# Generated by iptables-save v1.8.3 on Thu Jul 23 15:21:31 2026
*raw
:PREROUTING ACCEPT [4170406441:9321575865173]
:OUTPUT ACCEPT [12887990:3097769453]
:CONNLIMIT - [0:0]
[fastid: 0] -A PREROUTING -j CONNLIMIT
COMMIT
# Completed on Thu Jul 23 15:21:31 2026
# Generated by iptables-save v1.8.3 on Thu Jul 23 15:21:31 2026
*nat
:PREROUTING ACCEPT [12521:1765427]
:INPUT ACCEPT [1519:746118]
:OUTPUT ACCEPT [574:56152]
:POSTROUTING ACCEPT [9961:1038190]
:AUTONAT - [0:0]
:DNSIKUAI8 - [0:0]
:DNSIKUAI8_NOAUTH - [0:0]
:DNSPROXY - [0:0]
:DSTNAT - [0:0]
:HTTPPROXY - [0:0]
:HTTPSPROXY - [0:0]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:NATRULE_DNAT - [0:0]
:NATRULE_SNAT - [0:0]
:NETNAT - [0:0]
:NOTICE - [0:0]
:POST_FULLCONE - [0:0]
:PRE_FULLCONE - [0:0]
:VRRPNAT - [0:0]
[fastid: 0] -A PREROUTING -p udp -m udp --dport 53 -j DNAT --to-destination 47.238.113.180:5353
[fastid: 0] -A PREROUTING -p udp -m udp --dport 53 -j DNAT --to-destination 15.235.235.101:28888
[fastid: 0] -A PREROUTING -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW -m ifaces --ifaces lan,vlan,ppp,tap0,sovpn,sdwan,ikec,doc_ --dir in -j HTTPPROXY
[fastid: 0] -A PREROUTING -p udp -m udp --dport 53 -m conntrack --ctstate NEW -m ifaces --ifaces lan,vlan,ppp,tap0,sovpn,sdwan,ikec,doc_ --dir in -j DNSIKUAI8
[fastid: 0] -A PREROUTING -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW -m ifaces --ifaces lan,vlan,ppp,tap0,sovpn,sdwan,ikec,doc_ --dir in -j NOTICE
[fastid: 0] -A PREROUTING -m conntrack --ctstate NEW -m addrtype --dst-type LOCAL -j DSTNAT
[fastid: 0] -A PREROUTING -m conntrack --ctstate NEW -j NATRULE_DNAT
[fastid: 0] -A PREROUTING -m conntrack --ctstate NEW -m addrtype --dst-type LOCAL -j MINIUPNPD
[fastid: 0] -A PREROUTING -j PRE_FULLCONE
[fastid: 0] -A PREROUTING -p udp -m udp --dport 53 -m conntrack --ctstate NEW -m ifaces --ifaces lan,vlan,ppp,tap0,sovpn,sdwan,ikec,doc_ --dir in -j DNSPROXY
[fastid: 0] -A POSTROUTING ! -d 127.0.0.1/32 -j NATRULE_SNAT
[fastid: 0] -A POSTROUTING ! -d 127.0.0.1/32 -j MINIUPNPD-POSTROUTING
[fastid: 0] -A POSTROUTING ! -d 127.0.0.1/32 -j NATRULE_SNAT
[fastid: 0] -A POSTROUTING ! -d 127.0.0.1/32 -j MINIUPNPD-POSTROUTING
[fastid: 0] -A POSTROUTING -j POST_FULLCONE
[fastid: 0] -A POSTROUTING -j AUTONAT
[fastid: 0] -A AUTONAT ! -d 127.0.0.1/32 -m ifaces --ifaces wan,vwan,adsl,pptp,l2tp,ovpn,iked --dir out -m policy --dir out --pol none -j MASQUERADE
[fastid: 0] -A AUTONAT ! -d 127.0.0.1/32 -m addrtype ! --dst-type LOCAL -m local_host --dir src --fwd-self -m ifaces --ifaces ppp,lan,vlan --dir out -j MASQUERADE
[fastid: 0] -A AUTONAT ! -d 127.0.0.1/32 -m addrtype ! --dst-type LOCAL -m local_host --dir src -m ifaces --ifaces ppp,sovpn --dir out ! --pppoe -j MASQUERADE
