# Generated by iptables-save v1.8.7 on Thu Oct  1 12:44:10 2026
*raw
:PREROUTING ACCEPT [168359:164099205]
:OUTPUT ACCEPT [44760:29927778]
:out_dns_deal_conn_zone - [0:0]
:pre_dns_deal_conn_zone - [0:0]
:zone_guest_helper - [0:0]
:zone_iot_helper - [0:0]
:zone_lan_helper - [0:0]
-A PREROUTING -i br-lan -m comment --comment "!fw3: lan CT helper assignment" -j zone_lan_helper
-A PREROUTING -p udp -m udp --dport 53 -j pre_dns_deal_conn_zone
-A OUTPUT -p udp -j out_dns_deal_conn_zone
-A out_dns_deal_conn_zone ! -o lo -p udp -m udp --sport 2153 -j CT --zone 4096
-A pre_dns_deal_conn_zone ! -i lo -p udp -m mark --mark 0x1000/0xf000 -j CT --zone 4096
-A zone_guest_helper -p udp -m comment --comment "!fw3: Amanda backup and archiving proto" -m udp --dport 10080 -j CT --helper amanda
-A zone_guest_helper -p tcp -m comment --comment "!fw3: FTP passive connection tracking" -m tcp --dport 21 -j CT --helper ftp
-A zone_guest_helper -p udp -m comment --comment "!fw3: RAS proto tracking" -m udp --dport 1719 -j CT --helper RAS
-A zone_guest_helper -p tcp -m comment --comment "!fw3: Q.931 proto tracking" -m tcp --dport 1720 -j CT --helper Q.931
-A zone_guest_helper -p tcp -m comment --comment "!fw3: IRC DCC connection tracking" -m tcp --dport 6667 -j CT --helper irc
-A zone_guest_helper -p tcp -m comment --comment "!fw3: PPTP VPN connection tracking" -m tcp --dport 1723 -j CT --helper pptp
-A zone_guest_helper -p udp -m comment --comment "!fw3: SNMP monitoring connection tracking" -m udp --dport 161 -j CT --helper snmp
-A zone_guest_helper -p udp -m comment --comment "!fw3: TFTP connection tracking" -m udp --dport 69 -j CT --helper tftp
-A zone_iot_helper -p udp -m comment --comment "!fw3: Amanda backup and archiving proto" -m udp --dport 10080 -j CT --helper amanda
-A zone_iot_helper -p tcp -m comment --comment "!fw3: FTP passive connection tracking" -m tcp --dport 21 -j CT --helper ftp
-A zone_iot_helper -p udp -m comment --comment "!fw3: RAS proto tracking" -m udp --dport 1719 -j CT --helper RAS
-A zone_iot_helper -p tcp -m comment --comment "!fw3: Q.931 proto tracking" -m tcp --dport 1720 -j CT --helper Q.931
-A zone_iot_helper -p tcp -m comment --comment "!fw3: IRC DCC connection tracking" -m tcp --dport 6667 -j CT --helper irc
-A zone_iot_helper -p tcp -m comment --comment "!fw3: PPTP VPN connection tracking" -m tcp --dport 1723 -j CT --helper pptp
-A zone_iot_helper -p udp -m comment --comment "!fw3: SNMP monitoring connection tracking" -m udp --dport 161 -j CT --helper snmp
-A zone_iot_helper -p udp -m comment --comment "!fw3: TFTP connection tracking" -m udp --dport 69 -j CT --helper tftp
-A zone_lan_helper -p udp -m comment --comment "!fw3: Amanda backup and archiving proto" -m udp --dport 10080 -j CT --helper amanda
-A zone_lan_helper -p tcp -m comment --comment "!fw3: FTP passive connection tracking" -m tcp --dport 21 -j CT --helper ftp
-A zone_lan_helper -p udp -m comment --comment "!fw3: RAS proto tracking" -m udp --dport 1719 -j CT --helper RAS
-A zone_lan_helper -p tcp -m comment --comment "!fw3: Q.931 proto tracking" -m tcp --dport 1720 -j CT --helper Q.931
-A zone_lan_helper -p tcp -m comment --comment "!fw3: IRC DCC connection tracking" -m tcp --dport 6667 -j CT --helper irc
