#!/bin/sh
# =====================================================================
#  Projet  : DARKWALL
#  Fichier : lib/firewallGateway6
#  Auteur  : Nicolas "DarkHack" Chapuis (c) 2026
# ================== DARKHACK ==================
#        [ darkweb.fr  -  system online ]
#   Powered by Perplexity, your AI assistant
#       https://www.perplexity.ai
# ==============================================
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
# =====================================================================
if ! type "shInclude" > /dev/null 2>&1; then racineSh="${racineSh:-/etc/darksh}"; . "$racineSh/lib/shTools"; shDebugEnable="1";fi
rootDarkWall="${rootDarkWall:-/etc/darkwall}"
[ ! -d "$rootDarkWall" ] && shDebug 0 "exit cause rootDarWall is not dir:$rootDarkWall" && exit 0

requiresCmd=""
requiresCmd="printf timeout sleep kill cat echo sh rm mkdir grep md5sum"
requiresCmd="${requiresCmd} cut tr rev sort uniq awk head seq"
requiresCmd="${requiresCmd} ip iptables sed ping6 sh"
shWhichCmd $requiresCmd >/dev/null
shErrorOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

requiresCmd=""
requiresCmd="brctl ifup ifdown dhclient"
shWhichCmd $requiresCmd >/dev/null
shWarnOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ' )

$( shInclude $rootDarkWall/lib/firewallGateway )
$( shInclude $rootDarkWall/lib/firewall6 )

# firewallGateway6Check $jsonIfacePipe $jsonConfIfacePipe
firewallGateway6Check() {
 local log="firewallGateway6Check"
 local jsonIfacePipe="$1"
 local jsonConfIfacePipe="$2"
 
 local eth="$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "eth" )"
 local masterEth="$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "masterEth" )"
 if [ -z "${masterEth}" ];then local masterEth="$( $cmdEcho ${eth} | $cmdCut -d: -f 1 )";fi
 local jsonEthRoute6="$( shPipeReadTee $jsonIfacePipe | json64InObjectRead "route6" )"
 
 if [ -z "${eth}" ] || [ -z "${masterEth}" ] || [ -z "${jsonEthRoute6}" ];then
  shDebug 0 ""${log}" echec empty param eth:"${eth}" masterEth:"${masterEth}" jsonEthRoute6:"${jsonEthRoute6}""
  return ;
 else
  local log="firewallGateway6Check["${eth}"/"${masterEth}"]"
 fi
 if [ "${eth}" = "lo" ];then
   shDebug 0 ""${log}" no gw6 for this ifaces"
   return ;
 fi
 local markEthIn="$( $cmdEcho ${jsonEthRoute6} | json64InObjectRead "markIn" )"
 local markEthOut="$( $cmdEcho ${jsonEthRoute6} | json64InObjectRead "markOut" )"
 local eth6RtTableName="$( $cmdEcho ${jsonEthRoute6} | jsonInObjectRead "rtTableName" )"
 
 shPipeInit "${log} jsonIp6s-gw"; local jsonIp6sPipe=$?
 shPipeReadTee $jsonIfacePipe | json64InObjectRead ip6s | shPipeWrite $jsonIp6sPipe
 if [ -z "$( shPipeReadTee $jsonIp6sPipe )" ];then
  shDebug 0 ""${log}" echec empty jsonIp6sPipe:$jsonIp6sPipe "
 elif [ -z "${markEthIn}" ] || [ -z "${markEthOut}" ];then
  shDebug 0 ""${log}" echec empty params markEthIn:${markEthIn} markEthOut:${markEthOut}"
 else
  for jsonKeyIp6 in $( shPipeReadTee $jsonIp6sPipe | json64InObjectKeyList );do
#   ip6IsInNetwork ${jsonKeyIp6} "fe80::/10" && continue
   local log="firewallGateway6Check[ ${eth}/${jsonKeyIp6} ]"
#   local log=""${log}"["${jsonKeyIp}"]"
   local jsonIp6="$( shPipeReadTee $jsonIp6sPipe | json64InObjectRead "${jsonKeyIp6}" )"
   
   local isNew=0
   local net6="$( $cmdEcho ${jsonIp6} | json64InObjectRead "net6" )"
   local ll6="$( $cmdEcho ${jsonIp6} | json64InObjectRead "ll6" )"
   
   local jsonIp6Route="$( $cmdEcho ${jsonIp6} | json64InObjectRead route )"
   local markNet6In="$( $cmdEcho ${jsonIp6Route} | json64InObjectRead "markIn" )"
   local markNet6Out="$( $cmdEcho ${jsonIp6Route} | json64InObjectRead "markOut" )"
   local IP6rtTableName="$( $cmdEcho ${jsonIp6Route} | jsonInObjectRead "rtTableName" )"
   
   if [ -z "${jsonIp6}" ] || [ -z "${net6}" ] || [ -z "${markNet6In}" ] | [ -z "${markNet6Out}" ];then
    shDebug 0 ""${log}" echec empty params net6:"${net6}" markNet6In:"${markNet6In}" markNet6Out:"${markNet6Out}" jsonIp6:"${jsonIp6}""
   else
    # local log="firewallGateway6Check["${eth}"/"${jsonKeyIp6}"/${net6}]"
    local jsonGw6s="$( $cmdEcho ${jsonIp6} | json64InObjectRead "gw6s" )"
    if [ -z "${jsonGw6s}" ];then
     #shDebug 0 ""$log" no jsonGw6s"
     local isNew=1
     local jsonGw6s="{}"
#   else
#    shDebug 2 ""$log" gw6s exist..."
    fi
#    for gw6 in $( ip6toolsGetGws "${eth}" "${net6}" ) $( ip6toolsGetGws "${eth}" "fe80::/10" ) ;do
    local gw6s="$( ip6toolsGetGws "${eth}" ${net6} )"
    [ -z "$gw6s" ] && local gw6s="$( ip6toolsGetGws "${eth}" fe80::/10 )"
    [ -z "$gw6s" ] && local gw6s="$( ip6toolsGetAllGws )"
#    if ! ip6IsInNetwork ${jsonKeyIp6} "fe80::/10";then local gw6s="${gw6s} $( ip6toolsGetGws "${eth}" fe80::/10 )";fi
#    local gw6s="${gw6s} $( ip6toolsGetGws "${eth}" fe80::/10 )"
    shDebug 1 ""${log}" search gw6s:${gw6s}"
    for gw6 in ${gw6s};do
     if [ -z "${gw6}" ];then continue;fi
     local ethForGw="$( ip6ToolsGetEthForGw ${gw6} )"
     if [ "${eth}" != "${ethForGw}" ];then
      local soliciteForGw="$( ip6toolsGetNodeSollicite ${gw6} )"
      iptoolsExecute "$cmdIp -6 route add ${soliciteForGw}/128 proto kernel metric 5 dev ${ethForGw} scope link table ${IP6rtTableName}"
      iptoolsExecute "$cmdIp -6 rule add pri 100 to ${soliciteForGw}/128 table ${IP6rtTableName}"
      ip6toolsRuleAdd "filter" "INPUT -i ${ethForGw} -j ${markNet6In}"
      ip6toolsRuleAdd "filter" "OUTPUT -o ${ethForGw} -j ${markNet6Out}"
     fi
     local log="firewallGateway6Check[ ${eth}/${jsonKeyIp6}/${gw6} ]"
     local jsonGw6="$( $cmdEcho ${jsonGw6s} | json64InObjectRead "${jsonKeyIp6}${gw6}" )"
     if [ -n "${jsonGw6}" ];then
#      if ip6IsInNetwork ${jsonKeyIp6} "fe80::/10" ;then continue;fi
      local statsGateway="$( $cmdPing6 -I ${eth} -I ${jsonKeyIp6} -c 10 ${gw6} 2>/dev/null 2>&1 | $cmdTail -2l | $cmdHead -n 1 )"
      shDebug 1 ""${log}" gw stats:${statsGateway}"
      local gw6LinkState="$( $cmdEcho ${jsonGw6} | json64InObjectRead state )"
      local jsonGw6Route="$( $cmdEcho ${jsonGw6} | json64InObjectRead route )"
      if [ -z "${jsonGw6Route}" ];then
       local newJsonGw6="$( $cmdEcho ${jsonGw6} | route6AddGw "${ethForGw}" "${jsonKeyIp6}" "${ll6}" "${markNet6In}" "${markNet6Out}" )"
       if [ -n "${newJsonGw6}" ];then local jsonGw6="${newJsonGw6}"
       else shDebug 0 ""${log}" newJsonGw6 empty after route6AddGw "
       fi
       local jsonGw6Route="$( $cmdEcho ${jsonGw6} | json64InObjectRead route )"
      fi
      if [ -z "${jsonGw6Route}" ];then
       shDebug 0 ""${log}" gw6 has never responded for now!!!!"
      else
       local rtTableCpt="$( $cmdEcho ${jsonGw6Route} | jsonInObjectRead "rtTableCpt" )"
       shDebug 1 ""${log}" gw6 '${jsonKeyIp6} <=> ${gw6}' have to ping for validate link:"${gw6LinkState}"."
       local ping6Gw="$( $cmdPing6 -I ${eth} -I ${jsonKeyIp6} -c 1 ${gw6} 2>/dev/null | $cmdGrep time= | $cmdTr -c '[:alnum:]\n' '-' )"
       if [ -n "${ping6Gw}" ] || ( ip6IsInNetwork ${gw6} "fe80::/10" && [ "${eth}" != "${ethForGw}" ] ) ;then
        shDebug 1 ""${log}" gw6 responded or is linklocal fwd: ${ethForGw} => ${eth}."
        if [ "onlink" = "${gw6LinkState}" ];then
         local statsInternet="$( $cmdPing6  -I ${eth} -I ${jsonKeyIp6} -c 10 2606:4700:4700::1111 2>&1 | $cmdTail -2l | $cmdHead -n 1 )"
         shDebug 1 ""${log}" 2606:4700:4700::1111 stats:${statsInternet}"
#         shDebug 1 ""${log}" now test 2606:4700:4700::1111:$( $cmdPing6 -I ${eth} -I ${jsonKeyIp6} -c 10 2606:4700:4700::1111 2>&1 | $cmdTr -d '\n' ) or $($cmdPing6 -I ${eth} -c 10 2606:4700:4700::1111 2>&1 | $cmdTr -d '\n')."
#         shDebug 1 ""${log}" $cmdPing6 -I ${eth} -I ${jsonKeyIp6} -c 10 2606:4700:4700::1111 2>&1 | $cmdTr -d '\n'"
        else
         shDebug 1 ""${log}" switch to onlink. ${gw6RtTableName}/${eth6RtTableName}/${IP6rtTableName}"
         local jsonGw6="$( $cmdEcho ${jsonGw6} | json64InObjectWrite state onlink )"
         #if [ -z "${eth6RtTableName}" ];then
         # shDebug 0 ""$log" empty 2 eth6RtTableName:${eth6RtTableName}"
         #else
         # mangle6EnableEthGw "${eth}" "${jsonKeyIp6}" "${ll6}" "${net6}" "${gw6}" "${eth6RtTableName}"
         #fi
         #mangle6EnableEthGw "${eth}" "${jsonKeyIp6}" "${ll6}" "${net6}" "${gw6}" "${eth6RtTableName}"
         mangle6EnableGw "${eth}" "${jsonKeyIp6}" "${ll6}" "${net6}" "${gw6}" "${eth6RtTableName}"
         mangle6EnableGw "${eth}" "${jsonKeyIp6}" "${ll6}" "${net6}" "${gw6}" "${IP6rtTableName}"
         local gw6RtTableName="$( $cmdEcho ${jsonGw6Route} | jsonInObjectRead "rtTableName" )"
         if [ -z "${gw6RtTableName}" ];then
          shDebug 1 ""${log}" empty 2 gw6RtTableName:${gw6RtTableName}"
         else
          mangle6EnableGw "${eth}" "${jsonKeyIp6}" "${ll6}" "${net6}" "${gw6}" "${gw6RtTableName}"
         fi
        fi
       else
        shDebug 1 ""${log}" gw6 not responded !!!!! $cmdPing6 -I ${eth} -I ${jsonKeyIp6} -c 10 ${gw6}"
        if [ "onlink" = "${gw6LinkState}" ];then
         shDebug 1 ""${log}" switch to offlink."
         local jsonGw6="$( $cmdEcho ${jsonGw6} | json64InObjectWrite state offlink )"
         #if [ -z "${eth6RtTableName}" ];then
         # shDebug 0 ""$log" empty 3 eth6RtTableName:${eth6RtTableName}"
         #else
         # mangle6DisableGw "${eth}" "${jsonKeyIp6}" "${net6}" "${gw6}" "${eth6RtTableName}"
         #fi
         
