#!/bin/sh
# =====================================================================
#  Projet  : DARKWALL
#  Fichier : lib/mangle
#  Auteur  : Nicolas "DarkHack" Chapuis (c) 2026
# ================== DARKHACK ==================
#        [ darkweb.fr  -  system online ]
#   Powered by Perplexity, your AI assistant
#       https://www.perplexity.ai
# ==============================================
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
# =====================================================================
if ! type "shInclude" > /dev/null 2>&1; then racineSh="${racineSh:-/etc/darksh}"; . "$racineSh/lib/shTools"; shDebugEnable="1";fi
rootDarkWall="${rootDarkWall:-/etc/darkwall}"
[ ! -d "$rootDarkWall" ] && shDebug 0 "exit cause rootDarWall is not dir:$rootDarkWall" && exit 0

requiresCmd="printf timeout sleep kill cat echo sh rm mkdir grep md5sum"
shWhichCmd $requiresCmd >/dev/null
shWarnOnMissing $( shWhichCmd $requiresCmd | $cmdTr '_' ' ')

#firewallStartMangleIface
mangleStartIface() {
 local log="$0:"
 local eth=""$($cmdEcho "$1" | $cmdCut -d: -f1)""
 mangleAddIface ""$eth""
 # Mark packets [ save the mark in end of all interface ]
 # iptables -t mangle -A INPUT -j CONNMARK --save-mark
 for enterSoluce in "FORWARD" "INPUT";do
  #shDebug 2 ""$log" iptoolsRuleDelete mangle $enterSoluce save-mark"
  iptoolsRuleDelete "mangle" "$enterSoluce"     "save-mark"
  shDebug 2 ""$log" iptoolsRuleAdd mangle $enterSoluce -j CONNMARK     --save-mark"
  iptoolsRuleAdd "mangle" "$enterSoluce	-j CONNMARK	--save-mark"
 done
}
mangleAddIface() {
 local log="$0:"
# local eth=""$1""
 local eth=""$(iptoolsGetHostEth ""$1"")""

 local rtTableData=""
 local rtTableCpt=10
 for rtLine in $(cat "$fileRtTable" | tr "[[:blank:]]" "_" | grep 0X );do
  anEth="$(echo $rtLine | cut -d'_' -f 4 | cut -d'|' -f 1 )"
  if [ -z "$anEth" ];then continue
  elif [ "|$eth|" = "|$anEth|" ];then
   if [ -n "$rtTableData" ];then shDebug "[ ERROR ]"$log" $rtTableData found twice:$rtLine";fi
   local rtTableData="$(echo $rtLine | cut -d'#' -f 2 | tr -d '[[:space:]]' | tr -d '_' )"
   local rtTableMark="$(echo $rtTableData | cut -d'|' -f 2)"
   local rtTableName="$(echo $rtTableData | cut -d'|' -f 3)"
   local rtTablePrio="$(echo $rtTableData | cut -d'|' -f 4)"
  else
   local rtTableCpt=$((rtTableCpt + 1))
  fi
 done
 
 if [ -z "$rtTableData" ];then
  shDebug "[ INFO ]"$log" echec no $eth in RT_TABLE"
 else
# shDebug "[ INFO ]"$log" mark:$rtTableMark name:$rtTableName prio:rtTablePrio"
  if [ -z "$(ip -4 rule show | grep lookup | grep $rtTableName)" ];then
   if ! iptoolsExecute "ip rule add pri $rtTablePrio fwmark $rtTableMark lookup $rtTableName" ; then
    shDebug 0 ""$log" $eth ip rule add pri"
   else
    shDebug 2 ""$log" $eth ip rule add pri"
   fi
#  shDebug "[ INFO ]"$log" ip rule add pri $rtTablePrio fwmark $rtTableMark iif $intEth oif $outEth lookup $rtTableName"
#  local initMangleIface="$initMangleIface ip rule add pri $rtTablePrio fwmark $rtTableMark iif $intEth oif $outEth lookup $rtTableName
  fi
  shDebug "[ INFO ]"$log" add mark for -i $eth "
  if [ -z "$(iptables -t mangle -nL INPUT | grep $rtTableMark | grep ' $eth ' )" ];then
   iptoolsRuleAdd "mangle" "INPUT	-j MARK	--set-mark "$rtTableMark" -i "$eth""
  fi
  if [ -z "$(iptables -t mangle -nL FORWARD | grep $rtTableMark | grep ' $eth ' )" ];then
   iptoolsRuleAdd "mangle" "FORWARD	-j MARK	--set-mark "$rtTableMark" -i "$eth""
  fi
  #[ -z "$(ip -4 route show table $rtTableName)" ];then
  if [ "$eth" != "lo" ];then
   if ! iptoolsExecute "ip -4 route add default dev "$eth" table "$rtTableName"" ; then
    shDebug 0 ""$log" mangle $eth init by all route for t:$rtTableName"
   else
    shDebug 2 ""$log" mangle $eth init by all route for t:$rtTableName"
   fi
  fi
 fi
 
}
# mangleAddIpInterface "$eth" "$ip" "$net" "$gw"
mangleAddIpInterface() {
 local log="mangleAddIpInterface"
# local eth=""$1""
 local eth=""$(iptoolsGetHostEth ""$1"")""
 local ip="$2"
 local net="$3"
 local gw="$4"
 
 local rtTableData=""
 local rtTableCpt=10
 for rtLine in $(cat "$fileRtTable" | tr "[[:blank:]]" "_" | grep 0X );do
  anEth="$(echo $rtLine | cut -d'_' -f 4 | cut -d'|' -f 1 )"
  if [ -z "$anEth" ];then continue
  elif [ "|$eth|" = "|$anEth|" ];then
   if [ -n "$rtTableData" ];then shDebug "[ ERROR ]"$log" $rtTableData found twice:$rtLine";fi
   local rtTableData="$(echo $rtLine | cut -d'#' -f 2 | tr -d '[[:space:]]' | tr -d '_' )"
   local rtTableMark="$(echo $rtTableData | cut -d'|' -f 2)"
   local rtTableName="$(echo $rtTableData | cut -d'|' -f 3)"
   local rtTablePrio="$(echo $rtTableData | cut -d'|' -f 4)"
  else
   local rtTableCpt=$((rtTableCpt + 1))
  fi
 done
 
 if [ -z "$rtTableData" ] || [ -z "$ip" ] || [ -z "$net" ];then
  shErrorOnMissing "rtTableData" "ip" "net"
  shDebug 2 ""$log" echec rtTableData:$rtTableData ip:$ip net:$net"
 else
  if ! iptoolsExecute "ip rule add pri $rtTablePrio fwmark $rtTableMark lookup $rtTableName" ; then
   shDebug 0 ""$log" $eth ip rule add pri"
  else
   shDebug 2 ""$log" $eth ip rule add pri"
  fi
# shDebug 2 ""$log" mark:$rtTableMark name:$rtTableName prio:rtTablePrio"
# if ! iptoolsExecute "ip -4 route add 0.0.0.0/0 src $ip dev $eth table $rtTableName" ; then
#  shDebug 0 ""$log" mangle $eth init default route "
# else
#  shDebug 2 ""$log" mangle $eth init default route"
# fi
  local iface=""$(iptoolsGetHostEth ""${eth}"")""
  shDebug 2 ""$log" add table for mark ${eth}/${iface} table ${rtTableName} => add $ip/$net"
  if ! iptoolsExecute "ip -4 route del default dev ${iface} table ${rtTableName};ip -4 route add ${net} dev ${iface} src ${ip} table ${rtTableName};ip -4 route add default dev ${iface} table ${rtTableName}" ; then
   shDebug 0 ""$log" mangle $eth init ${net} route "
  else
   shDebug 2 ""$log" mangle $eth init ${net} route"
  fi
  if [ "$eth" = "lo" ];then
   shDebug "[ INFO ]"$log" no gw mangle local iface $eth"
  else
   if [ -n "${gw}" ];then addGateway "${ip}" "${gw}" "${net}" "${iface}";fi
  fi
 fi
 # Mark packets [ save the mark in end of all interface ]
 # iptables -t mangle -A INPUT -j CONNMARK --save-mark
 for enterSoluce in "FORWARD" "INPUT";do
  #shDebug "[ INFO ]"$log" iptoolsRuleDelete mangle $enterSoluce save-mark"
  iptoolsRuleDelete "mangle" "$enterSoluce"     "save-mark"
  shDebug "[ INFO ]"$log" iptoolsRuleAdd mangle $enterSoluce -j CONNMARK     --save-mark"
  iptoolsRuleAdd "mangle" "$enterSoluce	-j CONNMARK	--save-mark"
 done
}
addGateway() {
 local log="addGateway"
 local ip="$1"
 local gwIp="$2"
 local gwNet="$3"
 local gwEth="$4"
 
