From 7a7a4a277828d8ea059fdb72c9a4fdc7d35f9b65 Mon Sep 17 00:00:00 2001
From: "Ycarus (Yannick Chabanois)" <ycarus@zugaina.org>
Date: Fri, 14 Oct 2022 07:01:41 +0000
Subject: [PATCH] Add current 0.1028 release

---
 debian9-x86_64.sh                |  25 +++++++++++++++++--------
 multipath                        |  12 +++++++++---
 omr-service                      |   2 +-
 omr-update                       |   2 +-
 omr-update.service.in            |   2 +-
 openmptcprouter-shorewall.tar.gz | Bin 4192 -> 4154 bytes
 shorewall4/shorewall.conf        |   4 ++--
 7 files changed, 31 insertions(+), 16 deletions(-)

diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh
index aa273c8..e65d32b 100755
--- a/debian9-x86_64.sh
+++ b/debian9-x86_64.sh
@@ -55,8 +55,8 @@ MLVPN_BINARY_VERSION="3.0.0+20211028.git.ddafba3"
 UBOND_VERSION="f9fb6aa0a65e8e20950977bda970c90012f830d7"
 OBFS_VERSION="486bebd9208539058e57e23a12f23103016e09b4"
 OBFS_BINARY_VERSION="0.0.5-1"
-OMR_ADMIN_VERSION="20314b11f21eb5878ba62c85d874528e0e394024"
-OMR_ADMIN_BINARY_VERSION="0.3+20220715"
+OMR_ADMIN_VERSION="4f8dc4f997c6c95971beea9d52512ed91c77479b"
+OMR_ADMIN_BINARY_VERSION="0.3+20220827"
 DSVPN_VERSION="3b99d2ef6c02b2ef68b5784bec8adfdd55b29b1a"
 DSVPN_BINARY_VERSION="0.1.4-2"
 V2RAY_VERSION="4.43.0"
@@ -76,7 +76,7 @@ VPSURL="https://www.openmptcprouter.com/"
 REPO="repo.openmptcprouter.com"
 CHINA=${CHINA:-no}
 
-OMR_VERSION="0.1027"
+OMR_VERSION="0.1028"
 
 DIR=$( pwd )
 #"
@@ -563,10 +563,15 @@ if [ "$OMR_ADMIN" = "yes" ]; then
 	fi
 	apt-get -y --allow-downgrades install python3-uvicorn jq ipcalc python3-netifaces python3-aiofiles python3-psutil python3-requests pwgen
 	echo '-- pip3 install needed python modules'
-	echo "If you see any error here, I really don't care: it's about a not used module for home users"
+	echo "If you see any error here, I really don't care: it's about a module not used for home users"
 	#pip3 install pyjwt passlib uvicorn fastapi netjsonconfig python-multipart netaddr
 	#pip3 -q install fastapi netjsonconfig python-multipart uvicorn -U
-	pip3 -q install fastapi jsonschema netjsonconfig python-multipart jinja2 -U
+	pip3 -q install netjsonconfig
+	pip3 -q install fastapi -U
+	pip3 -q install jsonschema -U
+	pip3 -q install python-multipart jinja2 -U
+	pip3 -q install starlette
+	pip3 -q install starlette
 	mkdir -p /etc/openmptcprouter-vps-admin/omr-6in4
 	mkdir -p /etc/openmptcprouter-vps-admin/intf
 	[ ! -f "/etc/openmptcprouter-vps-admin/current-vpn" ] && echo "glorytun_tcp" > /etc/openmptcprouter-vps-admin/current-vpn
@@ -578,7 +583,7 @@ if [ "$OMR_ADMIN" = "yes" ]; then
 		cd /tmp
 		unzip -q -o openmptcprouter-vps-admin.zip
 		cp /tmp/openmptcprouter-vps-admin-${OMR_ADMIN_VERSION}/omr-admin.py /usr/local/bin/
-		if [ -f /usr/local/bin/omr-admin.py ]; then
+		if [ -f /usr/local/bin/omr-admin.py ] || [ -f /etc/openmptcprouter-vps-admin/omr-admin-config.json ]; then
 			OMR_ADMIN_PASS2=$(grep -Po '"'"pass"'"\s*:\s*"\K([^"]*)' /etc/openmptcprouter-vps-admin/omr-admin-config.json | tr -d  "\n")
 			[ -z "$OMR_ADMIN_PASS2" ] && OMR_ADMIN_PASS2=$(cat /etc/openmptcprouter-vps-admin/omr-admin-config.json | jq -r .users[0].openmptcprouter.user_password | tr -d "\n")
 			[ -n "$OMR_ADMIN_PASS2" ] && OMR_ADMIN_PASS=$OMR_ADMIN_PASS2
@@ -695,8 +700,12 @@ fi
 
 if [ "$LOCALFILES" = "no" ]; then
 	wget -O /lib/systemd/system/omr-update.service ${VPSURL}${VPSPATH}/omr-update.service.in
+	wget -O /usr/bin/omr-update ${VPSURL}${VPSPATH}/omr-update
+	chmod 755 /usr/bin/omr-update
 else
 	cp ${DIR}/omr-update.service.in /lib/systemd/system/omr-update.service
+	cp ${DIR}/omr-update /usr/bin/omr-update
+	chmod 755 /usr/bin/omr-update
 fi
 
