Script started on Sat 12 Jan 2013 01:23:21 PM PST
bash-4.1# shorewall trace check -T
Checking...
Processing /etc/shorewall/params ...
Params:
export CVS_RSH="ssh"
export G_BROKEN_FILENAMES="1"
export HISTCONTROL="ignoredups"
export HISTSIZE="1000"
export HOME="/"
export HOSTNAME="caesar.cac.washington.edu"
export H_ALL_EXTERNAL="67.207.137.81,96.126.120.156,96.126.120.152,67.207.135.11,173.255.199.248,209.20.67.94,209.20.67.95,173.255.193.110"
export H_CLONE5="96.126.120.152"
export H_EM1="67.207.135.11,173.255.199.248"
export H_UWPLONE1="209.20.67.94"
export H_UWPLONE2="209.20.67.95,173.255.193.110"
export H_VMAIL6="67.207.137.81,96.126.120.156"
export LANG="en_US.UTF-8"
export LESSOPEN="|/usr/bin/lesspipe.sh %s"
export LOGNAME="root"
export LS_COLORS="rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=01;05;37;41:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.dz=01;31:*.gz=01;31:*.lz=01;31:*.xz=01;31:*.bz2=01;31:*.tbz=01;31:*.tbz2=01;31:*.bz=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.rar=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.axv=01;35:*.anx=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=01;36:*.au=01;36:*.flac=01;36:*.mid=01;36:*.midi=01;36:*.mka=01;36:*.mp3=01;36:*.mpc=01;36:*.ogg=01;36:*.ra=01;36:*.wav=01;36:*.axa=01;36:*.oga=01;36:*.spx=01;36:*.xspf=01;36:"
export MAIL="/var/spool/mail/root"
export N_ALL_BACKDOOR="198.48.64.0/19,172.16.141.32/27,172.16.141.128/27"
export N_ALL_UW_AFFILIATED="140.142.0.0/16,128.95.0.0/16,128.208.0.0/16,69.91.128.0/17,173.250.128.0/17,108.179.128.0/18,172.16.0.0/12,10.0.0.0/8,198.48.64.0/19,172.16.141.32/27,172.16.141.128/27,209.124.185.0/26,216.186.0.0/17,66.96.64.0/20,68.179.192.0/19,152.157.181.16/30,209.124.176.0/20,65.61.96.0/19,67.207.137.81,96.126.120.156,96.126.120.152,67.207.135.11,173.255.199.248,209.20.67.94,209.20.67.95,173.255.193.110"
export N_GIGAPOP="209.124.176.0/20"
export N_GPFS_BACKDOOR="172.16.141.32/27,172.16.141.128/27"
export N_K20="216.186.0.0/17,66.96.64.0/20,68.179.192.0/19,152.157.181.16/30"
export N_LLIX="66.45.163.112/28"
export N_MYUW="209.124.185.0/26"
export N_TIERPOINT="65.61.96.0/19"
export N_UWIT_BACKDOOR="198.48.64.0/19"
export N_UW_PRIVATE="172.16.0.0/12,10.0.0.0/8"
export N_UW_PUBLIC="140.142.0.0/16,128.95.0.0/16,128.208.0.0/16,69.91.128.0/17,173.250.128.0/17,108.179.128.0/18"
export OLDPWD
export PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin"
export PERL5LIB="/usr/share/perl5/vendor_perl"
export PWD="/usr/share/perl5/vendor_perl/Shorewall"
export QTDIR="/usr/lib64/qt-3.3"
export QTINC="/usr/lib64/qt-3.3/include"
export QTLIB="/usr/lib64/qt-3.3/lib"
export SHELL="/bin/bash"
export SHLVL="4"
export SSH_CLIENT="140.142.12.69 39530 22"
export SSH_CONNECTION="140.142.12.69 39530 172.22.12.140 22"
export SSH_TTY="/dev/pts/2"
export TERM="screen"
export USER="root"
PARAMS:
   SSH_CLIENT='140.142.12.69 39530 22'
   QTINC='/usr/lib64/qt-3.3/include'
   N_GPFS_BACKDOOR='172.16.141.32/27,172.16.141.128/27'
   CVS_RSH='ssh'
   LESSOPEN='|/usr/bin/lesspipe.sh %s'
   PWD='/usr/share/perl5/vendor_perl/Shorewall'
   N_LLIX='66.45.163.112/28'
   N_GIGAPOP='209.124.176.0/20'
   USER='root'
   LANG='en_US.UTF-8'
   N_UW_PRIVATE='172.16.0.0/12,10.0.0.0/8'
   G_BROKEN_FILENAMES='1'
   LOGNAME='root'
   SHLVL='4'
   QTLIB='/usr/lib64/qt-3.3/lib'
   PERL5LIB='/usr/share/perl5/vendor_perl'
   PATH='/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin'
   TERM='screen'
   HISTSIZE='1000'
   N_UW_PUBLIC='140.142.0.0/16,128.95.0.0/16,128.208.0.0/16,69.91.128.0/17,173.250.128.0/17,108.179.128.0/18'
   SSH_TTY='/dev/pts/2'
   N_ALL_UW_AFFILIATED='140.142.0.0/16,128.95.0.0/16,128.208.0.0/16,69.91.128.0/17,173.250.128.0/17,108.179.128.0/18,172.16.0.0/12,10.0.0.0/8,198.48.64.0/19,172.16.141.32/27,172.16.141.128/27,209.124.185.0/26,216.186.0.0/17,66.96.64.0/20,68.179.192.0/19,152.157.181.16/30,209.124.176.0/20,65.61.96.0/19,67.207.137.81,96.126.120.156,96.126.120.152,67.207.135.11,173.255.199.248,209.20.67.94,209.20.67.95,173.255.193.110'
   HOME='/'
   SSH_CONNECTION='140.142.12.69 39530 172.22.12.140 22'
   N_K20='216.186.0.0/17,66.96.64.0/20,68.179.192.0/19,152.157.181.16/30'
   H_VMAIL6='67.207.137.81,96.126.120.156'
   H_UWPLONE2='209.20.67.95,173.255.193.110'
   H_UWPLONE1='209.20.67.94'
   MAIL='/var/spool/mail/root'
   QTDIR='/usr/lib64/qt-3.3'
   N_MYUW='209.124.185.0/26'
   H_CLONE5='96.126.120.152'
   H_ALL_EXTERNAL='67.207.137.81,96.126.120.156,96.126.120.152,67.207.135.11,173.255.199.248,209.20.67.94,209.20.67.95,173.255.193.110'
   HOSTNAME='caesar.cac.washington.edu'
   H_EM1='67.207.135.11,173.255.199.248'
   N_ALL_BACKDOOR='198.48.64.0/19,172.16.141.32/27,172.16.141.128/27'
   OLDPWD=''
   N_UWIT_BACKDOOR='198.48.64.0/19'
   LS_COLORS='rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=01;05;37;41:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.dz=01;31:*.gz=01;31:*.lz=01;31:*.xz=01;31:*.bz2=01;31:*.tbz=01;31:*.tbz2=01;31:*.bz=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.rar=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.axv=01;35:*.anx=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=01;36:*.au=01;36:*.flac=01;36:*.mid=01;36:*.midi=01;36:*.mka=01;36:*.mp3=01;36:*.mpc=01;36:*.ogg=01;36:*.ra=01;36:*.wav=01;36:*.axa=01;36:*.oga=01;36:*.spx=01;36:*.xspf=01;36:'
   SHELL='/bin/bash'
   N_TIERPOINT='65.61.96.0/19'
   HISTCONTROL='ignoredups'
Processing /etc/shorewall/shorewall.conf...
