#! /bin/bash
# Firewall nove generace pro Czela Debian 3.0
# Autor: Mirek Slugen
# Spoluatori: Michal Perlik, Michal Vondracek, Jan Chmelensky
# Vytvoreno: 06.11.2006
# Naposledy zmeneno: 11.1.2009
# Tento skript muzete volne sirit a upravovat.
#
# TODO: Dodelat nat typu tree, ktery potrebuje zjednoduseni, vycisteni kodu a testovani!!!
#

# prevede /X na xxx.xxx.xxx.xxx
convert_net_to_mask() {
    if let $(((32-$1) > 0)); then
        M4=$(((255 << (32-$1)) & 255))
    else
        M4=255
    fi
    if let $(((24-$1) > 0)); then
        M3=$(((255 << (24-$1)) & 255))
    else
        M3=255
    fi
    if let $(((16-$1) > 0)); then
        M2=$(((255 << (16-$1)) & 255))
    else
        M2=255
    fi
    if let $(((8-$1) > 0)); then
        M1=$(((255 << (8-$1)) & 255))
    else
        M1=255
    fi
}

# prevede napriklad 10.93.55.125/24 na 10.93.55.0/24
convert_ip_to_network() {
    IP_POM=($(tr '/' ' ' <<< "$1"))
    BC=${IP_POM[1]}
    IP_POM=($(tr '.' ' ' <<< "${IP_POM[0]}"))
    BCN="$(($BC - 1))"
    convert_net_to_mask "$BCN"
}

# implementace natu
nat() {
    # Tady zacina nat 1:1
    echo -n "Starting NAT 1:1..."

    # Kontrola na neexistujici konfiguracni soubor
    if [ ! -e $NAT_CONFIG ] && [ "$NAT_TYPE" != "tree" ]; then
        echo "error, $NAT_CONFIG does not exist!"
        return 0
    fi

    [ "$DUMMY_IFACE" == "" ] && DUMMY_IFACE="dummy0"
    [ "$DUMMY_IP" == "" ] && DUMMY_IP="`$IP addr show $DUMMY_IFACE | grep inet | grep -v inet6 | awk '{print \$2}' | cut -d \"/\" -f1`"

    if [ "$NAT_TYPE" == "tree" ]; then
        # Zakladni cast celkem peti stromu
        rm -rf $TMP
        mkdir -p $TMP
        # raw
        echo "*raw" >> "$TMP/table_raw"
        echo ":PREROUTING ACCEPT" >> "$TMP/table_raw"
        echo ":OUTPUT ACCEPT" >> "$TMP/table_raw"
        # nat
        echo "*nat" >> "$TMP/table_nat2"
        echo ":PREROUTING ACCEPT" >> "$TMP/table_nat2"
        echo ":POSTROUTING ACCEPT" >> "$TMP/table_nat2"
        echo ":OUTPUT ACCEPT" >> "$TMP/table_nat2"
        # mangle
        echo "*mangle" >> "$TMP/table_mangle"
        echo ":PREROUTING ACCEPT" >> "$TMP/table_mangle"
        echo ":INPUT ACCEPT" >> "$TMP/table_mangle"
        echo ":FORWARD ACCEPT" >> "$TMP/table_mangle"
        echo ":OUTPUT ACCEPT" >> "$TMP/table_mangle"
        echo ":POSTROUTING ACCEPT" >> "$TMP/table_mangle"
        # filter
        echo "*filter" >> "$TMP/table_fwd2"
        echo ":INPUT ACCEPT" >> "$TMP/table_fwd2"
        echo ":FORWARD ACCEPT" >> "$TMP/table_fwd2"
        echo ":OUTPUT ACCEPT" >> "$TMP/table_fwd2"
        IP_POM=""
        M1=""
        M2=""
        M3=""
        M4=""
        BC=""
        BCN=""
        # vytvorime zakladni chainy
        convert_net_to_mask "`echo $INTERNAL_IP | cut -d/ -f2`"
        INTERNAL_IP2="`echo $INTERNAL_IP | cut -d/ -f1`/$M1.$M2.$M3.$M4"
        convert_net_to_mask "`echo $EXTERNAL_IP | cut -d/ -f2`"
        EXTERNAL_IP2="`echo $EXTERNAL_IP | cut -d/ -f1`/$M1.$M2.$M3.$M4"
        echo ":chain_fwd - [0:0]" >> "$TMP/table_fwd"
        echo "-A FORWARD -s $INTERNAL_IP2 -i $NAT_DEV -j chain_fwd" >> "$TMP/table_fwd"
        echo ":chain_pre - [0:0]" >> "$TMP/table_nat"
        echo "-A PREROUTING -d $EXTERNAL_IP2 -i $NAT_DEV -j chain_pre" >> "$TMP/table_nat"
        echo ":chain_pre_2 - [0:0]" >> "$TMP/table_nat"
        echo "-A PREROUTING -s $INTERNAL_IP2 -d $EXTERNAL_IP2 ! -i $NAT_DEV -j chain_pre_2" >> "$TMP/table_nat"
        echo ":chain_post - [0:0]" >> "$TMP/table_nat"
        echo "-A POSTROUTING -s $INTERNAL_IP2 -o $NAT_DEV -j chain_post" >> "$TMP/table_nat"
        echo ":chain_post_2 - [0:0]" >> "$TMP/table_nat"
        echo "-A POSTROUTING -s $INTERNAL_IP2 -d $INTERNAL_IP2 ! -o $NAT_DEV -j chain_post_2" >> "$TMP/table_nat"
    fi

