rc.firewall

#!/bin/sh

# Suck in the configuration variables.
if [ -z "${source_rc_confs_defined}" ]; then
 if [ -r /etc/defaults/rc.conf ]; then
  . /etc/defaults/rc.conf
  source_rc_confs
 elif [ -r /etc/rc.conf ]; then
  . /etc/rc.conf
 fi
fi
. /etc/rc.subr
. /etc/network.subr
if [ -n "${1}" ]; then
 firewall_type="${1}"
fi
if [ -z "${firewall_rc_config_load}" ]; then
 load_rc_config ipfw
else
 for i in ${firewall_rc_config_load}; do
  load_rc_config $i
 done
fi
afexists inet6
ipv6_available=$?
. /etc/rc.firewall.definitions
. /etc/rc.firewall.config
if [ x"${IPFW_LANS6}" == x"" ]; then
 IPFW_LANS6=${IPFW_LANS}
fi
if [ x"${IPFW_WANS6}" == x"" ]; then
 IPFW_WANS6=${IPFW_WANS}
fi
if [ x"${IPFW_LANS6_list}" == x"" ]; then
 IPFW_LANS6_list=${IPFW_LANS_list}
fi
if [ x"${IPFW_WANS6_list}" == x"" ]; then
 IPFW_WANS6_list=${IPFW_WANS_list}
fi
${fwcmd} -f flush > /dev/null 2> /dev/null
${fwcmd} set enable 0
if [ ${IPFW_multiwan} -eq 1 ]; then
 for i in ${IPFW_WANS_list}; do
  j="IPFW_oip${i}"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   ${fwcmd} set disable ${i} # WAN is online
  else
   ${fwcmd} set enable ${i} # WAN is offline
  fi
 done
fi
prepare_tables

########################
### Loopback
########################
${fwcmd} add 1 ${IPFW_allow} all from any to any via lo0
${fwcmd} add ${IPFW_denylog} all from any to 127.0.0.0/8
${fwcmd} add ${IPFW_denylog} ip from 127.0.0.0/8 to any
if [ x"$ipv6_available" == x"0" ]; then
 if [ x"$IPFW_LAN_6" == x"1" -o x"$IPFW_WAN_6" == x"1" ]; then
  ${fwcmd} add ${IPFW_denylog} all from any to ::1/128
  ${fwcmd} add ${IPFW_denylog} all from ::1/128 to any
 fi
fi
########################
### Traffic identification
########################
${fwcmd} add skipto 1000 ip4 from any to any out
${fwcmd} add skipto 3000 ip4 from any to any in
if [ x"$ipv6_available" == x"0" ]; then
 if [ x"$IPFW_LAN_6" == x"1" -o x"$IPFW_WAN_6" == x"1" ]; then
  ${fwcmd} add skipto 5000 ip6 from any to any out
  ${fwcmd} add skipto 7000 ip6 from any to any in
 fi
fi
for i in ${IPFW_WANS_list}; do
 j="IPFW_oip${i}"
 eval j="\$${j}"
 if [ -n "${j}" ]; then
  j="IPFW_nat${i}"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_oif${i}"
   eval k="\$${k}"
   ${fwcmd} nat ${i} config if ${k} ${j}
  fi
 fi
done
${fwcmd} add 999 skipto 65500 log all from any to any
########################
########################
# IPv4 Out
y=1000
for i in ${IPFW_LANS_list}; do
 j="IPFW_iip${i}"
 eval j="\$${j}"
 if [ -n "${j}" ]; then
  k="IPFW_iif${i}"
  eval k="\$${k}"
  l="IPFW_inet${i}"
  eval l="\$${l}"
  x=$(( 20000 + ( ( ${i} - 1 ) * 10 ) ))
  ${fwcmd} add ${y} skipto ${x} ip4 from ${j} to any via ${k} out
  ${fwcmd} add skipto ${x} ip4 from any to ${l} via ${k} out
  ${fwcmd} add skipto ${x} ip4 from any to 255.255.255.255 via ${k} out
 fi
 y=$(( ${y} + 5 )) # 5 rules max.
done
y=1100
for i in ${IPFW_WANS_list}; do
 j="IPFW_oip${i}"
 eval j="\$${j}"
 if [ -n "${j}" ]; then
  k="IPFW_oif${i}"
  eval k="\$${k}"
  x=$(( 45000 + ( ( ${i} - 1 ) * 10 ) ))
  ${fwcmd} add ${y} skipto ${x} ip4 from ${j} to any via ${k} out
  for ii in ${IPFW_LANS_list}; do
   jj="IPFW_iip${ii}"
   eval jj="\$${jj}"
   if [ -n "${jj}" ]; then
    kk="IPFW_inet${ii}"
    eval kk="\$${kk}"
    ${fwcmd} add skipto ${x} ip4 from ${kk} to any via ${k} out
   fi
  done
  ${fwcmd} add skipto ${x} ip4 from any to 255.255.255.255 via ${k} out
 fi
 y=$(( ${y} + 25 ))
done
y=1600
for i in ${IPFW_LANS_list}; do
 j="IPFW_iip${i}"
 eval j="\$${j}"
 if [ -n "${j}" ]; then
  k="IPFW_iif${i}"
  eval k="\$${k}"
  x=$(( 20000 + ( ( ${i} - 1 ) * 10 ) ))
  ${fwcmd} add ${y} skipto ${x} log ip4 from any to any via ${k} out
 fi
 y=$(( ${y} + 5 )) # 5 rules max.