 rtTableAddGw "${gwIp}" "${gwNet}" "${gwEth}"
 
 local rtTableData=""
 local rtTableCpt=10
 for rtLine in $(cat "$fileRtTable" | tr "[[:blank:]]" "_" | grep 0X );do
  local anGwIpMacEth="$(echo $rtLine | cut -d'_' -f 4 | cut -d'|' -f 1 )"
  if [ -z "$anGwIpMacEth" ];then continue;fi
  local anGwIp="$(echo $anGwIpMacEth | cut -d';' -f 1)"
  local anGwEth="$(echo $anGwIpMacEth | cut -d';' -f 3)"
  if [ "|$gwIp|" = "|$anGwIp|" ] && [ "|$gwEth|" = "|$anGwEth|" ];then
   local gwMac="$(echo $anGwIpMacEth | cut -d';' -f 2)"
   if [ -n "$rtTableData" ];then shDebug "[ ERROR ]"$log" $rtTableData found twice:$rtLine";fi
   local rtTableData="$(echo $rtLine | cut -d'#' -f 2 | tr -d '[[:space:]]' | tr -d '_' )"
   local rtTableMark="$(echo $rtTableData | cut -d'|' -f 2)"
   local rtTableName="$(echo $rtTableData | cut -d'|' -f 3)"
   local rtTablePrio="$(echo $rtTableData | cut -d'|' -f 4)"
  else
   local rtTableCpt=$((rtTableCpt + 1))
  fi
 done
 
 if [ -z "$gwMac" ];then
  shDebug "[ ERROR ]"$log" no MAC for $gwIp/$gwNet/$gwEth"
 else
  local initMangleGw=""
# shDebug "[ INFO ]"$log" mark:$rtTableMark name:$rtTableName prio:rtTablePrio"
  local initMangleGw="$initMangleGw ip -4 route add default via $gwIp dev $gwEth src $ip table $rtTableName"
  local initMangleGw="$initMangleGw;ip -4 route add $gwIp dev $gwEth src $ip table $rtTableName"
  local initMangleGw="$initMangleGw;ip -4 route add $gwNet dev $gwEth src $ip table $rtTableName"
  local initMangleGw="$initMangleGw;ip -4 route add default dev $gwEth table $rtTableName"
  if ! iptoolsExecute "$initMangleGw" ; then
   shDebug "[ ERROR ]"$log" route $rtTableName gw:$gwIp($gwEth)"
  else
   shDebug "[ INFO ]"$log" route $rtTableName gw:$gwIp($gwEth)"
  fi
  if ! iptoolsExecute "ip -4 route add $gwIp dev $gwEth src $ip" ; then
   shDebug "[ ERROR ]"$log" std route of $gwIp"
  else
   shDebug "[ INFO ]"$log" std route of $gwIp"
  fi
  # Mark packets [ save the mark in end of all interface ]
  shDebug "[ INFO ]"$log" found mac:$gwMac/$gwIp/$gwNet/$gwEth"
  for enterSoluce in "FORWARD" "INPUT";do
   if [ -z "$($cmdIptables -w -t mangle -nL $enterSoluce | grep $gwMac)" ];then
    shDebug "[ INFO ]"$log" add to '$enterSoluce' mark for mac of '$gwIp' => '$gwMac'"
    # iptables -t mangle -A INPUT -m mac --mac-source $gwMac -j MARK --set-mark $rtTableMark
    iptoolsRuleAdd "mangle" "$enterSoluce	-j MARK	--set-mark "$rtTableMark" -m mac --mac-source "$gwMac" ! -s "$gwIp""
   fi
  done
 fi
}
firewallBridge() {
 local log="firewallBridge:"
 local eth=""$1""
 local file=""$2""
 
 shDebug "[ INFO ]"$log" eth:"$eth" mode:"$mode" file:"$file""
 
 local ruleIfaceIn="In"$eth""
 local ruleIfaceOut="Out"$eth""
 local dropIn=""
 local dropFw=""
 local dropOut=""
 local ruleIn=""
 local ruleFwd=""
 local ruleOut=""
 $(shIncludeET $file)
 if [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ];then
   shDebug 0 ""$log" echec params empty: dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut""
 else
  shDebug "[ INFO ]"$log" "$eth" "$file""
  local fwdEth=""$eth""
  firewallGwCreateInterface ""$eth"" ""$fwdEth""
  local ruleIfaceGIn="Gw"$eth"-"$fwdEth"I"
  local ruleIfaceGOut="Gw"$eth"-"$fwdEth"O"
  
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$dropIn"	"-j DROP"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceGIn""	"$dropFwd"	"-j DROP"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceGOut""	"$dropFwd"	"-j DROP"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$dropOut"	"-j DROP"
  
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$ruleIn"	"-j ACCEPT"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceGIn""	"$ruleIn"	"-j ACCEPT"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceGOut""	"$ruleOut"	"-j ACCEPT"
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$ruleOut"	"-j ACCEPT"
 fi
}
firewallMangleExecute() {
 local log="firewallMangleExecute"
 local eth=""$(iptoolsGetHostEth ""$1"")""
 local ethFwd=""$2""
 
 local ruleIfaceIn="In"$eth""
 local ruleIfaceOut="Out"$eth""
 
 local rtTableData=""
 local rtTableCpt=10
 for rtLine in $(cat "$fileRtTable" | tr "[[:blank:]]" "_" | grep 0X );do
  anEth="$(echo $rtLine | cut -d'_' -f 4 | cut -d'|' -f 1 )"
  if [ -z "$anEth" ];then continue
  elif [ "|$eth|" = "|$anEth|" ];then
   if [ -n "$rtTableData" ];then shDebug 0 ""$log" $rtTableData found twice:$rtLine";fi
   local rtTableData="$(echo $rtLine | cut -d'#' -f 2 | tr -d '[[:space:]]' | tr -d '_' )"
   local rtTableMark="$(echo $rtTableData | cut -d'|' -f 2)"
   local rtTableName="$(echo $rtTableData | cut -d'|' -f 3)"
   local rtTablePrio="$(echo $rtTableData | cut -d'|' -f 4)"
  else
   local rtTableCpt=$((rtTableCpt + 1))
  fi
 done
 
 if [ -z "$rtTableMark" ];then
  shDebug "[ ERROR ]"$log" ${ethFw} no table MARK for '$eth'"
 else
  shDebug "[ INFO ]"$log" ${ethFw} => $eth"
  for ip in $(iptoolsGetIps "$eth" );do
   local net=""$(ip route show dev $eth | grep "src $ip " | cut -f1 -d' ')""
   if [ -z "$ip" ] || [ -z "$net" ];then continue;fi
   shDebug "[ INFO ]"$log" $ip => $net / $ethFw:$rtTableMark 1"
   if [ -z "$(iptables -t mangle -nL INPUT | grep $rtTableMark | grep $ethFwd )" ];then
    iptoolsRuleAdd "mangle" "INPUT	-j MARK	--set-mark "$rtTableMark" -m physdev --physdev-in ${ethFwd} -s "$net""
    iptoolsRuleAdd "mangle" "INPUT	-j MARK	--set-mark "$rtTableMark"  -m physdev --physdev-in ${ethFwd} -d "$net""
   fi
   shDebug "[ INFO ]"$log" $ip => $net / $ethFw:$rtTableMark 2"
   if [ -z "$(iptables -t mangle -nL FORWARD | grep $rtTableMark | grep $ethFwd )" ];then
    iptoolsRuleAdd "mangle" "FORWARD	-j MARK	--set-mark "$rtTableMark" -m physdev --physdev-in ${ethFwd} -s "$net""
    iptoolsRuleAdd "mangle" "FORWARD	-j MARK	--set-mark "$rtTableMark" -m physdev --physdev-in ${ethFwd} -d "$net""
   fi
  done
  for enterSoluce in "FORWARD" "INPUT";do
   iptoolsRuleDelete "mangle" "$enterSoluce"	"--save-mark"
   iptoolsRuleAdd "mangle" "$enterSoluce	-j CONNMARK	--save-mark"
  done
  local bridgeEthFwd=""$(iptoolsGetHostEth $ethFwd )""
  local ruleFwdIN="Gw${bridgeEthFwd}-${bridgeEthFwd}O"
  local ruleFwdOUT="Gw${bridgeEthFwd}-${bridgeEthFwd}I"
# [ 2099.268193] NETFILTER_FORWARD
# IN=xenbr0 OUT=xenbr0 PHYSIN=eth1 PHYSOUT=veth2 MAC=01:00:5e:00:00:01:58:90:43:9c:93:1c:08:00 SRC=192.168.1.254 DST=224.0.0.1
# LEN=32 TOS=0x00 PREC=0xA0 TTL=1 ID=19502 DF OPT (94040000) PROTO=2 MARK=0xd
   iptoolsRuleAdd "filter" "INPUT	-j ${ruleIfaceIn} -m physdev --physdev-in ${ethFwd} "
   iptoolsRuleAdd "filter" "INPUT	-j ${ruleFwdIN} -m physdev --physdev-in ${ethFwd} "
   iptoolsRuleAdd "filter" "INPUT	-j ${ruleFwdOUT} -m physdev --physdev-in ${ethFwd} "

   iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdIN} -m physdev --physdev-in ${ethFwd} "
   iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdOUT} -m physdev --physdev-in ${ethFwd} "
   iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdIN} -m physdev --physdev-out ${ethFwd} "
   iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdOUT} -m physdev --physdev-out ${ethFwd} "
   iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdIN} -o "$(iptoolsGetHostEth $ethFwd )" "
   iptoolsRuleAdd "filter" "FORWARD	-j ${ruleFwdOUT} -o "$(iptoolsGetHostEth $ethFwd )" "

   iptoolsRuleAdd "filter" "OUTPUT	-j ${ruleIfaceOut} -o "$(iptoolsGetHostEth $ethFwd )" "
   iptoolsRuleAdd "filter" "OUTPUT	-j ${ruleFwdIN} -m physdev --physdev-out ${ethFwd} "
   iptoolsRuleAdd "filter" "OUTPUT	-j ${ruleFwdOUT} -m physdev --physdev-out ${ethFwd} "
 fi
}
firewallStartGw() {
 local log="firewallStartGw:"
 local ifacesConf="$1"
 
 shDebug "[ INFO ]"$log"ifaceConf "$ifacesConf""
# for eth in $(ipToolsGetEths);do
#  shDebug "[ INFO ]"$log" mangle add $eth"
# done
 
 $(shIncludeET $ifacesConf)
 if [ -z "ifaceConf" ];then
  shDebug "[ ERROR ]"$log" echec empty ifaceConf : "$ifacesConf""
 else
  local initGwNetIptables="$initGwNetIptables iptables -t nat -P PREROUTING ACCEPT"
  local initGwNetIptables="$initGwNetIptables;iptables -t nat -P POSTROUTING ACCEPT"
  local initGwNetIptables="$initGwNetIptables;iptables -t nat -P OUTPUT ACCEPT"
  if ! iptoolsExecute "$initGwNetIptables" ; then
   shDebug "[ ERROR ]"$log" init gw iptables for nat"
  else
   shDebug "[ INFO ]"$log" init gw iptables for nat"
  fi

  for ifaceConf in $(echo $ifaces | tr -d ' ' | tr -d '\t' | tr -s '|' ' ');do
   local iface=""
   local mode=""
   local file=""
   
   for value in $(echo $ifaceConf | tr ';' ' ');do
    if [ -z "$iface" ];then
     local eth=""$value""
     local iface=""$(iptoolsGetHostEth ""$eth"")""
     if [ "$value" = "$iface" ];then
      shDebug "[ INFO ]"$log" value:$value iface:$iface"
#     brctlCmd="${brctlCmd:-$(which brctl)}"
#     brctlCmd="${brctlCmd:-/sbin/brctl}"
#     if [ -x "$brctlCmd" ];then
#      for phyABr in $($brctlCmd show $iface | tail -n+2 | rev | cut -f1 | rev);do
#       for phyBBr in $($brctlCmd show $iface | tail -n+2 | rev | cut -f1 | rev);do
#        if [ "$phyABr" = "$phyBBr" ];then continue
#        else
#         #shDebug "[ INFO ]"$log" iptoolsRuleAdd "filter" "FORWARD -i "$iface" -o "$iface" -s 0.0.0.0/32 -d 255.255.255.255/32 -p UDP --sport bootpc --dport bootps -j ACCEPT""
#         #iptoolsRuleAdd "filter" "FORWARD -i "$phyABr" -o "$phyBBr" -s 0.0.0.0/32 -d 255.255.255.255/32 -p UDP --sport bootpc --dport bootps -j ACCEPT"
#        fi
#       done
#      done
#     fi
     fi
    else if [ -z "$mode" ];then
     local mode="$(echo $value | cut -d'/' -f 1)"
     local modeValue="$(echo $value | cut -d'/' -f 2- )"
    else if [ -z "$file" ];then
     local file="$value"
    else
       shDebug "[ ERROR ]"$log" echec reading : "$ifacesConf" unknow:$value in :$ifaceConf"
    fi fi fi
   done
   if [ -n "$mode" ] && [ -n "$file" ];then
    if [ "$mode" = "gw" ] || [ "$mode" = "igw" ];then
     shDebug "[ INFO ]"$log"$iface $mode $modeValue $file"
     firewallGateway $iface $mode $modeValue $file
    elif [ "$mode" = "mangle" ];then
     shDebug "[ INFO ]"$log" firewallMangleExecute [$eth,$modeValue]"
     firewallMangleExecute $eth $modeValue
    fi
   fi
  done
 fi

}
firewallStop() {
 local log="firewallStop:"
 local eth=""$(iptoolsGetHostEth ""$1"")""
 if [ -n "$eth" ];then
  for sens in "INPUT" "OUTPUT" "FORWARD";do
   for rule in $($cmdIptables -w -nL $sens | grep "\-[io]\#"$eth"" | cut -f1 -d' ');do
    firewallDeleteRule $rule $sens
   done
   for rule in $($cmdIp6tables -w -nL $sens | grep "\-[io]\#"$eth"" | cut -f1 -d' ');do
    firewall6DeleteRule $rule $sens
   done
  done
 fi
}

firewallDeleteRule() {
 local log="firewallDeleteRule:"
 local rule="$1"
 local from="$2"
 if [ "$rule" = "ACCEPT" ] || [ "$rule" = "DROP" ] || [ "$rule" = "Chain" ] || [ "$rule" = "target" ] || [ -z "$rule" ] || [ -z "$from" ];then
  return
 fi
 
 local subRules="$($cmdIptables -w -nL $rule 2>&1 | tr -s '\n' '¤')"
 if [ -n "$(echo $subRules | grep "is incompatible" 2>&1)" ];then
  return
 fi
 if [ -z "$(echo $subRules | grep "iptables: No chain/target/match by that name.")" ] ;then
  for subRule in $(echo "$subRules" | tr -s '¤' '\n'| cut -f1 -d' ');do
   if [ -n "$subRule" ];then firewallDeleteRule $subRule $rule;fi
  done
  iptoolsRuleDelete "filter" ""$from""     ""$rule""
 fi
}
firewall6DeleteRule() {
 local log="firewall6DeleteRule:"
 local rule="$1"
 local from="$2"
 if [ "$rule" = "ACCEPT" ] || [ "$rule" = "DROP" ] || [ "$rule" = "Chain" ] || [ "$rule" = "target" ] || [ -z "$rule" ] || [ -z "$from" ];then
  return
 fi
 
 local subRules="$($cmdIp6tables -w -nL $rule 2>&1 | tr -s '\n' '¤')"
 if [ -n "$(echo $subRules | grep "is incompatible" 2>&1)" ];then
  return
 fi
 if [ -z "$(echo $subRules | grep "ip6tables: No chain/target/match by that name.")" ];then
  for subRule in $(echo "$subRules" | tr -s '¤' '\n'| cut -f1 -d' ');do
   if [ -n "$subRule" ];then firewall6DeleteRule $subRule $rule;fi
  done
  ip6toolsRuleDelete "filter" ""$from""     ""$rule""
 fi
}
firewallGatewayServerFwConf() {
 local log="firewallGatewayFwServerConf:"
 local upnpRuleName=""$1""
 local servers=""$2""
 local serversMd5=""$(echo ""$servers"" | $cmdMd5sum | cut -f1 -d' ')""
 if [ -z "$serversMd5" ];then return 1;fi
 local serversRule=""$(iptoolsGetMd5Rule "filter" ""$serversMd5"")""
 local serversRuleIn=""$serversRule"SrvFwIn"
 local serversRuleOut=""$serversRule"SrvFwOut"
 
