#!/usr/sbin/nft -f
flush ruleset
table inet security {
	secmark default_input_packet {
		"system_u:object_r:server_packet_t:s0"
	}
	secmark default_output_packet {
		"system_u:object_r:client_packet_t:s0"
	}
	secmark icmp_packet {
		"system_u:object_r:icmp_packet_t:s0"
	}
	secmark afs_bos_input {
		"system_u:object_r:afs_bos_server_packet_t:s0"
	}
	secmark afs_bos_output {
		"system_u:object_r:afs_bos_client_packet_t:s0"
	}
	secmark afs_fs_input {
		"system_u:object_r:afs_fs_server_packet_t:s0"
	}
	secmark afs_fs_output {
		"system_u:object_r:afs_fs_client_packet_t:s0"
	}
	secmark afs_ka_input {
		"system_u:object_r:afs_ka_server_packet_t:s0"
	}
	secmark afs_ka_output {
		"system_u:object_r:afs_ka_client_packet_t:s0"
	}
	secmark afs_pt_input {
		"system_u:object_r:afs_pt_server_packet_t:s0"
	}
	secmark afs_pt_output {
		"system_u:object_r:afs_pt_client_packet_t:s0"
	}
	secmark afs_vl_input {
		"system_u:object_r:afs_vl_server_packet_t:s0"
	}
	secmark afs_vl_output {
		"system_u:object_r:afs_vl_client_packet_t:s0"
	}
	secmark afs3_callback_input {
		"system_u:object_r:afs3_callback_server_packet_t:s0"
	}
	secmark afs3_callback_output {
		"system_u:object_r:afs3_callback_client_packet_t:s0"
	}
	secmark agentx_input {
		"system_u:object_r:agentx_server_packet_t:s0"
	}
	secmark agentx_output {
		"system_u:object_r:agentx_client_packet_t:s0"
	}
	secmark amanda_input {
		"system_u:object_r:amanda_server_packet_t:s0"
	}
	secmark amanda_output {
		"system_u:object_r:amanda_client_packet_t:s0"
	}
	secmark amavisd_recv_input {
		"system_u:object_r:amavisd_recv_server_packet_t:s0"
	}
	secmark amavisd_recv_output {
		"system_u:object_r:amavisd_recv_client_packet_t:s0"
	}
	secmark amavisd_send_input {
		"system_u:object_r:amavisd_send_server_packet_t:s0"
	}
	secmark amavisd_send_output {
		"system_u:object_r:amavisd_send_client_packet_t:s0"
	}
	secmark amqp_input {
		"system_u:object_r:amqp_server_packet_t:s0"
	}
	secmark amqp_output {
		"system_u:object_r:amqp_client_packet_t:s0"
	}
	secmark aol_input {
		"system_u:object_r:aol_server_packet_t:s0"
	}
	secmark aol_output {
		"system_u:object_r:aol_client_packet_t:s0"
	}
	secmark apcupsd_input {
		"system_u:object_r:apcupsd_server_packet_t:s0"
	}
	secmark apcupsd_output {
		"system_u:object_r:apcupsd_client_packet_t:s0"
	}
	secmark apertus_ldp_input {
		"system_u:object_r:apertus_ldp_server_packet_t:s0"
	}
	secmark apertus_ldp_output {
		"system_u:object_r:apertus_ldp_client_packet_t:s0"
	}
	secmark aptcacher_input {
		"system_u:object_r:aptcacher_server_packet_t:s0"
	}
	secmark aptcacher_output {
		"system_u:object_r:aptcacher_client_packet_t:s0"
	}
	secmark armtechdaemon_input {
		"system_u:object_r:armtechdaemon_server_packet_t:s0"
	}
	secmark armtechdaemon_output {
		"system_u:object_r:armtechdaemon_client_packet_t:s0"
	}
	secmark asterisk_input {
		"system_u:object_r:asterisk_server_packet_t:s0"
	}
	secmark asterisk_output {
		"system_u:object_r:asterisk_client_packet_t:s0"
	}
	secmark audit_input {
		"system_u:object_r:audit_server_packet_t:s0"
	}
	secmark audit_output {
		"system_u:object_r:audit_client_packet_t:s0"
	}
	secmark auth_input {
		"system_u:object_r:auth_server_packet_t:s0"
	}
	secmark auth_output {
		"system_u:object_r:auth_client_packet_t:s0"
	}
	secmark bgp_input {
		"system_u:object_r:bgp_server_packet_t:s0"
	}
	secmark bgp_output {
		"system_u:object_r:bgp_client_packet_t:s0"
	}
	secmark boinc_input {
		"system_u:object_r:boinc_server_packet_t:s0"
	}
	secmark boinc_output {
		"system_u:object_r:boinc_client_packet_t:s0"
	}
	secmark boinc_client_input {
		"system_u:object_r:boinc_client_server_packet_t:s0"
	}
	secmark boinc_client_output {
		"system_u:object_r:boinc_client_client_packet_t:s0"
	}
	secmark certmaster_input {
		"system_u:object_r:certmaster_server_packet_t:s0"
	}
	secmark certmaster_output {
		"system_u:object_r:certmaster_client_packet_t:s0"
	}
	secmark chronyd_input {
		"system_u:object_r:chronyd_server_packet_t:s0"
	}
	secmark chronyd_output {
		"system_u:object_r:chronyd_client_packet_t:s0"
	}
	secmark clamd_input {
		"system_u:object_r:clamd_server_packet_t:s0"
	}
	secmark clamd_output {
		"system_u:object_r:clamd_client_packet_t:s0"
	}
	secmark clockspeed_input {
		"system_u:object_r:clockspeed_server_packet_t:s0"
	}
