## As a special case, the NETWORK/MASK can be the string `default', which
## indicates that all addresses not matched elsewhere should be considered.
ifaces=:
-defaultiface=none
+defaultifaces=""
allnets= allnets6=
defiface () {
set -e
netclass=${item%:*} addr=${item#*:}
case $addr in
default)
- defaultiface=$name
- defaultclass=$netclass
- run ip46tables -t mangle -A out-classify -g mark-to-$netclass
+ case "$defaultifaces,$defaultclass" in
+ ,* | *,$netclass)
+ defaultifaces="$defaultifaces $name"
+ defaultclass=$netclass
+ ;;
+ *)
+ echo >&2 "$0: inconsistent default netclasses"
+ exit 1
+ ;;
+ esac
;;
*:*)
run ip6tables -t mangle -A in-$name -g mark-from-$netclass \