IN===> STARTUP_ENABLED=Yes
IN===> VERBOSITY=1
IN===> SHOREWALL_COMPILER=perl
IN===> LOGFILE=/var/log/syslog
IN===> STARTUP_LOG=/var/log/shorewall-init.log
IN===> LOG_VERBOSITY=
IN===> LOGFORMAT="Shorewall:%s:%s:"
IN===> LOGTAGONLY=No
IN===> LOGRATE=
IN===> LOGBURST=
IN===> LOGALLNEW=
IN===> BLACKLIST_LOGLEVEL=
IN===> MACLIST_LOG_LEVEL=
IN===> TCP_FLAGS_LOG_LEVEL=
IN===> RFC1918_LOG_LEVEL=
IN===> SMURF_LOG_LEVEL=
IN===> LOG_MARTIANS=No
IN===> IPTABLES=
IN===> PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
IN===> SHOREWALL_SHELL=/bin/sh
IN===> SUBSYSLOCK=/var/lock/subsys/shorewall
IN===> MODULESDIR=
IN===> CONFIG_PATH=/etc/shorewall:/usr/share/shorewall
IN===> RESTOREFILE=
IN===> IPSECFILE=zones
IN===> LOCKFILE=
IN===> DROP_DEFAULT="Drop"
IN===> REJECT_DEFAULT="Reject"
IN===> ACCEPT_DEFAULT="none"
IN===> QUEUE_DEFAULT="none"
IN===> NFQUEUE_DEFAULT="none"
IN===> RSH_COMMAND='ssh ${root}@${system} ${command}'
IN===> RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
IN===> IP_FORWARDING=Keep
IN===> ADD_IP_ALIASES=Yes
IN===> ADD_SNAT_ALIASES=No
IN===> RETAIN_ALIASES=No
IN===> TC_ENABLED=Internal
IN===> TC_EXPERT=No
IN===> CLEAR_TC=Yes
IN===> COMPLETE=Yes
IN===> MARK_IN_FORWARD_CHAIN=No
IN===> CLAMPMSS=No
IN===> ROUTE_FILTER=No
IN===> DETECT_DNAT_IPADDRS=No
IN===> MUTEX_TIMEOUT=60
IN===> ADMINISABSENTMINDED=Yes
IN===> BLACKLISTNEWONLY=Yes
IN===> DELAYBLACKLISTLOAD=No
IN===> MODULE_SUFFIX=
IN===> DISABLE_IPV6=No
IN===> BRIDGING=No
IN===> DYNAMIC_ZONES=No
IN===> PKTTYPE=Yes
IN===> RFC1918_STRICT=No
IN===> MACLIST_TABLE=filter
IN===> MACLIST_TTL=
IN===> SAVE_IPSETS=No
IN===> MAPOLDACTIONS=No
IN===> FASTACCEPT=Yes
IN===> IMPLICIT_CONTINUE=No
IN===> HIGH_ROUTE_MARKS=No
IN===> USE_ACTIONS=Yes
IN===> OPTIMIZE=1
IN===> EXPAND_POLICIES=Yes
IN===> KEEP_RT_TABLES=No
IN===> DELETE_THEN_ADD=Yes
IN===> MULTICAST=No
IN===> DONT_LOAD=
IN===> AUTO_COMMENT=Yes
IN===> MANGLE_ENABLED=Yes
IN===> USE_DEFAULT_RT=No
IN===> RESTORE_DEFAULT_ROUTE=Yes
IN===> FAST_STOP=No
IN===> BLACKLIST_DISPOSITION=DROP
IN===> MACLIST_DISPOSITION=REJECT
IN===> TCP_FLAGS_DISPOSITION=DROP
Loading Modules...
IN===> loadmodule nfnetlink
IN===> loadmodule x_tables
IN===> loadmodule ip_tables
IN===> loadmodule iptable_filter
IN===> loadmodule iptable_mangle
IN===> loadmodule ip_conntrack
IN===> loadmodule nf_conntrack
IN===> loadmodule nf_conntrack_ipv4
IN===> loadmodule iptable_nat
IN===> loadmodule iptable_raw
IN===> loadmodule xt_state
IN===> loadmodule xt_tcpudp
IN===> loadmodule ipt_LOG
IN===> loadmodule xt_AUDIT
IN===> loadmodule xt_CLASSIFY
IN===> loadmodule xt_connmark
IN===> loadmodule xt_CONNMARK
IN===> loadmodule xt_conntrack
IN===> loadmodule xt_dccp
IN===> loadmodule xt_dscp
IN===> loadmodule xt_DSCP
IN===> loadmodule xt_hashlimit
IN===> loadmodule xt_helper
IN===> loadmodule xt_ipp2p
IN===> loadmodule xt_iprange
IN===> loadmodule xt_length
IN===> loadmodule xt_limit
IN===> loadmodule xt_mac
IN===> loadmodule xt_mark
IN===> loadmodule xt_MARK
IN===> loadmodule xt_multiport
IN===> loadmodule xt_NFLOG
IN===> loadmodule xt_NFQUEUE
IN===> loadmodule xt_owner
IN===> loadmodule xt_physdev
IN===> loadmodule xt_pkttype
IN===> loadmodule xt_tcpmss
IN===> loadmodule xt_IPMARK
IN===> loadmodule xt_TPROXY
IN===> loadmodule xt_condition
IN===> loadmodule xt_geoip
IN===> loadmodule xt_ipp2p
IN===> loadmodule xt_LOGMARK
IN===> loadmodule xt_RAWNAT
IN===> loadmodule ip_conntrack_amanda
IN===> loadmodule ip_conntrack_ftp
IN===> loadmodule ip_conntrack_h323
IN===> loadmodule ip_conntrack_irc
IN===> loadmodule ip_conntrack_netbios_ns
IN===> loadmodule ip_conntrack_pptp
IN===> loadmodule ip_conntrack_sip
IN===> loadmodule ip_conntrack_tftp
IN===> loadmodule ip_nat_amanda
IN===> loadmodule ip_nat_ftp
IN===> loadmodule ip_nat_h323
IN===> loadmodule ip_nat_irc
IN===> loadmodule ip_nat_pptp
IN===> loadmodule ip_nat_sip
IN===> loadmodule ip_nat_snmp_basic
IN===> loadmodule ip_nat_tftp
IN===> loadmodule ip_set
IN===> loadmodule ip_set_iphash
IN===> loadmodule ip_set_ipmap
IN===> loadmodule ip_set_macipmap
IN===> loadmodule ip_set_portmap
IN===> loadmodule nf_conntrack_ftp
IN===> loadmodule nf_conntrack_h323
IN===> loadmodule nf_conntrack_irc
IN===> loadmodule nf_conntrack_netbios_ns
IN===> loadmodule nf_conntrack_netlink
IN===> loadmodule nf_conntrack_pptp
IN===> loadmodule nf_conntrack_proto_gre
IN===> loadmodule nf_conntrack_proto_sctp
IN===> loadmodule nf_conntrack_proto_udplite
IN===> loadmodule nf_conntrack_sip         sip_direct_media=0
IN===> loadmodule nf_conntrack_tftp
IN===> loadmodule nf_conntrack_sane
IN===> loadmodule nf_nat_amanda
IN===> loadmodule nf_nat_ftp
IN===> loadmodule nf_nat_h323
IN===> loadmodule nf_nat_irc
IN===> loadmodule nf_nat
IN===> loadmodule nf_nat_pptp
IN===> loadmodule nf_nat_proto_gre
IN===> loadmodule nf_nat_sip
IN===> loadmodule nf_nat_snmp_basic
IN===> loadmodule nf_nat_tftp
IN===> loadmodule xt_set
IN===> loadmodule ip_set
IN===> loadmodule ip_set_iphash
IN===> loadmodule ip_set_ipmap
IN===> loadmodule ip_set_ipporthash
IN===> loadmodule ip_set_iptree
IN===> loadmodule ip_set_iptreemap
IN===> loadmodule ip_set_macipmap
IN===> loadmodule ip_set_nethash
IN===> loadmodule ip_set_portmap
IN===> loadmodule ipt_SET
IN===> loadmodule ipt_set
IN===> loadmodule sch_sfq
IN===> loadmodule sch_ingress
IN===> loadmodule sch_hfsc
IN===> loadmodule sch_htb
IN===> loadmodule sch_prio
IN===> loadmodule sch_tbf
IN===> loadmodule cls_u32
IN===> loadmodule cls_fw
IN===> loadmodule cls_flow
IN===> loadmodule cls_basic
IN===> loadmodule act_police
IN===> loadmodule ipt_addrtype
IN===> loadmodule ipt_ah