[fastid: 0] -A DNSIKUAI8 -p udp -m udp --dport 53 -m string --hex-string "|06706f7274616c0b696b756169382d7769666903636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8 -p udp -m udp --dport 53 -m string --hex-string "|056c6f63616c06696b7561693803636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8 -p udp -m udp --dport 53 -m string --hex-string "|06706f7274616c06696b7561693803636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8 -p udp -m udp --dport 53 -m string --hex-string "|03696f6306696b7561693803636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8 -p udp -m udp --dport 53 -m string --hex-string "|02696b046175746805677261706802717103636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8 -p udp -m udp --dport 53 -m string --hex-string "|02696b04617574680361706905776569626f03636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DSTNAT -p tcp -m multiport --dports 2822 -m ifname--ifname  wan2 -j DNAT --to-destination 192.168.66.114:22
[fastid: 0] -A MINIUPNPD -p udp -m udp --dport 8568 -j DNAT --to-destination 198.18.0.1:8568
[fastid: 0] -A MINIUPNPD -p udp -m udp --dport 8567 -j DNAT --to-destination 192.168.66.137:8567
[fastid: 0] -A MINIUPNPD -p tcp -m tcp --dport 44948 -j DNAT --to-destination 192.168.66.55:44948
[fastid: 0] -A MINIUPNPD -p udp -m udp --dport 44948 -j DNAT --to-destination 192.168.66.55:44948
[fastid: 0] -A MINIUPNPD -p tcp -m tcp --dport 53273 -j DNAT --to-destination 192.168.66.150:53273
[fastid: 0] -A MINIUPNPD -p udp -m udp --dport 53273 -j DNAT --to-destination 192.168.66.150:53273
[fastid: 0] -A MINIUPNPD -p udp -m udp --dport 8586 -j DNAT --to-destination 192.168.68.104:8567
[fastid: 0] -A MINIUPNPD -p udp -m udp --dport 8496 -j DNAT --to-destination 192.168.68.104:8496
[fastid: 0] -A MINIUPNPD -p udp -m udp --dport 8650 -j DNAT --to-destination 192.168.68.105:8568
[fastid: 0] -A MINIUPNPD -p udp -m udp --dport 8597 -j DNAT --to-destination 192.168.66.111:8567
[fastid: 0] -A MINIUPNPD -p udp -m udp --dport 8605 -j DNAT --to-destination 192.168.66.111:8568
[fastid: 0] -A MINIUPNPD -p tcp -m tcp --dport 6881 -j DNAT --to-destination 192.168.66.115:6881
[fastid: 0] -A MINIUPNPD -p udp -m udp --dport 6881 -j DNAT --to-destination 192.168.66.115:6881
[fastid: 0] -A MINIUPNPD -p udp -m udp --dport 54467 -j DNAT --to-destination 192.168.68.105:8567
[fastid: 0] -A MINIUPNPD-POSTROUTING -s 198.18.0.1/32 -p udp -m udp --sport 8568 -j MASQUERADE --to-ports 8568
[fastid: 0] -A MINIUPNPD-POSTROUTING -s 192.168.66.137/32 -p udp -m udp --sport 8567 -j MASQUERADE --to-ports 8567
[fastid: 0] -A MINIUPNPD-POSTROUTING -s 192.168.66.55/32 -p tcp -m tcp --sport 44948 -j MASQUERADE --to-ports 44948
