release 0.2.6

18 files changed, 253 insertions, 794 deletions

diff --git a/core/conf/hosts b/core/conf/hosts
index a0e80ae..ee776e2 100644
--- a/core/conf/hosts
+++ b/core/conf/hosts
@@ -4,10 +4,10 @@
 
 # IPv4
 127.0.0.1	localhost.localdomain localhost
-127.0.0.1       c9.core c9
+127.0.0.1       c9.localdomain c9
 
 #<ip-address>	<hostname.domain.org>	<aliases>
-10.0.0.1	core.privat-network.net core
+192.168.1.9	core.privat-network.net c9.core
 
 # IPv6
 #::1		ip6-localhost	ip6-loopback
diff --git a/core/conf/iptables/rules.v4 b/core/conf/iptables/rules.v4
new file mode 100644
index 0000000..848603c
--- /dev/null
+++ b/core/conf/iptables/rules.v4
@@ -0,0 +1,140 @@
+# Generated by iptables-save v1.6.0 on Sat Oct 15 17:20:41 2016
+*security
+:INPUT ACCEPT [6:2056]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [6:2056]
+COMMIT
+# Completed on Sat Oct 15 17:20:41 2016
+# Generated by iptables-save v1.6.0 on Sat Oct 15 17:20:41 2016
+*raw
+:PREROUTING ACCEPT [7:2092]
+:OUTPUT ACCEPT [6:2056]
+COMMIT
+# Completed on Sat Oct 15 17:20:41 2016
+# Generated by iptables-save v1.6.0 on Sat Oct 15 17:20:41 2016
+*mangle
+:PREROUTING ACCEPT [7:2092]
+:INPUT ACCEPT [6:2056]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [6:2056]
+:POSTROUTING ACCEPT [6:2056]
+COMMIT
+# Completed on Sat Oct 15 17:20:41 2016
+# Generated by iptables-save v1.6.0 on Sat Oct 15 17:20:41 2016
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT DROP [0:0]
+-A INPUT -i lo -j ACCEPT
+-A INPUT -i br0 -j ACCEPT
+-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop sync: " --log-level 7
+-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
+-A INPUT -f -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop frag: "
+-A INPUT -f -j DROP
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop null: "
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
+-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop syn rst syn rs"
+-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop xmas: "
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
+-A INPUT -p tcp -m tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop fin scan: "
+-A INPUT -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
+#################################################################################
+#	INPUT
+#	Established connections and passive
+#
+
+# Allow established from dns server
+#-A INPUT -i wlp7s0 -p udp -m udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+
+# INPUT accept passive
+-A INPUT -i wlp7s0 -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+-A INPUT -i wlp7s0 -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state RELATED -j ACCEPT
+# Allow established from http server
+-A INPUT -i wlp7s0 -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+# Allow established from https server
+-A INPUT -i wlp7s0 -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+-A INPUT -i wlp7s0 -p udp -m udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+# Allow established from rsync server
+-A INPUT -i wlp7s0 -p tcp -m tcp --sport 873 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+# Allow established from pop3s server
+-A INPUT -i wlp7s0 -p tcp -m tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+# Allow established from smtps server
+-A INPUT -i wlp7s0 -p tcp -m tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+# Allow established from ntp server
+-A INPUT -i wlp7s0 -p udp -m udp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+# Allow established from whois server
+-A INPUT -i wlp7s0 -p tcp -m tcp --sport 43 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+# Allow established from ftp server
+-A INPUT -i wlp7s0 -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+-A INPUT -i wlp7s0 -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+-A INPUT -i wlp7s0 -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+##################################################################################
+#	INPUT
+#	New and established connections to local servers
+#
+
+# INPUT accept from wlp7s0 to dns server
+-A INPUT -i wlp7s0 -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+# INPUT accept from wlp7s0 to https server
+-A INPUT -i wlp7s0 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
+# INPUT accept from wlp7s0 to ssh server
+-A INPUT -i wlp7s0 -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state ESTABLISHED -j ACCEPT
+-A INPUT -i wlp7s0 -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state NEW -m limit --limit 6/min --limit-burst 3 -j ACCEPT
+
+
+-A INPUT -j LOG --log-prefix "iptables: INPUT: " --log-level 7
+-A FORWARD -j LOG --log-prefix "iptables: FORWARD: " --log-level 7
+
+##################################################################################
+#	Output
+#	Connections to remote servers
+#
+-A OUTPUT -o lo -j ACCEPT
+-A OUTPUT -o br0 -j ACCEPT
+
+# Allow dns
+#-A OUTPUT -o wlp7s0 -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+# Allow to rsync server
+-A OUTPUT -o wlp7s0 -p tcp -m tcp --sport 1024:65535 --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT
+# Allow to pop3s server
+-A OUTPUT -o wlp7s0 -p tcp -m tcp --sport 1024:65535 --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT
+# Allow to smtps server
+-A OUTPUT -o wlp7s0 -p tcp -m tcp --sport 1024:65535 --dport 465 -m state --state NEW,ESTABLISHED -j ACCEPT
+# Allow to ntp server
+-A OUTPUT -o wlp7s0 -p udp -m udp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
+# Allow to ftp server
+-A OUTPUT -o wlp7s0 -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -o wlp7s0 -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT
+# Allow to https server
+-A OUTPUT -o wlp7s0 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -o wlp7s0 -p udp -m udp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
+# Allow to http server
+-A OUTPUT -o wlp7s0 -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+##################################################################################
+#	Output
+#	Connections from local servers
+#
+
+# Allow from ssh server
+-A OUTPUT -o wlp7s0 -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+# Allow from dns server
+-A OUTPUT -o wlp7s0 -p udp -m udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+
+-A OUTPUT -j LOG --log-prefix "iptables: OUTPUT: " --log-level 7
+COMMIT
+# Completed on Sat Oct 15 17:20:41 2016
+# Generated by iptables-save v1.6.0 on Sat Oct 15 17:20:41 2016
+*nat
+:PREROUTING ACCEPT [1:36]
+:INPUT ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+COMMIT
+# Completed on Sat Oct 15 17:20:41 2016
diff --git a/core/conf/rc.d/net b/core/conf/rc.d/net
index d46583b..53224af 100755
--- a/core/conf/rc.d/net
+++ b/core/conf/rc.d/net
@@ -9,9 +9,9 @@ TYPE="static"
 # For "static" connections, specify your settings here:
 # To see your available devices run "ip link".
 DEV=enp8s0
-ADDR=10.0.0.1
+ADDR=192.168.1.9
 MASK=24
-GW=10.0.0.1
+GW=192.168.1.254
 
