From 2f30196609c9ef1c7e0b03fc0f6a7a60c0c5526e Mon Sep 17 00:00:00 2001
From: Silvino Silva <silvino@bk.ru>
Date: Sun, 25 Sep 2016 01:03:53 +0100
Subject: network revision

---
 core/conf/rc.d/iptables          |  50 +++++-
 core/conf/rc.d/net               |   2 -
 core/network.html                |  33 +++-
 tools/conf/etc/dnsmasq.conf      |  22 ++-
 tools/conf/etc/rc.d/blan         |  63 +++++++
 tools/index.html                 |  38 ++---
 tools/network.html               |  46 +++++
 tools/qemu.html                  |  70 ++++----
 tools/scripts/iptables.sh        | 337 ------------------------------------
 tools/scripts/system-iptables.sh | 361 +++++++++++++++++++++++++++++++++++++++
 tools/scripts/system-qemu.sh     |  15 ++
 11 files changed, 628 insertions(+), 409 deletions(-)
 create mode 100755 tools/conf/etc/rc.d/blan
 create mode 100644 tools/network.html
 delete mode 100644 tools/scripts/iptables.sh
 create mode 100644 tools/scripts/system-iptables.sh
 create mode 100644 tools/scripts/system-qemu.sh

diff --git a/core/conf/rc.d/iptables b/core/conf/rc.d/iptables
index 2d77722..3f29928 100644
--- a/core/conf/rc.d/iptables
+++ b/core/conf/rc.d/iptables
@@ -1,12 +1,12 @@
 #!/bin/sh
 #
-# /etc/rc.d/iptables: load/unload iptable rules  
+# /etc/rc.d/iptables: load/unload iptable rules
 #
 
 case $1 in
 start)
   	echo "Starting IPv4 firewall filter table..."
-	/usr/sbin/iptables-restore < /etc/iptables/rules.v4	
+	/usr/sbin/iptables-restore < /etc/iptables/rules.v4
 	;;
 stop)
 	echo "Stopping firewall and deny everyone..."
@@ -21,16 +21,60 @@ stop)
         iptables -t security -F
         iptables -t security -X
 
-
         /usr/sbin/iptables -P INPUT DROP
         /usr/sbin/iptables -P FORWARD DROP
         /usr/sbin/iptables -P OUTPUT DROP
+
+	# Unlimited on local
+	/usr/sbin/iptables -A INPUT -i lo -j ACCEPT
+	/usr/sbin/iptables -A OUTPUT -o lo -j ACCEPT
+
+	# log everything else and drop
+	/usr/sbin/iptables -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: "
+	/usr/sbin/iptables -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: "
+	/usr/sbin/iptables -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: "
+
+	;;
+open)
+	echo "Outgoing Open firewall and deny everyone..."
+        iptables -F
+        iptables -X
+        iptables -t nat -F
+        iptables -t nat -X
+        iptables -t mangle -F
+        iptables -t mangle -X
+        iptables -t raw -F
+        iptables -t raw -X
+        iptables -t security -F
+        iptables -t security -X
+
+        /usr/sbin/iptables -P INPUT DROP
+        /usr/sbin/iptables -P FORWARD DROP
+        /usr/sbin/iptables -P OUTPUT ACCEPT
+
+	# Unlimited on local
+	/usr/sbin/iptables -A INPUT -i lo -j ACCEPT
+	/usr/sbin/iptables -A OUTPUT -o lo -j ACCEPT
+
+	# Accept passive
+	/usr/sbin/iptables -A INPUT -p tcp --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+	/usr/sbin/iptables -A INPUT -p udp --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+
+	# log everything else and drop
+	/usr/sbin/iptables -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: "
+	#/usr/sbin/iptables -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: "
+	/usr/sbin/iptables -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: "
+
 	;;
+
 restart)
 	$0 stop
 	$0 start
 	;;
 *)
+
 	echo "usage: $0 [start|stop|restart]"
 	;;
 esac
diff --git a/core/conf/rc.d/net b/core/conf/rc.d/net
index 2b94af0..d46583b 100755
--- a/core/conf/rc.d/net
+++ b/core/conf/rc.d/net
@@ -31,8 +31,6 @@ case $1 in
 			/usr/bin/pkill -F /var/run/dhcpcd-${DEV}.pid
 
 		else
-			# /sbin/ip route del default
-			/sbin/ip route flush dev ${DEV}
 			/sbin/ip link set ${DEV} down
 			/sbin/ip addr flush dev ${DEV}
 		fi
diff --git a/core/network.html b/core/network.html
index 39fc9c2..ce4643b 100644
--- a/core/network.html
+++ b/core/network.html
@@ -23,9 +23,9 @@
             connection to router and add as default gateway.</dd>
         </dl>
 
-	<p>If is first boot after install configure iptables and
-	one of above described scripts then proceed to upgrade your
-	system.</p>
+        <p>If is first boot after install configure iptables and
+        one of above described scripts then proceed to upgrade your
+        system.</p>
 
         <h2 id="resolv">2.1.1. Resolver</h2>
 
@@ -113,8 +113,16 @@
         configure nat and filtering;</p>
 
         <pre>
+<<<<<<< HEAD
         # mkdir /etc/iptables
         # cp c9-doc/core/scripts/iptables.sh /etc/iptables/
+=======
+        DEV=tap0
+        ADDR=10.0.0.1
+        NET=10.0.0.0
+        MASK=24
+        GW=10.0.0.1
+>>>>>>> core network revision
         </pre>
 
