#!/bin/sh
# =====================================================================
#  Projet  : DARKWALL
#  Fichier : lib/firewallGateway
#  Auteur  : Nicolas "DarkHack" Chapuis (c) 2026
# ================== DARKHACK ==================
#        [ darkweb.fr  -  system online ]
#   Powered by Perplexity, your AI assistant
#       https://www.perplexity.ai
# ==============================================
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
# =====================================================================
if ! type "shInclude" > /dev/null 2>&1; then racineSh="${racineSh:-/etc/darksh}"; . "$racineSh/lib/shTools"; shDebugEnable="1";fi
rootDarkWall="${rootDarkWall:-/etc/darkwall}"
[ ! -d "$rootDarkWall" ] && shDebug 0 "exit cause rootDarWall is not dir:$rootDarkWall" && exit 0

requiresCmd=""
requiresCmd="printf timeout sleep kill cat echo sh rm mkdir grep md5sum"
requiresCmd="${requiresCmd} cut tr rev sort uniq awk head tail"
requiresCmd="${requiresCmd} ip iptables sed ping sh"
shWhichCmd $requiresCmd >/dev/null
shErrorOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

requiresCmd=""
requiresCmd="brctl ifup ifdown dhclient"
shWhichCmd $requiresCmd >/dev/null
shWarnOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

$( shInclude $rootDarkWall/lib/firewall )

firewallGatewayInit() {
 local log="firewallGatewayInit:"
 #
 # Initialisation de la table MANGLE
 #
 
 #iptables -t mangle -F
 #iptables -t mangle -X
 #iptables -t mangle -P PREROUTING ACCEPT
 #iptables -t mangle -P INPUT ACCEPT
 #iptables -t mangle -P OUTPUT ACCEPT
 #iptables -t mangle -P FORWARD ACCEPT
 #iptables -t mangle -P POSTROUTING ACCEPT
 local upnpRuleName="MINIUPNPD"
 iptoolsRuleCreate "nat" ""$upnpRuleName""
 iptoolsRuleCreate "filter" ""$upnpRuleName""
 iptoolsRuleCreate "mangle" ""$upnpRuleName""
 local upnpPeerRuleName="MINIUPNPD-PCP-PEER"
 iptoolsRuleCreate "nat" ""$upnpPeerRuleName""
 local upnpPostRoutingRuleName="MINIUPNPD-POSTROUTING"
 iptoolsRuleCreate "nat" ""$upnpPostRoutingRuleName""
 if command -v nft >/dev/null 2>&1; then
#  nft add table bridge br_mark
#  nft 'add chain bridge br_mark prerouting { type filter hook prerouting priority -300; }'
  nft add table inet mark_tbl
  nft 'add chain inet mark_tbl prerouting { type filter hook prerouting priority -150; policy accept; }'
 fi
}
# firewallGatewayCheck $jsonIfacePipe $jsonConfIfacePipe
firewallGatewayCheck() {
 local log="firewallGatewayCheck"
 local jsonIfacePipe="$1"
 local jsonConfIfacePipe="$2"
 
 local eth="$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "eth" )"
 local masterEth="$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "masterEth" )"
 if [ -z "${masterEth}" ];then local masterEth="$( $cmdEcho ${eth} | $cmdCut -d: -f 1 )";fi
 if [ "${masterEth}" = "lo" ];then
  shDebug 0 ""${log}" no gw for this ifaces :${eth}/${masterEth}"
  return ;
 fi
 local jsonEthRoute="$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "route" )"
 local markEthIn="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markIn" )"
 local markEthOut="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markOut" )"
 if [ -z "${eth}" ] || [ -z "${masterEth}" ] || [ -z "${jsonEthRoute}" ];then
  shDebug 0 ""${log}" echec empty eth:"${eth}" masterEth:"${masterEth}" jsonEthRoute:"${jsonEthRoute}""
  return ;
 elif [ -z "${markEthIn}" ] || [ -z "${markEthOut}" ];then
  shDebug 0 ""${log}" echec empty markEthIn:"${markEthIn}" markEthOut:"${markEthOut}""
  return ;
 else
  if [ "${eth}" = "${masterEth}" ];then
   local log=""${log}"["${eth}"]"
  else
   local log=""${log}"["${eth}"/"${masterEth}"]"
  fi
 fi
 shPipeInit "${log} jsonIps-gw"; local jsonIpsPipe=$?
 shPipeReadTee $jsonIfacePipe | json64InObjectRead ips | shPipeWrite $jsonIpsPipe
 if [ -z "$( shPipeReadTee $jsonIpsPipe )" ];then
  shDebug 0 ""${log}" echec empty jsonIpsPipe:$jsonIpsPipe "
 else
  for jsonKeyIp in $( shPipeReadTee $jsonIpsPipe | json64InObjectKeyList );do
   local log=""${log}"["${jsonKeyIp}"]"
   local jsonIp="$( shPipeReadTee $jsonIpsPipe | json64InObjectRead "${jsonKeyIp}" )"
   if [ -z "${jsonIp}" ];then
    shDebug 0 ""${log}" echec json ip not found :"${jsonKeyIp}""
    continue
   fi
   local net="$( $cmdEcho ${jsonIp} | json64InObjectRead "net" )"
   if [ -z "${net}" ];then
    shDebug 0 ""${log}" echec no found net:"${net}" in jsonIp:${jsonIp}"
    continue
   fi
   local jsonIpRoute="$( $cmdEcho ${jsonIp} | json64InObjectRead route )"
   local markNetIn="$( $cmdEcho ${jsonIpRoute} | json64InObjectRead "markIn" )"
   local markNetOut="$( $cmdEcho ${jsonIpRoute} | json64InObjectRead "markOut" )"
   local IPrtTableName="$( $cmdEcho ${jsonIpRoute} | jsonInObjectRead "rtTableName" )"
   if [ -z "${jsonIpRoute}" ] || [ -z "${markNetIn}" ] || [ -z "${markNetOut}" ];then
    shDebug 0 ""${log}" echec empty markNetIn:"${markNetIn}" markNetOut:"${markNetOut}" in jsonIpRoute:${jsonIpRoute}"
   else
    # local log="firewallGatewayCheck["${eth}"/"${jsonKeyIp}"/${net}]"
    local jsonGws="$( $cmdEcho ${jsonIp} | json64InObjectRead "gws" )"
    if [ -z "${jsonGws}" ];then
     #shDebugHidden 0 ""$log" no jsonGws" >&2
     local jsonGws="{}"
#   else
#    shDebugHidden 2 ""$log" gws exist..." >&2
    fi
    
    for gw in $(iptoolsGetGws "${eth}" "${net}" ) $( iptoolsHasMacNextHop "${eth}" && echo "_" );do
     if [ -z "${gw}" ];then continue;fi
     local log="${log}["${gw}"]"
     local jsonGw="$( $cmdEcho ${jsonGws} | json64InObjectRead "${gw}" )"
     if [ -z "${jsonGw}" ];then
      local jsonGw="$( $cmdEcho {} | json64InObjectWrite ip "${gw}" )"
      local jsonGw="$( $cmdEcho ${jsonGw} | json64InObjectWrite state offlink )"
      local files="$( shPipeReadTee $jsonConfIfacePipe | json64InObjectRead files )"
      if [ -z "${files}" ];then
       shDebug 0 ""${log}" no files:${files}"
      else
       shDebug 2 ""$log" try send :$( $cmdEcho ${files} | $cmdTr '|' ' ' )"
       for fileMode in $( $cmdEcho ${files} | $cmdTr '|' ' ' );do
        if [ -z "${fileMode}" ];then continue;fi
        #local file="$( $cmdEcho ${fileMode} | $cmdCut -d ';' -f 1 | $cmdBase64 -d -i 2>>/dev/null )"
        local mode="$( $cmdEcho ${fileMode} | $cmdCut -d ';' -f 2 )"
        if [ "${mode}" = "gw" ] || [ "${mode}" = "igw" ];then
         shDebug 2 ""$log" send :gateway ${eth} ${fileMode}"
#         $cmdEcho "gateway ${eth} ${fileMode}" >> "$firewallPipe" &
         $cmdSh ${rootDarkWall}/bin/tryPipeMessage "gateway ${eth} ${fileMode}" 2>&1 >> /tmp/tryPipeMessage.log &
        fi
       done
      fi
     fi
     local gwLinkState="$( $cmdEcho ${jsonGw} | json64InObjectRead state )"
     