done
y=1700
for i in ${IPFW_WANS_list}; do
 j="IPFW_oip${i}"
 eval j="\$${j}"
 if [ -n "${j}" ]; then
  k="IPFW_oif${i}"
  eval k="\$${k}"
  x=$(( 45000 + ( ( ${i} - 1 ) * 10 ) ))
  for ii in ${IPFW_WANS_list}; do
   if [ ! x"${j}" == x"${jj}" ]; then
    jj="IPFW_oip${ii}"
    eval jj="\$${jj}"
    if [ -n "${jj}" ]; then
     ${fwcmd} add ${y} skipto ${x} ip4 from ${jj} to any via ${k} out
     y=$(( ${y} + 1 ))
    fi
   fi
  done
  ${fwcmd} add ${y} skipto ${x} log ip4 from any to any via ${k} out
  y=$(( ${y} + 1 ))
 fi
done
# IPv4 In
y=3000
for i in ${IPFW_LANS_list}; do
 j="IPFW_iip${i}"
 eval j="\$${j}"
 if [ -n "${j}" ]; then
  k="IPFW_iif${i}"
  eval k="\$${k}"
  l="IPFW_inet${i}"
  eval l="\$${l}"
  x=$(( 25000 + ( ( ${i} - 1 ) * 10 ) ))
  ${fwcmd} add ${y} skipto ${x} ip4 from any to ${j} via ${k} in
  ${fwcmd} add skipto ${x} ip4 from ${l} to any via ${k} in
  ${fwcmd} add skipto ${x} ip4 from any to 255.255.255.255 via ${k} in
 fi
 y=$(( ${y} + 5 )) # 5 rules max.
done
y=3100
for i in ${IPFW_WANS_list}; do
 j="IPFW_oip${i}"
 eval j="\$${j}"
 if [ -n "${j}" ]; then
  k="IPFW_oif${i}"
  eval k="\$${k}"
  l=$(( ${i} * 2 ))
  x=$(( 40000 + ( ( ${i} - 1 ) * 10 ) ))
  ${fwcmd} add ${y} skipto ${x} ip4 from any to ${j} via ${k} in
  for ii in ${IPFW_LANS_list}; do
   jj="IPFW_iip${ii}"
   eval jj="\$${jj}"
   if [ -n "${jj}" ]; then
    kk="IPFW_inet${ii}"
    eval kk="\$${kk}"
    ${fwcmd} add skipto ${x} ip4 from any to ${kk} via ${k} in
   fi
  done
  if [ x"${IPFW_DHCP}" == x"1" ]; then
   ${fwcmd} add skipto ${x} ip4 from 0.0.0.0 to 255.255.255.255 via ${k} in
  fi
  ${fwcmd} add ${IPFW_deny} ip4 from any to 255.255.255.255 via ${k} in
 fi
 y=$(( ${y} + 25 ))
done
y=3600
for i in ${IPFW_LANS_list}; do
 j="IPFW_iip${i}"
 eval j="\$${j}"
 if [ -n "${j}" ]; then
  k="IPFW_iif${i}"
  eval k="\$${k}"
  x=$(( 25000 + ( ( ${i} - 1 ) * 10 ) ))
  ${fwcmd} add ${y} skipto ${x} log ip4 from any to any via ${k} in
 fi
 y=$(( ${y} + 5 )) # max. 5 rules
done
y=3700
for i in ${IPFW_WANS_list}; do
 j="IPFW_oip${i}"
 eval j="\$${j}"
 if [ -n "${j}" ]; then
  k="IPFW_oif${i}"
  eval k="\$${k}"
  x=$(( 40000 + ( ( ${i} - 1 ) * 10 ) ))
  ${fwcmd} add ${y} ${IPFW_deny} igmp from any to any via ${k} in
  ${fwcmd} add skipto ${x} log ip4 from any to any via ${k} in
 fi
 y=$(( ${y} + 5 )) # max. 5 rules
done
if [ x"$ipv6_available" == x"0" ]; then
# IPv6 Out
 y=5000
 for i in ${IPFW_LANS6_list}; do
  j="IPFW_iip${i}_6"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_iif${i}"
   eval k="\$${k}"
   l="IPFW_inet${i}_6"
   eval l="\$${l}"
   x=$(( 10000 + ( ( ${i} - 1 ) * 10 ) ))
   ${fwcmd} add ${y} skipto ${x} ip6 from ${j} to any via ${k} out
   ${fwcmd} add skipto ${x} ip6 from any to ${l} via ${k} out
   ${fwcmd} add skipto ${x} ip6 from fe80::/10 546,547 to fe80::/10 546,547 via ${k} out
   ${fwcmd} add skipto ${x} ip6 from fe80::/10 521,546,547 to ff02::/16 521,546,547 via ${k} out
   ${fwcmd} add ${IPFW_deny} ip6 from fe80::/10 to ff02::/16 5355 via ${k} out
   ${fwcmd} add skipto ${x} ip6 from fe80::/10 to any via ${k} out
   ${fwcmd} add skipto ${x} ipv6-icmp from ::/128 to ff02::/16 via ${k} out
   ${fwcmd} add skipto ${x} ipv6-icmp from fe80::/10 to fe80::/10 via ${k} out
   ${fwcmd} add skipto ${x} ipv6-icmp from fe80::/10 to ff02::/16 via ${k} out
   ${fwcmd} add skipto ${x} ipv6-icmp from any to any icmp6types 1,2,128,129,135,136 via ${k} out
  fi
  y=$(( ${y} + 20 )) # 20 rules max.
