X-Git-Url: https://git.harvie.cz/?a=blobdiff_plain;f=prometheus.c;h=5a9492e3e7592cc4cf8fac51f5a98e674039016e;hb=dba7666bdacf8846560e5414b6c9535434e98f8b;hp=71b2a32e13c9a8188cac8dea38a67d22d0736e42;hpb=56f6397ec3e60052dce31b6417ff64572b880897;p=svn%2FPrometheus-QoS%2F.git

diff --git a/prometheus.c b/prometheus.c
index 71b2a32..5a9492e 100644
--- a/prometheus.c
+++ b/prometheus.c
@@ -2,12 +2,12 @@
 /* Prometheus QoS - you can "steal fire" from your ISP         */
 /* "fair-per-IP" quality of service (QoS) utility              */
 /* requires Linux 2.4.x or 2.6.x with HTB support              */
-/* Copyright(C) 2005-2017 Michael Polak, Arachne Aerospace     */
+/* Copyright(C) 2005-2019 Michael Polak, Arachne Aerospace     */
 /* iptables-restore support Copyright(C) 2007-2008 ludva       */
 /* Credit: CZFree.Net,Martin Devera,Netdave,Aquarius,Gandalf  */
 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
 
-/* Modified by: xChaos, 20171012
+/* Modified by: xChaos, 20190212
                  ludva, 20080415
  
    Prometheus QoS is free software; you can redistribute it and/or
@@ -29,7 +29,7 @@
 #include "cll1-0.6.2.h"
 #include "ipstruct.h"
 
-const char *version = "0.9.0-a";
+const char *version = "0.9.1";
 
 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
 /* Versions: 0.9.0 is development release, 1.0 will be "stable"    */
@@ -40,7 +40,7 @@ const char *version = "0.9.0-a";
 /* Warning: unofficial Github mirror is not supported by author!  */
 /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */
 
-const char *stats_html_signature = "<span class=\"small\">Statistics generated by Prometheus QoS version %s<br />GPL+Copyright(C)2005-2017 Michael Polak, <a target=\"_blank\" href=\"http://www.arachne.cz/\">Arachne Labs</a></span>\n";
+const char *stats_html_signature = "<span class=\"small\">Statistics generated by Prometheus QoS version %s<br />GPL+Copyright(C)2005-2019 Michael Polak, <a target=\"_blank\" href=\"http://www.arachne.cz/\">Arachne Labs</a></span>\n";
 
 #define STRLEN 512
 #undef DEBUG
@@ -61,6 +61,7 @@ char           *hosts = "/etc/prometheus/hosts"; /* per-IP bandwidth definition
 char      *macrosfile = "/etc/prometheus/prometheus.macros"; /* rewrite rules for most common tariffs */
 char    *upstreamfile = "/etc/prometheus/upstream.interfaces"; /* list of interfaces to manage */
 char  *downstreamfile = "/etc/prometheus/downstream.interfaces"; /* list of interfaces to manage */
+char     *qosfreefile = "/etc/prometheus/qosfree.interfaces"; /* list of interfaces to manage */
 char    *iptablesfile = "/var/spool/prometheus.iptables"; /* temporary file for iptables-restore*/
 char   *ip6tablesfile = "/var/spool/prometheus.ip6tables"; /* temporary file for ip6tables-restore*/
 char          *credit = "/var/lib/misc/prometheus.credit"; /* credit log file */
@@ -86,6 +87,8 @@ char      *final_chain = "DROP"; /* REJECT would be better, but it is impossible
 char             *mark = "MARK";
 char    *mark_iptables = "MARK --set-mark ";
 int            dry_run = FALSE; /* preview - use puts() instead of system() */
+int      mix_new_hosts = FALSE; /* execute only commands not already in log of iptables */
+char    *log_file_mode = "w";   /* overwrite command and iptables log files, except append in -x mode */
 char *iptablespreamble = "*mangle\n:PREROUTING ACCEPT [0:0]\n:POSTROUTING ACCEPT [0:0]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]";
 char      *ip6preamble = "-A FORWARD -p ipv6-icmp -j ACCEPT\n-A POSTROUTING -p ipv6-icmp -j ACCEPT\n-A FORWARD -s fe80::/10 -j ACCEPT\n-A FORWARD -d ff00::/8 -j ACCEPT\n-A POSTROUTING -s fe80::/10 -j ACCEPT\n-A POSTROUTING -d ff00::/8 -j ACCEPT";
 FILE    *iptables_file = NULL;
@@ -125,12 +128,12 @@ int           ip_count = 0;
 FILE         *log_file = NULL;
 char              *kwd = "via-prometheus"; /* /etc/hosts comment, eg. #qos-64-128 */
 
