--- wg_paid --- listen_port=51830 peer_count=5 allowed_ip_count=5 --- selector --- 10.253.1.10 cs1 canary_vpn3 10.253.1.11 cs2 canary_vpn4 10.253.1.12 cs3 canary_vpn5 10.253.1.13 cs4 canary_vpn1 10.253.1.14 cs5 canary_vpn2 --- candidate inner-traffic counter support hints --- set pbr_transit_direct_4_dst_ip_user { set pbr_transit_direct_4_src_ip_user { set pbr_transit_direct_4_src_mac_user { set pbr_transit_vpn_4_dst_ip_user { set pbr_transit_vpn_4_src_ip_user { set pbr_transit_vpn_4_src_mac_user { ip saddr 10.250.0.0/24 ip daddr 192.168.30.64 oifname "br-lan" counter packets 0 bytes 0 snat ip to 192.168.30.1 comment "wg_remote_to_pc64_snat" iifname "eth0" jump input_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 input traffic" iifname "eth2" jump input_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 input traffic" iifname "wg_paid" jump input_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 input traffic" iifname "eth0" jump forward_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 forward traffic" iifname "eth2" jump forward_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 forward traffic" iifname "wg_paid" jump forward_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 forward traffic" udp dport 51830 counter packets 0 bytes 0 accept comment "!fw4: Allow-WG-Paid-51830" oifname "eth0" jump output_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 output traffic" oifname "eth2" jump output_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 output traffic" oifname "wg_paid" jump output_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 output traffic" iifname "wg_paid" jump helper_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 helper assignment" jump accept_to_transit_direct comment "!fw4: Accept lan to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept lan to transit_vpn forwarding" iifname "br-lan" counter packets 13 bytes 888 accept comment "!fw4: accept lan IPv4/IPv6 traffic" oifname "br-lan" counter packets 23 bytes 1512 accept comment "!fw4: accept lan IPv4/IPv6 traffic" oifname "br-lan" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject lan IPv4/IPv6 traffic" chain input_transit_direct { ip daddr 10.201.0.1 udp dport 51820 counter packets 0 bytes 0 accept comment "!fw4: Allow-WG-Remote-In" jump accept_from_transit_direct chain output_transit_direct { jump accept_to_transit_direct chain forward_transit_direct { jump reject_to_transit_direct chain accept_from_transit_direct { iifname "eth0" counter packets 2 bytes 112 accept comment "!fw4: accept transit_direct IPv4/IPv6 traffic" chain accept_to_transit_direct { meta nfproto ipv4 oifname "eth0" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage" oifname "eth0" counter packets 1525 bytes 103953 accept comment "!fw4: accept transit_direct IPv4/IPv6 traffic" chain reject_to_transit_direct { oifname "eth0" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject transit_direct IPv4/IPv6 traffic" chain input_transit_vpn { jump accept_from_transit_vpn chain output_transit_vpn { jump accept_to_transit_vpn chain forward_transit_vpn { jump reject_to_transit_vpn chain accept_from_transit_vpn { iifname "eth2" counter packets 1 bytes 56 accept comment "!fw4: accept transit_vpn IPv4/IPv6 traffic" chain accept_to_transit_vpn { meta nfproto ipv4 oifname "eth2" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage" oifname "eth2" counter packets 2 bytes 232 accept comment "!fw4: accept transit_vpn IPv4/IPv6 traffic" chain reject_to_transit_vpn { oifname "eth2" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject transit_vpn IPv4/IPv6 traffic" ip saddr 10.250.1.3 tcp dport 53 counter packets 0 bytes 0 accept comment "!fw4: ALLOW_OWNER_DNS_VM100" ip saddr 10.250.1.3 udp dport 53 counter packets 0 bytes 0 accept comment "!fw4: ALLOW_OWNER_DNS_VM100" ip saddr 10.250.1.3 counter packets 0 bytes 0 jump handle_reject comment "!fw4: BLOCK_OWNER_VM100_ROUTER" ip saddr 10.250.1.3 ip daddr 10.71.1.189 tcp dport 51822 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: ALLOW_OWNER_WGEASY_UI" ip saddr 10.250.1.3 ip daddr 10.71.1.2 counter packets 0 bytes 0 jump reject_to_lan comment "!fw4: BLOCK_OWNER_VM101" ip saddr 10.250.1.3 ip daddr 10.71.1.222 counter packets 0 bytes 0 jump reject_to_lan comment "!fw4: BLOCK_OWNER_PROXMOX" ip saddr 10.250.1.3 ip daddr 10.71.1.189 counter packets 0 bytes 0 jump reject_to_lan comment "!fw4: BLOCK_OWNER_VM103_EXCEPT_UI" jump accept_to_transit_direct comment "!fw4: Accept remote_in to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept remote_in to transit_vpn forwarding" iifname "wg_remote" counter packets 578 bytes 38637 accept comment "!fw4: accept remote_in IPv4/IPv6 traffic" oifname "wg_remote" counter packets 0 bytes 0 accept comment "!fw4: accept remote_in IPv4/IPv6 traffic" chain input_wg_paid { jump accept_from_wg_paid chain output_wg_paid { jump accept_to_wg_paid chain forward_wg_paid { jump accept_to_transit_direct comment "!fw4: Accept wg_paid to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept wg_paid to transit_vpn forwarding" jump reject_to_wg_paid chain helper_wg_paid { chain accept_from_wg_paid { iifname "wg_paid" counter packets 0 bytes 0 accept comment "!fw4: accept wg_paid IPv4/IPv6 traffic" chain accept_to_wg_paid { oifname "wg_paid" counter packets 0 bytes 0 accept comment "!fw4: accept wg_paid IPv4/IPv6 traffic" chain reject_to_wg_paid { oifname "wg_paid" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wg_paid IPv4/IPv6 traffic" oifname "eth0" jump srcnat_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 srcnat traffic" oifname "eth2" jump srcnat_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 srcnat traffic" chain srcnat_transit_direct { meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 transit_direct traffic" chain srcnat_transit_vpn { meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 transit_vpn traffic" oifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_direct IPv4/IPv6 egress MTU fixing" oifname "eth2" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_vpn IPv4/IPv6 egress MTU fixing" iifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_direct IPv4/IPv6 ingress MTU fixing" iifname "eth2" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_vpn IPv4/IPv6 ingress MTU fixing" ip daddr @pbr_transit_direct_4_dst_ip_user goto pbr_mark_0x010000 ip saddr @pbr_transit_direct_4_src_ip_user goto pbr_mark_0x010000 ether saddr @pbr_transit_direct_4_src_mac_user goto pbr_mark_0x010000 ip daddr @pbr_transit_vpn_4_dst_ip_user goto pbr_mark_0x020000 ip saddr @pbr_transit_vpn_4_src_ip_user goto pbr_mark_0x020000 ether saddr @pbr_transit_vpn_4_src_mac_user goto pbr_mark_0x020000 table inet wgpay_dscp_canary {