and part 2,
[0:0] -A zone_lan_postrouting -s 192.168.9.0/24 -d 192.168.8.252/32 -p tcp -m tcp --dport 8081 -m comment --comment "!fw3: webserver (reflection)" -j SNAT --to-source 192.168.9.1
[0:0] -A zone_lan_postrouting -s 192.168.8.0/24 -d 192.168.8.252/32 -p udp -m udp --dport 500 -m comment --comment "!fw3: ISAKMP (VPN) (reflection)" -j SNAT --to-source 192.168.8.1
[0:0] -A zone_lan_postrouting -s 192.168.9.0/24 -d 192.168.8.252/32 -p udp -m udp --dport 500 -m comment --comment "!fw3: ISAKMP (VPN) (reflection)" -j SNAT --to-source 192.168.9.1
[0:0] -A zone_lan_postrouting -s 192.168.8.0/24 -d 192.168.8.252/32 -p udp -m udp --dport 4500 -m comment --comment "!fw3: IPSec NAT (VPN) (reflection)" -j SNAT --to-source 192.168.8.1
[0:0] -A zone_lan_postrouting -s 192.168.9.0/24 -d 192.168.8.252/32 -p udp -m udp --dport 4500 -m comment --comment "!fw3: IPSec NAT (VPN) (reflection)" -j SNAT --to-source 192.168.9.1
[0:0] -A zone_lan_postrouting -s 192.168.8.0/24 -d 192.168.8.252/32 -p tcp -m tcp --dport 20 -m comment --comment "!fw3: FTP (DATA) (reflection)" -j SNAT --to-source 192.168.8.1
[0:0] -A zone_lan_postrouting -s 192.168.9.0/24 -d 192.168.8.252/32 -p tcp -m tcp --dport 20 -m comment --comment "!fw3: FTP (DATA) (reflection)" -j SNAT --to-source 192.168.9.1
[0:0] -A zone_lan_postrouting -s 192.168.8.0/24 -d 192.168.8.252/32 -p tcp -m tcp --dport 21 -m comment --comment "!fw3: FTP (CONTROL) (reflection)" -j SNAT --to-source 192.168.8.1
[0:0] -A zone_lan_postrouting -s 192.168.9.0/24 -d 192.168.8.252/32 -p tcp -m tcp --dport 21 -m comment --comment "!fw3: FTP (CONTROL) (reflection)" -j SNAT --to-source 192.168.9.1
[6116:1082053] -A zone_lan_prerouting -m comment --comment "!fw3: Custom lan prerouting rule chain" -j prerouting_lan_rule
[0:0] -A zone_lan_prerouting -s 192.168.8.0/24 -d 192.168.1.2/32 -p udp -m udp --dport 1701 -m comment --comment "!fw3: L2TP (VPN) (reflection)" -j DNAT --to-destination 192.168.8.252:1701
[0:0] -A zone_lan_prerouting -s 192.168.9.0/24 -d 192.168.1.2/32 -p udp -m udp --dport 1701 -m comment --comment "!fw3: L2TP (VPN) (reflection)" -j DNAT --to-destination 192.168.8.252:1701
[0:0] -A zone_lan_prerouting -s 192.168.8.0/24 -d 192.168.1.2/32 -p tcp -m tcp --dport 1723 -m comment --comment "!fw3: PPTP (VPN) (reflection)" -j DNAT --to-destination 192.168.8.252:1723
[0:0] -A zone_lan_prerouting -s 192.168.9.0/24 -d 192.168.1.2/32 -p tcp -m tcp --dport 1723 -m comment --comment "!fw3: PPTP (VPN) (reflection)" -j DNAT --to-destination 192.168.8.252:1723
[0:0] -A zone_lan_prerouting -s 192.168.8.0/24 -d 192.168.1.2/32 -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: OPENVPN (VPN) (reflection)" -j DNAT --to-destination 192.168.8.252:1194
[0:0] -A zone_lan_prerouting -s 192.168.8.0/24 -d 192.168.1.2/32 -p udp -m udp --dport 1194 -m comment --comment "!fw3: OPENVPN (VPN) (reflection)" -j DNAT --to-destination 192.168.8.252:1194
[0:0] -A zone_lan_prerouting -s 192.168.9.0/24 -d 192.168.1.2/32 -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: OPENVPN (VPN) (reflection)" -j DNAT --to-destination 192.168.8.252:1194
[0:0] -A zone_lan_prerouting -s 192.168.9.0/24 -d 192.168.1.2/32 -p udp -m udp --dport 1194 -m comment --comment "!fw3: OPENVPN (VPN) (reflection)" -j DNAT --to-destination 192.168.8.252:1194
[0:0] -A zone_lan_prerouting -s 192.168.8.0/24 -d 192.168.1.2/32 -p tcp -m tcp --dport 13131 -m comment --comment "!fw3: telnet (reflection)" -j DNAT --to-destination 192.168.8.252:13131
[0:0] -A zone_lan_prerouting -s 192.168.9.0/24 -d 192.168.1.2/32 -p tcp -m tcp --dport 13131 -m comment --comment "!fw3: telnet (reflection)" -j DNAT --to-destination 192.168.8.252:13131
[0:0] -A zone_lan_prerouting -s 192.168.8.0/24 -d 192.168.1.2/32 -p tcp -m tcp --dport 8081 -m comment --comment "!fw3: webserver (reflection)" -j DNAT --to-destination 192.168.8.252:8081