 # Optional settings:
 DHCPOPTS="-h $(/bin/hostname) -C resolv.conf $DEV"
@@ -23,7 +23,7 @@ case $1 in
 		else
 			/sbin/ip addr add ${ADDR}/${MASK} dev ${DEV} broadcast +
 			/sbin/ip link set ${DEV} up
-			#/sbin/ip route add default via ${GW}
+			/sbin/ip route add default via ${GW}
 		fi
 		;;
 	stop)
@@ -31,6 +31,8 @@ case $1 in
 			/usr/bin/pkill -F /var/run/dhcpcd-${DEV}.pid
 
 		else
+                        /sbin/ip route del default dev ${DEV}
+                        /sbin/ip route flush dev ${DEV}
 			/sbin/ip link set ${DEV} down
 			/sbin/ip addr flush dev ${DEV}
 		fi
diff --git a/core/conf/rc.d/wlan b/core/conf/rc.d/wlan
index 263cf42..894a69c 100755
--- a/core/conf/rc.d/wlan
+++ b/core/conf/rc.d/wlan
@@ -33,6 +33,8 @@ case $1 in
 		( $SSD --stop --retry 10 --pidfile $PID_DHCP
 		  $SSD --stop --retry 10 --pidfile $PID_WIFI )
 		RETVAL=$?
+                /sbin/ip route del default dev ${DEV}
+		/sbin/ip route flush dev ${DEV}
 		/sbin/ip link set ${DEV} down
 		/sbin/ip addr flush dev ${DEV}
 		;;
diff --git a/core/configure.html b/core/configure.html
index 7653af9..d7bbc25 100644
--- a/core/configure.html
+++ b/core/configure.html
@@ -61,10 +61,10 @@
         <pre>
         # IPv4
         127.0.0.1	localhost.localdomain localhost
-        127.0.0.1       c9.core c9
+        127.0.0.1       c9.localdomain c9
 
         #&lt;ip-address&gt;	&lt;hostname.domain.org&gt;	&lt;aliases&gt;
-        10.0.0.1	core.privat-network.net core
+        192.168.1.9	core.privat-network.net c9.core
 
         # IPv6
         #::1		ip6-localhost	ip6-loopback
diff --git a/core/network.html b/core/network.html
index b8b7617..e1b590d 100644
--- a/core/network.html
+++ b/core/network.html
@@ -29,10 +29,7 @@
 
         <h2 id="resolv">2.1.1. Resolver</h2>
 
-        <p>Configure your resolver with a server that don't censorship there for
-        respect your freedom and privacy. Read
-        <a href="https://trac.torproject.org/projects/tor/wiki/doc/DnsResolver/PublicDnsResolvers#PublicDNSServers">Tor Dns Resolver</a>
-        for more information. This example will use
+        <p>This example will use
         <a href="http://www.chaoscomputerclub.de/en/censorship/dns-howto">Chaos Computer Club</a>
         server, edit /etc/resolv.conf and make it immutable;</p>
 
@@ -51,6 +48,20 @@
         <p>Current example of <a href="conf/rc.d/net">/etc/rc.d/net</a>;</p>
 
         <pre>
+        Address:   192.168.0.1           11000000.10101000.00000000 .00000001
+        Netmask:   255.255.255.0 = 24    11111111.11111111.11111111 .00000000
+        Wildcard:  0.0.0.255             00000000.00000000.00000000 .11111111
+        =>
+        Network:   192.168.0.0/24        11000000.10101000.00000000 .00000000 (Class C)
+        Broadcast: 192.168.0.255         11000000.10101000.00000000 .11111111
+        HostMin:   192.168.0.1           11000000.10101000.00000000 .00000001
+        HostMax:   192.168.0.254         11000000.10101000.00000000 .11111110
+        Hosts/Net: 254                   (Private Internet)
+        </pre>
+
+        <p>Other IP class that can used for private network;</p>
+
+        <pre>
         Address:   10.0.0.1              00001010.00000000.00000000 .00000001
         Netmask:   255.255.255.0 = 24    11111111.11111111.11111111 .00000000
         Wildcard:  0.0.0.255             00000000.00000000.00000000 .11111111
@@ -62,78 +73,50 @@
         Hosts/Net: 254                   (Private Internet)
         </pre>
 
+        <p>Manual configuring like net script;</p>
+
         <pre>
         # DEV=enp8s0
-        # ADDR=10.0.0.1
+        # ADDR=192.168.1.9
         # MASK=24
-        # GW=10.0.0.1
-        # ip addr flush dev ${DEV}
-        # ip route flush dev ${DEV}
+        # GW=192.168.1.254
         </pre>
 
         <pre>
+        # ip addr flush dev ${DEV}
+        # ip route flush dev ${DEV}
         # ip addr add ${ADDR}/${MASK} dev ${DEV} broadcast +
         # ip link set ${DEV} up
-        </pre>
-
-        <p>Script don't add above network as gateway;</p>
-
-        <pre>
         # ip route add default via ${GW}
         </pre>
 
