSAL#GENERATE {NAT-UNSKIP-PRIOCHAIN_DEFINITIONS}
#IF {CPE_HIGH_AVAILABILITY}
#FOREACH VIF in {LAN|VLAN}
#-A PREROUTING -p tcp -m tcp -i {PHYSNAME({VIF})} -d {HAIP({VIF})}/32 --dport 53 -j DNAT --to-destination {IP({VIF})}
#-A PREROUTING -p udp -m udp -i {PHYSNAME({VIF})} -d {HAIP({VIF})}/32 --dport 53 -j DNAT --to-destination {IP({VIF})}
#DONE
#FI
-A PREROUTING -p tcp -m mark --mark 0x40000000/0x40000000 -j ACCEPT
IF {SERVICE_TRANSPARENT_SQUID}
#Transparent Squid Traffic Redirect
-A PREROUTING -p tcp -m tcp -i {LAN_PHYSNAME}+ --dport 80 -j REDIRECT --to-ports 3128
FI
FOREACH VIF in {WAN}
#for every wan, redirect port 22002 to combox ssh port
-A PREROUTING -p tcp -m tcp -i {PHYSNAME({VIF})} -d {IP({VIF})} --dport 22002 -j DNAT --to-destination {IP({VIF})}:22
DONE
IF {SERVICE_BRIDGE_MODE}
-A PREROUTING -p tcp -m tcp -i {TPIF_PHYSNAME} -d {VLL_IP_1}/32 --dport 22202 -j REDIRECT --to-port 22
FOREACH SUBNET in {HQWLIST|PWLIST}
-A PREROUTING -p tcp -m tcp -i {TPIF_PHYSNAME} -s {SUBNET} --dport 8443 -j REDIRECT
DONE
-A PREROUTING -i {LAN_PHYSNAME} -p tcp -m tcp -d {VLL_GATEWAY}/32 --dport 22002 -j DNAT --to-destination {VLL_IP_1}
-A PREROUTING -i {LAN_PHYSNAME} -d {VLL_GATEWAY}/32 -j REDIRECT
FOREACH VIF in {WAN}
# OLA TA WAN IPs GINONTAI DNAT STHN PRIMARY IP. Please patch for different behaviour.
-A PREROUTING -i {PHYSNAME({VIF})} -d {IP({VIF})} -j DNAT --to-destination {VLL_IP_1}
DONE
ELSE
# USER DEFINED PORT FORWARDING CHAIN. ALL PROTOCOLS EXCEPT FOR ACCELERATED TCP. 
-A PREROUTING ! -p tcp -j NAT_USER_FORWARDS
FI
#-A PREROUTING -i {LAN_PHYSNAME}+ -p tcp -j PEP-NAT-BB
#TESTPEPSAL#-A PREROUTING -p tcp -j PEP-NAT-BB
#TESTPEPSAL#IF {SERVICE_BRIDGE_MODE}
#TESTPEPSAL#ELSE
# FTP Control Connections should NOT go through PEPSAL
#TESTPEPSAL#-A PEP-NAT-BB -p tcp -m tcp -i {LAN_PHYSNAME}+ --dport 21 -j RETURN
#-A PEP-NAT-BB -p tcp -m tcp -i {LAN_PHYSNAME}+ -m state --state RELATED -j RETURN
#TESTPEPSAL#FI
#TESTPEPSAL#FOREACH VIF in {LAN|VLAN}
#TESTPEPSAL#-A PEP-NAT-BB -i {LAN_PHYSNAME}+ -d {IP({VIF})}/{SUBNETMASK({VIF})} -j RETURN
#TESTPEPSAL#-A PEP-NAT-BB -d {IP({VIF})} -j RETURN
#TESTPEPSAL#DONE
#TESTPEPSAL#FOREACH ROUTE in {SROUTES}
#TESTPEPSAL#-A PEP-NAT-BB -i {LAN_PHYSNAME}+ -d {NETWORK({ROUTE})}/{SUBNETMASK({ROUTE})} -j RETURN