 if ! iptoolsRuleExiste "filter" $serversRuleIn;then
  if iptoolsRuleExiste "filter" $serversRuleOut;then shDebugHidden "[ ERROR ]"$log" 'in' not exist but 'out' exist ??????" ;fi
  iptoolsRuleCreate "filter" "$serversRuleIn"
  iptoolsRuleCreate "filter" "$serversRuleOut"
  for server in $(echo $servers | tr -s '|' ' ');do
   local proto="$(echo $server | cut -d';' -f1)"
   local port="$(echo $server | cut -d';' -f2)"
   if [ -z "$(echo $port | grep :)" ];then
    iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW -j "$upnpRuleName""
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j "$upnpRuleName""
    fi
   else
    iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW -j "$upnpRuleName""
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j "$upnpRuleName""
    fi
   fi
   if [ -z "$(echo $port | grep :)" ];then
    iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   else
    iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   fi
  done
 fi
 echo ""$serversRuleIn"|"$serversRuleOut""
}
firewallGatewayServerConf() {
 local log="firewallGatewayServerConf:"
 local servers=""$1""
 local serversMd5=""$(echo ""$servers"" | $cmdMd5sum | cut -f1 -d' ')""
 if [ -z "$serversMd5" ];then return 1;fi
 local serversRule=""$(iptoolsGetMd5Rule "filter" ""$serversMd5"")""
 local serversRuleIn=""$serversRule"SrvIn"
 local serversRuleOut=""$serversRule"SrvOut"
 if ! iptoolsRuleExiste "filter" $serversRuleIn;then
  if iptoolsRuleExiste "filter" $serversRuleOut;then shDebugHidden "[ ERROR ]"$log" 'in' not exist but 'out' exist ??????" ;fi
  iptoolsRuleCreate "filter" "$serversRuleIn"
  iptoolsRuleCreate "filter" "$serversRuleOut"
  for server in $(echo $servers | tr -s '|' ' ');do
   local proto="$(echo $server | cut -d';' -f1)"
   local port="$(echo $server | cut -d';' -f2)"
   if [ -z "$(echo $port | grep :)" ];then
    iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   else
    iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleIn  -p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   fi
   if [ -z "$(echo $port | grep :)" ];then
    iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   else
    iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT"
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$serversRuleOut -p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT"
    fi
   fi
  done
 fi
 echo ""$serversRuleIn"|"$serversRuleOut""
}
firewallGatewayClientConf() {
 local log="firewallGatewayClientConf:"
 local clients=""$1""
 local clientsMd5=""$(echo ""$clients"" | $cmdMd5sum | cut -f1 -d' ')""
 local clientsRule=""$(iptoolsGetMd5Rule "filter" ""$clientsMd5"")""
 local clientsRuleIn=""$clientsRule"CltIn"
 local clientsRuleOut=""$clientsRule"CltOut"
 if ! iptoolsRuleExiste "filter" $clientsRuleIn;then
  if iptoolsRuleExiste "filter" $clientsRuleOut;then shDebugHidden "[ ERROR ]"$log" 'in' not exist but 'out' exist ??????" ;fi
  iptoolsRuleCreate "filter" "$clientsRuleIn"
  iptoolsRuleCreate "filter" "$clientsRuleOut"
  for client in $(echo $clients | tr -s '|' ' ');do
   local proto="$(echo $client | cut -d';' -f1)"
   local port="$(echo $client | cut -d';' -f2)"
   if [ -z "$(echo $port | grep :)" ];then
    iptoolsRuleAdd "filter" "$clientsRuleIn	-p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT" >&2
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$clientsRuleIn	-p "$proto" --sport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT" >&2
    fi
    iptoolsRuleAdd "filter" "$clientsRuleOut	-p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT" >&2
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$clientsRuleOut	-p "$proto" --dport "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT" >&2
    fi
   else
    iptoolsRuleAdd "filter" "$clientsRuleIn	-p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED -j ACCEPT" >&2
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$clientsRuleIn	-p "$proto" --match multiport --sports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT" >&2
    fi
    iptoolsRuleAdd "filter" "$clientsRuleOut	-p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT" >&2
    if [ "$proto" = "TCP" ];then
     iptoolsRuleAdd "filter" "$clientsRuleOut	-p "$proto" --match multiport --dports "$port" -m state --state ESTABLISHED,RELATED,NEW ! --syn -j ACCEPT" >&2
    fi
   fi
  done
 fi
 echo ""$clientsRuleIn"|"$clientsRuleOut""
}
firewallGwCreateInterface() {
 local log="firewallGwCreateInterface:"
 local eth=""$1""
 local fwdEth=""$2""
 
 firewallCreateInterface ""$eth""
 local ruleIfaceIn="In"$eth""
 local ruleIfaceOut="Out"$eth""
 
 firewallCreateInterface ""$fwdEth""
 local ruleFwdIfaceIn="In"$fwdEth""
 local ruleFwdIfaceOut="Out"$fwdEth""

 #local ruleIfaceIn=""$(firewallCreateRule	"Gw"$eth"In")""
 #local ruleIfaceOut=""$(firewallCreateRule	"Gw"$eth"Out")""
 local ruleIfaceGwIn="Gw"$eth"-"$fwdEth"I"
 local ruleIfaceGwOut="Gw"$eth"-"$fwdEth"O"
 iptoolsRuleCreate "filter" "$ruleIfaceGwIn"
 iptoolsRuleCreate "filter" "$ruleIfaceGwOut"
 iptoolsRuleAdd "filter" ""$ruleIfaceIn"	-j "$ruleIfaceGwIn""
 iptoolsRuleAdd "filter" "FORWARD	-i "$eth"	-o "$fwdEth"	-j "$ruleIfaceGwIn""
 iptoolsRuleAdd "filter" ""$ruleFwdIfaceOut"	-j "$ruleIfaceGwIn""
 
 iptoolsRuleAdd "filter" ""$ruleFwdIfaceIn"	-j "$ruleIfaceGwOut""
 iptoolsRuleAdd "filter" "FORWARD	-i "$fwdEth"	-o "$eth"	-j "$ruleIfaceGwOut""
 iptoolsRuleAdd "filter" ""$ruleIfaceOut"	-j "$ruleIfaceGwOut""
}
firewallGateway() {
 local log="firewallGateway:"
 local eth=""$(iptoolsGetHostEth ""$1"")""
 local mode=""$2""
 local fwdEth=""$(iptoolsGetHostEth ""$3"")""
 local file=""$4""
 
 shDebug "[ INFO ]"$log" eth:"$eth" fwdEth:"$fwdEth" mode:"$mode" file:"$file""
 #firewallStartMangle
 firewallGwCreateInterface ""$eth"" ""$fwdEth""
 local ruleIfaceIn="Gw"$eth"-"$fwdEth"I"
 local ruleIfaceOut="Gw"$eth"-"$fwdEth"O"
 
 local ips="$(iptoolsGetIps "$eth" "")"
 shDebug "[ INFO ]"$log" ips(eth :$eth):$ips"
 for ip in $ips;do
  local net=""$(iptoolsGetNet ""$eth"" ""$ip"")""
  local gw=""$(iptoolsGetGw ""$eth"" ""$ip"")""
  local broadcast=""$(iptoolsGetBroadcast ""$eth"" ""$ip"")""
  
  local fwdIps="$(iptoolsGetIps "$fwdEth" "")"
  shDebug "[ INFO ]"$log" fw ips(eth :$fwdEth):$fwdIps"
  for fwdIp in $fwdIps;do
   local fwdNet=""$(iptoolsGetNet ""$fwdEth"" ""$fwdIp"")""
   local fwdGw=""$(iptoolsGetGw ""$fwdEth"" ""$fwdIp"")""
   local fwdBroadcast=""$(iptoolsGetBroadcast ""$fwdEth"" ""$fwdIp"")""
   
   local clients=""
   local servers=""
   
   local dropIn=""
   local dropOut=""
   local dropFwd=""
   local ruleIn=""
   local ruleOut=""
   local ruleFwd=""
   
   $(shIncludeET $file)
   if [ -z "$clients" ] && [ -z "$servers" ] && [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$dropFwd" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ] && [ -z "$ruleFwd" ];then
    shDebug "[ ERROR ]"$log" echec params(ip:$ip) empty : clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut""
   else
    shDebug "[ INFO ]"$log" "$eth" => ip:"$ip" net:"$net" gw:"$gw""
    
    local clients="$(echo $clients | tr -d ' ' | tr -d '\t')"
    local servers="$(echo $servers | tr -d ' ' | tr -d '\t')"
    
    iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$dropIn"	"-j DROP"
    iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$dropOut"	"-j DROP"
    
    iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$ruleIn"	"-j ACCEPT"
    iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$ruleOut"	"-j ACCEPT"
    
    iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$dropFwd"	"-j DROP"
    iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$dropFwd"	"-j DROP"
    
    iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$ruleFwd"	"-j ACCEPT"
    iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$ruleFwd"	"-j ACCEPT"
    
    local ruleNetworkIn="gIn"$eth"-"$fwdEth"N"
    local ruleNetworkOut="gOut"$eth"-"$fwdEth"N"
    iptoolsRuleCreate "filter" "$ruleNetworkIn"
    iptoolsRuleCreate "filter" "$ruleNetworkOut"
    iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""		"-s" "$network"	"-j $ruleNetworkIn"
    iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""		"-d" "$network"	"-j $ruleNetworkOut"
    
    local ruleGwIn="gIn"$eth"-"$fwdEth"R"
    local ruleGwOut="gOut"$eth"-"$fwdEth"R"
    iptoolsRuleCreate "filter" "$ruleGwIn"
    iptoolsRuleCreate "filter" "$ruleGwOut"
    
    iptoolsRuleAdd "filter" "$ruleNetworkIn	-d "$fwdNet" -j "$ruleGwIn""
    iptoolsRuleAdd "filter" "$ruleNetworkOut	-s "$fwdNet" -j "$ruleGwOut""
    
    if [ "$mode" = "igw" ];then
     # Initialization de la table NAT
     echo 1 > /proc/sys/net/ipv4/ip_forward
     
     iptoolsRuleAdd "nat"	"POSTROUTING	-o "$eth"	-s "$fwdNet" !	-d "$fwdNet"	-j SNAT --to-source "$ip""
     #iptoolsRuleAdd "nat"	"POSTROUTING	-o "$eth"	-s "$fwdNet" !	-d "$fwdNet"	-j MASQUERADE"
     #
     # Initialisation de la table MANGLE
     #
     