-        <p>Other IP class used in home setups;</p>
-
-        <pre>
-        Address:   192.168.0.1           11000000.10101000.00000000 .00000001
-        Netmask:   255.255.255.0 = 24    11111111.11111111.11111111 .00000000
-        Wildcard:  0.0.0.255             00000000.00000000.00000000 .11111111
-        =>
-        Network:   192.168.0.0/24        11000000.10101000.00000000 .00000000 (Class C)
-        Broadcast: 192.168.0.255         11000000.10101000.00000000 .11111111
-        HostMin:   192.168.0.1           11000000.10101000.00000000 .00000001
-        HostMax:   192.168.0.254         11000000.10101000.00000000 .11111110
-        Hosts/Net: 254                   (Private Internet)
-        </pre>
-
-        <pre>
-        # DEV=enp8s0
-        # ADDR=192.168.1.1
-        # MASK=24
-        # GW=192.168.1.254
-        </pre>
-
 	<h2 id="iptables">2.1.3. Iptables</h2>
 
         <p>For more information about iptables read
         <a href="https://wiki.archlinux.org/index.php/Iptables">arch wiki</a>.
         You can use
-        <a href="scripts/iptables.sh">iptables script</a>
-        at boot time and iptables-save and iptables-restore tools to
-        configure nat and filtering;</p>
+        <a href="conf/iptables/rules.v4">/etc/iptables/rules.v4</a>
+        as template, replace interface by the one facing the router/gateway.
+        This configuration file is used at boot time by iptables-restore command,
+        if you use a script or change the rules of running system you can
+        use iptables-save command to save configuration to a file.</p>
 
         <pre>
         # mkdir /etc/iptables
-        # cp c9-doc/core/scripts/iptables.sh /etc/iptables/
+        # cp c9-doc/core/conf/iptables/rules.v4 /etc/iptables/
+        # cp c9-doc/core/conf/rc.d/iptables /etc/rc.d/
+        # chmod +x /etc/rc.d/iptables
         </pre>
 
-        <p>Adjust iptables to your needs, then;</p>
+        <p>Adjust rules.v4 to your needs, then;</p>
 
         <pre>
-        # cd /etc/iptables
-        # sh iptables.sh
-        # iptables-save > rules.v4
+        # sh /etc/rc.d/iptables start
         </pre>
 
         <p>Copy init script, edit if you dont like to
         let drop when you call stop.</p>
 
-        <pre>
-        # cp c9-doc/core/conf/rc.d/iptables /etc/rc.d/
-        # vim /etc/rc.d/iptables
-        # chmod +x /etc/rc.d/iptables
-        </pre>
-
         <p>Re-configure your rc.conf and add iptables before (w)lan is up;</p>
 