-A zone_lan_helper -p tcp -m comment --comment "!fw3: PPTP VPN connection tracking" -m tcp --dport 1723 -j CT --helper pptp
-A zone_lan_helper -p udp -m comment --comment "!fw3: SNMP monitoring connection tracking" -m udp --dport 161 -j CT --helper snmp
-A zone_lan_helper -p udp -m comment --comment "!fw3: TFTP connection tracking" -m udp --dport 69 -j CT --helper tftp
COMMIT
# Completed on Thu Oct  1 12:44:10 2026
# Generated by iptables-save v1.8.7 on Thu Oct  1 12:44:10 2026
*nat
:PREROUTING ACCEPT [662:63092]
:INPUT ACCEPT [158:11483]
:OUTPUT ACCEPT [117:8850]
:POSTROUTING ACCEPT [10:610]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:adg_redirect - [0:0]
:aw_redirect - [0:0]
:dns_dispatcher - [0:0]
:dns_redirect - [0:0]
:policy_output - [0:0]
:policy_redirect - [0:0]
:postrouting_guest_rule - [0:0]
:postrouting_iot_rule - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:postrouting_wgclient1_rule - [0:0]
:prerouting_guest_rule - [0:0]
:prerouting_iot_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:prerouting_wgclient1_rule - [0:0]
:zone_guest_postrouting - [0:0]
:zone_guest_prerouting - [0:0]
:zone_iot_postrouting - [0:0]
:zone_iot_prerouting - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
:zone_wgclient1_postrouting - [0:0]
:zone_wgclient1_prerouting - [0:0]
-A PREROUTING -m comment --comment "!fw3: Custom prerouting rule chain" -j prerouting_rule
-A PREROUTING -i br-lan -m comment --comment "!fw3" -j zone_lan_prerouting
-A PREROUTING -i eth0 -m comment --comment "!fw3" -j zone_wan_prerouting
-A PREROUTING -i wgclient1 -m comment --comment "!fw3" -j zone_wgclient1_prerouting
-A PREROUTING -i br-lan -p tcp -m tcp --dport 53 -j dns_dispatcher
-A PREROUTING -i br-lan -p udp -m udp --dport 53 -j dns_dispatcher
-A OUTPUT -p tcp -j policy_output
-A OUTPUT -p udp -j policy_output
-A POSTROUTING -m comment --comment "!fw3: Custom postrouting rule chain" -j postrouting_rule
-A POSTROUTING -o br-lan -m comment --comment "!fw3" -j zone_lan_postrouting
-A POSTROUTING -o eth0 -m comment --comment "!fw3" -j zone_wan_postrouting
-A POSTROUTING -o wgclient1 -m comment --comment "!fw3" -j zone_wgclient1_postrouting
-A dns_dispatcher -j aw_redirect
-A dns_dispatcher -j adg_redirect
-A dns_dispatcher -j policy_redirect
-A dns_dispatcher -j dns_redirect
-A dns_redirect -p tcp -j REDIRECT --to-ports 53
-A dns_redirect -p udp -j REDIRECT --to-ports 53
-A policy_output -p tcp -m mark --mark 0x1000/0xf000 -m owner --uid-owner 453 -m tcp --dport 53 -j REDIRECT --to-ports 2153
-A policy_output -p udp -m mark --mark 0x1000/0xf000 -m owner --gid-owner 10000 -m udp --dport 53 -j REDIRECT --to-ports 2153
-A policy_redirect -p udp -m mark --mark 0x1000/0xf000 -j REDIRECT --to-ports 2153
-A zone_guest_postrouting -m comment --comment "!fw3: Custom guest postrouting rule chain" -j postrouting_guest_rule
-A zone_guest_prerouting -m comment --comment "!fw3: Custom guest prerouting rule chain" -j prerouting_guest_rule
-A zone_iot_postrouting -m comment --comment "!fw3: Custom iot postrouting rule chain" -j postrouting_iot_rule
-A zone_iot_prerouting -m comment --comment "!fw3: Custom iot prerouting rule chain" -j prerouting_iot_rule