-const int highest_priority   = 0; /* highest HTB priority (HTB built-in value is 0) */
-const int lowest_priority    = 7; /* lowest HTB priority /include/uapi/linux/pkt_sched.h: #define TC_HTB_NUMPRIO 8 */
-const int idxtable_treshold1 = 24;      /* this is no longer configurable */
-const int idxtable_treshold2 = 12;      /* this is no longer configurable */
-const int idxtable_bitmask1  = 3;        /* this is no longer configurable */
-const int idxtable_bitmask2  = 3;        /* this is no longer configurable */
+const int highest_priority   = 0;  /* highest HTB priority (HTB built-in value is 0) */
+const int lowest_priority    = 7;  /* lowest HTB priority /include/uapi/linux/pkt_sched.h: #define TC_HTB_NUMPRIO 8 */
+const int idxtable_treshold1 = 24; /* this is no longer configurable */
+const int idxtable_treshold2 = 12; /* this is no longer configurable */
+const int idxtable_bitmask1  = 3;  /* this is no longer configurable */
+const int idxtable_bitmask2  = 3;  /* this is no longer configurable */
 
 struct IP *ips = NULL, *networks = NULL, *ip, *sharedip;
 struct Group *groups = NULL, *group;
@@ -138,6 +141,8 @@ struct Keyword *keyword, *defaultkeyword=NULL, *keywords = NULL;
 struct Macro *macro, *macros = NULL;
 struct Index *idxs = NULL, *idx, *metaindex;
 struct Interface *interfaces = NULL, *interface;
+struct QosFreeInterface *qosfreeinterfaces = NULL, *qosfreeinterface;
+struct Textfile *previous_commands = NULL, *previous_iptables = NULL, *previous_ip6tables = NULL, *previous_classmap = NULL, *textline;
 
 #define FREE_CLASS      3
 #define OVERLIMIT_CLASS 4
@@ -182,7 +187,6 @@ const char *tr_odd_even(void)
  }
 }
 
-
 /* ====== iptables indexes are used to reduce complexity to log8(N) ===== */
 
 char *index_id(char *ip, int bitmask);
@@ -290,6 +294,7 @@ void get_config(char *config_filename)
   option("hosts",hosts);
   option("downstream-interfaces-list-filename",downstreamfile);
   option("upstream-interfaces-list-filename",upstreamfile);
+  option("qos-free-interfaces-list-filename",qosfreefile);
   option("macros-filename",macrosfile);
   option("ip6-prefix",ip6prefix);
   option("medium",medium);
@@ -375,9 +380,31 @@ void safe_run(char *cmd)
  }
  else
  {
-  system(cmd);
+  int skip_cmd = FALSE;
+  if(mix_new_hosts)
+  {
+   skip_cmd = FALSE;
+   for_each(textline, previous_commands)
+   {
+    if(eq(textline->str, cmd))
+    {
+     skip_cmd = TRUE;
+     break;
+    }
+   }
+  }
+ 
+  if(!skip_cmd)
+  {
+   if(mix_new_hosts)
+   {
+    printf("Executing command: %s\n", cmd);
+   }
+   else
+    system(cmd);
+  }
  }
- if(log_file)
+ if(log_file && !mix_new_hosts)//!!debug
  {
   fprintf(log_file,"%s\n",cmd);
  }
@@ -385,16 +412,47 @@ void safe_run(char *cmd)
 