	secmark clockspeed_output {
		"system_u:object_r:clockspeed_client_packet_t:s0"
	}
	secmark cluster_input {
		"system_u:object_r:cluster_server_packet_t:s0"
	}
	secmark cluster_output {
		"system_u:object_r:cluster_client_packet_t:s0"
	}
	secmark cma_input {
		"system_u:object_r:cma_server_packet_t:s0"
	}
	secmark cma_output {
		"system_u:object_r:cma_client_packet_t:s0"
	}
	secmark cobbler_input {
		"system_u:object_r:cobbler_server_packet_t:s0"
	}
	secmark cobbler_output {
		"system_u:object_r:cobbler_client_packet_t:s0"
	}
	secmark commplex_link_input {
		"system_u:object_r:commplex_link_server_packet_t:s0"
	}
	secmark commplex_link_output {
		"system_u:object_r:commplex_link_client_packet_t:s0"
	}
	secmark commplex_main_input {
		"system_u:object_r:commplex_main_server_packet_t:s0"
	}
	secmark commplex_main_output {
		"system_u:object_r:commplex_main_client_packet_t:s0"
	}
	secmark comsat_input {
		"system_u:object_r:comsat_server_packet_t:s0"
	}
	secmark comsat_output {
		"system_u:object_r:comsat_client_packet_t:s0"
	}
	secmark condor_input {
		"system_u:object_r:condor_server_packet_t:s0"
	}
	secmark condor_output {
		"system_u:object_r:condor_client_packet_t:s0"
	}
	secmark couchdb_input {
		"system_u:object_r:couchdb_server_packet_t:s0"
	}
	secmark couchdb_output {
		"system_u:object_r:couchdb_client_packet_t:s0"
	}
	secmark cslistener_input {
		"system_u:object_r:cslistener_server_packet_t:s0"
	}
	secmark cslistener_output {
		"system_u:object_r:cslistener_client_packet_t:s0"
	}
	secmark ctdb_input {
		"system_u:object_r:ctdb_server_packet_t:s0"
	}
	secmark ctdb_output {
		"system_u:object_r:ctdb_client_packet_t:s0"
	}
	secmark cvs_input {
		"system_u:object_r:cvs_server_packet_t:s0"
	}
	secmark cvs_output {
		"system_u:object_r:cvs_client_packet_t:s0"
	}
	secmark cyphesis_input {
		"system_u:object_r:cyphesis_server_packet_t:s0"
	}
	secmark cyphesis_output {
		"system_u:object_r:cyphesis_client_packet_t:s0"
	}
	secmark daap_input {
		"system_u:object_r:daap_server_packet_t:s0"
	}
	secmark daap_output {
		"system_u:object_r:daap_client_packet_t:s0"
	}
	secmark dbskkd_input {
		"system_u:object_r:dbskkd_server_packet_t:s0"
	}
	secmark dbskkd_output {
		"system_u:object_r:dbskkd_client_packet_t:s0"
	}
	secmark dcc_input {
		"system_u:object_r:dcc_server_packet_t:s0"
	}
	secmark dcc_output {
		"system_u:object_r:dcc_client_packet_t:s0"
	}
	secmark dccm_input {
		"system_u:object_r:dccm_server_packet_t:s0"
	}
	secmark dccm_output {
		"system_u:object_r:dccm_client_packet_t:s0"
	}
	secmark dhcpc_input {
		"system_u:object_r:dhcpc_server_packet_t:s0"
	}
	secmark dhcpc_output {
		"system_u:object_r:dhcpc_client_packet_t:s0"
	}
	secmark dhcpd_input {
		"system_u:object_r:dhcpd_server_packet_t:s0"
	}
	secmark dhcpd_output {
		"system_u:object_r:dhcpd_client_packet_t:s0"
	}
	secmark dict_input {
		"system_u:object_r:dict_server_packet_t:s0"
	}
	secmark dict_output {
		"system_u:object_r:dict_client_packet_t:s0"
	}
	secmark distccd_input {
		"system_u:object_r:distccd_server_packet_t:s0"
	}
	secmark distccd_output {
		"system_u:object_r:distccd_client_packet_t:s0"
	}
	secmark dns_input {
		"system_u:object_r:dns_server_packet_t:s0"
	}
	secmark dns_output {
		"system_u:object_r:dns_client_packet_t:s0"
	}
	secmark dropbox_input {
		"system_u:object_r:dropbox_server_packet_t:s0"
	}
	secmark dropbox_output {
		"system_u:object_r:dropbox_client_packet_t:s0"
	}
	secmark efs_input {
		"system_u:object_r:efs_server_packet_t:s0"
	}
	secmark efs_output {
		"system_u:object_r:efs_client_packet_t:s0"
	}
	secmark embrace_dp_c_input {
		"system_u:object_r:embrace_dp_c_server_packet_t:s0"
	}
	secmark embrace_dp_c_output {
		"system_u:object_r:embrace_dp_c_client_packet_t:s0"
	}
	secmark epmap_input {
		"system_u:object_r:epmap_server_packet_t:s0"
	}
	secmark epmap_output {
		"system_u:object_r:epmap_client_packet_t:s0"
	}
	secmark epmd_input {
		"system_u:object_r:epmd_server_packet_t:s0"
	}
	secmark epmd_output {
		"system_u:object_r:epmd_client_packet_t:s0"
	}
	secmark fingerd_input {
		"system_u:object_r:fingerd_server_packet_t:s0"
	}
	secmark fingerd_output {
		"system_u:object_r:fingerd_client_packet_t:s0"
	}
	secmark ftp_input {
		"system_u:object_r:ftp_server_packet_t:s0"
	}
	secmark ftp_output {