#TESTPEPSAL#DONE
#FOREACH VIF in {FAKE|WAN|TPIF|VPN}
#-A PEP-NAT-BB -d {IP({VIF})} -j RETURN
#DONE
###IF {CPE_HIGH_AVAILABILITY}
###FOREACH VIF in {WAN}
###-A PEP-NAT-BB -d {HAIP({VIF})} -j RETURN
###DONE
###FI
# Let traffic have the chance to skip pepsal
#TESTPEPSAL#-A PEP-NAT-BB -j SKIPPEPSAL-NAT
#TESTPEPSAL#IF {SERVICE_BRIDGE_MODE}
#TESTPEPSAL#ELSE
#TESTPEPSAL#-A PEP-NAT-BB -j PEPSNAT
#TESTPEPSAL#FI
#TESTPEPSAL#-A PEP-NAT-BB -j FILTER_PEPDNAT
IF {CPE_HIGH_AVAILABILITY}
FOREACH HAIF in {HAIFS}
-A POSTROUTING -d {PEERIP({HAIF})} -o {PHYSNAME({HAIF})} -j SNAT --to-source {IP({HAIF})}
-A POSTROUTING -s {PEERIP({HAIF})} -o {TPIF_PHYSNAME} -j SNAT --to-source {TPIF_IP}
DONE
FOREACH HAIF in {HAIFACE_1}
-A POSTROUTING -s {TPIF_IP} -o {LAN_PHYSNAME} -j SNAT --to-source {IP({HAIF})}
DONE
FI
IF {SERVICE_BRIDGE_MODE}
-A POSTROUTING -s {LAN_IP} -o {LAN_PHYSNAME} -j SNAT --to-source {VLL_GATEWAY}
FOREACH IPID in {VLL_IP_IDS}
-A POSTROUTING -o {TPIF_PHYSNAME} -m mark --mark {TPIF_MARK} -s {VLL_IP({IPID})} -j ACCEPT
DONE
FOREACH VIF in {WAN|TPIF}
-A POSTROUTING -o {PHYSNAME({VIF})} -m mark --mark {MARK({VIF})} -j SNAT --to-source {IP({VIF})}
DONE
ELSE
FOREACH VIF in {WAN}
-A POSTROUTING -o {PHYSNAME({VIF})} -m mark --mark {MARK({VIF})} -j SNAT --to-source {IP({VIF})}
-A POSTROUTING -o {TPIF_PHYSNAME} -m mark --mark {TPIF_MARK} -s {IP({VIF})} -j SNAT --to-source {TPIF_IP}
DONE
FI
# ATTEMPT TO PREVENT USER FROM COMMITING SUICIDE.
#TESTPEPSAL#FOREACH VIF in {WAN|TPIF}
#TESTPEPSAL#-A FILTER_PEPDNAT -p tcp -m tcp -i {PHYSNAME({VIF})} -d {IP({VIF})} --dport 22002 -j RETURN
#TESTPEPSAL#DONE
#TESTPEPSAL#-A FILTER_PEPDNAT -j PEPDNAT
# allow treloproxy ports 22221-22229 UDP
IF {SERVICE_BRIDGE_MODE}
ELSE
GENERATE {NAT_USER_FORWARDS}
FI
#TESTPEPSAL#GENERATE {SKIPPEPSAL-NAT}
COMMIT
*mangle
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING DROP [0:0]
:POSTROUTING ACCEPT [0:0]
:FORWARD_FW - [0:0]
:X_ACCEPT - [0:0]
:NetBalancer_OUTPUT - [0:0]
:NetBalancer - [0:0]
:NetBalancer_USER - [0:0]
# :GREEKIPREQUIRED - [0:0]
:FILTER_NFQDNAT - [0:0]
:NFQDNAT - [0:0]
:RTCHARTS_OUT - [0:0]
:MY_PREROUTING - [0:0]
:RTCHARTS_IN - [0:0]
:SKIPPEPSAL-MANGLE - [0:0]
:CLASS_A - [0:0]
:CLASS_B - [0:0]
:CLASS_C - [0:0]
:CLASS_D - [0:0]