     if [ "${gw}" = "_" ];then
      local jsonGwRoute="$( $cmdEcho ${jsonGw} | json64InObjectRead route )"
      if [ -z "${jsonGwRoute}" ];then
       local jsonGw="$( $cmdEcho ${jsonGw} | routeAddMacNextHop "${eth}" "${jsonKeyIp}" "${net}" "${markEthIn}" "${markNetIn}" )"
       local jsonGwRoute="$( $cmdEcho ${jsonGw} | json64InObjectRead route )"
#      firewalliStartFiles $jsonIfacePipe $jsonConfIfacePipe "${jsonKeyIp}" "${gw}" >> /ram/istart.log 2>&1
      else
       if [ "onlink" = "${gwLinkState}" ];then
        shDebug 1 ""${log}" ever online yet"
#       local pingInternet="$( $cmdPing -m ${rtTableCpt} -I ${masterEth} -c 1 8.8.8.8 2>/dev/null | grep time= )"
       else
        local rtTableName="$( $cmdEcho ${jsonGwRoute} | jsonInObjectRead "rtTableName" )"
        local rtTableCpt="$( $cmdEcho ${jsonGwRoute} | jsonInObjectRead "rtTableCpt" )"
        local jsonGw="$( $cmdEcho ${jsonGw} | json64InObjectWrite state onlink )"
        mangleEnableNextMacHop "${eth}" "${jsonKeyIp}" "${net}" "${rtTableName}"
        mangleEnableNextMacHop "${eth}" "${jsonKeyIp}" "${net}" "${IPrtTableName}"
        shDebug 1 ""${log}" default route via mac next hop switch to onlink. ${rtTableName}/${IPrtTableName}"
       fi
       local statsInternet="$( $cmdPing -I ${eth} -I ${jsonKeyIp} -c 10 8.8.8.8 2>&1 | $cmdTail -2l | $cmdHead -n 1 )"
       shDebug 1 ""${log}" 8.8.8.8 stats:${statsInternet}"
       local pingInternet="$( $cmdPing -I ${eth}-I ${jsonKeyIp} -c 1 8.8.8.8 2>/dev/null | grep time= )"
       if [ -n "${pingInternet}" ];then
        shDebug 1 ""${log}" gw has responded for 8.8.8.8:${pingInternet}"
       else
        shDebug 0 ""${log}" echec test 8.8.8.8 ${eth}:$cmdPing -I ${eth} -I ${jsonKeyIp} -c 1 8.8.8.8"
       fi
      fi
     else
#      if [ -n "$( $cmdPing -m ${rtTableCpt} -I ${masterEth} -c 1 ${gw} 2>/dev/null | grep time= )" ];then
      local statsGateway="$( $cmdPing -I ${eth} -I ${jsonKeyIp} -c 10 ${gw} 2>&1 | $cmdTail -2l | $cmdHead -n 1 )"
      shDebug 1 ""${log}" gw stats:${statsGateway}"
      if [ -z "$( $cmdPing -I ${eth} -I ${jsonKeyIp} -c 1 ${gw} 2>/dev/null | grep time= )" ];then
       shDebug 0 ""${log}" gw '${gw}' no ping. $cmdPing -I ${eth} -I ${jsonKeyIp} -c 1 ${gw}"
       if [ "onlink" = "${gwLinkState}" ];then
        shDebug 0 ""${log}" gw '${gw}' switch to offlink."
        local jsonGw="$( $cmdEcho ${jsonGw} | json64InObjectWrite state offlink )"
#       mangleDisableGw "${eth}" "${jsonKeyIp}" "${net}" "${gw}" "${rtTableName}"
       fi
      else
       shDebug 1 ""${log}" gw:${gw} has responded."
       local jsonGwRoute="$( $cmdEcho ${jsonGw} | json64InObjectRead route )"
       if [ -z "${jsonGwRoute}" ];then
        local jsonGw="$( $cmdEcho ${jsonGw} | routeAddGw "${eth}" "${jsonKeyIp}" "${net}" "${markEthIn}" "${markNetIn}" )"
        local jsonGwRoute="$( $cmdEcho ${jsonGw} | json64InObjectRead route )"
        firewalliStartFiles $jsonIfacePipe $jsonConfIfacePipe "${jsonKeyIp}" "${gw}" >> /ram/istart.log 2>&1
       else
        if [ "onlink" = "${gwLinkState}" ];then
         shDebug 1 ""${log}" ever online yet"
#         local pingInternet="$( $cmdPing -m ${rtTableCpt} -I ${masterEth} -c 1 8.8.8.8 2>/dev/null | grep time= )"
        else
         local rtTableName="$( $cmdEcho ${jsonGwRoute} | jsonInObjectRead "rtTableName" )"
         local rtTableCpt="$( $cmdEcho ${jsonGwRoute} | jsonInObjectRead "rtTableCpt" )"
         local jsonGw="$( $cmdEcho ${jsonGw} | json64InObjectWrite state onlink )"
         mangleEnableGw "${eth}" "${jsonKeyIp}" "${net}" "${gw}" "${rtTableName}"
         mangleEnableGw "${eth}" "${jsonKeyIp}" "${net}" "${gw}" "${IPrtTableName}"
         shDebug 1 ""${log}" gw '${gw}' switch to onlink. ${rtTableName}/${IPrtTableName}"
        fi
        local statsInternet="$( $cmdPing -I ${eth} -I ${jsonKeyIp} -c 10 8.8.8.8 2>&1 | $cmdTail -2l | $cmdHead -n 1 )"
        shDebug 1 ""${log}" 8.8.8.8 stats:${statsInternet}"
        local pingInternet="$( $cmdPing -I ${eth} -I ${jsonKeyIp} -c 1 8.8.8.8 2>/dev/null | grep time= )"
        if [ -n "${pingInternet}" ];then
         shDebug 1 ""${log}" gw has responded for 8.8.8.8:${pingInternet}"
        else
         shDebug 0 ""${log}" echec test 8.8.8.8 ${eth}:$cmdPing -I ${eth} -I ${jsonKeyIp} -c 1 8.8.8.8 2>&1 | grep time="
        fi
       fi
      fi
     fi
#=====================================
     local jsonGws="$( $cmdEcho ${jsonGws} | json64InObjectWrite "${gw}" "${jsonGw}" )"
    done
#==========================================================
    local jsonIp="$( $cmdEcho ${jsonIp} | json64InObjectWrite "gws" "${jsonGws}" )"
    shPipeInit "${log} jsonBuffer-gw"; local jsonBufferPipe=$?
    shPipeRead $jsonIpsPipe  | json64InObjectWrite "${jsonKeyIp}" "${jsonIp}" | shPipeWrite $jsonBufferPipe
    shPipeRead $jsonBufferPipe | shPipeWrite $jsonIpsPipe
    shPipeFree $jsonBufferPipe
   fi
  done
  jsonWriteBig "ips" "$jsonIfacePipe" "$jsonIpsPipe"
 fi
 shPipeFree $jsonIpsPipe
}

# firewalliStartFiles $jsonIfacePipe $jsonConfIfacePipe "${ip}" "${gw}"
firewalliStartFiles() {
 local jsonIfacePipe="$1"
 local jsonConfIfacePipe="$2"
 local ip="$3"
 local gw="$4"
 
 local files="$( shPipeReadTee $jsonConfIfacePipe | json64InObjectRead files )"
 if [ -z "${files}" ];then shDebug 2 ""$log" no files:${files}";fi
 for fileMode in $( $cmdEcho ${files} | $cmdTr '|' ' ' );do
  if [ -z "${fileMode}" ];then continue;fi
  local file="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 1 )"
  local mode="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 2 )"
  if [ "$mode" != "inet" ] && [ "$mode" != "bridge" ];then
#  shDebug 2 ""${log}" ip:${ip} is Global for inet skipe ${mode} ${file} "
   continue;
  fi
  shPipeReadTee $jsonIfacePipe | firewalliStartFile "${ip}" "${gw}" "${mode}" "${file}"
 done
}
# echo ${jsonEth} | firewalliStartFile "${ip}" "${gw}" "${mode}" "${file}"
firewalliStartFile() {
 local log="firewalliStartFile"
 local ip="${1}"
 local gw="${2}"
 local mode="${3}"
 local file="$( $cmdEcho ${4} | $cmdBase64 -d -i 2>>/dev/null )"
 
 local jsonEth="$( $cmdCat <&0 )"
 local eth="$( $cmdEcho ${jsonEth} | json64InObjectRead eth )"
 local jsonEthRoute="$( $cmdEcho ${jsonEth} | json64InObjectRead route )"
 local markEthIn="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markIn" )"
 local markEthOut="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markOut" )"
 