    echo ""
    # Ne vsude pouzivame jednotnou syntaxi
    while read UserName PublicIP PrivateIP; do # standardni v Czela Debianu, podle me nejlepsi! :)
        if [ "`echo $UserName | cut -c1`" == "#" ]; then
            # Prazdne radky preskocime, jen neprazdne radky povazujeme za uzivatele, tj. oznamime je jako zakomentovane
            if [ "`echo $UserName | cut -c2`" != " " ] && [ "`echo $UserName | cut -c2`" != "" ] && [ "`echo $UserName | cut -c2`" != "#" ]; then
                echo "    $UserName commented"
            fi
        else
            echo "    $UserName ($PrivateIP -> $PublicIP)"
            for LOCAL_IP in $PrivateIP; do
                PORT_TYPE=""
                PUBLIC_PORT=""
                PRIVATE_PORT=""
                # rozdeleni na porty
                if [ "`echo $LOCAL_IP | grep :`" != "" ]; then
                    PORT_TYPE="`echo $LOCAL_IP | cut -d: -f2`"
                    PUBLIC_PORT="`echo $LOCAL_IP | cut -d: -f3`"
                    PRIVATE_PORT="`echo $LOCAL_IP | cut -d: -f4`"
                fi
                # local ip musi byt jako posledni!
                LOCAL_IP="`echo $LOCAL_IP | cut -d: -f1`"
                if [ "`echo $PUBLIC_PORT | grep -`" != "" ]; then
                    PUBLIC_PORT="`echo $PUBLIC_PORT | cut -d- -f1`:`echo $PUBLIC_PORT | cut -d- -f2`"
                fi