:CLASS_E - [0:0]
:CLASS_F - [0:0]
:CLASS_G - [0:0]
:CLASS_DEFAULT - [0:0]
:CLASSIFIER - [0:0]
:NB_CT_POST - [0:0]
:MAIN_FW - [0:0]
:DIVERT - [0:0]
:NFQSNAT - [0:0]
:INPUT_FW - [0:0]
:LOCALPF - [0:0]
:REMOVE_ECN - [0:0]
:GEN_USER_FW - [0:0]
:GEN_SYSTEM_FW - [0:0]
:MY_NB_CT_POST - [0:0]
:SAVEMARK_POST - [0:0]
:NFQNAT-MANGLE-BB - [0:0]
:NB_BM_OUT - [0:0]
:NB_BM_PRE - [0:0]
:DUC_MARK - [0:0]
:NBGW99 - [0:0]
:TPROXYRULES - [0:0]
:SAVEMARKANDQUEUE - [0:0]
:UNLOOP - [0:0]
:OPT_MSS - [0:0]
# :NBGWprio - [0:0]
FOREACH VIF in {WAN|TPIF}
:{NBGWCHAIN({VIF})} - [0:0]
DONE
GENERATE {PRIOCHAIN_DEFINITIONS}
GENERATE {MANGLE-UNSKIP-PRIOCHAIN_DEFINITIONS}
# Filter All Traffic through Main Combox Firewall MAIN_FW chain
-A PREROUTING -j MAIN_FW
# Accept Established Connections
-A MAIN_FW -m mark --mark 0x80000000/0x80000000 -j TPROXYRULES
IF {SERVICE_BRIDGE_MODE}
-A MAIN_FW -m state --state ESTABLISHED -j X_ACCEPT
ELSE
-A MAIN_FW -m state --state ESTABLISHED,RELATED -j X_ACCEPT
FI
# Accept everything that comes from the loopback interface
-A MAIN_FW -i lo -j X_ACCEPT
-A MAIN_FW -i tun555 -j INPUT_FW
IF {CPE_HIGH_AVAILABILITY}
FOREACH HAIF in {HAIFS}
-A MAIN_FW -i {PHYSNAME({HAIF})} -d {IP({HAIF})} -j INPUT_FW
DONE
-A MAIN_FW -i {VIRTUAL_IP_INTERFACE} -d {VIRTUAL_IP_ADDRESS} -j INPUT_FW
FI
IF {SERVICE_BRIDGE_MODE}
FOREACH VIF in {LAN|TPIF|VPN|VLAN}
-A MAIN_FW -d {IP({VIF})} -j INPUT_FW
DONE
#IF {CPE_HIGH_AVAILABILITY}
#FOREACH VIF in {LAN|VLAN}
#-A MAIN_FW -d {HAIP({VIF})} -j INPUT_FW
#DONE
#FI
ELSE
FOREACH VIF in {LAN|WAN|TPIF|VPN|VLAN}
-A MAIN_FW -d {IP({VIF})} -j INPUT_FW
DONE
#IF {CPE_HIGH_AVAILABILITY}
#FOREACH VIF in {LAN|VLAN|WAN}
#-A MAIN_FW -d {HAIP({VIF})} -j INPUT_FW
#DONE
#FI
FI
# ROUTED Traffic with destination NOT THIS MACHINE
-A MAIN_FW -j FORWARD_FW
# DROP EVERYTHING ELSE
-A MAIN_FW -j DROP
#UDVLAN|# except for eg Printers (kai kala ta printers htane leei sto subnet 192.168.158.0/24)
#UDVLAN|-A FORWARD_FW -i eth0+ -d 192.168.158.0/24 -j X_ACCEPT
#UDVLAN|# H protonyx na blepei ta modem
#UDVLAN|-A FORWARD_FW -i eth0.151 -d 192.168.0.0/20 -j X_ACCEPT
#UDVLAN|-A FORWARD_FW -i eth0 -d 192.168.0.0/20 -j X_ACCEPT
-A FORWARD_FW -i {LAN_PHYSNAME}+ -p tcp -m tcp -d {VLL_IP_1}/32 --dport {VLL_MANAGEMENT_PORT} -j DROP