-A zone_lan_postrouting -m comment --comment "!fw3: Custom lan postrouting rule chain" -j postrouting_lan_rule
-A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
-A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
-A zone_wan_postrouting -j MINIUPNPD-POSTROUTING
-A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
-A zone_wan_prerouting -j MINIUPNPD
-A zone_wgclient1_postrouting -m comment --comment "!fw3: Custom wgclient1 postrouting rule chain" -j postrouting_wgclient1_rule
-A zone_wgclient1_postrouting -m comment --comment "!fw3" -j MASQUERADE
-A zone_wgclient1_prerouting -m comment --comment "!fw3: Custom wgclient1 prerouting rule chain" -j prerouting_wgclient1_rule
COMMIT
# Completed on Thu Oct  1 12:44:10 2026
# Generated by iptables-save v1.8.7 on Thu Oct  1 12:44:10 2026
*mangle
:PREROUTING ACCEPT [168478:164185853]
:INPUT ACCEPT [67600:73709819]
:FORWARD ACCEPT [100569:90398330]
:OUTPUT ACCEPT [44793:29940606]
:POSTROUTING ACCEPT [145362:120338936]
:LOCAL_POLICY - [0:0]
:POST_ROUTE_POLICY - [0:0]
:ROUTE_POLICY - [0:0]
:TUNNEL100_ROUTE_POLICY - [0:0]
:TUNNEL10100_LOCAL_POLICY - [0:0]
:TUNNEL201_LOCAL_POLICY - [0:0]
:TUNNEL7670_ROUTE_POLICY - [0:0]
:VPN_LOCAL_POLICY_DROP - [0:0]
:VPN_PREROUTING_HOOK - [0:0]
:vpn_in_new_mark - [0:0]
:wan_in_new_mark - [0:0]
-A PREROUTING -j VPN_PREROUTING_HOOK
-A FORWARD -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -o wgclient1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wgclient1 MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i wgclient1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wgclient1 MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -j LOCAL_POLICY
-A POSTROUTING -j POST_ROUTE_POLICY
-A POSTROUTING -p tcp -m mark ! --mark 0x0/0xf000 -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A LOCAL_POLICY -m connmark ! --mark 0x0/0xf000 -j CONNMARK --restore-mark --nfmask 0xf000 --ctmask 0xf000
-A LOCAL_POLICY -p tcp -m set --match-set output_vpn_bypass_tcp_ports src -j RETURN
-A LOCAL_POLICY -p udp -m set --match-set output_vpn_bypass_udp_ports src -j RETURN
-A LOCAL_POLICY -m mark --mark 0x0/0xf000 -m owner --gid-owner 2100 -j MARK --set-xmark 0x1000/0xf000
-A LOCAL_POLICY -j TUNNEL201_LOCAL_POLICY
-A LOCAL_POLICY -j TUNNEL10100_LOCAL_POLICY
-A LOCAL_POLICY -p udp -m connmark --mark 0x0/0xf000 -m mark ! --mark 0x0/0xf000 -m udp --dport 5453 -j CONNMARK --save-mark --nfmask 0xf000 --ctmask 0xf000
-A LOCAL_POLICY -p tcp -m connmark --mark 0x0/0xf000 -m mark ! --mark 0x0/0xf000 -m tcp --dport 5453 -j CONNMARK --save-mark --nfmask 0xf000 --ctmask 0xf000
-A ROUTE_POLICY -m connmark ! --mark 0x0/0xf000 -j CONNMARK --restore-mark --nfmask 0xf000 --ctmask 0xf000
-A ROUTE_POLICY -p udp -m addrtype --dst-type LOCAL -m udp --dport 53 -j RETURN
-A ROUTE_POLICY -m addrtype ! --dst-type LOCAL -j TUNNEL7670_ROUTE_POLICY
-A ROUTE_POLICY -m addrtype ! --dst-type LOCAL -j TUNNEL100_ROUTE_POLICY
-A TUNNEL100_ROUTE_POLICY -m comment --comment "TUNNEL100 rule for set mark" -m mark --mark 0x0/0xf000 -j MARK --set-xmark 0x8000/0xf000
-A TUNNEL100_ROUTE_POLICY -m mark --mark 0x0/0xf000 -j DROP