         <p>Adjust iptables to your needs, then;</p>
@@ -129,9 +137,22 @@
         let drop when you call stop.</p>
 
         <pre>
+<<<<<<< HEAD
         # cp c9-doc/core/conf/rc.d/iptables /etc/rc.d/
         # vim /etc/rc.d/iptables
         # chmod +x /etc/rc.d/iptables
+=======
+        # ip link add name ${DEV} type bridge
+        # ip link set dev ${DEV} up
+
+        # ip addr add ${ADDR}/${MASK} dev ${DEV} broadcast 10.0.0.255
+        # ip addr add 0.0.0.0/${MASK} dev ${DEV} broadcast +
+
+        # ip tuntap add ${TAP} mode tap group kvm
+        # ip link set dev ${TAP} up
+
+        # ip link set dev ${TAP} master ${DEV}
+>>>>>>> core network revision
         </pre>
 
         <p>Re-configure your rc.conf and add iptables before (w)lan is up;</p>
@@ -187,10 +208,10 @@
         </pre>
 
         <p>Use <a href="conf/rc.d/wlan">/etc/rc.d/wlan</a>
-	init script to auto load wpa configuration and dhcp
+        init script to auto load wpa configuration and dhcp
         client.</p>
 
-	<h3>2.1.4.2. Wpa Cli</h3>
+        <h3>2.1.4.2. Wpa Cli</h3>
 
         <pre>
         # wpa_cli
@@ -345,7 +366,7 @@
         <p>Change to act as a router (default of conf/sysctl.conf);</p>
 
         <pre>
-    	# Act as a router, necessary for Access Point
+        # Act as a router, necessary for Access Point
         net.ipv4.ip_forward = 1
         net.ipv4.conf.all.send_redirects = 1
         net.ipv4.conf.default.send_redirects = 1
diff --git a/tools/conf/etc/dnsmasq.conf b/tools/conf/etc/dnsmasq.conf
index 35d75c8..f09b6a6 100644
--- a/tools/conf/etc/dnsmasq.conf
+++ b/tools/conf/etc/dnsmasq.conf
@@ -8,6 +8,7 @@
 # (53). Setting this to zero completely disables DNS function,
 # leaving only DHCP and/or TFTP.
 #port=5353
+port=53
 
 # The following two options make you a better netizen, since they
 # tell dnsmasq to filter out queries which the public DNS cannot
@@ -74,7 +75,7 @@ server=127.0.0.1#40
 
 # Add local-only domains here, queries in these domains are answered
 # from /etc/hosts or DHCP only.
-#local=/localnet/
+local=/core/
 
 # Add domains which you want to force to an IP address here.
 # The example below send any host in double-click.net to a local
@@ -106,16 +107,20 @@ server=127.0.0.1#40
 # specified interfaces (and the loopback) give the name of the
 # interface (eg eth0) here.
 # Repeat the line for more than one interface.
-#interface=
+interface=lo
+interface=br0
+
 # Or you can specify which interface _not_ to listen on
-#except-interface=
+except-interface=wlp7s0
 # Or which to listen on by address (remember to include 127.0.0.1 if
 # you use this.)
-#listen-address=
+listen-address=127.0.0.1
+#listen-address=10.0.0.1
 # If you want dnsmasq to provide only DNS service on an interface,
 # configure it as shown above, and then use the following line to
 # disable DHCP and TFTP on it.
-#no-dhcp-interface=
+no-dhcp-interface=lo
+no-dhcp-interface=wlp7s0
 
 # On systems which support it, dnsmasq binds the wildcard address,
 # even when it is listening on only some interfaces. It then discards
@@ -124,7 +129,7 @@ server=127.0.0.1#40
 # want dnsmasq to really bind only the interfaces it is listening on,
 # uncomment this option. About the only time you may need this is when
 # running another nameserver on the same machine.
-#bind-interfaces
+bind-interfaces
 
 # If you don't want dnsmasq to read /etc/hosts, uncomment the
 # following line.
@@ -136,7 +141,7 @@ addn-hosts=/etc/hosts.dnsmasq
 
 # Set this (and domain: see below) if you want to have a domain
 # automatically added to simple names in a hosts-file.
-#expand-hosts
+expand-hosts
 
 # Set the domain for dnsmasq. this is optional, but if it is set, it
 # does the following things.
@@ -145,7 +150,7 @@ addn-hosts=/etc/hosts.dnsmasq
 # 2) Sets the "domain" DHCP option thereby potentially setting the
 #    domain of all systems configured by DHCP
 # 3) Provides the domain part for "expand-hosts"
-#domain=thekelleys.org.uk
+domain=core.privat-network.net
 
 # Set a different domain for a particular subnet
 #domain=wireless.thekelleys.org.uk,192.168.2.0/24
@@ -159,6 +164,7 @@ addn-hosts=/etc/hosts.dnsmasq
 # repeat this for each network on which you want to supply DHCP
 # service.
 #dhcp-range=192.168.0.50,192.168.0.150,12h
+dhcp-range=br0,10.0.0.5,10.0.0.50,12h
 
