カテゴリー: CPU

# opkg update
# opkg install luci-i18n-base-ja
# opkg install map
# okpg install iptables-mod-ipopt

units1=15 #V6plus:15 OCN:63
units2=4096 #V6plus 4096 OCN:1024
IP4='xxx.xxx.xxx.xxx'
PSID='x'
TUNDEV='map-wan_map'


iptables -t nat -F PREROUTING
iptables -t nat -F OUTPUT
iptables -t nat -F POSTROUTING

rule=1
while [ $rule -le $units1  ] ; do
  mark=`expr $rule + 16`
  pn=`expr $rule - 1`
  portl=`expr $rule \* $units2 + $PSID \* 16`
  portr=`expr $portl + 15`

  iptables -t nat -A PREROUTING -m statistic --mode nth --every $units1 --packet $pn -j MARK --set-mark $mark
  iptables -t nat -A OUTPUT -m statistic --mode nth --every $units1 --packet $pn -j MARK --set-mark $mark

  iptables -t nat -A POSTROUTING -p icmp -o $TUNDEV -m mark --mark $mark -j SNAT --to $IP4:$portl-$portr
  iptables -t nat -A POSTROUTING -p tcp -o $TUNDEV -m mark --mark $mark -j SNAT --to $IP4:$portl-$portr
  iptables -t nat -A POSTROUTING -p udp -o $TUNDEV -m mark --mark $mark -j SNAT --to $IP4:$portl-$portr
  rule=`expr $rule + 1`
done

sleep 30
sh /etc/firewall.user

root@nanopi:~# opkg install iptables-mod-ipopt
Installing iptables-mod-ipopt (1.8.7-1) to root...
Downloading https://downloads.openwrt.org/releases/21.02.0-rc1/targets/rockchip/armv8/packages/iptables-mod-ipopt_1.8.7-1_aarch64_generic.ipk
Installing kmod-ipt-ipopt (5.4.111-1) to root...
Downloading https://downloads.openwrt.org/releases/21.02.0-rc1/targets/rockchip/armv8/packages/kmod-ipt-ipopt_5.4.111-1_aarch64_generic.ipk
Configuring kmod-ipt-ipopt.
Configuring iptables-mod-ipopt.
root@nanopi:~#

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdaf:6014:6f21::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth1'

config device
        option name 'eth1'
        option macaddr '1a:e4:a4:73:0d:0c'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.1.1'

config device
        option name 'eth0'
        option macaddr '1a:e4:a4:73:0d:0b'

config interface 'wan'
        option device 'eth0'
        option proto 'dhcp'
        option auto '0'

config interface 'wan6'
        option device 'eth0'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'

config interface 'wan_map'
        option proto 'map'
        option maptype 'map-e'
        option peeraddr '2404:9200:225:100::64'
        option ipaddr 'xxx.xxx.xxx.xxx'
        option ip4prefixlen '15'
        option ip6prefix 'wwww:xxxx::'
        option ip6prefixlen '31'
        option ealen '25'
        option psidlen '8'
        option offset '4'
        option legacymap '1'

config interface 'WAN6PD'
        option proto 'static'
        list ip6addr 'wwww:xxxx:yyyy:zzzz::1001'
        option ip6gw 'wwww:xxxx:yyyy:zzzz::1'
        option ip6prefix 'wwww:xxxx:yyyy:zzzz::/56'
        option device '@wan6'

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option ra 'relay'
        option ndp 'relay'
        list ra_flags 'none'
        option dhcpv6 'server'

config dhcp 'wan6'
        option dhcpv6 'relay'
        option ra 'relay'
        option ndp 'relay'
        option master '1'
        option interface 'wan6'
        option ignore '1'
        list ra_flags 'none'

root@nanopi:~# iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 2756 packets, 474K bytes)
 pkts bytes target     prot opt in     out     source               destination
  185 32012 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 MARK set 0x11
  184 28575 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 1 MARK set 0x12
  184 31952 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 2 MARK set 0x13
  184 31323 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 3 MARK set 0x14
  184 33123 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 4 MARK set 0x15
  184 36047 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 5 MARK set 0x16
  184 32939 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 6 MARK set 0x17
  184 33412 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 7 MARK set 0x18
  184 29916 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 8 MARK set 0x19
  184 28526 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 9 MARK set 0x1a
  184 29308 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 10 MARK set 0x1b
  183 32364 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 11 MARK set 0x1c
  183 30150 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 12 MARK set 0x1d
  183 29944 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 13 MARK set 0x1e
  183 34100 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 14 MARK set 0x1f