-A TUNNEL10100_LOCAL_POLICY -m comment --comment "TUNNEL10100 rule for set mark" -m connmark --mark 0x0/0xf000 -m mark --mark 0x0/0xf000 -m owner --gid-owner 20000 -j MARK --set-xmark 0x1000/0xf000
-A TUNNEL10100_LOCAL_POLICY -m connmark --mark 0x0/0xf000 -m mark --mark 0x0/0xf000 -m owner --gid-owner 20000 -j MARK --set-xmark 0x8000/0xf000
-A TUNNEL10100_LOCAL_POLICY -m connmark --mark 0x0/0xf000 -m mark --mark 0x0/0xf000 -m owner --gid-owner 20000 -j VPN_LOCAL_POLICY_DROP
-A TUNNEL201_LOCAL_POLICY -m comment --comment "TUNNEL201 rule for set mark" -m connmark --mark 0x0/0xf000 -m mark --mark 0x0/0xf000 -m owner --gid-owner 10000 -j MARK --set-xmark 0x8000/0xf000
-A TUNNEL201_LOCAL_POLICY -m connmark --mark 0x0/0xf000 -m mark --mark 0x0/0xf000 -m owner --gid-owner 10000 -j VPN_LOCAL_POLICY_DROP
-A TUNNEL7670_ROUTE_POLICY -m comment --comment "TUNNEL7670 rule for set mark" -m mark --mark 0x0/0xf000 -m set ! --match-set dst_net7670 dst -j MARK --set-xmark 0x1000/0xf000
-A TUNNEL7670_ROUTE_POLICY -m mark --mark 0x0/0xf000 -m set ! --match-set dst_net7670 dst -j MARK --set-xmark 0x8000/0xf000
-A TUNNEL7670_ROUTE_POLICY -m mark --mark 0x0/0xf000 -m set ! --match-set dst_net7670 dst -j DROP
-A VPN_LOCAL_POLICY_DROP -o br-lan -j RETURN
-A VPN_LOCAL_POLICY_DROP -j DROP
-A VPN_PREROUTING_HOOK -j vpn_in_new_mark
-A VPN_PREROUTING_HOOK -j wan_in_new_mark
-A VPN_PREROUTING_HOOK -i br-lan -j ROUTE_POLICY
-A VPN_PREROUTING_HOOK -p udp -m connmark --mark 0x0/0xf000 -m udp --dport 3053 -j CONNMARK --save-mark --nfmask 0xf000 --ctmask 0xf000
-A VPN_PREROUTING_HOOK -p udp -m connmark --mark 0x0/0xf000 -m udp --dport 5453 -j CONNMARK --save-mark --nfmask 0xf000 --ctmask 0xf000
-A VPN_PREROUTING_HOOK -p udp -m connmark --mark 0x0/0xf000 -m udp --dport 53 -j CONNMARK --save-mark --nfmask 0xf000 --ctmask 0xf000
-A vpn_in_new_mark -i wgclient1 -p tcp -m conntrack --ctstate NEW -m connmark ! --mark 0x1000/0xf000 -m comment --comment wgclient1_in_new_connmark -j CONNMARK --set-xmark 0x1000/0xf000
-A vpn_in_new_mark -i wgclient1 -p udp -m conntrack --ctstate NEW -m connmark ! --mark 0x1000/0xf000 -m comment --comment wgclient1_in_new_connmark -j CONNMARK --set-xmark 0x1000/0xf000
-A vpn_in_new_mark -i wgclient1 -p icmp -m conntrack --ctstate NEW -m connmark ! --mark 0x1000/0xf000 -m comment --comment wgclient1_in_new_connmark -j CONNMARK --set-xmark 0x1000/0xf000
-A wan_in_new_mark -i eth0 -p tcp -m conntrack --ctstate NEW -m connmark ! --mark 0x8000/0xf000 -m comment --comment eth0_in_new_connmark -j CONNMARK --set-xmark 0x8000/0xf000
-A wan_in_new_mark -i eth0 -p udp -m conntrack --ctstate NEW -m connmark ! --mark 0x8000/0xf000 -m comment --comment eth0_in_new_connmark -j CONNMARK --set-xmark 0x8000/0xf000
-A wan_in_new_mark -i eth0 -p icmp -m conntrack --ctstate NEW -m connmark ! --mark 0x8000/0xf000 -m comment --comment eth0_in_new_connmark -j CONNMARK --set-xmark 0x8000/0xf000
COMMIT
# Completed on Thu Oct  1 12:44:10 2026
# Generated by iptables-save v1.8.7 on Thu Oct  1 12:44:10 2026
*filter
:INPUT ACCEPT [6:336]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
:forwarding_guest_rule - [0:0]
:forwarding_iot_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:forwarding_wgclient1_rule - [0:0]
:input_guest_rule - [0:0]