         <pre>
diff --git a/core/scripts/iptables.sh b/core/scripts/iptables.sh
deleted file mode 100644
index 714a18a..0000000
--- a/core/scripts/iptables.sh
+++ /dev/null
@@ -1,334 +0,0 @@
-#!/bin/sh
-
-#
-#                                XXXXXXXXXXXXXXXXX
-#                                XXXX Network XXXX
-#                                XXXXXXXXXXXXXXXXX
-#                                        +
-#                                        |
-#                                        v
-#  +-------------+              +------------------+
-#  |table: filter| <---+        | table: nat       |
-#  |chain: INPUT |     |        | chain: PREROUTING|
-#  +-----+-------+     |        +--------+---------+
-#        |             |                 |
-#        v             |                 v
-#  [local process]     |           ****************          +--------------+
-#        |             +---------+ Routing decision +------> |table: filter |
-#        v                         ****************          |chain: FORWARD|
-# ****************                                           +------+-------+
-# Routing decision                                                  |
-# ****************                                                  |
-#        |                                                          |
-#        v                        ****************                  |
-# +-------------+       +------>  Routing decision  <---------------+
-# |table: nat   |       |         ****************
-# |chain: OUTPUT|       |               +
-# +-----+-------+       |               |
-#       |               |               v
-#       v               |      +-------------------+
-# +--------------+      |      | table: nat        |
-# |table: filter | +----+      | chain: POSTROUTING|
-# |chain: OUTPUT |             +--------+----------+
-# +--------------+                      |
-#                                       v
-#                               XXXXXXXXXXXXXXXXX
-#                               XXXX Network XXXX
-#                               XXXXXXXXXXXXXXXXX
-#
-# iptables [-t table] {-A|-C|-D} chain rule-specification
-#
-# iptables [-t table] {-A|-C|-D} chain  rule-specification
-#
-# iptables  [-t table] -I chain [rulenum] rule-specification
-#
-# iptables [-t table] -R chain rulenum  rule-specification
-#
-# iptables [-t table] -D chain rulenum
-#
-# iptables [-t table] -S [chain [rulenum]]
-#
-# iptables  [-t  table]  {-F|-L|-Z} [chain [rulenum]] [options...]
-#
-# iptables [-t table] -N chain
-#
-# iptables [-t table] -X [chain]
-#
-# iptables [-t table] -P chain target
-#
-# iptables [-t table]  -E  old-chain-name  new-chain-name
-#
-# rule-specification = [matches...] [target]
-#
-# match = -m matchname [per-match-options]
-#
-#
-# Targets
-#
-# can be a user defined chain
-#
-# ACCEPT - accepts the packet
-# DROP   - drop the packet on the floor
-# QUEUE  - packet will be stent to queue
-# RETURN - stop traversing this chain and
-#          resume ate the next rule in the
-#          previeus (calling) chain.
-#
-# if packet reach the end of the chain or
-# a target RETURN, default policy for that
-# chain is applayed.
-#
-# Target Extensions
-#
-# AUDIT
-# CHECKSUM
-# CLASSIFY
-# DNAT
-# DSCP
-# LOG
-#     Torn on kernel logging, will print some
-#     some information on all matching packets.
-#     Log data can be read with dmesg or syslogd.
-#     This is a non-terminating target and a rule
-#     should be created with matching criteria.
-#
-#     --log-level level
-#           Level of logging (numeric or see sys-
-#           log.conf(5)
-#
-#     --log-prefix prefix
-#           Prefix log messages with specified prefix
-#           up to 29 chars log
-#
-#     --log-uid
-#           Log the userid of the process with gener-
-#           ated the packet
-# NFLOG
-#     This target pass the packet to loaded logging
-#     backend to log the packet. One or more userspace
-#     processes may subscribe to the group to receive
-#     the packets.
-#
-# ULOG
-#     This target provides userspace logging of maching
-#     packets. One or more userspace processes may then
-#     then subscribe to various multicast groups and
-#     then receive the packets.
-#
-#
-# Commands
-#
-# -A, --append chain rule-specification
-# -C, --check chain rule-specification
-# -D, --delete chain rule-specification
-# -D, --delete chain rulenum
-# -I, --insert chain [rulenum] rule-specification
-# -R, --replace chain rulenum rule-specification
-# -L, --list [chain]
-# -P, --policy chain target
-#
-# Parameters
-#
-# -p, --protocol protocol
-#       tcp, udp, udplite, icmp, esp, ah, sctp, all
-# -s, --source address[/mask][,...]
-# -d, --destination address[/mask][,...]
-# -j, --jump target
-# -g, --goto chain
-# -i, --in-interface name
-# -o, --out-interface name
-# -f, --fragment
-# -m, --match options module-name
-#       iptables can use extended packet matching
-#       modules.
-# -c, --set-counters packets bytes
-
-IPT="/usr/sbin/iptables"
-SPAMLIST="blockedip"
-SPAMDROPMSG="BLOCKED IP DROP"
-PUB_IF="wlp7s0"
-DHCP_SERV="192.168.1.1"
-#PUB_IP="192.168.1.65"
-#PRIV_IF="wlp3s0"
-
-modprobe ip_conntrack
-modprobe ip_conntrack_ftp
-
-echo "Stopping ipv4 firewall and deny everyone..."
-
-iptables -F
-iptables -X
-iptables -t nat -F
-iptables -t nat -X
-iptables -t mangle -F
-iptables -t mangle -X
-iptables -t raw -F
-iptables -t raw -X
-iptables -t security -F
-iptables -t security -X
-
-
-echo "Starting ipv4 firewall filter table..."
-
-# Set Default Rules
-iptables -P INPUT DROP
-iptables -P FORWARD DROP
-iptables -P OUTPUT DROP
-
-# Unlimited on local
-$IPT -A INPUT -i lo -j ACCEPT
-$IPT -A OUTPUT -o lo -j ACCEPT
-
-# Block sync
-$IPT -A INPUT -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: "
-$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
-
-# Block Fragments
-$IPT -A INPUT -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: "
-$IPT -A INPUT -f -j DROP
-
-# Block bad stuff
-$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
-$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
-
-$IPT -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: "
-$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # NULL packets
-
-$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: "
-$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-
-$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: "
-$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS
-
-$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: "
-$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans
-
-$IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
-
-##### Add your AP rules below ######
-
-#echo 1 > /proc/sys/net/ipv4/ip_forward
-#$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP}
-#$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -j ACCEPT
-#$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -j ACCEPT
-
-#$IPT -A INPUT -i ${PRIV_IF} -j ACCEPT
-#$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT
-
-##### Server rules below ######
-
-#echo "Allow ICMP"
-#$IPT -A INPUT -i ${PUB_IF} -p icmp --icmp-type 0 -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p icmp --icmp-type 0 -d 192.168.0.0/16 -j ACCEPT
-#$IPT -A INPUT -i ${PUB_IF} -p icmp --icmp-type 8 -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p icmp --icmp-type 8 -d 192.168.0.0/16 -j ACCEPT
-
-#echo "Allow DNS Server"
-#$IPT -A INPUT -i ${PUB_IF} -p udp --sport 1024:65535 --dport 53  -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -d 192.168.0.0/16 -j ACCEPT
-
-#echo "Allow HTTP and HTTPS server"
-#$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 443 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 80 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 80 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 443 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-
-#echo "Allow ssh server"
-#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-#$IPT -A INPUT  -i ${PUB_IF} -p tcp --dport 22 -m state --state ESTABLISHED -j ACCEPT
-#$IPT -A INPUT  -i ${PUB_IF} -p tcp --dport 22 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT
-
-##### Add your rules below ######
-
-echo "Allow DNS Client"
-
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow Whois Client"
-
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 43 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 43 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow HTTP Client"
-
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow Rsync Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 873 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow POP3S Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow SMTPS Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 465 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 465 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow NTP Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 123 -m state --state ESTABLISHED -j ACCEPT
-
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow IRC Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 6667 -m state --state NEW -j ACCEPT
-
-echo "Allow Active FTP Client"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 20 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow Git"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 9418 -m state --state NEW -j ACCEPT
-
-echo "Allow ssh client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT  -i ${PUB_IF} -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-
-#echo "Allow Passive Connections"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024:  -m state --state ESTABLISHED,RELATED -j ACCEPT
-
-
-# echo "Allow FairCoin"
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 46392 -m state --state NEW,ESTABLISHED -j ACCEPT
-# $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 46392 -m state --state ESTABLISHED -j ACCEPT
-# 
-# echo "Allow Dashcoin"
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 29080 -m state --state NEW,ESTABLISHED -j ACCEPT
-# $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 29080 -m state --state ESTABLISHED -j ACCEPT
-# 
-# echo "Allow warzone2100"
-# $IPT -A INPUT -i ${PUB_IF} -p tcp --dport 2100 -s 192.168.0.0/16 -j ACCEPT
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 2100 -j ACCEPT
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 2100 -j ACCEPT
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 9990 -j ACCEPT
-# 
-# echo "Allow wesnoth"
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 15000 -m state --state NEW -j ACCEPT
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 14998 -m state --state NEW -j ACCEPT
-
-##### END your rules ############
-# Less log of known traffic
-
-# RIP protocol
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -s 192.168.0.0/16 -j DROP
-
-# DHCP
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -d $DHCP_SERV -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 67 --dport 68 -s $DHCP_SERV -j ACCEPT
-
-# log everything else and drop
-$IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: "
-$IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: "
-$IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: "
-
-exit 0
diff --git a/core/scripts/setup-install.sh b/core/scripts/setup-install.sh
index 7625519..4ca01ff 100644
--- a/core/scripts/setup-install.sh
+++ b/core/scripts/setup-install.sh
@@ -209,6 +209,7 @@ setup_crux() {
     vim $CHROOT/etc/fstab
 