 done
 y=5400
 for i in ${IPFW_WANS6_list}; do
  j="IPFW_oip${i}_6"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_oif${i}"
   eval k="\$${k}"
   x=$(( 35000 + ( ( ${i} - 1 ) * 10 ) ))
   ${fwcmd} add ${y} skipto ${x} ip6 from ${j} to any via ${k} out
   for ii in ${IPFW_LANS6_list}; do
    jj="IPFW_iip${ii}_6"
    eval jj="\$${jj}"
    if [ -n "${jj}" ]; then
     kk="IPFW_inet${i}_6"
     eval kk="\$${kk}"
     ${fwcmd} add skipto ${x} ip6 from ${kk} to any via ${k} out
    fi
   done
   ${fwcmd} add skipto ${x} ip6 from fe80::/10 546,547 to fe80::/10 546,547 via ${k} out
   ${fwcmd} add skipto ${x} ip6 from fe80::/10 521,546,547 to ff02::/16 521,546,547 via ${k} out
   ${fwcmd} add ${IPFW_deny} ip6 from fe80::/10 to ff02::/16 5355 via ${k} out
   ${fwcmd} add skipto ${x} ip6 from fe80::/10 to any via ${k} out
   ${fwcmd} add skipto ${x} ipv6-icmp from ::/128 to ff02::/16 via ${k} out
   ${fwcmd} add skipto ${x} ipv6-icmp from fe80::/10 to fe80::/10 via ${k} out
   ${fwcmd} add skipto ${x} ipv6-icmp from fe80::/10 to ff02::/16 via ${k} out
   ${fwcmd} add skipto ${x} ipv6-icmp from any to any icmp6types 1,2,128,129,135,136 via ${k} out
  fi
  y=$(( ${y} + 40 )) # 40 rules max.
 done
 y=6200
 for i in ${IPFW_LANS6_list}; do
  j="IPFW_iip${i}_6"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_iif${i}"
   eval k="\$${k}"
   x=$(( 10000 + ( ( ${i} - 1 ) * 10 ) ))
   ${fwcmd} add ${y} skipto ${x} log ip6 from any to any via ${k} out
   ${fwcmd} add skipto ${x} log ipv6-icmp from any to any via ${k} out
  fi
  y=$(( ${y} + 5 )) # 5 rules max.
 done
 y=6300
 for i in ${IPFW_WANS6_list}; do
  j="IPFW_oip${i}_6"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_oif${i}"
   eval k="\$${k}"
   x=$(( 35000 + ( ( ${i} - 1 ) * 10 ) ))
   ${fwcmd} add ${y} skipto ${x} log ip6 from any to any via ${k} out
   ${fwcmd} add skipto ${x} log ipv6-icmp from any to any via ${k} out
  fi
  y=$(( ${y} + 5 )) # 5 rules max.
 done
# IPv6 In
 y=7000
 for i in ${IPFW_LANS6_list}; do
  j="IPFW_iip${i}_6"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_iif${i}"
   eval k="\$${k}"
   l="IPFW_inet${i}_6"
   eval l="\$${l}"
   x=$(( 15000 + ( ( ${i} - 1 ) * 10 ) ))
   ${fwcmd} add ${y} skipto ${x} ip6 from any to ${j} via ${k} in
   ${fwcmd} add skipto ${x} ip6 from ${l} to any via ${k} in
   ${fwcmd} add skipto ${x} ip6 from fe80::/10 546,547 to fe80::/10 546,547 via ${k} in
   ${fwcmd} add skipto ${x} ip6 from fe80::/10 521,546,547 to ff02::/16 521,546,547 via ${k} in
   ${fwcmd} add ${IPFW_deny} ip6 from fe80::/10 to ff02::/16 5355 via ${k} in
   ${fwcmd} add skipto ${x} ip6 from fe80::/10 to any via ${k} in
   ${fwcmd} add skipto ${x} ipv6-icmp from ::/128 to ff02::/16 via ${k} in
   ${fwcmd} add skipto ${x} ipv6-icmp from fe80::/10 to fe80::/10 via ${k} in
   ${fwcmd} add skipto ${x} ipv6-icmp from fe80::/10 to ff02::/16 via ${k} in
   ${fwcmd} add skipto ${x} ipv6-icmp from any to any icmp6types 1,2,128,129,135,136 via ${k} in
  fi
  y=$(( ${y} + 20 )) # 20 rules max.
 done
 y=7400
 for i in ${IPFW_WANS6_list}; do
  j="IPFW_oip${i}_6"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_oif${i}"
   eval k="\$${k}"
   l="IPFW_onet${i}_6"
   eval l="\$${l}"
   x=$(( 30000 + ( ( ${i} - 1 ) * 10 ) ))
   ${fwcmd} add ${y} skipto ${x} ip6 from any to ${j} via ${k} in
   ${fwcmd} add skipto ${x} ip6 from ${l} to fe00::/4 via ${k} in
   for ii in ${IPFW_LANS6_list}; do
    jj="IPFW_iip${ii}_6"
    eval jj="\$${jj}"
    if [ -n "${jj}" ]; then
     kk="IPFW_inet${i}_6"
     eval kk="\$${kk}"
     ${fwcmd} add skipto ${x} ip6 from any to ${kk} via ${k} in
    fi
   done
   ${fwcmd} add skipto ${x} ip6 from fe80::/10 546,547 to fe80::/10 546,547 via ${k} in
   ${fwcmd} add skipto ${x} ip6 from fe80::/10 521,546,547 to ff02::/16 521,546,547 via ${k} in
   ${fwcmd} add ${IPFW_deny} ip6 from fe80::/10 to ff02::/16 5355 via ${k} in
   ${fwcmd} add skipto ${x} ip6 from fe80::/10 to any via ${k} in
   ${fwcmd} add skipto ${x} ipv6-icmp from ::/128 to ff02::/16 via ${k} in
   ${fwcmd} add skipto ${x} ipv6-icmp from fe80::/10 to fe80::/10 via ${k} in
   ${fwcmd} add skipto ${x} ipv6-icmp from fe80::/10 to ff02::/16 via ${k} in
   ${fwcmd} add skipto ${x} ipv6-icmp from any to any icmp6types 1,2,128,129,135,136 via ${k} in
  fi
  y=$(( ${y} + 40 )) # 40 rules max.