IN===> loadmodule ipt_CLASSIFY
IN===> loadmodule ipt_CLUSTERIP
IN===> loadmodule ipt_comment
IN===> loadmodule ipt_connmark
IN===> loadmodule ipt_CONNMARK
IN===> loadmodule ipt_conntrack
IN===> loadmodule ipt_dscp
IN===> loadmodule ipt_DSCP
IN===> loadmodule ipt_ecn
IN===> loadmodule ipt_ECN
IN===> loadmodule ipt_esp
IN===> loadmodule ipt_hashlimit
IN===> loadmodule ipt_helper
IN===> loadmodule ipt_ipp2p
IN===> loadmodule ipt_iprange
IN===> loadmodule ipt_length
IN===> loadmodule ipt_limit
IN===> loadmodule ipt_LOG
IN===> loadmodule ipt_mac
IN===> loadmodule ipt_mark
IN===> loadmodule ipt_MARK
IN===> loadmodule ipt_MASQUERADE
IN===> loadmodule ipt_multiport
IN===> loadmodule ipt_NETMAP
IN===> loadmodule ipt_NOTRACK
IN===> loadmodule ipt_owner
IN===> loadmodule ipt_physdev
IN===> loadmodule ipt_pkttype
IN===> loadmodule ipt_policy
IN===> loadmodule ipt_realm
IN===> loadmodule ipt_recent
IN===> loadmodule ipt_REDIRECT
IN===> loadmodule ipt_REJECT
IN===> loadmodule ipt_SAME
IN===> loadmodule ipt_sctp
IN===> loadmodule ipt_set
IN===> loadmodule ipt_state
IN===> loadmodule ipt_tcpmss
IN===> loadmodule ipt_TCPMSS
IN===> loadmodule ipt_tos
IN===> loadmodule ipt_TOS
IN===> loadmodule ipt_ttl
IN===> loadmodule ipt_TTL
IN===> loadmodule ipt_ULOG
SYS----> /sbin/iptables -N fooX18277
SYS----> /sbin/iptables -N foo1X18277
SYS----> /sbin/iptables -A fooX18277 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -p tcp -m multiport --dports 21,22 -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -p tcp -m multiport --sports 60 -m multiport --dports 99 -j ACCEPT
SYS----> /sbin/iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
SYS----> /sbin/iptables -t nat -N fooX18277
SYS----> /sbin/iptables -t nat -A fooX18277 -j SNAT --to-source 1.2.3.4 --persistent
SYS----> /sbin/iptables -t nat -F fooX18277
SYS----> /sbin/iptables -t nat -X fooX18277
SYS----> /sbin/iptables -t mangle -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
tcpre      all  --  0.0.0.0/0            0.0.0.0/0           

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
tcin       all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
MARK       all  --  0.0.0.0/0            0.0.0.0/0           MARK and 0xffffff00 
tcfor      all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
tcout      all  --  0.0.0.0/0            0.0.0.0/0           

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
tcpost     all  --  0.0.0.0/0            0.0.0.0/0           

Chain tcfor (1 references)
target     prot opt source               destination         

Chain tcin (1 references)
target     prot opt source               destination         

Chain tcout (1 references)
target     prot opt source               destination         

Chain tcpost (1 references)
target     prot opt source               destination         

Chain tcpre (1 references)
target     prot opt source               destination         
SYS----> /sbin/iptables -A fooX18277 -m conntrack --ctorigdst 192.168.1.1 -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -m conntrack -p tcp --ctorigdstport 22 -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -m conntrack ! --ctorigdst 1.2.3.4
SYS----> /sbin/iptables -A fooX18277 -p tcp -m multiport --dports 21,22 -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -p tcp -m multiport --dports 21:22 -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -m policy --pol ipsec --mode tunnel --dir in -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -m physdev --physdev-in eth0 -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -m physdev --physdev-is-bridged --physdev-in eth0 --physdev-out eth1 -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -m iprange --src-range 192.168.1.5-192.168.1.124 -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -m recent --update -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -m owner --uid-owner 0 -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -m owner --uid-owner root
 -j ACCEPT
sh: line 1: -j: command not found
SYS----> /sbin/iptables -A fooX18277 -m connmark --mark 2  -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -m connmark --mark 2/0xFF -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -p tcp -m ipp2p --edk -j ACCEPT
iptables v1.4.7: Couldn't load match `ipp2p':/lib64/xtables/libipt_ipp2p.so: cannot open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
SYS----> /sbin/iptables -A fooX18277 -m length --length 10:20 -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -j REJECT --reject-with icmp-host-prohibited
SYS----> /sbin/iptables -A fooX18277 -j ACCEPT -m comment --comment "This is a comment" 
SYS----> /sbin/iptables -A fooX18277 -m hashlimit --hashlimit 3/min --hashlimit-burst 3 --hashlimit-name fooX18277 --hashlimit-mode srcip -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -m hashlimit --hashlimit-upto 3/min --hashlimit-burst 3 --hashlimit-name fooX18277 --hashlimit-mode srcip -j ACCEPT
SYS----> /sbin/iptables -t mangle -A fooX18277 -j MARK --set-mark 1
SYS----> /sbin/iptables -t mangle -A fooX18277 -j MARK --and-mark 0xFF
SYS----> /sbin/iptables -t mangle -A fooX18277 -j MARK --set-mark 1/0xFF
SYS----> /sbin/iptables -t mangle -A fooX18277 -j CONNMARK --save-mark
SYS----> /sbin/iptables -t mangle -A fooX18277 -j CONNMARK --save-mark --mask 0xFF
SYS----> /sbin/iptables -t mangle -A fooX18277 -j CLASSIFY --set-class 1:1
SYS----> /sbin/iptables -t mangle -A fooX18277 -j IPMARK --addr src
iptables v1.4.7: unknown option `--addr'
Try `iptables -h' or 'iptables --help' for more information.