                if [ "$NAT_TYPE" == "tree" ]; then
                    LOCAL_IP3=""
                    if [ "`echo $LOCAL_IP | grep /`" == "" ]; then
                        LOCAL_IP2="$LOCAL_IP"
                        LOCAL_IP=$LOCAL_IP/32
                    else
                        LOCAL_POM3="`echo $LOCAL_IP | cut -d/ -f2`"
                        if [ "$LOCAL_POM3" != "32" ]; then
                            convert_net_to_mask "$LOCAL_POM3"
                            LOCAL_IP2="`echo $LOCAL_IP | cut -d/ -f1`/$M1.$M2.$M3.$M4"
                            # pokud dostaneme zadany rozsah, pak natujeme na prvni adresu z daneho rozsahu
                            #LOCAL_IP3="`echo $LOCAL_IP | cut -d. -f1`.`echo $LOCAL_IP | cut -d. -f2`.`echo $LOCAL_IP | cut -d. -f3`.$((`echo $LOCAL_IP | cut -d. -f4 | cut -d/ -f1` + 1))"
                            LOCAL_IP3="`echo $LOCAL_IP | cut -d/ -f1`"
                        else
                            LOCAL_IP2="`echo $LOCAL_IP | cut -d/ -f1`"
                        fi
                    fi
                    if [ "`echo $PublicIP | grep /`" == "" ]; then
                        PublicIP2="$PublicIP"
                        PublicIP="${PublicIP}/32"
                    else
                        if [ "`echo $PublicIP | cut -d/ -f2`" != "32" ]; then
                            echo "Verejna adresa pro $UserName je zadana spatne!"
                        else
                            PublicIP2="`echo $PublicIP | cut -d/ -f1`"
                        fi
                    fi
                    # Tato cast je opet pro generovani stromu
                    # tam kde je rozdeleni podle INTERNAL_IP
                    # chain_post
                    I="0"
                    J="$((`echo $LOCAL_IP | cut -d/ -f2` - `echo $INTERNAL_IP | cut -d/ -f2`))"
                    IP_POM="$LOCAL_IP"
                    CHAINS_POST=""
                    CHAINS_POST_2=""
                    CHAINS_FWD=""
                    IP_POMS=""
                    while [ $I -lt $J ]; do
                        convert_ip_to_network "$IP_POM"
                        CHAIN="${IP_POM[0]}${IP_POM[1]}${IP_POM[2]}${IP_POM[3]}_$BC"
                        if [ "$I" == "0" ]; then
                            LOCAL_POM="$CHAIN"
                        fi
                        CHAIN_POST="chain_post_$CHAIN"
                        CHAIN_POST_2="chain_post_2_$CHAIN"
                        CHAIN_FWD="chain_fwd_$CHAIN"
                        echo ":$CHAIN_POST - [0:0]" >> "$TMP/table_nat"
                        echo ":$CHAIN_POST_2 - [0:0]" >> "$TMP/table_nat"
                        echo ":$CHAIN_FWD - [0:0]" >> "$TMP/table_fwd"
                        IP_POMS="${IP_POM[0]}.${IP_POM[1]}.${IP_POM[2]}.${IP_POM[3]}/$BC $IP_POMS"
                        CHAINS_POST="$CHAIN_POST $CHAINS_POST"
                        CHAINS_POST_2="$CHAIN_POST_2 $CHAINS_POST_2"
                        CHAINS_FWD="$CHAIN_FWD $CHAINS_FWD"
                        IP_POM="$((${IP_POM[0]} & $M1)).$((${IP_POM[1]} & $M2)).$((${IP_POM[2]} & $M3)).$((${IP_POM[3]} & $M4))/$BCN"
                        ((I++))
                    done
                    CHAINS_POST="chain_post $CHAINS_POST"
                    CHAINS_POST_2="chain_post_2 $CHAINS_POST_2"
                    CHAINS_FWD="chain_fwd $CHAINS_FWD"
                    I="1"
                    for IP_POM in $IP_POMS; do
                        CHAIN_POST="`echo $CHAINS_POST | cut -d \" \" -f $I`"
                        CHAIN_POST_2="`echo $CHAINS_POST_2 | cut -d \" \" -f $I`"
                        CHAIN_FWD="`echo $CHAINS_FWD | cut -d \" \" -f $I`"
                        CHAIND_POST="`echo $CHAINS_POST | cut -d \" \" -f $(($I + 1))`"
                        CHAIND_POST_2="`echo $CHAINS_POST_2 | cut -d \" \" -f $(($I + 1))`"
                        CHAIND_FWD="`echo $CHAINS_FWD | cut -d \" \" -f $(($I + 1))`"
                        if [ "`echo $IP_POM | cut -d/ -f2`" != "32" ]; then
                            convert_net_to_mask "`echo $IP_POM | cut -d/ -f2`"
                            IP_POM="`echo $IP_POM | cut -d/ -f1`/$M1.$M2.$M3.$M4"
                        else
                            IP_POM="`echo $IP_POM | cut -d/ -f1`"
                        fi
                        echo "-A $CHAIN_POST -s $IP_POM -j $CHAIND_POST" >> "$TMP/table_nat"
                        echo "-A $CHAIN_POST_2 -d $IP_POM -j $CHAIND_POST_2" >> "$TMP/table_nat"
                        echo "-A $CHAIN_FWD -d $IP_POM -j $CHAIND_FWD" >> "$TMP/table_fwd"
                        ((I++))
                    done