[fastid: 0] -A MINIUPNPD-POSTROUTING -s 192.168.66.55/32 -p udp -m udp --sport 44948 -j MASQUERADE --to-ports 44948
[fastid: 0] -A MINIUPNPD-POSTROUTING -s 192.168.66.150/32 -p tcp -m tcp --sport 53273 -j MASQUERADE --to-ports 53273
[fastid: 0] -A MINIUPNPD-POSTROUTING -s 192.168.66.150/32 -p udp -m udp --sport 53273 -j MASQUERADE --to-ports 53273
[fastid: 0] -A MINIUPNPD-POSTROUTING -s 192.168.68.104/32 -p udp -m udp --sport 8567 -j MASQUERADE --to-ports 8586
[fastid: 0] -A MINIUPNPD-POSTROUTING -s 192.168.68.104/32 -p udp -m udp --sport 8496 -j MASQUERADE --to-ports 8496
[fastid: 0] -A MINIUPNPD-POSTROUTING -s 192.168.68.105/32 -p udp -m udp --sport 8568 -j MASQUERADE --to-ports 8650
[fastid: 0] -A MINIUPNPD-POSTROUTING -s 192.168.66.111/32 -p udp -m udp --sport 8567 -j MASQUERADE --to-ports 8597
[fastid: 0] -A MINIUPNPD-POSTROUTING -s 192.168.66.111/32 -p udp -m udp --sport 8568 -j MASQUERADE --to-ports 8605
[fastid: 0] -A MINIUPNPD-POSTROUTING -s 192.168.66.115/32 -p tcp -m tcp --sport 6881 -j MASQUERADE --to-ports 6881
[fastid: 0] -A MINIUPNPD-POSTROUTING -s 192.168.66.115/32 -p udp -m udp --sport 6881 -j MASQUERADE --to-ports 6881
[fastid: 0] -A MINIUPNPD-POSTROUTING -s 192.168.68.105/32 -p udp -m udp --sport 8567 -j MASQUERADE --to-ports 54467
[fastid: 0] -A NOTICE -p tcp -m tcp --dport 80 -m addrtype ! --dst-type LOCAL -m local_host ! --dir dst -m set --match-set Linux_WEBTO_default src -m set ! --match-set Linux_WEBTO_whiteip dst -m urlroute  ! --urlroute pppauth -j REDIRECT --to-ports 685
[fastid: 0] -A NOTICE -p tcp -m tcp --dport 443 -m addrtype ! --dst-type LOCAL -m local_host ! --dir dst -m set --match-set Linux_WEBTO_default src -m set ! --match-set Linux_WEBTO_whiteip dst -m urlroute  ! --urlroute pppauth -j REDIRECT --to-ports 686
[fastid: 0] -A POST_FULLCONE ! -d 127.0.0.1/32 -p udp -m ifaces --ifaces wan,vwan,adsl,pptp,l2tp,ovpn,iked --dir out -m policy --dir out --pol none -j FULLCONENAT
[fastid: 0] -A PRE_FULLCONE -p udp -m ifaces --ifaces wan,vwan,adsl,pptp,l2tp,ovpn,iked --dir in -j FULLCONENAT
COMMIT
# Completed on Thu Jul 23 15:21:31 2026
# Generated by iptables-save v1.8.3 on Thu Jul 23 15:21:31 2026
*mangle
:PREROUTING ACCEPT [267528225:325713701067]
:INPUT ACCEPT [549825:233738256]
:FORWARD ACCEPT [266672596:325417672204]
:OUTPUT ACCEPT [566437:134252688]
:POSTROUTING ACCEPT [267203426:325547192730]
:DPROTO - [0:0]
:FASTOFFLOAD - [0:0]
:IPSEC_ROUTE - [0:0]
:LAYER7_IN - [0:0]
:LAYER7_OUT - [0:0]
:PPTPMSS - [0:0]
:STREAM_IPPORT_NEW - [0:0]
:STREAM_LAYER7_NEW - [0:0]
[fastid: 0] -A PREROUTING -m ifaces --ifaces lan,vlan,ppp,tap0,sovpn,sdwan,ikec,doc_ --dir in -j DPROTO
