run ip46tables -A inbound -j forbidden
run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound
-## Allow responses from the scary outside world into the untrusted net, but
-## don't let untrusted things run services.
-case $forward in
- 1)
- run ip46tables -A FORWARD -j ACCEPT \
- -m mark --mark $to_untrusted/$(( $MASK_FROM | $MASK_TO )) \
- -m state --state ESTABLISHED,RELATED
- ;;
-esac
-
## Otherwise process as indicated by the mark.
for i in $inchains; do
run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT