API tools faq
paste
xxorza

doesnt work

xxorza
Sep 7th, 2019
236
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 11.41 KB | None | 0 0
raw download clone embed print report
  1. root@OpenWrt:~# swconfig list
  2. swconfig Found: switch0 - 10.mvsw61xx
  3. devroot@OpenWrt:~# swconfig dev switch0 help
  4. swconfig deswitch0: 10.mvsw61xx(MV88E6352), ports: 7 (cpu @ 5), vlans: 64
  5. --switch
  6. Attribute 1 (int): enable_vlan (Enable 802.1q VLAN support)
  7. Attribute 2 (none): apply (Activate changes in the hardware)
  8. Attribute 3 (none): reset (Reset the switch)
  9. --vlan
  10. Attribute 1 (int): port_based (Use port-based (non-802.1q) VLAN only)
  11. Attribute 2 (int): vid (Get/set VLAN ID)
  12. Attribute 3 (ports): ports (VLAN port mapping)
  13. --port
  14. Attribute 1 (string): mask (Port-based VLAN mask)
  15. Attribute 2 (int): qmode (802.1q mode: 0=off/1=fallback/2=check/3=secure)
  16. Attribute 3 (int): pvid (Primary VLAN ID)
  17. Attribute 4 (unknown): link (Get port link information)
  18. vroot@OpenWrt:~# swconfig dev switch0 show
  19. ip a; ip r; iGlobal attributes:
  20. enable_vlan: 1
  21. Port 0:
  22. mask: 0x0000: (0)
  23. p qmode: 3
  24. pvid: 1
  25. link: port:0 link:down
  26. Port 1:
  27. mask: 0x0000: (1)
  28. qmode: 3
  29. pvid: 1
  30. r link: port:1 link:down
  31. Port 2:
  32. mask: 0x0000: (2)
  33. u qmode: 3
  34. pvid: 1
  35. link: port:2 link:up speed:1000baseT full-duplex
  36. Port 3:
  37. mask: 0x0000: (3)
  38. qmode: 3
  39. pvid: 1
  40. link: port:3 link:up speed:1000baseT full-duplex
  41. Port 4:
  42. ; mask: 0x0000: (4)
  43. qmode: 3
  44. pvid: 2
  45. link: port:4 link:up speed:100baseT full-duplex
  46. Port 5:
  47. mask: 0x0000: (5)
  48. qmode: 3
  49. pvid: 0
  50. link: port:5 link:up speed:1000baseT full-duplex
  51. Port 6:
  52. mask: 0x0000: (6)
  53. qmode: 3
  54. pvid: 0
  55. i link: port:6 link:up speed:1000baseT full-duplex
  56. VLAN 1:
  57. port_based: 0
  58. vid: 1
  59. ports: 0 1 2 3 5t
  60. VLAN 2:
  61. port_based: 0
  62. vid: 2
  63. ports: 4 6t
  64. ptaroot@OpenWrt:~# ip a; ip r; ip ru; iptables-save
  65. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
  66. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  67. inet 127.0.0.1/8 scope host lo
  68. valid_lft forever preferred_lft forever
  69. inet6 ::1/128 scope host
  70. valid_lft forever preferred_lft forever
  71. 2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 532
  72. link/ether 24:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  73. inet6 fe80::26f5:a2ff:fec4:7ad0/64 scope link
  74. valid_lft forever preferred_lft forever
  75. 3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 532
  76. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  77. inet6 fe80::24f5:a2ff:fec4:7ad0/64 scope link
  78. valid_lft forever preferred_lft forever
  79. 7: mlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  80. link/ether 24:f5:a2:c4:7a:d3 brd ff:ff:ff:ff:ff:ff
  81. 8: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  82. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  83. inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
  84. valid_lft forever preferred_lft forever
  85. inet6 fd55:f0a5:8ae9::1/60 scope global
  86. valid_lft forever preferred_lft forever
  87. inet6 fe80::24f5:a2ff:fec4:7ad0/64 scope link
  88. valid_lft forever preferred_lft forever
  89. 9: eth0.1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
  90. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  91. 10: eth1.2@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  92. link/ether 24:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  93. inet6 fe80::26f5:a2ff:fec4:7ad0/64 scope link
  94. valid_lft forever preferred_lft forever
  95. 11: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br-lan state UP qlen 1000
  96. link/ether 24:f5:a2:c4:7a:d1 brd ff:ff:ff:ff:ff:ff
  97. inet6 fe80::26f5:a2ff:fec4:7ad1/64 scope link
  98. valid_lft forever preferred_lft forever
  99. 12: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq master br-lan state DOWN qlen 1000
  100. link/ether 24:f5:a2:c4:7a:d2 brd ff:ff:ff:ff:ff:ff
  101. 192.168.1.0/24 dev br-lan scope link src 192.168.1.1
  102. 0: from all lookup local
  103. 32766: from all lookup main
  104. 32767: from all lookup default
  105. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:09:32 2019
  106. *nat
  107. :PREROUTING ACCEPT [908:173303]
  108. :INPUT ACCEPT [192:11965]
  109. :OUTPUT ACCEPT [25:3178]
  110. :POSTROUTING ACCEPT [25:3178]
  111. :postrouting_lan_rule - [0:0]
  112. :postrouting_rule - [0:0]
  113. :postrouting_wan_rule - [0:0]
  114. :prerouting_lan_rule - [0:0]
  115. :prerouting_rule - [0:0]
  116. :prerouting_wan_rule - [0:0]
  117. :zone_lan_postrouting - [0:0]
  118. :zone_lan_prerouting - [0:0]
  119. :zone_wan_postrouting - [0:0]
  120. :zone_wan_prerouting - [0:0]
  121. -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
  122. -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
  123. -A PREROUTING -i eth1.2 -m comment --comment "!fw3" -j zone_wan_prerouting
  124. -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
  125. -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
  126. -A POSTROUTING -o eth1.2 -m comment --comment "!fw3" -j zone_wan_postrouting