:input_iot_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:input_wgclient1_rule - [0:0]
:output_guest_rule - [0:0]
:output_iot_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:output_wgclient1_rule - [0:0]
:parental_control - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_guest_dest_ACCEPT - [0:0]
:zone_guest_dest_REJECT - [0:0]
:zone_guest_forward - [0:0]
:zone_guest_input - [0:0]
:zone_guest_output - [0:0]
:zone_guest_src_REJECT - [0:0]
:zone_iot_dest_ACCEPT - [0:0]
:zone_iot_dest_REJECT - [0:0]
:zone_iot_forward - [0:0]
:zone_iot_input - [0:0]
:zone_iot_output - [0:0]
:zone_iot_src_REJECT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_DROP - [0:0]
:zone_wgclient1_dest_ACCEPT - [0:0]
:zone_wgclient1_forward - [0:0]
:zone_wgclient1_input - [0:0]
:zone_wgclient1_output - [0:0]
:zone_wgclient1_src_DROP - [0:0]
-A INPUT -i br-lan -p icmp -m icmp --icmp-type 8 -m limit --limit 25/sec -j ACCEPT
-A INPUT -i br-lan -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j LOG
-A INPUT -i br-lan -p icmp -m icmp --icmp-type 8 -j DROP
-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
-A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
-A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
-A INPUT -i eth0 -m comment --comment "!fw3" -j zone_wan_input
-A INPUT -i wgclient1 -m comment --comment "!fw3" -j zone_wgclient1_input
-A FORWARD -j parental_control
-A FORWARD -m set --match-set GL_MAC_BLOCK src -j DROP
-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT
-A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
-A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_wan_forward
-A FORWARD -i wgclient1 -m comment --comment "!fw3" -j zone_wgclient1_forward
-A FORWARD -m comment --comment "!fw3" -j reject
-A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
-A OUTPUT -p tcp -m mark --mark 0x0/0xf000 -m owner --uid-owner 453 -m comment --comment "!fw3: tcp_dns_leak_drop" -j DROP
-A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
-A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_wan_output
-A OUTPUT -o wgclient1 -m comment --comment "!fw3" -j zone_wgclient1_output
-A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
-A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
-A syn_flood -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 1/sec -j LOG --log-prefix "SYN_DROPPED: "
-A syn_flood -m comment --comment "!fw3" -j DROP
-A zone_guest_forward -m comment --comment "!fw3: Custom guest forwarding rule chain" -j forwarding_guest_rule
-A zone_guest_forward -m comment --comment "!fw3: Zone guest to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_guest_forward -m comment --comment "!fw3: Zone guest to wgclient1 forwarding policy" -j zone_wgclient1_dest_ACCEPT
-A zone_guest_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_guest_forward -m comment --comment "!fw3" -j zone_guest_dest_REJECT
-A zone_guest_input -m comment --comment "!fw3: Custom guest input rule chain" -j input_guest_rule
-A zone_guest_input -p udp -m udp --dport 3053 -m mark --mark 0x0/0xf000 -m comment --comment "!fw3: guest_drop_leaked_adgdns" -j DROP
-A zone_guest_input -p udp -m udp --dport 53 -m mark ! --mark 0x8000/0xf000 -m comment --comment "!fw3: guest_drop_leaked_dns" -j DROP