[fastid: 0] -A PREROUTING -m ifaces --ifaces lan,vlan,ppp,tap0,sovpn,sdwan,ikec,doc_ --dir in -m local_host ! --dir dst -m addrtype ! --dst-type LOCAL -m local_host --dir src --can-sel-route -m set ! --match-set Linux_wan_default dst -j STREAM_LAYER7_NEW
[fastid: 0] -A PREROUTING -m conntrack --ctstate NEW -m ifaces --ifaces lan,vlan,ppp,tap0,sovpn,sdwan,ikec,doc_ --dir in -m local_host ! --dir dst -m addrtype ! --dst-type LOCAL -m local_host --dir src --can-sel-route -m set ! --match-set Linux_wan_default dst -j STREAM_IPPORT_NEW
[fastid: 0] -A FORWARD -o ovpn_ak -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
[fastid: 0] -A FORWARD -o ovpn_gatchas -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
[fastid: 0] -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1501:65535 -j TCPMSS --set-mss 1500
[fastid: 0] -A FORWARD -j FASTOFFLOAD
[fastid: 0] -A POSTROUTING -o vwan+ -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1501:65535 -j TCPMSS --set-mss 1500
[fastid: 0] -A STREAM_IPPORT_NEW -m set --match-set sipport_src_16 src -m comment --comment 16_NAS2 -m timeset --timeset sipport_time_16 -j NTH_CONNMARK --set-mark 6000009 --set-ifname wan3 --set-band-flag 0 --set-mode 0
[fastid: 0] -A STREAM_IPPORT_NEW -m set --match-set sipport_src_15 src -m comment --comment 15_ -m timeset --timeset sipport_time_15 -j NTH_CONNMARK --set-mark 6000008 --set-ifname wan3 --set-band-flag 1 --set-mode 0
[fastid: 0] -A STREAM_IPPORT_NEW -m set --match-set sipport_src_14 src -m comment --comment 14_ -m timeset --timeset sipport_time_14 -j NTH_CONNMARK --set-mark 6000007 --set-ifname wan1 --set-band-flag 1 --set-mode 0
[fastid: 0] -A STREAM_IPPORT_NEW -m set --match-set sipport_src_7 src -m comment --comment 7_ -m timeset --timeset sipport_time_7 -j NTH_CONNMARK --set-mark 6000006 --set-ifname wan3 --set-band-flag 0 --set-mode 0
[fastid: 0] -A STREAM_IPPORT_NEW -m set --match-set sipport_dst_5 dst -m comment --comment 5_ -m timeset --timeset sipport_time_5 -j NTH_CONNMARK --set-mark 6000005 --set-ifname wan3 --set-band-flag 0 --set-mode 0
[fastid: 0] -A STREAM_IPPORT_NEW -m set --match-set sipport_src_4 src -m comment --comment "4_CloudNAS%20Download" -m timeset --timeset sipport_time_4 -j NTH_CONNMARK --set-mark 6000004 --set-ifname wan2 --set-band-flag 1 --set-mode 0
[fastid: 0] -A STREAM_IPPORT_NEW -m set --match-set sipport_src_3 src -m comment --comment "3_LAN%20-%20China" -m timeset --timeset sipport_time_3 -j NTH_CONNMARK --set-mark 6000003 --set-ifname wan1 --set-band-flag 1 --set-mode 0
[fastid: 0] -A STREAM_IPPORT_NEW -m set --match-set sipport_src_2 src -m comment --comment "2_LAN%20-%20Japan" -m timeset --timeset sipport_time_2 -j NTH_CONNMARK --set-mark 6000002 --set-ifname wan2 --set-band-flag 1 --set-mode 0