		"system_u:object_r:ftp_client_packet_t:s0"
	}
	secmark ftp_data_input {
		"system_u:object_r:ftp_data_server_packet_t:s0"
	}
	secmark ftp_data_output {
		"system_u:object_r:ftp_data_client_packet_t:s0"
	}
	secmark gatekeeper_input {
		"system_u:object_r:gatekeeper_server_packet_t:s0"
	}
	secmark gatekeeper_output {
		"system_u:object_r:gatekeeper_client_packet_t:s0"
	}
	secmark gdomap_input {
		"system_u:object_r:gdomap_server_packet_t:s0"
	}
	secmark gdomap_output {
		"system_u:object_r:gdomap_client_packet_t:s0"
	}
	secmark gds_db_input {
		"system_u:object_r:gds_db_server_packet_t:s0"
	}
	secmark gds_db_output {
		"system_u:object_r:gds_db_client_packet_t:s0"
	}
	secmark git_input {
		"system_u:object_r:git_server_packet_t:s0"
	}
	secmark git_output {
		"system_u:object_r:git_client_packet_t:s0"
	}
	secmark glance_registry_input {
		"system_u:object_r:glance_registry_server_packet_t:s0"
	}
	secmark glance_registry_output {
		"system_u:object_r:glance_registry_client_packet_t:s0"
	}
	secmark glusterd_input {
		"system_u:object_r:glusterd_server_packet_t:s0"
	}
	secmark glusterd_output {
		"system_u:object_r:glusterd_client_packet_t:s0"
	}
	secmark gopher_input {
		"system_u:object_r:gopher_server_packet_t:s0"
	}
	secmark gopher_output {
		"system_u:object_r:gopher_client_packet_t:s0"
	}
	secmark gpsd_input {
		"system_u:object_r:gpsd_server_packet_t:s0"
	}
	secmark gpsd_output {
		"system_u:object_r:gpsd_client_packet_t:s0"
	}
	secmark hadoop_datanode_input {
		"system_u:object_r:hadoop_datanode_server_packet_t:s0"
	}
	secmark hadoop_datanode_output {
		"system_u:object_r:hadoop_datanode_client_packet_t:s0"
	}
	secmark hadoop_namenode_input {
		"system_u:object_r:hadoop_namenode_server_packet_t:s0"
	}
	secmark hadoop_namenode_output {
		"system_u:object_r:hadoop_namenode_client_packet_t:s0"
	}
	secmark hddtemp_input {
		"system_u:object_r:hddtemp_server_packet_t:s0"
	}
	secmark hddtemp_output {
		"system_u:object_r:hddtemp_client_packet_t:s0"
	}
	secmark howl_input {
		"system_u:object_r:howl_server_packet_t:s0"
	}
	secmark howl_output {
		"system_u:object_r:howl_client_packet_t:s0"
	}
	secmark hplip_input {
		"system_u:object_r:hplip_server_packet_t:s0"
	}
	secmark hplip_output {
		"system_u:object_r:hplip_client_packet_t:s0"
	}
	secmark http_input {
		"system_u:object_r:http_server_packet_t:s0"
	}
	secmark http_output {
		"system_u:object_r:http_client_packet_t:s0"
	}
	secmark http_cache_input {
		"system_u:object_r:http_cache_server_packet_t:s0"
	}
	secmark http_cache_output {
		"system_u:object_r:http_cache_client_packet_t:s0"
	}
	secmark i18n_input_input {
		"system_u:object_r:i18n_input_server_packet_t:s0"
	}
	secmark i18n_input_output {
		"system_u:object_r:i18n_input_client_packet_t:s0"
	}
	secmark imaze_input {
		"system_u:object_r:imaze_server_packet_t:s0"
	}
	secmark imaze_output {
		"system_u:object_r:imaze_client_packet_t:s0"
	}
	secmark inetd_child_input {
		"system_u:object_r:inetd_child_server_packet_t:s0"
	}
	secmark inetd_child_output {
		"system_u:object_r:inetd_child_client_packet_t:s0"
	}
	secmark innd_input {
		"system_u:object_r:innd_server_packet_t:s0"
	}
	secmark innd_output {
		"system_u:object_r:innd_client_packet_t:s0"
	}
	secmark interwise_input {
		"system_u:object_r:interwise_server_packet_t:s0"
	}
	secmark interwise_output {
		"system_u:object_r:interwise_client_packet_t:s0"
	}
	secmark ionixnetmon_input {
		"system_u:object_r:ionixnetmon_server_packet_t:s0"
	}
	secmark ionixnetmon_output {
		"system_u:object_r:ionixnetmon_client_packet_t:s0"
	}
	secmark ipmi_input {
		"system_u:object_r:ipmi_server_packet_t:s0"
	}
	secmark ipmi_output {
		"system_u:object_r:ipmi_client_packet_t:s0"
	}
	secmark ipp_input {
		"system_u:object_r:ipp_server_packet_t:s0"
	}
	secmark ipp_output {
		"system_u:object_r:ipp_client_packet_t:s0"
	}
	secmark ipsecnat_input {
		"system_u:object_r:ipsecnat_server_packet_t:s0"
	}
	secmark ipsecnat_output {
		"system_u:object_r:ipsecnat_client_packet_t:s0"
	}
	secmark ircd_input {
		"system_u:object_r:ircd_server_packet_t:s0"
	}
	secmark ircd_output {
		"system_u:object_r:ircd_client_packet_t:s0"
	}
	secmark isakmp_input {
		"system_u:object_r:isakmp_server_packet_t:s0"
	}
	secmark isakmp_output {
		"system_u:object_r:isakmp_client_packet_t:s0"
	}