                    # pro ty kde je rozdeleni podle EXTERNAL_IP
                    # chain_pre
                    I="0"
                    J="$((`echo $PublicIP | cut -d/ -f2` - `echo $EXTERNAL_IP | cut -d/ -f2`))"
                    IP_POM="$PublicIP"
                    CHAINS_PRE=""
                    CHAINS_PRE_2=""
                    IP_POMS=""
                    while [ $I -lt $J ]; do
                        convert_ip_to_network "$IP_POM"
                        CHAIN="${IP_POM[0]}${IP_POM[1]}${IP_POM[2]}${IP_POM[3]}_$BC"
                        if [ "$I" == "0" ]; then
                            PUBLIC_POM="$CHAIN"
                        fi
                        CHAIN_PRE="chain_pre_$CHAIN"
                        CHAIN_PRE_2="chain_pre_2_$CHAIN"
                        echo ":$CHAIN_PRE - [0:0]" >> "$TMP/table_nat"
                        echo ":$CHAIN_PRE_2 - [0:0]" >> "$TMP/table_nat"
                        IP_POMS="${IP_POM[0]}.${IP_POM[1]}.${IP_POM[2]}.${IP_POM[3]}/$BC $IP_POMS"
                        CHAINS_PRE="$CHAIN_PRE $CHAINS_PRE"
                        CHAINS_PRE_2="$CHAIN_PRE_2 $CHAINS_PRE_2"
                        IP_POM="$((${IP_POM[0]} & $M1)).$((${IP_POM[1]} & $M2)).$((${IP_POM[2]} & $M3)).$((${IP_POM[3]} & $M4))/$BCN"
                        ((I++))
                    done
                    CHAINS_PRE="chain_pre $CHAINS_PRE"
                    CHAINS_PRE_2="chain_pre_2 $CHAINS_PRE_2"
                    I="1"
                    for IP_POM in $IP_POMS; do
                        CHAIN_PRE="`echo $CHAINS_PRE | cut -d \" \" -f $I`"
                        CHAIN_PRE_2="`echo $CHAINS_PRE_2 | cut -d \" \" -f $I`"
                        CHAIND_PRE="`echo $CHAINS_PRE | cut -d \" \" -f $(($I + 1))`"
                        CHAIND_PRE_2="`echo $CHAINS_PRE_2 | cut -d \" \" -f $(($I + 1))`"
                        if [ "`echo $IP_POM | cut -d/ -f2`" != "32" ]; then
                            convert_net_to_mask "`echo $IP_POM | cut -d/ -f2`"
                            IP_POM="`echo $IP_POM | cut -d/ -f1`/$M1.$M2.$M3.$M4"
                        else
                            IP_POM="`echo $IP_POM | cut -d/ -f1`"
                        fi
                        echo "-A $CHAIN_PRE -d $IP_POM -j $CHAIND_PRE" >> "$TMP/table_nat"
                        echo "-A $CHAIN_PRE_2 -d $IP_POM -j $CHAIND_PRE_2" >> "$TMP/table_nat"
                        ((I++))
                    done
                    # no a strom je za nami
                    # nat 1:1
                    if [ "$PUBLIC_PORT" == "" ]; then
                        # Pokud je vice zaznamu na jednu verejnou ip adresu, pak bude plnohodnotna verejna jen ta prvni (jeste se to da zoptimalizovat o cca 15 vterin pro 1500 zaznamu)
                        if [ "`cat $TMP/table_nat | grep \"chain_pre_$PUBLIC_POM\" | grep DNAT | grep -v \"dport\" | cut -d \" \" -f 4`" != "$PublicIP2" ]; then
                            if [ "$LOCAL_IP3" != "" ]; then
                                echo "-A chain_pre_$PUBLIC_POM -d $PublicIP2 -j DNAT --to-destination $LOCAL_IP3" >> "$TMP/table_nat"
                                echo "-A chain_pre_2_$PUBLIC_POM -d $PublicIP2 -j DNAT --to-destination $LOCAL_IP3" >> "$TMP/table_nat"
                                echo "-A chain_post_2_$LOCAL_POM -d $LOCAL_IP3 -j SNAT --to-source $DUMMY_IP" >> "$TMP/table_nat"
                            else
                                echo "-A chain_pre_$PUBLIC_POM -d $PublicIP2 -j DNAT --to-destination $LOCAL_IP2" >> "$TMP/table_nat"
                                echo "-A chain_pre_2_$PUBLIC_POM -d $PublicIP2 -j DNAT --to-destination $LOCAL_IP2" >> "$TMP/table_nat"
                                echo "-A chain_post_2_$LOCAL_POM -d $LOCAL_IP2 -j SNAT --to-source $DUMMY_IP" >> "$TMP/table_nat"
                            fi
                        fi
                        # Pokud je vice zaznamu na jednu vnitrni ip adresu, pak zahlasime chybu, radeji otevirame fwd, ktery je kratsi! (totot jeste taky jde zoptimalizovat o cca 10 vterin pro 1500 zaznamu)
                        if [ "`cat $TMP/table_fwd | grep \"chain_fwd_$LOCAL_POM\" | grep ACCEPT | grep -v \"dport\" | cut -d \" \" -f 4`" != "$LOCAL_IP2" ]; then
                            echo "-A chain_post_"$LOCAL_POM" -s $LOCAL_IP2 -j SNAT --to-source $PublicIP2" >> "$TMP/table_nat"
                            echo "-A chain_fwd_$LOCAL_POM -d $LOCAL_IP2 -j ACCEPT" >> "$TMP/table_fwd"
                        else
                            echo "Chyba, zaznam pro lokalni adresu uz existuje!"
                        fi