#         local gw6RtTableName="$( $cmdEcho ${jsonGw6Route} | jsonInObjectRead "rtTableName" )"
#         if [ -z "${gw6RtTableName}" ];then
#          shDebug 1 ""${log}" empty 3 gw6RtTableName:${gw6RtTableName}"
#         else
#          mangle6DisableGw "${eth}" "${jsonKeyIp6}" "${net6}" "${gw6}" "${gw6RtTableName}"
#         fi
         shDebug 1 ""${log}" gw6RtTableName:${gw6RtTableName} eth6RtTableName:${eth6RtTableName}"
        fi
       fi
      fi
     else
      shDebug 1 ""${log}" init json gw6."
      local jsonGw6="$( $cmdEcho {} | json64InObjectWrite ip "${gw6}" )"
      shDebug 2 ""${log}" here grep error or after inside firewall6iStartFiles."
      firewall6iStartFiles $jsonIfacePipe $jsonConfIfacePipe "${jsonKeyIp6}" "${gw6}" >> /ram/istart6.log 2>&1
#      if ! ip6IsInNetwork ${jsonKeyIp6} "fe80::/10" ;then
       shDebug 1 ""${log}" gateway[${eth}] route6AddGw "${ethForGw}" "${jsonKeyIp6}" "${ll6}" "${markNet6In}" "${markNet6Out}""
       local newJsonGw6="$( $cmdEcho ${jsonGw6} | route6AddGw "${ethForGw}" "${jsonKeyIp6}" "${ll6}" "${markNet6In}" "${markNet6Out}" )"
       if [ -n "${newJsonGw6}" ];then local jsonGw6="${newJsonGw6}"
       else shDebug 0 ""${log}" newJsonGw6 empty after route6AddGw "
       fi
       local jsonGw6Route="$( $cmdEcho ${jsonGw6} | json64InObjectRead route )"
       if [ -z "${jsonGw6Route}" ];then
        shDebug 0 ""$log" echec no jsonGw6Route, may be no ping"
        shDebug 1 ""${log}" initied offlink."
        local jsonGw6="$( $cmdEcho ${jsonGw6} | json64InObjectWrite state offlink )"
       else
        shDebug 1 ""${log}" initied onlink. ${gw6RtTableName}/${eth6RtTableName}/${IP6rtTableName}"
        local jsonGw6="$( $cmdEcho ${jsonGw6} | json64InObjectWrite state onlink )"
        #if [ -z "${eth6RtTableName}" ];then
        # shDebugHidden 0 ""$log" empty 1 eth6RtTableName:${eth6RtTableName}"
        #else
        # mangle6EnableEthGw "${eth}" "${jsonKeyIp6}" "${ll6}" "${net6}" "${gw6}" "${eth6RtTableName}"
        #fi
#        mangle6EnableGw "${eth}" "${jsonKeyIp6}" "${ll6}" "${net6}" "${gw6}" "${eth6RtTableName}"
        mangle6EnableGw "${eth}" "${jsonKeyIp6}" "${ll6}" "${net6}" "${gw6}" "${IP6rtTableName}"
        local gw6RtTableName="$( $cmdEcho ${jsonGw6Route} | jsonInObjectRead "rtTableName" )"
        if [ -z "${gw6RtTableName}" ];then
         shDebug 0 ""${log}" empty 1 gw6RtTableName:${gw6RtTableName}"
        else
         mangle6EnableGw "${eth}" "${jsonKeyIp6}" "${ll6}" "${net6}" "${gw6}" "${gw6RtTableName}"
        fi
#       fi
      fi
     fi
     local jsonGw6s="$( $cmdEcho ${jsonGw6s} | json64InObjectWrite "${jsonKeyIp6}${gw6}" "${jsonGw6}" )"
    done
#==========================================================
    local jsonIp6="$( $cmdEcho ${jsonIp6} | json64InObjectWrite "gw6s" "${jsonGw6s}" )"
    shPipeInit "${log} jsonBuffer-gw"; local jsonBufferPipe=$?
    shPipeRead $jsonIp6sPipe  | json64InObjectWrite "${jsonKeyIp6}" "${jsonIp6}" | shPipeWrite $jsonBufferPipe
    shPipeRead $jsonBufferPipe | shPipeWrite $jsonIp6sPipe
    shPipeFree $jsonBufferPipe
   fi
  done
  jsonWriteBig "ip6s" "$jsonIfacePipe" "$jsonIp6sPipe"
 fi
 
 shPipeFree $jsonIp6sPipe
}
# firewall6iStartFiles $jsonIfacePipe $jsonConfIfacePipe "${ip6}" "${gw6}"
firewall6iStartFiles() {
 local jsonIfacePipe="$1"
 local jsonConfIfacePipe="$2"
 local ip6="${3}"
 local gw6="${4}"
 local log="firewall6iStartFiles:"
 local files="$( shPipeReadTee $jsonConfIfacePipe | json64InObjectRead files )"
 if [ -z "${files}" ];then shDebug 2 ""$log" no files:${files}";fi
 shDebug 2 ""${log}" FILES:\n $( $cmdEcho ${files} | $cmdTr '|' ' '| $cmdCut -d';' -f 1 ) "
 for fileLongMode in $( $cmdEcho ${files} | $cmdTr ' ' 'µ' | $cmdTr '|' ' ' );do
  local fileMode="$( $cmdEcho ${fileLongMode} | $cmdTr 'µ' ' ' )"
  if [ -z "${fileMode}" ];then continue;fi
  local file="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 1 )"
  local mode="$( $cmdEcho ${fileMode} | $cmdCut -d';' -f 2 )"
  #if ip6IsInNetwork ${ip6} "fe80::/10" ; then
  # if [ "$mode" != "ill6" ];then
  #  #shDebug 2 ""${log}" ip6:${ip6} is LocalLink for ill6 skipe ${mode} ${file} "
  #  continue;
  # fi
  #else
   if [ "${mode}" = "gw6" ] || [ "${mode}" = "igw6" ] || [ "${mode}" = "bridge6" ];then
    shDebug 1 ""${log}" gateway[${eth}] order file:${fileMode}"
#    $cmdEcho "gateway ${eth} ${fileMode}" >> "$firewallPipe" &
    $cmdSh ${rootDarkWall}/bin/tryPipeMessage "gateway ${eth} ${fileMode}" 2>&1 >> /tmp/tryPipeMessage.log &
   fi
   if [ "$mode" != "inet6" ] && [ "$mode" != "ill6" ] && [ "$mode" != "bridge6" ];then
    #shDebug 2 ""${log}" ip6:${ip6} is LinkSite/Global for inet6 skipe ${mode} ${file} "
    #shDebug 2 ""${log}" ip6:${ip6} is for internet mode skipe ${mode} ${file} "
    continue;
   fi
  #fi
  shPipeReadTee $jsonIfacePipe | firewall6iStartFile "${ip6}" "${gw6}" "${mode}" "${file}"
 done
}
# echo ${jsonEth} | firewall6iStartFile "${ip6}" "${gw6}" "$mode" "$file64"
firewall6iStartFile() {
 local log="firewall6iStartFile"
 local ip6="${1}"
 local gw6="${2}"
 local mode="$3"
 local file64="$4"
 
 local jsonEth="$( $cmdCat <&0 )"
 local eth="$( $cmdEcho ${jsonEth} | json64InObjectRead eth )"
 local jsonEthRoute="$( $cmdEcho ${jsonEth} | json64InObjectRead route6 )"
 local markEthIn="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markIn" )"
 local markEthOut="$( $cmdEcho ${jsonEthRoute} | json64InObjectRead "markOut" )"
 
 if [ -z "${gw6}" ] || [ -z "${ip6}" ] || [ -z "${eth}" ] || [ -z "${markEthIn}" ] || [ -z "${markEthOut}" ];then
  shDebug 0 ""${log}" bad params empty gw6:${gw6} ip6:${ip6} eth:${eth} markEthIn:${markEthIn} markEthOut:${markEthOut} jsonEthRoute:${jsonEthRoute}"
 else
  local log="${log}[${eth}/${gw6}]"
  if ip6IsInNetwork ${ip6} "::1/128" ; then
   shDebug 2 ""${log}" ip6:${ip6} is LinkLoop skipe."
  else
   shDebug 1 ""${log}" ${eth} ${ip6} <=> ${gw6}"
   local jsonIp6s="$( $cmdEcho ${jsonEth} | json64InObjectRead ip6s )"
   local jsonIp6="$( $cmdEcho ${jsonIp6s} | json64InObjectRead "${ip6}" )"
   local net6="$( $cmdEcho ${jsonIp6} | json64InObjectRead net6 )"
   local ll6="$( $cmdEcho ${jsonIp6} | json64InObjectRead ll6 )"
   
   local jsonIp6Route="$( $cmdEcho ${jsonIp6} | json64InObjectRead route )"
   local markNet6In="$( $cmdEcho ${jsonIp6Route} | json64InObjectRead "markIn" )"
   local markNet6Out="$( $cmdEcho ${jsonIp6Route} | json64InObjectRead "markOut" )"
   
   # ==================================================================================================
   local file="$( $cmdEcho $file64 | $cmdBase64 -d -i 2>>/dev/null )"
   shDebug 2 ""$log" "$eth"/ fileName:"${fileName}" mode:${mode} file:${file}"
   if [ -z "${net6}" ] || [ -z "${markNet6In}" ] || [ -z "${markNet6Out}" ];then
    shDebugHidden 0 ""${log}" bad params empty net6:${net6} markNet6In:${markNet6In} markNet6Out:${markNet6Out} jsonIp6:${jsonIp6}" >&2
   else
    local log="${log}[${markNet6In}/${markNet6Out}]"
    shDebug 2 ""$log" "$eth"/ ip6:"${ip6}" net6:"${net6}" gw6:"${gw6}" broadcast6:"${broadcast6}""
    local clients="";local servers=""
    
    local dropIn="";local dropOut="";local ruleIn="";local ruleOut="";local icmpIn="";local icmpOut=""
    local network="${net}";local markExtraIn="";local markExtraOut="";
    if [ ! -f "${file}" ];then shDebugHidden 0 ""$log" echec not file:${file} /${fileMode}";continue;fi
    ll6="${ll6}" ip6="${ip6}" net6="${net6}" gw6="${gw6}" $(shIncludeET $file )
    
    if [ -z "$clients" ] && [ -z "$servers" ] && [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ] && [ -z "$icmpIn" ] && [ -z "$icmpOut" ];then
     shDebug 0 ""$log" echec params empty (ip6:"${ip6}"): clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut" icmpIO:"$icmpIn"/"$icmpOut""
    else
     local fileName="$( $cmdEcho ${file} | $cmdRev | $cmdCut -d'/' -f1 | $cmdTr -d '[[:blank:]]' | $cmdRev | $cmdHead -c 22 )"
     
     iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$markEthIn""	"$dropIn"	"-j DROP"
     iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$markEthOut""	"$dropOut"	"-j DROP"
     iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$markEthIn""	"$ruleIn"	"-j ACCEPT"
     iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$markEthOut""	"$ruleOut"	"-j ACCEPT"
     if [ -n "${icmpIn}" ];then
      local ruleIcmpIn="$(firewall6CreateRule i"${fileName}")"
      ip6toolsRuleAdd "filter" "${markEthIn} -p icmpv6  -j ${ruleIcmpIn}"
      iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIcmpIn""	"$icmpIn"	"-j ACCEPT"
     fi
     if [ -n "${icmpOut}" ];then
      local ruleIcmpOut="$(firewall6CreateRule o"${fileName}")"
      ip6toolsRuleAdd "filter" "${markEthOut} -p icmpv6  -j ${ruleIcmpOut}"
      iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIcmpOut""	"$icmpOut"	"-j ACCEPT"
     fi
     
