API tools faq
paste
xxorza

doesnt work

xxorza
Sep 7th, 2019
107
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 28.56 KB | None | 0 0
raw download clone embed print report
  1. root@OpenWrt:~# swconfig list
  2. swconfig Found: switch0 - 10.mvsw61xx
  3. devroot@OpenWrt:~# swconfig dev switch0 help
  4. swconfig deswitch0: 10.mvsw61xx(MV88E6352), ports: 7 (cpu @ 5), vlans: 64
  5. --switch
  6. Attribute 1 (int): enable_vlan (Enable 802.1q VLAN support)
  7. Attribute 2 (none): apply (Activate changes in the hardware)
  8. Attribute 3 (none): reset (Reset the switch)
  9. --vlan
  10. Attribute 1 (int): port_based (Use port-based (non-802.1q) VLAN only)
  11. Attribute 2 (int): vid (Get/set VLAN ID)
  12. Attribute 3 (ports): ports (VLAN port mapping)
  13. --port
  14. Attribute 1 (string): mask (Port-based VLAN mask)
  15. Attribute 2 (int): qmode (802.1q mode: 0=off/1=fallback/2=check/3=secure)
  16. Attribute 3 (int): pvid (Primary VLAN ID)
  17. Attribute 4 (unknown): link (Get port link information)
  18. vroot@OpenWrt:~# swconfig dev switch0 show
  19. ip a; ip r; iGlobal attributes:
  20. enable_vlan: 1
  21. Port 0:
  22. mask: 0x0000: (0)
  23. p qmode: 3
  24. pvid: 1
  25. link: port:0 link:down
  26. Port 1:
  27. mask: 0x0000: (1)
  28. qmode: 3
  29. pvid: 1
  30. r link: port:1 link:down
  31. Port 2:
  32. mask: 0x0000: (2)
  33. u qmode: 3
  34. pvid: 1
  35. link: port:2 link:up speed:1000baseT full-duplex
  36. Port 3:
  37. mask: 0x0000: (3)
  38. qmode: 3
  39. pvid: 1
  40. link: port:3 link:up speed:1000baseT full-duplex
  41. Port 4:
  42. ; mask: 0x0000: (4)
  43. qmode: 3
  44. pvid: 2
  45. link: port:4 link:up speed:100baseT full-duplex
  46. Port 5:
  47. mask: 0x0000: (5)
  48. qmode: 3
  49. pvid: 0
  50. link: port:5 link:up speed:1000baseT full-duplex
  51. Port 6:
  52. mask: 0x0000: (6)
  53. qmode: 3
  54. pvid: 0
  55. i link: port:6 link:up speed:1000baseT full-duplex
  56. VLAN 1:
  57. port_based: 0
  58. vid: 1
  59. ports: 0 1 2 3 5t
  60. VLAN 2:
  61. port_based: 0
  62. vid: 2
  63. ports: 4 6t
  64. ptaroot@OpenWrt:~# ip a; ip r; ip ru; iptables-save
  65. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
  66. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  67. inet 127.0.0.1/8 scope host lo
  68. valid_lft forever preferred_lft forever
  69. inet6 ::1/128 scope host
  70. valid_lft forever preferred_lft forever
  71. 2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 532
  72. link/ether 24:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  73. inet6 fe80::26f5:a2ff:fec4:7ad0/64 scope link
  74. valid_lft forever preferred_lft forever
  75. 3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 532
  76. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  77. inet6 fe80::24f5:a2ff:fec4:7ad0/64 scope link
  78. valid_lft forever preferred_lft forever
  79. 7: mlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  80. link/ether 24:f5:a2:c4:7a:d3 brd ff:ff:ff:ff:ff:ff
  81. 8: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  82. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  83. inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
  84. valid_lft forever preferred_lft forever
  85. inet6 fd55:f0a5:8ae9::1/60 scope global
  86. valid_lft forever preferred_lft forever
  87. inet6 fe80::24f5:a2ff:fec4:7ad0/64 scope link
  88. valid_lft forever preferred_lft forever
  89. 9: eth0.1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
  90. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  91. 10: eth1.2@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  92. link/ether 24:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  93. inet6 fe80::26f5:a2ff:fec4:7ad0/64 scope link
  94. valid_lft forever preferred_lft forever
  95. 11: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br-lan state UP qlen 1000
  96. link/ether 24:f5:a2:c4:7a:d1 brd ff:ff:ff:ff:ff:ff