SYS----> /sbin/iptables -t mangle -A fooX18277 -p tcp -j TPROXY --on-port 0 --tproxy-mark 1
SYS----> /sbin/iptables -t mangle -L FORWARD -n
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
MARK       all  --  0.0.0.0/0            0.0.0.0/0           MARK and 0xffffff00 
tcfor      all  --  0.0.0.0/0            0.0.0.0/0           
SYS----> /sbin/iptables -t raw -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
net_notrk  all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
host_notrk  all  --  0.0.0.0/0            0.0.0.0/0           

Chain host_notrk (1 references)
target     prot opt source               destination         
NOTRACK    udp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 67,68 

Chain net_notrk (1 references)
target     prot opt source               destination         
NOTRACK    udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:53 
NOTRACK    udp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 67,68 
SYS----> /sbin/iptables -t rawpost -L -n
iptables v1.4.7: can't initialize iptables table `rawpost': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
SYS----> /sbin/iptables -A fooX18277 -m pkttype --pkt-type broadcast -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -m addrtype --src-type BROADCAST -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1000:1500 -j ACCEPT
SYS----> /sbin/iptables -A fooX18277 -j NFQUEUE --queue-num 4
SYS----> /sbin/iptables -A fooX18277 -m realm --realm 1
SYS----> /sbin/iptables -A fooX18277 -m connlimit --connlimit-above 8
SYS----> /sbin/iptables -A fooX18277 -m time --timestart 11:00
SYS----> /sbin/iptables -A fooX18277 -g foo1X18277
SYS----> /sbin/iptables -A fooX18277 -j LOG
SYS----> /sbin/iptables -A fooX18277 -j ULOG
SYS----> /sbin/iptables -A fooX18277 -j NFLOG
SYS----> /sbin/iptables -A fooX18277 -j LOGMARK
iptables v1.4.7: Couldn't load target `LOGMARK':/lib64/xtables/libipt_LOGMARK.so: cannot open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
SYS----> /sbin/iptables -A fooX18277 -j MARK --set-mark 5
SYS----> /sbin/iptables -A fooX18277 -j ACCOUNT --addr 192.168.1.0/29 --tname fooX18277
iptables v1.4.7: unknown option `--addr'
Try `iptables -h' or 'iptables --help' for more information.
SYS----> /sbin/iptables -A fooX18277 -j AUDIT --type drop
SYS----> /sbin/iptables -A fooX18277 -m condition --condition foo
iptables v1.4.7: Couldn't load match `condition':/lib64/xtables/libipt_condition.so: cannot open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
SYS----> /sbin/iptables -S INPUT
-P INPUT DROP
-A INPUT -m conntrack --ctstate INVALID,NEW,UNTRACKED -j dynamic 
-A INPUT -i lo -j ACCEPT 
-A INPUT -j enet_in 
-A INPUT -j Drop 
-A INPUT -j LOG --log-prefix "Shorewall:INPUT:DROP:" --log-level 6 
-A INPUT -j DROP 
SYS----> /sbin/iptables -t raw -N fooX18277
SYS----> /sbin/iptables -t raw -A fooX18277 -j CT --notrack
iptables v1.4.7: unknown option `--notrack'
Try `iptables -h' or 'iptables --help' for more information.
SYS----> /sbin/iptables -A fooX18277 -m statistic --mode nth --every 2 --packet 1
SYS----> /sbin/iptables -t mangle -A fooX18277 -j IMQ --todev 0
iptables v1.4.7: unknown option `--todev'
Try `iptables -h' or 'iptables --help' for more information.
SYS----> /sbin/iptables -t mangle -A fooX18277 -m dscp --dscp 0
SYS----> /sbin/iptables -t mangle -A fooX18277 -j DSCP --set-dscp 0
SYS----> /sbin/iptables -A fooX18277 -m geoip --src-cc US
iptables v1.4.7: Couldn't load match `geoip':/lib64/xtables/libipt_geoip.so: cannot open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
SYS----> /sbin/iptables -t mangle -A fooX18277 -m rpfilter
iptables v1.4.7: Couldn't load match `rpfilter':/lib64/xtables/libipt_rpfilter.so: cannot open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
SYS----> nfacct add fooX18277
Can't exec "nfacct": No such file or directory at /usr/share/perl5/vendor_perl/Shorewall/Config.pm line 3371.
SYS----> /sbin/iptables -t mangle -A fooX18277 -j CHECKSUM --checksum-fill
SYS----> /sbin/iptables -A fooX18277 -p tcp --dport 21 -m helper --helper ftp
SYS----> /sbin/iptables -F fooX18277
SYS----> /sbin/iptables -X fooX18277
SYS----> /sbin/iptables -F foo1X18277
SYS----> /sbin/iptables -X foo1X18277
SYS----> /sbin/iptables -t mangle -F fooX18277
SYS----> /sbin/iptables -t mangle -X fooX18277
SYS----> /sbin/iptables -t nat -F fooX18277
iptables: No chain/target/match by that name.
SYS----> /sbin/iptables -t nat -X fooX18277
iptables: No chain/target/match by that name.
SYS----> /sbin/iptables -t raw -F fooX18277
SYS----> /sbin/iptables -t raw -X fooX18277
                NF-(N)-> raw:OUTPUT             
                NF-(N)-> raw:PREROUTING         
                NF-(N)-> rawpost:POSTROUTING    
                NF-(N)-> filter:INPUT           
                NF-(N)-> filter:OUTPUT          
                NF-(N)-> filter:FORWARD         
                NF-(N)-> nat:PREROUTING         
                NF-(N)-> nat:POSTROUTING        
                NF-(N)-> nat:OUTPUT             
                NF-(N)-> mangle:PREROUTING      
                NF-(N)-> mangle:INPUT           
                NF-(N)-> mangle:OUTPUT          
                NF-(N)-> mangle:FORWARD         
                NF-(N)-> mangle:POSTROUTING     
                NF-(N)-> filter:reject          
Checking /etc/shorewall/zones...
IN===> host	firewall
IN===> uw	ipv4
IN===> net	ipv4
CD===> ?FORMAT 2
Checking /etc/shorewall/interfaces...
IN===> -	enet		physical=+
SYS----> brctl show | tail -n+2 | grep -q '^+[[:space:]]'
Checking /etc/shorewall/hosts...
IN===> net	enet:0.0.0.0/0
IN===> uw	enet:140.142.0.0/16,128.95.0.0/16,128.208.0.0/16,69.91.128.0/17,173.250.128.0/17,108.179.128.0/18,172.16.0.0/12,10.0.0.0/8,198.48.64.0/19,172.16.141.32/27,172.16.141.128/27,209.124.185.0/26,216.186.0.0/17,66.96.64.0/20,68.179.192.0/19,152.157.181.16/30,209.124.176.0/20,65.61.96.0/19,67.207.137.81,96.126.120.156,96.126.120.152,67.207.135.11,173.255.199.248,209.20.67.94,209.20.67.95,173.255.193.110
Determining Hosts in Zones...
Locating Action Files...
IN===> A_Drop
IN===> A_Reject
IN===> Broadcast  noinline
IN===> Drop
IN===> DropSmurfs noinline
IN===> Invalid    noinline
IN===> NotSyn     noinline
IN===> Reject
IN===> RST	   noinline
IN===> TCPFlags   noinline
IN===> AllowNFS
                NF-(N)-> filter:Drop            
                NF-(!O1)-> filter:Drop          
Checking /usr/share/shorewall/action.Drop for chain Drop...
CD===> ?FORMAT 2
IN===> use Shorewall::Config;
IN===> 
IN===> my ( $p1, $p2, $p3 , $p4, $p5 ) = get_action_params( 5 );
IN===> 
IN===> if ( defined $p1 ) {
IN===>     if ( $p1 eq 'audit' ) {
IN===> 	set_action_param( 2, 'A_REJECT')   unless supplied $p2;
IN===> 	set_action_param( 3, 'A_DROP')     unless supplied $p3;
IN===> 	set_action_param( 4, 'A_ACCEPT' )  unless supplied $p4;
IN===> 	set_action_param( 5, 'A_DROP' )    unless supplied $p5;
IN===>     } else {
IN===> 	fatal_error "Invalid value ($p1) for first Drop parameter" if supplied $p1;
IN===>     }
IN===> }
IN===> 
IN===> 1;
IN===> 
IN===> ?END PERL;
IN===> DEFAULTS -,REJECT,DROP,ACCEPT,DROP
IN===> COUNT
                NF-(A)-> filter:Drop:1          -A Drop 
IN===> Auth(REJECT)
IN===> PARAM	-	-	tcp	113
                NF-(A)-> filter:Drop:2          -A Drop -p 6 --dport 113 -j reject
IN===> Broadcast(DROP,-)
                NF-(N)-> filter:Broadcast       
                NF-(!O1)-> filter:Broadcast     
Checking /usr/share/shorewall/action.Broadcast for chain Broadcast...