     #iptables -t mangle -F
     #iptables -t mangle -X
     # iptables -t mangle -P PREROUTING ACCEPT
     # iptables -t mangle -P INPUT ACCEPT
     # iptables -t mangle -P OUTPUT ACCEPT
     # iptables -t mangle -P FORWARD ACCEPT
     # iptables -t mangle -P POSTROUTING ACCEPT
     local upnpRuleName="MINIUPNPD"
     iptoolsRuleCreate "nat" ""$upnpRuleName""
     iptoolsRuleAdd "nat" "PREROUTING -i "$eth" -d "$ip" -j "$upnpRuleName""
     iptoolsRuleCreate "mangle" ""$upnpRuleName""
     iptoolsRuleAdd "mangle" "PREROUTING -i "$eth" -d "$ip" -j "$upnpRuleName""
     iptoolsRuleCreate "filter" ""$upnpRuleName""
     local upnpPeerRuleName="MINIUPNPD-PCP-PEER"
     iptoolsRuleCreate "nat" ""$upnpPeerRuleName""
     iptoolsRuleAdd "nat" "POSTROUTING -o "$eth" -s "$fwdNet" -d "$ip" -j "$upnpPeerRuleName""
     local upnpPostRoutingRuleName="MINIUPNPD-POSTROUTING"
     iptoolsRuleCreate "nat" ""$upnpPostRoutingRuleName""
     iptoolsRuleAdd "nat" "POSTROUTING -o "$eth" -s "$fwdNet" -d "$ip" -j "$upnpPostRoutingRuleName""
    fi
    
    if [ -n "$clients" ];then
     local clientsRulesName="$(firewallGatewayClientConf "$clients")"
     local clientsRuleNameIn="$(echo $clientsRulesName | cut -f1 -d '|')"
     local clientsRuleNameOut="$(echo $clientsRulesName | cut -f2 -d '|')"
     iptoolsRuleAdd "filter" "$ruleGwIn  -j $clientsRuleNameIn"
     iptoolsRuleAdd "filter" "$ruleGwOut -j $clientsRuleNameOut"
    fi
    if [ -n "$servers" ];then
     if [ "$mode" = "igw" ];then
      local serversRulesName="$(firewallGatewayServerFwConf "$upnpRuleName" "$servers")"
     else
      local serversRulesName="$(firewallGatewayServerConf "$servers")"
     fi
     local serversRuleNameIn="$(echo $serversRulesName | cut -f1 -d '|')"
     local serversRuleNameOut="$(echo $serversRulesName | cut -f2 -d '|')"
     iptoolsRuleAdd "filter" "$ruleGwIn  -j $serversRuleNameIn"
     iptoolsRuleAdd "filter" "$ruleGwOut -j $serversRuleNameOut"
    fi
   fi
  done
 done
}
firewallGwInterface() {
 local log="firewallGwInterface:"
 local iface=""$(iptoolsGetHostEth ""$1"")""

 shDebug "[ INFO ]"$log" iface:"$iface" "
 local ips="$(iptoolsGetIps "$iface" "")"
 shDebug "[ INFO ]"$log" ips(iface :$iface):$ips"
 iptoolsRuleAdd "filter" "FORWARD	-i "$iface" 	-o "$iface"	-s 0.0.0.0/32 -d 255.255.255.255/32 -p UDP --sport bootpc --dport bootps -j ACCEPT"
 iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d 255.255.255.255/32 -p UDP --sport bootps --dport bootpc -j ACCEPT"
 for ip in $ips;do
  local net=""$(iptoolsGetNet ""$iface"" )""
  local gw=""$(iptoolsGetGw ""$iface"" ""$ip"" )""
  iptoolsRuleAdd "filter" "INPUT	-i "$iface"			-s "$gw"/32 -d 224.0.0.1/8 -p igmp -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface" 	-o "$iface"	-s "$net" -d 224.0.0.1/239.255.255.255 -p igmp -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface" 	-o "$iface"	-s "$net" -d 224.0.0.1/239.255.255.255 -p udp --sport 5353 --dport 5353 -j ACCEPT"
  iptoolsRuleAdd "filter" "OUTPUT 			-o "$iface"	-s "$gw"/32 -d 224.0.0.1/32 -p igmp -j ACCEPT"
  
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-s "$gw"/32 -d 239.255.255.250/32 -p UDP --dport 1900 -j ACCEPT"
#[ 2278.367648] NETFILTER_FORWARD
# IN=br1 OUT=br1 PHYSIN=inbox1 PHYSOUT=inbox0.3 MAC=01:00:5e:7f:ff:fa:00:1b:11:64:04:75:08:00:45:00:01:83 SRC=10.85.88.1 DST=239.255.255.250 LEN=387 TOS=0x00
# PREC=0x00 TTL=2 ID=33710 DF PROTO=UDP SPT=50784 DPT=1900 LEN=367239.255.255.250
  
  # icmp (echo-reply:0/0, echo-request:8/0)
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 8/0 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT"
  # icmp (host-unreachable:3/1, port-unreachable:3/3, fragmentation-needed:3/4)
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 3/1 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 3/3 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 3/4 -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT"
  # icmp redirect gateway
  iptoolsRuleAdd "filter" "FORWARD	-i "$iface"	-o "$iface"	-d "$net" -s "$net" -p icmp --icmp-type 5/1 -j ACCEPT"
 done
}
firewallInitIface() {
 local log="firewallInitIface:"
 local iface=""$1""
 local eth=""$(iptoolsGetHostEth ""$iface"")""
 
 shDebug 2 ""$log" eth:"$eth""
 local ruleIfaceIn="In"$eth""
 local ruleIfaceOut="Out"$eth""
 if [ "$eth" = "lo" ];then
  local ips="$(iptoolsGetIps)"
 else
  local ips="$(iptoolsGetIps "$eth")"
 fi
 shDebug 2 ""$log" ip:$ips"
 for ip in $ips;do
  if [ -z "$($echo -e "$ip" | tr -d '[[:space:]]')" ];then continue;fi
  local net=""$(iptoolsGetNet ""$eth"" ""$ip"")""
  local gw=""$(iptoolsGetGw ""$eth"" ""$ip"")""
  local broadcast=""$(iptoolsGetBroadcast ""$eth"" ""$ip"")""
  
  #local ruleCltIn="$(firewallCreateRule In"$eth"Ip)"
  #local ruleCltOut="$(firewallCreateRule Out"$eth"Ip)"
  #local ruleCltIn="In"$eth"Ip"
  #local ruleCltOut="Out"$eth"Ip"
  #iptoolsRuleCreate "filter" "$ruleMd5CltIn"
  #iptoolsRuleCreate "filter" "$ruleCltOut"
  local ruleCltIn="In"$eth"Ip"$ip""
  local ruleCltOut="Out"$eth"Ip"$ip""
  local ruleMd5CltIn=""$(echo "${ruleCltIn}" | $cmdMd5sum | cut -f1 -d' ')""
  local ruleCltIn=""$(iptoolsGetMd5Rule "filter" ""$ruleMd5CltIn"")""
  local ruleMd5CltOut=""$(echo "${ruleCltOut}" | $cmdMd5sum | cut -f1 -d' ')""
  local ruleCltOut=""$(iptoolsGetMd5Rule "filter" ""$ruleMd5CltOut"")""
  if [ -z "$ruleCltIn" ] || [ -z "$ruleCltOut" ];then
   shDebug 0 ""$log" rule Md5 Clt In:${ruleCltIn}:${ruleMd5CltIn}:${ruleCltIn}"
   shDebug 0 ""$log" rule Md5 Clt Out:${ruleCltOut}:${ruleMd5CltOut}:${ruleCltOut}"
  else
   shDebug 2 ""$log" rule Md5 Clt In:${ruleCltIn}:${ruleMd5CltIn}:${ruleCltIn}"
   shDebug 2 ""$log" rule Md5 Clt Out:${ruleCltOut}:${ruleMd5CltOut}:${ruleCltOut}"
   if [ "$eth" = "lo" ];then
    iptoolsRuleAdd "filter" "$ruleIfaceIn -d "$ip" -s "$ip" -j "$ruleCltIn""
    iptoolsRuleAdd "filter" "$ruleIfaceOut -d "$ip" -s "$ip" -j "$ruleCltOut""
   else
    iptoolsRuleAdd "filter" "$ruleIfaceIn -d "$ip" -j "$ruleCltIn""
    iptoolsRuleAdd "filter" "$ruleIfaceOut -s "$ip" -j "$ruleCltOut""
   fi
  fi
 done
}
# firewallExecuteIp "$eth" "$ip" "$mode" "$file"
firewallExecuteIp() {
 local log="firewallExecuteIp:"
 local eth=""$(iptoolsGetHostEth ""$1"")""
 local ip=""$2""
 local mode=""$3""
 local file=""$4""
 local net=""$(iptoolsGetNet ""$eth"" ""$ip"")""
 local broadcast=""$(iptoolsGetBroadcast ""$eth"" ""$ip"")""
 local gw=""$(iptoolsGetGw ""$eth"" ""$ip"")""