	secmark iscsi_input {
		"system_u:object_r:iscsi_server_packet_t:s0"
	}
	secmark iscsi_output {
		"system_u:object_r:iscsi_client_packet_t:s0"
	}
	secmark isns_input {
		"system_u:object_r:isns_server_packet_t:s0"
	}
	secmark isns_output {
		"system_u:object_r:isns_client_packet_t:s0"
	}
	secmark jabber_client_input {
		"system_u:object_r:jabber_client_server_packet_t:s0"
	}
	secmark jabber_client_output {
		"system_u:object_r:jabber_client_client_packet_t:s0"
	}
	secmark jabber_interserver_input {
		"system_u:object_r:jabber_interserver_server_packet_t:s0"
	}
	secmark jabber_interserver_output {
		"system_u:object_r:jabber_interserver_client_packet_t:s0"
	}
	secmark jboss_iiop_input {
		"system_u:object_r:jboss_iiop_server_packet_t:s0"
	}
	secmark jboss_iiop_output {
		"system_u:object_r:jboss_iiop_client_packet_t:s0"
	}
	secmark kerberos_input {
		"system_u:object_r:kerberos_server_packet_t:s0"
	}
	secmark kerberos_output {
		"system_u:object_r:kerberos_client_packet_t:s0"
	}
	secmark kerberos_admin_input {
		"system_u:object_r:kerberos_admin_server_packet_t:s0"
	}
	secmark kerberos_admin_output {
		"system_u:object_r:kerberos_admin_client_packet_t:s0"
	}
	secmark kerberos_master_input {
		"system_u:object_r:kerberos_master_server_packet_t:s0"
	}
	secmark kerberos_master_output {
		"system_u:object_r:kerberos_master_client_packet_t:s0"
	}
	secmark kismet_input {
		"system_u:object_r:kismet_server_packet_t:s0"
	}
	secmark kismet_output {
		"system_u:object_r:kismet_client_packet_t:s0"
	}
	secmark kprop_input {
		"system_u:object_r:kprop_server_packet_t:s0"
	}
	secmark kprop_output {
		"system_u:object_r:kprop_client_packet_t:s0"
	}
	secmark ktalkd_input {
		"system_u:object_r:ktalkd_server_packet_t:s0"
	}
	secmark ktalkd_output {
		"system_u:object_r:ktalkd_client_packet_t:s0"
	}
	secmark kubernetes_input {
		"system_u:object_r:kubernetes_server_packet_t:s0"
	}
	secmark kubernetes_output {
		"system_u:object_r:kubernetes_client_packet_t:s0"
	}
	secmark l2tp_input {
		"system_u:object_r:l2tp_server_packet_t:s0"
	}
	secmark l2tp_output {
		"system_u:object_r:l2tp_client_packet_t:s0"
	}
	secmark ldap_input {
		"system_u:object_r:ldap_server_packet_t:s0"
	}
	secmark ldap_output {
		"system_u:object_r:ldap_client_packet_t:s0"
	}
	secmark lirc_input {
		"system_u:object_r:lirc_server_packet_t:s0"
	}
	secmark lirc_output {
		"system_u:object_r:lirc_client_packet_t:s0"
	}
	secmark llmnr_input {
		"system_u:object_r:llmnr_server_packet_t:s0"
	}
	secmark llmnr_output {
		"system_u:object_r:llmnr_client_packet_t:s0"
	}
	secmark lmtp_input {
		"system_u:object_r:lmtp_server_packet_t:s0"
	}
	secmark lmtp_output {
		"system_u:object_r:lmtp_client_packet_t:s0"
	}
	secmark mail_input {
		"system_u:object_r:mail_server_packet_t:s0"
	}
	secmark mail_output {
		"system_u:object_r:mail_client_packet_t:s0"
	}
	secmark matahari_input {
		"system_u:object_r:matahari_server_packet_t:s0"
	}
	secmark matahari_output {
		"system_u:object_r:matahari_client_packet_t:s0"
	}
	secmark memcache_input {
		"system_u:object_r:memcache_server_packet_t:s0"
	}
	secmark memcache_output {
		"system_u:object_r:memcache_client_packet_t:s0"
	}
	secmark mmcc_input {
		"system_u:object_r:mmcc_server_packet_t:s0"
	}
	secmark mmcc_output {
		"system_u:object_r:mmcc_client_packet_t:s0"
	}
	secmark mon_input {
		"system_u:object_r:mon_server_packet_t:s0"
	}
	secmark mon_output {
		"system_u:object_r:mon_client_packet_t:s0"
	}
	secmark monit_input {
		"system_u:object_r:monit_server_packet_t:s0"
	}
	secmark monit_output {
		"system_u:object_r:monit_client_packet_t:s0"
	}
	secmark monopd_input {
		"system_u:object_r:monopd_server_packet_t:s0"
	}
	secmark monopd_output {
		"system_u:object_r:monopd_client_packet_t:s0"
	}
	secmark mountd_input {
		"system_u:object_r:mountd_server_packet_t:s0"
	}
	secmark mountd_output {
		"system_u:object_r:mountd_client_packet_t:s0"
	}
	secmark movaz_ssc_input {
		"system_u:object_r:movaz_ssc_server_packet_t:s0"
	}
	secmark movaz_ssc_output {
		"system_u:object_r:movaz_ssc_client_packet_t:s0"
	}
	secmark mpd_input {
		"system_u:object_r:mpd_server_packet_t:s0"
	}
	secmark mpd_output {
		"system_u:object_r:mpd_client_packet_t:s0"
	}
	secmark msgsrvr_input {
		"system_u:object_r:msgsrvr_server_packet_t:s0"
	}
	secmark msgsrvr_output {