 void iptables_save_line(char *line, int ipv6)
 {
+ const char *cmd = NULL;
+    
  if(ipv6)
  {
-  fprintf(ip6tables_file,"%s\n",line);
+  if(mix_new_hosts)
+   for_each(textline, previous_ip6tables)
+    if(eq(textline->str, line))
+    {
+     printf("Match: %s\n",line);
+     return;
+    }
+
+  if(!mix_new_hosts) //!!debug
+   fprintf(ip6tables_file,"%s\n",line);
+  cmd = ip6tables;
  }
  else
  {
-  fprintf(iptables_file,"%s\n",line);
+  if(mix_new_hosts)
+   for_each(textline, previous_iptables)
+    if(eq(textline->str, line))
+    {
+     printf("Match: %s\n",line);
+     return;
+    }     
+
+  if(!mix_new_hosts) //!!debug
+   fprintf(iptables_file,"%s\n",line);
+  cmd = iptables;
  }
+ if(mix_new_hosts)
+ {
+ 
+  printf("Executing command: %s %s\n",cmd, line);
+ } 
 }
 
+#define IPv4 FALSE
+#define IPv6 TRUE
+
+
 void run_iptables_restore(void)
 {
  char *restor;
@@ -404,7 +462,7 @@ void run_iptables_restore(void)
  printf("Running %s <%s ...\n", iptablesrestore, iptablesfile);
  /*-----------------------------------------------------------------*/
 
- iptables_save_line("COMMIT", FALSE);
+ iptables_save_line("COMMIT", IPv4);
  fclose(iptables_file);
  if(dry_run) 
  {
@@ -423,7 +481,7 @@ void run_iptables_restore(void)
   /*-----------------------------------------------------------------*/
   printf("Running %s <%s ...\n", ip6tablesrestore, ip6tablesfile);
   /*-----------------------------------------------------------------*/
-  iptables_save_line("COMMIT", TRUE);
+  iptables_save_line("COMMIT", IPv6);
   fclose(ip6tables_file);
   if(dry_run) 
   {
@@ -462,7 +520,7 @@ program
  int just_preview  = FALSE;       /* preview - generate just stats */
  int start_shaping = FALSE;       /* apply FUP - requires classmap file */
  int stop_shaping  = FALSE;       /* lift FUP - requires classmap file */
- int reduce_ceil     = 0;           /* allow only rate+(ceil-rate)/2, /4, etc. */
+ int reduce_ceil   = 0;           /* allow only rate+(ceil-rate)/2, /4, etc. */
  int just_logs     = FALSE;       /* just parse logs */
  int run           = FALSE;
  int total         = 0;
@@ -471,7 +529,7 @@ program
   