     # network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
     local ruleNetworkIn="$(firewall6CreateRule i"${fileName}")"
     local ruleNetworkOut="$(firewall6CreateRule o"${fileName}")"
     iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""$markNet6In""	"-s" "$network"	"-j "$ruleNetworkIn""
     iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""$markNet6Out""	"-d" "$network"	"-j "$ruleNetworkOut""
     if [ "$mode" = "lo6" ];then
      iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""$markNet6In""   "-d" "$network" "-j "$ruleNetworkIn""
      iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""$markNet6Out""  "-s" "$network" "-j "$ruleNetworkOut""
     fi
     
     local clients="$( $cmdEcho $clients | $cmdTr -d ' ' | $cmdTr -d '\t')"
     if [ -z "$clients" ];then
      shDebug 2 ""$log" no clients:$clients"
     else
      local clientsRulesName="$(firewall6ClientConf "$clients")"
      if [ -n "$clientsRulesName" ];then
       ip6toolsRuleAdd "filter" "$ruleNetworkIn  -j "$( $cmdEcho $clientsRulesName | $cmdCut -f1 -d '|')""
       ip6toolsRuleAdd "filter" "$ruleNetworkOut -j "$( $cmdEcho $clientsRulesName | $cmdCut -f2 -d '|')""
      else
       shDebug 0 ""$log" no clientsRulesName for clients:$clients"
      fi
     fi
     
     local servers="$( $cmdEcho $servers | $cmdTr -d ' ' | $cmdTr -d '\t')"
     if [ -z "$servers" ];then
      shDebug 0 ""$log" no servers:$servers"
     else
      local serversRulesName="$(firewall6ServerConf "$servers")"
      if [ -n "$serversRulesName" ];then
       ip6toolsRuleAdd "filter" "$ruleNetworkIn  -j "$( $cmdEcho $serversRulesName | $cmdCut -f1 -d '|')""
       ip6toolsRuleAdd "filter" "$ruleNetworkOut -j "$( $cmdEcho $serversRulesName | $cmdCut -f2 -d '|')""
      else
       shDebug 0 ""$log" no serversRulesName for servers:$servers"
      fi
     fi
    fi
   fi
  fi
 fi
 shDebug 2 ""${log}" END"
 #$cmdEcho ${jsonEth}
}
# $cmdEcho ${jsonFwd} | firewall6Bridge "${file}" >> ${logFile} 2>&1
firewall6Bridge() {
 local log="firewall6Bridge:"
 local jsonFwd="$( $cmdCat <&0 )"
 local file=""${1}""
 
 local jsonSrcEth="$( $cmdEcho ${jsonFwd} | json64InObjectRead srcEth )"
 local srcIp="$( $cmdEcho ${jsonFwd} | json64InObjectRead srcIp )"
 if [ "*" = "${srcIp}" ];then local srcIp="all";fi
 local jsonFwdEth="$( $cmdEcho ${jsonFwd} | json64InObjectRead fwdEth )"
 local fwdIp="$( $cmdEcho ${jsonFwd} | json64InObjectRead fwdIp )"
 if [ "*" = "${fwdIp}" ];then local fwdIp="all";fi
 local fwdRoundRobin="$( $cmdEcho ${jsonFwd} | json64InObjectRead roundRobin )"
 local srcEth="$( $cmdEcho ${jsonSrcEth} | json64InObjectRead eth )"
 local srcEthClean="$( $cmdEcho ${srcEth} | $cmdTr ':' '_' )"
# local srcEth="$( iptoolsGetHostEth "${srcEth}" )"
 local fwdEth="$( $cmdEcho ${jsonFwdEth} | json64InObjectRead eth )"
 local fwdEthClean="$( $cmdEcho ${fwdEth} | $cmdTr ':' '_' )"
# local fwdEth="$( iptoolsGetHostEth "${fwdEth}" )"
 
 shDebug 2 ""$log" srcEth:"${srcEth}"/srcIp:"${srcIp}" fwdEth:"${fwdEth}"/fwdIp:"${fwdIp}" roundRobin:"${fwdRoundRobin}" mode:"$mode" file:"$file""
 
 firewall6GwCreateInterface "${srcEth}" "${fwdEth}" >&2
 
 shDebug 2 ""$log" file:"$file""
 
# local ruleIfaceIn="In"$eth""
# local ruleIfaceOut="Out"$eth""
 local ruleIfaceGIn="Gw"${srcEthClean}"-"${fwdEthClean}"I"
 local ruleIfaceGOut="Gw"${srcEthClean}"-"${fwdEthClean}"O"
 local dropIn=""
 local dropFw=""
 local dropOut=""
 local ruleIn=""
 local ruleFwd=""
 local ruleOut=""
 $(shIncludeET $file)
 if [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ];then
   shDebug 0 ""$log" echec params empty: dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut""
 else
  shDebug 2 ""$log" "
  
#  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceIn""	"$dropIn"	"-j DROP"
  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceGIn""	"$dropFwd"	"-j DROP"
  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceGOut""	"$dropFwd"	"-j DROP"
#  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceOut""	"$dropOut"	"-j DROP"
  
#  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceIn""	"$ruleIn"	"-j ACCEPT"
  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceGIn""	"$ruleIn"	"-j ACCEPT"
  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceGOut""	"$ruleOut"	"-j ACCEPT"
#  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceOut""	"$ruleOut"	"-j ACCEPT"
 fi
}

firewall6GatewayInit() {
 local log="firewallGatewayInit:"
 #
 # Initialisation de la table MANGLE
 #
 
 #iptables -t mangle -F
 #iptables -t mangle -X
 #iptables -t mangle -P PREROUTING ACCEPT
 #iptables -t mangle -P INPUT ACCEPT
 #iptables -t mangle -P OUTPUT ACCEPT
 #iptables -t mangle -P FORWARD ACCEPT
 #iptables -t mangle -P POSTROUTING ACCEPT
 local upnpRuleName="MINIUPNPD"
 ip6toolsRuleCreate "mangle" ""$upnpRuleName""
 ip6toolsRuleCreate "nat" ""$upnpRuleName""
 ip6toolsRuleCreate "filter" ""$upnpRuleName""
 local upnpPeerRuleName="MINIUPNPD-PCP-PEER"
 ip6toolsRuleCreate "nat" ""$upnpPeerRuleName""
 local upnpPostRoutingRuleName="MINIUPNPD-POSTROUTING"
 ip6toolsRuleCreate "nat" ""$upnpPostRoutingRuleName""
}
firewall6GwCreateInterface() {
 local log="firewall6GwCreateInterface:"
 local srcEth=""${1}""
 local srcEthClean="$( $cmdEcho ${srcEth} | $cmdTr ':' '_' )"
 local fwdEth=""${2}""
 local fwdEthClean="$( $cmdEcho ${fwdEth} | $cmdTr ':' '_' )"

# local ruleSrcIfaceIn="In"${srcEth}""
# local ruleSrcIfaceOut="Out"${srcEth}""
 local jsonEthRoute="$( $cmdEcho {} | routeTableGetFromData "${srcEth}" )"
 local rtTbleMark="$( $cmdEcho $jsonEthRoute | jsonInObjectRead rtTableMark )"
 local ruleSrcIfaceIn="$( $cmdEcho in${srcEth}${rtTbleMark} | $cmdTr ':' '_' )"
 local ruleSrcIfaceOut="$( $cmdEcho out${srcEth}${rtTbleMark} | $cmdTr ':' '_' )"
 
# local ruleFwdIfaceIn="In"${fwdEthClean}""
# local ruleFwdIfaceOut="Out"${fwdEthClean}""
 local jsonEthRoute="$( $cmdEcho {} | routeTableGetFromData "${fwdEth}" )"
 local rtTbleMark="$( $cmdEcho $jsonEthRoute | jsonInObjectRead rtTableMark )"
 local ruleFwdIfaceIn="$( $cmdEcho in${fwdEth}${rtTbleMark} | $cmdTr ':' '_' )"
 local ruleFwdIfaceOut="$( $cmdEcho out${fwdEth}${rtTbleMark} | $cmdTr ':' '_' )"
 
 
 #local ruleIfaceIn=""$(firewallCreateRule	"Gw"$eth"In")""
 #local ruleIfaceOut=""$(firewallCreateRule	"Gw"$eth"Out")""
 local ruleGwIn="Gw"${srcEthClean}"-"${fwdEthClean}"I"
 local ruleGwOut="Gw"${srcEthClean}"-"${fwdEthClean}"O"
 ip6toolsRuleCreate "filter" "$ruleGwIn"
 ip6toolsRuleCreate "filter" "$ruleGwOut"
 
 ip6toolsRuleAdd "filter" ""$ruleSrcIfaceIn"	-j "$ruleGwIn""
 ip6toolsRuleAdd "filter" "FORWARD	-i "${srcEthClean}"	-o "${fwdEthClean}"	-j "$ruleGwIn""
 ip6toolsRuleAdd "filter" ""$ruleFwdIfaceOut"	-j "$ruleGwIn""
 
 ip6toolsRuleAdd "filter" ""$ruleFwdIfaceIn"	-j "$ruleGwOut""
 ip6toolsRuleAdd "filter" "FORWARD	-i "${fwdEthClean}"	-o "${srcEthClean}"	-j "$ruleGwOut""
 ip6toolsRuleAdd "filter" ""$ruleSrcIfaceOut"	-j "$ruleGwOut""

 local hostSrcEth=""$( iptoolsGetHostEth ""${srcEth}"" )""
 local hostSrcEthClean="$( $cmdEcho ${hostSrcEth} | $cmdTr ':' '_' )"
 if [ "$hostSrcEthClean" != "srcEthClean" ];then
#  ip6toolsRuleAdd "filter" ""$ruleSrcIfaceIn"	-j "$ruleGwIn""
  ip6toolsRuleAdd "filter" "FORWARD	-i "${hostSrcEthClean}"	-o "${fwdEthClean}"	-j "$ruleGwIn""
#  ip6toolsRuleAdd "filter" ""$ruleFwdIfaceOut"	-j "$ruleGwIn""
 