 # This is an example of a DHCP range where the netmask is given. This
 # is needed for networks we reach the dnsmasq DHCP server via a relay
diff --git a/tools/conf/etc/rc.d/blan b/tools/conf/etc/rc.d/blan
new file mode 100755
index 0000000..f75d272
--- /dev/null
+++ b/tools/conf/etc/rc.d/blan
@@ -0,0 +1,63 @@
+#!/bin/sh
+#
+# /etc/rc.d/net: start/stop network interface
+#
+
+DEV="br0"
+PHY="enp8s0"
+
+ADDR=10.0.0.1
+NET=10.0.0.0
+MASK=24
+GTW=10.0.0.1
+NTAPS=$((`/usr/bin/nproc`-1))
+
+case $1 in
+	start)
+                /sbin/ip link add name ${DEV} type bridge
+                /sbin/ip link set dev ${DEV} up
+
+                /bin/sleep 0.2s
+                /sbin/ip route flush dev ${PHY}
+                /sbin/ip addr flush dev ${PHY}
+                /sbin/ip link set dev ${PHY} master ${DEV}
+
+                /sbin/ip addr add ${ADDR}/${MASK} dev ${DEV} broadcast +
+
+                for i in `/usr/bin/seq $NTAPS`
+                do
+                    TAP="tap$i"
+                    echo $TAP
+                    /sbin/ip tuntap add ${TAP} mode tap group kvm
+                    /sbin/ip link set ${TAP} up
+                    /bin/sleep 0.2s
+                    #brctl addif $switch $1
+                    /sbin/ip link set ${TAP} master ${DEV}
+                done
+
+		exit 0
+		;;
+	stop)
+
+                for i in `/usr/bin/seq $NTAPS`
+                do
+                    TAP="tap$i"
+		    /sbin/ip link del ${TAP}
+                    echo $TAP
+                done
+
+       		/sbin/ip link set dev ${DEV} down
+		/sbin/ip route flush dev ${DEV}
+		/sbin/ip link del ${DEV}
+		exit 0
+		;;
+	restart)
+		$0 stop
+		$0 start
+		;;
+	*)
+		echo "Usage: $0 [start|stop|restart]"
+		;;
+esac
+
+# End of file
diff --git a/tools/index.html b/tools/index.html
index bf317e1..407d212 100644
--- a/tools/index.html
+++ b/tools/index.html
@@ -68,12 +68,12 @@
         <h2>System Administration</h2>
 
         <ul>
-            <li><a href="network.html">Network</a>
+            <li><a href="network.html">Network Tools</a>
                 <ul>
-                    <li><a href="dnsmasq.html">1. Dnscrypt and Dnsmasq</a></li>
-                    <li><a href="tcpdump.html">2. Tcpdump</a></li>
-                    <li><a href="wireless.html">Wireless</a></li>
+                    <li><a href="dnsmasq.html">Dnscrypt and Dnsmasq</a></li>
+                    <li><a href="tcpdump.html">Tcpdump</a></li>
                     <li><a href="nmap.html">Nmap</a></li>
+                    <li><a href="wireless.html">Wireless</a></li>
                 </ul>
             </li>
             <li><a href="storage.html">Storage</a>
@@ -120,29 +120,29 @@
             <li>
                 <a href="openssh.html">OpenSSH</a>
                 <ul>
-                    <li><a href="openssh.html#sshd">Server</a></li>
-                    <li><a href="openssh.html#sshdconf">Configure Server</a></li>
-                    <li><a href="openssh.html#ssh">Client</a></li>
-                    <li><a href="openssh.html#reverse">Reverse connection</a></li>
+                    <li><a href="openssh.html#sshd">1. Server</a></li>
+                    <li><a href="openssh.html#sshdconf">2. Configure Server</a></li>
+                    <li><a href="openssh.html#ssh">3. Client</a></li>
+                    <li><a href="openssh.html#reverse">4. Reverse connection</a></li>
                 </ul>
             </li>
             <li><a href="gitolite.html">Gitolite</a>
                 <ul>
-                    <li><a href="gitolite.html#install">Install Gitolite</a></li>
-                    <li><a href="gitolite.html#config">Configure Gitolite</a></li>
-                    <li><a href="gitolite.html#admin">Gitolite Administration</a></li>
-                    <li><a href="gitolite.html#hooks">Gitolite Hooks</a></li>
+                    <li><a href="gitolite.html#install">1. Install Gitolite</a></li>
+                    <li><a href="gitolite.html#config">2. Configure Gitolite</a></li>
+                    <li><a href="gitolite.html#admin">3. Gitolite Administration</a></li>
+                    <li><a href="gitolite.html#hooks">4. Gitolite Hooks</a></li>
                 </ul>
             </li>
             <li><a href="postgresql.html">Postgresql</a>
                 <ul>
-                    <li><a href="postgresql.html#install">Install Postgresql</a></li>
-                    <li><a href="postgresql.html#config">Configure Server</a></li>
-                    <li><a href="postgresql.html#createuser">Create User</a></li>
-                    <li><a href="postgresql.html#createdb">Create Database</a></li>
-                    <li><a href="postgresql.html#dropdb">Drop Database</a></li>
-                    <li><a href="postgresql.html#dropuser">Drop User</a></li>
-                    <li><a href="postgresql.html#psql">Psql</a></li>
+                    <li><a href="postgresql.html#install">1. Install Postgresql</a></li>
+                    <li><a href="postgresql.html#config">2. Configure Server</a></li>
+                    <li><a href="postgresql.html#createuser">3. Create User</a></li>
+                    <li><a href="postgresql.html#createdb">4. Create Database</a></li>
+                    <li><a href="postgresql.html#dropdb">5. Drop Database</a></li>
+                    <li><a href="postgresql.html#dropuser">6. Drop User</a></li>
+                    <li><a href="postgresql.html#psql">7. Psql</a></li>
                 </ul>
             </li>
             <li><a href="nginx.html">Nginx</a>
diff --git a/tools/network.html b/tools/network.html
new file mode 100644
index 0000000..5e4a481
--- /dev/null
+++ b/tools/network.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<html dir="ltr" lang="en">
+    <head>
+        <meta charset='utf-8'>
+        <title>Network Tools</title>
+    </head>
+    <body>
+
+        <a href="index.html">Tools Index</a>
+
+        <h1>Network Tools</h1>
+
+        <h2 id="bridge">Bridges</h2>
+
+        <p>See <a href="conf/etc/rc.d/blan">/etc/rc.d/blan</a> on
+        how to create interfaces at startup or as source to do it
+        in automatic way;</p>
+
+        <pre>
+        DEV="br0"
+        PHY="enp8s0"
+        </pre>
+
+        <pre>
+        # ip link add name ${DEV} type bridge
+        # ip link set dev ${DEV} up
+        </pre>
+        <pre>
+        # ip route flush dev ${PHY}
+        # ip addr flush dev ${PHY}
+        # ip link set dev ${PHY} master ${DEV}
+        </pre>
+
+        <pre>
+        # ip addr add ${ADDR}/${MASK} dev ${DEV} broadcast +
+        </pre>
+
+        <a href="index.html">Tools Index</a>
+        <p>This is part of the c9 Manual.
+        Copyright (C) 2016
+        c9 team.
+        See the file <a href="../fdl-1.3-standalone.html">Gnu Free Documentation License</a>
+        for copying conditions.</p>
+
+    </body>
+</html>
diff --git a/tools/qemu.html b/tools/qemu.html
index ce1b66d..8c53ce7 100644
--- a/tools/qemu.html
+++ b/tools/qemu.html
@@ -97,45 +97,53 @@
             <dd>The VDE networking backend.</dd>
         </dl>
 