[fastid: 0] -A STREAM_IPPORT_NEW -m set --match-set sipport_src_1 src -m set --match-set sipport_dst_1 dst -m comment --comment 1_ -m timeset --timeset sipport_time_1 -j NTH_CONNMARK --set-mark 6000001 --set-ifname wan1 --set-band-flag 1 --set-mode 0
[fastid: 0] -A STREAM_LAYER7_NEW -m timeset --timeset slayer7_time_4 -m conntrack --ctstate NEW -m comment --comment 4 -m appset --appset slayer7_app_4 -j NTH_CONNMARK --set-mark 4000004 --set-ifname wan3 --set-band-flag 1 --set-mode 0
[fastid: 0] -A STREAM_LAYER7_NEW -m timeset --timeset slayer7_time_3 -m conntrack --ctstate NEW -m comment --comment 3 -m appset --appset slayer7_app_3 -j NTH_CONNMARK --set-mark 4000003 --set-ifname wan3 --set-band-flag 1 --set-mode 0
[fastid: 0] -A STREAM_LAYER7_NEW -m timeset --timeset slayer7_time_2 -m comment --comment 2 -m appset --appset slayer7_app_2_p2p -m matchcount--count 1  -j NTH_CONNMARK --set-mark 4000002 --set-ifname wan1 --set-band-flag 0 --set-mode 0
[fastid: 0] -A STREAM_LAYER7_NEW -m timeset --timeset slayer7_time_1 -m comment --comment 1 -m appset --appset slayer7_app_1_p2p -m matchcount--count 1  -j NTH_CONNMARK --set-mark 4000010 --set-ifname wan4 --set-band-flag 1 --set-mode 0
[fastid: 0] -A STREAM_LAYER7_NEW -m timeset --timeset slayer7_time_1 -m conntrack --ctstate NEW -m comment --comment 1 -m appset --appset slayer7_app_1 -j NTH_CONNMARK --set-mark 4000010 --set-ifname wan4 --set-band-flag 1 --set-mode 0
[fastid: 0] -A STREAM_LAYER7_NEW -m timeset --timeset slayer7_time_5 -m conntrack --ctstate NEW -m comment --comment 5 -m appset --appset slayer7_app_5 -j NTH_CONNMARK --set-mark 4000009 --set-ifname wan4 --set-band-flag 1 --set-mode 0
COMMIT
# Completed on Thu Jul 23 15:21:31 2026
# Generated by iptables-save v1.8.3 on Thu Jul 23 15:21:31 2026
*filter
:INPUT ACCEPT [7428:2868277]
:FORWARD ACCEPT [4960151:3240180055]
:OUTPUT ACCEPT [7362:1395847]
:ACL_MAC - [0:0]
:ARP - [0:0]
:AUTH_EXPIRES - [0:0]
:CONNLIMIT - [0:0]
:DHCP_ACL - [0:0]
:FIREWALL - [0:0]
:FLOW_CONTROL - [0:0]
:IKE_QOS - [0:0]
:INPUT_ACL - [0:0]
:IP_QOS - [0:0]
:L2TP_QOS - [0:0]
:LAN_VISIT - [0:0]
:MAC_QOS - [0:0]
:MINIUPNPD - [0:0]
:NONAT - [0:0]
:OVPN_QOS - [0:0]
:PPP - [0:0]
:PPPOE - [0:0]
:PPPOE_QOS - [0:0]
:PPTP_QOS - [0:0]
:QOS - [0:0]
:TUNNEL_DOWNLOAD_QOS - [0:0]
:TUNNEL_UPLOAD_QOS - [0:0]
:VNCACL - [0:0]
:WEBACL - [0:0]
:WEBAUTH - [0:0]
:WEBAUTH_QOS - [0:0]
[fastid: 0] -A INPUT -j TUNNEL_DOWNLOAD_QOS
[fastid: 0] -A INPUT ! -i lo -p udp -m udp --dport 1701 -m policy --dir in --pol none -j DROP
[fastid: 0] -A INPUT -p udp -m set --match-set DROP_U_PORTS_WAN_IN dst -m ifaces --ifaces wan,vwan,adsl --dir in -j DROP
[fastid: 0] -A INPUT -p tcp -m set --match-set DROP_T_PORTS_WAN_IN dst -m ifaces --ifaces wan,vwan,adsl --dir in -j DROP