CD===> ?FORMAT 2
IN===> DEFAULTS DROP,-
IN===> 
IN===> use Shorewall::IPAddrs;
IN===> use Shorewall::Config;
IN===> use Shorewall::Chains;
IN===> 
IN===> my ( $action, $audit ) = get_action_params( 2 );
IN===> 
IN===> fatal_error "Invalid parameter ($audit) to action Broadcast"   if supplied $audit && $audit ne 'audit';
IN===> fatal_error "Invalid parameter ($action) to action Broadcast"  unless $action =~ /^(?:ACCEPT|DROP|REJECT)$/;
IN===> 
IN===> my $chainref           = get_action_chain;
IN===> 
IN===> my ( $level, $tag )    = get_action_logging;
IN===> my $target             = require_audit ( $action , $audit );
IN===> 
IN===> if ( have_capability( 'ADDRTYPE' ) ) {
IN===>     if ( $level ne '' ) {
IN===> 	log_rule_limit $level, $chainref, 'dropBcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type BROADCAST ';
IN===> 	log_rule_limit $level, $chainref, 'dropBcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type MULTICAST ';
IN===> 	log_rule_limit $level, $chainref, 'dropBcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type ANYCAST ';
IN===>     }
IN===> 
IN===>     add_jump $chainref, $target, 0, '-m addrtype --dst-type BROADCAST ';
IN===>     add_jump $chainref, $target, 0, '-m addrtype --dst-type MULTICAST ';
IN===>     add_jump $chainref, $target, 0, '-m addrtype --dst-type ANYCAST ';
IN===> } else {
IN===>     add_commands $chainref, 'for address in $ALL_BCASTS; do';
IN===>     incr_cmd_level $chainref;
IN===>     log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -d $address ' if $level ne '';
IN===>     add_jump $chainref, $target, 0, "-d \$address ";
IN===>     decr_cmd_level $chainref;
IN===>     add_commands $chainref, 'done';
IN===> }
IN===> 
IN===> log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -d 224.0.0.0/4 ' if $level ne '';
IN===> add_jump $chainref, $target, 0, '-d 224.0.0.0/4 ';
IN===> 
IN===> 1;
IN===> 
IN===> ?END PERL;
                NF-(A)-> filter:Broadcast:1     -A Broadcast -m addrtype --dst-type BROADCAST -j DROP
                NF-(A)-> filter:Broadcast:2     -A Broadcast -m addrtype --dst-type MULTICAST -j DROP
                NF-(A)-> filter:Broadcast:3     -A Broadcast -m addrtype --dst-type ANYCAST -j DROP
                NF-(A)-> filter:Broadcast:4     -A Broadcast -d 224.0.0.0/4 -j DROP
                NF-(A)-> filter:Drop:3          -A Drop -j Broadcast
IN===> AllowICMPs(ACCEPT)	-	-	icmp
CD===> ?COMMENT Needed ICMP types
IN===> DEFAULT ACCEPT
IN===> PARAM	-	-	icmp	fragmentation-needed
                NF-(A)-> filter:Drop:4          -A Drop -p 1 --icmp-type 3/4 -j ACCEPT
IN===> PARAM	-	-	icmp	time-exceeded
                NF-(A)-> filter:Drop:5          -A Drop -p 1 --icmp-type 11 -j ACCEPT
IN===> Invalid(DROP,-)
                NF-(N)-> filter:Invalid         
                NF-(!O1)-> filter:Invalid       
Checking /usr/share/shorewall/action.Invalid for chain Invalid...
CD===> ?FORMAT 2
IN===> DEFAULTS DROP,-
IN===> 
IN===> use Shorewall::IPAddrs;
IN===> use Shorewall::Config;
IN===> use Shorewall::Chains;
IN===> 
IN===> my ( $action, $audit ) = get_action_params( 2 );
IN===> 
IN===> fatal_error "Invalid parameter ($audit) to action Invalid"   if supplied $audit && $audit ne 'audit';
IN===> fatal_error "Invalid parameter ($action) to action Invalid"  unless $action =~ /^(?:ACCEPT|DROP|REJECT)$/;
IN===> 
IN===> my $chainref         = get_action_chain;
IN===> 
IN===> my ( $level, $tag )  = get_action_logging;
IN===> my $target           = require_audit ( $action , $audit );
IN===> 
IN===> log_rule_limit $level, $chainref, 'Invalid' , $action, '', $tag, 'add', "$globals{STATEMATCH} INVALID " if $level ne '';
IN===> add_jump $chainref , $target, 0, "$globals{STATEMATCH} INVALID ";
IN===> 
IN===> allow_optimize( $chainref );
IN===> 
IN===> 1;
IN===> 
IN===> ?END PERL;
                NF-(A)-> filter:Invalid:1       -A Invalid -m conntrack --ctstate INVALID -j DROP
                NF-(O1)-> filter:Invalid        
                NF-(A)-> filter:Drop:6          -A Drop -j Invalid
IN===> SMB(DROP)
CD===> ?FORMAT 2
IN===> PARAM	-	-	udp	135,445
                NF-(A)-> filter:Drop:7          -A Drop -p 17 -m multiport --dports 135,445 -j DROP
CD===> ?if ( __CT_TARGET && ! $AUTOHELPERS && __NETBIOS_NS_HELPER )
EXPR=> ( '' && ! 'Yes' && 1 )
OMIT=>  PARAM	-	-	udp	137 ; helper=netbios-ns
OMIT=>  PARAM	-	-	udp	138:139
CD===> ?else
IN===>  PARAM	-	-	udp	137:139
                NF-(A)-> filter:Drop:8          -A Drop -p 17 --dport 137:139 -j DROP
CD===> ?endif
IN===> PARAM	-	-	udp	1024:	137
                NF-(A)-> filter:Drop:9          -A Drop -p 17 --dport 1024:65535 --sport 137 -j DROP
IN===> PARAM	-	-	tcp	135,139,445
                NF-(A)-> filter:Drop:10         -A Drop -p 6 -m multiport --dports 135,139,445 -j DROP
IN===> DropUPnP(DROP)
CD===> ?COMMENT UPnP
IN===> DEFAULT DROP
IN===> PARAM	-	-	udp	1900
                NF-(A)-> filter:Drop:11         -A Drop -p 17 --dport 1900 -j DROP
IN===> NotSyn(DROP,-)	-	-	tcp
                NF-(N)-> filter:NotSyn          
                NF-(!O1)-> filter:NotSyn        
Checking /usr/share/shorewall/action.NotSyn for chain NotSyn...