[0:0] -A zone_lan_prerouting -s 192.168.9.0/24 -d 192.168.1.2/32 -p tcp -m tcp --dport 8081 -m comment --comment "!fw3: webserver (reflection)" -j DNAT --to-destination 192.168.8.252:8081
[0:0] -A zone_lan_prerouting -s 192.168.8.0/24 -d 192.168.1.2/32 -p udp -m udp --dport 500 -m comment --comment "!fw3: ISAKMP (VPN) (reflection)" -j DNAT --to-destination 192.168.8.252:500
[0:0] -A zone_lan_prerouting -s 192.168.9.0/24 -d 192.168.1.2/32 -p udp -m udp --dport 500 -m comment --comment "!fw3: ISAKMP (VPN) (reflection)" -j DNAT --to-destination 192.168.8.252:500
[0:0] -A zone_lan_prerouting -s 192.168.8.0/24 -d 192.168.1.2/32 -p udp -m udp --dport 4500 -m comment --comment "!fw3: IPSec NAT (VPN) (reflection)" -j DNAT --to-destination 192.168.8.252:4500
[0:0] -A zone_lan_prerouting -s 192.168.9.0/24 -d 192.168.1.2/32 -p udp -m udp --dport 4500 -m comment --comment "!fw3: IPSec NAT (VPN) (reflection)" -j DNAT --to-destination 192.168.8.252:4500
[0:0] -A zone_lan_prerouting -s 192.168.8.0/24 -d 192.168.1.2/32 -p tcp -m tcp --dport 20 -m comment --comment "!fw3: FTP (DATA) (reflection)" -j DNAT --to-destination 192.168.8.252:20
[0:0] -A zone_lan_prerouting -s 192.168.9.0/24 -d 192.168.1.2/32 -p tcp -m tcp --dport 20 -m comment --comment "!fw3: FTP (DATA) (reflection)" -j DNAT --to-destination 192.168.8.252:20
[0:0] -A zone_lan_prerouting -s 192.168.8.0/24 -d 192.168.1.2/32 -p tcp -m tcp --dport 21 -m comment --comment "!fw3: FTP (CONTROL) (reflection)" -j DNAT --to-destination 192.168.8.252:21
[0:0] -A zone_lan_prerouting -s 192.168.9.0/24 -d 192.168.1.2/32 -p tcp -m tcp --dport 21 -m comment --comment "!fw3: FTP (CONTROL) (reflection)" -j DNAT --to-destination 192.168.8.252:21
[4758:351716] -A zone_wan_postrouting -m comment --comment "!fw3: Custom wan postrouting rule chain" -j postrouting_wan_rule
[4758:351716] -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE
[1104:74314] -A zone_wan_prerouting -m comment --comment "!fw3: Custom wan prerouting rule chain" -j prerouting_wan_rule
[0:0] -A zone_wan_prerouting -p udp -m udp --dport 1701 -m comment --comment "!fw3: L2TP (VPN)" -j DNAT --to-destination 192.168.8.252:1701
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 1723 -m comment --comment "!fw3: PPTP (VPN) " -j DNAT --to-destination 192.168.8.252:1723
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 1194 -m comment --comment "!fw3: OPENVPN (VPN)" -j DNAT --to-destination 192.168.8.252:1194
[0:0] -A zone_wan_prerouting -p udp -m udp --dport 1194 -m comment --comment "!fw3: OPENVPN (VPN)" -j DNAT --to-destination 192.168.8.252:1194
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 13131 -m comment --comment "!fw3: telnet" -j DNAT --to-destination 192.168.8.252:13131
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 8081 -m comment --comment "!fw3: webserver" -j DNAT --to-destination 192.168.8.252:8081
[0:0] -A zone_wan_prerouting -p udp -m udp --dport 500 -m comment --comment "!fw3: ISAKMP (VPN)" -j DNAT --to-destination 192.168.8.252:500
[0:0] -A zone_wan_prerouting -p udp -m udp --dport 4500 -m comment --comment "!fw3: IPSec NAT (VPN)" -j DNAT --to-destination 192.168.8.252:4500
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 20 -m comment --comment "!fw3: FTP (DATA)" -j DNAT --to-destination 192.168.8.252:20
[0:0] -A zone_wan_prerouting -p tcp -m tcp --dport 21 -m comment --comment "!fw3: FTP (CONTROL)" -j DNAT --to-destination 192.168.8.252:21
COMMIT
# Completed on Thu Sep 24 17:27:01 2020
# Generated by iptables-save v1.8.3 on Thu Sep 24 17:27:01 2020
*raw
:PREROUTING ACCEPT [81645:32013450]
:OUTPUT ACCEPT [17740:5574511]
COMMIT
# Completed on Thu Sep 24 17:27:01 2020
# Generated by iptables-save v1.8.3 on Thu Sep 24 17:27:01 2020
*mangle
:PREROUTING ACCEPT [76497:30472278]
:INPUT ACCEPT [14736:1829013]
:FORWARD ACCEPT [59956:27886794]
:OUTPUT ACCEPT [15915:5051472]