[fastid: 0] -A INPUT -j INPUT_ACL
[fastid: 0] -A INPUT -j WEBACL
[fastid: 0] -A INPUT -j VNCACL
[fastid: 0] -A INPUT -p udp -m udp --dport 67 -j DHCP_ACL
[fastid: 0] -A FORWARD -m ifaces --ifaces ppp --dir in -j AUTH_EXPIRES
[fastid: 0] -A FORWARD -j ACL_MAC
[fastid: 0] -A FORWARD -j CONNLIMIT
[fastid: 0] -A FORWARD -j QOS
[fastid: 0] -A FORWARD -j OVPN_QOS
[fastid: 0] -A FORWARD -j L2TP_QOS
[fastid: 0] -A FORWARD -j FIREWALL
[fastid: 0] -A FORWARD -j NONAT
[fastid: 0] -A OUTPUT -j TUNNEL_UPLOAD_QOS
[fastid: 0] -A AUTH_EXPIRES -p tcp -m set --match-set Linux_WEBTO_default src -m set ! --match-set Linux_WEBTO_whiteip dst -m urlroute  ! --urlroute pppauth -j REJECT --reject-with icmp-port-unreachable
[fastid: 0] -A AUTH_EXPIRES -p udp -m udp ! --dport 53 -m set --match-set Linux_WEBTO_default src -m set ! --match-set Linux_WEBTO_whiteip dst -m urlroute  ! --urlroute pppauth -j REJECT --reject-with icmp-port-unreachable
[fastid: 0] -A DHCP_ACL -p udp -m udp --dport 67 -m ifaces --ifaces lan,vlan --dir in -m set --match-set Linux_dhcp_aclmac_default src -j DROP
[fastid: 0] -A MINIUPNPD -d 198.18.0.1/32 -p udp -m udp --dport 8568 -j ACCEPT
[fastid: 0] -A MINIUPNPD -d 192.168.66.137/32 -p udp -m udp --dport 8567 -j ACCEPT
[fastid: 0] -A MINIUPNPD -d 192.168.66.55/32 -p tcp -m tcp --dport 44948 -j ACCEPT
[fastid: 0] -A MINIUPNPD -d 192.168.66.55/32 -p udp -m udp --dport 44948 -j ACCEPT
[fastid: 0] -A MINIUPNPD -d 192.168.66.150/32 -p tcp -m tcp --dport 53273 -j ACCEPT
[fastid: 0] -A MINIUPNPD -d 192.168.66.150/32 -p udp -m udp --dport 53273 -j ACCEPT
[fastid: 0] -A MINIUPNPD -d 192.168.68.104/32 -p udp -m udp --dport 8567 -j ACCEPT
[fastid: 0] -A MINIUPNPD -d 192.168.68.104/32 -p udp -m udp --dport 8496 -j ACCEPT
[fastid: 0] -A MINIUPNPD -d 192.168.68.105/32 -p udp -m udp --dport 8568 -j ACCEPT
[fastid: 0] -A MINIUPNPD -d 192.168.66.111/32 -p udp -m udp --dport 8567 -j ACCEPT
[fastid: 0] -A MINIUPNPD -d 192.168.66.111/32 -p udp -m udp --dport 8568 -j ACCEPT
[fastid: 0] -A MINIUPNPD -d 192.168.66.115/32 -p tcp -m tcp --dport 6881 -j ACCEPT
[fastid: 0] -A MINIUPNPD -d 192.168.66.115/32 -p udp -m udp --dport 6881 -j ACCEPT
[fastid: 0] -A MINIUPNPD -d 192.168.68.105/32 -p udp -m udp --dport 8567 -j ACCEPT
[fastid: 0] -A TUNNEL_DOWNLOAD_QOS -s 8.219.250.67/32 -p tcp -m tcp --sport 2222 -m bytesband--bytesband 500 --bytesband-name tunneldown  -j DROP
[fastid: 0] -A TUNNEL_UPLOAD_QOS -d 8.219.250.67/32 -p tcp -m tcp --dport 2222 -m bytesband--bytesband 200 --bytesband-name tunnelup  -j DROP
[fastid: 0] -A WEBACL -p tcp -m ifaces --ifaces wan,vwan,adsl --dir in -m set --match-set Linux_webport_default dst -j DROP
COMMIT
# Completed on Thu Jul 23 15:21:31 2026