 if [ -z "${gw}" ] || [ -z "${ip}" ] || [ -z "${eth}" ] || [ -z "${markEthIn}" ] || [ -z "${markEthOut}" ];then
  shDebug 0 ""${log}" bad params empty gw:${gw} ip:${ip} eth:${eth} markEthIn:${markEthIn} markEthOut:${markEthOut} jsonEthRoute:${jsonEthRoute} jsonEth:${jsonEth}"
 else
  local log="${log}[${eth}/${gw}]"
  if ipIsInNetwork ${ip} "127.0.0.1/8" ; then
   shDebug 2 ""${log}" ip:${ip} is LinkLoop skipe."
  else
   shDebug 1 ""${log}" ${eth} ${ip} <=> ${gw}"
   local jsonIps="$( $cmdEcho ${jsonEth} | json64InObjectRead ips )"
   local jsonIp="$( $cmdEcho ${jsonIps} | json64InObjectRead "${ip}" )"
   local net="$( $cmdEcho ${jsonIp} | json64InObjectRead net )"
   local broadcast="$( $cmdEcho ${jsonIp} | json64InObjectRead broadcast )"
   
   local jsonIpRoute="$( $cmdEcho ${jsonIp} | json64InObjectRead route )"
   local markNetIn="$( $cmdEcho ${jsonIpRoute} | json64InObjectRead "markIn" )"
   local markNetOut="$( $cmdEcho ${jsonIpRoute} | json64InObjectRead "markOut" )"
   
   if [ -z "${net}" ] || [ -z "${markNetIn}" ] || [ -z "${markNetOut}" ];then
    shDebug 0 ""${log}" bad params empty net:${net} markNetIn:${markNetIn} markNetOut:${markNetOut} jsonIp:${jsonIp}"
   else
    local log="${log}[${markNetIn}/${markNetOut}]"
    # ==================================================================================================
    local clients="";local servers=""
    local dropIn="";local dropOut="";local ruleIn="";local ruleOut="";local icmpIn="";local icmpOut=""
    local dropEthIn="";local dropEthOut="";local ruleEthIn="";local ruleEthOut="";local icmpEthIn="";local icmpEthOut=""
    local network="${net}";local markExtraIn="";local markExtraOut="";
    
    if [ ! -f "${file}" ];then shDebug 0 ""$log" echec not file:${file} fileMode:${fileMode}";continue;fi
    $(shIncludeET $file)
    if [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ] && [ -z "$icmpIn" ] && [ -z "$icmpOut" ] \
    && [ -z "$dropEthIn" ] && [ -z "$dropEthOut" ] && [ -z "$ruleEthIn" ] && [ -z "$ruleEthOut" ] && [ -z "$icmpEthIn" ] && [ -z "$icmpEthOut" ] \
    && [ -z "$clients" ] && [ -z "$servers" ];then
     shDebug 0 ""$log" echec params empty (ip:"${ip}"):clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut" icmpIO:"$icmpIn"/"$icmpOut" dropEthIO:"$dropEthIn"/"$dropEthOut" ruleEthIO:"$ruleEthIn"/"$ruleEthOut" icmpEthIO:"$icmpEthIn"/"$icmpEthOut""
    else
     shDebug 2 ""$log" "$eth"/ file:"$file" ip:"${ip}" net:"${net}" gw:"${gw}" broadcast:"${broadcast}""
     local fileName="$( $cmdEcho ${file} | $cmdRev | $cmdCut -d/ -f1 | $cmdTr -d '[[:blank:]]' | $cmdHead -c 22 | $cmdRev )"
     for subNet in $( $cmdEcho ${network} | $cmdTr ';' ' ' );do
#      if [ -n "${subNet}" ] && [ "${subNet}" != "${net}" ];then
      if [ -n "${subNet}" ];then
       local anMarkExtraIn="$( iptoolsGetMd5Rule "filter" "i${eth}${subNet}" )"
       local anMarkExtraOut="$( iptoolsGetMd5Rule "filter" "o${eth}${subNet}" )"
       iptoolsRuleAdd "filter" "$markEthIn -s "${subNet}" -d "${ip}" -j "${anMarkExtraIn}"" >&2
       iptoolsRuleAdd "filter" "$markEthOut -d "${subNet}" -s "${ip}" -j "${anMarkExtraOut}"" >&2
       local markExtraIn="${anMarkExtraIn};${markExtraIn}"
       local markExtraOut="${anMarkExtraOut};${markExtraOut}"
      fi
     done
     
     if [ -n "$dropEthIn" ] || [ -n "$dropEthOut" ] || [ -n "$ruleEthIn" ] || [ -n "$ruleEthOut" ] || [ -n "$icmpEthIn" ] || [ -n "$icmpEthOut" ];then
      local pFileEthIn="$(firewallCreateRule i"${fileName}")"
      local pFileEthOut="$(firewallCreateRule o"${fileName}")"
      iptoolsRuleAdd "filter" "${markEthIn}"	"-j ${pFileEthIn}"
      iptoolsRuleAdd "filter" "${markEthOut}"	"-j ${pFileEthOut}"
      if [ -n "$dropEthIn" ];then iptoolsRulesExecute "iptoolsRuleAdd"		"filter" "$pFileEthIn"	"$dropEthIn"	"-j DROP";fi
      if [ -n "$dropEthOut" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pFileEthOut"	"$dropEthOut"	"-j DROP";fi
      if [ -n "$ruleEthIn" ];then iptoolsRulesExecute "iptoolsRuleAdd"		"filter" "$pFileEthIn"	"$ruleEthIn"	"-j ACCEPT";fi
      if [ -n "$ruleEthOut" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pFileEthOut"	"$ruleEthOut"	"-j ACCEPT";fi
      
      if [ -n "${icmpEthIn}" ];then
       local ruleIcmpEthIn="$(firewallCreateRule i"${fileName}")"
       iptoolsRuleAdd "filter" "$pFileEthIn -p icmp  -j ${ruleIcmpEthIn}"
       iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIcmpEthIn""	"$icmpEthIn"	"-j ACCEPT"
      fi
      if [ -n "${icmpEthOut}" ];then
       local ruleIcmpEthOut="$(firewallCreateRule o"${fileName}")"
       iptoolsRuleAdd "filter" "$pFileEthOut -p icmp  -j ${ruleIcmpEthOut}"
       iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIcmpEthOut""	"$icmpEthOut"	"-j ACCEPT"
      fi
     fi
     # / if dropEthIn dropEthOut ruleEthIn ruleEthOut icmpEthIn icmpEthOut
     if [ -n "$dropIn" ] || [ -n "$dropOut" ] || [ -n "$ruleIn" ] || [ -n "$ruleOut" ] || [ -n "$icmpIn" ] || [ -n "$icmpOut" ] || [ -n "${clients}" ] || [ -n "${servers}" ];then
      local pFileIn="$(firewallCreateRule i"${fileName}")"
      local pFileOut="$(firewallCreateRule o"${fileName}")"
      for anMark in $( $cmdEcho ${markExtraIn} | $cmdTr ';' ' ' );do
       iptoolsRuleAdd "filter" "${anMark}"	"-j ${pFileIn}"
      done
      for anMark in $( $cmdEcho ${markExtraOut} | $cmdTr ';' ' ' );do
       iptoolsRuleAdd "filter" "${anMark}"	"-j ${pFileOut}"
      done
      if [ -n "$dropIn" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pFileIn"	"$dropIn"	"-j DROP";fi
      if [ -n "$dropOut" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pFileOut"	"$dropOut"	"-j DROP";fi
      if [ -n "$ruleIn" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pFileIn"	"$ruleIn"	"-j ACCEPT";fi
      if [ -n "$ruleOut" ];then iptoolsRulesExecute "iptoolsRuleAdd"	"filter" "$pFileOut"	"$ruleOut"	"-j ACCEPT";fi
      
      if [ -n "${icmpIn}" ] || [ -n "${icmpOut}" ] || [ -n "${clients}" ] || [ -n "${servers}" ];then
       # network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
       local ruleNetworkIn="$(firewallCreateRule iN"${fileName}")"
       local ruleNetworkOut="$(firewallCreateRule oN"${fileName}")"
#       iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" "$pFileIn"	"-s" "${markExtraIn}"	"-j "$ruleNetworkIn""
#       iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" "$pFileOut"	"-d" "${markExtraOut}"	"-j "$ruleNetworkOut""
       iptoolsRuleAdd "filter" "${pFileIn}"	"-j ${ruleNetworkIn}"
       iptoolsRuleAdd "filter" "${pFileOut}"	"-j ${ruleNetworkOut}"
       
       if [ -n "${icmpIn}" ];then
        local ruleIcmpIn="$(firewallCreateRule i"${fileName}")"
        iptoolsRuleAdd "filter" "${ruleNetworkIn} -p icmp  -j ${ruleIcmpIn}"
        iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIcmpIn""	"$icmpIn"	"-j ACCEPT"
       fi
       if [ -n "${icmpOut}" ];then
        local ruleIcmpOut="$(firewallCreateRule o"${fileName}")"
        iptoolsRuleAdd "filter" "${ruleNetworkOut} -p icmp  -j ${ruleIcmpOut}"
        iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIcmpOut""	"$icmpOut"	"-j ACCEPT"
       fi
       