                    elif [ "$PRIVATE_PORT" == "" ]; then
                        # Zatim neni jasne jestli porty funguji spravne!!!
                        # Ohlidani spravnosti je tu dost narocne, to proste musi byt spravne!
                        echo "-A chain_pre_$PUBLIC_POM -d $PublicIP2 -p $PORT_TYPE -m $PORT_TYPE --dport $PUBLIC_PORT -j DNAT --to-destination $LOCAL_IP2" >> "$TMP/table_nat"
                        echo "-A chain_post_"$LOCAL_POM" -s $LOCAL_IP2 -j SNAT --to-source $PublicIP2" >> "$TMP/table_nat"
                        echo "-A chain_fwd_$LOCAL_POM -d $LOCAL_IP2 -p $PORT_TYPE -m $PORT_TYPE --dport $PUBLIC_PORT -j ACCEPT" >> "$TMP/table_fwd"
                        echo "-A chain_pre_2_$PUBLIC_POM -d $PublicIP2 -j DNAT --to-destination $LOCAL_IP2" >> "$TMP/table_nat"
                        echo "-A chain_post_2_$LOCAL_POM -d $LOCAL_IP2 -j SNAT --to-source $DUMMY_IP" >> "$TMP/table_nat"
                    else
                        # Ohlidani spravnosti je tu dost narocne, to proste musi byt spravne!
                        echo "-A chain_pre_$PUBLIC_POM -d $PublicIP2 -p $PORT_TYPE -m $PORT_TYPE --dport $PUBLIC_PORT -j DNAT --to-destination $LOCAL_IP2:$PRIVATE_PORT" >> "$TMP/table_nat"
                        echo "-A chain_post_"$LOCAL_POM" -s $LOCAL_IP2 -j SNAT --to-source $PublicIP2" >> "$TMP/table_nat"
                        echo "-A chain_fwd_$LOCAL_POM -d $LOCAL_IP2 -p $PORT_TYPE -m $PORT_TYPE --dport $PRIVATE_PORT -j ACCEPT" >> "$TMP/table_fwd"
                        echo "-A chain_pre_2_$PUBLIC_POM -d $PublicIP2 -p $PORT_TYPE -m $PORT_TYPE --dport $PUBLIC_PORT -j DNAT --to-destination $LOCAL_IP2:$PRIVATE_PORT" >> "$TMP/table_nat"
                        echo "-A chain_post_2_$LOCAL_POM -d $LOCAL_IP2 -p $PORT_TYPE -m $PORT_TYPE --dport $PRIVATE_PORT -j SNAT --to-source $DUMMY_IP" >> "$TMP/table_nat"
                    fi
                else
#echo $PublicIP $LOCAL_IP
                    # zakladni nat 1:1 - originalni verze
                    if [ "$PUBLIC_PORT" == "" ]; then
                        $IPTABLES -t nat -I PREROUTING -d $PublicIP -j DNAT --to $LOCAL_IP
                        $IPTABLES -t nat -I POSTROUTING -o $NAT_DEV -s $LOCAL_IP -j SNAT --to $PublicIP
                        $IPTABLES -I FORWARD -i $NAT_DEV -d $LOCAL_IP -j ACCEPT
                    elif [ "$PRIVATE_PORT" == "" ]; then
                        $IPTABLES -t nat -I PREROUTING -d $PublicIP -p $PORT_TYPE --dport $PUBLIC_PORT -j DNAT --to $LOCAL_IP
                        $IPTABLES -t nat -I POSTROUTING -o $NAT_DEV -s $LOCAL_IP -j SNAT --to $PublicIP
                        $IPTABLES -I FORWARD -i $NAT_DEV -d $LOCAL_IP -p $PORT_TYPE --dport $PUBLIC_PORT -j ACCEPT
                    else
                        $IPTABLES -t nat -I PREROUTING -d $PublicIP -p $PORT_TYPE --dport $PUBLIC_PORT -j DNAT --to $LOCAL_IP:$PRIVATE_PORT
                        $IPTABLES -t nat -I POSTROUTING -o $NAT_DEV -s $LOCAL_IP -j SNAT --to $PublicIP
                        $IPTABLES -I FORWARD -i $NAT_DEV -d $LOCAL_IP -p $PORT_TYPE --dport $PRIVATE_PORT -j ACCEPT
                    fi
                    # Zaroven by bylo pekne zevnitr site na svou verejnou ip pingnout,
                    # pro tohle je idealne nutne mit dummy, dalsi moznost je nastavit
                    # DUMMY_IFACE na jedno z rozhrani LAN, kde se neprovadi nat.
                    if [ "$DUMMY_IP" != "" ]; then
                        if [ "$PUBLIC_PORT" == "" ]; then
                            $IPTABLES -t nat -I PREROUTING ! -i $NAT_DEV -s $INTERNAL_IP -d $PublicIP -j DNAT --to $LOCAL_IP
                            $IPTABLES -t nat -I POSTROUTING ! -o $NAT_DEV -s $INTERNAL_IP -d $LOCAL_IP -j SNAT --to $DUMMY_IP
                        elif [ "$PRIVATE_PORT" == "" ]; then
                            $IPTABLES -t nat -I PREROUTING ! -i $NAT_DEV -s $INTERNAL_IP -d $PublicIP -p $PORT_TYPE --dport $PUBLIC_PORT -j DNAT --to $LOCAL_IP
                            $IPTABLES -t nat -I POSTROUTING ! -o $NAT_DEV -s $INTERNAL_IP -d $LOCAL_IP -p $PORT_TYPE --dport $PUBLIC_PORT -j SNAT --to $DUMMY_IP
                        else
                            $IPTABLES -t nat -I PREROUTING ! -i $NAT_DEV -s $INTERNAL_IP -d $PublicIP -p $PORT_TYPE --dport $PUBLIC_PORT -j DNAT --to $LOCAL_IP:$PRIVATE_PORT
                            $IPTABLES -t nat -I POSTROUTING ! -o $NAT_DEV -s $INTERNAL_IP -d $LOCAL_IP -p $PORT_TYPE --dport $PRIVATE_PORT -j SNAT --to $DUMMY_IP
                        fi
                    fi
                fi
            done
        fi
    done < $NAT_CONFIG