 shErrorOnMissing eth ip net mode file

 local ruleIfaceIn="In"$eth""
 local ruleIfaceOut="Out"$eth""

 local ruleCltIn="In"$eth"Ip"$ip""
 local ruleCltOut="Out"$eth"Ip"$ip""
 local ruleMd5CltIn=""$($cmdEcho "${ruleCltIn}" | $cmdMd5sum | $cmdCut -f1 -d' ')""
 local ruleCltIn=""$(iptoolsGetMd5Rule "filter" ""$ruleMd5CltIn"")""
 local ruleMd5CltOut=""$($cmdEcho "${ruleCltOut}" | $cmdMd5sum | cut -f1 -d' ')""
  local ruleCltOut=""$(iptoolsGetMd5Rule "filter" ""$ruleMd5CltOut"")""
  if [ -z "$ruleCltIn" ] || [ -z "$ruleCltOut" ];then
   shDebug 0 ""$log" rule Md5 Clt In:${ruleCltIn}:${ruleMd5CltIn}:${ruleCltIn}"
   shDebug 0 ""$log" rule Md5 Clt Out:${ruleCltOut}:${ruleMd5CltOut}:${ruleCltOut}"
   return 0
  else
   shDebug 2 ""$log" rule Md5 Clt In:${ruleCltIn}:${ruleMd5CltIn}:${ruleCltIn}"
   shDebug 2 ""$log" rule Md5 Clt Out:${ruleCltOut}:${ruleMd5CltOut}:${ruleCltOut}"
   iptoolsRuleAdd "filter" "$ruleIfaceIn -j "$ruleCltIn""
   iptoolsRuleAdd "filter" "$ruleIfaceOut -j "$ruleCltOut""
  fi
  
  local clients=""
  local servers=""
  
  local dropIn=""
  local dropOut=""
  local ruleIn=""
  local ruleOut=""
  $(shIncludeET $file)
  if [ -z "$clients" ] && [ -z "$servers" ] && [ -z "$dropIn" ] && [ -z "$dropOut" ] && [ -z "$ruleIn" ] && [ -z "$ruleOut" ];then
   shDebug 0 ""$log" echec params empty (ip:"$ip"): clients:"$clients" servers:"$servers" dropIO:"$dropIn"/"$dropOut" ruleIO:"$ruleIn"/"$ruleOut""
  else
   shDebug 2 ""$log" "$eth" => ip:"$ip" net:"$net" gw:"$gw" broadcast:"$broadcast""
   
   iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$dropIn"	"-j DROP"
   iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$dropOut"	"-j DROP"
   iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""	"$ruleIn"	"-j ACCEPT"
   iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""	"$ruleOut"	"-j ACCEPT"
   
   # network	: ipv4.ipv4.ipv4.ipv4/mask || dns/mask
   local ruleNetworkIn="$(firewallCreateRule In"$eth"N)"
   local ruleNetworkOut="$(firewallCreateRule Out"$eth"N)"
   iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" ""$ruleCltIn""	"-s" "$network"	"-j "$ruleNetworkIn""
   iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" ""$ruleCltOut""	"-d" "$network"	"-j "$ruleNetworkOut""
   if [ "$mode" = "lo" ];then
    iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" ""$ruleIfaceIn""   "-d" "$network" "-j "$ruleCltIn""
    iptoolsRulesExecuteFlt "iptoolsRuleAdd" "filter" ""$ruleIfaceOut""  "-s" "$network" "-j "$ruleCltOut""
   fi
   
   local clients="$(echo $clients | tr -d ' ' | tr -d '\t')"
   if [ -z "$clients" ];then
    shDebug 2 ""$log" no clients:$clients"
   else
    local clientsRulesName="$(firewallClientConf "$clients")"
    if [ -n "$clientsRulesName" ];then
     iptoolsRuleAdd "filter" "$ruleNetworkIn  -j "$(echo $clientsRulesName | cut -f1 -d '|')""
     iptoolsRuleAdd "filter" "$ruleNetworkOut -j "$(echo $clientsRulesName | cut -f2 -d '|')""
    else
     shDebug 0 ""$log" no clientsRulesName for clients:$clients"
    fi
   fi
   
   local servers="$(echo $servers | tr -d ' ' | tr -d '\t')"
   if [ -z "$servers" ];then
    shDebug 0 ""$log" no servers:$servers"
   else
    local serversRulesName="$(firewallServerConf "$servers")"
    if [ -n "$serversRulesName" ];then
     iptoolsRuleAdd "filter" "$ruleNetworkIn  -j "$(echo $serversRulesName | cut -f1 -d '|')""
     iptoolsRuleAdd "filter" "$ruleNetworkOut -j "$(echo $serversRulesName | cut -f2 -d '|')""
    else
     shDebug 0 ""$log" no serversRulesName for servers:$servers"
    fi
   fi
  fi
 done
}
firewallClientConf() {
 local log="firewallClientConf:"
 local clients=""$1""
 local clientsMd5=""$(echo ""$clients"" | $cmdMd5sum | cut -f1 -d' ')""
 if [ -z "$clientsMd5" ];then shDebugHidden 1 ""$log" no client MD5 for clients:$clients";return 1;fi
 local clientsRule=""$(iptoolsGetMd5Rule "filter" ""$clientsMd5"")""
 shDebugHidden 1 ""$log" clientsRule:"$clientsRule" clients:"$clients""
 local clientsRuleIn=""$clientsRule"CltIn"
 local clientsRuleOut=""$clientsRule"CltOut"
 if ! iptoolsRuleExiste "filter" $clientsRuleIn;then
  if iptoolsRuleExiste "filter" $clientsRuleOut;then shDebugHidden 0 ""$log" 'in' not exist but 'out' exist ??????" ;fi
  iptoolsRuleCreate "filter" "$clientsRuleIn"
  iptoolsRuleCreate "filter" "$clientsRuleOut"
  # clients	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
  local cltCmdInput="$(firewallGenerate $clients	client INPUT)"
  local cltCmdOutput="$(firewallGenerate $clients	client OUTPUT)"
  shDebugHidden 1 ""$log" cltCmdInput:"$cltCmdInput" cltCmdOutput:"$cltCmdOutput""
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$clientsRuleIn""	"$cltCmdInput"	"-j ACCEPT" >&2
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$clientsRuleOut""	"$cltCmdOutput"	"-j ACCEPT" >&2
 else
  shDebugHidden O ""$log" rule ever exist"
 fi
 echo ""$clientsRuleIn"|"$clientsRuleOut""
}
firewallServerConf() {
 local log="firewallServerConf:"
 local servers=""$1""
 local serversMd5=""$(echo ""$servers"" | $cmdMd5sum | cut -f1 -d' ')""
 if [ -z "$serversMd5" ];then shDebugHidden 1 ""$log" no server MD5 for servers:$servers";return 1;fi
 local serversRule=""$(iptoolsGetMd5Rule "filter" ""$serversMd5"")""
 shDebugHidden 1 ""$log" serversRule:"$serversRule" servers:"$servers""
 local serversRuleIn=""$serversRule"SrvIn"
 local serversRuleOut=""$serversRule"SrvOut"
 if ! iptoolsRuleExiste "filter" $serversRuleIn;then
  if iptoolsRuleExiste "filter" $serversRuleOut;then shDebugHidden 0 ""$log" 'in' not exist but 'out' exist ??????" ;fi
  iptoolsRuleCreate "filter" "$serversRuleIn"
  iptoolsRuleCreate "filter" "$serversRuleOut"
  # servers	: PROTO ; PORT ; UID/GID ; UID/GID ; UID/GID .... |
  local srvCmdInput="$(firewallGenerate $servers	server INPUT)"
  local srvCmdOutput="$(firewallGenerate $servers	server OUTPUT)"
  shDebugHidden 1 ""$log" srvCmdInput:"$srvCmdInput" srvCmdOutput:"$srvCmdOutput""
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$serversRuleIn""   "$srvCmdInput"       "-j ACCEPT" >&2
  iptoolsRulesExecute "iptoolsRuleAdd" "filter" ""$serversRuleOut""  "$srvCmdOutput"      "-j ACCEPT" >&2
 else
  shDebugHidden 0 ""$log" rule ever exist"
 fi
 echo ""$serversRuleIn"|"$serversRuleOut""
}
#firewallInitStateRule() {
#}
firewallGenerate() {
 local log="firewallGenerate:"
 local params="$1"
 local role="$(echo $2 | tr '[:upper:]' '[:lower:]')"
 local sens="$(echo $3 | tr '[:lower:]' '[:upper:]')"
 local cmd=""
 