  printf("\n\
 Prometheus QoS - \"fair-per-IP\" Quality of Service setup utility.\n\
-Version %s - Copyright (C)2005-2017 Michael Polak, Arachne Labs\n\
+Version %s - Copyright (C)2005-2019 Michael Polak, Arachne Labs\n\
 iptables-restore & burst tunning & classify modification by Ludva\n\
 Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 
@@ -480,20 +538,21 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
  {
   argument("-c") { nextargument(config); }
   argument("-h") { nextargument(althosts);}
-  argument("-d") { run=TRUE; dry_run=TRUE; }
-  argument("-f") { run=TRUE; just_flush=TRUE; }
-  argument("-9") { run=TRUE; just_flush=9; }
-  argument("-p") { run=TRUE; just_preview=TRUE; }
-  argument("-q") { run=TRUE; just_preview=TRUE; stop_shaping=TRUE; }
-  argument("-2") { run=TRUE; just_preview=TRUE; reduce_ceil=2; }
-  argument("-4") { run=TRUE; just_preview=TRUE; reduce_ceil=4; }
-  argument("-s") { run=TRUE; just_preview=TRUE; start_shaping=TRUE; }
-  argument("-r") { run=TRUE; }
-  argument("-n") { run=TRUE; nodelay=TRUE; }
-  argument("-a") { run=TRUE; just_networks=TRUE; }
-  argument("-l") { just_logs=TRUE; }
-  argument("-m") { just_logs=TRUE; }
-  argument("-y") { just_logs=TRUE; }
+  argument("-d") { run = TRUE; dry_run = TRUE; }
+  argument("-f") { run = TRUE; just_flush = TRUE; }
+  argument("-9") { run = TRUE; just_flush = 9; }
+  argument("-p") { run = TRUE; just_preview = TRUE; }
+  argument("-q") { run = TRUE; just_preview = TRUE; stop_shaping = TRUE; }
+  argument("-2") { run = TRUE; just_preview = TRUE; reduce_ceil = 2; }
+  argument("-4") { run = TRUE; just_preview = TRUE; reduce_ceil = 4; }
+  argument("-s") { run = TRUE; just_preview = TRUE; start_shaping = TRUE; }
+  argument("-x") { run = TRUE; mix_new_hosts = TRUE; log_file_mode = "a"; }
+  argument("-r") { run = TRUE; }
+  argument("-n") { run = TRUE; nodelay = TRUE; }
+  argument("-a") { run = TRUE; just_networks = TRUE; }
+  argument("-l") { just_logs = TRUE; }
+  argument("-m") { just_logs = TRUE; }
+  argument("-y") { just_logs = TRUE; }
   argument("-?") { help(); exit(0); }
   argument("--help") { help(); exit(0); }
   argument("-v") { exit(0); } 
@@ -562,7 +621,6 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
   }
  }
  done; /* ugly macro end */
-
  
  if(just_logs)
  {
@@ -580,7 +638,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
   hosts = althosts;
  }
 
- if(just_flush<9)
+ if(!mix_new_hosts && just_flush<9)
  {
   /*-----------------------------------------------------------------*/
   puts("Parsing iptables verbose output ...");
@@ -601,6 +659,12 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
  string(str, STRLEN); 
  string(limit_pkts, STRLEN);
 
+ /*-----------------------------------------------------------------*/
+ printf("Parsing qos free interfaces file %s ...\n", qosfreefile);
+ /*-----------------------------------------------------------------*/
+ load(qosfreeinterface, qosfreeinterfaces,
+      qosfreefile, QosFreeInterface, name);
+
  /*-----------------------------------------------------------------*/
  printf("Parsing macro definition file %s ...\n", macrosfile);
  /*-----------------------------------------------------------------*/
@@ -618,8 +682,6 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
  }
  done; /* ugly macro end */
 
-
-
  /*-----------------------------------------------------------------*/
  printf("Parsing class defintion file %s ...\n", hosts);
  /*-----------------------------------------------------------------*/
@@ -633,6 +695,27 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
  }
 */
 
+ if(mix_new_hosts)
+ {
+  char *eoln;
+  /*-----------------------------------------------------------------*/
+  printf("Loading log of previously executed commands %s ...\n", cmdlog);
+  /*-----------------------------------------------------------------*/
+  load(textline, previous_commands, cmdlog, Textfile, str);
+  /*-----------------------------------------------------------------*/
+  printf("Loading log of iptables-restore commands %s ...\n", iptablesfile);
+  /*-----------------------------------------------------------------*/
+  load(textline, previous_iptables, iptablesfile, Textfile, str);
+  /*-----------------------------------------------------------------*/
+  printf("Loading log of ip6tables-restore commands %s ...\n", ip6tablesfile);
+  /*-----------------------------------------------------------------*/
+  load(textline, previous_ip6tables, ip6tablesfile, Textfile, str);
+ /*-----------------------------------------------------------------*/
+  printf("Loading map of IP addresses to tc classes  %s ...\n", classmap);
+  /*-----------------------------------------------------------------*/
+  load(textline, previous_classmap, classmap, Textfile, str);
+ }
+
  /*-----------------------------------------------------------------*/
  puts("Resolving shared connections ...");
  /*-----------------------------------------------------------------*/
@@ -673,7 +756,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
   }
  }
 