CD===> ?FORMAT 2
IN===> DEFAULTS DROP,-
IN===> 
IN===> use Shorewall::IPAddrs;
IN===> use Shorewall::Config;
IN===> use Shorewall::Chains;
IN===> 
IN===> my ( $action, $audit ) = get_action_params( 2 );
IN===> 
IN===> fatal_error "Invalid parameter ($audit) to action NotSyn"   if supplied $audit && $audit ne 'audit';
IN===> fatal_error "Invalid parameter ($action) to action NotSyn"  unless $action =~ /^(?:ACCEPT|DROP|REJECT)$/;
IN===> 
IN===> my $chainref         = get_action_chain;
IN===> 
IN===> my ( $level, $tag )  = get_action_logging;
IN===> my $target           = require_audit ( $action , $audit );
IN===> 
IN===> log_rule_limit $level, $chainref, 'NotSyn' , $action, '', $tag, 'add', '-p 6 ! --syn ' if $level ne '';
IN===> add_jump $chainref , $target, 0, '-p 6 ! --syn ';
IN===> 
IN===> allow_optimize( $chainref );
IN===> 
IN===> 1;
IN===> 
IN===> ?END PERL;
                NF-(A)-> filter:NotSyn:1        -A NotSyn -p 6 ! --syn -j DROP
                NF-(O1)-> filter:NotSyn         
                NF-(A)-> filter:Drop:12         -A Drop -p 6 -j NotSyn
IN===> DropDNSrep(DROP)
CD===> ?COMMENT Late DNS Replies
IN===> DEFAULT DROP
IN===> PARAM	-	-	udp	-	53
                NF-(A)-> filter:Drop:13         -A Drop -p 17 --sport 53 -j DROP
                NF-(N)-> filter:Reject          
                NF-(!O1)-> filter:Reject        
Checking /usr/share/shorewall/action.Reject for chain Reject...
CD===> ?FORMAT 2
IN===> use Shorewall::Config;
IN===> 
IN===> my ( $p1, $p2, $p3 , $p4, $p5 ) = get_action_params( 5 );
IN===> 
IN===> if ( defined $p1 ) {
IN===>     if ( $p1 eq 'audit' ) {
IN===> 	set_action_param( 2, 'A_REJECT')  unless supplied $p2;
IN===> 	set_action_param( 3, 'A_REJECT')  unless supplied $p3;
IN===> 	set_action_param( 4, 'A_ACCEPT' ) unless supplied $p4;
IN===> 	set_action_param( 5, 'A_DROP' )   unless supplied $p5;
IN===>     } else {
IN===> 	fatal_error "Invalid value ($p1) for first Reject parameter" if supplied $p1;
IN===>     }
IN===> }
IN===> 
IN===> 1;
IN===> 
IN===> ?END PERL;
IN===> DEFAULTS -,REJECT,REJECT,ACCEPT,DROP
IN===> COUNT
                NF-(A)-> filter:Reject:1        -A Reject 
IN===> Auth(REJECT)
IN===> PARAM	-	-	tcp	113
                NF-(A)-> filter:Reject:2        -A Reject -p 6 --dport 113 -j reject
IN===> Broadcast(DROP,-)
                NF-(A)-> filter:Reject:3        -A Reject -j Broadcast
IN===> AllowICMPs(ACCEPT)	-	-	icmp
CD===> ?COMMENT Needed ICMP types
IN===> DEFAULT ACCEPT
IN===> PARAM	-	-	icmp	fragmentation-needed
                NF-(A)-> filter:Reject:4        -A Reject -p 1 --icmp-type 3/4 -j ACCEPT
IN===> PARAM	-	-	icmp	time-exceeded
                NF-(A)-> filter:Reject:5        -A Reject -p 1 --icmp-type 11 -j ACCEPT
IN===> Invalid(DROP,-)
                NF-(A)-> filter:Reject:6        -A Reject -j Invalid
IN===> SMB(REJECT)
CD===> ?FORMAT 2
IN===> PARAM	-	-	udp	135,445
                NF-(A)-> filter:Reject:7        -A Reject -p 17 -m multiport --dports 135,445 -j reject
CD===> ?if ( __CT_TARGET && ! $AUTOHELPERS && __NETBIOS_NS_HELPER )
EXPR=> ( '' && ! 'Yes' && 1 )
OMIT=>  PARAM	-	-	udp	137 ; helper=netbios-ns
OMIT=>  PARAM	-	-	udp	138:139
CD===> ?else
IN===>  PARAM	-	-	udp	137:139
                NF-(A)-> filter:Reject:8        -A Reject -p 17 --dport 137:139 -j reject
CD===> ?endif
IN===> PARAM	-	-	udp	1024:	137
                NF-(A)-> filter:Reject:9        -A Reject -p 17 --dport 1024:65535 --sport 137 -j reject
IN===> PARAM	-	-	tcp	135,139,445
                NF-(A)-> filter:Reject:10       -A Reject -p 6 -m multiport --dports 135,139,445 -j reject
IN===> DropUPnP(DROP)
CD===> ?COMMENT UPnP
IN===> DEFAULT DROP
IN===> PARAM	-	-	udp	1900
                NF-(A)-> filter:Reject:11       -A Reject -p 17 --dport 1900 -j DROP
IN===> NotSyn(DROP,-)	-	-	tcp
                NF-(A)-> filter:Reject:12       -A Reject -p 6 -j NotSyn
IN===> DropDNSrep(DROP)
CD===> ?COMMENT Late DNS Replies
IN===> DEFAULT DROP
IN===> PARAM	-	-	udp	-	53
                NF-(A)-> filter:Reject:13       -A Reject -p 17 --sport 53 -j DROP
                NF-(N)-> filter:host2host       
                NF-(N)-> filter:uw2uw           
                NF-(N)-> filter:net2net         
Checking /etc/shorewall/policy...
IN===> host	all	ACCEPT
                NF-(N)-> filter:host2all        
                NF-(N)-> filter:host2uw         
                NF-(N)-> filter:host2net        
IN===> uw	net	NONE
                NF-(N)-> filter:uw2net          
IN===> net	uw	NONE
                NF-(N)-> filter:net2uw          
IN===> if [ -f /etc/shorewall/FW_OPEN ]; then
IN===>   echo "all	host	ACCEPT"
IN===> elif [ -f /etc/shorewall/FW_UW_OPEN ]; then
IN===>   echo "uw	host	ACCEPT"
IN===>   echo "net	host	DROP"
IN===> else 
IN===>   echo "uw	host	REJECT	info"
IN===>   echo "net	host	DROP"
IN===> fi
IN===> END SHELL
IN===> uw	host	ACCEPT
                NF-(N)-> filter:uw2host         
IN===> net	host	DROP
                NF-(N)-> filter:net2host        
GS-----> ################################################################################
GS-----> # Functions to execute the various user exits (extension scripts)
GS-----> ################################################################################
GS-----> 
GS-----> run_init_exit() {
GS----->     #
GS----->     # Shorewall version 4 - Init File
GS----->     #
GS----->     # /etc/shorewall/init
GS----->     #
GS----->     #	Add commands below that you want to be executed at the beginning of
GS----->     #	a "shorewall start" or "shorewall restart" command.
GS----->     #
GS----->     # For additional information, see
GS----->     # http://shorewall.net/shorewall_extension_scripts.htm
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_start_exit() {
GS----->     #
GS----->     # Shorewall version 4 - Start File
GS----->     #
GS----->     # /etc/shorewall/start
GS----->     #
GS----->     #	Add commands below that you want to be executed after shorewall has
GS----->     #	been started or restarted.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS----->     return 0
GS-----> }
GS-----> run_tcclear_exit() {
GS----->     #
GS----->     # Shorewall version 4 - tcclear File
GS----->     #
GS----->     # /etc/shorewall/tcclear
GS----->     #
GS----->     #	Add commands below that you want to be executed before Shorewall
GS----->     #       clears the traffic shaping configuration.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_started_exit() {
GS----->     #
GS----->     # Shorewall version 4 - Started File
GS----->     #
GS----->     # /etc/shorewall/started
GS----->     #
GS----->     #	Add commands below that you want to be executed after shorewall has
GS----->     #	been completely started or restarted. The difference between this
GS----->     #	extension script and /etc/shorewall/start is that this one is invoked
GS----->     #	after delayed loading of the blacklist (DELAYBLACKLISTLOAD=Yes) and
GS----->     #	after the 'shorewall' chain has been created (thus signaling that the
GS----->     #	firewall is completely up).