     echo "1.2.6. Initialization Scripts;"
+    cp $DIR_CONF/rc.d/* $CHROOT/etc/rc.d/
     cp $DIR_CONF/rc.conf $CHROOT/etc/
     vim $CHROOT/etc/rc.conf
 
diff --git a/index.html b/index.html
index 70cea5c..cbe6339 100644
--- a/index.html
+++ b/index.html
@@ -27,7 +27,7 @@
         <p>Version;</p>
 
         <pre>
-        rev 0.2.5
+        rev 0.2.6
         </pre>
 
 
diff --git a/tools/conf/etc/dnsmasq.conf b/tools/conf/etc/dnsmasq.conf
index f09b6a6..dc48d99 100644
--- a/tools/conf/etc/dnsmasq.conf
+++ b/tools/conf/etc/dnsmasq.conf
@@ -112,6 +112,8 @@ interface=br0
 
 # Or you can specify which interface _not_ to listen on
 except-interface=wlp7s0
+except-interface=enp8s0
+
 # Or which to listen on by address (remember to include 127.0.0.1 if
 # you use this.)
 listen-address=127.0.0.1
diff --git a/tools/conf/etc/rc.d/dnscrypt-proxy b/tools/conf/etc/rc.d/dnscrypt-proxy
index 3f4feea..0874fa6 100755
--- a/tools/conf/etc/rc.d/dnscrypt-proxy
+++ b/tools/conf/etc/rc.d/dnscrypt-proxy
@@ -16,15 +16,10 @@ USER=nobody
 PATH=/usr/sbin:/usr/bin:/sbin:/bin
 DAEMON=/usr/sbin/dnscrypt-proxy
 NAME=dnscrypt-proxy
+RESOLVER=dnscrypt.eu-dk
 ADDRESS1=77.66.84.233
-ADDRESS2=176.56.237.171
-ADDRESS3=77.66.84.233.443
 PNAME1=2.dnscrypt-cert.resolver2.dnscrypt.eu
-PNAME2=2.dnscrypt-cert.resolver1.dnscrypt.eu
 PKEY1=3748:5585:E3B9:D088:FD25:AD36:B037:01F5:520C:D648:9E9A:DD52:1457:4955:9F0A:9955
-PKEY2=67C0:0F2C:21C5:5481:45DD:7CB4:6A27:1AF2:EB96:9931:40A3:09B6:2B8D:1653:1185:9C66
-PKEY2=67C0:0F2C:21C5:5481:45DD:7CB4:6A27:1AF2:EB96:9931:40A3:09B6:2B8D:1653:1185:9C66
-PKEY2=3748:5585:E3B9:D088:FD25:AD36:B037:01F5:520C:D648:9E9A:DD52:1457:4955:9F0A:9955
 
 case "$1" in
   start)
@@ -33,7 +28,7 @@ case "$1" in
 	    --resolver-address=$ADDRESS3 \
 	    --provider-name=$PNAME1 \
 	    --provider-key=$PKEY3 \
-	    --resolver-name="dnscrypt.eu-dk"
+	    --resolver-name=$RESOLVER
     ;;
   stop)
     echo "Stopping $NAME"
diff --git a/tools/conf/etc/resolv.conf b/tools/conf/etc/resolv.conf
new file mode 100644
index 0000000..b568a6c
--- /dev/null
+++ b/tools/conf/etc/resolv.conf
@@ -0,0 +1,9 @@
+# Generated by dhcpcd from wlp7s0.dhcp
+# /etc/resolv.conf.head can replace this line
+nameserver 127.0.0.1
+# CCC server
+# nameserver 213.73.91.35
+# OpenNIC Servers
+# nameserver 192.71.249.83
+# nameserver 5.135.183.146
+# /etc/resolv.conf.tail can replace this line
diff --git a/tools/dnsmasq.html b/tools/dnsmasq.html
index ce22d76..c431c30 100644
--- a/tools/dnsmasq.html
+++ b/tools/dnsmasq.html
@@ -10,6 +10,9 @@
 
         <h1>Dnscrypt and Dnsmasq</h1>
 
+        <p>Configure your resolver with a server that don't
+        censorship there for respect your freedom and privacy.
+        Read <a href="https://trac.torproject.org/projects/tor/wiki/doc/DnsResolver/PublicDnsResolvers#PublicDNSServers">Tor Dns Resolver</a> for more information.</p>
 
         <h2 id="dnscrypt">1. Dnscrypt</h2>
 
@@ -17,23 +20,26 @@
         $ prt-get depinst dnscrypt
         </pre>
 
-        <p>Dnscrypt by default resolves to dnscrypt.eu-nl, file
-        /usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv
-        contains list of compatible serers. Sysdoc dnscrypt-proxy port
-        contains init script configured to use DNSCrypt.eu resolver and
-        run as nobody user. Basic usage example;</p>
+        <p>Dnscrypt by default resolves to dnscrypt.eu-nl, check file
+        /usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv for a list of
+        compatible servers. Dnscrypt-proxy port from c9-ports contains
+        <a href="conf/etc/rc.d/dnscrypt-proxy">dnscrypt-proxy</a> init
+        script configured to use dnscrypt.eu-dk resolver and run as 
+        nobody user. Basic usage example;</p>
 