		"system_u:object_r:msgsrvr_client_packet_t:s0"
	}
	secmark msnp_input {
		"system_u:object_r:msnp_server_packet_t:s0"
	}
	secmark msnp_output {
		"system_u:object_r:msnp_client_packet_t:s0"
	}
	secmark mssql_input {
		"system_u:object_r:mssql_server_packet_t:s0"
	}
	secmark mssql_output {
		"system_u:object_r:mssql_client_packet_t:s0"
	}
	secmark ms_streaming_input {
		"system_u:object_r:ms_streaming_server_packet_t:s0"
	}
	secmark ms_streaming_output {
		"system_u:object_r:ms_streaming_client_packet_t:s0"
	}
	secmark munin_input {
		"system_u:object_r:munin_server_packet_t:s0"
	}
	secmark munin_output {
		"system_u:object_r:munin_client_packet_t:s0"
	}
	secmark mxi_input {
		"system_u:object_r:mxi_server_packet_t:s0"
	}
	secmark mxi_output {
		"system_u:object_r:mxi_client_packet_t:s0"
	}
	secmark mysqld_input {
		"system_u:object_r:mysqld_server_packet_t:s0"
	}
	secmark mysqld_output {
		"system_u:object_r:mysqld_client_packet_t:s0"
	}
	secmark mysqlmanagerd_input {
		"system_u:object_r:mysqlmanagerd_server_packet_t:s0"
	}
	secmark mysqlmanagerd_output {
		"system_u:object_r:mysqlmanagerd_client_packet_t:s0"
	}
	secmark nessus_input {
		"system_u:object_r:nessus_server_packet_t:s0"
	}
	secmark nessus_output {
		"system_u:object_r:nessus_client_packet_t:s0"
	}
	secmark netport_input {
		"system_u:object_r:netport_server_packet_t:s0"
	}
	secmark netport_output {
		"system_u:object_r:netport_client_packet_t:s0"
	}
	secmark netsupport_input {
		"system_u:object_r:netsupport_server_packet_t:s0"
	}
	secmark netsupport_output {
		"system_u:object_r:netsupport_client_packet_t:s0"
	}
	secmark nfs_input {
		"system_u:object_r:nfs_server_packet_t:s0"
	}
	secmark nfs_output {
		"system_u:object_r:nfs_client_packet_t:s0"
	}
	secmark nfsrdma_input {
		"system_u:object_r:nfsrdma_server_packet_t:s0"
	}
	secmark nfsrdma_output {
		"system_u:object_r:nfsrdma_client_packet_t:s0"
	}
	secmark nmbd_input {
		"system_u:object_r:nmbd_server_packet_t:s0"
	}
	secmark nmbd_output {
		"system_u:object_r:nmbd_client_packet_t:s0"
	}
	secmark ntop_input {
		"system_u:object_r:ntop_server_packet_t:s0"
	}
	secmark ntop_output {
		"system_u:object_r:ntop_client_packet_t:s0"
	}
	secmark ntp_input {
		"system_u:object_r:ntp_server_packet_t:s0"
	}
	secmark ntp_output {
		"system_u:object_r:ntp_client_packet_t:s0"
	}
	secmark ntske_input {
		"system_u:object_r:ntske_server_packet_t:s0"
	}
	secmark ntske_output {
		"system_u:object_r:ntske_client_packet_t:s0"
	}
	secmark oa_system_input {
		"system_u:object_r:oa_system_server_packet_t:s0"
	}
	secmark oa_system_output {
		"system_u:object_r:oa_system_client_packet_t:s0"
	}
	secmark oracledb_input {
		"system_u:object_r:oracledb_server_packet_t:s0"
	}
	secmark oracledb_output {
		"system_u:object_r:oracledb_client_packet_t:s0"
	}
	secmark ocsp_input {
		"system_u:object_r:ocsp_server_packet_t:s0"
	}
	secmark ocsp_output {
		"system_u:object_r:ocsp_client_packet_t:s0"
	}
	secmark openhpid_input {
		"system_u:object_r:openhpid_server_packet_t:s0"
	}
	secmark openhpid_output {
		"system_u:object_r:openhpid_client_packet_t:s0"
	}
	secmark openvpn_input {
		"system_u:object_r:openvpn_server_packet_t:s0"
	}
	secmark openvpn_output {
		"system_u:object_r:openvpn_client_packet_t:s0"
	}
	secmark pdps_input {
		"system_u:object_r:pdps_server_packet_t:s0"
	}
	secmark pdps_output {
		"system_u:object_r:pdps_client_packet_t:s0"
	}
	secmark pegasus_http_input {
		"system_u:object_r:pegasus_http_server_packet_t:s0"
	}
	secmark pegasus_http_output {
		"system_u:object_r:pegasus_http_client_packet_t:s0"
	}
	secmark pegasus_https_input {
		"system_u:object_r:pegasus_https_server_packet_t:s0"
	}
	secmark pegasus_https_output {
		"system_u:object_r:pegasus_https_client_packet_t:s0"
	}
	secmark pgpkeyserver_input {
		"system_u:object_r:pgpkeyserver_server_packet_t:s0"
	}
	secmark pgpkeyserver_output {
		"system_u:object_r:pgpkeyserver_client_packet_t:s0"
	}
	secmark pingd_input {
		"system_u:object_r:pingd_server_packet_t:s0"
	}
	secmark pingd_output {
		"system_u:object_r:pingd_client_packet_t:s0"
	}
	secmark pktcable_cops_input {
		"system_u:object_r:pktcable_cops_server_packet_t:s0"
	}
	secmark pktcable_cops_output {
		"system_u:object_r:pktcable_cops_client_packet_t:s0"
	}
	secmark pop_input {