 done
 y=8200
 for i in ${IPFW_LANS6_list}; do
  j="IPFW_iip${i}_6"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_iif${i}"
   eval k="\$${k}"
   x=$(( 15000 + ( ( ${i} - 1 ) * 10 ) ))
   ${fwcmd} add ${y} skipto ${x} log ip6 from any to any via ${k} in
   ${fwcmd} add skipto ${x} log ipv6-icmp from any to any via ${k} in
  fi
  y=$(( ${y} + 5 )) # 5 rules max.
 done
 y=8300
 for i in ${IPFW_WANS6_list}; do
  j="IPFW_oip${i}_6"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_oif${i}"
   eval k="\$${k}"
   x=$(( 30000 + ( ( ${i} - 1 ) * 10 ) ))
   ${fwcmd} add ${y} skipto ${x} log ip6 from any to any via ${k} in
   ${fwcmd} add skipto ${x} log ipv6-icmp from any to any via ${k} in
  fi
  y=$(( ${y} + 5 )) # 5 rules max.
 done
fi
${fwcmd} add 9999 skipto 65500 log all from any to any

########################
########################
########################

if [ "${IPFW_LAN_6}" == "1" ]; then
########################
# All LANs IPv6 out
 y=10000
 for i in ${IPFW_LANS6_list}; do
  j="IPFW_iip${i}_6"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_iif${i}"
   eval k="\$${k}"
   ${fwcmd} add ${y} count ip6 from any to any via ${k} out
   if [ ! x"${IPFW_LANS6}" == x"${i}" ]; then
    ${fwcmd} add skipto 11000 all from any to any
   fi
  fi
  y=$(( ${y} + 10 ))
 done
 ${fwcmd} add 11000 ${IPFW_allow} ipv6-icmp from ::/128 to ff02::/16
 ${fwcmd} add ${IPFW_allow} ipv6-icmp from fe80::/10 to fe80::/10
 ${fwcmd} add ${IPFW_allow} ipv6-icmp from fe80::/10 to ff02::/16
 ${fwcmd} add ${IPFW_allow} ipv6-icmp from any to any icmp6types 1,2,128,129,135,136
 ${fwcmd} add ${IPFW_allowlog} ipv6-icmp from any to any
 ${fwcmd} add ${IPFW_allow} ip6 from fe80::/10 546,547 to fe80::/10 546,547
 ${fwcmd} add ${IPFW_allow} ip6 from fe80::/10 521,546,547 to ff02::/16 521,546,547
 ${fwcmd} add ${IPFW_allow} ip6 from table\(LOCAL_RANGES6\) to table\(LOCAL_RANGES6\)
 ${fwcmd} add ${IPFW_deny} ip6 from fe80::/10 to ff02::/16 5355
###
 for ports in $(array_groupby "${IPFW_known_ports}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} ip6 from any to any ${ports}
   ${fwcmd} add ${IPFW_allow} ip6 from any ${ports} to any
  fi
 done
###
 ${fwcmd} add 14900 ${IPFW_allowlog} tcp from any to any
 ${fwcmd} add ${IPFW_allowlog} udp from any to any
 ${fwcmd} add ${IPFW_allowlog} all from any to any
########################
# All LANs IPv6 in
 y=15000
 for i in ${IPFW_LANS6_list}; do
  j="IPFW_iip${i}_6"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_iif${i}"
   eval k="\$${k}"
   ${fwcmd} add ${y} count ip6 from any to any via ${k} in
   if [ ! x"${IPFW_LANS6}" == x"${i}" ]; then
    ${fwcmd} add skipto 16000 all from any to any
   fi
  fi
  y=$(( ${y} + 10 ))
 done
 ${fwcmd} add 16000 ${IPFW_allow} ipv6-icmp from ::/128 to ff02::/16
 ${fwcmd} add ${IPFW_allow} ipv6-icmp from fe80::/10 to fe80::/10
 ${fwcmd} add ${IPFW_allow} ipv6-icmp from fe80::/10 to ff02::/16
 ${fwcmd} add ${IPFW_allow} ipv6-icmp from any to any icmp6types 1,2,128,129,135,136
 ${fwcmd} add ${IPFW_allowlog} ipv6-icmp from any to any
 ${fwcmd} add ${IPFW_allow} ip6 from fe80::/10 546,547 to fe80::/10 546,547
 ${fwcmd} add ${IPFW_allow} ip6 from fe80::/10 521,546,547 to ff02::/16 521,546,547
 ${fwcmd} add ${IPFW_allow} ip6 from table\(LOCAL_RANGES6\) to table\(LOCAL_RANGES6\)
 ${fwcmd} add ${IPFW_deny} ip6 from fe80::/10 to ff02::/16 5355
###
 for ports in $(array_groupby "${IPFW_known_ports}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} ip6 from any to any ${ports}
   ${fwcmd} add ${IPFW_allow} ip6 from any ${ports} to any
  fi
 done
###
 ${fwcmd} add 19900 ${IPFW_allowlog} tcp from any to any
 ${fwcmd} add ${IPFW_allowlog} udp from any to any
 ${fwcmd} add ${IPFW_allowlog} all from any to any
########################
fi
if [ "${IPFW_LAN_4}" == "1" ]; then
########################
# All LANs IPv4 out
 y=20000
 for i in ${IPFW_LANS_list}; do