GS----->     #
GS----->     #	This script should not change the firewall configuration directly but
GS----->     #	may do so indirectly by running /sbin/shorewall with the 'nolock'
GS----->     #	option.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_stop_exit() {
GS----->     #
GS----->     # Shorewall version 4 - Stop File
GS----->     #
GS----->     # /etc/shorewall/stop
GS----->     #
GS----->     #	Add commands below that you want to be executed at the beginning of a
GS----->     #	"shorewall stop" command.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_stopped_exit() {
GS----->     #
GS----->     # Shorewall version 4 - Stopped File
GS----->     #
GS----->     # /etc/shorewall/stopped
GS----->     #
GS----->     #	Add commands below that you want to be executed at the completion of a
GS----->     #	"shorewall stop" command.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_clear_exit() {
GS----->     #
GS----->     # Shorewall version 4 - clear File
GS----->     #
GS----->     # /etc/shorewall/clear
GS----->     #
GS----->     #	Add commands below that you want to be executed after Shorewall
GS----->     #       has processed the 'clear' command.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_refresh_exit() {
GS----->     #
GS----->     # Shorewall version 4 - refresh File
GS----->     #
GS----->     # /etc/shorewall/refresh
GS----->     #
GS----->     #	Add commands below that you want to be executed before Shorewall
GS----->     #       has processed the 'refresh' command.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_refreshed_exit() {
GS----->     #
GS----->     # Shorewall version 4 - refreshed File
GS----->     #
GS----->     # /etc/shorewall/refreshed
GS----->     #
GS----->     #	Add commands below that you want to be executed after Shorewall
GS----->     #       has processed the 'refresh' command.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_restored_exit() {
GS----->     #
GS----->     # Shorewall version 4 - Restored File
GS----->     #
GS----->     # /etc/shorewall/restored
GS----->     #
GS----->     #	Add commands below that you want to be executed after shorewall has
GS----->     #	completed a 'restore' command.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS-----> }
GS-----> run_isusable_exit() {
GS----->     true
GS-----> }
GS-----> run_findgw_exit() {
GS----->     #
GS----->     # Shorewall version 4 - Findgw File
GS----->     #
GS----->     # /etc/shorewall/findgw
GS----->     #
GS----->     #    The code in this file is executed when Shorewall is trying to detect the
GS----->     #    gateway through an interface in /etc/shorewall/providers that has GATEWAY
GS----->     #    specified as 'detect'.
GS----->     #
GS----->     #    The function should echo the IP address of the gateway if it knows what
GS----->     #    it is; the name of the interface is in $1.
GS----->     #
GS----->     # See http://shorewall.net/shorewall_extension_scripts.htm for additional
GS----->     # information.
GS----->     #
GS----->     ###############################################################################
GS----->     true
GS-----> }
GS-----> ################################################################################
GS-----> # End user exit functions
GS-----> ################################################################################
GS-----> 
GS-----> #
GS-----> # Setup Common Rules (/proc)
GS-----> #
GS-----> setup_common_rules() {
                NF-(N)-> filter:logdrop         
                NF-(!O3)-> filter:logdrop       
                NF-(A)-> filter:logdrop:1       -A logdrop -j DROP
                NF-(N)-> filter:logreject       
                NF-(!O3)-> filter:logreject     
                NF-(A)-> filter:logreject:1     -A logreject -j reject
                NF-(N)-> filter:dynamic         
                NF-(!O1)-> filter:dynamic       
                NF-(T)-> filter:dynamic:1       [ -f ${VARDIR}/.dynamic ] && cat ${VARDIR}/.dynamic >&3

                NF-(A)-> filter:OUTPUT:1        -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
                NF-(N)-> filter:sfilter         
                NF-(A)-> filter:sfilter:1       -A sfilter -j LOG --log-level 6 --log-prefix "Shorewall:sfilter:DROP:" 
                NF-(A)-> filter:sfilter:2       -A sfilter -j DROP
                NF-(N)-> filter:enet_fwd        
                NF-(N)-> filter:enet_in         
                NF-(N)-> filter:enet_out        
                NF-(N)-> filter:enet_fop        
                NF-(N)-> filter:enet_iop        
                NF-(N)-> filter:enet_oop        
                NF-(A)-> filter:enet_fop:1      -A enet_fop -m conntrack --ctstate NEW,INVALID,UNTRACKED -j dynamic
                NF-(A)-> filter:enet_fop:2      -A enet_fop -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
                NF-(A)-> filter:enet_iop:1      -A enet_iop -m conntrack --ctstate NEW,INVALID,UNTRACKED -j dynamic
                NF-(A)-> filter:enet_iop:2      -A enet_iop -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
Running /etc/shorewall/initdone...
                NF-(A)-> filter:reject:1        -A reject -m addrtype --src-type BROADCAST -j DROP
                NF-(A)-> filter:reject:2        -A reject -s 224.0.0.0/4 -j DROP
                NF-(A)-> filter:reject:3        -A reject -p 2 -j DROP
                NF-(A)-> filter:reject:4        -A reject -p 6 -j REJECT --reject-with tcp-reset
                NF-(A)-> filter:reject:5        -A reject -p 17 -j REJECT
                NF-(A)-> filter:reject:6        -A reject -p 1 -j REJECT --reject-with icmp-host-unreachable
                NF-(A)-> filter:reject:7        -A reject -j REJECT --reject-with icmp-host-prohibited
Checking Kernel Route Filtering...
GS----->     for file in /proc/sys/net/ipv4/conf/*; do
GS-----> 	[ -f $file/rp_filter ] && echo 0 > $file/rp_filter
GS----->     done
GS-----> 
GS----->     echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
GS----->     echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
GS----->     [ -n "$g_noroutes" ] || $IP -4 route flush cache
Checking Martian Logging...