  97. inet6 fe80::26f5:a2ff:fec4:7ad1/64 scope link
  98. valid_lft forever preferred_lft forever
  99. 12: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq master br-lan state DOWN qlen 1000
  100. link/ether 24:f5:a2:c4:7a:d2 brd ff:ff:ff:ff:ff:ff
  101. 192.168.1.0/24 dev br-lan scope link src 192.168.1.1
  102. 0: from all lookup local
  103. 32766: from all lookup main
  104. 32767: from all lookup default
  105. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:09:32 2019
  106. *nat
  107. :PREROUTING ACCEPT [908:173303]
  108. :INPUT ACCEPT [192:11965]
  109. :OUTPUT ACCEPT [25:3178]
  110. :POSTROUTING ACCEPT [25:3178]
  111. :postrouting_lan_rule - [0:0]
  112. :postrouting_rule - [0:0]
  113. :postrouting_wan_rule - [0:0]
  114. :prerouting_lan_rule - [0:0]
  115. :prerouting_rule - [0:0]
  116. :prerouting_wan_rule - [0:0]
  117. :zone_lan_postrouting - [0:0]
  118. :zone_lan_prerouting - [0:0]
  119. :zone_wan_postrouting - [0:0]
  120. :zone_wan_prerouting - [0:0]
  121. -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
  122. -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
  123. -A PREROUTING -i eth1.2 -m comment --comment "!fw3" -j zone_wan_prerouting
  124. -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
  125. -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
  126. -A POSTROUTING -o eth1.2 -m comment --comment "!fw3" -j zone_wan_postrouting
  127. -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
  128. -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
  129. -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
  130. -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
  131. -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
  132. -A zone_wan_prerouting -p tcp -m tcp --dport 80 -m comment --comment "!fw3: rpi80" -j DNAT --to-destination 192.168.1.3:80
  133. -A zone_wan_prerouting -p tcp -m tcp --dport 443 -m comment --comment "!fw3: rpi443" -j DNAT --to-destination 192.168.1.3:443
  134. -A zone_wan_prerouting -p tcp -m tcp --dport 853 -m comment --comment "!fw3: privatedns853" -j DNAT --to-destination 192.168.1.3:853
  135. -A zone_wan_prerouting -p udp -m udp --dport 853 -m comment --comment "!fw3: privatedns853" -j DNAT --to-destination 192.168.1.3:853
  136. COMMIT
  137. # Completed on Sun Sep 8 03:09:32 2019
  138. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:09:32 2019
  139. *mangle
  140. :PREROUTING ACCEPT [2056:309631]
  141. :INPUT ACCEPT [949:91064]
  142. :FORWARD ACCEPT [0:0]
  143. :OUTPUT ACCEPT [876:124575]
  144. :POSTROUTING ACCEPT [877:124918]
  145. -A FORWARD -o eth1.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
  146. COMMIT
  147. # Completed on Sun Sep 8 03:09:32 2019
  148. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:09:32 2019
  149. *filter
  150. :INPUT ACCEPT [0:0]
  151. :FORWARD DROP [0:0]
  152. :OUTPUT ACCEPT [0:0]
  153. :forwarding_lan_rule - [0:0]
  154. :forwarding_rule - [0:0]
  155. :forwarding_wan_rule - [0:0]
  156. :input_lan_rule - [0:0]
  157. :input_rule - [0:0]
  158. :input_wan_rule - [0:0]
  159. :output_lan_rule - [0:0]
  160. :output_rule - [0:0]
  161. :output_wan_rule - [0:0]
  162. :reject - [0:0]
  163. :syn_flood - [0:0]
  164. root@OpenWrt:~# swconfig list; swconfig dev switch0 help; swconfig dev switch0 show
  165. ip a; ip r; Found: switch0 - 10.mvsw61xx
  166. ip ru; iptables-saveswitch0: 10.mvsw61xx(MV88E6352), ports: 7 (cpu @ 5), vlans: 64
  167. --switch
  168. Attribute 1 (int): enable_vlan (Enable 802.1q VLAN support)
  169. Attribute 2 (none): apply (Activate changes in the hardware)
  170. Attribute 3 (none): reset (Reset the switch)
  171. --vlan
  172. Attribute 1 (int): port_based (Use port-based (non-802.1q) VLAN only)
  173. Attribute 2 (int): vid (Get/set VLAN ID)
  174. Attribute 3 (ports): ports (VLAN port mapping)
  175. --port
  176. Attribute 1 (string): mask (Port-based VLAN mask)
  177. Attribute 2 (int): qmode (802.1q mode: 0=off/1=fallback/2=check/3=secure)
  178. Attribute 3 (int): pvid (Primary VLAN ID)
  179. Attribute 4 (unknown): link (Get port link information)
  180. Global attributes:
  181. enable_vlan: 1
  182. Port 0:
  183. mask: 0x0000: (0)
  184. qmode: 3
  185. pvid: 1
  186. link: port:0 link:down
  187. Port 1:
  188. mask: 0x0000: (1)
  189. qmode: 3
  190. pvid: 1
  191. link: port:1 link:down
  192. Port 2:
  193. mask: 0x0000: (2)
  194. qmode: 3
  195. pvid: 1
  196. link: port:2 link:up speed:1000baseT full-duplex
  197. Port 3:
  198. mask: 0x0000: (3)
  199. qmode: 3
  200. pvid: 1
  201. link: port:3 link:up speed:1000baseT full-duplex
  202. Port 4:
  203. mask: 0x0000: (4)
  204. qmode: 3
  205. pvid: 2
  206. link: port:4 link:up speed:100baseT full-duplex
  207. Port 5:
  208. mask: 0x0000: (5)
  209. qmode: 3
  210. pvid: 0
  211. link: port:5 link:up speed:1000baseT full-duplex
  212. Port 6:
  213. mask: 0x0000: (6)
  214. qmode: 3
  215. pvid: 0
  216. link: port:6 link:up speed:1000baseT full-duplex
  217. VLAN 1:
  218. port_based: 0
  219. vid: 1
  220. ports: 0 1 2 3 5t
  221. VLAN 2:
  222. port_based: 0
  223. vid: 2
  224. ports: 4 6t
  225. root@OpenWrt:~# ip a; ip r; ip ru; iptables-save
  226. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
  227. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  228. inet 127.0.0.1/8 scope host lo
  229. valid_lft forever preferred_lft forever
  230. inet6 ::1/128 scope host
  231. valid_lft forever preferred_lft forever
  232. 2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 532
  233. link/ether 24:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  234. inet6 fe80::26f5:a2ff:fec4:7ad0/64 scope link
  235. valid_lft forever preferred_lft forever
  236. 3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 532
  237. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  238. inet6 fe80::24f5:a2ff:fec4:7ad0/64 scope link
  239. valid_lft forever preferred_lft forever
  240. 7: mlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  241. link/ether 24:f5:a2:c4:7a:d3 brd ff:ff:ff:ff:ff:ff
  242. 8: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  243. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  244. inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
  245. valid_lft forever preferred_lft forever
  246. inet6 fd55:f0a5:8ae9::1/60 scope global
  247. valid_lft forever preferred_lft forever
  248. inet6 fe80::24f5:a2ff:fec4:7ad0/64 scope link
  249. valid_lft forever preferred_lft forever
  250. 9: eth0.1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
  251. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  252. 10: eth1.2@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  253. link/ether 24:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  254. inet 162.211.151.92/24 brd 162.211.151.255 scope global eth1.2
  255. valid_lft forever preferred_lft forever
  256. inet6 fe80::26f5:a2ff:fec4:7ad0/64 scope link
  257. valid_lft forever preferred_lft forever
  258. 11: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br-lan state UP qlen 1000
  259. link/ether 24:f5:a2:c4:7a:d1 brd ff:ff:ff:ff:ff:ff
  260. inet6 fe80::26f5:a2ff:fec4:7ad1/64 scope link
  261. valid_lft forever preferred_lft forever
  262. 12: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br-lan state UP qlen 1000
  263. link/ether 24:f5:a2:c4:7a:d2 brd ff:ff:ff:ff:ff:ff
  264. inet6 fe80::26f5:a2ff:fec4:7ad2/64 scope link
  265. valid_lft forever preferred_lft forever
  266. default via 162.211.151.1 dev eth1.2
  267. 162.211.151.0/24 dev eth1.2 scope link src 162.211.151.92
  268. 192.168.1.0/24 dev br-lan scope link src 192.168.1.1
  269. 0: from all lookup local
  270. 32766: from all lookup main
  271. 32767: from all lookup default
  272. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:15:49 2019
  273. *nat
  274. :PREROUTING ACCEPT [698:122304]