  127. -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
  128. -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
  129. -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
  130. -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
  131. -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
  132. -A zone_wan_prerouting -p tcp -m tcp --dport 80 -m comment --comment "!fw3: rpi80" -j DNAT --to-destination 192.168.1.3:80
  133. -A zone_wan_prerouting -p tcp -m tcp --dport 443 -m comment --comment "!fw3: rpi443" -j DNAT --to-destination 192.168.1.3:443
  134. -A zone_wan_prerouting -p tcp -m tcp --dport 853 -m comment --comment "!fw3: privatedns853" -j DNAT --to-destination 192.168.1.3:853
  135. -A zone_wan_prerouting -p udp -m udp --dport 853 -m comment --comment "!fw3: privatedns853" -j DNAT --to-destination 192.168.1.3:853
  136. COMMIT
  137. # Completed on Sun Sep 8 03:09:32 2019
  138. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:09:32 2019
  139. *mangle
  140. :PREROUTING ACCEPT [2056:309631]
  141. :INPUT ACCEPT [949:91064]
  142. :FORWARD ACCEPT [0:0]
  143. :OUTPUT ACCEPT [876:124575]
  144. :POSTROUTING ACCEPT [877:124918]
  145. -A FORWARD -o eth1.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
  146. COMMIT
  147. # Completed on Sun Sep 8 03:09:32 2019
  148. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:09:32 2019
  149. *filter
  150. :INPUT ACCEPT [0:0]
  151. :FORWARD DROP [0:0]
  152. :OUTPUT ACCEPT [0:0]
  153. :forwarding_lan_rule - [0:0]
  154. :forwarding_rule - [0:0]
  155. :forwarding_wan_rule - [0:0]
  156. :input_lan_rule - [0:0]
  157. :input_rule - [0:0]
  158. :input_wan_rule - [0:0]
  159. :output_lan_rule - [0:0]
  160. :output_rule - [0:0]
  161. :output_wan_rule - [0:0]
  162. :reject - [0:0]
  163. :syn_flood - [0:0]
  164. :zone_lan_dest_ACCEPT - [0:0]
  165. :zone_lan_forward - [0:0]
  166. :zone_lan_input - [0:0]
  167. :zone_lan_output - [0:0]
  168. :zone_lan_src_ACCEPT - [0:0]
  169. :zone_wan_dest_ACCEPT - [0:0]
  170. :zone_wan_dest_REJECT - [0:0]
  171. :zone_wan_forward - [0:0]
  172. :zone_wan_input - [0:0]
  173. :zone_wan_output - [0:0]
  174. :zone_wan_src_REJECT - [0:0]
  175. -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
  176. -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
  177. -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
  178. -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
  179. -A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
  180. -A INPUT -i eth1.2 -m comment --comment "!fw3" -j zone_wan_input
  181. -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
  182. -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
  183. -A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
  184. -A FORWARD -i eth1.2 -m comment --comment "!fw3" -j zone_wan_forward
  185. -A FORWARD -m comment --comment "!fw3" -j reject
  186. -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
  187. -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
  188. -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
  189. -A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
  190. -A OUTPUT -o eth1.2 -m comment --comment "!fw3" -j zone_wan_output
  191. -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
  192. -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
  193. -A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
  194. -A syn_flood -m comment --comment "!fw3" -j DROP
  195. -A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
  196. -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
  197. -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
  198. -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
  199. -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
  200. -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
  201. -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
  202. -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
  203. -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
  204. -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
  205. -A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
  206. -A zone_wan_dest_ACCEPT -o eth1.2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
  207. -A zone_wan_dest_ACCEPT -o eth1.2 -m comment --comment "!fw3" -j ACCEPT
  208. -A zone_wan_dest_REJECT -o eth1.2 -m comment --comment "!fw3" -j reject
  209. -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
  210. -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
  211. -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
  212. -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
  213. -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
  214. -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
  215. -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
  216. -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
  217. -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
  218. -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
  219. -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
  220. -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
  221. -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
  222. -A zone_wan_src_REJECT -i eth1.2 -m comment --comment "!fw3" -j reject
  223. COMMIT
  224. # Completed on Sun Sep 8 03:09:32 2019
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!