 # Install simple-obfs
@@ -1375,8 +1384,8 @@ fi
 
 if [ "$TLS" = "yes" ]; then
 	VPS_CERT=0
-	apt-get -y install dnsutils socat
-	if [ "$VPS_DOMAIN" != "" ] && [ "$(dig +noidnout +noall +answer $VPS_DOMAIN)" != "" ] && [ "$(ping -c 1 -w 1 $VPS_DOMAIN)" ]; then
+	apt-get -y install socat
+	if [ "$VPS_DOMAIN" != "" ] && [ "$(getent hosts $VPS_DOMAIN | awk '{ print $1; exit }')" != "" ] && [ "$(ping -c 1 -w 1 $VPS_DOMAIN)" ]; then
 		if [ ! -f "/root/.acme.sh/$VPS_DOMAIN/$VPS_DOMAIN.cer" ]; then
 			echo "Generate certificate for V2Ray"
 			set +e
diff --git a/multipath b/multipath
index 41c3880..608f08a 100755
--- a/multipath
+++ b/multipath
@@ -126,15 +126,21 @@ else
                         exit 0;;
                 "on")
                         [ -n "$ID" ] && ip mptcp endpoint delete id $ID 2>&1 >/dev/null
-                        ip mptcp endpoint add $IP dev $DEVICE subflow fullmesh
+                        for i in $IP; do
+                            ip mptcp endpoint add $i dev $DEVICE subflow fullmesh
+                        done
                         exit 0;;
                 "signal")
                         [ -n "$ID" ] && ip mptcp endpoint delete id $ID 2>&1 >/dev/null
-                        ip mptcp endpoint add $IP dev $DEVICE signal fullmesh
+                        for i in $IP; do
+                            ip mptcp endpoint add $i dev $DEVICE signal fullmesh
+                        done
                         exit 0;;
                 "backup")
                         [ -n "$ID" ] && ip mptcp endpoint delete id $ID 2>&1 >/dev/null
-                        ip mptcp endpoint add $IP dev $DEVICE backup fullmesh
+                        for i in $IP; do
+                            ip mptcp endpoint add $i dev $DEVICE backup fullmesh
+                        done
                         exit 0;;
                 "")
                         case "$IFF" in
diff --git a/omr-service b/omr-service
index e8de038..3898c5d 100755
--- a/omr-service
+++ b/omr-service
@@ -6,7 +6,7 @@ _multipath() {
 	source /etc/shorewall/params.net
 	for intf in `ls -1 /sys/class/net`; do
 		if [ "$intf" != "bonding_masters" ]; then
-			if [ "$intf" = "$NET_IFACE" ]; then
+			if ([ "$(ip a show dev lo | grep -v inet6 | grep global)" != "" ] && [ "$intf" = "lo" ]) || ([ "$intf" = "$NET_IFACE" ] && [ "$(ip a show dev lo | grep -v inet6 | grep global)" = "" ]); then
 				[ -f /proc/sys/net/mptcp/mptcp_enabled ] && [ "$(multipath $intf | tr -d '\n')" != "$intf is in default mode" ] && multipath $intf on
 				[ -f /proc/sys/net/mptcp/enabled ] && [ "$(multipath $intf | tr -d '\n')" != "$intf is in signal mode" ] && {
 					multipath $intf signal
diff --git a/omr-update b/omr-update
index 33b3fa6..ff2e201 100755
--- a/omr-update
+++ b/omr-update
@@ -1,6 +1,6 @@
 #!/bin/sh
 if [ -f /etc/openmptcprouter-vps-admin/update ]; then
-        wget -O - http://www.openmptcprouter.com/server-test/debian10-x86_64.sh | sh
+        wget -O - http://www.openmptcprouter.com/server/debian10-x86_64.sh | sh
         rm -f /etc/openmptcprouter-vps-admin/update
         reboot
 fi
diff --git a/omr-update.service.in b/omr-update.service.in
index 231803a..99120f8 100644
--- a/omr-update.service.in
+++ b/omr-update.service.in
@@ -4,7 +4,7 @@ After=network.target network-online.target
 