-A FORWARD_FW -i {LAN_PHYSNAME} -d {TPIF_GATEWAY({EID})}/32 -j X_ACCEPT
-A FORWARD_FW -i {LAN_PHYSNAME} -d {TPIF_GATEWAY({EID})}/{TPIF_SUBNETMASK({EID})} -j DROP
IF {SERVICE_BRIDGE_MODE}
# Bridge Mode de mou itheles?
-A FORWARD_FW -i {TPIF_PHYSNAME} -j X_ACCEPT
IF {SERVICE_SINGLE_WAN_IF}
-A FORWARD_FW -i {WAN_PHYSNAME} -j X_ACCEPT
ELSE
FOREACH VIF in {WAN}
# Bridge KAI STIS ADSL de mou itheles?
-A FORWARD_FW -i {PHYSNAME({VIF})} -j X_ACCEPT
DONE
FI
ELSE
# NAT_ONCE den eipame?
FOREACH VIF in {LAN|VLAN}
-A FORWARD_FW -i {TPIF_PHYSNAME} -d {IP({VIF})}/{SUBNETMASK({VIF})} -j X_ACCEPT 
DONE
FOREACH ROUTE in {SROUTES}
-A FORWARD_FW -i {LAN_PHYSNAME} -d {NETWORK({ROUTE})}/{SUBNETMASK({ROUTE})} -j X_ACCEPT
DONE
FOREACH ROUTE in {INET_SROUTES}
-A FORWARD_FW -i {TPIF_PHYSNAME} -d {NETWORK({ROUTE})}/{SUBNETMASK({ROUTE})} -j X_ACCEPT
DONE
# No Vlan-to-Vlan communication
# These Rules Allow Access to the Gateways by all VLANs
FOREACH VIF in {WAN|TPIF}
-A FORWARD_FW -i {LAN_PHYSNAME}+ -d {GATEWAY({VIF})} -j X_ACCEPT
DONE
-A FORWARD_FW -i {LAN_PHYSNAME}+ -d 192.168.0.0/16 -j DROP
-A FORWARD_FW -i {LAN_PHYSNAME}+ -d 172.16.0.0/12 -j DROP
-A FORWARD_FW -i {LAN_PHYSNAME}+ -d 10.0.0.0/8 -j DROP
FI
# Allow ICMP TESTING
-A FORWARD_FW -p icmp -j X_ACCEPT
# Allow ALL LAN to WAN traffic
-A FORWARD_FW -i {LAN_PHYSNAME}+ -j X_ACCEPT
# DROP EVERYTHING ELSE
-A FORWARD_FW -j DROP
# Naming Convenience Chain. Everything Jumps to MY_PREROUTING
-A X_ACCEPT -j MY_PREROUTING
# Accept any packet, after going through MY_PREROUTING and if it was not already Accepted
-A X_ACCEPT -j ACCEPT
FOREACH VIF in {WAN|TPIF}
-A {NBGWCHAIN({VIF})} -j MARK  --set-xmark {MARK({VIF})}/0xffffffff
-A {NBGWCHAIN({VIF})} -j ACCEPT
DONE
-A NBGW99 -j MARK --set-xmark 0x63/0xffffffff 
-A NBGW99 -j ACCEPT
-A DIVERT -j MARK --set-xmark 0xc8/0xffffffff
-A DIVERT -j ACCEPT
-A MY_PREROUTING -j CONNMARK  --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A MY_PREROUTING -j RTCHARTS_IN
-A MY_PREROUTING -p icmp -m conntrack --ctstate RELATED --ctproto 6 -j MARK --set-xmark 0xc8/0xffffffff
-A MY_PREROUTING -p tcp -m mark --mark 0xc8 -j TPROXYRULES
-A MY_PREROUTING -m state --state NEW -m mark --mark 0x00 -j LOCALPF
IF {SERVICE_BRIDGE_MODE}
-A MY_PREROUTING -i {LAN_PHYSNAME} -p tcp -m tcp -d {VLL_GATEWAY}/32 --dport 22002 -j NetBalancer
# Connections to this combox fake IP should not go through pepsal, not even NetBalancer.
-A MY_PREROUTING -i {LAN_PHYSNAME} -d {VLL_GATEWAY} -j ACCEPT
-A MY_PREROUTING -p tcp -m tcp -i {TPIF_PHYSNAME} -d {VLL_IP_1} --dport 22202 -j NetBalancer
FOREACH SUBNET in {HQWLIST|PWLIST}
-A MY_PREROUTING -p tcp -m tcp -i {TPIF_PHYSNAME} -s {SUBNET} -d {VLL_IP_1} --dport 8443 -j NetBalancer
DONE
FOREACH VIF in {WAN}
-A MY_PREROUTING -p tcp -m tcp -i {PHYSNAME({VIF})} -d {IP({VIF})} --dport 22202 -j NetBalancer
DONE
FI
-A MY_PREROUTING -p tcp -m tcp --tcp-flags SYN,ACK,FIN,RST SYN -j NFQNAT-MANGLE-BB 
#-A MY_PREROUTING -p tcp -m socket -j DIVERT
-A MY_PREROUTING -p tcp -m socket -m tcp ! --tcp-flags ALL SYN -j DIVERT
-A MY_PREROUTING -j NetBalancer
FOREACH VIF in {LAN|VLAN}