- if(enable_credit && just_flush<9)
+ if(!mix_new_hosts && enable_credit && just_flush<9)
  {
   /*-----------------------------------------------------------------*/
   printf("Parsing credit file %s ...\n", credit);
@@ -695,33 +778,36 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 
  if(!just_preview)
  {
-  /*-----------------------------------------------------------------*/
-  puts("Initializing iptables and tc classes ...");
-  /*-----------------------------------------------------------------*/
-  
-  iptables_file = fopen(iptablesfile, "w");
-  if(iptables_file == NULL)
+  if(!mix_new_hosts)
   {
+   /*-----------------------------------------------------------------*/
+   puts("Initializing iptables and tc classes ...");
+   /*-----------------------------------------------------------------*/
+  
+   iptables_file = fopen(iptablesfile, "w");
+   if(iptables_file == NULL)
+   {
     perror(iptablesfile);
     exit(-1);
-  }
-  iptables_save_line(iptablespreamble, FALSE);
+   }
+   iptables_save_line(iptablespreamble, IPv4);
 
-  if(ip6prefix)
-  {
-   ip6tables_file = fopen(ip6tablesfile, "w");
-   if(ip6tables_file == NULL)
+   if(ip6prefix)
    {
-     perror(ip6tablesfile);
-     exit(-1);
+    ip6tables_file = fopen(ip6tablesfile, "w");
+    if(ip6tables_file == NULL)
+    {
+      perror(ip6tablesfile);
+      exit(-1);
+     }
+    iptables_save_line(iptablespreamble, IPv6);
+    iptables_save_line(ip6preamble, IPv6);
    }
-   iptables_save_line(iptablespreamble, TRUE);
-   iptables_save_line(ip6preamble, TRUE);
-  }
 
-  run_iptables_restore();
+   run_iptables_restore();
+  }
   
-  log_file = fopen(cmdlog, "w");
+  log_file = fopen(cmdlog, log_file_mode); /* overwrite command and iptables log files, except append in -x mode */
   if(log_file == NULL) 
   {
     perror(cmdlog);
@@ -733,25 +819,38 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
    sprintf(str,"%s qdisc del dev %s root 2>/dev/null", tc, interface->name);
    safe_run(str);
   }
-  
-  iptables_file=fopen(iptablesfile,"w");
-  iptables_save_line(iptablespreamble, FALSE);
-  if(ip6prefix)
-  {
-   ip6tables_file=fopen(ip6tablesfile,"w");
-   iptables_save_line(iptablespreamble, TRUE);
-   iptables_save_line(ip6preamble, TRUE);
+
+  if(!mix_new_hosts)
+  {  
+   iptables_file = fopen(iptablesfile, log_file_mode); /* overwrite command and iptables log files, except append in -x mode */
+   iptables_save_line(iptablespreamble, IPv4);
+   if(ip6prefix)
+   {
+    ip6tables_file = fopen(ip6tablesfile, log_file_mode); /* overwrite command and iptables log files, except append in -x mode */
+    iptables_save_line(iptablespreamble, IPv6);
+    iptables_save_line(ip6preamble, IPv6);
+   }
   }
 
   if(qos_free_zone && *qos_free_zone!='0') /* this is currently supported only for IPv4 */
   {
    for_each(interface, interfaces)
    {
-    sprintf(str,"-A %s -s %s -o %s -j ACCEPT", interface->chain, qos_free_zone, interface->name);
-    iptables_save_line(str, FALSE);
+    sprintf(str,"-A %s -%c %s -o %s -j ACCEPT", interface->chain, (interface->is_upstream?'d':'s'), qos_free_zone, interface->name);
+    iptables_save_line(str, IPv4);
    }
   }
   