         <pre>
-        $ sudo  dnscrypt-proxy --daemonize --resolver-name=&lt;resolver name&gt;
+        $ sudo -u nobody  dnscrypt-proxy --daemonize --resolver-name=&lt;resolver name&gt;
         </pre>
 
         <h2 id="dnsmasq">2. Dnsmasq</h2>
 
-        <p>Edit <a href="../conf/etc/resolv.conf">resolv.conf</a>;</p>
+        <p>Edit <a href="conf/etc/resolv.conf">resolv.conf</a>;</p>
 
         <pre>
-        # Local dnsmasq server
+        # /etc/resolv.conf.head can replace this line
         nameserver 127.0.0.1
+        # CCC server
+        # nameserver 213.73.91.35
         # OpenNIC Servers
         # nameserver 192.71.249.83
         # nameserver 5.135.183.146
@@ -48,8 +54,8 @@
 
         <p>Dnsmasq provides dns caching and dhcpd, example configuration
         files:
-        <a href="../conf/etc/dnsmasq.conf">dnsmasq.conf</a> (change interface),
-        <a href="../conf/etc/hosts.dnsmasq">hosts.dnsmasq</a>.</p>
+        <a href="conf/etc/dnsmasq.conf">dnsmasq.conf</a> (change interface),
+        <a href="conf/etc/hosts.dnsmasq">hosts.dnsmasq</a>.</p>
 
         <a href="index.html">Tools Index</a>
 
diff --git a/tools/index.html b/tools/index.html
index c6fbae7..1b63a92 100644
--- a/tools/index.html
+++ b/tools/index.html
@@ -78,15 +78,17 @@
             </li>
             <li><a href="storage.html">Storage</a>
                 <ul>
-                    <li><a href="lvm.html">LVM</a>
-                        <ul>
-                            <li><a href="lvm.html#lvmpart">1. LVM partition</a></li>
-                            <li><a href="lvm.html#pv">2. Create physical volume</a></li>
-                            <li><a href="lvm.html#vg">3. Create volume group</a></li>
-                            <li><a href="lvm.html#lv">4. Create logical volume</a></li>
-                            <li><a href="lvm.html#maint">5. Maintenance</a></li>
-                        </ul>
-                    </li>
+                    <li><a href="storage.html#maint">1. Maintenance</a></li>
+                    <li><a href="storage.html#mv">2. Moving data</a></li>
+                </ul>
+            </li>
+            <li><a href="lvm.html">LVM</a>
+                <ul>
+                    <li><a href="lvm.html#lvmpart">1. LVM partition</a></li>
+                    <li><a href="lvm.html#pv">2. Create physical volume</a></li>
+                    <li><a href="lvm.html#vg">3. Create volume group</a></li>
+                    <li><a href="lvm.html#lv">4. Create logical volume</a></li>
+                    <li><a href="lvm.html#maint">5. Maintenance</a></li>
                 </ul>
             </li>
             <li><a href="syslog-ng.html">Syslog-ng</a>
@@ -97,10 +99,10 @@
                     <li><a href="syslog-ng.html#syslog-conf">Syslog-ng configuration</a></li>
                     <li><a href="logrotate.html">Logrotate</a></li>
                     <li><a href="logwatch.html">Logwatch</a>
-                    <ul>
-                        <li><a href="logwatch.html#conf">Configure Logwatch</a></li>
-                        <li><a href="logwatch.html#cron">Set cron task</a></li>
-                    </ul>
+                        <ul>
+                            <li><a href="logwatch.html#conf">Configure Logwatch</a></li>
+                            <li><a href="logwatch.html#cron">Set cron task</a></li>
+                        </ul>
                     </li>
 
                 </ul>
diff --git a/tools/lvm.html b/tools/lvm.html
index 8b1624a..898a8d3 100644
--- a/tools/lvm.html
+++ b/tools/lvm.html
@@ -127,17 +127,6 @@
 
         <h2 id="maint">5. Maintenance</h2>
 
-        <pre>
-        # smartctl -t long /dev/sdb1
-        # smartctl -a /dev/sdb1 | less
-        </pre>
-
-        <p><a href="https://wiki.archlinux.org/index.php/Badblocks">Non Destructive Test;</a></p>
-
-        <pre>
-        # badblocks -nsv /dev/sdb1
-        </pre>
-
         <h2 id="encrypt">7. Encryption</h2>
 
         <a href="index.html">Tools Index</a>
diff --git a/tools/network.html b/tools/network.html
index 5e4a481..43e4616 100644
--- a/tools/network.html
+++ b/tools/network.html
@@ -10,6 +10,10 @@
 
         <h1>Network Tools</h1>
 
+        <p>Ethernet and wireless connections to router are configured
+        by <a href="../core/network.html">net and wlan</a> scripts, they
+        allow to connect to the internet in the most common environments.</p>
+
         <h2 id="bridge">Bridges</h2>
 