       local clients="$( $cmdEcho $clients | $cmdTr -d ' ' | $cmdTr -d '\t')"
       if [ -n "$clients" ];then
        local clientsRulesName="$(firewallClientConf "$clients")"
        if [ -n "$clientsRulesName" ];then
         iptoolsRuleAdd "filter" "$ruleNetworkIn  -j "$( $cmdEcho $clientsRulesName | $cmdCut -f1 -d '|')""
         iptoolsRuleAdd "filter" "$ruleNetworkOut -j "$( $cmdEcho $clientsRulesName | $cmdCut -f2 -d '|')""
        else
         shDebug 0 ""$log" no clientsRulesName for clients:$clients"
        fi
       fi
       
       local servers="$( $cmdEcho $servers | $cmdTr -d ' ' | $cmdTr -d '\t')"
       if [ -n "$servers" ];then
        local serversRulesName="$(firewallServerConf "$servers")"
        if [ -n "$serversRulesName" ];then
         iptoolsRuleAdd "filter" "$ruleNetworkIn  -j "$( $cmdEcho $serversRulesName | $cmdCut -f1 -d '|')""
         iptoolsRuleAdd "filter" "$ruleNetworkOut -j "$( $cmdEcho $serversRulesName | $cmdCut -f2 -d '|')""
        else
         shDebug 0 ""$log" no serversRulesName for servers:$servers"
        fi
       fi
      fi
      #  / if icmpIn icmpOut clients servers
     fi
     # / if dropIn dropOut ruleIn ruleOut icmpIn icmpOut
    fi
    # / if file good params
   fi
   # / mark is valide
  fi
  # / if not inside 127.0.0.1
 fi
# $cmdEcho ${jsonEth}
}
#====================================================================================

#  local jsonGw="$( $cmdEcho ${jsonGw} | json64InObjectWrite state offlink )"
# $cmdEcho ${jsonGw} | firewallGatewayAddGw "${eth}" "${ip}" "${markEthIn}" "${markNetIn}"
#        local refreshMangle=1
firewallGatewayAddGw() {
 local log="firewallGatewayAddGw[$*]:"
 local jsonGw="$( $cmdCat <&0 )"
 if [ -z "${jsonGw}" ];then
  shDebugHidden 0 ""$log" no jsonGw in stdin" >&2
  return ;
 fi
 
 local eth="${1}"
 local ip="${2}"
 local markEthIn="${3}"
 local markNethIn="${4}"
 local gw="$( $cmdEcho ${jsonGw} | json64InObjectRead ip )"
 if [ -z "${eth}" ] || [ -z "${gw}" ] || [ -z "${ip}" ] || [ -z "${markEthIn}" ] || [ -z "${markNetIn}" ];then
   shDebugHidden 0 ""${log}" bad params eth:${eth} gw:${gw} ip:${ip} markEthIn:${markEthIn} markNetIn:${markNetIn}" >&2
 else
  local log="firewallGatewayAddGw[${eth}/${ip}/${gw}]:"
  local jsonGwRoute="$( $cmdEcho ${jsonGw} | json64InObjectRead route )"
  if [ -z "${jsonGwRoute}" ];then
   local mac="$( getMacForIpInEth "${gw}" "${eth}" )"
   if [ -z "${mac}" ];then 
#  if [ -z "${mac}" ] && [ -z "$(echo ${eth} | grep tun)" ];then
    shDebugHidden 0 ""${log}" no MAC for ${gw}, have to try later" >&2
   else
    local jsonGw="$( $cmdEcho ${jsonGw} | routeAddGw "${eth}" "${jsonKeyIp}" "${markEthIn}" "${markNetIn}" )"
    shDebugHidden 1 ""${log}" '"${gw}"/mac:"${mac}"' register mac route" >&2
    
#    if [ -z "${mac}" ];then
#     local jsonGwRoute="$( $cmdEcho {} | routeTableGetFromData "${eth}${ip}${net}" )"
#    else
     local jsonGwRoute="$( $cmdEcho {} | routeTableGetFromData "${eth}${ip}${gw}" )"
#    fi
    local rtTablePrio="$( $cmdEcho ${jsonGwRoute} | jsonInObjectRead "rtTablePrio" )"
    local rtTableMark="$( $cmdEcho ${jsonGwRoute} | jsonInObjectRead "rtTableMark" )"
    local rtTableName="$( $cmdEcho ${jsonGwRoute} | jsonInObjectRead "rtTableName" )"
    
    if [ -z "$rtTablePrio" ] || [ -z "$rtTableMark" ] || [ -z "$rtTableName" ];then
     shDebugHidden 0 ""$log" echec rtTablePrio:$rtTablePrio rtTableMark:$rtTableMark rtTableName:$rtTableName" >&2
    else
     local jsonGw="$( $cmdEcho ${jsonGw} | json64InObjectWrite route "${jsonGwRoute}" )"
#    local initMangleIface="$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} iif ${intEth} oif ${outEth} lookup ${rtTableName}"
#    if ! iptoolsExecute "$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} iif ${eth} oif ${eth} lookup ${rtTableName}" ; then
     if [ -z "${jsonGw}" ] || ! iptoolsExecute "$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} lookup ${rtTableName}" >&2; then
      shDebugHidden 0 ""$log" add mark for '${gw}':mac:'${mac}' mark:${rtTableMark} name:${rtTableName} prio:${rtTablePrio} jsonGw:${jsonGw}" >&2
     else
      shDebugHidden 2 ""$log" add mark for '${gw}':mac:'${mac}' mark:${rtTableMark} name:${rtTableName} prio:${rtTablePrio}" >&2
#      if [ -z "${mac}" ];then
##      iptoolsRuleInsert "mangle" "${markEthIn}	-d "${ip}" -j CONNMARK --set-mark "${rtTableMark}""
#       iptoolsRuleInsert "mangle" "${markEthIn}	-d "${ip}" -j MARK --set-mark "${rtTableMark}"" >&2
#       iptoolsRuleInsert "mangle" "${markNethIn}	-d "${ip}" -j MARK --set-mark "${rtTableMark}"" >&2
#      else
#      iptoolsRuleInsert "mangle" "${markEthIn}	-d "${ip}" -m mac --mac-source "${mac}" -j CONNMARK --set-mark "${rtTableMark}""
       iptoolsRuleInsert "mangle" "${markEthIn}	-d "${ip}" -m mac --mac-source "${mac}" -j MARK --set-mark "${rtTableMark}"" >&2
       iptoolsRuleInsert "mangle" "${markNethIn}	-d "${ip}" -m mac --mac-source "${mac}" -j MARK --set-mark "${rtTableMark}"" >&2
#      fi
     fi
    fi
   fi
  fi
 fi
 $cmdEcho ${jsonGw}
}
# firewallGateway $eth $ip $fwdEth $fwdNet $mode $file
firewallGateway() {
 local log="firewallGateway:"
 local jsonFwd="$( $cmdCat <&0 )"
 local mode=""${1}""
 local file=""${2}""
 
 local jsonSrcEth="$( $cmdEcho ${jsonFwd} | json64InObjectRead srcEth )"
 local srcIp="$( $cmdEcho ${jsonFwd} | json64InObjectRead srcIp )"
 if [ "*" = "${srcIp}" ];then local srcIp="all";fi
 local jsonFwdEth="$( $cmdEcho ${jsonFwd} | json64InObjectRead fwdEth )"
 local fwdIp="$( $cmdEcho ${jsonFwd} | json64InObjectRead fwdIp )"
 if [ "*" = "${fwdIp}" ];then local fwdIp="all";fi
 local fwdRoundRobin="$( $cmdEcho ${jsonFwd} | json64InObjectRead roundRobin )"
 
 local srcEth="$( $cmdEcho ${jsonSrcEth} | json64InObjectRead eth )"
 local srcMasterEth="$( $cmdEcho ${jsonSrcEth} | json64InObjectRead masterEth )"
# if [ -n "$srcMasterEth" ];then
#  local srcEth="${srcMasterEth}"
# else
#  local srcEth=""$( iptoolsGetHostEth ""${srcEth}"" )""
# fi
 
 local fwdEth="$( $cmdEcho ${jsonFwdEth} | json64InObjectRead eth )"
 local fwdEthClean="$( $cmdEcho ${fwdEth} | $cmdTr ':' '_' )"
# local fwdEth=""$( iptoolsGetHostEth ""${fwdEth}"" )""
 
 shDebug 2 ""$log" srcEth:"${srcEth}"/srcIp:"${srcIp}" fwdEth:"${fwdEth}"/fwdIp:"${fwdIp}" roundRobin:"${fwdRoundRobin}" mode:"$mode" file:"$file""
 