-
-        <h3>2.1. Tap interfaces</h3>
-
         <pre>
         KERNEL=="tun", GROUP="kvm", MODE="0660", OPTIONS+="static_node=net/tun"
         </pre>
 
-        <p>Automatic creation of tap interface with
-        correct permissions set for user and group,
-        you can set only user or group;</p>
 
-        <pre>
-        # tunctl -u username -g kvm -t tap0
-        </pre>
+        <h3>2.1. Public Bridge</h3>
 
-        <p>Set permissions to existing tap interface;</p>
+        <p>Create <a href="network.html#bridge">bridge</a>, create new
+        tap and add it to bridge;</p>
 
         <pre>
-        # tunctl -u username -t tap0
+        # DEV="br0"
+        # TAP="tap5"
         </pre>
 
-
-        <p>Manual creation of tap interface;</p>
+        <pre>
+        # ip tuntap add ${TAP} mode tap group kvm
+        # ip link set ${TAP} up
+        </pre>
 
         <pre>
-        # ip tuntap add name tap0 mode tap
-        # chmod 0666 /dev/tap0
-        # chown root:username /dev/tap0
+        # ip link set ${TAP} master ${DEV}
         </pre>
 
+        <p>See <a href="scripts/system-qemu.sh">scripts/system-qemu.sh</a>,
+        as template. Run virtual machine that uses above tap device;</p>
+
         <pre>
-        # ip addr add 10.0.2.1/24 dev tap0
-        # ip link set dev tap0 up
-        # ip link show
+        $ ISO=~/crux-3.2.iso
+        $ IMG=~/crux-img.qcow2
+
+        $ qemu-system-x86_64 \
+            -enable-kvm \
+            -m 1024 \
+            -boot d \
+            -cdrom ${ISO} \
+            -hda ${IMG} \
+            -net nic,model=virtio -net tap,ifname=${TAP},script=no,downscript=no
         </pre>
 
+        <h3>2.2. Routing</h3>
+
+        <p>Create interface with correct permissions set for kvm group.</p>
+
         <pre>
         # sysctl -w net.ipv4.ip_forward=1
-        # iptables -t nat -A POSTROUTING -s 10.0.2.0/24 -o eth0 -j MASQUERADE
+        # iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
         </pre>
 
         <h2 id="guest">Guest System</h2>
@@ -143,22 +151,16 @@
         <p>Start qemu with 512 of ram, mydisk.img as disk and boot from iso</p>
 
         <pre>
-        $ qemu-system-x86_64 \
-        -enable-kvm \
-        -m 512 \
-        -boot d -cdrom image.iso \
-        -hda mydisk.img
-        </pre>
+        $ ISO=~/crux-3.2.iso
+        $ IMG=~/crux-img.qcow2
 
-        <p>Start qemu with 1024 of ram, network configured using tap0
-        interface device no host and boot from crux.qcow2;</p>
-
-        <pre>
         $ qemu-system-x86_64 \
-        -enable-kvm \
-        -m 1024 \
-        -hda c9/local/crux.qcow2 \
-        -net nic,model=virtio -net tap,ifname=tap0,script=no,downscript=no
+            -enable-kvm \
+            -m 1024 \
+            -boot d \
+            -cdrom ${ISO} \
+            -hda ${IMG} \
+            -net nic,model=virtio -net tap,ifname=${TAP},script=no,downscript=no
         </pre>
 