-A NFQNAT-MANGLE-BB -i {LAN_PHYSNAME}+ -d {IP({VIF})}/{SUBNETMASK({VIF})} -j RETURN
DONE
FOREACH ROUTE in {SROUTES}
-A NFQNAT-MANGLE-BB -i {LAN_PHYSNAME}+ -d {NETWORK({ROUTE})}/{SUBNETMASK({ROUTE})} -j RETURN
DONE
#FOREACH VIF in {FAKE|WAN|TPIF|VPN}
#-A NFQNAT-MANGLE-BB -d {IP({VIF})} -j RETURN
#DONE
###IF {CPE_HIGH_AVAILABILITY}
###FOREACH VIF in {WAN}
###-A NFQNAT-MANGLE-BB -d {HAIP({VIF})} -j RETURN
###DONE
###FI
# Let traffic have the chance to skip pepsal
-A NFQNAT-MANGLE-BB -j SKIPPEPSAL-MANGLE
IF {SERVICE_BRIDGE_MODE}
ELSE
IF {SERVICE_TRANSPARENT_SQUID}
#Transparent Squid Traffic skips pepsal
-A NFQNAT-MANGLE-BB -p tcp -m tcp -i {LAN_PHYSNAME}+ --dport 80 -j RETURN
FI
# FTP Control Connections should NOT go through PEPSAL
-A NFQNAT-MANGLE-BB -p tcp -m tcp -i {LAN_PHYSNAME}+ --dport 21 -j RETURN
-A NFQNAT-MANGLE-BB -j NFQSNAT
FI
-A NFQNAT-MANGLE-BB -j FILTER_NFQDNAT
-A RTCHARTS_IN -i {LAN_PHYSNAME}+ -j RETURN
FOREACH VIF in {TPIF|VPN}
-A RTCHARTS_IN -i {PHYSNAME({VIF})} -j RETURN
DONE
FOREACH VIF in {WAN}
-A RTCHARTS_IN -m mark -i {PHYSNAME({VIF})} -j RETURN  --mark {MARK({VIF})}
-A RTCHARTS_IN -d {IP({VIF})}/32 -i {PHYSNAME({VIF})} -j RETURN
DONE
#-A INPUT -m state --state NEW -j LOCALPF
-A INPUT -m state --state NEW -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A OUTPUT -j CONNMARK  --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A OUTPUT -m mark --mark 0xc8 -j MARK --set-xmark 0x0/0xffffffff
-A OUTPUT -j NetBalancer_OUTPUT
-A OUTPUT -j NetBalancer
FOREACH VIF in {WAN|TPIF}
-A LOCALPF -m state -i {PHYSNAME({VIF})} -d {IP({VIF})}/32 --state NEW -j MARK --set-xmark {MARK({VIF})}/0xffffffff
DONE
-A LOCALPF -m state -i {TPIF_PHYSNAME} --state NEW -j MARK --set-xmark {TPIF_MARK}/0xffffffff
-A SAVEMARKANDQUEUE -i tun0 -m state --state NEW -j MARK --set-xmark 0x69/0xffffffff
-A SAVEMARKANDQUEUE -m state --state NEW -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A SAVEMARKANDQUEUE -j NFQUEUE --queue-num 1
-A POSTROUTING -m state --state NEW -j MY_NB_CT_POST
-A POSTROUTING -j RTCHARTS_OUT
-A POSTROUTING -o {TPIF_PHYSNAME} -j CLASSIFIER
-A POSTROUTING -p tcp -m tcp -o {TPIF_PHYSNAME} --tcp-flags SYN,RST SYN -j OPT_MSS
#IF {SERVICE_BRIDGE_MODE}
#FOREACH IPID in {VLL_IP_IDS}
#-A POSTROUTING -p tcp -m tcp -s {VLL_IP({IPID})}/32 -o {TPIF_PHYSNAME} --tcp-flags SYN,RST SYN -j TCPMSS  --set-mss 123
#DONE
#FI
-A POSTROUTING -j REMOVE_ECN
#-A OPT_MSS -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 123
GENERATE {OPT_MSS_CONTENTS}
-A REMOVE_ECN -o {TPIF_PHYSNAME} -j RETURN
-A REMOVE_ECN -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m ecn --ecn-tcp-cwr --ecn-tcp-ece -j ECN --ecn-tcp-remove
# DON'T CHANGE MARK EVEN WHEN tun0 GOES DOWN
-A MY_NB_CT_POST -p udp -m udp --sport 500 --dport 500 -g SAVEMARK_POST
-A MY_NB_CT_POST -p esp -g SAVEMARK_POST
-A MY_NB_CT_POST -p ah -g SAVEMARK_POST
-A MY_NB_CT_POST -p gre -g SAVEMARK_POST
FOREACH VIF in {WAN|TPIF}
-A MY_NB_CT_POST -s {IP({VIF})}/32 -p icmp -g SAVEMARK_POST
DONE
#IF {CPE_HIGH_AVAILABILITY}
#FOREACH VIF in {WAN}
#-A MY_NB_CT_POST -s {HAIP({VIF})}/32 -p icmp -g SAVEMARK_POST
