API tools faq
paste
xxorza

works

xxorza
Sep 7th, 2019
225
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 13.22 KB | None | 0 0
raw download clone embed print report
  1. root@OpenWrt:~# swconfig list
  2. swconfig devFound: switch0 - 10.mvsw61xx
  3. $(root@OpenWrt:~# swconfig dev $(swconfig list | cut -d " " -f 2) help
  4. swconfig dev $(swconfig list | cut -d " " -f 2) show
  5. ip a; ip switch0: 10.mvsw61xx(MV88E6352), ports: 7 (cpu @ 5), vlans: 64
  6. r --switch
  7. Attribute 1 (int): enable_vlan (Enable 802.1q VLAN support)
  8. Attribute 2 (none): apply (Activate changes in the hardware)
  9. ; Attribute 3 (none): reset (Reset the switch)
  10. --vlan
  11. Attribute 1 (int): port_based (Use port-based (non-802.1q) VLAN only)
  12. Attribute 2 (int): vid (Get/set VLAN ID)
  13. i Attribute 3 (ports): ports (VLAN port mapping)
  14. --port
  15. p Attribute 1 (string): mask (Port-based VLAN mask)
  16. Attribute 2 (int): qmode (802.1q mode: 0=off/1=fallback/2=check/3=secure)
  17. Attribute 3 (int): pvid (Primary VLAN ID)
  18. Attribute 4 (unknown): link (Get port link information)
  19. rroot@OpenWrt:~# swconfig dev $(swconfig list | cut -d " " -f 2) show
  20. iptables-saveGlobal attributes:
  21. enable_vlan: 1
  22. Port 0:
  23. mask: 0x0000: (0)
  24. qmode: 3
  25. pvid: 1
  26. link: port:0 link:down
  27. Port 1:
  28. mask: 0x0000: (1)
  29. qmode: 3
  30. pvid: 1
  31. link: port:1 link:down
  32. Port 2:
  33. mask: 0x0000: (2)
  34. qmode: 3
  35. pvid: 1
  36. link: port:2 link:up speed:1000baseT full-duplex
  37. Port 3:
  38. mask: 0x0000: (3)
  39. qmode: 3
  40. pvid: 1
  41. link: port:3 link:up speed:1000baseT full-duplex
  42. Port 4:
  43. mask: 0x0000: (4)
  44. qmode: 3
  45. pvid: 2
  46. link: port:4 link:up speed:100baseT full-duplex
  47. Port 5:
  48. mask: 0x0000: (5)
  49. qmode: 3
  50. pvid: 0
  51. link: port:5 link:up speed:1000baseT full-duplex
  52. Port 6:
  53. mask: 0x0000: (6)
  54. qmode: 3
  55. pvid: 0
  56. link: port:6 link:up speed:1000baseT full-duplex
  57. VLAN 1:
  58. port_based: 0
  59. vid: 1
  60. ports: 0 1 2 3 5t
  61. VLAN 2:
  62. port_based: 0
  63. vid: 2
  64. ports: 4 6t
  65. root@OpenWrt:~# ip a; ip r; ip ru; iptables-save
  66. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
  67. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  68. inet 127.0.0.1/8 scope host lo
  69. valid_lft forever preferred_lft forever
  70. inet6 ::1/128 scope host
  71. valid_lft forever preferred_lft forever
  72. 2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 532
  73. link/ether 24:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  74. inet6 fe80::26f5:a2ff:fec4:7ad0/64 scope link
  75. valid_lft forever preferred_lft forever
  76. 3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 532
  77. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  78. inet6 fe80::24f5:a2ff:fec4:7ad0/64 scope link
  79. valid_lft forever preferred_lft forever
  80. 7: mlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  81. link/ether 24:f5:a2:c4:7a:d3 brd ff:ff:ff:ff:ff:ff
  82. 8: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  83. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  84. inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
  85. valid_lft forever preferred_lft forever
  86. inet6 fd55:f0a5:8ae9::1/60 scope global
  87. valid_lft forever preferred_lft forever
  88. inet6 fe80::24f5:a2ff:fec4:7ad0/64 scope link
  89. valid_lft forever preferred_lft forever
  90. 9: eth0.1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
  91. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  92. 10: eth1.2@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  93. link/ether 24:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  94. inet 162.211.151.92/24 brd 162.211.151.255 scope global eth1.2
  95. valid_lft forever preferred_lft forever
  96. inet6 fe80::26f5:a2ff:fec4:7ad0/64 scope link
  97. valid_lft forever preferred_lft forever
  98. 11: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br-lan state UP qlen 1000
  99. link/ether 24:f5:a2:c4:7a:d1 brd ff:ff:ff:ff:ff:ff
  100. inet6 fe80::26f5:a2ff:fec4:7ad1/64 scope link
  101. valid_lft forever preferred_lft forever
  102. 12: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br-lan state UP qlen 1000
  103. link/ether 24:f5:a2:c4:7a:d2 brd ff:ff:ff:ff:ff:ff
  104. inet6 fe80::26f5:a2ff:fec4:7ad2/64 scope link
  105. valid_lft forever preferred_lft forever
  106. default via 162.211.151.1 dev eth1.2
  107. 162.211.151.0/24 dev eth1.2 scope link src 162.211.151.92
  108. 192.168.1.0/24 dev br-lan scope link src 192.168.1.1
  109. 0: from all lookup local
  110. 32766: from all lookup main
  111. 32767: from all lookup default
  112. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:07:04 2019
  113. *nat
  114. :PREROUTING ACCEPT [4708:824245]
  115. :INPUT ACCEPT [149:12090]
  116. :OUTPUT ACCEPT [476:32995]
  117. :POSTROUTING ACCEPT [5:600]
  118. :postrouting_lan_rule - [0:0]
  119. :postrouting_rule - [0:0]
  120. :postrouting_wan_rule - [0:0]
  121. :prerouting_lan_rule - [0:0]
  122. :prerouting_rule - [0:0]
  123. :prerouting_wan_rule - [0:0]
  124. :zone_lan_postrouting - [0:0]
  125. :zone_lan_prerouting - [0:0]
  126. :zone_wan_postrouting - [0:0]
  127. :zone_wan_prerouting - [0:0]
  128. -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
  129. -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
  130. -A PREROUTING -i eth1.2 -m comment --comment "!fw3" -j zone_wan_prerouting
  131. -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
  132. -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
  133. -A POSTROUTING -o eth1.2 -m comment --comment "!fw3" -j zone_wan_postrouting
  134. -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
  135. -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 80 -m comment --comment "!fw3: rpi80 (reflection)" -j SNAT --to-source 192.168.1.1
  136. -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: rpi443 (reflection)" -j SNAT --to-source 192.168.1.1
