--- host --- Thu Jul 9 12:18:43 UTC 2026 --- route tables 200..205 --- table_200=default dev vpn1 scope link ;10.200.0.0/24 dev eth1 scope link src 10.200.0.2 ;10.201.0.0/24 dev eth3 scope link src 10.201.0.2 ; table_201=default dev vpn1 scope link ; table_202=default dev vpn2 scope link ; table_203=default dev vpn3 scope link ; table_204=default dev vpn4 scope link ; table_205=default dev vpn5 scope link ; --- services --- egress_slots_enabled_rc=0 egress_slots_status_rc=0 mapper_enabled_rc=0 mapper_status_rc=0 --- mapper/apply scripts --- -rwxr-xr-x 1 root root 2217 Jul 8 13:00 /usr/local/sbin/router-egress-slots-apply.sh -rwxr-xr-x 1 root root 2737 Jul 8 13:03 /usr/local/sbin/router-wgpay-canary-apply.sh --- nft/rules hints --- iifname "eth0" oifname "eth2" ip daddr 192.168.30.189 udp dport 51821 counter packets 0 bytes 0 snat ip to 192.168.30.2 comment "WG_GUEST_51821_SNAT" iifname { "vpn1", "vpn2", "vpn3", "vpn4", "vpn5" } jump input_vpn_out comment "!fw4: Handle vpn_out IPv4/IPv6 input traffic" iifname { "vpn1", "vpn2", "vpn3", "vpn4", "vpn5" } jump forward_vpn_out comment "!fw4: Handle vpn_out IPv4/IPv6 forward traffic" oifname { "vpn1", "vpn2", "vpn3", "vpn4", "vpn5" } jump output_vpn_out comment "!fw4: Handle vpn_out IPv4/IPv6 output traffic" meta nfproto ipv4 udp dport 68 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCP-Renew" icmp type echo-request counter packets 447 bytes 24688 accept comment "!fw4: Allow-Ping" meta nfproto ipv4 meta l4proto igmp counter packets 0 bytes 0 accept comment "!fw4: Allow-IGMP" meta nfproto ipv6 udp dport 546 counter packets 0 bytes 0 accept comment "!fw4: Allow-DHCPv6" ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . 0, mld-listener-report . 0, mld-listener-done . 0, mld2-listener-report . 0 } counter packets 0 bytes 0 accept comment "!fw4: Allow-MLD" icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply, nd-router-solicit, nd-router-advert } limit rate 1000/second burst 5 packets counter packets 22 bytes 1232 accept comment "!fw4: Allow-ICMPv6-Input" icmpv6 type . icmpv6 code { packet-too-big . 0, parameter-problem . 0, nd-neighbor-solicit . 0, nd-neighbor-advert . 0, parameter-problem . 1 } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Input" icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward" icmpv6 type . icmpv6 code { packet-too-big . 0, parameter-problem . 0, parameter-problem . 1 } limit rate 1000/second burst 5 packets counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMPv6-Forward" meta nfproto ipv4 oifname "eth0" ct state invalid counter packets 59 bytes 2360 drop comment "!fw4: Prevent NAT leakage" oifname "eth0" counter packets 11376 bytes 924039 accept comment "!fw4: accept wan IPv4/IPv6 traffic" iifname "eth0" counter packets 54425 bytes 2516550 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic" oifname "eth0" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic" iifname "eth2" counter packets 133 bytes 8292 accept comment "!fw4: accept Management IPv4/IPv6 traffic" meta nfproto ipv4 oifname "eth2" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage" oifname "eth2" counter packets 0 bytes 0 accept comment "!fw4: accept Management IPv4/IPv6 traffic" oifname "eth2" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject Management IPv4/IPv6 traffic" iifname "eth3" counter packets 23 bytes 1288 accept comment "!fw4: accept direct_in IPv4/IPv6 traffic" oifname "eth3" counter packets 0 bytes 0 accept comment "!fw4: accept direct_in