  275. :INPUT ACCEPT [48:3378]
  276. :OUTPUT ACCEPT [226:15026]
  277. :POSTROUTING ACCEPT [4:272]
  278. :postrouting_lan_rule - [0:0]
  279. :postrouting_rule - [0:0]
  280. :postrouting_wan_rule - [0:0]
  281. :prerouting_lan_rule - [0:0]
  282. :prerouting_rule - [0:0]
  283. :prerouting_wan_rule - [0:0]
  284. :zone_lan_postrouting - [0:0]
  285. :zone_lan_prerouting - [0:0]
  286. :zone_wan_postrouting - [0:0]
  287. :zone_wan_prerouting - [0:0]
  288. -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
  289. -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
  290. -A PREROUTING -i eth1.2 -m comment --comment "!fw3" -j zone_wan_prerouting
  291. -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
  292. -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
  293. -A POSTROUTING -o eth1.2 -m comment --comment "!fw3" -j zone_wan_postrouting
  294. -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
  295. -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 80 -m comment --comment "!fw3: rpi80 (reflection)" -j SNAT --to-source 192.168.1.1
  296. -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: rpi443 (reflection)" -j SNAT --to-source 192.168.1.1
  297. -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j SNAT --to-source 192.168.1.1
  298. -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j SNAT --to-source 192.168.1.1
  299. -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
  300. -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p tcp -m tcp --dport 80 -m comment --comment "!fw3: rpi80 (reflection)" -j DNAT --to-destination 192.168.1.3:80
  301. -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: rpi443 (reflection)" -j DNAT --to-destination 192.168.1.3:443
  302. -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p tcp -m tcp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j DNAT --to-destination 192.168.1.3:853
  303. -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p udp -m udp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j DNAT --to-destination 192.168.1.3:853
  304. -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
  305. -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
  306. -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
  307. -A zone_wan_prerouting -p tcp -m tcp --dport 80 -m comment --comment "!fw3: rpi80" -j DNAT --to-destination 192.168.1.3:80
  308. -A zone_wan_prerouting -p tcp -m tcp --dport 443 -m comment --comment "!fw3: rpi443" -j DNAT --to-destination 192.168.1.3:443
  309. -A zone_wan_prerouting -p tcp -m tcp --dport 853 -m comment --comment "!fw3: privatedns853" -j DNAT --to-destination 192.168.1.3:853
  310. -A zone_wan_prerouting -p udp -m udp --dport 853 -m comment --comment "!fw3: privatedns853" -j DNAT --to-destination 192.168.1.3:853
  311. COMMIT
  312. # Completed on Sun Sep 8 03:15:49 2019
  313. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:15:49 2019
  314. *mangle
  315. :PREROUTING ACCEPT [16467:9490353]
  316. :INPUT ACCEPT [961:127271]
  317. :FORWARD ACCEPT [13871:9066410]
  318. :OUTPUT ACCEPT [831:137222]
  319. :POSTROUTING ACCEPT [14692:9203072]
  320. -A FORWARD -o eth1.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
  321. COMMIT
  322. # Completed on Sun Sep 8 03:15:49 2019
  323. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:15:49 2019
  324. *filter
  325. :INPUT ACCEPT [0:0]
  326. :FORWARD DROP [0:0]
  327. :OUTPUT ACCEPT [0:0]
  328. :forwarding_lan_rule - [0:0]
  329. :forwarding_rule - [0:0]
  330. :forwarding_wan_rule - [0:0]
  331. :input_lan_rule - [0:0]
  332. root@OpenWrt:~#
  333. root@OpenWrt:~#
  334. root@OpenWrt:~#
  335. root@OpenWrt:~#
  336. root@OpenWrt:~#
  337. root@OpenWrt:~#
  338. root@OpenWrt:~#
  339. root@OpenWrt:~#
  340. root@OpenWrt:~# swconfig list; swconfig dev switch0 help; swconfig dev switch0 show
  341. ip a; ip r; Found: switch0 - 10.mvsw61xx