  j="IPFW_iip${i}"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_iif${i}"
   eval k="\$${k}"
   ${fwcmd} add ${y} count ip4 from any to any via ${k} out
   if [ ! x"${IPFW_LANS}" == x"${i}" ]; then
    ${fwcmd} add skipto 21000 all from any to any
   fi
  fi
  y=$(( ${y} + 10 ))
 done
 ${fwcmd} add 21000 ${IPFW_allow} icmp from any to any
 ${fwcmd} add ${IPFW_allow} ip4 from table\(LOCAL_RANGES\) to table\(LOCAL_RANGES\)
###
 for ports in $(array_groupby "${IPFW_known_ports}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} ip4 from any to any ${ports}
   ${fwcmd} add ${IPFW_allow} ip4 from any ${ports} to any
  fi
 done
###
 ${fwcmd} add 24900 ${IPFW_allowlog} tcp from any to any
 ${fwcmd} add ${IPFW_allowlog} udp from any to any
 ${fwcmd} add ${IPFW_allowlog} gre from any to any
 ${fwcmd} add ${IPFW_allowlog} igmp from any to any
 ${fwcmd} add ${IPFW_allowlog} l2tp from any to any
 ${fwcmd} add ${IPFW_allowlog} esp from any to any
 ${fwcmd} add ${IPFW_allowlog} ah from any to any
 ${fwcmd} add ${IPFW_allowlog} all from any to any
########################
# All LANs IPv4 in
 y=25000
 for i in ${IPFW_LANS_list}; do
  j="IPFW_iip${i}"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_iif${i}"
   eval k="\$${k}"
   ${fwcmd} add ${y} count ip4 from any to any via ${k} in
   if [ ! x"${IPFW_LANS}" == x"${i}" ]; then
    ${fwcmd} add skipto 26000 all from any to any
   fi
  fi
  y=$(( ${y} + 10 ))
 done
 ${fwcmd} add 26000 ${IPFW_allow} icmp from any to any
 ${fwcmd} add ${IPFW_allow} ip4 from table\(LOCAL_RANGES\) to table\(LOCAL_RANGES\)
### MULTI ISP - WAN failover
 if [ ${IPFW_multiwan} -eq 1 ]; then
  for i in ${IPFW_WANS_list}; do
   j="IPFW_oip${i}"
   eval j="\$${j}"
   if [ -n "${j}" ]; then
    TEST="MWAN_PORTS${i}";
    eval TEST="\$${TEST}"
    if [ -n "${TEST}" ]; then
     for ports in $(array_groupby "${TEST}" "20"); do
      if [ -n "${ports}" ]; then
       define_multiwan "port" "${ports}" "${i}"
      fi
     done
    fi
   fi
  done
  for i in ${IPFW_WANS_list}; do
   j="IPFW_oip${i}"
   eval j="\$${j}"
   if [ -n "${j}" ]; then
    TEST="MWAN_TABLES${i}";
    eval TEST="\$${TEST}"
    if [ -n "${TEST}" ]; then
     for tables in $(array_groupby "${TEST}" "20"); do
      if [ -n "${tables}" ]; then
       define_multiwan "srchost" "${tables}" "${i}"
      fi
     done
    fi
   fi
  done
  for i in ${IPFW_WANS_list}; do
   j="IPFW_oip${i}"
   eval j="\$${j}"
   if [ -n "${j}" ]; then
    define_multiwan "srchost" "WAN${i}" "${i}"
    k="IPFW_ofib${i}"
    eval k="\$${k}"
    l="IPFW_onet${i}"
    eval l="\$${l}"
    ${fwcmd} add setfib ${k} all from any to ${l}
   fi
  done
 fi
###
 for ports in $(array_groupby "${IPFW_known_ports}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} ip4 from any to any ${ports}
   ${fwcmd} add ${IPFW_allow} ip4 from any ${ports} to any
  fi
 done
###
 ${fwcmd} add 29900 ${IPFW_allowlog} tcp from any to any
 ${fwcmd} add ${IPFW_allowlog} udp from any to any
 ${fwcmd} add ${IPFW_allowlog} gre from any to any
 ${fwcmd} add ${IPFW_allowlog} igmp from any to any
 ${fwcmd} add ${IPFW_allowlog} l2tp from any to any
 ${fwcmd} add ${IPFW_allowlog} esp from any to any
 ${fwcmd} add ${IPFW_allowlog} ah from any to any
 ${fwcmd} add ${IPFW_allowlog} all from any to any
########################
fi

########################
########################
if [ "${IPFW_WAN_6}" == "1" ]; then
########################
# All WANs IPv6 in
 y=30000
 for i in ${IPFW_WANS6_list}; do
  j="IPFW_oip${i}_6"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_oif${i}"
   eval k="\$${k}"
   ${fwcmd} add ${y} count ip6 from any to any via ${k} in
   if [ ! x"${IPFW_WANS6}" == x"${i}" ]; then
    ${fwcmd} add skipto 31000 all from any to any
   fi
  fi
  y=$(( ${y} + 10 ))
 done
 ${fwcmd} add 31000 ${IPFW_allow} ipv6-icmp from ::/128 to ff02::/16
 ${fwcmd} add ${IPFW_allow} ipv6-icmp from fe80::/10 to fe80::/10