 local ruleIfaceIn="Gw"${srcEth}"-"${fwdEthClean}"I"
 local ruleIfaceOut="Gw"${srcEth}"-"${fwdEthClean}"O"
 
 if [ "${srcIp}" = "all" ];then
  local srcNets="$( iptoolsGetNets "${srcEth}" )"
  local srcIp=""
 else
  local srcNets="$( iptoolsGetNet "${srcEth}" "${srcIp}" )"
 fi
 for srcNet in ${srcNets};do
  if [ -z "${srcIp}" ];then
   local srcBroadcast=""$( iptoolsGetBroadcast ""${srcEth}"" ""${srcNet}"" )""
   local srcGws=""$( iptoolsGetGws ""${srcEth}"" ""${srcNet}"" )" "$( iptoolsHasMacNextHop ""${srcEth}"" && $cmdEcho "_" )""
   local srcIps=""$( iptoolsGetIps ""${srcEth}"" ""${srcNet}"" )""
  else
   local srcBroadcast=""$( iptoolsGetBroadcast ""${srcEth}"" ""${srcIp}"" )""
   local srcGws="${srcIp}"
   local srcIps=""$( iptoolsGetIps ""${srcEth}"" ""${srcNet}"" )""
  fi
  shDebugHidden 2 ""$log" srcEth:${srcEth} srcNet:${srcNet} srcIps:${srcIps} srcGws:${srcGws} srcIp:${srcIp}" >&2
  
  if [ "${fwdIp}" = "all" ];then
   local fwdNets="$( iptoolsGetNets "${fwdEth}" )"
   local fwdIp=""
  else
   local fwdNets="$( iptoolsGetNet "${fwdEth}" "${fwdIp}" )"
  fi
  for fwdNet in $fwdNets;do
   if [ -z "${fwdIp}" ];then
    local fwdBroadcast=""$( iptoolsGetBroadcast ""$fwdEth"" ""$fwdNet"")""
    local fwdGws=""$( iptoolsGetGw ""$fwdEth"" ""$fwdNet"")""
    local fwdIps=""$( iptoolsGetIps ""$fwdEth"" ""$fwdNet"")""
   else
    local fwdBroadcast=""$( iptoolsGetBroadcast ""$fwdEth"" ""$fwdIp"" )""
    local fwdGws=""$( iptoolsGetGws ""$fwdEth"" ""$fwdIp"" )""
    local fwdIps=""$( iptoolsGetIps ""$fwdEth"" ""$fwdIp"" )""
   fi
   shDebugHidden 2 ""$log" fwdEth:${fwdEth} fwdNet:${fwdNet} srcIps:${fwdIps} srcGws:${fwdGws} srcIp:${fwdIp}" >&2
   # Initialization de la table NAT
#   echo 1 > /proc/sys/net/ipv4/ip_forward
#   echo 1 > /proc/sys/net/ipv4/conf/${srcEth}/forwarding
   if [ "$mode" = "igw" ];then
    echo 1 > /proc/sys/net/ipv4/conf/${srcEth}/forwarding
    echo 1 > /proc/sys/net/ipv4/conf/${fwdEth}/forwarding
#    echo 2 > /proc/sys/net/ipv6/conf/${srcEth}/accept_ra
    for srcIp in ${srcIps};do
     
     local upnpRuleName="MINIUPNPD"
     local upnpPeerRuleName="MINIUPNPD-PCP-PEER"
     local upnpPostRoutingRuleName="MINIUPNPD-POSTROUTING"
     iptoolsRuleAdd "nat" "PREROUTING -i "${srcEth}" -d "${srcIp}" -j "$upnpRuleName""
     iptoolsRuleAdd "mangle" "PREROUTING -i "${srcEth}" -d "${srcIp}" -j "$upnpRuleName""
     iptoolsRuleAdd "nat" "POSTROUTING -o "${srcEth}" -s "${fwdNet}" -d "${srcIp}" -j "$upnpPeerRuleName""
     iptoolsRuleAdd "nat" "POSTROUTING -o "${srcEth}" -s "${fwdNet}" -d "${srcIp}" -j "$upnpPostRoutingRuleName""
     if [ "$srcEth" != "$srcMasterEth" ];then
      iptoolsRuleAdd "nat" "PREROUTING -i "${srcMasterEth}" -d "${srcIp}" -j "$upnpRuleName""
      iptoolsRuleAdd "mangle" "PREROUTING -i "${srcMasterEth}" -d "${srcIp}" -j "$upnpRuleName""
      iptoolsRuleAdd "nat" "POSTROUTING -o "${srcMasterEth}" -s "${fwdNet}" -d "${srcIp}" -j "$upnpPeerRuleName""
      iptoolsRuleAdd "nat" "POSTROUTING -o "${srcMasterEth}" -s "${fwdNet}" -d "${srcIp}" -j "$upnpPostRoutingRuleName""
     fi
     
#     iptoolsRuleAdd "nat"	"POSTROUTING	-o "${srcEth}"	-s "${fwdNet}" !	-d "${fwdNet}"	-j SNAT --to-source "${srcIp}""
#     #iptoolsRuleAdd "nat"	"POSTROUTING	-o "$eth"	-s "$fwdNet" !	-d "$fwdNet"	-j MASQUERADE"
#     for srcGw in $( iptoolsGetGws "${srcEth}" "${srcNet}" ) ) $( iptoolsHasMacNextHop "${srcEth}" && echo "_" );do
     for srcGw in $srcGws;do
      local jsonRoute="$( $cmdEcho {} | routeTableGetFromData "${srcEth}${srcIp}${srcGw}" )"
      local rtTablePrio="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTablePrio" )"
      local rtTableMark="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTableMark" )"
      local rtTableName="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTableName" )"
#      iptoolsRuleAdd "nat"	"POSTROUTING	-m mark --mark "${rtTableMark}" -s "${fwdNet}"	-j SNAT --to-source "${srcIp}""
      iptoolsRuleAdd "nat"	"POSTROUTING	-m mark --mark "${rtTableMark}" -s "${fwdNet}" ! -d "${fwdNet}"	-j SNAT --to-source "${srcIp}""

      firewallGatewayFileConf "${file}" "${srcEth}" "${srcIp}" "${srcNet}" "${srcGw}" "${fwdEth}" "${fwdNet}" "${mode}" "${upnpRuleName}"
     done
    done
   else
    for srcIp in ${srcIps};do
     if [ "$srcEth" != "$srcMasterEth" ];then
      iptoolsRuleAdd "nat"	"POSTROUTING	-o "${srcMasterEth}"	-s "${fwdNet}" 	-d "${srcNet}"	-j SNAT --to-source "${srcIp}""
     fi
     iptoolsRuleAdd "nat"	"POSTROUTING	-o "${srcEth}"	-s "${fwdNet}" 	-d "${srcNet}"	-j SNAT --to-source "${srcIp}""
#     for srcGw in $( iptoolsGetGws "${srcEth}" "${srcNet}" ) ) $( iptoolsHasMacNextHop "${srcEth}" && echo "_" );do
     for srcGw in $srcGws;do
      firewallGatewayFileConf "${file}" "${srcEth}" "${srcIp}" "${srcNet}" "${srcGw}" "${fwdEth}" "${fwdNet}" "${mode}"
     done
    done
   fi
  done
 done
 shDebug 2 ""$log" END ==================================================================================="
}
firewallGatewayFileConf() {
 local file="${1}"
 local eth="${2}"
 local ip="${3}"
 local net="${4}"
 local gw="${5}"
 local fwdEth="${6}"
 local fwdEthClean="$( $cmdEcho ${fwdEth} | $cmdTr ':' '_' )"
 local fwdNet="${7}"
 local mode="${8}"
 local upnpRuleName="${9}"

 local clients=""
 local servers=""
 
 local dropIn=""
 local dropOut=""
 local dropFwd=""
 local ruleIn=""
 local ruleOut=""
 local ruleFwd=""
 
 $(shIncludeET $file)
 if [ -z "$clients" ] && [ -z "$servers" ] && [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$dropFwd" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ] && [ -z "$ruleFwd" ];then
  shDebugHidden 0 ""$log" echec params(ip:$ip) empty : clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut"" >&2
 else
  shDebugHidden 1 ""$log" "$eth" => ip:"$ip" net:"$net" gw:"$gw"" >&2
  
  local clients="$(echo $clients | tr -d ' ' | tr -d '\t')"
  local servers="$(echo $servers | tr -d ' ' | tr -d '\t')"
  
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$dropIn"	"-j DROP"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$dropOut"	"-j DROP"
  
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$ruleIn"	"-j ACCEPT"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$ruleOut"	"-j ACCEPT"
  
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$dropFwd"	"-j DROP"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$dropFwd"	"-j DROP"
  