  342. ip ru; iptableswitch0: 10.mvsw61xx(MV88E6352), ports: 7 (cpu @ 5), vlans: 64
  343. --switch
  344. Attribute 1 (int): enable_vlan (Enable 802.1q VLAN support)
  345. Attribute 2 (none): apply (Activate changes in the hardware)
  346. Attribute 3 (none): reset (Reset the switch)
  347. --vlan
  348. Attribute 1 (int): port_based (Use port-based (non-802.1q) VLAN only)
  349. Attribute 2 (int): vid (Get/set VLAN ID)
  350. Attribute 3 (ports): ports (VLAN port mapping)
  351. --port
  352. Attribute 1 (string): mask (Port-based VLAN mask)
  353. s Attribute 2 (int): qmode (802.1q mode: 0=off/1=fallback/2=check/3=secure)
  354. Attribute 3 (int): pvid (Primary VLAN ID)
  355. Attribute 4 (unknown): link (Get port link information)
  356. -saveGlobal attributes:
  357. enable_vlan: 1
  358. Port 0:
  359. mask: 0x0000: (0)
  360. qmode: 3
  361. pvid: 1
  362. link: port:0 link:down
  363. Port 1:
  364. mask: 0x0000: (1)
  365. qmode: 3
  366. pvid: 1
  367. link: port:1 link:down
  368. Port 2:
  369. mask: 0x0000: (2)
  370. qmode: 3
  371. pvid: 1
  372. link: port:2 link:up speed:1000baseT full-duplex
  373. Port 3:
  374. mask: 0x0000: (3)
  375. qmode: 3
  376. pvid: 1
  377. link: port:3 link:up speed:1000baseT full-duplex
  378. Port 4:
  379. mask: 0x0000: (4)
  380. qmode: 3
  381. pvid: 2
  382. link: port:4 link:up speed:100baseT full-duplex
  383. Port 5:
  384. mask: 0x0000: (5)
  385. qmode: 3
  386. pvid: 0
  387. link: port:5 link:up speed:1000baseT full-duplex
  388. Port 6:
  389. mask: 0x0000: (6)
  390. qmode: 3
  391. pvid: 0
  392. link: port:6 link:up speed:1000baseT full-duplex
  393. VLAN 1:
  394. port_based: 0
  395. vid: 1
  396. ports: 0 1 2 3 5t
  397. VLAN 2:
  398. port_based: 0
  399. vid: 2
  400. ports: 4 6t
  401. root@OpenWrt:~# ip a; ip r; ip ru; iptables-save
  402. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
  403. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  404. inet 127.0.0.1/8 scope host lo
  405. valid_lft forever preferred_lft forever
  406. inet6 ::1/128 scope host
  407. valid_lft forever preferred_lft forever
  408. 2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 532
  409. link/ether 24:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  410. inet6 fe80::26f5:a2ff:fec4:7ad0/64 scope link
  411. valid_lft forever preferred_lft forever
  412. 3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 532
  413. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  414. inet6 fe80::24f5:a2ff:fec4:7ad0/64 scope link
  415. valid_lft forever preferred_lft forever
  416. 7: mlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  417. link/ether 24:f5:a2:c4:7a:d3 brd ff:ff:ff:ff:ff:ff
  418. 8: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  419. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  420. inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
  421. valid_lft forever preferred_lft forever
  422. inet6 fd55:f0a5:8ae9::1/60 scope global
  423. valid_lft forever preferred_lft forever
  424. inet6 fe80::24f5:a2ff:fec4:7ad0/64 scope link
  425. valid_lft forever preferred_lft forever
  426. 9: eth0.1@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP qlen 1000
  427. link/ether 26:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  428. 10: eth1.2@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  429. link/ether 24:f5:a2:c4:7a:d0 brd ff:ff:ff:ff:ff:ff
  430. inet6 fe80::26f5:a2ff:fec4:7ad0/64 scope link
  431. valid_lft forever preferred_lft forever
  432. 11: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br-lan state UP qlen 1000
  433. link/ether 24:f5:a2:c4:7a:d1 brd ff:ff:ff:ff:ff:ff
  434. inet6 fe80::26f5:a2ff:fec4:7ad1/64 scope link
  435. valid_lft forever preferred_lft forever
  436. 12: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br-lan state UP qlen 1000
  437. link/ether 24:f5:a2:c4:7a:d2 brd ff:ff:ff:ff:ff:ff
  438. inet6 fe80::26f5:a2ff:fec4:7ad2/64 scope link