 ${fwcmd} add ${IPFW_allow} ipv6-icmp from fe80::/10 to ff02::/16
 ${fwcmd} add ${IPFW_allow} ipv6-icmp from any to any icmp6types 1,2,128,129,135,136
 ${fwcmd} add ${IPFW_allowlog} ipv6-icmp from any to any
 ${fwcmd} add ${IPFW_allow} ip6 from fe80::/10 546,547 to fe80::/10 546,547
 ${fwcmd} add ${IPFW_allow} ip6 from fe80::/10 521,546,547 to ff02::/16 521,546,547
 ${fwcmd} add ${IPFW_deny} ip6 from fe80::/10 to ff02::/16 5355
 ${fwcmd} add ${IPFW_deny} ip6 from table\(BLACKLIST6\) to any
 ${fwcmd} add ${IPFW_deny} ip6 from table\(BLACKLIST_RMT6\) to any
 ${fwcmd} add ${IPFW_deny} ip6 from table\(BLACKLIST_IMP6\) to any
 ${fwcmd} add ${IPFW_deny} ip6 from table\(BLACKLIST_GEO6\) to any
 ${fwcmd} add ${IPFW_denylog} ip6 from table\(BLOCKED_RANGES6\) to any
# blocked WAN IN dstports (logging enabled)
 block_dstports "in6log" "${IPFW_wan6_in_dstports}"
# replies to allowed WAN OUT dstports
 for ports in $(array_groupby "${IPFW_wan6_out_allowed_udp}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} udp from any ${ports} to table\(OUT_RANGES6\) ${IPFW_unprivports}
  fi
 done
 for ports in $(array_groupby "${IPFW_wan6_out_allowed_tcp}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} tcp from any ${ports} to table\(OUT_RANGES6\) ${IPFW_unprivports}
  fi
 done
# allowed WAN IN dstports
 i=0
 for protoport in ${PROTOPORT}; do
  protoip6=$(array_get "${PROTOIP6}" "${i}")
  if [ "${protoip6}" != "NONE" ]; then
   protocol=$(array_get "${PROTOCOL}" "${i}")
   protolog=$(array_get "${PROTOLOG}" "${i}")
   protoaction=$(array_get "${PROTOACTION}" "${i}")
   block_protocol "ipv6" "in" "${protoport}" "${protocol}" "${protolog}" "${protoip6}" "allow"
  fi
  i=$(( ${i} + 1 ))
 done
###
 for ports in $(array_groupby "${IPFW_known_ports}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} ip6 from any to any ${ports}
   ${fwcmd} add ${IPFW_allow} ip6 from any ${ports} to any
  fi
 done
###
 ${fwcmd} add 34900 ${IPFW_allowlog} tcp from any to any
 ${fwcmd} add ${IPFW_allowlog} udp from any to any
 ${fwcmd} add ${IPFW_allowlog} all from any to any
########################
# All WANs IPv6 out
 y=35000
 for i in ${IPFW_WANS6_list}; do
  j="IPFW_oip${i}_6"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_oif${i}"
   eval k="\$${k}"
   ${fwcmd} add ${y} count ip6 from any to any via ${k} out
   if [ ! x"${IPFW_WANS6}" == x"${i}" ]; then
    ${fwcmd} add skipto 36000 all from any to any
   fi
  fi
  y=$(( ${y} + 10 ))
 done
 ${fwcmd} add 36000 ${IPFW_allow} ipv6-icmp from ::/128 to ff02::/16
 ${fwcmd} add ${IPFW_allow} ipv6-icmp from fe80::/10 to fe80::/10
 ${fwcmd} add ${IPFW_allow} ipv6-icmp from fe80::/10 to ff02::/16
 ${fwcmd} add ${IPFW_allow} ipv6-icmp from any to any icmp6types 1,2,128,129,135,136
 ${fwcmd} add ${IPFW_allowlog} ipv6-icmp from any to any
 ${fwcmd} add ${IPFW_allow} ip6 from fe80::/10 546,547 to fe80::/10 546,547
 ${fwcmd} add ${IPFW_allow} ip6 from fe80::/10 521,546,547 to ff02::/16 521,546,547
 ${fwcmd} add ${IPFW_deny} ip6 from fe80::/10 to ff02::/16 5355
 ${fwcmd} add ${IPFW_deny} ip6 from any to table\(BLACKLIST6\)
 ${fwcmd} add ${IPFW_deny} ip6 from any to table\(BLACKLIST_RMT6\)
 ${fwcmd} add ${IPFW_deny} ip6 from any to table\(BLACKLIST_IMP6\)
 ${fwcmd} add ${IPFW_deny} ip6 from any to table\(BLACKLIST_GEO6\)
 ${fwcmd} add ${IPFW_denylog} ip6 from any to table\(BLOCKED_RANGES6\)
# blocked WAN OUT dstports (logging enabled)
 block_dstports "out6log" "${IPFW_wan6_out_dstports}"
 for table in ${BLOCK_TABLESRC_6}; do
  if [ -n "${table}" ]; then
   block_srchost "${table}"
  fi
 done
 for table in ${BLOCK_TABLEDST_6}; do
  if [ -n "${table}" ]; then
   block_dsthost "${table}"
  fi
 done
# allowed WAN OUT dstports
 for ports in $(array_groupby "${IPFW_wan6_out_allowed_udp}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} udp from table\(OUT_RANGES6\) ${IPFW_unprivports} to any ${ports}