 [Service]
 Type=simple
-Restart=never
+Restart=no
 ExecStart=/usr/bin/omr-update
 #ExecStart=/usr/share/omr-server/debian9-x86_64.sh
 AmbientCapabilities=
diff --git a/openmptcprouter-shorewall.tar.gz b/openmptcprouter-shorewall.tar.gz
index 67d46c4e05633e7be5618a85267cacb4c9a732fd..92957efcab04f4eca8eb09a1b98a997dd26d155f 100644
GIT binary patch
literal 4154
zcmV-A5XJ8wiwFRpt_foR1MNKhbE8JG`z!h@rewd%Zk_c3`igy}%OOA#&j<)0J5F5{
zg(YlLkw6d7I)17B->+u|5JK{5FDrR-Ioi8|>FMd7kDl%xm|+(9ejGZpU*4S#ngHE)
zn_K~kSGEWDY^&F6wpzVrhke&%*><<{4mD3$rwrCn?1Tut3xgp39NnS(|4=xqoFVfm
z2;FCAu|TyNYPj*N5v7>MEY*(+rW^(#^8AM&TspBA_{g~r)-iH{!gC|YLGhCpp$Bi_
zUZD78<)Z4+@lnRDmT{{ByB~&{G2t!Ls+_$ERL*$8k~NiK7*m@Xg2XVQWLgZP8=9pt
zqOKW`Fv(?VN(N)z%9b#$RDSRt&^bS~w6Ub<l3}91`~}&zVA&RLj3kQ^*fu}mRgt$T
zQAMz>p4`RC4X+&NgSm61YfO#7|JL&r!#11WH!DB5{@i;=%MUGmx9~%}+LVlED~4kW
z#l|hJwOh{M&4R=pdzs7sv3}WNw>h&tu2?165O!I6;cUBLx7+O%3aXMdkTug*&E4|8
z8{d0DRP&=k4O>Mny1uVVR;yy4K+Ri)q9(6OyG0|%cMEmzbi2i(@*bg)x7x04r`av`
zmZ?tmmGqZ|qHMP~hSuJ(kGBRNm+W3{3exM>&VSF3-SEMgxzRDK$$mIs|2a_2cWk=_
zL>$*_x3K;1vZeih6WF%@AKfs*cD-G1q8c)t<!a#~Ia3id1j~-V{G<3esAZ~yz^p%b
zkL!>)g*tE)g4IjtJwC<gz3>5XFtRnS$+pq`3wQ`OC(v@8CGjj4b{q@uK6JttgndZp
zx+n@B;%6sx|At<IHJX7d3EjCDfw#F|$1d_>1eUcCgiwANz-)NIsI@<LLm~#Mw~SEm
zKoTQ$iWE1BAaCUQZs;tKzP?|0GbpThGuMw?<V0wNanX}IPwP6w6)}^FfCB{fq?vz1
zt_S&8cG_!PolT`B94`>`)q5w#^$$_7!UaD-rC-p(f!d`d>!b@z5QNKO_lXRN7bj9Z
z{xv53{jd(PFf?~#$6G{DpmtO^f^XkglIpP?dKM~hN9TO@v!+T2Az8H~W5^5m9)qUi
zP{FK#vtrJ{o7pnXWadw^)dl#ChlTSPU4+m>F7yaA{K5~S<vM(bE+QD}nM<<z&C17>
z&pgJpc<uj{VKSPOLz)e?os#UQST5lA)$*U?{rvb^)@;Gd79I?54b$u|J&!&o_c3&9
zYnV^3l@69+?LGi6<v;GB_|}H61Oh83be1Rd{TL3d|2VE)SpPM9-CpVc-vSP;|EPWt
z|HMa;_vjPv_0b7E=Y9cxA%3FX4f!tkOmI;yb!Kvmy?C^Kd~~B2atK{o4EfFy%HF$=
z;8vc&jRI4&UO~(YP9FU5!i{6%S>pg<e-9R94Ne(*$0bAt!7^6?ut0M}e2)+HeIe|K
zvvRjuwhDvCtR>Q~B(k}}35FW?z8gO^lhi=qO{>qgnsu%NKD~*rog^>u3;k`=A3n_3
zOZNLbbM(H@lN<jCQOqm|=O3v2oQGlP4Utc8Q#V9IBo|6X>qQKWgeKk7a3O-e#F2|f