  439. valid_lft forever preferred_lft forever
  440. 192.168.1.0/24 dev br-lan scope link src 192.168.1.1
  441. 0: from all lookup local
  442. 32766: from all lookup main
  443. 32767: from all lookup default
  444. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:16:47 2019
  445. *nat
  446. :PREROUTING ACCEPT [1948:352466]
  447. :INPUT ACCEPT [65:4387]
  448. :OUTPUT ACCEPT [239:15907]
  449. :POSTROUTING ACCEPT [4:272]
  450. :postrouting_lan_rule - [0:0]
  451. :postrouting_rule - [0:0]
  452. :postrouting_wan_rule - [0:0]
  453. :prerouting_lan_rule - [0:0]
  454. :prerouting_rule - [0:0]
  455. :prerouting_wan_rule - [0:0]
  456. :zone_lan_postrouting - [0:0]
  457. :zone_lan_prerouting - [0:0]
  458. :zone_wan_postrouting - [0:0]
  459. :zone_wan_prerouting - [0:0]
  460. -A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
  461. -A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
  462. -A PREROUTING -i eth1.2 -m comment --comment "!fw3" -j zone_wan_prerouting
  463. -A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
  464. -A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
  465. -A POSTROUTING -o eth1.2 -m comment --comment "!fw3" -j zone_wan_postrouting
  466. -A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
  467. -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 80 -m comment --comment "!fw3: rpi80 (reflection)" -j SNAT --to-source 192.168.1.1
  468. -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: rpi443 (reflection)" -j SNAT --to-source 192.168.1.1
  469. -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p tcp -m tcp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j SNAT --to-source 192.168.1.1
  470. -A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.3/32 -p udp -m udp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j SNAT --to-source 192.168.1.1
  471. -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
  472. -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p tcp -m tcp --dport 80 -m comment --comment "!fw3: rpi80 (reflection)" -j DNAT --to-destination 192.168.1.3:80
  473. -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: rpi443 (reflection)" -j DNAT --to-destination 192.168.1.3:443
  474. -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p tcp -m tcp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j DNAT --to-destination 192.168.1.3:853
  475. -A zone_lan_prerouting -s 192.168.1.0/24 -d 162.211.151.92/32 -p udp -m udp --dport 853 -m comment --comment "!fw3: privatedns853 (reflection)" -j DNAT --to-destination 192.168.1.3:853
  476. -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
  477. -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
  478. -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
  479. -A zone_wan_prerouting -p tcp -m tcp --dport 80 -m comment --comment "!fw3: rpi80" -j DNAT --to-destination 192.168.1.3:80
  480. -A zone_wan_prerouting -p tcp -m tcp --dport 443 -m comment --comment "!fw3: rpi443" -j DNAT --to-destination 192.168.1.3:443
  481. -A zone_wan_prerouting -p tcp -m tcp --dport 853 -m comment --comment "!fw3: privatedns853" -j DNAT --to-destination 192.168.1.3:853
  482. -A zone_wan_prerouting -p udp -m udp --dport 853 -m comment --comment "!fw3: privatedns853" -j DNAT --to-destination 192.168.1.3:853
  483. COMMIT
  484. # Completed on Sun Sep 8 03:16:47 2019
  485. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:16:47 2019
  486. *mangle
  487. :PREROUTING ACCEPT [19909:10287091]
  488. :INPUT ACCEPT [1761:231165]
  489. :FORWARD ACCEPT [15025:9482411]
  490. :OUTPUT ACCEPT [1420:351258]
  491. :POSTROUTING ACCEPT [16433:9831957]
  492. -A FORWARD -o eth1.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
  493. COMMIT
  494. # Completed on Sun Sep 8 03:16:47 2019
  495. # Generated by iptables-save v1.6.2 on Sun Sep 8 03:16:47 2019
  496. *filter
  497. :INPUT ACCEPT [0:0]
  498. :FORWARD DROP [0:0]