#  ip6toolsRuleAdd "filter" ""$ruleFwdIfaceIn"	-j "$ruleGwOut""
  ip6toolsRuleAdd "filter" "FORWARD	-i "${fwdEthClean}"	-o "${hostSrcEthClean}"	-j "$ruleGwOut""
#  ip6toolsRuleAdd "filter" ""$ruleSrcIfaceOut"	-j "$ruleGwOut""
 fi
 local hostFwdEth=""$( iptoolsGetHostEth ""${fwdEth}"" )""
 local hostFwdEthClean="$( $cmdEcho ${hostFwdEth} | $cmdTr ':' '_' )"
 if [ "$hostFwdEthClean" != "fwdEthClean" ];then
#  ip6toolsRuleAdd "filter" ""$ruleSrcIfaceIn"	-j "$ruleGwIn""
  ip6toolsRuleAdd "filter" "FORWARD	-i "${srcEthClean}"	-o "${hostFwdEthClean}"	-j "$ruleGwIn""
#  ip6toolsRuleAdd "filter" ""$ruleFwdIfaceOut"	-j "$ruleGwIn""
 
#  ip6toolsRuleAdd "filter" ""$ruleFwdIfaceIn"	-j "$ruleGwOut""
  ip6toolsRuleAdd "filter" "FORWARD	-i "${hostFwdEthClean}"	-o "${srcEthClean}"	-j "$ruleGwOut""
#  ip6toolsRuleAdd "filter" ""$ruleSrcIfaceOut"	-j "$ruleGwOut""
 fi
 # if twice macvlan
 if [ "$hostSrcEthClean" != "srcEthClean" ] && [ "$hostFwdEthClean" != "fwdEthClean" ];then
#  ip6toolsRuleAdd "filter" ""$ruleSrcIfaceIn"	-j "$ruleGwIn""
  ip6toolsRuleAdd "filter" "FORWARD	-i "${hostSrcEthClean}"	-o "${hostFwdEthClean}"	-j "$ruleGwIn""
#  ip6toolsRuleAdd "filter" ""$ruleFwdIfaceOut"	-j "$ruleGwIn""
 
#  ip6toolsRuleAdd "filter" ""$ruleFwdIfaceIn"	-j "$ruleGwOut""
  ip6toolsRuleAdd "filter" "FORWARD	-i "${hostFwdEthClean}"	-o "${hostSrcEthClean}"	-j "$ruleGwOut""
#  ip6toolsRuleAdd "filter" ""$ruleSrcIfaceOut"	-j "$ruleGwOut""
 fi
}
firewall6MangleExecute() {
 local log="firewall6MangleExecute"
 local jsonFwd="$( $cmdCat <&0 )"
 
 local srcIp="$( $cmdEcho ${jsonFwd} | json64InObjectRead srcIp )"
 local srcLl="$( $cmdEcho ${jsonFwd} | json64InObjectRead srcLl )"
 local jsonSrcEth="$( $cmdEcho ${jsonFwd} | json64InObjectRead srcEth )"
 local jsonSrcEthRoute6="$( $cmdEcho ${jsonSrcEth} | json64InObjectRead "route6" )"
 local srcRtTableName="$( $cmdEcho ${jsonSrcEthRoute6} | jsonInObjectRead "rtTableName" )"
 local srcEth="$( $cmdEcho ${jsonSrcEth} | json64InObjectRead eth )"
 local srcEthClean="$( $cmdEcho ${srcEth} | $cmdCut -d':' -f 1 )"
# local srcEth="$( iptoolsGetHostEth "${srcEth}" )"
 
 local srcNets="$( ip6toolsGetNets "${srcEth}" )"
 if [ -z "${srcEth}" ] || [ -z "${srcIp}" ] || [ -z "${srcNets}" ];then
  shDebugHidden 0 ""$log" bad params : srcEth:${srcEth} srcIp:${srcIp} srcNets:${srcNets}  " >&2
 else
  local log="${log}[${srcEth}/${srcNets}/${srcIp}]"
#  shDebugHidden 1 ""$log" srcEth:${srcEth} srcIp:${srcIp} srcNets:${srcNets}  " >&2
 fi
 local fwdRoundRobin="$( $cmdEcho ${jsonFwd} | json64InObjectRead roundRobin )"
 
 local fwdIp="$( $cmdEcho ${jsonFwd} | json64InObjectRead fwdIp )"
 local jsonFwdEth="$( $cmdEcho ${jsonFwd} | json64InObjectRead fwdEth )"
# local jsonFwdEthRoute6="$( $cmdEcho ${jsonFwdEth} | json64InObjectRead "route6" )"
# local fwdRtTableName="$( $cmdEcho ${jsonFwdEthRoute6} | jsonInObjectRead "rtTableName" )"
 local fwdEth="$( $cmdEcho ${jsonFwdEth} | json64InObjectRead eth )"
 local fwdEthClean="$( $cmdEcho ${fwdEth} | $cmdCut -d':' -f 1 )"
# local fwdEth=""$( iptoolsGetHostEth ""${fwdEth}"" )""
 
 if [ "all" = "${fwdIp}" ];then
  local fwdNets="$(ip6toolsGetNets ${fwdEth} )"
 else
  local fwdNets="$(ip6toolsGetNet ${fwdEth} ${fwdIp} )"
 fi
 if [ -z "${fwdEth}" ] || [ -z "${fwdIp}" ] || [ -z "${fwdNets}" ];then
  shDebugHidden 0 ""$log" bad params : fwdEth:${fwdEth} fwdIp:${fwdIp} fwdNets:${fwdNets} " >&2
 else
  local log="firewall6MangleExecute"
  local log="${log}[${srcEth}/${srcIp}][${fwdEth}/${fwdIp}]"
#  shDebugHidden 1 ""$log" fwdEth:${fwdEth} fwdIp:${fwdIp} fwdNets:${fwdNets} " >&2
 fi
 
 #
# local gwFwd=""$(iptoolsGetGw ""$ethFwd"" ""$ipFwd"")""
# local broadcastFwd=""$(iptoolsGetBroadcast ""$ethFwd"" ""$ipFwd"")""
 
# local fwdRtTableData="$( routeTableGetIfaceData "$ethFwd" )"
# local fwdRtTableMark="$( $cmdEcho $fwdRtTableData | $cmdCut -d'|' -f 2)"
# local fwdRtTableName="$( $cmdEcho $fwdRtTableData | $cmdCut -d'|' -f 3)"
# local fwdRtTablePrio="$( $cmdEcho $fwdRtTableData | $cmdCut -d'|' -f 4)"
 
 local log="firewall6MangleExecute[${srcEth}/${srcIp}][${fwdEth}/${fwdIp}]"
 for srcNet in ${srcNets};do
  [ -z "${srcNet}" ] || ip6IsInNetwork ${srcNet} "fe80::/10" && continue
  local srcIp="$( ip6toolsGetIp "${srcEth}" "${srcNet}" )"
  if [ -z "${srcIp}" ];then
   shDebugHidden 0 ""$log" no srcIp:${srcIp} for srcNet:${srcNet} " >&2
   continue;
  else
   local srcGws="$( ip6toolsGetGws "${srcEth}" "${srcNet}" )"
   [ -z "$srcGws" ] && local srcGws="$( ip6toolsGetGws "${srcEth}" fe80::/10 )"
   [ -z "$srcGws" ] && local srcGws="$( ip6toolsGetAllGws )"
   shDebugHidden 1 ""$log" srcNet:${srcNet} srcIp:${srcIp} srcGws:${srcGws}" >&2
  fi
#  local jsonIpRoute6="$( $cmdEcho {} | routeTableGetFromData "${srcEth}${srcLl}" )"
  local jsonIpRoute6="$( $cmdEcho {} | routeTableGetFromData "${srcLl}" )"
  local srcIpRtTableName="$( $cmdEcho ${jsonIpRoute6} | jsonInObjectRead "rtTableName" )"
#  local srcIpRtTableName="$( $cmdIp -6 rule | $cmdGrep ${srcIp} | $cmdHead -n 1 | $cmdRev | $cmdCut -d' ' -f1 | $cmdRev )"
  for srcGw in ${srcGws};do
   if [ -z "${srcGw}" ];then continue;fi
   local log="firewall6MangleExecute[${srcEth}/${srcIp}/${srcGw}]"
   shDebugHidden 1 ""$log" srcGw:$srcGw  " >&2
#   local jsonRoute="$( $cmdEcho {} | routeTableGetFromData "${srcLl}" )"
#   local srcLLrtTableName="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTableName" )"
#=============== ICI
   local ethForGw="$( ip6ToolsGetEthForGw ${srcGw} )"
   local ethForGwClean="$( $cmdEcho ${ethForGw} | $cmdCut -d':' -f 1 )"
   local jsonRoute="$( $cmdEcho {} | routeTableGetFromData "${ethForGw}" )"
   local rtEthForGwTableName="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTableName" )"
   local ll6ForGw="$( ip6toolsGetLLForGw ${srcGw} )"
   local jsonRoute="$( $cmdEcho {} | routeTableGetFromData "${ll6ForGw}" )"
   local rtll6ForGwTableName="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTableName" )"
   local jsonRoute="$( $cmdEcho {} | routeTableGetFromData "${ethForGw}${ll6ForGw}${srcGw}" )"
   local rtTablePrio="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTablePrio" )"
   local rtTableMark="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTableMark" )"
   local rtTableName="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTableName" )"
   if [ -z "$rtTableMark" ];then
    shDebugHidden 0 ""$log" no table MARK for '"${srcEth}.${srcGw}"'" >&2
   else
    shDebugHidden 1 ""$log" rtTableName:${rtTableName} srcIpRtTableName:${srcIpRtTableName} srcRtTableName:${srcRtTableName} fwdRtTableName:${fwdRtTableName}" >&2
    for fwdNet in ${fwdNets};do
#     ip6IsInNetwork ${fwdNet} "fe80::/10" && continue
     local fwdLl6s="$( ip6toolsGetIps ""${fwdEth}"" "fe80::/10" )"
     if [  "all" = "${fwdIp}" ];then
      local fwdIps="$( ip6toolsGetIps ""${fwdEth}"" ""${fwdNet}"" )"
     else
      local fwdIps="${fwdIp}"
     fi
     for ipFwd in ${fwdIps};do
      local log="firewall6MangleExecute[${srcGw}|${srcEth}|${srcIp}|${fwdEth}|${ipFwd}]"
      local extraRtForLL=""
      for ll6Fwd in ${fwdLl6s};do
       local anJsonRoute="$( $cmdEcho {} | routeTableGetFromData "${ll6Fwd}" )"
       local fwdLLrtTableName="$( $cmdEcho ${anJsonRoute} | jsonInObjectRead "rtTableName" )"
       local extraRtForLL="$fwdLLrtTableName $extraRtForLL"
      done
      for anRtTableName in ${rtEthForGwTableName} ${rtll6ForGwTableName} ${rtTableName} ${srcIpRtTableName} ${srcRtTableName} ${fwdRtTableName} ${srcLLrtTableName} ${extraRtForLL};do
       iptoolsExecute "$cmdIp -6 route add local "${srcIp}" dev "${srcEthClean}" metric 256 table "${anRtTableName}""
#       iptoolsExecute "$cmdIp -6 route add "${srcNet}" dev "${srcEthClean}" metric 256 table "${anRtTableName}""
       iptoolsExecute "$cmdIp -6 route add "${srcNet}" src "${srcIp}" dev "${srcEthClean}" metric 256 table "${anRtTableName}""
##       iptoolsExecute "$cmdIp -6 route add fe80::/10 dev "${srcEthClean}" metric 2048 table "${anRtTableName}""
       