zBM-_OJvk7;xGr>W=s{=tnJC;&hAA|Td9^u5cDJ%BC{s~FRITbzp&|-A$G4sn|4pzN
zh||e9VE@4bbc@gbIvuXG|8D_VXiE&>x2{bIZw+r@bq~(}-tPSGmCt|P1a5TG=0(xy
zvm_88|JjN*F?O(A1=CVnL07cRauN3*5369|&0bC`<IwZpCf6-I|80UXDChrMz!yCK
z)rpFf&wk5izpp;~rB>wl&wbD6i&~TdeqW1nplgaO+-=f|HbRPYBPnTGp2*hKU}~6F
z1wWI_mqoDV*-G<*AnDc)*~9Zbssa`jOT9w&ip(M!Pmer^hNhEestox_le0yF*i@Y$
zFg`)S>>5jGs40qeE32cl$0k$g$bp0u9(o3(F%0=Jr2mx!=&EmRl}dOk2-k~KzWOC_
z!2h?~?c)9)AZJVe{}%8C{@=hV^0n^&0`7Wc4Dct80f;3zdI<21Al)mLdEi1IvKxuu
zJ!Cn2kzO<8k*xA*V1f+ZlJe#8hO-7-C%kcu(}Jd|Bzj5mEqSs<KL-84ThX%mk-cj9
ze6pG74E;X9o8Z#xd-FqvFE%@0MGPZDo9dMxOo{d$uPB=Y6y*nsY>p*ygES-sdLoCA
z)f--sbBL*G8N6_vr%|QbO4c+n@V|?3#1uSZYvj8#qP{C{_RD%j-xlFng<mzCRb>C8
zv+(BcaRh~1btv$PXDc!{De$wIyNZ#hnmI|)M#h7en6)@aWj+TX-Z}|I-qVPT_T~BT
zc1sSeT_%S#M)&+j!n={MyU|r3!stA&V&n;|cW8>@pv>#y4m9Nu@3bjm7_16RtM|^l
zO8Wf&1K+LJvH3=;(ESKjhMLGlkdWWIq~sz9=I*>s3?vbp4&3h0?Q8cw8vG(G8OWTv
z5TUCejM3jww*yfLF}u-|GY_7lVD?Ky>iW0{!k2jMqrl(lC16UWZgoRZbWyX&l?bbK
zJDpbN-{!HN@ACLe^GtJ`4(CxS&T$+OCyoUjcNcibIojyzt}@|?0JIO!^K_6H;7*n-
zgpmQ>J%k#QX-EcxuwXIMZu|1`GS8jvUfG)9iH4quDsM65Z6{`Zb)G)Xq?<)+gw<!L
z$R5pv>RZQWr-sab*Ks6w8X2FD|5=Xh^vLr+uEq7(F5p?N&6WE<-UN;wH({@`iSKWc
z(73Z_Yst3i(USXvP_oUzjqyH^FNj15yDH^3ar~9@2$B6F3czSDJRk03^c2Udt48Db
z`MJI+29}_)r1Vjta`mTpxj6pQErv;Ks);PbBLjY?NQbn9Aa+6nq`;kcbh#A>#0+by
z+mZ?anI!h_+^BMj*3stOKqCxjj0Vk=p^10LZ_tfo3^Y@=?)vNr8v>xiu#9kfj^75I
zA4x|4gw-EH?;B9}TWEuVl;gKxC>zo(g#4#$1S~l~kw)+*!yFkMzYzlk78|fiv1~;f
z+2mm|v?p1WY~k?z0Iy6`F-gJV&60W5?5hDqZ1j>N2<RMGyHM((tVsRFM<;AR(A!wL
zQG^W-%_6&<`_;^jUj0vm|5Zt@#g8;qxl4tRB^a=r@Is;5*pOB#$qH+$>V^)|Ey>s+
zHebU}rp9m=o7fS+Z(5Sy5$?rxKvgQ1pxZ-*ADKHWven&I{f<4VXAIUF0TkZ?z0r^g
z%A}zogQo<xv3MQLgFcCH6_aTq0IddhGR{A~p7Dl`m&1|?&4tDOP#)PjZ;kua^WSh%
zl#NfDuDm+`%^dTFw2cLI7)hF}1Ge8-M<L`mq1*U1wjbTVTQw936n7&<*2#}4SwsPa
zYodXmIGQ*G3e2TaQHKzjV**;4Ms)A_R}Jz*BxHBl%_5jNi((SfLG^UWQ2Hr(W95bm
ztdFLp84?j5x={>`0Zkff)OOhBSON<|=%Xjdm=4T46W6w1tztzwjd2lSkcXfGQ&0zs
zD1(ry3MfYdO$f%oKI{alK-NOGC=L0kV)cDk8|TbWimndAz?sjSD5i_xi^+Nsd%5%+