  499. :OUTPUT ACCEPT [0:0]
  500. :forwarding_lan_rule - [0:0]
  501. :forwarding_rule - [0:0]
  502. :forwarding_wan_rule - [0:0]
  503. :input_lan_rule - [0:0]
  504. :input_rule - [0:0]
  505. :input_wan_rule - [0:0]
  506. :output_lan_rule - [0:0]
  507. :output_rule - [0:0]
  508. :output_wan_rule - [0:0]
  509. :reject - [0:0]
  510. :syn_flood - [0:0]
  511. :zone_lan_dest_ACCEPT - [0:0]
  512. :zone_lan_forward - [0:0]
  513. :zone_lan_input - [0:0]
  514. :zone_lan_output - [0:0]
  515. :zone_lan_src_ACCEPT - [0:0]
  516. :zone_wan_dest_ACCEPT - [0:0]
  517. :zone_wan_dest_REJECT - [0:0]
  518. :zone_wan_forward - [0:0]
  519. :zone_wan_input - [0:0]
  520. :zone_wan_output - [0:0]
  521. :zone_wan_src_REJECT - [0:0]
  522. -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
  523. -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
  524. -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
  525. -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
  526. -A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
  527. -A INPUT -i eth1.2 -m comment --comment "!fw3" -j zone_wan_input
  528. -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
  529. -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
  530. -A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
  531. -A FORWARD -i eth1.2 -m comment --comment "!fw3" -j zone_wan_forward
  532. -A FORWARD -m comment --comment "!fw3" -j reject
  533. -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
  534. -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
  535. -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
  536. -A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
  537. -A OUTPUT -o eth1.2 -m comment --comment "!fw3" -j zone_wan_output
  538. -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
  539. -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
  540. -A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
  541. -A syn_flood -m comment --comment "!fw3" -j DROP
  542. -A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
  543. -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
  544. -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
  545. -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
  546. -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
  547. -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
  548. -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
  549. -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
  550. -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
  551. -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
  552. -A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
  553. -A zone_wan_dest_ACCEPT -o eth1.2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
  554. -A zone_wan_dest_ACCEPT -o eth1.2 -m comment --comment "!fw3" -j ACCEPT
  555. -A zone_wan_dest_REJECT -o eth1.2 -m comment --comment "!fw3" -j reject
  556. -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
  557. -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
  558. -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
  559. -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
  560. -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
  561. -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
  562. -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
  563. -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
  564. -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
  565. -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
  566. -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
  567. -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
  568. -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
  569. -A zone_wan_src_REJECT -i eth1.2 -m comment --comment "!fw3" -j reject
  570. COMMIT
  571. # Completed on Sun Sep 8 03:16:47 2019
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!