Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- root@OpenWrt:~# swconfig list; swconfig dev switch0 help; swconfig dev switch0 show; ip a; ip r; ip ru; iptables-save;
- Found: switch0 - 10.mvsw61xx
- switch0: 10.mvsw61xx(MV88E6352), ports: 7 (cpu @ 5), vlans: 64
- --switch
- Attribute 1 (int): enable_vlan (Enable 802.1q VLAN support)
- Attribute 2 (none): apply (Activate changes in the hardware)
- Attribute 3 (none): reset (Reset the switch)
- --vlan
- Attribute 1 (int): port_based (Use port-based (non-802.1q) VLAN only)
- Attribute 2 (int): vid (Get/set VLAN ID)
- Attribute 3 (ports): ports (VLAN port mapping)
- --port
- Attribute 1 (string): mask (Port-based VLAN mask)
- Attribute 2 (int): qmode (802.1q mode: 0=off/1=fallback/2=check/3=secure)
- Attribute 3 (int): pvid (Primary VLAN ID)
- Attribute 4 (unknown): link (Get port link information)
- Global attributes:
- enable_vlan: 1
- Port 0:
- mask: 0x0000: (0)
- qmode: 3
- pvid: 1
- link: port:0 link:down
- Port 1:
- mask: 0x0000: (1)
- qmode: 3
- pvid: 1
- link: port:1 link:down
- Port 2:
- mask: 0x0000: (2)
- qmode: 3
- pvid: 1
- link: port:2 link:up speed:1000baseT full-duplex
- Port 3:
- mask: 0x0000: (3)
- qmode: 3
- pvid: 1
- link: port:3 link:up speed:1000baseT full-duplex
- Port 4:
- mask: 0x0000: (4)
- qmode: 3
- pvid: 2
- link: port:4 link:up speed:100baseT full-duplex
- Port 5:
- mask: 0x0000: (5)
- qmode: 3
- pvid: 0
- link: port:5 link:up speed:1000baseT full-duplex
- Port 6:
- mask: 0x0000: (6)
- qmode: 3
- pvid: 0
- link: port:6 link:up speed:1000baseT full-duplex
- VLAN 1:
- port_based: 0
- vid: 1
- ports: 0 1 2 3 5t
- VLAN 2:
- port_based: 0
- vid: 2
- ports: 4 6t
- 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
- link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
- inet 127.0.0.1/8 scope host lo
- valid_lft forever preferred_lft forever
- inet6 ::1/128 scope host
- valid_lft forever preferred_lft forever
- 2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 532
- link/ether 24:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
- inet6 fe80::26f5:a2ff:fec4:7ad0/64 scope link
- valid_lft forever preferred_lft forever
- 3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 532
- link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
- inet6 fe80::24f5:a2ff:fec4:7ad0/64 scope link
- valid_lft forever preferred_lft forever
- 7: mlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
- link/ether 24:f5:a2:c4:7a:d3 brd ff:ff:ff:ff:ff:ff
- 8: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
- link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
- inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
- valid_lft forever preferred_lft forever
- inet6 fd55:f0a5:8ae9::1/60 scope global
- valid_lft forever preferred_lft forever
- inet6 fe80::24f5:a2ff:fec4:7ad0/64 scope link
- valid_lft forever preferred_lft forever
- 9: eth0.1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
- link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
- 10: eth1.2@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
- link/ether 24:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
- inet6 fe80::26f5:a2ff:fec4:7ad0/64 scope link
- valid_lft forever preferred_lft forever
- 11: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br-lan state UP qlen 1000
- link/ether 24:f5:a2:c4:7a:d1 brd ff:ff:ff:ff:ff:ff
- inet6 fe80::26f5:a2ff:fec4:7ad1/64 scope link
- valid_lft forever preferred_lft forever
- 12: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br-lan state UP qlen 1000
- link/ether 24:f5:a2:c4:7a:d2 brd ff:ff:ff:ff:ff:ff
- inet6 fe80::26f5:a2ff:fec4:7ad2/64 scope link
- valid_lft forever preferred_lft forever
- 192.168.1.0/24 dev br-lan scope link src 192.168.1.1
- 0: from all lookup local
- 32766: from all lookup main
- 32767: from all lookup default
- # Generated by iptables-save v1.6.2 on Sun Sep 8 03:21:28 2019
- *nat
- :PREROUTING ACCEPT [1184:214855]
- :INPUT ACCEPT [86:6293]
- :OUTPUT ACCEPT [162:10832]
- :POSTROUTING ACCEPT [0:0]
- :postrouting_lan_rule - [0:0]
- :postrouting_rule - [0:0]
- :postrouting_wan_rule - [0:0]
- :prerouting_lan_rule - [0:0]
- :prerouting_rule - [0:0]
- :prerouting_wan_rule - [0:0]
- :zone_lan_postrouting - [0:0]
- :zone_lan_prerouting - [0:0]
- :zone_wan_postrouting - [0:0]
- :zone_wan_prerouting - [0:0]
- -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
- -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
- -A PREROUTING -i eth1.2 -m comment --comment "!fw3" -j zone_wan_prerouting
- -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
- -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
- -A POSTROUTING -o eth1.2 -m comment --comment "!fw3" -j zone_wan_postrouting
- -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
- -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 80 -m comment --comment "!fw3: rpi80 (reflection)" -j SNAT --to-source 192.168.1.1
- -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: rpi443 (reflection)" -j SNAT --to-source 192.168.1.1
- -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j SNAT --to-source 192.168.1.1
- -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j SNAT --to-source 192.168.1.1
- -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