z7TjtOn=i1I$tDxQCQm)`XuLWXRWo!~Ic&9pIeoFjDrn1(Q)wz~SA7qPzE}D;7@x+0
z7%-M&7)=AlQfCAh%?TM<Jn>I3t_D~=L7U)Xq5bb7ST>*khJ)7V6WrkC#HW9p{}#PO
zvAg^P6MXLCjm{+O{q$YMFvq#F(bH}bz|4XrK3fXpC+V+3z(8!KzL^#$nFty<1X&%?
zkaUx_i52V99m<d)ingrV;F5V$qV5)>OjywukP}&zO@3fXss*=V8tmfJytsP-y+I_$
zdpC#)e=QL{1KyMcoBBq|Ih&vTDtPpZBtE#v+!<D3Va&^_Z3+e$;e@N8@DqJvQXYaL
z@rDg1jU=>*u1FS@2NMOHFw9RItfi(*@l#LAK$I|%ZH*-rKdeZoEi$`s>t!83!l3*`
z+;T+%+)bAvz>GqSNpDpgD)2aT5${xf0`1$hiHMSZ(n0%d^2S(}%nYd+R^l=!YRE$z
zKuj3n48hASZ-_Q+9e$n-BGRq}2Q*T_)KArGRl9{wGi2(Xa7h_@07O}!_;}E#v@gzN
zRgqN*I9b9trNmy$1~Dq=Mp6yXheR~iAI+~+t|dvg4a>GRBF=D=lasclO~NQrI1Qe*
z)hxqW3JI{(5%lKvqG`fI|A_Qu0TqE;Y{R%`{eZQA=726vbycUMc1AnVHmAd({8RrI
zOaR7FCWj9Q`P7nrvhjm|ZEE$qO>oXraF7P1B-<DYc#A$E#D@eX^3PJgxw*G<b4evp
zAhE!-qBsJSew;$MZfED-5-JkX5x?w&aptU3%T0yTrl(m1g&S?Acnhn2ej3s$)9FKr
zO#TL{n1w)?h@i;8(zGRHU7aR>f>E>5ly1l{LG^x>LoM=$uPpp=+kZG}z;hA`Xg9K$
zPGE{Nrm6U;nQLV-129e>-@)AH6&vPAjug~tgP>tPsHkL`u!>7M0;?zJhQRBPZ)P+2
zRx_@7=n++<g@2X|&8GcFlA0=U_@`exjaAo4D02;V-AbZe6Rdi=I48FKl&dN*N;+N=
z;r<}|ShBTMJ}0#Rn>m=zO}D9}OPhRNvhQWH#Mu={7c+bCua?-XUv~30E13NaIC5X^
z8N>;Bc65!G#yq-%0h}W1_+s&#8^{*6;pt4;No&I)U0zIh^E%DN%1rOe4a0vph#=xT
zwTwgie_Jf~j%_!)Y`4X=TV1^Wr`;}}|Gx<o&VQzResCn+m^jh@t=-U>yY5$R|LK-H
zfBwWff3OXyW(`T+tsHu<LQ0YMDx{f9K<6v*N7_fU=fhFV-u*ue`F0eJVFd<9botLn
zF?a_M`Q8+e4)}qr$krWn8hFYdr;@>oz%@N>)9%%q4X%Ch&kB=6e!mCVY3@U^`;go|
zWNRO?y${*RBfFQB3~+2W!S!GgbSa8UP?s3>eL}|MzN3Lv1uP7Gd5>S_!{me+K{SE9
zHq74dN0l>7`TjgTsPuthnsxHmXadXZOi~$I{4R*%V6}4RC*1~o$p5!ny~6n)j%$_Y
zf8GRM+yC3i#R54M`Q32<%atL(pE(4`>BtF=0e$6W-0gB-wJA2g88%7p?4V1&_mrh;
zI~277=cL3wPU)wizMNB9Vuv>UjMQN+lyZkG{T|d|29$D#jDD)>aPhs>C*QI<To%Z7
zXmVe=I?P~0{9kYoDxRJG3y_D-|FhlV_a8a7Jpc1Ha8~^A9R=%7&mm;BHsDq9Ru--7
zh=De>Hpoiu6M2mEEBzQ#<!lq3GmM;kqUl>VxP&dh8}YyK`9HSPF3$gEw~YVa2EO3@
z-_KY@%H#iK^#5w~PmIV3!v5sjtf@0fK8A;iAgep5)J1)9tp6JC^aFh9LH_J0OL|Pk
zTYYS2-wa3-vqhTt^GA>+lu$wmC6rJ?2_=+JLJ1|5P(leMlu$wmCHxWLU!*femH>DF
E0Q3<h8UO$Q