         <a href="index.html">Tools Index</a>
diff --git a/tools/scripts/iptables.sh b/tools/scripts/iptables.sh
deleted file mode 100644
index 3215633..0000000
--- a/tools/scripts/iptables.sh
+++ /dev/null
@@ -1,337 +0,0 @@
-#!/bin/sh
-
-#
-#                                XXXXXXXXXXXXXXXXX
-#                                XXXX Network XXXX
-#                                XXXXXXXXXXXXXXXXX
-#                                        +
-#                                        |
-#                                        v
-#  +-------------+              +------------------+
-#  |table: filter| <---+        | table: nat       |
-#  |chain: INPUT |     |        | chain: PREROUTING|
-#  +-----+-------+     |        +--------+---------+
-#        |             |                 |
-#        v             |                 v
-#  [local process]     |           ****************          +--------------+
-#        |             +---------+ Routing decision +------> |table: filter |
-#        v                         ****************          |chain: FORWARD|
-# ****************                                           +------+-------+
-# Routing decision                                                  |
-# ****************                                                  |
-#        |                                                          |
-#        v                        ****************                  |
-# +-------------+       +------>  Routing decision  <---------------+
-# |table: nat   |       |         ****************
-# |chain: OUTPUT|       |               +
-# +-----+-------+       |               |
-#       |               |               v
-#       v               |      +-------------------+
-# +--------------+      |      | table: nat        |
-# |table: filter | +----+      | chain: POSTROUTING|
-# |chain: OUTPUT |             +--------+----------+
-# +--------------+                      |
-#                                       v
-#                               XXXXXXXXXXXXXXXXX
-#                               XXXX Network XXXX
-#                               XXXXXXXXXXXXXXXXX
-#
-# iptables [-t table] {-A|-C|-D} chain rule-specification
-#
-# iptables [-t table] {-A|-C|-D} chain  rule-specification
-#
-# iptables  [-t table] -I chain [rulenum] rule-specification
-#
-# iptables [-t table] -R chain rulenum  rule-specification
-#
-# iptables [-t table] -D chain rulenum
-#
-# iptables [-t table] -S [chain [rulenum]]
-#
-# iptables  [-t  table]  {-F|-L|-Z} [chain [rulenum]] [options...]
-#
-# iptables [-t table] -N chain
-#
-# iptables [-t table] -X [chain]
-#
-# iptables [-t table] -P chain target
-#
-# iptables [-t table]  -E  old-chain-name  new-chain-name
-#
-# rule-specification = [matches...] [target]
-#
-# match = -m matchname [per-match-options]
-#
-#
-# Targets
-#
-# can be a user defined chain
-#
-# ACCEPT - accepts the packet
-# DROP   - drop the packet on the floor
-# QUEUE  - packet will be stent to queue
-# RETURN - stop traversing this chain and
-#          resume ate the next rule in the
-#          previeus (calling) chain.
-#
-# if packet reach the end of the chain or
-# a target RETURN, default policy for that
-# chain is applayed.
-#
-# Target Extensions
-#
-# AUDIT
-# CHECKSUM
-# CLASSIFY
-# DNAT
-# DSCP
-# LOG
-#     Torn on kernel logging, will print some
-#     some information on all matching packets.
-#     Log data can be read with dmesg or syslogd.
-#     This is a non-terminating target and a rule
-#     should be created with matching criteria.
-#
-#     --log-level level
-#           Level of logging (numeric or see sys-
-#           log.conf(5)
-#
-#     --log-prefix prefix
-#           Prefix log messages with specified prefix
-#           up to 29 chars log
-#
-#     --log-uid
-#           Log the userid of the process with gener-
-#           ated the packet
-# NFLOG
-#     This target pass the packet to loaded logging
-#     backend to log the packet. One or more userspace
-#     processes may subscribe to the group to receive
-#     the packets.
-#
-# ULOG
-#     This target provides userspace logging of maching
-#     packets. One or more userspace processes may then
-#     then subscribe to various multicast groups and
-#     then receive the packets.
-#
-#
-# Commands
-#
-# -A, --append chain rule-specification
-# -C, --check chain rule-specification
-# -D, --delete chain rule-specification
-# -D, --delete chain rulenum
-# -I, --insert chain [rulenum] rule-specification
-# -R, --replace chain rulenum rule-specification
-# -L, --list [chain]
-# -P, --policy chain target
-#
-# Parameters
-#
-# -p, --protocol protocol
-#       tcp, udp, udplite, icmp, esp, ah, sctp, all
-# -s, --source address[/mask][,...]
-# -d, --destination address[/mask][,...]
-# -j, --jump target
-# -g, --goto chain
-# -i, --in-interface name
-# -o, --out-interface name
-# -f, --fragment
-# -m, --match options module-name
-#       iptables can use extended packet matching
-#       modules.
-# -c, --set-counters packets bytes
-
-IPT="/usr/sbin/iptables"
-SPAMLIST="blockedip"
-SPAMDROPMSG="BLOCKED IP DROP"
-PUB_IF="wlp7s0"
-DHCP_SERV="192.168.1.254"
-#PUB_IP="192.168.1.65"
-#PRIV_IF="wlp3s0"
-
-modprobe ip_conntrack
-modprobe ip_conntrack_ftp
-
-echo "Stopping ipv4 firewall and deny everyone..."
-
-iptables -F
-iptables -X
-iptables -t nat -F
-iptables -t nat -X
-iptables -t mangle -F
-iptables -t mangle -X
-iptables -t raw -F
-iptables -t raw -X
-iptables -t security -F
-iptables -t security -X
-
-
-echo "Starting ipv4 firewall filter table..."
-
-# Set Default Rules
-iptables -P INPUT DROP
-iptables -P FORWARD DROP
-iptables -P OUTPUT DROP
-
-# Unlimited on local
-$IPT -A INPUT -i lo -j ACCEPT
-$IPT -A OUTPUT -o lo -j ACCEPT
-
-# Block sync
-$IPT -A INPUT -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: "
-$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
-
-# Block Fragments
-$IPT -A INPUT -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: "
-$IPT -A INPUT -f -j DROP
-
-# Block bad stuff
-$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
-$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
-