- -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p tcp -m tcp --dport 80 -m comment --comment "!fw3: rpi80 (reflection)" -j DNAT --to-destination 192.168.1.3:80
- -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: rpi443 (reflection)" -j DNAT --to-destination 192.168.1.3:443
- -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p tcp -m tcp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j DNAT --to-destination 192.168.1.3:853
- -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p udp -m udp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j DNAT --to-destination 192.168.1.3:853
- -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
- -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
- -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
- -A zone_wan_prerouting -p tcp -m tcp --dport 80 -m comment --comment "!fw3: rpi80" -j DNAT --to-destination 192.168.1.3:80
- -A zone_wan_prerouting -p tcp -m tcp --dport 443 -m comment --comment "!fw3: rpi443" -j DNAT --to-destination 192.168.1.3:443
- -A zone_wan_prerouting -p tcp -m tcp --dport 853 -m comment --comment "!fw3: privatedns853" -j DNAT --to-destination 192.168.1.3:853
- -A zone_wan_prerouting -p udp -m udp --dport 853 -m comment --comment "!fw3: privatedns853" -j DNAT --to-destination 192.168.1.3:853
- COMMIT
- # Completed on Sun Sep 8 03:21:28 2019
- # Generated by iptables-save v1.6.2 on Sun Sep 8 03:21:28 2019
- *mangle
- :PREROUTING ACCEPT [14826:4384595]
- :INPUT ACCEPT [1896:220942]
- :FORWARD ACCEPT [9560:3569885]
- :OUTPUT ACCEPT [1840:421310]
- :POSTROUTING ACCEPT [11371:3987637]
- -A FORWARD -o eth1.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
- COMMIT
- # Completed on Sun Sep 8 03:21:28 2019
- # Generated by iptables-save v1.6.2 on Sun Sep 8 03:21:28 2019
- *filter
- :INPUT ACCEPT [0:0]
- :FORWARD DROP [0:0]
- :OUTPUT ACCEPT [0:0]
- :forwarding_lan_rule - [0:0]
- :forwarding_rule - [0:0]
- :forwarding_wan_rule - [0:0]
- :input_lan_rule - [0:0]
- :input_rule - [0:0]
- :input_wan_rule - [0:0]
- :output_lan_rule - [0:0]
- :output_rule - [0:0]
- :output_wan_rule - [0:0]
- :reject - [0:0]
- :syn_flood - [0:0]
- :zone_lan_dest_ACCEPT - [0:0]
- :zone_lan_forward - [0:0]
- :zone_lan_input - [0:0]
- :zone_lan_output - [0:0]
- :zone_lan_src_ACCEPT - [0:0]
- :zone_wan_dest_ACCEPT - [0:0]
- :zone_wan_dest_REJECT - [0:0]
- :zone_wan_forward - [0:0]
- :zone_wan_input - [0:0]
- :zone_wan_output - [0:0]
- :zone_wan_src_REJECT - [0:0]
- -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
- -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
- -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
- -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
- -A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
- -A INPUT -i eth1.2 -m comment --comment "!fw3" -j zone_wan_input
- -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
- -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
- -A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
- -A FORWARD -i eth1.2 -m comment --comment "!fw3" -j zone_wan_forward
- -A FORWARD -m comment --comment "!fw3" -j reject
- -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
- -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
- -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
- -A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
- -A OUTPUT -o eth1.2 -m comment --comment "!fw3" -j zone_wan_output
- -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
- -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
- -A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
- -A syn_flood -m comment --comment "!fw3" -j DROP
- -A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
- -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
- -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
- -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
- -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
- -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
- -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
- -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
- -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
- -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
- -A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
- -A zone_wan_dest_ACCEPT -o eth1.2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
- -A zone_wan_dest_ACCEPT -o eth1.2 -m comment --comment "!fw3" -j ACCEPT
- -A zone_wan_dest_REJECT -o eth1.2 -m comment --comment "!fw3" -j reject
- -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
- -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
- -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
- -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
- -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
- -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
- -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
- -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
- -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
- -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
- -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
- -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
- -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
- -A zone_wan_src_REJECT -i eth1.2 -m comment --comment "!fw3" -j reject
- COMMIT
- # Completed on Sun Sep 8 03:21:28 2019
Add Comment
Please, Sign In to add comment