IPv4/IPv6 traffic" oifname "eth3" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject direct_in IPv4/IPv6 traffic" icmp type echo-request counter packets 0 bytes 0 accept comment "!fw4: Allow-ICMP-from-vpn_in-to-router" iifname "eth1" counter packets 22 bytes 1232 accept comment "!fw4: accept vpn_in IPv4/IPv6 traffic" oifname "eth1" counter packets 0 bytes 0 accept comment "!fw4: accept vpn_in IPv4/IPv6 traffic" oifname "eth1" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject vpn_in IPv4/IPv6 traffic" meta nfproto ipv4 oifname { "vpn1", "vpn2", "vpn3", "vpn4", "vpn5" } ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage" oifname { "vpn1", "vpn2", "vpn3", "vpn4", "vpn5" } counter packets 11 bytes 924 accept comment "!fw4: accept vpn_out IPv4/IPv6 traffic" iifname { "vpn1", "vpn2", "vpn3", "vpn4", "vpn5" } counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject vpn_out IPv4/IPv6 traffic" oifname { "vpn1", "vpn2", "vpn3", "vpn4", "vpn5" } counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject vpn_out IPv4/IPv6 traffic" oifname { "vpn1", "vpn2", "vpn3", "vpn4", "vpn5" } jump srcnat_vpn_out comment "!fw4: Handle vpn_out IPv4/IPv6 srcnat traffic" meta nfproto ipv4 udp dport 51821 counter packets 0 bytes 0 dnat ip to 10.71.1.189:51821 comment "!fw4: WG_easy_51821_to_VM103" meta nfproto ipv4 udp dport 51820 counter packets 5 bytes 880 dnat ip to 10.71.100.1:51820 comment "!fw4: wg_remote_to_vm100" meta nfproto ipv4 udp dport 51830 counter packets 8 bytes 1408 dnat ip to 10.71.100.1:51830 comment "!fw4: DNAT-WG-Paid-51830-to-VM100" ip daddr 192.168.30.186 tcp dport 65000-65535 counter packets 0 bytes 0 masquerade comment "!fw4: OMR_SERVER_SNAT_TO_MGMT" ip daddr 192.168.30.186 udp dport 65000-65535 counter packets 0 bytes 0 masquerade comment "!fw4: OMR_SERVER_SNAT_TO_MGMT" oifname { "vpn1", "vpn2", "vpn3", "vpn4", "vpn5" } tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone vpn_out IPv4/IPv6 egress MTU fixing" iifname { "vpn1", "vpn2", "vpn3", "vpn4", "vpn5" } tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone vpn_out IPv4/IPv6 ingress MTU fixing" table inet router_egress_dscp_canary { iifname "eth1" ip saddr 10.200.0.1 ip dscp cs1 meta mark set 0x00000203 counter packets 4 bytes 336 comment "STEP_036I_DSCP_CS1_TO_FW_MARK_0x203" iifname "eth1" ip saddr 10.200.0.1 ip dscp cs2 meta mark set 0x00000204 counter packets 8 bytes 672 comment "STEP_036I_DSCP_CS2_TO_FW_MARK_0x204" iifname "eth1" ip saddr 10.200.0.1 ip dscp cs3 meta mark set 0x00000205 counter packets 4 bytes 336 comment "STEP_036I_DSCP_CS3_TO_FW_MARK_0x205" iifname "eth1" ip saddr 10.200.0.1 ip dscp cs4 meta mark set 0x00000201 counter packets 4 bytes 336 comment "STEP_036I_DSCP_CS4_TO_FW_MARK_0x201" iifname "eth1" ip saddr 10.200.0.1 ip dscp cs5 meta mark set 0x00000202 counter packets 5 bytes 420 comment "STEP_036I_DSCP_CS5_TO_FW_MARK_0x202" meta mark 0x00000203 ip dscp cs1 ip dscp set cs0 counter packets 4 bytes 336 comment "STEP_036I_CLEAR_DSCP_CS1_MARK_0x203" meta mark 0x00000204 ip dscp cs2 ip dscp set cs0 counter packets 8 bytes 672 comment "STEP_036I_CLEAR_DSCP_CS2_MARK_0x204" meta mark 0x00000205 ip dscp cs3 ip dscp set cs0 counter packets 4 bytes 336 comment "STEP_036I_CLEAR_DSCP_CS3_MARK_0x205" meta mark 0x00000201 ip dscp cs4 ip dscp set cs0 counter packets 4 bytes 336 comment "STEP_036I_CLEAR_DSCP_CS4_MARK_0x201" meta mark 0x00000202 ip dscp cs5 ip dscp set cs0 counter packets 5 bytes 420 comment "STEP_036I_CLEAR_DSCP_CS5_MARK_0x202"