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$ruleFwd"	"-j ACCEPT"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$ruleFwd"	"-j ACCEPT"
  
  local ruleNetworkIn="gIn"$eth"-"$fwdEthClean"N"
  local ruleNetworkOut="gOut"$eth"-"$fwdEthClean"N"
  iptoolsRuleCreate "filter" "$ruleNetworkIn"
  iptoolsRuleCreate "filter" "$ruleNetworkOut"
  iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""		"-s" "$network"	"-j $ruleNetworkIn"
  iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""		"-d" "$network"	"-j $ruleNetworkOut"
  
  local ruleGwIn="gIn"$eth"-"$fwdEthClean"R"
  local ruleGwOut="gOut"$eth"-"$fwdEthClean"R"
  iptoolsRuleCreate "filter" "$ruleGwIn"
  iptoolsRuleCreate "filter" "$ruleGwOut"
  
  iptoolsRuleAdd "filter" "$ruleNetworkIn	-d "$fwdNet" -j "$ruleGwIn""
  iptoolsRuleAdd "filter" "$ruleNetworkOut	-s "$fwdNet" -j "$ruleGwOut""
  
  
  if [ -n "$clients" ];then
   local clientsRulesName="$( firewallGatewayClientConf "$clients" )"
   local clientsRuleNameIn="$( $cmdEcho $clientsRulesName | $cmdCut -f1 -d '|')"
   local clientsRuleNameOut="$( $cmdEcho $clientsRulesName | $cmdCut -f2 -d '|')"
   iptoolsRuleAdd "filter" "$ruleGwIn  -j $clientsRuleNameIn"
   iptoolsRuleAdd "filter" "$ruleGwOut -j $clientsRuleNameOut"
  fi
  if [ -n "$servers" ];then
   if [ "$mode" = "igw" ];then
    local serversRulesName="$(firewallGatewayServerFwConf "$upnpRuleName" "$servers")"
   else
    local serversRulesName="$(firewallGatewayServerConf "$servers")"
   fi
   local serversRuleNameIn="$( $cmdEcho $serversRulesName | $cmdCut -f1 -d '|')"
   local serversRuleNameOut="$( $cmdEcho $serversRulesName | $cmdCut -f2 -d '|')"
   iptoolsRuleAdd "filter" "$ruleGwIn  -j $serversRuleNameIn"
   iptoolsRuleAdd "filter" "$ruleGwOut -j $serversRuleNameOut"
  fi
 fi
}
firewallGwInterface() {
 local log="firewallGwInterface:"
# local iface=""$(iptoolsGetHostEth ""$1"")""
 local iface=""$1""

 shDebug "[ INFO ]"$log" iface:"$iface" "
 local ips="$(iptoolsGetIps "$iface" "")"
 shDebug "[ INFO ]"$log" ips(iface :$iface):$ips"
 iptoolsRuleAdd "filter" "FORWARD	-i "$iface" 	-o "$iface"	-s 0.0.0.0/32 -d 255.255.255.255/32 -p UDP --sport bootpc --dport bootps -j ACCEPT"
 iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d 255.255.255.255/32 -p UDP --sport bootps --dport bootpc -j ACCEPT"
 for ip in $ips;do
  local net=""$(iptoolsGetNet ""$iface"" )""
  local gw=""$(iptoolsGetGw ""$iface"" ""$ip"" )""
  iptoolsRuleAdd "filter" "INPUT	-i "$iface"			-s "$gw"/32 -d 224.0.0.1/8 -p igmp -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface" 	-o "$iface"	-s "$net" -d 224.0.0.1/239.255.255.255 -p igmp -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface" 	-o "$iface"	-s "$net" -d 224.0.0.1/239.255.255.255 -p udp --sport 5353 --dport 5353 -j ACCEPT"
  iptoolsRuleAdd "filter" "OUTPUT 			-o "$iface"	-s "$gw"/32 -d 224.0.0.1/32 -p igmp -j ACCEPT"
  
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-s "$gw"/32 -d 239.255.255.250/32 -p UDP --dport 1900 -j ACCEPT"
#[ 2278.367648] NETFILTER_FORWARD
# IN=br1 OUT=br1 PHYSIN=inbox1 PHYSOUT=inbox0.3 MAC=01:00:5e:7f:ff:fa:00:1b:11:64:04:75:08:00:45:00:01:83 SRC=10.85.88.1 DST=239.255.255.250 LEN=387 TOS=0x00
# PREC=0x00 TTL=2 ID=33710 DF PROTO=UDP SPT=50784 DPT=1900 LEN=367239.255.255.250
  
  # icmp (echo-reply:0/0, echo-request:8/0)
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT"
  # icmp (host-unreachable:3/1, port-unreachable:3/3, fragmentation-needed:3/4)
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  # icmp redirect gateway
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 5/1 -j ACCEPT"
 done
}
firewallMangleExecute() {
 local log="firewallMangleExecute"
 local jsonFwd="$( $cmdCat <&0 )"
 
 local srcIp="$( $cmdEcho ${jsonFwd} | json64InObjectRead srcIp )"
 local jsonSrcEth="$( $cmdEcho ${jsonFwd} | json64InObjectRead srcEth )"
 local srcEth="$( $cmdEcho ${jsonSrcEth} | json64InObjectRead eth )"
# local srcEth=""$( iptoolsGetHostEth ""${srcEth}"" )""
 
 if [ "all" = "${srcIp}" ];then
  local srcNets=""$( iptoolsGetNets ""${srcEth}"" )""
 else
  local srcNets=""$( iptoolsGetNets ""${srcEth}"" ""$srcIp"" )""
 fi
 if [ -z "${srcEth}" ] || [ -z "${srcIp}" ] || [ -z "${srcNets}" ];then
  shDebug 0 ""$log" bad params : srcEth:${srcEth} srcIp:${srcIp} srcNets:${srcNets}  "
 else
  shDebug 1 ""$log" srcEth:${srcEth} srcIp:${srcIp} srcNets:${srcNets}  "
 fi
 local fwdRoundRobin="$( $cmdEcho ${jsonFwd} | json64InObjectRead roundRobin )"
 shDebug 1 ""$log" fwdRoundRobin:${fwdRoundRobin}  "
 
 local fwdIp="$( $cmdEcho ${jsonFwd} | json64InObjectRead fwdIp )"
 local jsonFwdEth="$( $cmdEcho ${jsonFwd} | json64InObjectRead fwdEth )"
 local fwdEth="$( $cmdEcho ${jsonFwdEth} | json64InObjectRead eth )"
 local fwdEthCleanIp="$( $cmdEcho ${fwdEth} | $cmdCut -d':' -f 1 )"
# local fwdEth=""$( iptoolsGetHostEth ""${fwdEth}"" )""
 
 if [ "all" = "${fwdIp}" ];then
  local fwdNets=""$(iptoolsGetNets ""${fwdEth}"" )""
 else
  local fwdNets=""$(iptoolsGetNet ""${fwdEth}"" ""${fwdIp}"" )""
##  local fwdMarkOut="$( $cmdEcho ${jsonFwdEth} | json64InObjectRead ips | json64InObjectRead "${fwdIp}" | json64InObjectRead route | json64InObjectRead markOut )"
#  local fwdMarkOut="$( $cmdEcho ${jsonFwdEth} | json64InObjectRead route | json64InObjectRead markOut )"
 fi
 if [ -z "${fwdEth}" ] || [ -z "${fwdIp}" ] || [ -z "${fwdNets}" ];then
  shDebug 0 ""$log" bad params : fwdEth:${fwdEth} fwdIp:${fwdIp} fwdNets:${fwdNets} "
 else
  shDebug 1 ""$log" fwdEth:${fwdEth} fwdIp:${fwdIp} fwdNets:${fwdNets} "
 fi
 
 #
# local gwFwd=""$(iptoolsGetGw ""$ethFwd"" ""$ipFwd"")""
# local broadcastFwd=""$(iptoolsGetBroadcast ""$ethFwd"" ""$ipFwd"")""
 