-A zone_guest_input -p udp -m udp --dport 67:68 -m comment --comment "!fw3: Allow-DHCP" -j ACCEPT
-A zone_guest_input -p tcp -m tcp --dport 53 -m comment --comment "!fw3: Allow-DNS" -j ACCEPT
-A zone_guest_input -p udp -m udp --dport 53 -m comment --comment "!fw3: Allow-DNS" -j ACCEPT
-A zone_guest_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_guest_input -m comment --comment "!fw3" -j zone_guest_src_REJECT
-A zone_guest_output -m comment --comment "!fw3: Custom guest output rule chain" -j output_guest_rule
-A zone_guest_output -m comment --comment "!fw3" -j zone_guest_dest_ACCEPT
-A zone_iot_forward -m comment --comment "!fw3: Custom iot forwarding rule chain" -j forwarding_iot_rule
-A zone_iot_forward -m comment --comment "!fw3: Zone iot to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_iot_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_iot_forward -m comment --comment "!fw3" -j zone_iot_dest_REJECT
-A zone_iot_input -m comment --comment "!fw3: Custom iot input rule chain" -j input_iot_rule
-A zone_iot_input -p udp -m udp --dport 67:68 -m comment --comment "!fw3: Allow-DHCP" -j ACCEPT
-A zone_iot_input -p tcp -m tcp --dport 53 -m comment --comment "!fw3: Allow-DNS" -j ACCEPT
-A zone_iot_input -p udp -m udp --dport 53 -m comment --comment "!fw3: Allow-DNS" -j ACCEPT
-A zone_iot_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_iot_input -m comment --comment "!fw3" -j zone_iot_src_REJECT
-A zone_iot_output -m comment --comment "!fw3: Custom iot output rule chain" -j output_iot_rule
-A zone_iot_output -m comment --comment "!fw3" -j zone_iot_dest_ACCEPT
-A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m comment --comment "!fw3: Zone lan to wgclient1 forwarding policy" -j zone_wgclient1_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
-A zone_lan_input -p udp -m udp --dport 3053 -m mark --mark 0x0/0xf000 -m comment --comment "!fw3: lan_drop_leaked_adgdns" -j DROP
-A zone_lan_input -p udp -m udp --dport 53 -m mark ! --mark 0x8000/0xf000 -m comment --comment "!fw3: lan_drop_leaked_dns" -j DROP
-A zone_lan_input -p tcp -m tcp --dport 137 -m comment --comment "!fw3: @rule[17]" -j ACCEPT
-A zone_lan_input -p tcp -m tcp --dport 138 -m comment --comment "!fw3: @rule[17]" -j ACCEPT
-A zone_lan_input -p tcp -m tcp --dport 139 -m comment --comment "!fw3: @rule[17]" -j ACCEPT
-A zone_lan_input -p tcp -m tcp --dport 445 -m comment --comment "!fw3: @rule[17]" -j ACCEPT
-A zone_lan_input -p udp -m udp --dport 137 -m comment --comment "!fw3: @rule[17]" -j ACCEPT
-A zone_lan_input -p udp -m udp --dport 138 -m comment --comment "!fw3: @rule[17]" -j ACCEPT
-A zone_lan_input -p udp -m udp --dport 139 -m comment --comment "!fw3: @rule[17]" -j ACCEPT
-A zone_lan_input -p udp -m udp --dport 445 -m comment --comment "!fw3: @rule[17]" -j ACCEPT
-A zone_lan_input -d 192.168.9.1/32 -p tcp -m tcp --dport 80 -m comment --comment "!fw3: Block-LAN-mgmt-guest" -j reject
-A zone_lan_input -d 192.168.9.1/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: Block-LAN-mgmt-guest" -j reject
-A zone_lan_input -d 192.168.9.1/32 -p tcp -m tcp --dport 8080 -m comment --comment "!fw3: Block-LAN-mgmt-guest" -j reject