Chain INPUT (policy ACCEPT 598 packets, 40818 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 67 packets, 5056 bytes)
 pkts bytes target     prot opt in     out     source               destination
    5   372 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 MARK set 0x11
    5   372 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 1 MARK set 0x12
    5   372 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 2 MARK set 0x13
    5   372 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 3 MARK set 0x14
    5   380 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 4 MARK set 0x15
    5   380 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 5 MARK set 0x16
    5   380 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 6 MARK set 0x17
    4   300 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 7 MARK set 0x18
    4   304 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 8 MARK set 0x19
    4   304 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 9 MARK set 0x1a
    4   304 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 10 MARK set 0x1b
    4   304 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 11 MARK set 0x1c
    4   304 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 12 MARK set 0x1d
    4   304 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 13 MARK set 0x1e
    4   304 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 14 MARK set 0x1f

Chain POSTROUTING (policy ACCEPT 23 packets, 1064 bytes)
 pkts bytes target     prot opt in     out     source               destination
    2   168 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x11 to:xxx.xxx.xxx.xxx:5856-5871
   41  2607 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x11 to:xxx.xxx.xxx.xxx:5856-5871
    8   557 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x11 to:xxx.xxx.xxx.xxx:5856-5871
    4   336 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x12 to:xxx.xxx.xxx.xxx:9952-9967
   50  3503 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x12 to:xxx.xxx.xxx.xxx:9952-9967
   13   868 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x12 to:xxx.xxx.xxx.xxx:9952-9967
    0     0 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x13 to:xxx.xxx.xxx.xxx:14048-14063
   46  2981 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x13 to:xxx.xxx.xxx.xxx:14048-14063
   11   771 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x13 to:xxx.xxx.xxx.xxx:14048-14063
    0     0 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x14 to:xxx.xxx.xxx.xxx:18144-18159
   33  1991 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x14 to:xxx.xxx.xxx.xxx:18144-18159
   10   709 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x14 to:xxx.xxx.xxx.xxx:18144-18159
    2   168 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x15 to:xxx.xxx.xxx.xxx:22240-22255
   38  2280 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x15 to:xxx.xxx.xxx.xxx:22240-22255
   13   950 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x15 to:xxx.xxx.xxx.xxx:22240-22255
    0     0 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x16 to:xxx.xxx.xxx.xxx:26336-26351
   42  3095 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x16 to:xxx.xxx.xxx.xxx:26336-26351
   11   831 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x16 to:xxx.xxx.xxx.xxx:26336-26351
    0     0 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x17 to:xxx.xxx.xxx.xxx:30432-30447
   51  3838 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x17 to:xxx.xxx.xxx.xxx:30432-30447
   11   823 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x17 to:xxx.xxx.xxx.xxx:30432-30447
    1    84 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x18 to:xxx.xxx.xxx.xxx:34528-34543
   41  2564 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x18 to:xxx.xxx.xxx.xxx:34528-34543
    9   656 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x18 to:xxx.xxx.xxx.xxx:34528-34543
    0     0 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x19 to:xxx.xxx.xxx.xxx:38624-38639
   44  2665 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x19 to:xxx.xxx.xxx.xxx:38624-38639
    9   629 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x19 to:xxx.xxx.xxx.xxx:38624-38639
    0     0 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x1a to:xxx.xxx.xxx.xxx:42720-42735
   55  3841 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1a to:xxx.xxx.xxx.xxx:42720-42735
   11   762 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1a to:xxx.xxx.xxx.xxx:42720-42735
    1    84 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x1b to:xxx.xxx.xxx.xxx:46816-46831
   53  3161 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1b to:xxx.xxx.xxx.xxx:46816-46831
   10   699 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1b to:xxx.xxx.xxx.xxx:46816-46831
    2   168 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x1c to:xxx.xxx.xxx.xxx:50912-50927
   46  2965 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1c to:xxx.xxx.xxx.xxx:50912-50927
    9   632 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1c to:xxx.xxx.xxx.xxx:50912-50927
    1    84 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x1d to:xxx.xxx.xxx.xxx:55008-55023
   45  2700 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1d to:xxx.xxx.xxx.xxx:55008-55023
   10   671 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1d to:xxx.xxx.xxx.xxx:55008-55023
    1    84 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x1e to:xxx.xxx.xxx.xxx:59104-59119
   48  2992 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1e to:xxx.xxx.xxx.xxx:59104-59119
   15  1003 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1e to:xxx.xxx.xxx.xxx:59104-59119
    1    84 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x1f to:xxx.xxx.xxx.xxx:63200-63215
   38  2280 SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1f to:xxx.xxx.xxx.xxx:63200-63215
    9   615 SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1f to:xxx.xxx.xxx.xxx:63200-63215