-$IPT -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: "
-$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # NULL packets
-
-$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: "
-$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-
-$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: "
-$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS
-
-$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: "
-$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans
-
-$IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
-
-##### Add your AP rules below ######
-
-#echo 1 > /proc/sys/net/ipv4/ip_forward
-#$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP}
-#$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -j ACCEPT
-#$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -j ACCEPT
-
-#$IPT -A INPUT -i ${PRIV_IF} -j ACCEPT
-#$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT
-
-##### Server rules below ######
-
-#echo "Allow ICMP"
-#$IPT -A INPUT -i ${PUB_IF} -p icmp --icmp-type 0 -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p icmp --icmp-type 0 -d 192.168.0.0/16 -j ACCEPT
-#$IPT -A INPUT -i ${PUB_IF} -p icmp --icmp-type 8 -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p icmp --icmp-type 8 -d 192.168.0.0/16 -j ACCEPT
-
-#echo "Allow DNS Server"
-#$IPT -A INPUT -i ${PUB_IF} -p udp --sport 1024:65535 --dport 53  -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -d 192.168.0.0/16 -j ACCEPT
-
-#echo "Allow HTTP and HTTPS server"
-#$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 443 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 80 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 80 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 443 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-
-#echo "Allow ssh server"
-#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-#$IPT -A INPUT  -i ${PUB_IF} -p tcp --dport 22 -m state --state ESTABLISHED -j ACCEPT
-#$IPT -A INPUT  -i ${PUB_IF} -p tcp --dport 22 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT
-
-##### Add your rules below ######
-
-echo "Allow DNS Client"
-
-#$IPT -A INPUT -i ${PUB_IF} -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-#$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow Whois Client"
-
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 43 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 43 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow HTTP Client"
-
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-
-echo "Allow Rsync Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 873 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow POP3S Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow SMTPS Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 465 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 465 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow NTP Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 123 -m state --state ESTABLISHED -j ACCEPT
-
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow IRC Client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 6667 -m state --state NEW -j ACCEPT
-
-echo "Allow Active FTP Client"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 20 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow Git"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 9418 -m state --state NEW -j ACCEPT
-
-echo "Allow ssh client"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A INPUT  -i ${PUB_IF} -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-
-#echo "Allow Passive Connections"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024:  -m state --state ESTABLISHED,RELATED -j ACCEPT
-
-
-# echo "Allow FairCoin"
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 46392 -m state --state NEW,ESTABLISHED -j ACCEPT
-# $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 46392 -m state --state ESTABLISHED -j ACCEPT
-# 
-# echo "Allow Dashcoin"
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 29080 -m state --state NEW,ESTABLISHED -j ACCEPT
-# $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 29080 -m state --state ESTABLISHED -j ACCEPT
-# 
-# echo "Allow warzone2100"
-# $IPT -A INPUT -i ${PUB_IF} -p tcp --dport 2100 -s 192.168.0.0/16 -j ACCEPT
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 2100 -j ACCEPT
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 2100 -j ACCEPT
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 9990 -j ACCEPT
-# 
-# echo "Allow wesnoth"
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 15000 -m state --state NEW -j ACCEPT
-# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 14998 -m state --state NEW -j ACCEPT
-
-##### END your rules ############
-# Less log of known traffic
-
-# RIP protocol
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -s 192.168.0.0/16 -j DROP
-
-# DHCP
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -d $DHCP_SERV -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 68 --dport 67 -s $DHCP_SERV -j ACCEPT
-
-# log everything else and drop
-$IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: "
-$IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: "
-$IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: "
-
-exit 0
diff --git a/tools/scripts/system-iptables.sh b/tools/scripts/system-iptables.sh
new file mode 100644
index 0000000..4ec3b79
--- /dev/null
+++ b/tools/scripts/system-iptables.sh
@@ -0,0 +1,361 @@
+#!/bin/sh
+
+#
+#                                XXXXXXXXXXXXXXXXX
+#                                XXXX Network XXXX
+#                                XXXXXXXXXXXXXXXXX
+#                                        +
+#                                        |
+#                                        v
+#  +-------------+              +------------------+
+#  |table: filter| <---+        | table: nat       |
+#  |chain: INPUT |     |        | chain: PREROUTING|
+#  +-----+-------+     |        +--------+---------+
+#        |             |                 |
+#        v             |                 v
+#  [local process]     |           ****************          +--------------+