#DONE
#FI
FOREACH VIF in {WAN}
-A MY_NB_CT_POST -d {VLL_IP_EXT}/32 -p tcp -m tcp --dport {TPPORT({VIF})} -g SAVEMARK_POST
-A MY_NB_CT_POST -d {VLL_IP_EXT}/32 -p udp -m udp --dport {TPPORT({VIF})} -g SAVEMARK_POST
DONE
-A MY_NB_CT_POST -j NB_CT_POST
-A SAVEMARK_POST -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A TPROXYRULES -j MARK --set-xmark 0x0/0x80000000
-A TPROXYRULES -p tcp -j TPROXY --on-port 5000 --on-ip 127.0.0.1 --tproxy-mark 0xc8/0xffffffff
-A RTCHARTS_OUT -o {LAN_PHYSNAME}+ -j RETURN
FOREACH VIF in {TPIF|VPN}
-A RTCHARTS_OUT -o {PHYSNAME({VIF})} -j RETURN
DONE
FOREACH VIF in {WAN}
-A RTCHARTS_OUT -m mark -o {PHYSNAME({VIF})} -j RETURN --mark {MARK({VIF})}
DONE
#Loipon anti na kaneis aplws set to TOS, steile se eidiko chain pou tha kanei set to TOS kai tha kanei kai return apo to chain
-A CLASS_A -j TOS --set-tos 0xE0/0xE0
-A CLASS_A -j RETURN
-A CLASS_B -j TOS --set-tos 0xC0/0xE0
-A CLASS_B -j RETURN
-A CLASS_C -j TOS --set-tos 0xA0/0xE0
-A CLASS_C -j RETURN
-A CLASS_D -j TOS --set-tos 0x80/0xE0
-A CLASS_D -j RETURN
-A CLASS_E -j TOS --set-tos 0x60/0xE0
-A CLASS_E -j RETURN
-A CLASS_F -j TOS --set-tos 0x40/0xE0
-A CLASS_F -j RETURN
-A CLASS_G -j TOS --set-tos 0x20/0xE0
-A CLASS_G -j RETURN
-A CLASS_DEFAULT -j TOS --set-tos 0x00/0xE0
-A CLASS_DEFAULT -j RETURN
# -g CLASS_X cannot be overwritten, -j CLASS_X can
# Acks fall under Highest Priority Class
-A CLASSIFIER -p tcp -m tcp -m length --tcp-flags RST,ACK ACK --length :64 -g CLASS_A
# Generated rules are of the '-g' type
GENERATE {USER_CLASSIFIERS}
# Unclassified traffic handling:
# First Erase All Preset Precedence Bits (Default class)
-A CLASSIFIER -j CLASS_DEFAULT
# ICMP Falls Under Highest Priority Class
-A CLASSIFIER -p icmp -j CLASS_A
-A CLASSIFIER -p tcp -m tcp --dport 5060 -j CLASS_A
-A CLASSIFIER -p udp -m udp --dport 5060 -j CLASS_A
-A CLASSIFIER -p tcp -m tcp --sport 5060 -j CLASS_A
-A CLASSIFIER -p udp -m udp --sport 5060 -j CLASS_A
-A CLASSIFIER -p udp -m udp --dport 500 -j CLASS_A
-A CLASSIFIER -p udp -m udp --sport 500 -j CLASS_A
-A CLASSIFIER -p esp -j CLASS_A
FOREACH VIF in {WAN|TPIF}
-A NB_CT_POST -m realm -j MARK  --realm {MARK({VIF})} --set-xmark {MARK({VIF})}/0xffffffff
DONE
-A NB_CT_POST -j CONNMARK  --save-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A NetBalancer_OUTPUT -m mark -j ACCEPT  ! --mark 0x0
-A NetBalancer_OUTPUT -p tcp -m tcp -d 5.9.236.155 --dport 10051 -j NBGWprio
IF {SERVICE_DUC}
# duc standard clients via group id
-A NetBalancer_OUTPUT -p tcp -m tcp -m owner --gid-owner duc1 -j DUC_MARK
FI
IF {SERVICE_BRIDGE_MODE}
FOREACH IPID in {VLL_IP_IDS}
-A NetBalancer_OUTPUT -s {VLL_IP({IPID})}/32 -g NB_BM_OUT
DONE
-A NetBalancer_OUTPUT -p tcp -m tcp -d {VLL_IP_EXT} --dport {VLL_MANAGEMENT_PORT} -j NBGW99
# the 3 following lines and the 7th one should be uncommented when the UNLOOP mystery is solved? 
#IF {VLL_BEHIND_NAT}
#-A NetBalancer_OUTPUT -d {VLL_NAT_ΕΧTERNAL_IP} -j UNLOOP
#ELSE
FOREACH IPID in {VLL_IP_IDS}
-A NetBalancer_OUTPUT -d {VLL_IP({IPID})} -j UNLOOP
DONE
#FI
FOREACH VIF in {WAN}