    # V pripade typu natu "tree", musime spojit soubory do jedine tabulky
    if [ "$NAT_TYPE" == "tree" ]; then
        cat $TMP/table_nat | sort -k 2.1 | uniq >> $TMP/table_nat2
        cat $TMP/table_fwd | sort -k 2.1 | uniq >> $TMP/table_fwd2
        cat "$TMP/table_raw" >> "$TMP/table"
        echo "COMMIT" >> "$TMP/table"
        cat "$TMP/table_nat2" >> "$TMP/table"
        echo "COMMIT" >> "$TMP/table"
        cat "$TMP/table_mangle" >> "$TMP/table"
        echo "COMMIT" >> "$TMP/table"
        cat "$TMP/table_fwd2" >> "$TMP/table"
        echo "COMMIT" >> "$TMP/table"
        echo "done."
    fi
}
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
   <head>
      <meta http-equiv="content-type" content="text/html;charset=UTF-8">
      <meta http-equiv="generator" content="WebSVN 2.2.1" /> <!-- leave this for stats -->
      <link rel="shortcut icon" type="image/x-icon" href="./templates/BlueGrey/favicon.ico" />
      <link type="text/css" href="./templates/BlueGrey/styles.css" rel="stylesheet" media="screen">
      <!--[if lt IE 7]>
      <script type="text/javascript" src="./templates/BlueGrey/png.js"></script>
      <![endif]-->
      <script type="text/javascript" src="./templates/BlueGrey/collapse.js"></script>
      <title>
         WebSVN
            - freenet-router
            - Blame
               - Rev 2
            - /trunk/freenet-router/etc/firewall/nat
      </title>