         <p>See <a href="conf/etc/rc.d/blan">/etc/rc.d/blan</a> on
diff --git a/tools/scripts/system-iptables.sh b/tools/scripts/system-iptables.sh
deleted file mode 100644
index 429efde..0000000
--- a/tools/scripts/system-iptables.sh
+++ /dev/null
@@ -1,361 +0,0 @@
-#!/bin/sh
-
-#
-#                                XXXXXXXXXXXXXXXXX
-#                                XXXX Network XXXX
-#                                XXXXXXXXXXXXXXXXX
-#                                        +
-#                                        |
-#                                        v
-#  +-------------+              +------------------+
-#  |table: filter| <---+        | table: nat       |
-#  |chain: INPUT |     |        | chain: PREROUTING|
-#  +-----+-------+     |        +--------+---------+
-#        |             |                 |
-#        v             |                 v
-#  [local process]     |           ****************          +--------------+
-#        |             +---------+ Routing decision +------> |table: filter |
-#        v                         ****************          |chain: FORWARD|
-# ****************                                           +------+-------+
-# Routing decision                                                  |
-# ****************                                                  |
-#        |                                                          |
-#        v                        ****************                  |
-# +-------------+       +------>  Routing decision  <---------------+
-# |table: nat   |       |         ****************
-# |chain: OUTPUT|       |               +
-# +-----+-------+       |               |
-#       |               |               v
-#       v               |      +-------------------+
-# +--------------+      |      | table: nat        |
-# |table: filter | +----+      | chain: POSTROUTING|
-# |chain: OUTPUT |             +--------+----------+
-# +--------------+                      |
-#                                       v
-#                               XXXXXXXXXXXXXXXXX
-#                               XXXX Network XXXX
-#                               XXXXXXXXXXXXXXXXX
-#
-# iptables [-t table] {-A|-C|-D} chain rule-specification
-#
-# iptables [-t table] {-A|-C|-D} chain  rule-specification
-#
-# iptables  [-t table] -I chain [rulenum] rule-specification
-#
-# iptables [-t table] -R chain rulenum  rule-specification
-#
-# iptables [-t table] -D chain rulenum
-#
-# iptables [-t table] -S [chain [rulenum]]
-#
-# iptables  [-t  table]  {-F|-L|-Z} [chain [rulenum]] [options...]
-#
-# iptables [-t table] -N chain
-#
-# iptables [-t table] -X [chain]
-#
-# iptables [-t table] -P chain target
-#
-# iptables [-t table]  -E  old-chain-name  new-chain-name
-#
-# rule-specification = [matches...] [target]
-#
-# match = -m matchname [per-match-options]
-#
-#
-# Targets
-#
-# can be a user defined chain
-#
-# ACCEPT - accepts the packet
-# DROP   - drop the packet on the floor
-# QUEUE  - packet will be stent to queue
-# RETURN - stop traversing this chain and
-#          resume ate the next rule in the
-#          previeus (calling) chain.
-#
-# if packet reach the end of the chain or
-# a target RETURN, default policy for that
-# chain is applayed.
-#
-# Target Extensions
-#
-# AUDIT
-# CHECKSUM
-# CLASSIFY
-# DNAT
-# DSCP
-# LOG
-#     Torn on kernel logging, will print some
-#     some information on all matching packets.
-#     Log data can be read with dmesg or syslogd.
-#     This is a non-terminating target and a rule
-#     should be created with matching criteria.
-#
-#     --log-level level
-#           Level of logging (numeric or see sys-
-#           log.conf(5)
-#
-#     --log-prefix prefix
-#           Prefix log messages with specified prefix
-#           up to 29 chars log
-#
-#     --log-uid
-#           Log the userid of the process with gener-
-#           ated the packet
-# NFLOG
-#     This target pass the packet to loaded logging
-#     backend to log the packet. One or more userspace
-#     processes may subscribe to the group to receive
-#     the packets.
-#
-# ULOG
-#     This target provides userspace logging of maching
-#     packets. One or more userspace processes may then
-#     then subscribe to various multicast groups and
-#     then receive the packets.
-#
-#
-# Commands
-#
-# -A, --append chain rule-specification
-# -C, --check chain rule-specification
-# -D, --delete chain rule-specification
-# -D, --delete chain rulenum
-# -I, --insert chain [rulenum] rule-specification
-# -R, --replace chain rulenum rule-specification
-# -L, --list [chain]
-# -P, --policy chain target
-#
-# Parameters
-#
-# -p, --protocol protocol
-#       tcp, udp, udplite, icmp, esp, ah, sctp, all
-# -s, --source address[/mask][,...]
-# -d, --destination address[/mask][,...]
-# -j, --jump target
-# -g, --goto chain
-# -i, --in-interface name
-# -o, --out-interface name
-# -f, --fragment
-# -m, --match options module-name
-#       iptables can use extended packet matching
-#       modules.
-# -c, --set-counters packets bytes
-
-IPT="/usr/sbin/iptables"
-SPAMLIST="blockedip"
-SPAMDROPMSG="BLOCKED IP DROP"
-
-PUB_IF="wlp7s0"
-#PRIV_IF="wlp3s0"
-
-BRIDGE="br0"
-BNET=10.0.0.0
-BMSK=24
-
-DHCP_IP="192.168.1.254"
-PUB_IP=$(ip addr show dev ${PUB_IF} | grep 'state UP' -A2 | tail -n1 | awk '{print $2}' | cut -f1 -d'/')
-
-modprobe ip_conntrack
-modprobe ip_conntrack_ftp
-
-echo "Stopping ipv4 firewall and deny everyone..."
-
-iptables -F
-iptables -X
-iptables -t nat -F
-iptables -t nat -X
-iptables -t mangle -F
-iptables -t mangle -X
-iptables -t raw -F
-iptables -t raw -X
-iptables -t security -F
-iptables -t security -X
-
-
-echo "Starting ipv4 firewall filter table..."
-
-# Set Default Rules
-iptables -P INPUT DROP
-iptables -P FORWARD DROP
-iptables -P OUTPUT DROP
-
-
-# Unlimited on local
-$IPT -A INPUT -i lo -j ACCEPT
-$IPT -A OUTPUT -o lo -j ACCEPT
-
-$IPT -A INPUT -i $BRIDGE -j ACCEPT
-$IPT -A OUTPUT -o $BRIDGE -j ACCEPT
-
-# Block sync
-$IPT -A INPUT -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: "
-$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
-
-# Block Fragments
-$IPT -A INPUT -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: "
-$IPT -A INPUT -f -j DROP
-
-# Block bad stuff
-$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
-$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
-
-$IPT -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: "
-$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # NULL packets
-
-$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: "
-$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-
-$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: "