-A UNLOOP -p tcp -m tcp -s {IP({VIF})} --dport {TPPORT({VIF})} -d {VLL_IP_EXT} -j RETURN
-A UNLOOP -p udp -m udp -s {IP({VIF})} --dport {TPPORT({VIF})} -d {VLL_IP_EXT} -j RETURN
-A UNLOOP -p icmp -s {IP({VIF})} -j RETURN
-A UNLOOP -s {IP({VIF})} -j NBGWtun0
DONE
FI
-A DUC_MARK -j NBGWprio
IF {SERVICE_BRIDGE_MODE}
FOREACH VIF in {WAN}
-A NB_BM_OUT -d {IP({VIF})}/{SUBNETMASK({VIF})} -j RETURN
DONE
-A NB_BM_OUT -p tcp -m tcp --dport 443 -j NBGWprio
-A NB_BM_OUT -p tcp -m tcp --dport 8443 -j NBGWprio
-A NB_BM_OUT -j {TPIF_NBGWCHAIN}
FI
-A NetBalancer -m mark -j ACCEPT  ! --mark 0x0
FOREACH VIF in {WAN}
-A NetBalancer -m state -d {IP({VIF})}/32 --state NEW -j {NBGWCHAIN({VIF})}
-A NetBalancer -m state -d {GATEWAY({VIF})}/32 --state NEW -j {NBGWCHAIN({VIF})}
-A NetBalancer -s {IP({VIF})}/32 -j {NBGWCHAIN({VIF})}
DONE
#IF {CPE_HIGH_AVAILABILITY}
#FOREACH VIF in {WAN}
#-A NetBalancer -s {HAIP({VIF})}/32 -j {NBGWCHAIN({VIF})}
#DONE
#FI
-A NetBalancer -m state -i {TPIF_PHYSNAME} --state NEW -j {TPIF_NBGWCHAIN}
# Check whether a greek IP is Required
# -A NetBalancer -j GREEKIPREQUIRED
# Replace with the correct ports for cPanel if multiple endpoints
#-A NetBalancer -p tcp -m tcp -d {VLL_IP_EXT} -i {LAN_PHYSNAME}+ --dport 1099 -j NBGWprio
#-A NetBalancer -p tcp -m tcp -d {VLL_IP_EXT} -i {LAN_PHYSNAME}+ --dport 1122:1123 -j NBGWprio
-A NetBalancer -i {LAN_PHYSNAME} -p tcp -m tcp -d {VLL_GATEWAY}/32 --dport 22002 -j NBGW99
-A NetBalancer -j NetBalancer_USER
IF {SERVICE_BRIDGE_MODE}
-A NetBalancer -p tcp -m tcp -s {TPIF_IP} -j NB_BM_PRE
FOREACH IPID in {VLL_IP_IDS}
-A NetBalancer -p tcp -s {VLL_IP({IPID})}/32 -j NB_BM_PRE
DONE
ELSE
# NBGWPrio gia to Outgoing 8443
-A NetBalancer -p tcp -m tcp --dport 8443 -j NBGWprio
# NBGWPrio gia to Outgoing 443
-A NetBalancer -p tcp -m tcp --dport 443 -j NBGWprio
# OLOI PANE APO VLL
FOREACH VIF in {LAN|VLAN}
-A NetBalancer -s {IP({VIF})}/{SUBNETMASK({VIF})} -j {TPIF_NBGWCHAIN}
DONE
FOREACH ROUTE in {INET_SROUTES}
-A NetBalancer -s {NETWORK({ROUTE})}/{SUBNETMASK({ROUTE})} -j {TPIF_NBGWCHAIN}
DONE
FI
-A NetBalancer -s {TPIF_IP}/32 -j {TPIF_NBGWCHAIN}
# OLOI PANE APO VLL (mono pou afto to rule den pianei logw pepsal)
-A NetBalancer -i {LAN_PHYSNAME}+ -j {TPIF_NBGWCHAIN}
-A NetBalancer -j ACCEPT
-A NB_BM_PRE -p tcp -m tcp --dport 443 -j NBGWprio
-A NB_BM_PRE -p tcp -m tcp --dport 8443 -j NBGWprio
# User-defined policy routing rules should not interfere with connections with destination the VLL IPs
FOREACH IPID in {VLL_IP_IDS}
-A NetBalancer_USER -d {VLL_IP({IPID})} -j RETURN
DONE
FOREACH VIF in {LAN|VLAN}
-A NetBalancer_USER -s {IP({VIF})} -j RETURN
DONE
#IF {CPE_HIGH_AVAILABILITY}
#FOREACH VIF in {LAN|VLAN}
#-A NetBalancer_USER -s {HAIP({VIF})} -j RETURN
#DONE
#FI
GENERATE {USER_NETBALANCER}
# Traffic with destination THIS MACHINE. X_Accept FORWARDED PORTS HERE
# Allow System services
-A INPUT_FW -j GEN_SYSTEM_FW
# allow sshd port
-A INPUT_FW -p tcp -m tcp --dport 22 -j X_ACCEPT
# allow webmin port
-A INPUT_FW -p tcp -m tcp --dport 10000 -j X_ACCEPT
# allow cpanel port
#-A INPUT_FW -p tcp -m tcp --dport {TP_RMI_REG_PORT} -j X_ACCEPT