:POSTROUTING ACCEPT [75724:32931368]
:qos_Default - [0:0]
:qos_Default_ct - [0:0]
[772:46344] -A FORWARD -o br-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[464:27056] -A FORWARD -i br-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[0:0] -A FORWARD -o eth0.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[0:0] -A FORWARD -i eth0.2 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "!fw3: Zone wan MTU fixing" -j TCPMSS --clamp-mss-to-pmtu
[0:0] -A qos_Default -j CONNMARK --restore-mark --nfmask 0xf --ctmask 0xf
[0:0] -A qos_Default -m mark --mark 0x0/0xf -j qos_Default_ct
[0:0] -A qos_Default -p udp -m mark --mark 0x0/0xf0 -m length --length 0:500 -j MARK --set-xmark 0x22/0xff
[0:0] -A qos_Default -p icmp -j MARK --set-xmark 0x11/0xff
[0:0] -A qos_Default -p tcp -m mark --mark 0x0/0xf0 -m tcp --sport 1024:65535 --dport 1024:65535 -j MARK --set-xmark 0x44/0xff
[0:0] -A qos_Default -p udp -m mark --mark 0x0/0xf0 -m udp --sport 1024:65535 --dport 1024:65535 -j MARK --set-xmark 0x44/0xff
[0:0] -A qos_Default -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff
[0:0] -A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 22,53 -m comment --comment "ssh, dns" -j MARK --set-xmark 0x11/0xff
[0:0] -A qos_Default_ct -p udp -m mark --mark 0x0/0xf -m udp -m multiport --ports 22,53 -m comment --comment "ssh, dns" -j MARK --set-xmark 0x11/0xff
[0:0] -A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 20,21,25,80,110,443,993,995 -m comment --comment "ftp, smtp, http(s), imap" -j MARK --set-xmark 0x33/0xff
[0:0] -A qos_Default_ct -p tcp -m mark --mark 0x0/0xf -m tcp -m multiport --ports 5190 -m comment --comment "AOL, iChat, ICQ" -j MARK --set-xmark 0x22/0xff
[0:0] -A qos_Default_ct -p udp -m mark --mark 0x0/0xf -m udp -m multiport --ports 5190 -m comment --comment "AOL, iChat, ICQ" -j MARK --set-xmark 0x22/0xff
[0:0] -A qos_Default_ct -j CONNMARK --save-mark --nfmask 0xff --ctmask 0xff
COMMIT
# Completed on Thu Sep 24 17:27:01 2020
# Generated by iptables-save v1.8.3 on Thu Sep 24 17:27:01 2020
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:forwarding_guest_rule - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_guest_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_guest_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_guest_dest_ACCEPT - [0:0]
:zone_guest_dest_REJECT - [0:0]
:zone_guest_forward - [0:0]
:zone_guest_input - [0:0]
:zone_guest_output - [0:0]
:zone_guest_src_REJECT - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_dest_REJECT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_REJECT - [0:0]
[5638:475551] -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT
[9107:1353930] -A INPUT -m comment --comment "!fw3: Custom input rule chain" -j input_rule
[7414:1151816] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[230:9564] -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood
[580:133750] -A INPUT -i br-lan -m comment --comment "!fw3" -j zone_lan_input
[0:0] -A INPUT -i wg0 -m comment --comment "!fw3" -j zone_lan_input
[1113:68364] -A INPUT -i br-wan -m comment --comment "!fw3" -j zone_wan_input
[0:0] -A INPUT -i eth0.2 -m comment --comment "!fw3" -j zone_wan_input
[0:0] -A INPUT -i br-guest -m comment --comment "!fw3" -j zone_guest_input
[59956:27886794] -A FORWARD -m comment --comment "!fw3: Custom forwarding rule chain" -j forwarding_rule
[54846:27474129] -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[5110:412665] -A FORWARD -i br-lan -m comment --comment "!fw3" -j zone_lan_forward
[0:0] -A FORWARD -i wg0 -m comment --comment "!fw3" -j zone_lan_forward
[0:0] -A FORWARD -i br-wan -m comment --comment "!fw3" -j zone_wan_forward
[0:0] -A FORWARD -i eth0.2 -m comment --comment "!fw3" -j zone_wan_forward
[0:0] -A FORWARD -i br-guest -m comment --comment "!fw3" -j zone_guest_forward
[0:0] -A FORWARD -m comment --comment "!fw3" -j reject