		"system_u:object_r:pop_server_packet_t:s0"
	}
	secmark pop_output {
		"system_u:object_r:pop_client_packet_t:s0"
	}
	secmark portmap_input {
		"system_u:object_r:portmap_server_packet_t:s0"
	}
	secmark portmap_output {
		"system_u:object_r:portmap_client_packet_t:s0"
	}
	secmark postfix_policyd_input {
		"system_u:object_r:postfix_policyd_server_packet_t:s0"
	}
	secmark postfix_policyd_output {
		"system_u:object_r:postfix_policyd_client_packet_t:s0"
	}
	secmark postgresql_input {
		"system_u:object_r:postgresql_server_packet_t:s0"
	}
	secmark postgresql_output {
		"system_u:object_r:postgresql_client_packet_t:s0"
	}
	secmark postgrey_input {
		"system_u:object_r:postgrey_server_packet_t:s0"
	}
	secmark postgrey_output {
		"system_u:object_r:postgrey_client_packet_t:s0"
	}
	secmark pptp_input {
		"system_u:object_r:pptp_server_packet_t:s0"
	}
	secmark pptp_output {
		"system_u:object_r:pptp_client_packet_t:s0"
	}
	secmark prelude_input {
		"system_u:object_r:prelude_server_packet_t:s0"
	}
	secmark prelude_output {
		"system_u:object_r:prelude_client_packet_t:s0"
	}
	secmark presence_input {
		"system_u:object_r:presence_server_packet_t:s0"
	}
	secmark presence_output {
		"system_u:object_r:presence_client_packet_t:s0"
	}
	secmark printer_input {
		"system_u:object_r:printer_server_packet_t:s0"
	}
	secmark printer_output {
		"system_u:object_r:printer_client_packet_t:s0"
	}
	secmark ptal_input {
		"system_u:object_r:ptal_server_packet_t:s0"
	}
	secmark ptal_output {
		"system_u:object_r:ptal_client_packet_t:s0"
	}
	secmark pulseaudio_input {
		"system_u:object_r:pulseaudio_server_packet_t:s0"
	}
	secmark pulseaudio_output {
		"system_u:object_r:pulseaudio_client_packet_t:s0"
	}
	secmark puppet_input {
		"system_u:object_r:puppet_server_packet_t:s0"
	}
	secmark puppet_output {
		"system_u:object_r:puppet_client_packet_t:s0"
	}
	secmark pxe_input {
		"system_u:object_r:pxe_server_packet_t:s0"
	}
	secmark pxe_output {
		"system_u:object_r:pxe_client_packet_t:s0"
	}
	secmark pyzor_input {
		"system_u:object_r:pyzor_server_packet_t:s0"
	}
	secmark pyzor_output {
		"system_u:object_r:pyzor_client_packet_t:s0"
	}
	secmark radacct_input {
		"system_u:object_r:radacct_server_packet_t:s0"
	}
	secmark radacct_output {
		"system_u:object_r:radacct_client_packet_t:s0"
	}
	secmark radius_input {
		"system_u:object_r:radius_server_packet_t:s0"
	}
	secmark radius_output {
		"system_u:object_r:radius_client_packet_t:s0"
	}
	secmark radsec_input {
		"system_u:object_r:radsec_server_packet_t:s0"
	}
	secmark radsec_output {
		"system_u:object_r:radsec_client_packet_t:s0"
	}
	secmark razor_input {
		"system_u:object_r:razor_server_packet_t:s0"
	}
	secmark razor_output {
		"system_u:object_r:razor_client_packet_t:s0"
	}
	secmark redis_input {
		"system_u:object_r:redis_server_packet_t:s0"
	}
	secmark redis_output {
		"system_u:object_r:redis_client_packet_t:s0"
	}
	secmark repository_input {
		"system_u:object_r:repository_server_packet_t:s0"
	}
	secmark repository_output {
		"system_u:object_r:repository_client_packet_t:s0"
	}
	secmark ricci_input {
		"system_u:object_r:ricci_server_packet_t:s0"
	}
	secmark ricci_output {
		"system_u:object_r:ricci_client_packet_t:s0"
	}
	secmark ricci_modcluster_input {
		"system_u:object_r:ricci_modcluster_server_packet_t:s0"
	}
	secmark ricci_modcluster_output {
		"system_u:object_r:ricci_modcluster_client_packet_t:s0"
	}
	secmark rlogind_input {
		"system_u:object_r:rlogind_server_packet_t:s0"
	}
	secmark rlogind_output {
		"system_u:object_r:rlogind_client_packet_t:s0"
	}
	secmark rndc_input {
		"system_u:object_r:rndc_server_packet_t:s0"
	}
	secmark rndc_output {
		"system_u:object_r:rndc_client_packet_t:s0"
	}
	secmark router_input {
		"system_u:object_r:router_server_packet_t:s0"
	}
	secmark router_output {
		"system_u:object_r:router_client_packet_t:s0"
	}
	secmark rsh_input {
		"system_u:object_r:rsh_server_packet_t:s0"
	}
	secmark rsh_output {
		"system_u:object_r:rsh_client_packet_t:s0"
	}
	secmark rsync_input {
		"system_u:object_r:rsync_server_packet_t:s0"
	}
	secmark rsync_output {
		"system_u:object_r:rsync_client_packet_t:s0"
	}
	secmark rtsp_input {
		"system_u:object_r:rtsp_server_packet_t:s0"
	}
	secmark rtsp_output {
		"system_u:object_r:rtsp_client_packet_t:s0"
	}
	secmark rwho_input {
		"system_u:object_r:rwho_server_packet_t:s0"
	}
	secmark rwho_output {
		"system_u:object_r:rwho_client_packet_t:s0"
	}
	secmark sap_input {
		"system_u:object_r:sap_server_packet_t:s0"
	}
	secmark sap_output {
		"system_u:object_r:sap_client_packet_t:s0"
	}
	secmark servistaitsm_input {
		"system_u:object_r:servistaitsm_server_packet_t:s0"
	}
	secmark servistaitsm_output {
		"system_u:object_r:servistaitsm_client_packet_t:s0"
	}
	secmark sieve_input {
		"system_u:object_r:sieve_server_packet_t:s0"
	}
	secmark sieve_output {
		"system_u:object_r:sieve_client_packet_t:s0"
	}
	secmark sip_input {
		"system_u:object_r:sip_server_packet_t:s0"
	}
	secmark sip_output {
		"system_u:object_r:sip_client_packet_t:s0"
	}
	secmark sixxsconfig_input {
		"system_u:object_r:sixxsconfig_server_packet_t:s0"
	}
	secmark sixxsconfig_output {
		"system_u:object_r:sixxsconfig_client_packet_t:s0"
	}
	secmark smbd_input {
		"system_u:object_r:smbd_server_packet_t:s0"
	}
	secmark smbd_output {
		"system_u:object_r:smbd_client_packet_t:s0"
	}
	secmark smtp_input {
		"system_u:object_r:smtp_server_packet_t:s0"
	}
	secmark smtp_output {
		"system_u:object_r:smtp_client_packet_t:s0"
	}
	secmark snmp_input {
		"system_u:object_r:snmp_server_packet_t:s0"
	}
	secmark snmp_output {
		"system_u:object_r:snmp_client_packet_t:s0"
	}
	secmark soundd_input {
		"system_u:object_r:soundd_server_packet_t:s0"
	}
	secmark soundd_output {
		"system_u:object_r:soundd_client_packet_t:s0"
	}
	secmark spamd_input {
		"system_u:object_r:spamd_server_packet_t:s0"
	}
	secmark spamd_output {
		"system_u:object_r:spamd_client_packet_t:s0"
	}
	secmark speech_input {
		"system_u:object_r:speech_server_packet_t:s0"
	}
	secmark speech_output {
		"system_u:object_r:speech_client_packet_t:s0"
	}
	secmark squid_input {
		"system_u:object_r:squid_server_packet_t:s0"
	}
	secmark squid_output {
		"system_u:object_r:squid_client_packet_t:s0"
	}
	secmark ssdp_input {
		"system_u:object_r:ssdp_server_packet_t:s0"
	}
	secmark ssdp_output {
		"system_u:object_r:ssdp_client_packet_t:s0"
	}
	secmark ssh_input {
		"system_u:object_r:ssh_server_packet_t:s0"
	}
	secmark ssh_output {
		"system_u:object_r:ssh_client_packet_t:s0"
	}
	secmark svn_input {
		"system_u:object_r:svn_server_packet_t:s0"
	}
	secmark svn_output {
		"system_u:object_r:svn_client_packet_t:s0"
	}
	secmark svrloc_input {
		"system_u:object_r:svrloc_server_packet_t:s0"
	}
	secmark svrloc_output {
		"system_u:object_r:svrloc_client_packet_t:s0"
	}
	secmark swat_input {
		"system_u:object_r:swat_server_packet_t:s0"
	}
	secmark swat_output {
		"system_u:object_r:swat_client_packet_t:s0"
	}
	secmark syncthing_input {
		"system_u:object_r:syncthing_server_packet_t:s0"
	}
	secmark syncthing_output {
		"system_u:object_r:syncthing_client_packet_t:s0"
	}
	secmark syncthing_admin_input {
		"system_u:object_r:syncthing_admin_server_packet_t:s0"
	}
	secmark syncthing_admin_output {
		"system_u:object_r:syncthing_admin_client_packet_t:s0"
	}
	secmark syncthing_discovery_input {
		"system_u:object_r:syncthing_discovery_server_packet_t:s0"
	}
	secmark syncthing_discovery_output {
		"system_u:object_r:syncthing_discovery_client_packet_t:s0"
	}
	secmark sype_transport_input {
		"system_u:object_r:sype_transport_server_packet_t:s0"
	}
	secmark sype_transport_output {
		"system_u:object_r:sype_transport_client_packet_t:s0"
	}
	secmark syslogd_input {
		"system_u:object_r:syslogd_server_packet_t:s0"
	}
	secmark syslogd_output {
		"system_u:object_r:syslogd_client_packet_t:s0"
	}
	secmark syslog_tls_input {
		"system_u:object_r:syslog_tls_server_packet_t:s0"
	}
	secmark syslog_tls_output {
		"system_u:object_r:syslog_tls_client_packet_t:s0"
	}
	secmark tcs_input {
		"system_u:object_r:tcs_server_packet_t:s0"
	}
	secmark tcs_output {
		"system_u:object_r:tcs_client_packet_t:s0"
	}
	secmark telnetd_input {
		"system_u:object_r:telnetd_server_packet_t:s0"
	}
	secmark telnetd_output {
		"system_u:object_r:telnetd_client_packet_t:s0"
	}
	secmark tftp_input {
		"system_u:object_r:tftp_server_packet_t:s0"
	}
	secmark tftp_output {
		"system_u:object_r:tftp_client_packet_t:s0"
	}
	secmark tor_input {
		"system_u:object_r:tor_server_packet_t:s0"
	}
	secmark tor_output {
		"system_u:object_r:tor_client_packet_t:s0"