literal 4192
zcmV-m5TEZKiwFP<!|!4M1MM7ZbE8IbzoK6;CHs=yI?EF175hq;Lx3dC2nZlMPF)p+
zC2UiXKnG|YUuysR^~?Z5NM3ESlAX)Z-W5zwPxm}}x_e-TY2f>D=uCfpcRXkSbXqNP
z1t?zGF5I&%uG4I`n%yq<uEDY`xS+-n>y*JNik%RlcVQ63pQGEC|33;Rl@nw>2BG`p
z%;%_9Lv=Tv)}s_tpQidz!IXm_M4o>igbOG30v|bd!74^BP<U<xIVgVgB6RP~-7^$F
zFI`k!I6lg_)iQ2XVE6q%Gse7ynw67RfyxOlShA)v3}b2&Ly#ColuV0ZbVIW=M$|O}
z5+=D!Ovzx(8`%;@mCE<tJv!wlmNt?UT{2Ac%{R!l1<SU0V<=gaz_$4@uZp})i7JA1
z`RLA<Zg}ZHAIzLfU1Mqt{<oSf8Me{*u2K2k^=ICFT7F>Z+lBAr<+@}%T{0Y7C^l+x
z&FyjqZx$qW*^6BM59b$6c9S#P<%(634Pl$L7fv?|b~>GIp`a>ReOWVY)!Z)cyYZbD
zL^VGu)Ua9PqU*c5WVtN%3Dmq<C~ESmv|TiEe78{dcBfM;D(?^)dCSe(wi}&dZ<*?N
zS4n?SD9Uz<V`%Lh`*>sUammibx*)xN?fm!r*bVQUsT&=_n(T%>_MZdQ#P+}2?6z2z
zW3m13aP89mzXojD|Br4MVY}WsZ=f17oyBtQA~{nLGyuzv!2F~5DX3+tgTSocdk?FS
zIE8cIC<M#r(0h1{(R<+o;$Zk|T!U?)yJzqaZcd=(It$`iEbKVu-d*T~&j|aF&~;H1
z+{aH&=>82o2P-rMR}#82F9L6Kw~Afl#Rx2GJqV%vB7oWOj8Q9p=7vNJRBsWX;GQIg
z>I5ln6hYq5_1(~!BYkx@_oh%-@usdHxyXso662yrcb3+5fGc7q6#)kb>`62KhFlNw
zvFx<hxN|m@mT){n&{yxB7}q~U!4enz0F{15a|dddmOLk2V1giA7Q0VmNW3_f&f{NV
z(%<*15DP;yH+H;v1O;jbg#-BZwI!(@+M#Em0(WrECqHSbgb<QdOELz$fbTJAIt~@g
z3OFm~6ug-&<4k7uI9;BB-?*PU57Ai&J>)`<K*P`cAX==#`{*o!p`N-VtJkP}T>8vI
zT#Hx!Ul}H&Njaq1VB0ClZi>YmeqSvAIo?kXFJ(>V%yjO-@YXQR?$Wd9b8;U-x3+@$
z^it_y5!UVk@KXN64vM!nd?gTAI-#>TqVLDBZ~ez{t#=UoK?u-lbedi8|BY_9QTqSa
zfPL#fsvpEZ@loVG_{4jCbVAR$n}c77AE|dkz6(ART$D?lnH*y;9<3f8+$e?|LYEdp
zzO#U`ckTnYl_zkcz!a^P5c7hQ2R}S_<Cu8XI6&Cng9TZEQ^wwL0g*wl$W;I=&<qjZ
z<3oL)2|MDf+>Mqk!{8xniS!GJY%Xzvp~k)E#*d98)fafv>aoqnIoAfC-oV#(l9%{}
z-lpjf@2Bhq`(2(ndSB?twSR;tW*UUE4^)26!!Y!Q$fvid8=@hS3nin~JcdR>lkRA^
z5J6w!$i<_P2jz_(9f)9D7rHm}pfmkU6mBQO6dK38*qj5qTUiy9i6|keR_9QmA__dm
zThEFACs+@}@nr0=|KI^S1^dso+s)GczXoKXEir&^U7HeK8(zce?w$YL?fDO=a{j*p
zT<fOIi=xqENgzP}vlVS@Y+<<yrlq!mu4o(OBJO`4mciVcJ|9=czURLUu9H3g<(lOE
zU!zg_|5t%8c>b#s6)B(nmd}1)eD+JN$l;&+p3oPyC<Xk!7Ue+K6j``krxk686zN)0
z(zHC5t;_zzFs%xHCYdjbV9m3U<^@60tu3<qr(IM9EGm|If$RmDMKqosc@PavC(l$F
z@{=Z~^8~T3IzeE3f`ZvKlF&d?6zxV<hiQ+EC(x072`N1E3`k=b@?%K<lmzIix3)?p