[5935:501687] -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT
[9989:4553277] -A OUTPUT -m comment --comment "!fw3: Custom output rule chain" -j output_rule
[9757:4538791] -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT
[0:0] -A OUTPUT -o br-lan -m comment --comment "!fw3" -j zone_lan_output
[0:0] -A OUTPUT -o wg0 -m comment --comment "!fw3" -j zone_lan_output
[232:14486] -A OUTPUT -o br-wan -m comment --comment "!fw3" -j zone_wan_output
[0:0] -A OUTPUT -o eth0.2 -m comment --comment "!fw3" -j zone_wan_output
[0:0] -A OUTPUT -o br-guest -m comment --comment "!fw3" -j zone_guest_output
[296:13973] -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset
[260:12647] -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable
[230:9564] -A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN
[0:0] -A syn_flood -m comment --comment "!fw3" -j DROP
[0:0] -A zone_guest_dest_ACCEPT -o br-guest -m comment --comment "!fw3" -j ACCEPT
[0:0] -A zone_guest_dest_REJECT -o br-guest -m comment --comment "!fw3" -j reject
[0:0] -A zone_guest_forward -m comment --comment "!fw3: Custom guest forwarding rule chain" -j forwarding_guest_rule
[0:0] -A zone_guest_forward -m comment --comment "!fw3: Zone guest to wan forwarding policy" -j zone_wan_dest_ACCEPT
[0:0] -A zone_guest_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[0:0] -A zone_guest_forward -m comment --comment "!fw3" -j zone_guest_dest_REJECT
[0:0] -A zone_guest_input -m comment --comment "!fw3: Custom guest input rule chain" -j input_guest_rule
[0:0] -A zone_guest_input -p tcp -m tcp --dport 53 -m comment --comment "!fw3: Allow-DNS-Guest" -j ACCEPT
[0:0] -A zone_guest_input -p udp -m udp --dport 53 -m comment --comment "!fw3: Allow-DNS-Guest" -j ACCEPT
[0:0] -A zone_guest_input -p udp -m udp --dport 67 -m comment --comment "!fw3: Allow-DHCP-Guest" -j ACCEPT
[0:0] -A zone_guest_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[0:0] -A zone_guest_input -m comment --comment "!fw3" -j zone_guest_src_REJECT
[0:0] -A zone_guest_output -m comment --comment "!fw3: Custom guest output rule chain" -j output_guest_rule
[0:0] -A zone_guest_output -m comment --comment "!fw3" -j zone_guest_dest_ACCEPT
[0:0] -A zone_guest_src_REJECT -i br-guest -m comment --comment "!fw3" -j reject
[0:0] -A zone_lan_dest_ACCEPT -o br-lan -m comment --comment "!fw3" -j ACCEPT
[0:0] -A zone_lan_dest_ACCEPT -o wg0 -m comment --comment "!fw3" -j ACCEPT
[5110:412665] -A zone_lan_forward -m comment --comment "!fw3: Custom lan forwarding rule chain" -j forwarding_lan_rule
[5110:412665] -A zone_lan_forward -m comment --comment "!fw3: Zone lan to wan forwarding policy" -j zone_wan_dest_ACCEPT
[0:0] -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[0:0] -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
[580:133750] -A zone_lan_input -m comment --comment "!fw3: Custom lan input rule chain" -j input_lan_rule
[223:15338] -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[357:118412] -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT
[0:0] -A zone_lan_output -m comment --comment "!fw3: Custom lan output rule chain" -j output_lan_rule
[0:0] -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT
[357:118412] -A zone_lan_src_ACCEPT -i br-lan -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
[0:0] -A zone_lan_src_ACCEPT -i wg0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT
[147:6898] -A zone_wan_dest_ACCEPT -o br-wan -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
[5195:420253] -A zone_wan_dest_ACCEPT -o br-wan -m comment --comment "!fw3" -j ACCEPT
[0:0] -A zone_wan_dest_ACCEPT -o eth0.2 -m conntrack --ctstate INVALID -m comment --comment "!fw3: Prevent NAT leakage" -j DROP
[0:0] -A zone_wan_dest_ACCEPT -o eth0.2 -m comment --comment "!fw3" -j ACCEPT
[0:0] -A zone_wan_dest_REJECT -o br-wan -m comment --comment "!fw3" -j reject