  fi
 done
 for ports in $(array_groupby "${IPFW_wan6_out_allowed_tcp}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} tcp from table\(OUT_RANGES6\) ${IPFW_unprivports} to any ${ports}
  fi
 done
# replies to allowed WAN IN dstports
 i=0
 for protoport in ${PROTOPORT}; do
  protoip6=$(array_get "${PROTOIP6}" "${i}")
  if [ "${protoip6}" != "NONE" ]; then
   protoaction=$(array_get "${PROTOACTION}" "${i}")
   if [ "${protoaction}" != "deny" ]; then
    protocol=$(array_get "${PROTOCOL}" "${i}")
    protolog=$(array_get "${PROTOLOG}" "${i}")
    block_protocol "ipv6" "outreply" "${protoport}" "${protocol}" "${protolog}" "${protoip6}" "allow"
   fi
  fi
  i=$(( ${i} + 1 ))
 done
###
 for ports in $(array_groupby "${IPFW_known_ports}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} ip6 from any to any ${ports}
   ${fwcmd} add ${IPFW_allow} ip6 from any ${ports} to any
  fi
 done
###
 ${fwcmd} add 39900 ${IPFW_allowlog} tcp from any to any
 ${fwcmd} add ${IPFW_allowlog} udp from any to any
 ${fwcmd} add ${IPFW_allowlog} all from any to any
########################
fi
if [ "${IPFW_WAN_4}" == "1" ]; then
########################
# All WANs IPv4 in
 y=40000
 for i in ${IPFW_WANS_list}; do
  j="IPFW_oip${i}"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_oif${i}"
   eval k="\$${k}"
   ${fwcmd} add ${y} count ip4 from any to any via ${k} in
   if [ ! x"${IPFW_WANS}" == x"${i}" ]; then
    ${fwcmd} add skipto 41000 all from any to any
   fi
  fi
  y=$(( ${y} + 10 ))
 done
 ${fwcmd} add 41000 ${IPFW_deny} ip4 from table\(BLACKLIST\) to any
 ${fwcmd} add ${IPFW_deny} ip4 from table\(BLACKLIST_RMT\) to any
 ${fwcmd} add ${IPFW_deny} ip4 from table\(BLACKLIST_IMP\) to any
 ${fwcmd} add ${IPFW_deny} ip4 from table\(BLACKLIST_GEO\) to any
 ${fwcmd} add ${IPFW_deny} igmp from any to any
 ${fwcmd} add ${IPFW_denylog} ip4 from table\(BLOCKED_RANGES\) to any
# blocked WAN IN dstports (logging enabled)
 block_dstports "in4log" "${IPFW_wan4_in_dstports}"
# blocked WAN IN dstports
 i=0
 for protoport in ${PROTOPORT}; do
  protoip4=$(array_get "${PROTOIP4}" "${i}")
  if [ "${protoip4}" != "NONE" ]; then
   protoaction=$(array_get "${PROTOACTION}" "${i}")
   if [ "${protoaction}" = "deny" ]; then
    protocol=$(array_get "${PROTOCOL}" "${i}")
    protolog=$(array_get "${PROTOLOG}" "${i}")
    block_protocol "ipv4" "in" "${protoport}" "${protocol}" "${protolog}" "${protoip4}" "deny"
   fi
  fi
  i=$(( ${i} + 1 ))
 done
 i=0
 for protoport in ${PROTOPORT}; do
  protoip4=$(array_get "${PROTOIP4}" "${i}")
  if [ "${protoip4}" != "NONE" ]; then
   protoaction=$(array_get "${PROTOACTION}" "${i}")
   if [ "${protoaction}" != "deny" ]; then
    protocol=$(array_get "${PROTOCOL}" "${i}")
    protolog=$(array_get "${PROTOLOG}" "${i}")
    block_protocol "ipv4" "in" "${protoport}" "${protocol}" "${protolog}" "${protoip4}" "denyonly"
   fi
  fi
  i=$(( ${i} + 1 ))
 done
# NAT
 for i in ${IPFW_WANS_list}; do
  j="IPFW_nat${i}"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_oif${i}"
   eval k="\$${k}"
   ${fwcmd} add nat ${i} ip4 from any to any via ${k}
  fi
 done
 ${fwcmd} add ${IPFW_allow} icmp from any to any
# replies to allowed WAN OUT dstports
 for ports in $(array_groupby "${IPFW_wan4_out_allowed_udp}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} udp from any ${ports} to table\(OUT_RANGES\) ${IPFW_unprivports}
  fi
 done
 for ports in $(array_groupby "${IPFW_wan4_out_allowed_tcp}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} tcp from any ${ports} to table\(OUT_RANGES\) ${IPFW_unprivports}
  fi
 done
# allowed WAN IN dstports
 i=0
 for protoport in ${PROTOPORT}; do
  protoip4=$(array_get "${PROTOIP4}" "${i}")
  if [ "${protoip4}" != "NONE" ]; then
   protoaction=$(array_get "${PROTOACTION}" "${i}")
   if [ "${protoaction}" != "deny" ]; then
    protocol=$(array_get "${PROTOCOL}" "${i}")
    protolog=$(array_get "${PROTOLOG}" "${i}")
    block_protocol "ipv4" "in" "${protoport}" "${protocol}" "${protolog}" "${protoip4}" "nodeny"
   fi
  fi
  i=$(( ${i} + 1 ))
 done
###
 for ports in $(array_groupby "${IPFW_known_ports}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} ip4 from any to any ${ports}
   ${fwcmd} add ${IPFW_allow} ip4 from any ${ports} to any
  fi
 done
###
 ${fwcmd} add 44900 ${IPFW_allowlog} sctp from any to any
 ${fwcmd} add ${IPFW_allowlog} tcp from any to any
 ${fwcmd} add ${IPFW_allowlog} udp from any to any
 ${fwcmd} add ${IPFW_allowlog} all from any to any
########################
# All WANs IPv4 out
 y=45000
 for i in ${IPFW_WANS_list}; do
  j="IPFW_oip${i}"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_oif${i}"
   eval k="\$${k}"
   ${fwcmd} add ${y} count ip4 from any to any via ${k} out
   if [ ! x"${IPFW_WANS}" == x"${i}" ]; then
    ${fwcmd} add skipto 46000 all from any to any
   fi
  fi
  y=$(( ${y} + 10 ))
 done
 ${fwcmd} add 46000 ${IPFW_deny} ip4 from any to table\(BLACKLIST\)
 ${fwcmd} add ${IPFW_deny} ip4 from any to table\(BLACKLIST_RMT\)
 ${fwcmd} add ${IPFW_deny} ip4 from any to table\(BLACKLIST_IMP\)
 ${fwcmd} add ${IPFW_deny} ip4 from any to table\(BLACKLIST_GEO\)
 ${fwcmd} add ${IPFW_deny} igmp from any to any
 ${fwcmd} add ${IPFW_denylog} ip4 from any to table\(BLOCKED_RANGES\)
# blocked WAN OUT dstports (logging enabled)
 block_dstports "out4log" "${IPFW_wan4_out_dstports}"
 for table in ${BLOCK_TABLESRC}; do
  if [ -n "${table}" ]; then
   block_srchost "${table}"
  fi
 done
 for table in ${BLOCK_TABLEDST}; do
  if [ -n "${table}" ]; then
   block_dsthost "${table}"
  fi
 done
# blocked WAN OUT dstports
 i=0
 for protoport in ${PROTOPORT}; do
  protoip4=$(array_get "${PROTOIP4}" "${i}")
  if [ "${protoip4}" != "NONE" ]; then
   protoaction=$(array_get "${PROTOACTION}" "${i}")
   if [ "${protoaction}" != "deny" ]; then
    protocol=$(array_get "${PROTOCOL}" "${i}")
    protolog=$(array_get "${PROTOLOG}" "${i}")
    block_protocol "ipv4" "outreply" "${protoport}" "${protocol}" "${protolog}" "${protoip4}" "denyonly"
   fi
  fi
  i=$(( ${i} + 1 ))
 done
# NAT
 for i in ${IPFW_WANS_list}; do
  j="IPFW_nat${i}"
  eval j="\$${j}"
  if [ -n "${j}" ]; then
   k="IPFW_oif${i}"
   eval k="\$${k}"
   ${fwcmd} add nat ${i} ip4 from any to any via ${k}
  fi
 done
 ${fwcmd} add ${IPFW_allow} icmp from any to any
# allowed WAN OUT dstports
 for ports in $(array_groupby "${IPFW_wan4_out_allowed_udp}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} udp from table\(OUT_RANGES\) ${IPFW_unprivports} to any ${ports}
  fi
 done
 for ports in $(array_groupby "${IPFW_wan4_out_allowed_tcp}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} tcp from table\(OUT_RANGES\) ${IPFW_unprivports} to any ${ports}
  fi
 done
# replies to allowed WAN IN dstports
 i=0
 for protoport in ${PROTOPORT}; do
  protoip4=$(array_get "${PROTOIP4}" "${i}")
  if [ "${protoip4}" != "NONE" ]; then
   protoaction=$(array_get "${PROTOACTION}" "${i}")
   if [ "${protoaction}" != "deny" ]; then
    protocol=$(array_get "${PROTOCOL}" "${i}")
    protolog=$(array_get "${PROTOLOG}" "${i}")
    block_protocol "ipv4" "outreply" "${protoport}" "${protocol}" "${protolog}" "${protoip4}" "nodeny"
   fi
  fi
  i=$(( ${i} + 1 ))
 done
###
 for ports in $(array_groupby "${IPFW_known_ports}" "20"); do
  if [ -n "${ports}" ]; then
   ${fwcmd} add ${IPFW_allow} ip4 from any to any ${ports}
   ${fwcmd} add ${IPFW_allow} ip4 from any ${ports} to any
  fi
 done
###
 ${fwcmd} add 49900 ${IPFW_allowlog} tcp from any to any
 ${fwcmd} add ${IPFW_allowlog} sctp from any to any
 ${fwcmd} add ${IPFW_allowlog} udp from any to any
 ${fwcmd} add ${IPFW_allowlog} all from any to any
########################
fi

########################
# END
########################
${fwcmd} add 65500 ${IPFW_allowlog} ip from any to any