       iptoolsExecute "$cmdIp -6 route add local "${ipFwd}" dev "${fwdEthClean}" metric 256 table "${anRtTableName}""
#       iptoolsExecute "$cmdIp -6 route add "${fwdNet}" dev "${fwdEthClean}" metric 512 table "${anRtTableName}""
       iptoolsExecute "$cmdIp -6 route add "${fwdNet}" src "${ipFwd}" dev "${fwdEthClean}" metric 512 table "${anRtTableName}""
##       iptoolsExecute "$cmdIp -6 route add fe80::/10 dev "${fwdEthClean}" metric 2048 table "${anRtTableName}""
       for ll6Fwd in ${fwdLl6s};do
        iptoolsExecute "$cmdIp -6 route add local "${ll6Fwd}" dev "${fwdEthClean}" metric 256 table "${anRtTableName}""
#        iptoolsExecute "$cmdIp -6 route add "${fwdNet}" src "${ll6Fwd}" dev "${fwdEthClean}" metric 513 table "${anRtTableName}""
#        iptoolsExecute "$cmdIp -6 route add fe80::/64 src "${ll6Fwd}" dev "${fwdEthClean}" metric 1024 table "${anRtTableName}""
#        iptoolsExecute "$cmdIp -6 route add ff00::/8 src "${ll6Fwd}" dev "${fwdEthClean}" metric 1024 table "${anRtTableName}""
#        iptoolsExecute "$cmdIp -6 route add ff00::/8 dev "${fwdEthClean}" metric 1024 table "${anRtTableName}""
       done
#       iptoolsExecute "$cmdIp -6 route add fe80::/64 dev "${fwdEthClean}" metric 2048 table "${anRtTableName}""
       iptoolsExecute "$cmdIp -6 route add fe80::/64 src "${ipFwd}" dev "${fwdEthClean}" metric 2048 table "${anRtTableName}""
#       iptoolsExecute "$cmdIp -6 route add ff00::/8 dev "${fwdEthClean}" metric 2048 table "${anRtTableName}""
#       iptoolsExecute "$cmdIp -6 route add ff00::/8 src "${ipFwd}" dev "${fwdEthClean}" metric 2048 table "${anRtTableName}""
       iptoolsExecute "$cmdIp -6 route add default via "${srcGw}" src "${srcIp}" dev "${ethForGwClean}" metric 2048 table "${anRtTableName}""
       shDebugHidden 2 ""$log" ${fwdNet} add backing route ${anRtTableName} " >&2
      done
#      for anRtTableName in ${rtTableName} ${srcRtTableName};do
##       iptoolsExecute "$cmdIp -6 route add local "${ipFwd}" dev lo metric 119 table "${anRtTableName}""
#        iptoolsExecute "$cmdIp -6 route add local "${ipFwd}" dev "${fwdEthClean}" metric 213 table "${anRtTableName}""
##       iptoolsExecute "$cmdIp -6 route add fe80::/10 src "${ipFwd}" dev "${fwdEthClean}" metric 212 table "${anRtTableName}""
#        iptoolsExecute "$cmdIp -6 route add "${fwdNet}" src "${ipFwd}" dev "${fwdEthClean}" metric 118 table "${anRtTableName}""
##       iptoolsExecute "$cmdIp -6 route add ff00::/8 src "${ipFwd}" dev "${fwdEthClean}" metric 1048 table "${anRtTableName}""
#       for ll6Fwd in ${fwdLl6s};do
##        iptoolsExecute "$cmdIp -6 route add local "${ll6Fwd}" dev lo metric 117 table "${anRtTableName}""
#        iptoolsExecute "$cmdIp -6 route add local "${ll6Fwd}" dev "${fwdEthClean}" metric 211 table "${anRtTableName}""
#        iptoolsExecute "$cmdIp -6 route add fe80::/10 src "${ll6Fwd}" dev "${fwdEthClean}" metric 116 table "${anRtTableName}""
#        iptoolsExecute "$cmdIp -6 route add "${fwdNet}" src "${ll6Fwd}" dev "${fwdEthClean}" metric 210 table "${anRtTableName}""
#        iptoolsExecute "$cmdIp -6 route add ff00::/8 src "${ll6Fwd}" dev "${fwdEthClean}" metric 550 table "${anRtTableName}""
#       done
#       shDebugHidden 2 ""$log" ${fwdNet} add backing route ${anRtTableName} " >&2
#      done
      local macIpPorteuse="$( $cmdIp link show dev "${fwdEthClean}" | $cmdGrep ether | $cmdCut -d' ' -f 6 )"
      if ! command -v nft >/dev/null 2>&1; then
       echo "=> "${ipFwd}" "${fwdEth}":$macIpPorteuse" >> /tmp/ebtables6.log 2>&1
       echo ebtables -t broute -I BROUTING -i "${fwdEthClean}" -d "${macIpPorteuse}" -p IPv6 --ip6-source "${fwdNet}" -j mark --mark-set "${rtTableMark}" >> /tmp/ebtables6.log 2>&1
       ebtables -t broute -I BROUTING -i "${fwdEthClean}" -d "${macIpPorteuse}" -p IPv6 --ip6-source "${fwdNet}" -j mark --mark-set "${rtTableMark}" >> /tmp/ebtables6.log 2>&1
       echo ebtables -t broute -A BROUTING -i "${fwdEthClean}" -p IPv6 --ip6-destination "${ipFwd}" --ip6-source "${fwdNet}" -j mark --mark-set "${rtTableMark}" >> /tmp/ebtables6.log 2>&1
       ebtables -t broute -A BROUTING -i "${fwdEthClean}" -p IPv6 --ip6-destination "${ipFwd}" --ip6-source "${fwdNet}" -j mark --mark-set "${rtTableMark}" >> /tmp/ebtables6.log 2>&1
      else
       echo nft insert rule inet mark_tbl prerouting \
        iif  "${fwdEth}" ether daddr "${macIpPorteuse}" \
        ip6 saddr "${fwdNet}" \
        meta mark set "${rtTableMark}"
       nft insert rule inet mark_tbl prerouting \
        iif  "${fwdEth}" ether daddr "${macIpPorteuse}" \
        ip6 saddr "${fwdNet}" \
        meta mark set "${rtTableMark}"
       echo nft add rule inet mark_tbl prerouting \
        iif  "${fwdEth}" ip6 daddr "${ipFwd}" \
        ip6 saddr "${fwdNet}" \
        meta mark set "${rtTableMark}"
       nft add rule inet mark_tbl prerouting \
        iif  "${fwdEth}" ip6 daddr "${ipFwd}" \
        ip6 saddr "${fwdNet}" \
        meta mark set "${rtTableMark}"
      fi
      #local jsonIp6RouteFwd="$( $cmdEcho ${jsonFwdEth} | json64InObjectRead ip6s | json64InObjectRead "${ipFwd}" | json64InObjectRead route )"
      #local fwdIpRtTableName="$( $cmdEcho ${jsonIp6RouteFwd} | json64InObjectRead rtTableName )"
#      local fwdIpRtTableName="$( $cmdEcho {} | routeTableGetFromData "${fwdEth}${ipFwd}${fwdNet}" | jsonInObjectRead rtTableName )"
#      shDebugHidden 2 ""$log" mangle6EnableGwfwdEth:${fwdEth} fwdIpRtTableName:${fwdIpRtTableName} " >&2
#      mangle6EnableGw "${srcEth}" "no-ip6" "no-ll6" "no-net6" "${srcGw}" "${fwdIpRtTableName}" >&2
      local fwdMarkNetIn="$( $cmdEcho ${jsonFwdEth} | json64InObjectRead ip6s | json64InObjectRead "${ipFwd}" | json64InObjectRead route | json64InObjectRead markIn )"
      if [ -z "${fwdMarkNetIn}" ];then
       shDebugHidden 0 ""$log" empty fwdMarkNetIn:${fwdMarkNetIn} " >&2
      else
#       if [ -n "$(ip6tables -t mangle -nL ${fwdMarkNetIn} | grep $rtTableMark | grep ${fwdEth} )" ];then
#        shDebugHidden 2 ""$log" default route table mark ever exist" >&2
#       else
       if [ "all" = "$fwdRoundRobin" ];then
        ip6toolsRuleInsert "mangle" "${fwdMarkNetIn}		-m mark --mark 0x0 -s "${fwdNet}" ! -d "${fwdNet}" -j MARK --set-mark "${rtTableMark}""
       else
        local modeRoundRobin="$( $cmdEcho ${fwdRoundRobin} | $cmdCut -d',' -f1 )"
        local valueRoundRobin="$( $cmdEcho ${fwdRoundRobin} | $cmdCut -d',' -f2 )"
        #random,0.22
        if [ "random" = "${modeRoundRobin}" ];then
         ip6toolsRuleInsert "mangle" "${fwdMarkNetIn}	 -m mark --mark 0x0 -s "${fwdNet}" ! -d "${fwdNet}" -m statistic --mode random --probability "${valueRoundRobin}" -j MARK --set-mark "${rtTableMark}""
        #ntf,4.3
        elif [ "nth" = "${modeRoundRobin}" ];then
         local every="$( $cmdEcho ${valueRoundRobin} | $cmdCut -d. -f1 )"
         local packet="$( $cmdEcho ${valueRoundRobin} | $cmdCut -d. -f2 )"
         ip6toolsRuleInsert "mangle" "${fwdMarkNetIn}	 -m mark --mark 0x0 -s "${fwdNet}" ! -d "${fwdNet}" -m statistic --mode nth --every "${every}" --packet "${packet}" -j MARK --set-mark "${rtTableMark}""
        else
         shDebugHidden 1 ""$log" unknow modeRoundRobin:"${modeRoundRobin}"/"${fwdRoundRobin}"" >&2
        fi
       fi
#       iptoolsRuleAdd "mangle" "$enterSoluce	-m mark --mark 0x0 -s "${fwdNet}" ! -d "${fwdNet}" -j CONNMARK --set-mark "${rtTableMark}""
#       iptoolsRuleAdd "mangle" "${fwdMarkNetIn}	-i ${ethFwd} -s "$netFwd" ! -d "$netFwd" -m mark --mark 0x0 -j CONNMARK --set-mark "$rtTableMark""
#       iptoolsRuleAdd "mangle" "${fwdMarkNetIn}	-i ${eth} -d "$netFwd" -m mark --mark 0x0 -j MARK --set-mark "$fwdRtTableMark""
#       iptoolsRuleAdd "mangle" "${fwdMarkNetIn}	-m physdev --physdev-in ${ethFwd} -s "$netFwd" ! -d "$netFwd" -j MARK --set-mark "$rtTableMark""
#      fi
      fi
     done
    done
    #if ! iptoolsExecute "$cmdIp -4 rule add pri ${rtTablePrio} fwmark ${rtTableMark} lookup ${rtTableName}" ; then
    # shDebugHidden 0 ""$log" $eth ip rule add pri" >&2
    #else
    # shDebugHidden 2 ""$log" $eth ip rule add pri" >&2
    #fi
   fi
  done
 done
# local ruleIfaceIn="In"$eth""
# local ruleIfaceOut="Out"$eth""
  
# local bridgeEthFwd=""$(iptoolsGetHostEth $ethFwd )""
# local ruleFwdIN="Gw${bridgeEthFwd}-${bridgeEthFwd}O"
# local ruleFwdOUT="Gw${bridgeEthFwd}-${bridgeEthFwd}I"
## [ 2099.268193] NETFILTER_FORWARD
## IN=xenbr0 OUT=xenbr0 PHYSIN=eth1 PHYSOUT=veth2 MAC=01:00:5e:00:00:01:58:90:43:9c:93:1c:08:00 SRC=192.168.1.254 DST=224.0.0.1
## LEN=32 TOS=0x00 PREC=0xA0 TTL=1 ID=19502 DF OPT (94040000) PROTO=2 MARK=0xd
# iptoolsRuleAdd "filter" "INPUT	-j ${ruleIfaceIn} -m physdev --physdev-in ${ethFwd} "
# iptoolsRuleAdd "filter" "INPUT	-j ${ruleFwdIN} -m physdev --physdev-in ${ethFwd} "
# iptoolsRuleAdd "filter" "INPUT	-j ${ruleFwdOUT} -m physdev --physdev-in ${ethFwd} "
# 
# iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdIN} -m physdev --physdev-in ${ethFwd} "
# iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdOUT} -m physdev --physdev-in ${ethFwd} "
# iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdIN} -m physdev --physdev-out ${ethFwd} "
# iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdOUT} -m physdev --physdev-out ${ethFwd} "
# iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdIN} -o "$(iptoolsGetHostEth $ethFwd )" "
# iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdOUT} -o "$(iptoolsGetHostEth $ethFwd )" "