  137. -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j SNAT --to-source 192.168.1.1
  138. -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j SNAT --to-source 192.168.1.1
  139. -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
  140. -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p tcp -m tcp --dport 80 -m comment --comment "!fw3: rpi80 (reflection)" -j DNAT --to-destination 192.168.1.3:80
  141. -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: rpi443 (reflection)" -j DNAT --to-destination 192.168.1.3:443
  142. -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p tcp -m tcp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j DNAT --to-destination 192.168.1.3:853
  143. -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p udp -m udp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j DNAT --to-destination 192.168.1.3:853
  144. -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
  145. -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
  146. -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
  147. -A zone_wan_prerouting -p tcp -m tcp --dport 80 -m comment --comment "!fw3: rpi80" -j DNAT --to-destination 192.168.1.3:80
  148. -A zone_wan_prerouting -p tcp -m tcp --dport 443 -m comment --comment "!fw3: rpi443" -j DNAT --to-destination 192.168.1.3:443
  149. -A zone_wan_prerouting -p tcp -m tcp --dport 853 -m comment --comment "!fw3: privatedns853" -j DNAT --to-destination 192.168.1.3:853
  150. -A zone_wan_prerouting -p udp -m udp --dport 853 -m comment --comment "!fw3: privatedns853" -j DNAT --to-destination 192.168.1.3:853
  151. COMMIT
  152. # Completed on Sun Sep 8 03:07:04 2019
  153. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:07:04 2019
  154. *mangle
  155. :PREROUTING ACCEPT [60334:28769917]
  156. :INPUT ACCEPT [4964:699657]
  157. :FORWARD ACCEPT [42833:25801151]
  158. :OUTPUT ACCEPT [2935:609814]
  159. :POSTROUTING ACCEPT [45761:26410445]
  160. -A FORWARD -o eth1.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
  161. COMMIT
  162. # Completed on Sun Sep 8 03:07:04 2019
  163. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:07:04 2019
  164. *filter
  165. :INPUT ACCEPT [1:40]
  166. :FORWARD DROP [0:0]
  167. :OUTPUT ACCEPT [0:0]
  168. :forwarding_lan_rule - [0:0]
  169. :forwarding_rule - [0:0]
  170. :forwarding_wan_rule - [0:0]
  171. :input_lan_rule - [0:0]
  172. :input_rule - [0:0]
  173. :input_wan_rule - [0:0]
  174. :output_lan_rule - [0:0]
  175. :output_rule - [0:0]
  176. :output_wan_rule - [0:0]
  177. :reject - [0:0]
  178. :syn_flood - [0:0]
  179. :zone_lan_dest_ACCEPT - [0:0]
  180. :zone_lan_forward - [0:0]
  181. :zone_lan_input - [0:0]
  182. :zone_lan_output - [0:0]
  183. :zone_lan_src_ACCEPT - [0:0]
  184. :zone_wan_dest_ACCEPT - [0:0]
  185. :zone_wan_dest_REJECT - [0:0]
  186. :zone_wan_forward - [0:0]
  187. :zone_wan_input - [0:0]
  188. :zone_wan_output - [0:0]
  189. :zone_wan_src_REJECT - [0:0]
  190. -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
  191. -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
  192. -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
  193. -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
  194. -A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
  195. -A INPUT -i eth1.2 -m comment --comment "!fw3" -j zone_wan_input
  196. -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
  197. -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
  198. -A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
  199. -A FORWARD -i eth1.2 -m comment --comment "!fw3" -j zone_wan_forward
  200. -A FORWARD -m comment --comment "!fw3" -j reject
  201. -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
  202. -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
  203. -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
  204. -A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
  205. -A OUTPUT -o eth1.2 -m comment --comment "!fw3" -j zone_wan_output
  206. -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
  207. -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
  208. -A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
  209. -A syn_flood -m comment --comment "!fw3" -j DROP
  210. -A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
  211. -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
  212. -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
  213. -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
  214. -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
  215. -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
  216. -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
  217. -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
  218. -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
  219. -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
  220. -A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
  221. -A zone_wan_dest_ACCEPT -o eth1.2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
  222. -A zone_wan_dest_ACCEPT -o eth1.2 -m comment --comment "!fw3" -j ACCEPT
  223. -A zone_wan_dest_REJECT -o eth1.2 -m comment --comment "!fw3" -j reject
  224. -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
  225. -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
  226. -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
  227. -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
  228. -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
  229. -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
  230. -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
  231. -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
  232. -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
  233. -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
  234. -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
  235. -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
  236. -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
  237. -A zone_wan_src_REJECT -i eth1.2 -m comment --comment "!fw3" -j reject
  238. COMMIT
  239. # Completed on Sun Sep 8 03:07:04 2019
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!