-A zone_lan_input -d 192.168.9.1/32 -p tcp -m tcp --dport 8443 -m comment --comment "!fw3: Block-LAN-mgmt-guest" -j reject
-A zone_lan_input -d 192.168.9.1/32 -p udp -m udp --dport 80 -m comment --comment "!fw3: Block-LAN-mgmt-guest" -j reject
-A zone_lan_input -d 192.168.9.1/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: Block-LAN-mgmt-guest" -j reject
-A zone_lan_input -d 192.168.9.1/32 -p udp -m udp --dport 8080 -m comment --comment "!fw3: Block-LAN-mgmt-guest" -j reject
-A zone_lan_input -d 192.168.9.1/32 -p udp -m udp --dport 8443 -m comment --comment "!fw3: Block-LAN-mgmt-guest" -j reject
-A zone_lan_input -d 192.168.10.1/32 -p tcp -m tcp --dport 80 -m comment --comment "!fw3: Block-LAN-mgmt-iot" -j reject
-A zone_lan_input -d 192.168.10.1/32 -p tcp -m tcp --dport 443 -m comment --comment "!fw3: Block-LAN-mgmt-iot" -j reject
-A zone_lan_input -d 192.168.10.1/32 -p tcp -m tcp --dport 8080 -m comment --comment "!fw3: Block-LAN-mgmt-iot" -j reject
-A zone_lan_input -d 192.168.10.1/32 -p tcp -m tcp --dport 8443 -m comment --comment "!fw3: Block-LAN-mgmt-iot" -j reject
-A zone_lan_input -d 192.168.10.1/32 -p udp -m udp --dport 80 -m comment --comment "!fw3: Block-LAN-mgmt-iot" -j reject
-A zone_lan_input -d 192.168.10.1/32 -p udp -m udp --dport 443 -m comment --comment "!fw3: Block-LAN-mgmt-iot" -j reject
-A zone_lan_input -d 192.168.10.1/32 -p udp -m udp --dport 8080 -m comment --comment "!fw3: Block-LAN-mgmt-iot" -j reject
-A zone_lan_input -d 192.168.10.1/32 -p udp -m udp --dport 8443 -m comment --comment "!fw3: Block-LAN-mgmt-iot" -j reject
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
-A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_ACCEPT -o eth0 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT
-A zone_wan_dest_REJECT -o eth0 -m comment --comment "!fw3" -j reject
-A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
-A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m comment --comment "!fw3: Zone wan to wgclient1 forwarding policy" -j zone_wgclient1_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wan_forward -j MINIUPNPD
-A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
-A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
-A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
-A zone_wan_input -p tcp -m tcp --dport 137 -m comment --comment "!fw3: @rule[16]" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 138 -m comment --comment "!fw3: @rule[16]" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 139 -m comment --comment "!fw3: @rule[16]" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 445 -m comment --comment "!fw3: @rule[16]" -j DROP
-A zone_wan_input -p udp -m udp --dport 137 -m comment --comment "!fw3: @rule[16]" -j DROP
-A zone_wan_input -p udp -m udp --dport 138 -m comment --comment "!fw3: @rule[16]" -j DROP
-A zone_wan_input -p udp -m udp --dport 139 -m comment --comment "!fw3: @rule[16]" -j DROP
-A zone_wan_input -p udp -m udp --dport 445 -m comment --comment "!fw3: @rule[16]" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 6000:6002 -m comment --comment "!fw3: @rule[18]" -j DROP
-A zone_wan_input -p udp -m udp --dport 6000:6002 -m comment --comment "!fw3: @rule[18]" -j DROP