# iptoolsRuleAdd "filter" "OUTPUT	-j ${ruleIfaceOut} -o "$(iptoolsGetHostEth $ethFwd )" "
# iptoolsRuleAdd "filter" "OUTPUT	-j ${ruleFwdIN} -m physdev --physdev-out ${ethFwd} "
# iptoolsRuleAdd "filter" "OUTPUT	-j ${ruleFwdOUT} -m physdev --physdev-out ${ethFwd} "
}

# $cmdEcho ${jsonFwd} | firewall6Gateway "${mode}" "${file}" >> ${logFile} 2>&1
firewall6Gateway() {
 local log="firewall6Gateway:"
 local jsonFwd="$( $cmdCat <&0 )"
 local mode=""${1}""
 local file=""${2}""
 
 local jsonSrcEth="$( $cmdEcho ${jsonFwd} | json64InObjectRead srcEth )"
 local srcIp="$( $cmdEcho ${jsonFwd} | json64InObjectRead srcIp )"
 if [ "*" = "${srcIp}" ];then local srcIp="all";fi
 local jsonFwdEth="$( $cmdEcho ${jsonFwd} | json64InObjectRead fwdEth )"
 local fwdIp="$( $cmdEcho ${jsonFwd} | json64InObjectRead fwdIp )"
 if [ "*" = "${fwdIp}" ];then local fwdIp="all";fi
 local fwdRoundRobin="$( $cmdEcho ${jsonFwd} | json64InObjectRead roundRobin )"
 local srcEth="$( $cmdEcho ${jsonSrcEth} | json64InObjectRead eth )"
 local srcEthClean="$( $cmdEcho ${srcEth} | $cmdTr ':' '_' )"
 local srcMasterEth="$( $cmdEcho ${jsonSrcEth} | json64InObjectRead masterEth )"
# local srcEth="$( iptoolsGetHostEth "${srcEth}" )"
 local fwdEth="$( $cmdEcho ${jsonFwdEth} | json64InObjectRead eth )"
 local fwdEthClean="$( $cmdEcho ${fwdEth} | $cmdTr ':' '_' )"
# local fwdEth="$( iptoolsGetHostEth "${fwdEth}" )"
 
 shDebug 2 ""$log" srcEth:"${srcEth}"/srcIp:"${srcIp}" fwdEth:"${fwdEth}"/fwdIp:"${fwdIp}" roundRobin:"${fwdRoundRobin}" mode:"$mode" file:"$file""
 
 firewall6GwCreateInterface "${srcEth}" "${fwdEth}" >&2
# $cmdEcho ${jsonFwd} | firewall6MangleExecute >&2
# shDebug 2 "${log} Mangle executed"
 local ruleIfaceIn="Gw"${srcEthClean}"-"${fwdEthClean}"I"
 local ruleIfaceOut="Gw"${srcEthClean}"-"${fwdEthClean}"O"
 
 if [ "${srcIp}" = "all" ];then
  local srcNets="$( ip6toolsGetNets "${srcEth}" )"
  local srcIp=""
 else
  if ip6IsInNetwork "${srcIp}" "fe80::/10";then
   local srcNets="$( ip6toolsGetNet "${srcEth}" )"
  else
   local srcNets="$( ip6toolsGetNet "${srcEth}" "${srcIp}" )"
  fi
 fi
 for srcNet in ${srcNets};do
  ip6IsInNetwork ${srcNet} "fe80::/10" && continue
  if [ -z "${srcIp}" ];then
   local srcGws="$( ip6toolsGetGws "${srcEth}" "${srcNet}" )"
   [ -z "$srcGws" ] && local srcGws="$( ip6toolsGetGws "${srcEth}" fe80::/10 )"
   [ -z "$srcGws" ] && local srcGws="$( ip6toolsGetAllGws )"
#   if ! ip6IsInNetwork "${srcNet}" "fe80::/10";then local srcGws="${srcGws} $( ip6toolsGetGws "${srcEth}" fe80::/10 )";fi
   local srcIps=""$( ip6toolsGetIps ""${srcEth}"" ""${srcNet}"" )""
  else
   local srcGws="${srcIp}"
   local srcIps=""$( ip6toolsGetIps ""${srcEth}"" ""${srcNet}"" )""
  fi
  if [ -z "${srcGws}" ];then shDebug 2 "${log} no Gw in ${srcNet}" >&2;continue;fi
  local log="firewall6Gateway:"
  shDebug 2 ""$log" [srcEth:${srcEth}}] srcIps:${srcIps} srcGws:${srcGws}" >&2
  
  if [ "${fwdIp}" = "all" ];then
   local fwdNets="$( ip6toolsGetNets "${fwdEth}" )"
   local fwdIp=""
  else
   local fwdNets="$( ip6toolsGetNets "${fwdEth}" "${fwdIp}" )"
  fi
  shDebug 2 ""$log" [fwdEth:${fwdEth}] fwdNets:${fwdNets}" >&2
  for fwdNet in ${fwdNets};do
#   ip6IsInNetwork ${fwdNet} "fe80::/10" && continue
   if [ -z "${fwdIp}" ];then
    #local fwdGws=""$( ip6toolsGetGws ""$fwdEth"" ""$fwdNet"")""
    local fwdIps="$( ip6toolsGetIps "${fwdEth}" "${fwdNet}")"
   else
    #local fwdGws=""$( ip6toolsGetGws ""$fwdEth"" ""$fwdIp"" )""
    local fwdIps="$( ip6toolsGetIps "${fwdEth}" "${fwdIp}" )"
   fi
   shDebug 2 ""$log" fwdIps:${fwdIps}" >&2
   # Initialization de la table NAT
   if [ "$mode" = "igw6" ];then
#    echo 2 > /proc/sys/net/ipv6/conf/${srcEth}/accept_ra
    for srcIp in ${srcIps};do
     local log="firewall6Gateway[srcIp:${srcIp} <=> fwdNet:${fwdNet}"
     ip6IsInNetwork $srcIp $fwdNet && shDebug 2 ""$log" shunt cause srcIp in fwdNet" >&2 && continue

     local upnpRuleName="MINIUPNPD"
     local upnpPeerRuleName="MINIUPNPD-PCP-PEER"
     local upnpPostRoutingRuleName="MINIUPNPD-POSTROUTING"
     ip6toolsRuleAdd "nat" "PREROUTING -i "${srcEth}" -d "${srcIp}" -j "$upnpRuleName""
     ip6toolsRuleAdd "mangle" "PREROUTING -i "${srcEth}" -d "${srcIp}" -j "$upnpRuleName""
     ip6toolsRuleAdd "nat" "POSTROUTING -o "${srcEth}" -s "${fwdNet}" -d "${srcIp}" -j "$upnpPeerRuleName""
     ip6toolsRuleAdd "nat" "POSTROUTING -o "${srcEth}" -s "${fwdNet}" -d "${srcIp}" -j "$upnpPostRoutingRuleName""
#     ip6toolsRuleInsert	"nat"	"POSTROUTING	-i "${fwdEth}"	-s "${fwdNet}"	-d "${srcNet}"	-j SNAT --to-source "${srcIp}""
     ip6toolsRuleInsert	"nat"	"POSTROUTING	-o "${srcEth}"	-s "${fwdNet}"	-d "${srcNet}"	-j SNAT --to-source "${srcIp}""
     if [ -n "$srcMasterEth" ] && [ "$srcEth" != "$srcMasterEth" ];then
      ip6toolsRuleAdd "nat" "PREROUTING -i "${srcMasterEth}" -d "${srcIp}" -j "$upnpRuleName""
      ip6toolsRuleAdd "mangle" "PREROUTING -i "${srcMasterEth}" -d "${srcIp}" -j "$upnpRuleName""
      ip6toolsRuleAdd "nat" "POSTROUTING -o "${srcMasterEth}" -s "${fwdNet}" -d "${srcIp}" -j "$upnpPeerRuleName""
      ip6toolsRuleAdd "nat" "POSTROUTING -o "${srcMasterEth}" -s "${fwdNet}" -d "${srcIp}" -j "$upnpPostRoutingRuleName""
#      ip6toolsRuleInsert	"nat"	"POSTROUTING	-i "${fwdEth}"	-s "${fwdNet}"	-d "${srcNet}"	-j SNAT --to-source "${srcIp}""
      ip6toolsRuleInsert	"nat"	"POSTROUTING	-o "${srcMasterEth}"	-s "${fwdNet}"	-d "${srcNet}"	-j SNAT --to-source "${srcIp}""
     fi
#     ip6toolsRuleInsert	"nat"	"POSTROUTING	-i "${fwdEth}"	-s "${fwdNet}" ! -d "${fwdNet}"	-j SNAT --to-source "${srcIp}""
#     ip6toolsRuleInsert	"nat"	"POSTROUTING	-o "${srcEth}"	-s "${fwdNet}" ! -d "${fwdNet}"	-j SNAT --to-source "${srcIp}""
     
#     for srcGw in $( ip6toolsGetGws "${srcEth}" "${srcNet}" ) $( ip6toolsGetGws "${srcEth}" "fe80::/10" );do
     for srcGw in ${srcGws};do
      shDebug 2 ""$log" srcGw:${srcGw}" >&2
      echo 2 > /proc/sys/net/ipv6/conf/$( ip6ToolsGetEthForGw ${srcGw} )/accept_ra
#=============== ICI
      local ethForGw="$( ip6ToolsGetEthForGw ${srcGw} )"
      local ll6ForGw="$( ip6toolsGetLLForGw ${srcGw} )"
      local jsonRoute="$( $cmdEcho {} | routeTableGetFromData "${ethForGw}${ll6ForGw}${srcGw}" )"
#     local rtTablePrio="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTablePrio" )"
      local rtTableMark="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTableMark" )"
#     local rtTableName="$( $cmdEcho ${jsonRoute} | jsonInObjectRead "rtTableName" )"