      <script type="text/javascript">
         function checkCB(chBox)
         {
            count = 0
            first = null
            f = chBox.form
            for (i = 0 ; i < f.elements.length ; i++)
            if (f.elements[i].type == 'checkbox' && f.elements[i].checked)
            {
               if (first == null && f.elements[i] != chBox)
                  first = f.elements[i]
               count += 1
            }
            
            if (count > 2) 
            {
               first.checked = false
               count -= 1
            }
         }
         
      </script>


</head>
<body>
	<table width="100%" border="0">
	  <tr>
		<td width="13%">&nbsp;</td>
		<td width="73%" align="center"><a href="http://www.jablonka.cz/"><img style="border: 0; width: 201px; height: 51px;" src="./templates/BlueGrey/logo.png" alt="jablonka.cz" /></a><a href="http://www.prosek.czf/"><img style="border: 0; width: 528px; height: 51px;" src="./templates/BlueGrey/squares.png" alt="prosek.czf" /></a></td>
		<td width="13%"><div style="float: right"><form action="?path=%2Ftrunk%2Ffreenet-router%2Fetc%2Ffirewall%2Fnat&amp;repname=freenet-router&amp;rev=2" method="post" id="langform"><select name="langchoice" onchange="javascript:this.form.submit();"><option value="ca">Catal&agrave;-Valenci&agrave; - Catalan</option><option value="cs">&#268;esky - Cesky</option><option value="da">Dansk - Dansk</option><option value="nl">Dutch - Dutch</option><option value="en" selected="selected">English - English</option><option value="fi">Finnish - Finnish</option><option value="fr">Fran&ccedil;ais - Francais</option><option value="de">Deutsch - German</option><option value="he-IL">&#1506;&#1489;&#1512;&#1497;&#1514; - Hebrew</option><option value="hu">Magyar - Hungarian</option><option value="id">Bahasa Indonesia - Indonesian</option><option value="it">Italiano - Italian</option><option value="ja">&#26085;&#26412;&#35486; - Japanese</option><option value="ko">&#54620;&#44397;&#50612; - Korean</option><option value="no">Norsk - Norwegian</option><option value="pl">Polski - Polish</option><option value="pt">Portugu&ecirc;s - Portuguese</option><option value="pt-BR">Portugu&ecirc;s - Brazilian Portuguese</option><option value="ru">&#1056;&#1091;&#1089;&#1089;&#1082;&#1080;&#1081; - Russian</option><option value="zh-CN">&#20013;&#25991; - Simplified Chinese</option><option value="sk">Sloven&#269;ina - Slovak</option><option value="sl">Sloven&#269;ina - Slovenian</option><option value="es">Espa&ntilde;ol - Spanish</option><option value="sv">Svenska - Swedish</option><option value="zh-TW">&#20013;&#25991; - Traditional Chinese</option><option value="tr">T&uuml;rk&ccedil;e - Turkish</option><option value="uz">O&euml;zbekcha - Uzbek</option></select><input type="submit" value="Go" /></form></div></td>
	  </tr>
	</table>
	<hr />
<table cellspacing="0" cellpadding="0" border="0" width="100%">
  <tr>
    <td align="left"><h1>freenet-router</h1></td>
    <td align="right"><b>Subversion Repositories:</b> <form action="form.php?" method="post" id="projectform"><select name="repname" onchange="javascript:this.form.submit();"><option value="banderdyn">banderdyn</option><option value="centos.prosek.czf">centos.prosek.czf</option><option value="crusader">crusader</option><option value="czf4bfu">czf4bfu</option><option value="czf4bfu.prosek.czf">czf4bfu.prosek.czf</option><option value="czfcentos">czfcentos</option><option value="czfgmap">czfgmap</option><option value="discover">discover</option><option value="fedora.prosek.czf">fedora.prosek.czf</option><option value="freenet-router" selected="selected">freenet-router</option><option value="ftth">ftth</option><option value="getonlineclouds">getonlineclouds</option><option value="hotsanic">hotsanic</option><option value="internet.prosek.czf">internet.prosek.czf</option><option value="is">is</option><option value="mapstats">mapstats</option><option value="meteolinger">meteolinger</option><option value="netmap">netmap</option><option value="qos">qos</option><option value="sedlo">sedlo</option><option value="sedlo.prosek.czf">sedlo.prosek.czf</option><option value="switches">switches</option><option value="vbtobb">vbtobb</option><option value="vlubnt">vlubnt</option><option value="weathermap">weathermap</option><option value="weatherstats">weatherstats</option><option value="websvn">websvn</option><option value="wifidashboard">wifidashboard</option><option value="wifimon">wifimon</option><option value="www.prosek.czf">www.prosek.czf</option><option value="xenstats">xenstats</option></select><input type="submit" value="Go" /><input type="hidden" name="selectproj" value="1" /><input type="hidden" name="op" value="form" /></form></td>
  </tr>
</table>