zycUG3`7vMp64>MaTdh{3`24riD);}q3Veb8H?WF)t@}TNyKWf+{E1@#Vo44j0=yBV
zd&M#jTnI$ABN4oZEQc@BYlb|ORXz<&kilD0zC7M=R)_1DH?DA6&{UN~FG;>7k2mN?
zpdWZET2?=@S1q4UHWQto-v@XTTzY+Pe#r2}X6LJjVQ6R*z4E;&(ca?~Wu1Vcd|#2x
zktD8>hNM7G<PfrY%`0*aF;Ojp7q0R&s&rGynkEMRw=s^Gf+uW^e0NIJcj--kUM=a{
zB0Q_`tA>+`?0<CT-t0Y&pm3}91zz!VN#-U6emZrRF%nfXCn;LXxc3sX76+-!ry#^z
zC!xrD8j;byJRRI@$f32%<dDYbp8r62*AsTvx(Y-Xo#$1IJc0EVO;H?_d0E_^rtIUL
zHbo4BWr1n+&Y4w7pZ_QD-Scy7zR@ytKZ2E^CUPDm<aaJ9IS+!FJ3A)^k_b)*ZhPo<
zwR;y0ei4=oWKLa(&}9(D=<lf0hNy&?-RRMo1y4~h{W&6aeV7N~bG-6V;BWL2Fr`vA
zx}hk#s9EGngw;CjcC-DPd8}sJJU-Jr(;TJ4d60^897n{7BSFXA1s-yS*1Ec_On4#y
z?fug%9V7<0lO+pbWPo=Mp~hqylEEM>Sj@E3y12N=bEmskHYRwYp(mosTMT*IiCJHs
zrjIk}X3-j9^%*L%M>C;%>-g;0kooU(9LXI=#^>XImSel*`Cq5OwKxvbv0STJ#{aJZ
z2alVuS6RpR*GXvH-m$f0Q}t-c-9aeX=HSM7AIKL(qJ&+Q@*6w;(s_W$ejWv2wCA1=
z_c3~m<K<<&{`B;8zAgrqpuV8=QK53@kMUxD_@`S8lh{-fS%^ml{7#S#X$e8>g!)K<
zJMrLhD-eho)<m}@6#_Cz?A^Li<ruA_&AWz17|<9EnkhpQZx7#~Ysu(qrfl8z*dsOs
zK!;%&;`SWA4LU!RjNTEeKY-phpzb%&1_ddHZ^1w|q#FqNkJ$)Va)2TY;ZKG+GCX`E
z`U)&IV3lIoiZ-;#!(?brvMSlY;rl*bnW$otg2kI9^QzfX1BzJdB}Wj@Ik0x2)B{<O
zdi9S^ScjmuzHp-m8y=cPc02c~nH|0SON9SbNv_2YHC4Gyg^(o}upIM3q1xDxRw~H~
zYoqFh4$>{j*djJx!jC7$U>lp*5x}oolHU>T#pi&kR4hTa2MRwlw^(GWyN&uCdQ?vs
ztTh5Cz6E-tAr+KKLjwj+32bBWI+_Q465%Q)(?kGT4en%|e|SCP4IM9sB@>zpi~WH-
zv~}JZ^{S`8;-n}WpVnP@dHSn4;tgpN3+gbGG+761ufB>x$Z<lq{!45>xPiB<D-tN~
zT8gZbA5*f30t#0|13_^#aRL;WOQoU?ATq}Uv@-SR&hszp<cCPe?y{SCFm>j|B&LJv
z>5`%JQu6xJ4d+-NO-nN*B0O}X7#ahbG}5T;u+5PK7KG48kB~9xo3|#eZLeCzigX;~
zBEldKKm{hC4i-@cAypMnjyf6>jDdaF5mbS!g=|q8@Ds)A`LH(5nV}S2?T3Lgn>tZU
z7r|%a)jalc=@~4z)gU&XVJ(wQCW1|#dgRe~buOxA=q_{EY6WxpVu@AImLDe4MB1$S
z4itT_^cxr-$AK6ymLnKV1IAKk1Q^XR8Cg8>k1(zVSUo`-<71({ZzEVXpZ<!2*60)5
z;N`@pf1LgrJx8&-_yiMt=HiXcB<%h4ZN)H0xw6sYb`ii#g9ScY3gk!WuR_2;Y^J`R
z7Dt%~8aM=59nz3=owkV;>(L#`kRgh;tlQv{c~he97Nbm9(HD?oS(Qz`Z%V2Kw_+OX
z;?umidjY*hB*%McNl1_RD~TlfyeSJdb&WJTo1VQYIP|k5JUGj|8P;H7#LKE}3I^C<
zlS&a3eyop8%0o~j-mt-<k%TtZ70IIVV4i>vhUsa8vDB0ae&|UVh!Q5Ut&ybSXB7#x