      firewall6GatewayFileConf "${file}" "${srcEth}" "${srcIp}" "${srcNet}" "${srcGw}" "${fwdEth}" "${fwdNet}" "${mode}" "${upnpRuleName}"
      ip6toolsRuleInsert "nat"	"POSTROUTING	-m mark --mark "${rtTableMark}"	-s "${fwdNet}" !	-d "${fwdNet}"	-j SNAT --to-source "${srcIp}""
      ip6toolsRuleAdd "nat"	"POSTROUTING	-s "${fwdNet}" !	-d "${fwdNet}"	-j SNAT --to-source "${srcIp}""
     done
     #ip6toolsRuleAdd "nat"	"POSTROUTING	-o "${srcEth}"	-s "${fwdNet}" !-d "${fwdNet}"	-j SNAT --to-source "${srcIp}""
     #ip6toolsRuleAdd "nat"	"POSTROUTING	-o "$eth"	-s "$fwdNet" !	-d "$fwdNet"	-j MASQUERADE"
    done
   elif [  "$mode" = "gw6" ];then
    for srcIp in ${srcIps};do
     local log="firewall6Gateway[srcIp:${srcIp} <=> fwdNet:${fwdNet}"
     ip6IsInNetwork $srcIp $fwdNet && shDebug 2 ""$log" shunt cause srcIp in fwdNet" >&2 && continue
     if [ "$srcEth" != "$srcMasterEth" ];then
      ip6toolsRuleAdd "nat"	"POSTROUTING	 -o "${srcMasterEth}"	-s "${fwdNet}" 	-d "${srcNet}"	-j SNAT --to-source "${srcIp}""
     fi
     ip6toolsRuleAdd "nat"	"POSTROUTING	 -o "${srcEth}"	-s "${fwdNet}" 	-d "${srcNet}"	-j SNAT --to-source "${srcIp}""
#     for srcGw in $( ip6toolsGetGws "${srcEth}" "${srcNet}" ) $( ip6toolsGetGws "${srcEth}" "fe80::/10" );do
     for srcGw in ${srcGws};do
      shDebug 2 ""$log" srcGw:${srcGw}" >&2
      firewall6GatewayFileConf "${file}" "${srcEth}" "${srcIp}" "${srcNet}" "${srcGw}" "${fwdEth}" "${fwdNet}" "${mode}"
     done
    done
   fi
   echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
   echo 0 > /proc/sys/net/ipv6/conf/default/forwarding
   echo 0 > /proc/sys/net/ipv6/conf/lo/forwarding
#   echo 1 > /proc/sys/net/ipv6/conf/${fwdEth}/forwarding
#   echo 1 > /proc/sys/net/ipv6/conf/${srcEth}/forwarding
  done
 done
 shDebug 2 ""$log" END ==================================================================================="
}
firewall6GatewayFileConf() {
 local file="${1}"
 local srcEth="${2}"
 local srcEthClean="$( $cmdEcho ${srcEth} | $cmdTr ':' '_' )"
 local ip="${3}"
 local net="${4}"
 local gw="${5}"
 local fwdEth="${6}"
 local fwdEthClean="$( $cmdEcho ${fwdEth} | $cmdTr ':' '_' )"
 local fwdNet="${7}"
 local mode="${8}"
 local upnpRuleName="${9}"

 local clients=""
 local servers=""
 
 local dropIn=""
 local dropOut=""
 local dropFwd=""
 local ruleIn=""
 local ruleOut=""
 local ruleFwd=""
 
 $(shIncludeET $file)
 if [ -z "$clients" ] && [ -z "$servers" ] && [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$dropFwd" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ] && [ -z "$ruleFwd" ];then
  shDebugHidden 0 ""$log" echec params(ip:$ip) empty : clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut"" >&2
 else
  shDebugHidden 1 ""$log" "$srcEth" => ip:"$ip" net:"$net" gw:"$gw"" >&2
  
  local clients="$(echo $clients | tr -d ' ' | tr -d '\t')"
  local servers="$(echo $servers | tr -d ' ' | tr -d '\t')"
  
  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceIn""	"$dropIn"	"-j DROP"
  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceOut""	"$dropOut"	"-j DROP"
  
  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceIn""	"$ruleIn"	"-j ACCEPT"
  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceOut""	"$ruleOut"	"-j ACCEPT"
  
  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceIn""	"$dropFwd"	"-j DROP"
  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceOut""	"$dropFwd"	"-j DROP"
  
  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceIn""	"$ruleFwd"	"-j ACCEPT"
  iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceOut""	"$ruleFwd"	"-j ACCEPT"
  
  local fwdEthClean="$( $cmdEcho ${fwdEth} | $cmdTr ':' '_' )"
  local ruleNetworkIn="gIn"$srcEthClean"-"$fwdEthClean"N"
  local ruleNetworkOut="gOut"$srcEthClean"-"$fwdEthClean"N"
  ip6toolsRuleCreate "filter" "$ruleNetworkIn"
  ip6toolsRuleCreate "filter" "$ruleNetworkOut"
  iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""$ruleIfaceIn""		"-s" "$network"	"-j $ruleNetworkIn"
  iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""$ruleIfaceOut""		"-d" "$network"	"-j $ruleNetworkOut"
  
  local ruleGwIn="gIn"$srcEthClean"-"$fwdEthClean"R"
  local ruleGwOut="gOut"$srcEthClean"-"$fwdEthClean"R"
  ip6toolsRuleCreate "filter" "$ruleGwIn"
  ip6toolsRuleCreate "filter" "$ruleGwOut"
  
  ip6toolsRuleAdd "filter" "$ruleNetworkIn	-d "$fwdNet" -j "$ruleGwIn""
  ip6toolsRuleAdd "filter" "$ruleNetworkOut	-s "$fwdNet" -j "$ruleGwOut""
  
  
  if [ -n "$clients" ];then
   local clientsRulesName="$( firewall6GatewayClientConf "$clients" )"
   local clientsRuleNameIn="$( $cmdEcho $clientsRulesName | $cmdCut -f1 -d '|')"
   local clientsRuleNameOut="$( $cmdEcho $clientsRulesName | $cmdCut -f2 -d '|')"
   ip6toolsRuleAdd "filter" "$ruleGwIn  -j $clientsRuleNameIn"
   ip6toolsRuleAdd "filter" "$ruleGwOut -j $clientsRuleNameOut"
  fi
  if [ -n "$servers" ];then
   if [ "$mode" = "igw" ];then
    local serversRulesName="$(firewall6GatewayServerFwConf "$upnpRuleName" "$servers")"
   else
    local serversRulesName="$(firewall6GatewayServerConf "$servers")"
   fi
   local serversRuleNameIn="$( $cmdEcho $serversRulesName | $cmdCut -f1 -d '|')"
   local serversRuleNameOut="$( $cmdEcho $serversRulesName | $cmdCut -f2 -d '|')"
   ip6toolsRuleAdd "filter" "$ruleGwIn  -j $serversRuleNameIn"
   ip6toolsRuleAdd "filter" "$ruleGwOut -j $serversRuleNameOut"
  fi
 fi
}
firewall6GatewayClientConf() {
 local log="firewall6GatewayClientConf:"
 local clients=""$1""
 local clientsMd5=""$(echo ""$clients"" | $cmdMd5sum | cut -f1 -d' ')""
 local clientsRule=""$(ip6toolsGetMd5Rule "filter" ""$clientsMd5"")""
 local clientsRuleIn=""$clientsRule"CltIn"
 local clientsRuleOut=""$clientsRule"CltOut"
 if ! ip6toolsRuleExiste "filter" $clientsRuleIn;then
  if ip6toolsRuleExiste "filter" $clientsRuleOut;then shDebugHidden "[ ERROR ]"$log" 'in' not exist but 'out' exist ??????" ;fi
  ip6toolsRuleCreate "filter" "$clientsRuleIn"
  ip6toolsRuleCreate "filter" "$clientsRuleOut"
  for client in $(echo $clients | tr -s '|' ' ');do
   local proto="$(echo $client | cut -d';' -f1)"
   local port="$(echo $client | cut -d';' -f2)"
   if [ -z "$(echo $port | grep :)" ];then
    ip6toolsRuleAdd "filter" "$clientsRuleIn	-p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT" >&2
    if [ "$proto" = "TCP" ];then
     ip6toolsRuleAdd "filter" "$clientsRuleIn	-p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT" >&2
    fi
    ip6toolsRuleAdd "filter" "$clientsRuleOut	-p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT" >&2
    if [ "$proto" = "TCP" ];then
     ip6toolsRuleAdd "filter" "$clientsRuleOut	-p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT" >&2
    fi
   else
    ip6toolsRuleAdd "filter" "$clientsRuleIn	-p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT" >&2
    if [ "$proto" = "TCP" ];then
     ip6toolsRuleAdd "filter" "$clientsRuleIn	-p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT" >&2
    fi
    ip6toolsRuleAdd "filter" "$clientsRuleOut	-p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT" >&2
    if [ "$proto" = "TCP" ];then
     ip6toolsRuleAdd "filter" "$clientsRuleOut	-p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT" >&2
    fi
   fi
  done
 fi
 echo ""$clientsRuleIn"|"$clientsRuleOut""
}
firewall6GatewayServerConf() {
 local log="firewall6GatewayServerConf:"
 local servers=""$1""
 local serversMd5=""$(echo ""$servers"" | $cmdMd5sum | cut -f1 -d' ')""
 if [ -z "$serversMd5" ];then return 1;fi
 local serversRule=""$(ip6toolsGetMd5Rule "filter" ""$serversMd5"")""
 local serversRuleIn=""$serversRule"SrvIn"
 local serversRuleOut=""$serversRule"SrvOut"
 if ! ip6toolsRuleExiste "filter" $serversRuleIn;then
  if ip6toolsRuleExiste "filter" $serversRuleOut;then shDebugHidden "[ ERROR ]"$log" 'in' not exist but 'out' exist ??????" ;fi
  ip6toolsRuleCreate "filter" "$serversRuleIn"
  ip6toolsRuleCreate "filter" "$serversRuleOut"
  for server in $(echo $servers | tr -s '|' ' ');do
   local proto="$(echo $server | cut -d';' -f1)"
   local port="$(echo $server | cut -d';' -f2)"
   if [ -z "$(echo $port | grep :)" ];then
    ip6toolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     ip6toolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   else
    ip6toolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     ip6toolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   fi
   if [ -z "$(echo $port | grep :)" ];then
    ip6toolsRuleAdd "filter" "$serversRuleOut -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     ip6toolsRuleAdd "filter" "$serversRuleOut -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   else
    ip6toolsRuleAdd "filter" "$serversRuleOut -p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     ip6toolsRuleAdd "filter" "$serversRuleOut -p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   fi
  done
 fi
 echo ""$serversRuleIn"|"$serversRuleOut""
}
firewall6GatewayServerFwConf() {
 local log="firewall6GatewayServerFwConf:"
 local upnpRuleName=""$1""
 local servers=""$2""
 local serversMd5=""$( $cmdEcho ""$servers"" | $cmdMd5sum | $cmdCut -f1 -d' ')""
 if [ -z "$serversMd5" ];then return 1;fi
 local serversRule=""$( ip6toolsGetMd5Rule "filter" ""$serversMd5"" )""
 local serversRuleIn=""$serversRule"SrvFwIn"
 local serversRuleOut=""$serversRule"SrvFwOut"
 
 if ip6toolsRuleExiste "filter" $serversRuleIn;then
  if ! ip6toolsRuleExiste "filter" $serversRuleOut;then shDebugHidden "[ ERROR ]"$log" 'in' exist but 'out' not exist ??????" >&2 ;fi
 else
  if ip6toolsRuleExiste "filter" $serversRuleOut;then shDebugHidden "[ ERROR ]"$log" 'in' not exist but 'out' exist ??????" >&2 ;fi
  ip6toolsRuleCreate "filter" "$serversRuleIn"
  ip6toolsRuleCreate "filter" "$serversRuleOut"
  for server in $(echo $servers | tr -s '|' ' ');do
   local proto="$(echo $server | cut -d';' -f1)"
   local port="$(echo $server | cut -d';' -f2)"
   if [ -z "$(echo $port | grep :)" ];then
    ip6toolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW -j "$upnpRuleName""
    if [ "$proto" = "TCP" ];then
     ip6toolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j "$upnpRuleName""
    fi
   else
    ip6toolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW -j "$upnpRuleName""
    if [ "$proto" = "TCP" ];then
     ip6toolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j "$upnpRuleName""
    fi
   fi
   if [ -z "$(echo $port | grep :)" ];then
    ip6toolsRuleAdd "filter" "$serversRuleOut -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     ip6toolsRuleAdd "filter" "$serversRuleOut -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   else
    ip6toolsRuleAdd "filter" "$serversRuleOut -p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     ip6toolsRuleAdd "filter" "$serversRuleOut -p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   fi
  done
 fi
 echo ""$serversRuleIn"|"$serversRuleOut""
}
#return ;
#firewall6Gateway() {
# local log="firewall6Gateway:"
# local eth="$(iptoolsGetHostEth "$1")"
# local mode=""$2""
# local fwdEth="$(iptoolsGetHostEth "$3")"
# local file=""$4""
# 
# shDebug "[ INFO ]"$log" eth:"$eth" fwdEth:"$fwdEth" mode:"$mode" file:"$file""
# 
# #local ruleIfaceIn=""$(firewall6CreateRule	"Gw"$eth"In")""
# #local ruleIfaceOut=""$(firewall6CreateRule	"Gw"$eth"Out")""
# local ruleIfaceIn="Gw"$eth"-"$fwdEth"I"
# local ruleIfaceOut="Gw"$eth"-"$fwdEth"O"
# ip6toolsRuleCreate "filter" "$ruleIfaceIn"
# ip6toolsRuleCreate "filter" "$ruleIfaceOut"
#
# ip6toolsRuleAdd "filter" "INPUT	-i "$eth"			-j "$ruleIfaceIn""
# ip6toolsRuleAdd "filter" "FORWARD	-i "$eth"	-o "$fwdEth"	-j "$ruleIfaceIn""
# ip6toolsRuleAdd "filter" "FORWARD	-i "$eth"	-o "$fwdEth"	-j "$ruleIfaceIn""
# ip6toolsRuleAdd "filter" "OUTPUT			-o "$fwdEth"	-j "$ruleIfaceIn""
# 
# ip6toolsRuleAdd "filter" "INPUT	-i "$fwdEth"			-j "$ruleIfaceOut""
# ip6toolsRuleAdd "filter" "FORWARD	-i "$fwdEth"	-o "$eth"	-j "$ruleIfaceOut""
# ip6toolsRuleAdd "filter" "OUTPUT			-o "$eth"	-j "$ruleIfaceOut""
# 
# local ips="$(ip6toolsGetIps "$eth")"
# shDebug "[ INFO ]"$log" ips(eth :$eth):$ips"
# for ip in $ips;do
#  if [ -z "$(echo -e "$ip" | tr -d '[[:space:]]')" ];then continue;fi
#  local net="$(ip6toolsGetNet "$eth" "$ip")"
#  local gw="$(ip6toolsGetGw "$eth" "$ip")"
#  
#  local fwdIps="$(ip6toolsGetIps "$fwdEth" "")"
#  shDebug "[ INFO ]"$log" fw ips(eth :$fwdEth):$fwdIps"
#  for fwdIp in $fwdIps;do
#   if [ -z "$(echo -e "$fwdIp" | tr -d '[[:space:]]')" ];then continue;fi
#   local fwdNet="$(ip6toolsGetNet "$fwdEth" "$fwdIp")"
#   local fwdGw="$(ip6toolsGetGw "$fwdEth" "$fwdIp")"
#   
#   local clients=""
#   local servers=""
#   
#   local dropIn=""
#   local dropOut=""
#   local ruleIn=""
#   local ruleOut=""
#   
#   $(shIncludeET $file)
#   if [ -z "$clients" ] && [ -z "$servers" ] && [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ];then
#    shDebug "[ ERROR ]"$log" echec params(ip:$ip) empty : clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut""
#   else
#    shDebug "[ INFO ]"$log" "$eth" => ip:"$ip" net:"$net" gw:"$gw""
#    
#    local clients="$(echo $clients | tr -d ' ' | tr -d '\t')"
#    local servers="$(echo $servers | tr -d ' ' | tr -d '\t')"
#    
#    iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceIn""	"$dropIn"	"-j DROP"
#    iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceOut""	"$dropOut"	"-j DROP"
#    
#    iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceIn""	"$ruleIn"	"-j ACCEPT"
#    iptoolsRulesExecute "ip6toolsRuleAdd" "filter" ""$ruleIfaceOut""	"$ruleOut"	"-j ACCEPT"
#    
#    local ruleNetworkIn="gIn"$eth"-"$fwdEth"N"
#    local ruleNetworkOut="gOut"$eth"-"$fwdEth"N"
#    ip6toolsRuleCreate "filter" "$ruleNetworkIn"
#    ip6toolsRuleCreate "filter" "$ruleNetworkOut"
#    # network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
#    iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""$ruleIfaceIn""		"-s" "$network"	"-j $ruleNetworkIn"
#    iptoolsRulesExecuteFlt "ip6toolsRuleAdd" "filter" ""$ruleIfaceOut""		"-d" "$network"	"-j $ruleNetworkOut"
#    
#    local ruleGwIn="gIn"$eth"-"$fwdEth"R"
#    local ruleGwOut="gOut"$eth"-"$fwdEth"R"
#    ip6toolsRuleCreate "filter" "$ruleGwIn"
#    ip6toolsRuleCreate "filter" "$ruleGwOut"
#    
#    ip6toolsRuleAdd "filter" "$ruleNetworkIn	-d "$fwdNet" -j "$ruleGwIn""
#    ip6toolsRuleAdd "filter" "$ruleNetworkOut	-s "$fwdNet" -j "$ruleGwOut""
#    
#    if [ "$mode" = "igw6" ];then
#     # Initialization de la table NAT
#     echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
#     
#     local initGwNetIptables="$initGwNetIptables ip6tables -t nat -P PREROUTING ACCEPT"
#     local initGwNetIptables="$initGwNetIptables;ip6tables -t nat -P POSTROUTING ACCEPT"
#     local initGwNetIptables="$initGwNetIptables;ip6tables -t nat -P OUTPUT ACCEPT"
#     if ! iptoolsExecute "$initGwNetIptables" ; then
#      shDebug "[ ERROR ]"$log" init gw iptables for nat"
#     else
#      shDebug "[ INFO ]"$log" init gw iptables for nat"
#     fi
#     ip6toolsRuleAdd "nat"	"POSTROUTING	-o "$eth"	-s "$fwdNet" !	-d "$fwdNet"	-j SNAT --to-source "$ip""
#     ##ip6toolsRuleAdd "nat"	"POSTROUTING	-o "$eth"	-s "$fwdNet" !	-d "$fwdNet"	-j MASQUERADE"
#     ##
#     ## Initialisation de la table MANGLE
#     ##
#     
#     ##iptables -t mangle -F
#     ##iptables -t mangle -X
#     ## iptables -t mangle -P PREROUTING ACCEPT
#     ## iptables -t mangle -P INPUT ACCEPT
#     ## iptables -t mangle -P OUTPUT ACCEPT
#     ## iptables -t mangle -P FORWARD ACCEPT
#     ## iptables -t mangle -P POSTROUTING ACCEPT
#     local upnpRuleName="MINIUPNPD"
#     local upnpPeerRuleName="MINIUPNPD-PCP-PEER"
#     local upnpPostRoutingRuleName="MINIUPNPD-POSTROUTING"
#
#     ip6toolsRuleAdd "nat" "PREROUTING -i "$eth" -d "$ip" -j "$upnpRuleName""
#     ip6toolsRuleAdd "mangle" "PREROUTING -i "$eth" -d "$ip" -j "$upnpRuleName""
#     ip6toolsRuleAdd "nat" "POSTROUTING -o "$eth" -s "$fwdNet" -d "$ip" -j "$upnpPeerRuleName""
#     ip6toolsRuleAdd "nat" "POSTROUTING -o "$eth" -s "$fwdNet" -d "$ip" -j "$upnpPostRoutingRuleName""
#    fi
#    
#    if [ -n "$clients" ];then
#     for client in $(echo $clients | tr -s '|' ' ');do
#      local proto="$(echo $client | cut -d';' -f1)"
#      local port="$(echo $client | cut -d';' -f2)"
#      ip6toolsRuleAdd "filter" "$ruleGwIn  -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT"
#      if [ "$proto" = "TCP" ];then
#       ip6toolsRuleAdd "filter" "$ruleGwIn  -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
#      fi
#      ip6toolsRuleAdd "filter" "$ruleGwOut -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
#      if [ "$proto" = "TCP" ];then
#       ip6toolsRuleAdd "filter" "$ruleGwOut -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
#      fi
#     done
#    fi
#    if [ -n "$servers" ];then
#     for server in $(echo $servers | tr -s '|' ' ');do
#      local proto="$(echo $server | cut -d';' -f1)"
#      local port="$(echo $server | cut -d';' -f2)"
#      if [ "$mode" = "igw" ];then
#       ip6toolsRuleAdd "filter" "$ruleGwIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW -j "$upnpRuleName""
#       if [ "$proto" = "TCP" ];then
#        ip6toolsRuleAdd "filter" "$ruleGwIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j "$upnpRuleName""
#       fi
#      else
#       ip6toolsRuleAdd "filter" "$ruleGwIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
#       if [ "$proto" = "TCP" ];then
#        ip6toolsRuleAdd "filter" "$ruleGwIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
#       fi
#      fi
#      
#      ip6toolsRuleAdd "filter" "$ruleGwOut -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT"
#      if [ "$proto" = "TCP" ];then
#       ip6toolsRuleAdd "filter" "$ruleGwOut -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
#      fi
#     done
#    fi
#   fi
#  done
# done
#}
firewall6GwInterface() {
 local log="firewallGwInterface:"
# local iface=""$(iptoolsGetHostEth ""$1"")""
 local iface=""$1""

 shDebug "[ INFO ]"$log" iface:"$iface" "
 local ips="$(iptoolsGetIps "$iface" "")"
 shDebug "[ INFO ]"$log" ips(iface :$iface):$ips"
 iptoolsRuleAdd "filter" "FORWARD	-i "$iface" 	-o "$iface"	-s 0.0.0.0/32 -d 255.255.255.255/32 -p UDP --sport bootpc --dport bootps -j ACCEPT"
 iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d 255.255.255.255/32 -p UDP --sport bootps --dport bootpc -j ACCEPT"
 for ip in $ips;do
  local net=""$(iptoolsGetNet ""$iface"" )""
  local gw=""$(iptoolsGetGw ""$iface"" ""$ip"" )""
  iptoolsRuleAdd "filter" "INPUT	-i "$iface"			-s "$gw"/32 -d 224.0.0.1/8 -p igmp -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface" 	-o "$iface"	-s "$net" -d 224.0.0.1/239.255.255.255 -p igmp -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface" 	-o "$iface"	-s "$net" -d 224.0.0.1/239.255.255.255 -p udp --sport 5353 --dport 5353 -j ACCEPT"
  iptoolsRuleAdd "filter" "OUTPUT 			-o "$iface"	-s "$gw"/32 -d 224.0.0.1/32 -p igmp -j ACCEPT"
  
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-s "$gw"/32 -d 239.255.255.250/32 -p UDP --dport 1900 -j ACCEPT"
#[ 2278.367648] NETFILTER_FORWARD
# IN=br1 OUT=br1 PHYSIN=inbox1 PHYSOUT=inbox0.3 MAC=01:00:5e:7f:ff:fa:00:1b:11:64:04:75:08:00:45:00:01:83 SRC=10.85.88.1 DST=239.255.255.250 LEN=387 TOS=0x00
# PREC=0x00 TTL=2 ID=33710 DF PROTO=UDP SPT=50784 DPT=1900 LEN=367239.255.255.250
  
  # icmp (echo-reply:0/0, echo-request:8/0)
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT"
  # icmp (host-unreachable:3/1, port-unreachable:3/3, fragmentation-needed:3/4)
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  # icmp redirect gateway
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 5/1 -j ACCEPT"
 done
}