# allow cpanel-X ports
#-A INPUT_FW -p tcp -m tcp --dport {TP_RMI_OBJ_PORT_1}:{TP_RMI_OBJ_PORT_2} -j X_ACCEPT
# allow BIND port from [V]LAN side
-A INPUT_FW -p tcp -i {LAN_PHYSNAME}+ -m tcp --dport 53 -j X_ACCEPT
-A INPUT_FW -p udp -i {LAN_PHYSNAME}+ -m udp --dport 53 -j X_ACCEPT
# allow SNMP port from [V]LAN side
-A INPUT_FW -p udp -i {LAN_PHYSNAME}+ -m udp --dport 161 -j X_ACCEPT
# allow jetty port from [V]LAN side
-A INPUT_FW -p tcp -i {LAN_PHYSNAME}+ -m tcp --dport 8443 -j X_ACCEPT
FOREACH SUBNET in {HQWLIST|PWLIST}
-A INPUT_FW -p tcp -i {TPIF_PHYSNAME} -m tcp -s {SUBNET} --dport 8443 -j X_ACCEPT
DONE
IF {CPE_HIGH_AVAILABILITY}
# allow the heartbeat service to communicate
IF {DECIDE_OS_CENTOS_5}
FOREACH HAIF in {HAIFS}
-A INPUT_FW -p udp -i {PHYSNAME({HAIF})} -d {IP({HAIF})} -m udp --dport 694 -j X_ACCEPT
DONE
FI
IF {DECIDE_OS_CENTOS_7}
-A INPUT_FW -p vrrp -i {LAN_PHYSNAME} -d 224.0.0.18 -j X_ACCEPT
FOREACH HAIF in {HAIFACE_1}
-A INPUT_FW -i {PHYSNAME({HAIF})} -p tcp -m tcp -s {PEERIP({HAIF})} -d {IP({HAIF})} --dport {VLL_MANAGEMENT_PORT} -j X_ACCEPT
DONE
FI
FI
#IF {SERVICE_TRANSPARENT_SQUID}
# Allow squid port from [V]LAN side
#-A INPUT_FW -i {LAN_PHYSNAME}+ -p tcp -m tcp --dport 3128 -j X_ACCEPT
#FI
# Allow ICMP testing 
-A INPUT_FW -p icmp -j X_ACCEPT
# Allow System services
#-A INPUT_FW -j GEN_SYSTEM_FW
IF {SERVICE_BRIDGE_MODE}
ELSE
# Allow ssh port 22002 for connecting directly through the ADSL modem
FOREACH VIF in {WAN}
-A INPUT_FW -p tcp -m tcp -i {PHYSNAME({VIF})} -d {IP({VIF})} --dport 22002 -j X_ACCEPT
DONE
# Allow User Defined Forwards
-A INPUT_FW -j GEN_USER_FW
FI
# DROP EVERYTHING ELSE
-A INPUT_FW -j DROP
GENERATE {GEN_SYSTEM_FW}
IF {SERVICE_BRIDGE_MODE}
ELSE
GENERATE {GEN_USER_FW}
FI
GENERATE {SKIPPEPSAL-MANGLE}
# ATTEMPT TO PREVENT USER FROM COMMITING SUICIDE.
FOREACH VIF in {WAN|TPIF}
-A FILTER_NFQDNAT -p tcp -m tcp -i {PHYSNAME({VIF})} -d {IP({VIF})} --dport 22002 -j RETURN
DONE
-A FILTER_NFQDNAT -j NFQDNAT
-A TPROXYRULES -j MARK --set-xmark 0x0/0x80000000
-A TPROXYRULES -p tcp -j TPROXY --on-port 5000 --on-ip 127.0.0.1 --tproxy-mark 0xc8/0xffffffff
COMMIT
*filter
:FORWARD ACCEPT [0:0]
:USAGELOGGING - [0:0]
:INPUT ACCEPT [0:0]
:SYS_OUTPUT - [0:0]
:SYS_SSH - [0:0]
:SYS_INPUT - [0:0]
:OUTPUT ACCEPT [0:0]
:SYS_HTTPS - [0:0]
:USAGELOGGING_INPUT - [0:0]
-A INPUT -j USAGELOGGING_INPUT
-A FORWARD -p tcp -m mark --mark 0x40000000/0xc0000000 -j REJECT --reject-with tcp-reset
-A FORWARD -p tcp -m mark --mark 0xc0000000/0xc0000000 -j REJECT --reject-with icmp-host-unreachable
-A OUTPUT -j USAGELOGGING
FOREACH VIF in {WAN}
-A USAGELOGGING -p tcp -m tcp -d {VLL_IP_EXT}/32 --dport {TPPORT({VIF})}
-A USAGELOGGING -p tcp -m tcp -m length -d {VLL_IP_EXT}/32 --dport {TPPORT({VIF})} --tcp-flags RST,ACK ACK  --length :52
DONE
FOREACH VIF in {WAN}
-A USAGELOGGING_INPUT -p tcp -m tcp -s {VLL_IP_EXT}/32 --sport {TPPORT({VIF})}
-A USAGELOGGING_INPUT -p tcp -m tcp -m length -s {VLL_IP_EXT}/32 --sport {TPPORT({VIF})} --tcp-flags RST,ACK ACK  --length :52
DONE
COMMIT
# Completed on Wed Jan 20 14:00:00 2010
