ebtables \
--concurrent \
-t nat \
-A libvirt-P-vnet0 \
-p 0x1234 \
-j ACCEPT
ebtables \
--concurrent \
-t nat \
-A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \
-p ipv4 \
--ip-source 10.1.2.3/32 \
--ip-destination 10.1.2.3/32 \
--ip-protocol 17 \
--ip-source-port 291:564 \
--ip-destination-port 13398:17767 \
--ip-tos 0x32 \
-j ACCEPT
ebtables \
--concurrent \
-t nat \
-A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:fe \
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:80 \
-p ipv6 \
--ip6-source ::ffff:10.1.2.3/22 \
--ip6-destination ::ffff:10.1.2.3/113 \
--ip6-protocol 6 \
--ip6-source-port 273:400 \
--ip6-destination-port 13107:65535 \
-j ACCEPT
ebtables \
--concurrent \
-t nat \
-A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \
-p 0x806 \
--arp-htype 18 \
--arp-opcode 1 \
--arp-ptype 0x56 \
--arp-mac-src 01:02:03:04:05:06 \
--arp-mac-dst 0a:0b:0c:0d:0e:0f \
-j ACCEPT
iptables \
-w \
-A FJ-vnet0 \
-p udp \
-m mac \
--mac-source 01:02:03:04:05:06 \
--destination 10.1.2.3/32 \
-m dscp \
--dscp 34 \
--sport 291:400 \
--dport 564:1092 \
-m conntrack \
--ctstate NEW,ESTABLISHED \
-m conntrack \
--ctdir Original \
-m comment \
--comment 'udp rule' \
-j RETURN
iptables \
-w \
-A FP-vnet0 \
-p udp \
--source 10.1.2.3/32 \
-m dscp \
--dscp 34 \
--dport 291:400 \
--sport 564:1092 \
-m conntrack \
--ctstate ESTABLISHED \
-m conntrack \
--ctdir Reply \
-m comment \
--comment 'udp rule' \
-j ACCEPT
iptables \
-w \
-A HJ-vnet0 \
-p udp \
-m mac \
--mac-source 01:02:03:04:05:06 \
--destination 10.1.2.3/32 \
-m dscp \
--dscp 34 \
--sport 291:400 \
--dport 564:1092 \
-m conntrack \
--ctstate NEW,ESTABLISHED \
-m conntrack \
--ctdir Original \
-m comment \
--comment 'udp rule' \
-j RETURN
ip6tables \
-w \
-A FJ-vnet0 \
-p tcp \
--destination a:b:c::/128 \
-m dscp \
--dscp 57 \
--dport 32:33 \
--sport 256:4369 \
-m conntrack \
--ctstate ESTABLISHED \
-m conntrack \
--ctdir Reply \
-m comment \
--comment 'tcp/ipv6 rule' \
-j RETURN
ip6tables \
-w \
-A FP-vnet0 \
-p tcp \
-m mac \
--mac-source 01:02:03:04:05:06 \
--source a:b:c::/128 \
-m dscp \
--dscp 57 \
--sport 32:33 \
--dport 256:4369 \
-m conntrack \
--ctstate NEW,ESTABLISHED \
-m conntrack \
--ctdir Original \
-m comment \
--comment 'tcp/ipv6 rule' \
-j ACCEPT
ip6tables \
-w \
-A HJ-vnet0 \
-p tcp \
--destination a:b:c::/128 \
-m dscp \
--dscp 57 \
--dport 32:33 \
--sport 256:4369 \
-m conntrack \
--ctstate ESTABLISHED \
-m conntrack \
--ctdir Reply \
-m comment \
--comment 'tcp/ipv6 rule' \
-j RETURN
ip6tables \
-w \
-A FJ-vnet0 \
-p udp \
-m conntrack \
--ctstate ESTABLISHED \
-m conntrack \
--ctdir Reply \
-m comment \
--comment '`ls`;${COLUMNS};$(ls);"test";&'\''3   spaces'\''' \
-j RETURN
ip6tables \
-w \
-A FP-vnet0 \
-p udp \
-m conntrack \
--ctstate NEW,ESTABLISHED \
-m conntrack \
--ctdir Original \
-m comment \
--comment '`ls`;${COLUMNS};$(ls);"test";&'\''3   spaces'\''' \
-j ACCEPT
ip6tables \
-w \
-A HJ-vnet0 \
-p udp \
-m conntrack \
--ctstate ESTABLISHED \
-m conntrack \
--ctdir Reply \
-m comment \
--comment '`ls`;${COLUMNS};$(ls);"test";&'\''3   spaces'\''' \
-j RETURN
ip6tables \
-w \
-A FJ-vnet0 \
-p sctp \
-m conntrack \
--ctstate ESTABLISHED \
-m conntrack \
--ctdir Reply \
-m comment \
--comment 'comment with lone '\'', `, ", `, \, $x, and two  spaces' \
-j RETURN
ip6tables \
-w \
-A FP-vnet0 \
-p sctp \
-m conntrack \
--ctstate NEW,ESTABLISHED \
-m conntrack \
--ctdir Original \
-m comment \
--comment 'comment with lone '\'', `, ", `, \, $x, and two  spaces' \
-j ACCEPT
ip6tables \
-w \
-A HJ-vnet0 \
-p sctp \
-m conntrack \
--ctstate ESTABLISHED \
-m conntrack \
--ctdir Reply \
-m comment \
--comment 'comment with lone '\'', `, ", `, \, $x, and two  spaces' \
-j RETURN
ip6tables \
-w \
-A FJ-vnet0 \
-p ah \
-m conntrack \
--ctstate ESTABLISHED \
-m conntrack \
--ctdir Reply \
-m comment \
--comment 'tmp=`mktemp`; echo ${RANDOM} > ${tmp} ; cat < ${tmp}; rm -f ${tmp}' \
-j RETURN
ip6tables \
-w \
-A FP-vnet0 \
-p ah \
-m conntrack \
--ctstate NEW,ESTABLISHED \
-m conntrack \
--ctdir Original \
-m comment \
--comment 'tmp=`mktemp`; echo ${RANDOM} > ${tmp} ; cat < ${tmp}; rm -f ${tmp}' \
-j ACCEPT
ip6tables \
-w \
-A HJ-vnet0 \
-p ah \
-m conntrack \
--ctstate ESTABLISHED \
-m conntrack \
--ctdir Reply \
-m comment \
--comment 'tmp=`mktemp`; echo ${RANDOM} > ${tmp} ; cat < ${tmp}; rm -f ${tmp}' \
-j RETURN