-A zone_wan_input -p tcp -m tcp --dport 6008 -m comment --comment "!fw3: @rule[19]" -j DROP
-A zone_wan_input -p udp -m udp --dport 6008 -m comment --comment "!fw3: @rule[19]" -j DROP
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wan_input -j MINIUPNPD
-A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_DROP
-A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
-A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
-A zone_wan_src_DROP -i eth0 -m comment --comment "!fw3" -j DROP
-A zone_wgclient1_dest_ACCEPT -o wgclient1 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
-A zone_wgclient1_dest_ACCEPT -o wgclient1 -m comment --comment "!fw3" -j ACCEPT
-A zone_wgclient1_forward -m comment --comment "!fw3: Custom wgclient1 forwarding rule chain" -j forwarding_wgclient1_rule
-A zone_wgclient1_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
-A zone_wgclient1_forward -m comment --comment "!fw3" -j zone_wgclient1_dest_ACCEPT
-A zone_wgclient1_input -m comment --comment "!fw3: Custom wgclient1 input rule chain" -j input_wgclient1_rule
-A zone_wgclient1_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
-A zone_wgclient1_input -m comment --comment "!fw3" -j zone_wgclient1_src_DROP
-A zone_wgclient1_output -m comment --comment "!fw3: Custom wgclient1 output rule chain" -j output_wgclient1_rule
-A zone_wgclient1_output -m comment --comment "!fw3" -j zone_wgclient1_dest_ACCEPT
-A zone_wgclient1_src_DROP -i wgclient1 -m comment --comment "!fw3" -j DROP
COMMIT
# Completed on Thu Oct  1 12:44:10 2026

create GL_DPI_BLOCK hash:net family inet hashsize 1024 maxelem 65536
create GL_MAC_BLOCK hash:mac hashsize 1024 maxelem 65536
create output_vpn_bypass_tcp_ports bitmap:port range 0-65535
create output_vpn_bypass_udp_ports bitmap:port range 0-65535
create dst_net866 hash:net family inet hashsize 1024 maxelem 65536
add dst_net866 172.203.39.49
add dst_net866 4.197.172.116
add dst_net866 74.248.148.7
add dst_net866 52.143.181.161
add dst_net866 172.207.173.200
add dst_net866 4.151.200.38
add dst_net866 4.245.198.13
add dst_net866 191.233.251.27
add dst_net866 51.4.112.173
add dst_net866 172.214.226.198
add dst_net866 72.146.20.246
add dst_net866 4.155.146.196
add dst_net866 68.155.152.41
add dst_net866 20.184.36.134
add dst_net866 20.74.221.21
add dst_net866 4.217.235.100
add dst_net866 20.162.96.163
add dst_net866 20.203.144.245
add dst_net866 40.118.236.137
add dst_net866 13.71.25.29
add dst_net866 20.168.48.117
add dst_net866 135.220.40.201
add dst_net866 102.37.57.54
create dst_net866_6 hash:net family inet6 hashsize 1024 maxelem 65536
create dst_net7670 hash:net family inet hashsize 1024 maxelem 65536
add dst_net7670 169.254.0.0
add dst_net7670 224.0.0.0
add dst_net7670 127.0.0.0
add dst_net7670 217.69.139.90
add dst_net7670 213.180.204.179
add dst_net7670 172.16.0.0
add dst_net7670 64.233.163.108
add dst_net7670 77.105.138.138
add dst_net7670 188.40.167.82
add dst_net7670 87.250.251.183
add dst_net7670 77.88.21.24
add dst_net7670 192.168.0.0
add dst_net7670 94.100.180.90
add dst_net7670 10.0.0.0
add dst_net7670 195.82.140.49
add dst_net7670 64.233.163.109
add dst_net7670 100.64.0.0
add dst_net7670 192.168.2.42
create dst_net7670_6 hash:net family inet6 hashsize 1024 maxelem 65536