# local fwdRtTableData="$( routeTableGetIfaceData "$ethFwd" )"
# local fwdRtTableMark="$( $cmdEcho $fwdRtTableData | $cmdCut -d'|' -f 2)"
# local fwdRtTableName="$( $cmdEcho $fwdRtTableData | $cmdCut -d'|' -f 3)"
# local fwdRtTablePrio="$( $cmdEcho $fwdRtTableData | $cmdCut -d'|' -f 4)"
 
 local log="${log}[${srcEth}/${fwdEth}]"
 for srcNet in ${srcNets};do
  if [ -z "${srcNet}" ];then continue ;fi
  local srcIp="$( iptoolsGetIp ""${srcEth}"" ""${srcNet}"" )"
  if [ -z "${srcIp}" ];then
   shDebug 0 ""$log" no srcIp:${srcIp} for srcNet:${srcNet} "
   continue;
  fi
  local log="$log[${srcNet}]"
  for srcGw in $( iptoolsGetGws "${srcEth}" "${srcNet}" ) $( iptoolsHasMacNextHop "${srcEth}" && echo "_" );do
   if [ -z "${srcGw}" ];then continue;fi
   shDebug 1 ""$log" srcGw:$srcGw"
#   local jsonRouteIp="$( $cmdEcho {} | routeTableGetFromData "${srcEth}${srcIp}${srcNet}" )"
#   local IpRtTableName="$( $cmdEcho ${jsonRouteIp} | jsonInObjectRead "rtTableName" )"
   
   local jsonRoute="$( $cmdEcho {} | routeTableGetFromData "${srcEth}${srcIp}${srcGw}" )"
   local rtTablePrio="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTablePrio" )"
   local rtTableMark="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTableMark" )"
   local rtTableName="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTableName" )"
   
   if [ -z "$rtTableMark" ];then
    shDebug 0 ""$log" no table GW MARK for '"${srcEth}${srcIp}${srcGw}"'"
#   elif [ -z "$IpRtTableName" ];then
#    shDebug 0 ""$log" no table IP MARK for '"${srcEth}${srcIp}${srcNet}"'"
   else
    for fwdNet in ${fwdNets};do
     if [  "all" = "${fwdIp}" ];then
      local fwdIps="$( iptoolsGetIps ""${fwdEth}"" ""${fwdNet}"" )"
     else
      local fwdIps="${fwdIp}"
     fi
     for ipFwd in ${fwdIps};do
#      if [  "all" = "${fwdIp}" ];then
       local fwdMarkOut="$( $cmdEcho ${jsonFwdEth} | json64InObjectRead route | json64InObjectRead markOut )"
       local fwdMarkIn="$( $cmdEcho ${jsonFwdEth} | json64InObjectRead route | json64InObjectRead markIn )"
#      else
#       local fwdMarkOut="$( $cmdEcho ${jsonFwdEth} | json64InObjectRead ips | json64InObjectRead "${ipFwd}" | json64InObjectRead route | json64InObjectRead markOut )"
#       local fwdMarkIn="$( $cmdEcho ${jsonFwdEth} | json64InObjectRead ips | json64InObjectRead "${ipFwd}" | json64InObjectRead route | json64InObjectRead markIn )"
#      fi
      shDebug 1 ""$log" ${fwdNet} by ${ipFwd} on ${fwdEth} add backing route "
      for anRtTableName in $rtTableName;do
#      for anRtTableName in $rtTableName $IpRtTableName ;do
#       if ! iptoolsExecute "$cmdIp -4 route add "${fwdNet}" src "${ipFwd}" dev "${fwdEth}" table "${anRtTableName}"" ; then
       if ! iptoolsExecute "$cmdIp -4 route add "${fwdNet}" dev "${fwdEthCleanIp}" table "${anRtTableName}"" ; then
        shDebug 0 ""$log" route add "${fwdNet}" dev "${fwdEthCleanIp}" table "${anRtTableName}""
       else
        shDebug 2 ""$log" route add "${fwdNet}" dev "${fwdEthCleanIp}" table "${anRtTableName}""
       fi
      done
      local macIpPorteuse="$( $cmdIp link show dev "${fwdEthCleanIp}" | $cmdGrep ether | $cmdCut -d' ' -f 6 )"
      if $cmdIp link show dev "${fwdEthCleanIp}" | $cmdGrep -q "link/ether"; then
       shDebug 1 ""$log" "${ipFwd}" "${fwdEth}":$macIpPorteuse"
       if ! command -v nft >/dev/null 2>&1; then
        iptoolsRuleInsert "mangle" "${fwdMarkOut}		-s "${fwdNet}" ! -d "${fwdNet}" -j MARK --set-mark "${rtTableMark}""
        iptoolsRuleInsert "mangle" "${fwdMarkIn}		-s "${fwdNet}" ! -d "${fwdNet}" -j MARK --set-mark "${rtTableMark}""
        if [ -z "${macIpPorteuse}" ];then
         shDebug 1 ebtables -t broute -I BROUTING -i "${fwdEthCleanIp}" -p ipv4 --ip-source "${fwdNet}" -j mark --mark-set "${rtTableMark}"
         ebtables -t broute -I BROUTING -i "${fwdEthCleanIp}" -p ipv4 --ip-source "${fwdNet}" -j mark --mark-set "${rtTableMark}"
        else
         shDebug 1 ebtables -t broute -I BROUTING -i "${fwdEthCleanIp}" -d "${macIpPorteuse}" -p ipv4 --ip-source "${fwdNet}" -j mark --mark-set "${rtTableMark}"
         ebtables -t broute -I BROUTING -i "${fwdEthCleanIp}" -d "${macIpPorteuse}" -p ipv4 --ip-source "${fwdNet}" -j mark --mark-set "${rtTableMark}"
        fi
        shDebug 1 ebtables -t broute -A BROUTING -i "${fwdEthCleanIp}" -p ipv4 --ip-destination "${ipFwd}" --ip-source "${fwdNet}" -j mark --mark-set "${rtTableMark}"
        ebtables -t broute -A BROUTING -i "${fwdEthCleanIp}" -p ipv4  --ip-destination "${ipFwd}" --ip-source "${fwdNet}" -j mark --mark-set "${rtTableMark}"
       else
        if [ -z "${macIpPorteuse}" ];then
         shDebug 1 nft insert rule inet mark_tbl prerouting \
          iif  "${fwdEthCleanIp}" ether daddr "${macIpPorteuse}" \
          ip saddr "${fwdNet}" \
          meta mark set "${rtTableMark}"
         nft insert rule inet mark_tbl prerouting \
          iif  "${fwdEthCleanIp}" ether daddr "${macIpPorteuse}" \
          ip saddr "${fwdNet}" \
          meta mark set "${rtTableMark}"
        else
         shDebug 1 nft insert rule inet mark_tbl prerouting \
          iif  "${fwdEthCleanIp}" \
          ip saddr "${fwdNet}" \
          meta mark set "${rtTableMark}"
         nft insert rule inet mark_tbl prerouting \
          iif  "${fwdEthCleanIp}" \
          ip saddr "${fwdNet}" \
          meta mark set "${rtTableMark}"
        fi
        shDebug 1 nft add rule inet mark_tbl prerouting \
         iif  "${fwdEthCleanIp}" ip daddr "${ipFwd}" \
         ip saddr "${fwdNet}" \
         meta mark set "${rtTableMark}"
        nft add rule inet mark_tbl prerouting \
         iif  "${fwdEthCleanIp}" ip daddr "${ipFwd}" \
         ip saddr "${fwdNet}" \
         meta mark set "${rtTableMark}"
       fi
      else
       shDebug 1 ""$log" "${ipFwd}" "${fwdEth}" no mac maybe L3 tun."
      fi
     done
#    if [ -n "$(iptables -t mangle -nL ${fwdMarkOut} | grep $rtTableMark | grep $ethFwd )" ];then
#     shDebugHidden 2 ""$log" default route table mark ever exist" >&2
#    else
     if [ "all" = "$fwdRoundRobin" ];then
      iptoolsRuleInsert "mangle" "${fwdMarkOut}		-m mark --mark 0x0 -s "${fwdNet}" ! -d "${fwdNet}" -j MARK --set-mark "${rtTableMark}""
      iptoolsRuleInsert "mangle" "${fwdMarkIn}		-m mark --mark 0x0 -s "${fwdNet}" ! -d "${fwdNet}" -j MARK --set-mark "${rtTableMark}""
     else
      local modeRoundRobin="$( $cmdEcho ${fwdRoundRobin} | $cmdCut -d',' -f1 )"
      local valueRoundRobin="$( $cmdEcho ${fwdRoundRobin} | $cmdCut -d',' -f2 )"
      #random,0.22
      if [ "random" = "${modeRoundRobin}" ];then
       iptoolsRuleInsert "mangle" "${fwdMarkOut}	-m mark --mark 0x0 -s "${fwdNet}" ! -d "${fwdNet}" -m statistic --mode random --probability "${valueRoundRobin}" -j MARK --set-mark "${rtTableMark}""
       iptoolsRuleInsert "mangle" "${fwdMarkIn}		-m mark --mark 0x0 -s "${fwdNet}" ! -d "${fwdNet}" -m statistic --mode random --probability "${valueRoundRobin}" -j MARK --set-mark "${rtTableMark}""
      #ntf,4.3
      elif [ "nth" = "${modeRoundRobin}" ];then
       local every="$( $cmdEcho ${valueRoundRobin} | $cmdCut -d. -f1 )"
       local packet="$( $cmdEcho ${valueRoundRobin} | $cmdCut -d. -f2 )"
       iptoolsRuleInsert "mangle" "${fwdMarkOut}	-m mark --mark 0x0 -s "${fwdNet}" ! -d "${fwdNet}" -m statistic --mode nth --every "${every}" --packet "${packet}" -j MARK --set-mark "${rtTableMark}""
       iptoolsRuleInsert "mangle" "${fwdMarkIn}		-m mark --mark 0x0 -s "${fwdNet}" ! -d "${fwdNet}" -m statistic --mode nth --every "${every}" --packet "${packet}" -j MARK --set-mark "${rtTableMark}""
      else
       shDebugHidden 1 ""$log" unknow modeRoundRobin:"${modeRoundRobin}"/"${fwdRoundRobin}"" >&2
      fi
     fi
#      iptoolsRuleAdd "mangle" "$enterSoluce	-m mark --mark 0x0 -s "${fwdNet}" ! -d "${fwdNet}" -j CONNMARK --set-mark "${rtTableMark}""
#     iptoolsRuleAdd "mangle" "${fwdMarkOut}	-i ${ethFwd} -s "$netFwd" ! -d "$netFwd" -m mark --mark 0x0 -j CONNMARK --set-mark "$rtTableMark""
#     iptoolsRuleAdd "mangle" "${fwdMarkOut}	-i ${eth} -d "$netFwd" -m mark --mark 0x0 -j MARK --set-mark "$fwdRtTableMark""
#     iptoolsRuleAdd "mangle" "${fwdMarkOut}	-m physdev --physdev-in ${ethFwd} -s "$netFwd" ! -d "$netFwd" -j MARK --set-mark "$rtTableMark""
#    fi
    done
    if ! iptoolsExecute "$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} lookup ${rtTableName}" ; then
     shDebugHidden 0 ""$log" $eth ip rule add pri" >&2
    else
     shDebugHidden 2 ""$log" $eth ip rule add pri" >&2
    fi
   fi
  done
 done
# local ruleIfaceIn="In"$eth""
# local ruleIfaceOut="Out"$eth""
  