+  for_each(qosfreeinterface, qosfreeinterfaces)
+  {
+    sprintf(str,"-A FORWARD -i %s -j ACCEPT", qosfreeinterface->name);
+    iptables_save_line(str, IPv4);  
+    iptables_save_line(str, IPv6);
+    sprintf(str,"-A POSTROUTING -o %s -j ACCEPT", qosfreeinterface->name);
+    iptables_save_line(str, IPv4);
+    iptables_save_line(str, IPv6);
+  }
+  
   if(ip_count > idxtable_treshold1 && !just_flush)
   {
    int idxcount=0, bitmask=32-idxtable_bitmask1;
@@ -760,12 +859,12 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
    printf("Detected %d addresses - indexing iptables rules to improve performance...\n",ip_count);
    /*-----------------------------------------------------------------*/
 
-   iptables_save_line(":post_common - [0:0]", FALSE);
-   iptables_save_line(":forw_common - [0:0]", FALSE);
+   iptables_save_line(":post_common - [0:0]", IPv4);
+   iptables_save_line(":forw_common - [0:0]", IPv4);
    if(ip6prefix)
    {
-    iptables_save_line(":post_common - [0:0]", TRUE);
-    iptables_save_line(":forw_common - [0:0]", TRUE);
+    iptables_save_line(":post_common - [0:0]", IPv6);
+    iptables_save_line(":forw_common - [0:0]", IPv6);
    }
 
    for_each(ip,ips) if(ip->addr && *(ip->addr) && !eq(ip->addr,"0.0.0.0/0")) 
@@ -868,10 +967,12 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
       buf = interface->chain;
      }
 
-     sprintf(str,"-A %s -d %s/%d -o %s -j %s_%s", buf, subnet, idx->bitmask, interface->name, interface->idxprefix, idx->id);
+     sprintf(str, "-A %s -%c %s/%d -o %s -j %s_%s", 
+                  buf, (interface->is_upstream?'s':'d'), subnet, idx->bitmask, interface->name, interface->idxprefix, idx->id);
      iptables_save_line(str, idx->ipv6);
 
-     sprintf(str,"-A %s -d %s/%d -o %s -j %s_common", buf, subnet, idx->bitmask, interface->name, interface->idxprefix);
+     sprintf(str, "-A %s -%c %s/%d -o %s -j %s_common",
+                  buf, (interface->is_upstream?'s':'d'), subnet, idx->bitmask, interface->name, interface->idxprefix);
      iptables_save_line(str, idx->ipv6);
     }
    }
@@ -880,11 +981,11 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
    for_each(interface, interfaces)
    {
     sprintf(str,"-A %s -o %s -j %s_common", interface->chain, interface->name, interface->idxprefix);
-    iptables_save_line(str, FALSE);
+    iptables_save_line(str, IPv4);
     if(ip6prefix)
     {
      sprintf(str,"-A %s -o %s -j %s_common", interface->chain, interface->name, interface->idxprefix);
-     iptables_save_line(str, TRUE);
+     iptables_save_line(str, IPv6);
     }
    }
   }
@@ -901,7 +1002,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
   exit(0);
  }
 
- if(!just_preview)
+ if(!mix_new_hosts && !just_preview)
  {
   if(!dry_run && !nodelay && qos_free_delay)
   {
@@ -925,10 +1026,13 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
   }
  }
 
- /*-----------------------------------------------------------------*/
- puts("Locating heavy downloaders and generating root classes ...");
- /*-----------------------------------------------------------------*/
- sort(ip,ips,desc_order_by,traffic); 
+ if(mix_new_hosts)
+ {
+  /*-----------------------------------------------------------------*/
+  puts("Locating heavy downloaders and generating root classes ...");
+  /*-----------------------------------------------------------------*/
+  sort(ip,ips,desc_order_by,traffic);
+ }
 