 shDebugHidden 2 ""$log" $params"
 for param in $(echo $params | tr -s '|' ' ');do
  local proto=""
  local port=""
  for value in $(echo $param | tr ';' ' ');do
   if [ -z "$proto" ];then
    local proto="$(echo $value | tr '[:lower:]' '[:upper:]')"
   else if [ -z "$port" ];then
    local port="$value"
   else
    local uid=""
    local gid=""
    for uidgid in $(echo $value | tr '/' ' ');do
     if [ -z "$uid" ];then
      local uid="$uidgid"
     else if [ -z "$gid" ];then
      local gid="$uidgid"
     else
      shDebugHidden 0 ""$log" echec reading uid/gid: unknow $uidgid in : $value"
     fi fi
    done
    if shUserExist $uid 1>&2 && shGroupExist $gid 1>&2; then
     if [ "$sens" = "INPUT" ];then
      if [ "$role" = "client" ];then
       if [ -z "$(echo $port | grep :)" ];then
        # -j inCltMState
        local cmd="$cmd;$port	|-p $proto --sport $port  -m state --state ESTABLISHED,RELATED"
        if [ "$proto" = "TCP" ];then
         # -j inCltTcpMState
         local cmd="$cmd;$port     |-p $proto --sport $port  -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       else
        # -j inCltMState
        local cmd="$cmd;$port	|-p $proto --match multiport --sports $port  -m state --state ESTABLISHED,RELATED"
        if [ "$proto" = "TCP" ];then
         # -j inCltTcpMState
         local cmd="$cmd;$port     |-p $proto --match multiport --sports $port  -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       fi
      else if [ "$role" = "server" ];then
       if [ -z "$(echo $port | grep :)" ];then
        # -j inSrvMState
        local cmd="$cmd;$port     |-p $proto --dport $port  -m state --state ESTABLISHED,RELATED,NEW"
        if [ "$proto" = "TCP" ];then
         # -j inSrvTcpMState
         local cmd="$cmd;$port     |-p $proto --dport $port  -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       else
        # -j inSrvMState
        local cmd="$cmd;$port     |-p $proto --match multiport --dports $port  -m state --state ESTABLISHED,RELATED,NEW"
        if [ "$proto" = "TCP" ];then
         # -j inSrvTcpMState
         local cmd="$cmd;$port     |-p $proto --match multiport --dports $port  -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       fi
      else
       shDebugHidden 0 ""$log" echec reading role: unknow $role"
      fi fi # $role is "client" or "server"
     else if [ "$sens" = "OUTPUT" ];then
      if [ "$role" = "client" ];then
       if [ -z "$(echo $port | grep :)" ];then
        # -J outCltMState
        local cmd="$cmd;$port	|-p $proto --dport $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW"
        if [ "$proto" = "TCP" ];then
         # -J outCltTcpMState
         local cmd="$cmd;$port     |-p $proto --dport $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       else
        # -J outCltMState
        local cmd="$cmd;$port	|-p $proto --match multiport --dports $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW"
        if [ "$proto" = "TCP" ];then
         # -J outCltTcpMState
         local cmd="$cmd;$port     |-p $proto --match multiport --dports $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       fi
      else if [ "$role" = "server" ];then
       if [ -z "$(echo $port | grep :)" ];then
        # -j outSrvMState
        local cmd="$cmd;$port     |-p $proto --sport $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW"
        if [ "$proto" = "TCP" ];then
         # -j outSrvTcpMState
         local cmd="$cmd;$port     |-p $proto --sport $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       else
        # -j outSrvMState
        local cmd="$cmd;$port     |-p $proto --match multiport --sports $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW"
        if [ "$proto" = "TCP" ];then
         # -j outSrvTcpMState
         local cmd="$cmd;$port     |-p $proto --match multiport --sports $port -m owner --uid-owner $uid --gid-owner $gid -m state --state ESTABLISHED,RELATED,NEW ! --syn"
        fi
       fi
      else
       shDebugHidden "[ ERROR ]"$log" echec reading role: unknow $role"
      fi fi # $role is "client" or "server"
     else
      shDebugHidden "[ ERROR ]"$log" echec reading sens: unknow $sens"
     fi fi # $sens "INPUT" or "OUTPUT"
    else
      shDebugHidden 0 ""$log" no user $uid or no group $gid"
    fi # if shUserExist $uid && shGroupExist $gid
   fi fi # $value is proto or port or user n...
  done
 done
 shDebugHidden 2 ""$log" $cmd"
 echo "$cmd"
}
# inCltMState="-m state --state ESTABLISHED,RELATED"
# inCltTcpMState="-m state --state ESTABLISHED,RELATED ! --syn"
# inSrvMState="-m state --state ESTABLISHED,RELATED,NEW"
# inSrvTcpMState="-m state --state ESTABLISHED,RELATED,NEW ! --syn"

# outCltMState="-m state --state ESTABLISHED,RELATED,NEW"
# outCltTcpMState="-m state --state ESTABLISHED,RELATED,NEW ! --syn"
# outSrvMState="-m state --state ESTABLISHED,RELATED"
# outSrvTcpMState="-m state --state ESTABLISHED,RELATED ! --syn"

firewallCreateRule() {
 local log="firewallCreateRule:"
 local ruleName=""$1""
 local cpt=0

 while iptoolsRuleExiste "filter" ""$ruleName""$cpt"" && [ $cpt -lt 1000 ];do
  cpt=$((cpt+1))
 done
 iptoolsRuleCreate "filter" ""$ruleName""$cpt"" 2>&1 >> /dev/null
 echo ""$ruleName""$cpt""
}

firewallStartMangleIface() {
 local log="firewallStartMangleIface:"
 local eth=""$(echo "$1" | cut -d: -f1)""
 mangleAddInterface ""$eth""
 # Mark packets [ save the mark in end of all interface ]
 # iptables -t mangle -A INPUT -j CONNMARK --save-mark
 for enterSoluce in "FORWARD" "INPUT";do
  #shDebug "[ INFO ]"$log" iptoolsRuleDelete mangle $enterSoluce save-mark"
  iptoolsRuleDelete "mangle" "$enterSoluce"     "save-mark"
  shDebug "[ INFO ]"$log" iptoolsRuleAdd mangle $enterSoluce -j CONNMARK     --save-mark"
  iptoolsRuleAdd "mangle" "$enterSoluce	-j CONNMARK	--save-mark"
 done
}
mangleAddInterface() {
 local log="mangleAddInterface"
# local eth=""$1""
 local eth=""$(iptoolsGetHostEth ""$1"")""

 local rtTableData=""
 local rtTableCpt=10
 for rtLine in $(cat "$fileRtTable" | tr "[[:blank:]]" "_" | grep 0X );do
  anEth="$(echo $rtLine | cut -d'_' -f 4 | cut -d'|' -f 1 )"
  if [ -z "$anEth" ];then continue
  elif [ "|$eth|" = "|$anEth|" ];then
   if [ -n "$rtTableData" ];then shDebug "[ ERROR ]"$log" $rtTableData found twice:$rtLine";fi
   local rtTableData="$(echo $rtLine | cut -d'#' -f 2 | tr -d '[[:space:]]' | tr -d '_' )"
   local rtTableMark="$(echo $rtTableData | cut -d'|' -f 2)"
   local rtTableName="$(echo $rtTableData | cut -d'|' -f 3)"
   local rtTablePrio="$(echo $rtTableData | cut -d'|' -f 4)"
  else
   local rtTableCpt=$((rtTableCpt + 1))
  fi
 done
 