GS----->     for file in /proc/sys/net/ipv4/conf/*; do
GS-----> 	[ -f $file/log_martians ] && echo 0 > $file/log_martians
GS----->     done
GS-----> 
GS----->     #
GS----->     # Disable automatic helper association on kernel 3.5.0 and later
GS----->     #
GS----->     if [ -f /proc/sys/net/netfilter/nf_conntrack_helper ]; then
GS-----> 	progress_message "Disabling Kernel Automatic Helper Association"
GS-----> 	echo 0 > /proc/sys/net/netfilter/nf_conntrack_helper
GS----->     fi
GS-----> 
GS----->     return 0
GS-----> }
GS-----> #
GS-----> # Enable an optional provider
GS-----> #
GS-----> enable_provider() {
GS----->     g_interface=$1;
GS-----> 
GS----->     case $g_interface in
GS-----> 
GS-----> 	*)
GS-----> 	    startup_error "$g_interface is not an optional provider or interface"
GS-----> 	    ;;
GS----->     esac
GS-----> 
GS-----> }
GS-----> 
GS-----> #
GS-----> # Disable an optional provider
GS-----> #
GS-----> disable_provider() {
GS----->     g_interface=$1;
GS-----> 
GS----->     case $g_interface in
GS-----> 
GS-----> 	*)
GS-----> 	    startup_error "$g_interface is not an optional provider interface"
GS-----> 	    ;;
GS----->     esac
GS-----> }
GS-----> 
GS-----> #
GS-----> # Setup routing and traffic shaping
GS-----> #
GS-----> setup_routing_and_traffic_shaping() {
GS----->     
GS----->     if [ -z "$g_noroutes" ]; then
GS-----> 	
GS-----> 	undo_routing
GS-----> 	restore_default_route 
GS----->     fi
GS-----> 
                NF-(N)-> mangle:tcpre           
                NF-(N)-> mangle:tcout           
                NF-(N)-> mangle:tcfor           
                NF-(N)-> mangle:tcpost          
                NF-(N)-> mangle:tcin            
                NF-(A)-> mangle:PREROUTING:1    -A PREROUTING -j tcpre
                NF-(A)-> mangle:OUTPUT:1        -A OUTPUT -j tcout
                NF-(A)-> mangle:FORWARD:1       -A FORWARD -j MARK --set-mark 0/0xff
                NF-(A)-> mangle:FORWARD:2       -A FORWARD -j tcfor
                NF-(A)-> mangle:POSTROUTING:1   -A POSTROUTING -j tcpost
                NF-(A)-> mangle:INPUT:1         -A INPUT -j tcin
CD===> ?FORMAT 2
GS-----> }
GS-----> 
Checking MAC Filtration -- Phase 1...
                NF-(N)-> filter:uw_frwd         
                NF-(A)-> filter:enet_in:1       -A enet_in -m conntrack --ctstate NEW,INVALID,UNTRACKED -j dynamic
                NF-(A)-> filter:enet_in:2       -A enet_in -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
                NF-(X)-> filter:enet_iop        
                NF-(A)-> filter:enet_fwd:1      -A enet_fwd -m conntrack --ctstate NEW,INVALID,UNTRACKED -j dynamic
                NF-(A)-> filter:enet_fwd:2      -A enet_fwd -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
                NF-(X)-> filter:enet_fop        
Checking /etc/shorewall/rules...
IN===> SECTION NEW
IN===> ACCEPT		uw		host		udp	492
                NF-(A)-> filter:uw2host:1       -A uw2host -p 17 --dport 492 -j ACCEPT
IN===> DROP		net		host		udp	492
                NF-(A)-> filter:net2host:1      -A net2host -p 17 --dport 492 -j DROP
IN===> ACCEPT		uw		host		tcp	36664
                NF-(A)-> filter:uw2host:2       -A uw2host -p 6 --dport 36664 -j ACCEPT
IN===> ACCEPT		uw		host		udp	36664
                NF-(A)-> filter:uw2host:3       -A uw2host -p 17 --dport 36664 -j ACCEPT
IN===> ACCEPT		uw		host		tcp	32804
                NF-(A)-> filter:uw2host:4       -A uw2host -p 6 --dport 32804 -j ACCEPT
IN===> ACCEPT		uw		host		udp	32804
                NF-(A)-> filter:uw2host:5       -A uw2host -p 17 --dport 32804 -j ACCEPT
IN===> DROP		net		host		tcp	36664
                NF-(A)-> filter:net2host:2      -A net2host -p 6 --dport 36664 -j DROP
IN===> DROP		net		host		udp	36664
                NF-(A)-> filter:net2host:3      -A net2host -p 17 --dport 36664 -j DROP
IN===> DROP		net		host		tcp	32804
                NF-(A)-> filter:net2host:4      -A net2host -p 6 --dport 32804 -j DROP
IN===> DROP		net		host		udp	32804
                NF-(A)-> filter:net2host:5      -A net2host -p 17 --dport 32804 -j DROP
IN===> if [ -e /etc/ntp.conf.timekeeper ]; then
IN===>   echo "NTP(ACCEPT)	all    host"
IN===> else 
IN===>   echo "NTP(ACCEPT)	uw	host"
IN===>   echo "NTP(DROP)	net	host"
IN===> fi
IN===> END SHELL
IN===> NTP(ACCEPT)	uw	host
IN===> PARAM	-	-	udp	123
                NF-(A)-> filter:uw2host:6       -A uw2host -p 17 --dport 123 -j ACCEPT
IN===> NTP(DROP)	net	host
IN===> PARAM	-	-	udp	123
                NF-(A)-> filter:net2host:6      -A net2host -p 17 --dport 123 -j DROP
IN===> Ping(ACCEPT)	uw		host
IN===> PARAM	-	-	icmp	8
                NF-(A)-> filter:uw2host:7       -A uw2host -p 1 --icmp-type 8 -j ACCEPT
IN===> ACCEPT		uw		host		tcp	111
                NF-(A)-> filter:uw2host:8       -A uw2host -p 6 --dport 111 -j ACCEPT
IN===> ACCEPT		uw		host		udp	111
                NF-(A)-> filter:uw2host:9       -A uw2host -p 17 --dport 111 -j ACCEPT
IN===> DROP		net		host		tcp	111
                NF-(A)-> filter:net2host:7      -A net2host -p 6 --dport 111 -j DROP
IN===> DROP		net		host		udp	111
                NF-(A)-> filter:net2host:8      -A net2host -p 17 --dport 111 -j DROP
IN===> ACCEPT		uw		host		tcp	678
                NF-(A)-> filter:uw2host:10      -A uw2host -p 6 --dport 678 -j ACCEPT
IN===> ACCEPT		uw		host		udp	678
                NF-(A)-> filter:uw2host:11      -A uw2host -p 17 --dport 678 -j ACCEPT
IN===> DROP		net		host		tcp	678
                NF-(A)-> filter:net2host:9      -A net2host -p 6 --dport 678 -j DROP
IN===> DROP		net		host		udp	678
                NF-(A)-> filter:net2host:10     -A net2host -p 17 --dport 678 -j DROP
IN===> ACCEPT		uw:ref.cac.washington.edu	host	22
   ERROR: Unknown Interface (ref.cac.washington.edu) SHELL@/etc/shorewall/rules:17 (line 96)
      from /etc/shorewall/rules (line 17) at /usr/share/perl5/vendor_perl/Shorewall/Config.pm line 1190
	Shorewall::Config::fatal_error('Unknown Interface (ref.cac.washington.edu)') called at /usr/share/perl5/vendor_perl/Shorewall/Chains.pm line 5999
	Shorewall::Chains::verify_source_interface('ref.cac.washington.edu', 4, 'filter', 'HASH(0x338cdf8)') called at /usr/share/perl5/vendor_perl/Shorewall/Chains.pm line 6423
	Shorewall::Chains::expand_rule('HASH(0x338cdf8)', 4, '-p 22 ', 'ref.cac.washington.edu', '0.0.0.0/0', '', 'ACCEPT', '', 'ACCEPT', ...) called at /usr/share/perl5/vendor_perl/Shorewall/Rules.pm line 2477
	Shorewall::Rules::process_rule1(undef, 'ACCEPT', '', 'uw:ref.cac.washington.edu', 'host', 22, '-', '-', '-', ...) called at /usr/share/perl5/vendor_perl/Shorewall/Rules.pm line 2633
	Shorewall::Rules::process_rule() called at /usr/share/perl5/vendor_perl/Shorewall/Rules.pm line 2792
	Shorewall::Rules::process_rules(0) called at /usr/share/perl5/vendor_perl/Shorewall/Compiler.pm line 790
	Shorewall::Compiler::compiler('script', '', 'directory', '', 'verbosity', 1, 'timestamp', 0, 'debug', ...) called at /usr/libexec/shorewall/compiler.pl line 142