[<a href="listing.php?repname=freenet-router&amp;path=%2F&amp;rev=2">/</a>] [<a href="listing.php?repname=freenet-router&amp;path=%2Ftrunk%2F&amp;rev=2">trunk/</a>] [<a href="listing.php?repname=freenet-router&amp;path=%2Ftrunk%2Ffreenet-router%2F&amp;rev=2">freenet-router/</a>] [<a href="listing.php?repname=freenet-router&amp;path=%2Ftrunk%2Ffreenet-router%2Fetc%2F&amp;rev=2">etc/</a>] [<a href="listing.php?repname=freenet-router&amp;path=%2Ftrunk%2Ffreenet-router%2Fetc%2Ffirewall%2F&amp;rev=2">firewall/</a>] [<b>nat</b>] - Blame information for rev <b>2</b>
<p>&nbsp;</p>

<table cellpadding="2" cellspacing="0" width="100%" class="blameTbl">
	<thead>
		<tr>
			<th class="HdrClmn"><b>Line No.</b></th>
			<th class="HdrClmn"><b>Rev</b></th>
			<th class="HdrClmn"><b>Author</b></th>
			<th class="HdrClmnEnd"><b>Line</b></th>
		</tr>
	</thead>
	<tbody>
	</tbody>
</table> 


<script type='text/javascript'>
/* <![CDATA[ */
var rev = new Array();
var a = document.getElementsByTagName('a');
for (var i = 0; i < a.length; i++) {
  if (a[i].className == 'blame-revision') {
    var id = a[i].id;
    addEvent(a[i], 'mouseover', function() { mouseover(this) } );
    addEvent(a[i], 'mouseout', function() { mouseout(this) } );
  }
}

function mouseover(a) {
  // Find the revision by using the link
  var m = /rev=(\d+)/.exec(a.href);
  var r = m[1];

  div = document.createElement('div');
  div.className = 'blame-popup';
  div.innerHTML = rev[r];
  a.parentNode.appendChild(div);
}

function mouseout(a) {
  var div = a.parentNode.parentNode.getElementsByTagName('div');
  for (var i = 0; i < div.length; i++) {
    if (div[i].className = 'blame-popup') {
      div[i].parentNode.removeChild(div[i]);
    }
  }
}

function addEvent(obj, type, func) {
  if (obj.addEventListener) {
    obj.addEventListener(type, func, false);
    return true;
  } else if (obj.attachEvent) {
    return obj.attachEvent('on' + type, func);
  } else {
    return false;
  }
}
/* ]]> */
</script>

      <p><center><font size="-1"><i><b>Powered by <a href="http://www.websvn.info/">WebSVN</a> 2.2.1</b></i></font></center>
   </body>
</html>