  /*-----------------------------------------------------------------*/
  for_each(interface, interfaces)
@@ -1163,7 +1267,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
   json_traffic=json_preview;
  }
 
- if(!dry_run && !just_flush)
+ if(!mix_new_hosts && !dry_run && !just_flush)
  {
   /*-----------------------------------------------------------------*/
   printf("Writing json traffic overview  %s ... ", json_traffic);
@@ -1194,8 +1298,8 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 
   printf("Statistics preview generated (-%c switch) - now exiting ...\n", swchar);
   exit(0);
- }  
-
+ }
+ 
  i=0;
 #ifdef DEBUG
  printf("%-22s %-15s mark\n","name","ip");
@@ -1257,25 +1361,27 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
  #endif
 
    /* ------------------------------------------------ iptables classify */
-   sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
-                chain, ip->addr, ip->mask,
+   sprintf(str, "-A %s -%c %s/%d -o %s -j %s%d",
+                chain, (interface->is_upstream?'s':'d'), ip->addr, ip->mask,
                 interface->name, mark_iptables, ip->mark);
    iptables_save_line(str, ip->v6);
 
-   sprintf(str, "-A %s -d %s/%d -o %s %s-j ACCEPT",
-                chain, ip->addr, ip->mask, interface->name, limit_pkts);
+   sprintf(str, "-A %s -%c %s/%d -o %s %s-j ACCEPT",
+                chain, (interface->is_upstream?'s':'d'),ip->addr, ip->mask,
+                interface->name, limit_pkts);
    iptables_save_line(str, ip->v6);
 
-   if(limit_pkts)
+   if(*limit_pkts) /* non-empty string?*/
    {
     /* classify overlimit packets to separate overlimit class */
-    sprintf(str, "-A %s -d %s/%d -o %s -j %s%d",
-                 chain, ip->addr, ip->mask,
+    sprintf(str, "-A %s -%c %s/%d -o %s -j %s%d",
+                 chain, (interface->is_upstream?'s':'d'), ip->addr, ip->mask,
                  interface->name, mark_iptables, OVERLIMIT_CLASS);
     iptables_save_line(str, ip->v6);
 
-    sprintf(str, "-A %s -d %s/%d -o %s -j ACCEPT",
-                 chain, ip->addr, ip->mask, interface->name);
+    sprintf(str, "-A %s -%c %s/%d -o %s -j ACCEPT",
+                 chain, (interface->is_upstream?'s':'d'), ip->addr, ip->mask,
+                 interface->name);
     iptables_save_line(str, ip->v6);
    }
 
@@ -1314,6 +1420,7 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
    }
    i++;
   }
+  /* classmap */
   if(ip->min && f > 0)
   {
    fprintf(f, "%s %d\n", ip->addr, ip->mark);
@@ -1344,15 +1451,15 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
 
    sprintf(str, "-A %s -o %s -j %s%d",
                 chain, interface->name, mark_iptables, FREE_CLASS);
-   iptables_save_line(str, FALSE); /* only for IPv4 */
+   iptables_save_line(str, IPv4); /* only for IPv4 */
   }
 
   sprintf(str,"-A %s -o %s -j %s", chain, interface->name, final_chain);
-  iptables_save_line(str, FALSE);
+  iptables_save_line(str, IPv4);
   if(ip6prefix)
   {
    sprintf(str,"-A %s -o %s -j %s", chain, interface->name, final_chain);
-   iptables_save_line(str, TRUE);
+   iptables_save_line(str, IPv6);
   }
 
   if(free_min) /* allocate free bandwith if it is not zero... */ 
@@ -1381,7 +1488,10 @@ Credit: CZFree.Net, Martin Devera, Netdave, Aquarius, Gandalf\n\n",version);
   safe_run(str);
  } 
  printf("Total IP count: %d\n", i);
- run_iptables_restore();
+ if(!mix_new_hosts)
+ {
+  run_iptables_restore();
+ }
  if(log_file)
  {
   fclose(log_file);