 if [ -z "$rtTableData" ];then
  shDebug "[ INFO ]"$log" echec no $eth in RT_TABLE"
 else
# shDebug "[ INFO ]"$log" mark:$rtTableMark name:$rtTableName prio:rtTablePrio"
  if [ -z "$(ip -4 rule show | grep lookup | grep $rtTableName)" ];then
   if ! iptoolsExecute "ip rule add pri $rtTablePrio fwmark $rtTableMark lookup $rtTableName" ; then
    shDebug 0 ""$log" $eth ip rule add pri"
   else
    shDebug 2 ""$log" $eth ip rule add pri"
   fi
#  shDebug "[ INFO ]"$log" ip rule add pri $rtTablePrio fwmark $rtTableMark iif $intEth oif $outEth lookup $rtTableName"
#  local initMangleIface="$initMangleIface ip rule add pri $rtTablePrio fwmark $rtTableMark iif $intEth oif $outEth lookup $rtTableName
  fi
  shDebug "[ INFO ]"$log" add mark for -i $eth "
  if [ -z "$(iptables -t mangle -nL INPUT | grep $rtTableMark | grep ' $eth ' )" ];then
   iptoolsRuleAdd "mangle" "INPUT	-j MARK	--set-mark "$rtTableMark" -i "$eth""
  fi
  if [ -z "$(iptables -t mangle -nL FORWARD | grep $rtTableMark | grep ' $eth ' )" ];then
   iptoolsRuleAdd "mangle" "FORWARD	-j MARK	--set-mark "$rtTableMark" -i "$eth""
  fi
  #[ -z "$(ip -4 route show table $rtTableName)" ];then
  if [ "$eth" != "lo" ];then
   if ! iptoolsExecute "ip -4 route add default dev "$eth" table "$rtTableName"" ; then
    shDebug 0 ""$log" mangle $eth init by all route for t:$rtTableName"
   else
    shDebug 2 ""$log" mangle $eth init by all route for t:$rtTableName"
   fi
  fi
 fi
 
}
# mangleAddIpInterface "$eth" "$ip" "$net" "$gw"
mangleAddIpInterface() {
 local log="mangleAddIpInterface"
# local eth=""$1""
 local eth=""$(iptoolsGetHostEth ""$1"")""
 local ip="$2"
 local net="$3"
 local gw="$4"
 
 local rtTableData=""
 local rtTableCpt=10
 for rtLine in $(cat "$fileRtTable" | tr "[[:blank:]]" "_" | grep 0X );do
  anEth="$(echo $rtLine | cut -d'_' -f 4 | cut -d'|' -f 1 )"
  if [ -z "$anEth" ];then continue
  elif [ "|$eth|" = "|$anEth|" ];then
   if [ -n "$rtTableData" ];then shDebug "[ ERROR ]"$log" $rtTableData found twice:$rtLine";fi
   local rtTableData="$(echo $rtLine | cut -d'#' -f 2 | tr -d '[[:space:]]' | tr -d '_' )"
   local rtTableMark="$(echo $rtTableData | cut -d'|' -f 2)"
   local rtTableName="$(echo $rtTableData | cut -d'|' -f 3)"
   local rtTablePrio="$(echo $rtTableData | cut -d'|' -f 4)"
  else
   local rtTableCpt=$((rtTableCpt + 1))
  fi
 done
 
 if [ -z "$rtTableData" ] || [ -z "$ip" ] || [ -z "$net" ];then
  shErrorOnMissing "rtTableData" "ip" "net"
  shDebug 2 ""$log" echec rtTableData:$rtTableData ip:$ip net:$net"
 else
  if ! iptoolsExecute "ip rule add pri $rtTablePrio fwmark $rtTableMark lookup $rtTableName" ; then
   shDebug 0 ""$log" $eth ip rule add pri"
  else
   shDebug 2 ""$log" $eth ip rule add pri"
  fi
# shDebug 2 ""$log" mark:$rtTableMark name:$rtTableName prio:rtTablePrio"
# if ! iptoolsExecute "ip -4 route add 0.0.0.0/0 src $ip dev $eth table $rtTableName" ; then
#  shDebug 0 ""$log" mangle $eth init default route "
# else
#  shDebug 2 ""$log" mangle $eth init default route"
# fi
  local iface=""$(iptoolsGetHostEth ""${eth}"")""
  shDebug 2 ""$log" add table for mark ${eth}/${iface} table ${rtTableName} => add $ip/$net"
  if ! iptoolsExecute "ip -4 route del default dev ${iface} table ${rtTableName};ip -4 route add ${net} dev ${iface} src ${ip} table ${rtTableName};ip -4 route add default dev ${iface} table ${rtTableName}" ; then
   shDebug 0 ""$log" mangle $eth init ${net} route "
  else
   shDebug 2 ""$log" mangle $eth init ${net} route"
  fi
  if [ "$eth" = "lo" ];then
   shDebug "[ INFO ]"$log" no gw mangle local iface $eth"
  else
   if [ -n "${gw}" ];then addGateway "${ip}" "${gw}" "${net}" "${iface}";fi
  fi
 fi
 # Mark packets [ save the mark in end of all interface ]
 # iptables -t mangle -A INPUT -j CONNMARK --save-mark
 for enterSoluce in "FORWARD" "INPUT";do
  #shDebug "[ INFO ]"$log" iptoolsRuleDelete mangle $enterSoluce save-mark"
  iptoolsRuleDelete "mangle" "$enterSoluce"     "save-mark"
  shDebug "[ INFO ]"$log" iptoolsRuleAdd mangle $enterSoluce -j CONNMARK     --save-mark"
  iptoolsRuleAdd "mangle" "$enterSoluce	-j CONNMARK	--save-mark"
 done
}
addGateway() {
 local log="addGateway"
 local ip="$1"
 local gwIp="$2"
 local gwNet="$3"
 local gwEth="$4"
 
 rtTableAddGw "${gwIp}" "${gwNet}" "${gwEth}"
 
 local rtTableData=""
 local rtTableCpt=10
 for rtLine in $(cat "$fileRtTable" | tr "[[:blank:]]" "_" | grep 0X );do
  local anGwIpMacEth="$(echo $rtLine | cut -d'_' -f 4 | cut -d'|' -f 1 )"
  if [ -z "$anGwIpMacEth" ];then continue;fi
  local anGwIp="$(echo $anGwIpMacEth | cut -d';' -f 1)"
  local anGwEth="$(echo $anGwIpMacEth | cut -d';' -f 3)"
  if [ "|$gwIp|" = "|$anGwIp|" ] && [ "|$gwEth|" = "|$anGwEth|" ];then
   local gwMac="$(echo $anGwIpMacEth | cut -d';' -f 2)"
   if [ -n "$rtTableData" ];then shDebug "[ ERROR ]"$log" $rtTableData found twice:$rtLine";fi
   local rtTableData="$(echo $rtLine | cut -d'#' -f 2 | tr -d '[[:space:]]' | tr -d '_' )"
   local rtTableMark="$(echo $rtTableData | cut -d'|' -f 2)"
   local rtTableName="$(echo $rtTableData | cut -d'|' -f 3)"
   local rtTablePrio="$(echo $rtTableData | cut -d'|' -f 4)"
  else
   local rtTableCpt=$((rtTableCpt + 1))
  fi
 done
 
 if [ -z "$gwMac" ];then
  shDebug "[ ERROR ]"$log" no MAC for $gwIp/$gwNet/$gwEth"
 else
  local initMangleGw=""
# shDebug "[ INFO ]"$log" mark:$rtTableMark name:$rtTableName prio:rtTablePrio"
  local initMangleGw="$initMangleGw ip -4 route add default via $gwIp dev $gwEth src $ip table $rtTableName"
  local initMangleGw="$initMangleGw;ip -4 route add $gwIp dev $gwEth src $ip table $rtTableName"
  local initMangleGw="$initMangleGw;ip -4 route add $gwNet dev $gwEth src $ip table $rtTableName"
  local initMangleGw="$initMangleGw;ip -4 route add default dev $gwEth table $rtTableName"
  if ! iptoolsExecute "$initMangleGw" ; then
   shDebug "[ ERROR ]"$log" route $rtTableName gw:$gwIp($gwEth)"
  else
   shDebug "[ INFO ]"$log" route $rtTableName gw:$gwIp($gwEth)"
  fi
  if ! iptoolsExecute "ip -4 route add $gwIp dev $gwEth src $ip" ; then
   shDebug "[ ERROR ]"$log" std route of $gwIp"
  else
   shDebug "[ INFO ]"$log" std route of $gwIp"
  fi
  # Mark packets [ save the mark in end of all interface ]
  shDebug "[ INFO ]"$log" found mac:$gwMac/$gwIp/$gwNet/$gwEth"
  for enterSoluce in "FORWARD" "INPUT";do
   if [ -z "$($cmdIptables -w -t mangle -nL $enterSoluce | grep $gwMac)" ];then
    shDebug "[ INFO ]"$log" add to '$enterSoluce' mark for mac of '$gwIp' => '$gwMac'"
    # iptables -t mangle -A INPUT -m mac --mac-source $gwMac -j MARK --set-mark $rtTableMark
    iptoolsRuleAdd "mangle" "$enterSoluce	-j MARK	--set-mark "$rtTableMark" -m mac --mac-source "$gwMac" ! -s "$gwIp""
   fi
  done
 fi
}