[0:0] -A zone_wan_dest_REJECT -o eth0.2 -m comment --comment "!fw3" -j reject
[0:0] -A zone_wan_forward -m comment --comment "!fw3: Custom wan forwarding rule chain" -j forwarding_wan_rule
[0:0] -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT
[0:0] -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT
[0:0] -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT
[0:0] -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT
[1113:68364] -A zone_wan_input -m comment --comment "!fw3: Custom wan input rule chain" -j input_wan_rule
[0:0] -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT
[524:40688] -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT
[33:1056] -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT
[0:0] -A zone_wan_input -p udp -m udp --dport 51820 -m comment --comment "!fw3: Allow-WireGuard" -j ACCEPT
[0:0] -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT
[556:26620] -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT
[232:14486] -A zone_wan_output -m comment --comment "!fw3: Custom wan output rule chain" -j output_wan_rule
[232:14486] -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT
[556:26620] -A zone_wan_src_REJECT -i br-wan -m comment --comment "!fw3" -j reject
[0:0] -A zone_wan_src_REJECT -i eth0.2 -m comment --comment "!fw3" -j reject
COMMIT
# Completed on Thu Sep 24 17:27:01 2020
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
9: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 192.168.8.1/24 brd 192.168.8.255 scope global br-lan
valid_lft forever preferred_lft forever
11: br-wan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 192.168.1.2/24 brd 192.168.1.255 scope global br-wan
valid_lft forever preferred_lft forever
13: br-guest: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
inet 192.168.3.1/24 brd 192.168.3.255 scope global br-guest
valid_lft forever preferred_lft forever
35: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
inet 192.168.9.1/24 brd 192.168.9.255 scope global wg0
valid_lft forever preferred_lft forever
default via 192.168.1.1 dev br-wan proto static
192.168.1.0/24 dev br-wan proto kernel scope link src 192.168.1.2
192.168.3.0/24 dev br-guest proto kernel scope link src 192.168.3.1
192.168.8.0/24 dev br-lan proto kernel scope link src 192.168.8.1
192.168.9.0/24 dev wg0 proto kernel scope link src 192.168.9.1
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
broadcast 192.168.1.0 dev br-wan table local proto kernel scope link src 192.168.1.2
local 192.168.1.2 dev br-wan table local proto kernel scope host src 192.168.1.2
broadcast 192.168.1.255 dev br-wan table local proto kernel scope link src 192.168.1.2
broadcast 192.168.3.0 dev br-guest table local proto kernel scope link src 192.168.3.1
local 192.168.3.1 dev br-guest table local proto kernel scope host src 192.168.3.1
broadcast 192.168.3.255 dev br-guest table local proto kernel scope link src 192.168.3.1
broadcast 192.168.8.0 dev br-lan table local proto kernel scope link src 192.168.8.1
local 192.168.8.1 dev br-lan table local proto kernel scope host src 192.168.8.1
broadcast 192.168.8.255 dev br-lan table local proto kernel scope link src 192.168.8.1
broadcast 192.168.9.0 dev wg0 table local proto kernel scope link src 192.168.9.1
local 192.168.9.1 dev wg0 table local proto kernel scope host src 192.168.9.1
broadcast 192.168.9.255 dev wg0 table local proto kernel scope link src 192.168.9.1
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
lrwxrwxrwx 1 root root 16 Sep 6 18:19 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r-- 1 root root 32 Sep 24 16:56 /tmp/resolv.conf
-rw-r--r-- 1 root root 39 Sep 24 16:55 /tmp/resolv.conf.auto
==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1
==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1
==> /tmp/resolv.conf.auto <==
# Interface wan
nameserver 192.168.1.1