# local bridgeEthFwd=""$(iptoolsGetHostEth $ethFwd )""
# local ruleFwdIN="Gw${bridgeEthFwd}-${bridgeEthFwd}O"
# local ruleFwdOUT="Gw${bridgeEthFwd}-${bridgeEthFwd}I"
## [ 2099.268193] NETFILTER_FORWARD
## IN=xenbr0 OUT=xenbr0 PHYSIN=eth1 PHYSOUT=veth2 MAC=01:00:5e:00:00:01:58:90:43:9c:93:1c:08:00 SRC=192.168.1.254 DST=224.0.0.1
## LEN=32 TOS=0x00 PREC=0xA0 TTL=1 ID=19502 DF OPT (94040000) PROTO=2 MARK=0xd
# iptoolsRuleAdd "filter" "INPUT	-j ${ruleIfaceIn} -m physdev --physdev-in ${ethFwd} "
# iptoolsRuleAdd "filter" "INPUT	-j ${ruleFwdIN} -m physdev --physdev-in ${ethFwd} "
# iptoolsRuleAdd "filter" "INPUT	-j ${ruleFwdOUT} -m physdev --physdev-in ${ethFwd} "
# 
# iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdIN} -m physdev --physdev-in ${ethFwd} "
# iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdOUT} -m physdev --physdev-in ${ethFwd} "
# iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdIN} -m physdev --physdev-out ${ethFwd} "
# iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdOUT} -m physdev --physdev-out ${ethFwd} "
# iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdIN} -o "$(iptoolsGetHostEth $ethFwd )" "
# iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdOUT} -o "$(iptoolsGetHostEth $ethFwd )" "

# iptoolsRuleAdd "filter" "OUTPUT	-j ${ruleIfaceOut} -o "$(iptoolsGetHostEth $ethFwd )" "
# iptoolsRuleAdd "filter" "OUTPUT	-j ${ruleFwdIN} -m physdev --physdev-out ${ethFwd} "
# iptoolsRuleAdd "filter" "OUTPUT	-j ${ruleFwdOUT} -m physdev --physdev-out ${ethFwd} "
}

firewallGatewayServerFwConf() {
 local log="firewallGatewayFwServerConf:"
 local upnpRuleName=""$1""
 local servers=""$2""
 local serversMd5=""$( $cmdEcho ""$servers"" | $cmdMd5sum | $cmdCut -f1 -d' ')""
 if [ -z "$serversMd5" ];then return 1;fi
 local serversRule=""$( iptoolsGetMd5Rule "filter" ""$serversMd5"" )""
 local serversRuleIn=""$serversRule"SrvFwIn"
 local serversRuleOut=""$serversRule"SrvFwOut"
 
 if ! iptoolsRuleExiste "filter" $serversRuleIn;then
  if iptoolsRuleExiste "filter" $serversRuleOut;then shDebugHidden "[ ERROR ]"$log" 'in' not exist but 'out' exist ??????" ;fi
  iptoolsRuleCreate "filter" "$serversRuleIn"
  iptoolsRuleCreate "filter" "$serversRuleOut"
  for server in $(echo $servers | tr -s '|' ' ');do
   local proto="$(echo $server | cut -d';' -f1)"
   local port="$(echo $server | cut -d';' -f2)"
   if [ -z "$(echo $port | grep :)" ];then
    iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW -j "$upnpRuleName""
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j "$upnpRuleName""
    fi
   else
    iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW -j "$upnpRuleName""
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j "$upnpRuleName""
    fi
   fi
   if [ -z "$(echo $port | grep :)" ];then
    iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   else
    iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   fi
  done
 fi
 echo ""$serversRuleIn"|"$serversRuleOut""
}
firewallGatewayServerConf() {
 local log="firewallGatewayServerConf:"
 local servers=""$1""
 local serversMd5=""$(echo ""$servers"" | $cmdMd5sum | cut -f1 -d' ')""
 if [ -z "$serversMd5" ];then return 1;fi
 local serversRule=""$(iptoolsGetMd5Rule "filter" ""$serversMd5"")""
 local serversRuleIn=""$serversRule"SrvIn"
 local serversRuleOut=""$serversRule"SrvOut"
 if ! iptoolsRuleExiste "filter" $serversRuleIn;then
  if iptoolsRuleExiste "filter" $serversRuleOut;then shDebugHidden "[ ERROR ]"$log" 'in' not exist but 'out' exist ??????" ;fi
  iptoolsRuleCreate "filter" "$serversRuleIn"
  iptoolsRuleCreate "filter" "$serversRuleOut"
  for server in $(echo $servers | tr -s '|' ' ');do
   local proto="$(echo $server | cut -d';' -f1)"
   local port="$(echo $server | cut -d';' -f2)"
   if [ -z "$(echo $port | grep :)" ];then
    iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   else
    iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   fi
   if [ -z "$(echo $port | grep :)" ];then
    iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   else
    iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   fi
  done
 fi
 echo ""$serversRuleIn"|"$serversRuleOut""
}
firewallGatewayClientConf() {
 local log="firewallGatewayClientConf:"
 local clients=""$1""
 local clientsMd5=""$(echo ""$clients"" | $cmdMd5sum | cut -f1 -d' ')""
 local clientsRule=""$(iptoolsGetMd5Rule "filter" ""$clientsMd5"")""
 local clientsRuleIn=""$clientsRule"CltIn"
 local clientsRuleOut=""$clientsRule"CltOut"
 if ! iptoolsRuleExiste "filter" $clientsRuleIn;then
  if iptoolsRuleExiste "filter" $clientsRuleOut;then shDebugHidden "[ ERROR ]"$log" 'in' not exist but 'out' exist ??????" ;fi
  iptoolsRuleCreate "filter" "$clientsRuleIn"
  iptoolsRuleCreate "filter" "$clientsRuleOut"
  for client in $(echo $clients | tr -s '|' ' ');do
   local proto="$(echo $client | cut -d';' -f1)"
   local port="$(echo $client | cut -d';' -f2)"
   if [ -z "$(echo $port | grep :)" ];then
    iptoolsRuleAdd "filter" "$clientsRuleIn	-p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT" >&2
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$clientsRuleIn	-p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT" >&2
    fi
    iptoolsRuleAdd "filter" "$clientsRuleOut	-p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT" >&2
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$clientsRuleOut	-p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT" >&2
    fi
   else
    iptoolsRuleAdd "filter" "$clientsRuleIn	-p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT" >&2
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$clientsRuleIn	-p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT" >&2
    fi
    iptoolsRuleAdd "filter" "$clientsRuleOut	-p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT" >&2
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$clientsRuleOut	-p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT" >&2
    fi
   fi
  done
 fi
 echo ""$clientsRuleIn"|"$clientsRuleOut""
}