Chain postrouting_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain postrouting_rule (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain postrouting_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain prerouting_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain prerouting_rule (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain prerouting_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain zone_lan_postrouting (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 postrouting_lan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom lan postrouting rule chain */

Chain zone_lan_prerouting (0 references)
 pkts bytes target     prot opt in     out     source               destination
  389 44358 prerouting_lan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom lan prerouting rule chain */

Chain zone_wan_postrouting (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 postrouting_wan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom wan postrouting rule chain */
    0     0 MASQUERADE  all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain zone_wan_prerouting (0 references)
 pkts bytes target     prot opt in     out     source               destination
    6   786 prerouting_wan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom wan prerouting rule chain */
root@nanopi:~#

root@nanopi:~# iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 1434K packets, 285M bytes)
 pkts bytes target     prot opt in     out     source               destination
95575   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 MARK set 0x11
95574   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 1 MARK set 0x12
95574   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 2 MARK set 0x13
95574   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 3 MARK set 0x14
95574   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 4 MARK set 0x15
95574   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 5 MARK set 0x16
95574   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 6 MARK set 0x17
95573   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 7 MARK set 0x18
95573   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 8 MARK set 0x19
95573   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 9 MARK set 0x1a
95573   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 10 MARK set 0x1b
95573   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 11 MARK set 0x1c
95573   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 12 MARK set 0x1d
95573   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 13 MARK set 0x1e
95573   19M MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 14 MARK set 0x1f

Chain INPUT (policy ACCEPT 231K packets, 17M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 1399 packets, 222K bytes)
 pkts bytes target     prot opt in     out     source               destination
   94 15373 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 MARK set 0x11
   94 16668 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 1 MARK set 0x12
   94 13812 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 2 MARK set 0x13
   94 14151 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 3 MARK set 0x14
   93 14819 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 4 MARK set 0x15
   93 13431 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 5 MARK set 0x16
   93 15387 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 6 MARK set 0x17
   93 14528 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 7 MARK set 0x18
   93 15124 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 8 MARK set 0x19
   93 16367 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 9 MARK set 0x1a
   93 14850 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 10 MARK set 0x1b
   93 14763 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 11 MARK set 0x1c
   93 14121 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 12 MARK set 0x1d
   93 13029 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 13 MARK set 0x1e
   93 15394 MARK       all  --  any    any     anywhere             anywhere             statistic mode nth every 15 packet 14 MARK set 0x1f