+#        |             +---------+ Routing decision +------> |table: filter |
+#        v                         ****************          |chain: FORWARD|
+# ****************                                           +------+-------+
+# Routing decision                                                  |
+# ****************                                                  |
+#        |                                                          |
+#        v                        ****************                  |
+# +-------------+       +------>  Routing decision  <---------------+
+# |table: nat   |       |         ****************
+# |chain: OUTPUT|       |               +
+# +-----+-------+       |               |
+#       |               |               v
+#       v               |      +-------------------+
+# +--------------+      |      | table: nat        |
+# |table: filter | +----+      | chain: POSTROUTING|
+# |chain: OUTPUT |             +--------+----------+
+# +--------------+                      |
+#                                       v
+#                               XXXXXXXXXXXXXXXXX
+#                               XXXX Network XXXX
+#                               XXXXXXXXXXXXXXXXX
+#
+# iptables [-t table] {-A|-C|-D} chain rule-specification
+#
+# iptables [-t table] {-A|-C|-D} chain  rule-specification
+#
+# iptables  [-t table] -I chain [rulenum] rule-specification
+#
+# iptables [-t table] -R chain rulenum  rule-specification
+#
+# iptables [-t table] -D chain rulenum
+#
+# iptables [-t table] -S [chain [rulenum]]
+#
+# iptables  [-t  table]  {-F|-L|-Z} [chain [rulenum]] [options...]
+#
+# iptables [-t table] -N chain
+#
+# iptables [-t table] -X [chain]
+#
+# iptables [-t table] -P chain target
+#
+# iptables [-t table]  -E  old-chain-name  new-chain-name
+#
+# rule-specification = [matches...] [target]
+#
+# match = -m matchname [per-match-options]
+#
+#
+# Targets
+#
+# can be a user defined chain
+#
+# ACCEPT - accepts the packet
+# DROP   - drop the packet on the floor
+# QUEUE  - packet will be stent to queue
+# RETURN - stop traversing this chain and
+#          resume ate the next rule in the
+#          previeus (calling) chain.
+#
+# if packet reach the end of the chain or
+# a target RETURN, default policy for that
+# chain is applayed.
+#
+# Target Extensions
+#
+# AUDIT
+# CHECKSUM
+# CLASSIFY
+# DNAT
+# DSCP
+# LOG
+#     Torn on kernel logging, will print some
+#     some information on all matching packets.
+#     Log data can be read with dmesg or syslogd.
+#     This is a non-terminating target and a rule
+#     should be created with matching criteria.
+#
+#     --log-level level
+#           Level of logging (numeric or see sys-
+#           log.conf(5)
+#
+#     --log-prefix prefix
+#           Prefix log messages with specified prefix
+#           up to 29 chars log
+#
+#     --log-uid
+#           Log the userid of the process with gener-
+#           ated the packet
+# NFLOG
+#     This target pass the packet to loaded logging
+#     backend to log the packet. One or more userspace
+#     processes may subscribe to the group to receive
+#     the packets.
+#
+# ULOG
+#     This target provides userspace logging of maching
+#     packets. One or more userspace processes may then
+#     then subscribe to various multicast groups and
+#     then receive the packets.
+#
+#
+# Commands
+#
+# -A, --append chain rule-specification
+# -C, --check chain rule-specification
+# -D, --delete chain rule-specification
+# -D, --delete chain rulenum
+# -I, --insert chain [rulenum] rule-specification
+# -R, --replace chain rulenum rule-specification
+# -L, --list [chain]
+# -P, --policy chain target
+#
+# Parameters
+#
+# -p, --protocol protocol
+#       tcp, udp, udplite, icmp, esp, ah, sctp, all
+# -s, --source address[/mask][,...]
+# -d, --destination address[/mask][,...]
+# -j, --jump target
+# -g, --goto chain
+# -i, --in-interface name
+# -o, --out-interface name
+# -f, --fragment
+# -m, --match options module-name
+#       iptables can use extended packet matching
+#       modules.
+# -c, --set-counters packets bytes
+
+IPT="/usr/sbin/iptables"
+SPAMLIST="blockedip"
+SPAMDROPMSG="BLOCKED IP DROP"
+
+PUB_IF="wlp7s0"
+#PRIV_IF="wlp3s0"
+
+BRIDGE="br0"
+BNET=10.0.0.0
+BMSK=24
+
+DHCP_IP="192.168.1.254"
+PUB_IP=$(ip addr show dev ${PUB_IF} | grep 'state UP' -A2 | tail -n1 | awk '{print $2}' | cut -f1 -d'/')
+
+modprobe ip_conntrack
+modprobe ip_conntrack_ftp
+
+echo "Stopping ipv4 firewall and deny everyone..."
+
+iptables -F
+iptables -X
+iptables -t nat -F
+iptables -t nat -X
+iptables -t mangle -F
+iptables -t mangle -X
+iptables -t raw -F
+iptables -t raw -X
+iptables -t security -F
+iptables -t security -X
+
+
+echo "Starting ipv4 firewall filter table..."
+
+# Set Default Rules
+iptables -P INPUT DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT DROP
+
+
+# Unlimited on local
+$IPT -A INPUT -i lo -j ACCEPT
+$IPT -A OUTPUT -o lo -j ACCEPT
+
+$IPT -A INPUT -i $BRIDGE -j ACCEPT
+$IPT -A OUTPUT -o $BRIDGE -j ACCEPT
+
+# Block sync
+$IPT -A INPUT -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: "
+$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
+
+# Block Fragments
+$IPT -A INPUT -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: "
+$IPT -A INPUT -f -j DROP
+
+# Block bad stuff
+$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
+$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
+
+$IPT -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: "
+$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # NULL packets
+
+$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: "
+$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
+
+$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: "
+$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS
+
+$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: "
+$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans
+
+$IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
+
+##### Add your virtual rules below ######
+
+#echo 1 > /proc/sys/net/ipv4/ip_forward
+#$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP}
+##$IPT -t nat -A POSTROUTING -s 10.0.2.0/24 -o ${PUB_IF} -j MASQUERADE