-$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS
-
-$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: "
-$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans
-
-$IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
-
-##### Add your virtual rules below ######
-
-#echo 1 > /proc/sys/net/ipv4/ip_forward
-#$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP}
-##$IPT -t nat -A POSTROUTING -s 10.0.2.0/24 -o ${PUB_IF} -j MASQUERADE
-#$IPT -A FORWARD -i ${TAP_IF} -o ${PUB_IF} -j ACCEPT
-#$IPT -A FORWARD -i ${PUB_IF} -o ${TAP_IF} -j ACCEPT
-#
-#$IPT -A INPUT -i ${TAP_IF} -j ACCEPT
-#$IPT -A OUTPUT -o ${TAP_IF} -j ACCEPT
-
-##### Add your AP rules below ######
-
-#echo 1 > /proc/sys/net/ipv4/ip_forward
-#$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP}
-#$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -j ACCEPT
-#$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -j ACCEPT
-
-#$IPT -A INPUT -i ${PRIV_IF} -j ACCEPT
-#$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT
-
-##### Server rules below ######
-
-#echo "Allow ICMP"
-#$IPT -A INPUT -i ${PUB_IF} -p icmp --icmp-type 0 -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p icmp --icmp-type 0 -d 192.168.0.0/16 -j ACCEPT
-#$IPT -A INPUT -i ${PUB_IF} -p icmp --icmp-type 8 -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p icmp --icmp-type 8 -d 192.168.0.0/16 -j ACCEPT
-
-#echo "Allow DNS Server"
-#$IPT -A INPUT -i ${PUB_IF} -p udp --sport 1024:65535 --dport 53  -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -d 192.168.0.0/16 -j ACCEPT
-
-#echo "Allow HTTP and HTTPS server"
-#$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 443 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 80 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 80 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 443 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-
-#echo "Allow ssh server"
-#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-#$IPT -A INPUT  -i ${PUB_IF} -p tcp --dport 22 -m state --state ESTABLISHED -j ACCEPT
-#$IPT -A INPUT  -i ${PUB_IF} -p tcp --dport 22 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT
-
-##### Add your rules below ######
-
-echo "Allow DNS Client"
-
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 53 -m state --state NEW -j LOG --log-level 7 --log-prefix "iptables: DNS TCP: "
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 53 -m state --state NEW -j ACCEPT -j LOG --log-level 7 --log-prefix "iptables: DNS UDP: "
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow Whois Client"
-
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 43 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 43 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow HTTP Client"
-
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-
-echo "Allow Rsync Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 873 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow POP3S Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow SMTPS Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 465 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 465 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow NTP Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 123 -m state --state ESTABLISHED -j ACCEPT
-
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow IRC Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 6667 -m state --state NEW -j ACCEPT
-
-echo "Allow Active FTP Client"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 20 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow Git"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 9418 -m state --state NEW -j ACCEPT
-
-echo "Allow ssh client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT  -i ${PUB_IF} -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-
-#echo "Allow Passive Connections"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024:  -m state --state ESTABLISHED,RELATED -j ACCEPT
-
-# echo "Allow FairCoin"
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 46392 -m state --state NEW,ESTABLISHED -j ACCEPT
-# $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 46392 -m state --state ESTABLISHED -j ACCEPT
-#
-# echo "Allow Dashcoin"
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 29080 -m state --state NEW,ESTABLISHED -j ACCEPT
-# $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 29080 -m state --state ESTABLISHED -j ACCEPT
-#
-# echo "Allow warzone2100"
-# $IPT -A INPUT -i ${PUB_IF} -p tcp --dport 2100 -s 192.168.0.0/16 -j ACCEPT
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 2100 -j ACCEPT
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 2100 -j ACCEPT
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 9990 -j ACCEPT
-#
- echo "Allow wesnoth"
- $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 15000 -m state --state NEW -j ACCEPT
- $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 14998 -m state --state NEW -j ACCEPT
-
-##### END your rules ############
-# Less log of known traffic
-
-# RIP protocol
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -s 192.168.0.0/16 -j DROP
-
-# DHCP
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -d $DHCP_IP -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 68 --dport 67 -s $DHCP_IP -j ACCEPT
-
-# log everything else and drop
-$IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: "
-$IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: "
-$IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: "
-
-exit 0
diff --git a/tools/storage.html b/tools/storage.html
index 97b73b0..894873b 100644
--- a/tools/storage.html
+++ b/tools/storage.html
@@ -5,14 +5,33 @@
         <title>Storage</title>
     </head>
     <body>
-
         <a href="index.html">Tools Index</a>
 
         <h1>Storage</h1>
 
-        <h2 id="mv">1. Moving partitions</h2>
+        <h2 id="maint">1. Maintenance</h2>
+
+        <p>SMART provides statistics of disk firmware, this system
+        handle errors has their occur. Badblocks detect bad blocks
+        by writing and reading from disk in a destructive test.
+        Example of how to view SMART statistics of a disk;</p>
+
+        <pre>
+        # smartctl -t long /dev/sdb1
+        # smartctl -a /dev/sdb1 | less
+        </pre>
+
+        <p>Search for bad blocks using
+        <a href="https://wiki.archlinux.org/index.php/Badblocks">non destructive test;</a></p>
+
+        <pre>
+        # badblocks -nsv /dev/sdb1
+        </pre>
+
+        <h2 id="mv">2. Moving data</h2>
 
         <p>Reboot into single-user mode where services aren't started and networking is offline.<p>
+
         <pre>
         # init 1
         </pre>