Chain POSTROUTING (policy ACCEPT 1289 packets, 186K bytes)
 pkts bytes target     prot opt in     out     source               destination
  772 64680 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x11 to:xxx.xxx.xxx.xxx:5856-5871
14703  948K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x11 to:xxx.xxx.xxx.xxx:5856-5871
 3753  257K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x11 to:xxx.xxx.xxx.xxx:5856-5871
  837 70140 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x12 to:xxx.xxx.xxx.xxx:9952-9967
14623  945K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x12 to:xxx.xxx.xxx.xxx:9952-9967
 3628  254K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x12 to:xxx.xxx.xxx.xxx:9952-9967
  806 67536 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x13 to:xxx.xxx.xxx.xxx:14048-14063
14690  930K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x13 to:xxx.xxx.xxx.xxx:14048-14063
 3705  257K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x13 to:xxx.xxx.xxx.xxx:14048-14063
  853 71540 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x14 to:xxx.xxx.xxx.xxx:18144-18159
14620  936K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x14 to:xxx.xxx.xxx.xxx:18144-18159
 3696  255K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x14 to:xxx.xxx.xxx.xxx:18144-18159
  802 67088 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x15 to:xxx.xxx.xxx.xxx:22240-22255
14833  942K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x15 to:xxx.xxx.xxx.xxx:22240-22255
 3723  256K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x15 to:xxx.xxx.xxx.xxx:22240-22255
  834 69944 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x16 to:xxx.xxx.xxx.xxx:26336-26351
14759  930K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x16 to:xxx.xxx.xxx.xxx:26336-26351
 3689  258K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x16 to:xxx.xxx.xxx.xxx:26336-26351
  804 67480 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x17 to:xxx.xxx.xxx.xxx:30432-30447
14874  946K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x17 to:xxx.xxx.xxx.xxx:30432-30447
 3746  261K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x17 to:xxx.xxx.xxx.xxx:30432-30447
  868 72800 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x18 to:xxx.xxx.xxx.xxx:34528-34543
14703  937K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x18 to:xxx.xxx.xxx.xxx:34528-34543
 3698  254K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x18 to:xxx.xxx.xxx.xxx:34528-34543
  843 70644 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x19 to:xxx.xxx.xxx.xxx:38624-38639
14651  931K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x19 to:xxx.xxx.xxx.xxx:38624-38639
 3720  256K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x19 to:xxx.xxx.xxx.xxx:38624-38639
  768 64288 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x1a to:xxx.xxx.xxx.xxx:42720-42735
14731  942K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1a to:xxx.xxx.xxx.xxx:42720-42735
 3689  251K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1a to:xxx.xxx.xxx.xxx:42720-42735
  839 70084 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x1b to:xxx.xxx.xxx.xxx:46816-46831
14826  944K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1b to:xxx.xxx.xxx.xxx:46816-46831
 3729  257K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1b to:xxx.xxx.xxx.xxx:46816-46831
  841 70420 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x1c to:xxx.xxx.xxx.xxx:50912-50927
14751  939K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1c to:xxx.xxx.xxx.xxx:50912-50927
 3697  252K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1c to:xxx.xxx.xxx.xxx:50912-50927
  783 65492 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x1d to:xxx.xxx.xxx.xxx:55008-55023
14802  937K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1d to:xxx.xxx.xxx.xxx:55008-55023
 3679  255K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1d to:xxx.xxx.xxx.xxx:55008-55023
  850 71288 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x1e to:xxx.xxx.xxx.xxx:59104-59119
14824  942K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1e to:xxx.xxx.xxx.xxx:59104-59119
 3622  246K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1e to:xxx.xxx.xxx.xxx:59104-59119
  870 72968 SNAT       icmp --  any    map-wan_map  anywhere             anywhere             mark match 0x1f to:xxx.xxx.xxx.xxx:63200-63215
14802  941K SNAT       tcp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1f to:xxx.xxx.xxx.xxx:63200-63215
 3684  258K SNAT       udp  --  any    map-wan_map  anywhere             anywhere             mark match 0x1f to:xxx.xxx.xxx.xxx:63200-63215

Chain postrouting_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain postrouting_rule (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain postrouting_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain prerouting_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain prerouting_rule (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain prerouting_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain zone_lan_postrouting (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 postrouting_lan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom lan postrouting rule chain */

Chain zone_lan_prerouting (0 references)
 pkts bytes target     prot opt in     out     source               destination
  389 44358 prerouting_lan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom lan prerouting rule chain */

Chain zone_wan_postrouting (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 postrouting_wan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom wan postrouting rule chain */
    0     0 MASQUERADE  all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain zone_wan_prerouting (0 references)
 pkts bytes target     prot opt in     out     source               destination
    6   786 prerouting_wan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom wan prerouting rule chain */
root@nanopi:~#