zMJ5++ysYCV7?i(=8?H!zyY5f~SWyTu>8*+*1zzm=_jYzF+m5^?<lU<L7}~pTBM~kA
zsDm=v<OQ-UnHf?uti*#*)PRSufLJsl31XQW-VkltTKsq$EO^?};E#qXSpJE6rD`|O
ziH1zQ6)q`5kANr(<^k4$3GJH`Syg0J0#24NN-42Zvq6jss*+R#)FTm%)k*U!l`Bco
zZNsvywTKhk1<Ao%(<V_BDV)Yqn_8D)ErrBe>JWN&a}71-p?^gB?tqHGEw(`qvVOo?
zL32PgC%UTBQ9PlYXq%J4K>o4!GbR9ADU-7ZgnVL2Kic>`fHtvuod)>o3HVC`Qj%>9
z1iWLP5aKffWBDhk*I3`%xv8a+ppY13T2UMjN<T~>dbhJ<a0wNO@Q9ms!Z`EYsUfGr
zY17jzg2Ih9Q@n+zL4H=!D%0siiA??)s+dJYn24arz|yoOWL=#me}qx9(v)t<Fk$sx
zl|xPPhp#OBahrcQh`@6c3TW4|m`-SlGbX9{iJ5C<G6OJ9AKij2;1wI@NRAZLYK@>#
zKd7i=ny{!#Is&UF=!U@SkZ)!)`bIOZc<2#Tq=kQy49%wfN0OQ<armcKJC2dpNn~>c
zX5LDIUlWXcx>hHq{+Np_Fj6{RA>sZY+gh@vRz4@S0P8uJ&rNr&q${0#Ua}2lz2eyx
zNY^$y@Gq8FFK4#%)(e{54LERL?ij=|d6aa8SIRuPg#nx(>+oXnoa@ULw&Cea+DdDK
z0bOm3dGjjG#mY?Y%l*S|4-rJ1$Cj~g|8JA!-m$Glhi!KN8hHOttKBM}|Gx$l&VQzR
zesCmRA3M>%S8nLcT=y%t|8&ZoKY!w#KiGy;vxX$^R`$JDA*INB71GQFp!1dZBkd#F
z@!=?D=l&mtd^-vUtpbBXxcq0N7`y|Bd~XU!`+Q$kWa}0>4P4_76UpF3;F_McX?4#V
zb*^>xuL_exezybJZtOy`yO7*2WOEm?wF}wKBRdzA3~+2G!F6F0bSR2TP!|~WT|&m>
zzN3Lv1uP7Gd5>S_!{me+K{SE9Hq74dN0k#y`TjILsPuth8t3G%-T;=_nWQq7_+1di
z!E))&j=BwapZ{+)yX*5m?GAqb4?0}>|JQ(*_W!nXu|Q5mes>(ea%BkcXAS{!I&y?#
zKwr5TceC7AZHmorhE392JLr<{J!R?I7DcVVIVrJ=Q~GJBFXxn&*rH88BekCkrQ9M*
zzX!FS0j1m`qo1nUUwmiv$+xWbmj$vdn%tMJ_A^)${~sKLil@i_0_48)|7?eR|FPX|
zG#gE>jr~8{F2DcuDsWQ#@Erx~R?i`1wbtiV@kSP{?1+IjvDU~+?h|>8^b7qMQ{`kG
zoimJ_e4^>C8(hK$;EniieEyGZx7Oc(<+?0A|5twh<5l1b&j0;{Rir%rUq=5gM*qZ!
z93kvazRj9CqvT_Fs0gyUg-Tu27svW9@lHR$mmcKLj<Tf3WW43aR`$(+G%=m0i9de?
qSwaaVlu$wmC6rJ?2_=+JLJ1|5P(leMlu*JS5&jDq0=BLIcmMz{V-n&3

diff --git a/shorewall4/shorewall.conf b/shorewall4/shorewall.conf
index be836d4..d1ed03f 100644
--- a/shorewall4/shorewall.conf
+++ b/shorewall4/shorewall.conf
@@ -137,7 +137,7 @@ ADMINISABSENTMINDED=Yes
 
 AUTOCOMMENT=Yes
 
-AUTOHELPERS=No
+AUTOHELPERS=Yes
 
 AUTOMAKE=No
 
@@ -163,7 +163,7 @@ DISABLE_IPV6=No
 
 DOCKER=No
 
-DONT_LOAD=nf_conntrack_sip
+DONT_LOAD=
 
 DYNAMIC_BLACKLIST=Yes