+#$IPT -A FORWARD -i ${TAP_IF} -o ${PUB_IF} -j ACCEPT
+#$IPT -A FORWARD -i ${PUB_IF} -o ${TAP_IF} -j ACCEPT
+#
+#$IPT -A INPUT -i ${TAP_IF} -j ACCEPT
+#$IPT -A OUTPUT -o ${TAP_IF} -j ACCEPT
+
+##### Add your AP rules below ######
+
+#echo 1 > /proc/sys/net/ipv4/ip_forward
+#$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP}
+#$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -j ACCEPT
+#$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -j ACCEPT
+
+#$IPT -A INPUT -i ${PRIV_IF} -j ACCEPT
+#$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT
+
+##### Server rules below ######
+
+#echo "Allow ICMP"
+#$IPT -A INPUT -i ${PUB_IF} -p icmp --icmp-type 0 -s 192.168.0.0/16 -j ACCEPT
+#$IPT -A OUTPUT -o ${PUB_IF} -p icmp --icmp-type 0 -d 192.168.0.0/16 -j ACCEPT
+#$IPT -A INPUT -i ${PUB_IF} -p icmp --icmp-type 8 -s 192.168.0.0/16 -j ACCEPT
+#$IPT -A OUTPUT -o ${PUB_IF} -p icmp --icmp-type 8 -d 192.168.0.0/16 -j ACCEPT
+
+#echo "Allow DNS Server"
+#$IPT -A INPUT -i ${PUB_IF} -p udp --sport 1024:65535 --dport 53  -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
+#$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -d 192.168.0.0/16 -j ACCEPT
+
+#echo "Allow HTTP and HTTPS server"
+#$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 443 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
+#$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 80 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
+#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 80 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
+#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 443 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
+
+#echo "Allow ssh server"
+#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
+#$IPT -A INPUT  -i ${PUB_IF} -p tcp --dport 22 -m state --state ESTABLISHED -j ACCEPT
+#$IPT -A INPUT  -i ${PUB_IF} -p tcp --dport 22 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT
+
+##### Add your rules below ######
+
+echo "Allow DNS Client"
+
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A INPUT -i ${PUB_IF} -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 53 -m state --state NEW -j LOG --log-level 7 --log-prefix "iptables: DNS TCP: "
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 53 -m state --state NEW -j ACCEPT -j LOG --log-level 7 --log-prefix "iptables: DNS UDP: "
+$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+echo "Allow Whois Client"
+
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 43 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 43 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+echo "Allow HTTP Client"
+
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A INPUT -i ${PUB_IF} -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+
+echo "Allow Rsync Client"
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 873 -m state --state ESTABLISHED -j ACCEPT
+
+echo "Allow POP3S Client"
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT
+
+echo "Allow SMTPS Client"
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 465 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 465 -m state --state ESTABLISHED -j ACCEPT
+
+echo "Allow NTP Client"
+$IPT -A OUTPUT -o ${PUB_IF} -p udp --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A INPUT -i ${PUB_IF} -p udp --sport 123 -m state --state ESTABLISHED -j ACCEPT
+
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+echo "Allow IRC Client"
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 6667 -m state --state NEW -j ACCEPT
+
+echo "Allow Active FTP Client"
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 20 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+echo "Allow Git"
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 9418 -m state --state NEW -j ACCEPT
+
+echo "Allow ssh client"
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A INPUT  -i ${PUB_IF} -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
+
+#echo "Allow Passive Connections"
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024:  -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# echo "Allow FairCoin"
+# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 46392 -m state --state NEW,ESTABLISHED -j ACCEPT
+# $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 46392 -m state --state ESTABLISHED -j ACCEPT
+#
+# echo "Allow Dashcoin"
+# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 29080 -m state --state NEW,ESTABLISHED -j ACCEPT
+# $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 29080 -m state --state ESTABLISHED -j ACCEPT
+#
+# echo "Allow warzone2100"
+# $IPT -A INPUT -i ${PUB_IF} -p tcp --dport 2100 -s 192.168.0.0/16 -j ACCEPT
+# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 2100 -j ACCEPT
+# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 2100 -j ACCEPT
+# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 9990 -j ACCEPT
+#
+# echo "Allow wesnoth"
+# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 15000 -m state --state NEW -j ACCEPT
+# $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 14998 -m state --state NEW -j ACCEPT
+
+##### END your rules ############
+# Less log of known traffic
+
+# RIP protocol
+$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -s 192.168.0.0/16 -j DROP
+
+# DHCP
+$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -d $DHCP_IP -j ACCEPT
+$IPT -A INPUT -i ${PUB_IF} -p udp --sport 68 --dport 67 -s $DHCP_IP -j ACCEPT
+
+# log everything else and drop
+$IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: "
+$IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: "
+$IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: "
+
+exit 0
diff --git a/tools/scripts/system-qemu.sh b/tools/scripts/system-qemu.sh
new file mode 100644
index 0000000..8c68e70
--- /dev/null
+++ b/tools/scripts/system-qemu.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+ISO=~/crux-3.2.iso
+IMG=~/crux-img.qcow2
+
+TAP=$1
+
+echo "TAP: $TAP"
+
+qemu-system-x86_64 \
+    -enable-kvm \
+    -m 1024 \
+    -boot d \
+    -cdrom ${ISO} \
+    -hda ${IMG} \
+    -net nic,model=virtio -net tap,ifname=${TAP},script=no,downscript=no
-- 
cgit 1.4.1-2-gfad0