*filter
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
:INPUT DROP
ELSE
:INPUT ACCEPT
FI
:OUTPUT ACCEPT
:FORWARD ACCEPT
IF {CPE_HIGH_AVAILABILITY}
:HEARTBEAT_IN -
:HEARTBEAT_OUT -
-A INPUT -j HEARTBEAT_IN
FOREACH HAIF in {HAIFS}
-A OUTPUT -d {PEERIP({HAIF})} -o {PHYSNAME({HAIF})} --opcode 1 -j mangle --mangle-ip-s {IP({HAIF})}
DONE
-A OUTPUT -j HEARTBEAT_OUT
FI
IF {DECIDE_BRIDGE_MODE_ANY_ENDPOINT}
IF {CPE_HIGH_AVAILABILITY}
# accept the keepalived virtual ip address
-A INPUT -d {VIRTUAL_IP_ADDRESS} -i {VIRTUAL_IP_INTERFACE} -j ACCEPT
# accept the heartbeat service IPs
FOREACH HAIF in {HAIFS}
-A INPUT -d {IP({HAIF})} -i {PHYSNAME({HAIF})} -j ACCEPT
DONE
FI
# -p 1 shmainei Request operation (who-has?)
FOREACH VIF in {LAN}
-A INPUT -d {VLL_GATEWAY}/{VLL_MASK_1} -i {PHYSNAME({VIF})} -j ACCEPT
IF {VLL_WORKAROUND_SUBNET_ENABLED}
FOREACH IPID in {VLL_IP_IDS}
-A INPUT -d {VLL_WORKAROUND_SUBNET({IPID})} -i {PHYSNAME({VIF})} -j ACCEPT
DONE
FI
DONE
FOREACH VIF in {LAN|WAN|VLAN}
-A INPUT -d {IP({VIF})}/32 -i {PHYSNAME({VIF})} -j ACCEPT
DONE
#-A INPUT -i {PHYSNAME({VIF})} -j DROP
FOREACH VIF in {LAN}
FOREACH IPID in {VLL_IP_IDS}
IF {VLL_WORKAROUND_SUBNET_ENABLED}
-A OUTPUT -s {IP({VIF})} -d {VLL_IP({IPID})} -o {PHYSNAME({VIF})} -j mangle --mangle-ip-s {VLL_WORKAROUND_GATEWAY({IPID})}
ELSE
-A OUTPUT -s {IP({VIF})} -d {VLL_IP({IPID})} -o {PHYSNAME({VIF})} -j mangle --mangle-ip-s {VLL_GATEWAY}
FI
DONE
IF {VLL_BACKROUTED_SUBNET_ENABLED}
FOREACH BRID in {BR_IDS}
IF {VLL_WORKAROUND_SUBNET_ENABLED}
#-A OUTPUT -s {IP({VIF})} -d {VLL_BACKROUTED_SUBNET({BRID})} -o {PHYSNAME({VIF})} -j mangle --mangle-ip-s {VLL_WORKAROUND_GATEWAY_1}
GENERATE {BACKROUTED_ARP_OUTPUT_MANGLE}
ELSE
-A OUTPUT -s {IP({VIF})} -d {VLL_BACKROUTED_SUBNET({BRID})} -o {PHYSNAME({VIF})} -j mangle --mangle-ip-s {VLL_GATEWAY}
FI
DONE
FI
DONE
FI