	}
	secmark traceroute_input {
		"system_u:object_r:traceroute_server_packet_t:s0"
	}
	secmark traceroute_output {
		"system_u:object_r:traceroute_client_packet_t:s0"
	}
	secmark transproxy_input {
		"system_u:object_r:transproxy_server_packet_t:s0"
	}
	secmark transproxy_output {
		"system_u:object_r:transproxy_client_packet_t:s0"
	}
	secmark trisoap_input {
		"system_u:object_r:trisoap_server_packet_t:s0"
	}
	secmark trisoap_output {
		"system_u:object_r:trisoap_client_packet_t:s0"
	}
	secmark trivnet1_input {
		"system_u:object_r:trivnet1_server_packet_t:s0"
	}
	secmark trivnet1_output {
		"system_u:object_r:trivnet1_client_packet_t:s0"
	}
	secmark ups_input {
		"system_u:object_r:ups_server_packet_t:s0"
	}
	secmark ups_output {
		"system_u:object_r:ups_client_packet_t:s0"
	}
	secmark uucpd_input {
		"system_u:object_r:uucpd_server_packet_t:s0"
	}
	secmark uucpd_output {
		"system_u:object_r:uucpd_client_packet_t:s0"
	}
	secmark varnishd_input {
		"system_u:object_r:varnishd_server_packet_t:s0"
	}
	secmark varnishd_output {
		"system_u:object_r:varnishd_client_packet_t:s0"
	}
	secmark virt_input {
		"system_u:object_r:virt_server_packet_t:s0"
	}
	secmark virt_output {
		"system_u:object_r:virt_client_packet_t:s0"
	}
	secmark virtual_places_input {
		"system_u:object_r:virtual_places_server_packet_t:s0"
	}
	secmark virtual_places_output {
		"system_u:object_r:virtual_places_client_packet_t:s0"
	}
	secmark virt_migration_input {
		"system_u:object_r:virt_migration_server_packet_t:s0"
	}
	secmark virt_migration_output {
		"system_u:object_r:virt_migration_client_packet_t:s0"
	}
	secmark vnc_input {
		"system_u:object_r:vnc_server_packet_t:s0"
	}
	secmark vnc_output {
		"system_u:object_r:vnc_client_packet_t:s0"
	}
	secmark wccp_input {
		"system_u:object_r:wccp_server_packet_t:s0"
	}
	secmark wccp_output {
		"system_u:object_r:wccp_client_packet_t:s0"
	}
	secmark websm_input {
		"system_u:object_r:websm_server_packet_t:s0"
	}
	secmark websm_output {
		"system_u:object_r:websm_client_packet_t:s0"
	}
	secmark whois_input {
		"system_u:object_r:whois_server_packet_t:s0"
	}
	secmark whois_output {
		"system_u:object_r:whois_client_packet_t:s0"
	}
	secmark winshadow_input {
		"system_u:object_r:winshadow_server_packet_t:s0"
	}
	secmark winshadow_output {
		"system_u:object_r:winshadow_client_packet_t:s0"
	}
	secmark wsdapi_input {
		"system_u:object_r:wsdapi_server_packet_t:s0"
	}
	secmark wsdapi_output {
		"system_u:object_r:wsdapi_client_packet_t:s0"
	}
	secmark wsicopy_input {
		"system_u:object_r:wsicopy_server_packet_t:s0"
	}
	secmark wsicopy_output {
		"system_u:object_r:wsicopy_client_packet_t:s0"
	}
	secmark xdmcp_input {
		"system_u:object_r:xdmcp_server_packet_t:s0"
	}
	secmark xdmcp_output {
		"system_u:object_r:xdmcp_client_packet_t:s0"
	}
	secmark xen_input {
		"system_u:object_r:xen_server_packet_t:s0"
	}
	secmark xen_output {
		"system_u:object_r:xen_client_packet_t:s0"
	}
	secmark xfs_input {
		"system_u:object_r:xfs_server_packet_t:s0"
	}
	secmark xfs_output {
		"system_u:object_r:xfs_client_packet_t:s0"
	}
	secmark xserver_input {
		"system_u:object_r:xserver_server_packet_t:s0"
	}
	secmark xserver_output {
		"system_u:object_r:xserver_client_packet_t:s0"
	}
	secmark zarafa_input {
		"system_u:object_r:zarafa_server_packet_t:s0"
	}
	secmark zarafa_output {
		"system_u:object_r:zarafa_client_packet_t:s0"
	}
	secmark zabbix_input {
		"system_u:object_r:zabbix_server_packet_t:s0"
	}
	secmark zabbix_output {
		"system_u:object_r:zabbix_client_packet_t:s0"
	}
	secmark zabbix_agent_input {
		"system_u:object_r:zabbix_agent_server_packet_t:s0"
	}
	secmark zabbix_agent_output {
		"system_u:object_r:zabbix_agent_client_packet_t:s0"
	}
	secmark zookeeper_client_input {
		"system_u:object_r:zookeeper_client_server_packet_t:s0"
	}
	secmark zookeeper_client_output {
		"system_u:object_r:zookeeper_client_client_packet_t:s0"
	}
	secmark zookeeper_election_input {
		"system_u:object_r:zookeeper_election_server_packet_t:s0"
	}
	secmark zookeeper_election_output {
		"system_u:object_r:zookeeper_election_client_packet_t:s0"
	}
	secmark zookeeper_leader_input {
		"system_u:object_r:zookeeper_leader_server_packet_t:s0"
	}
	secmark zookeeper_leader_output {
		"system_u:object_r:zookeeper_leader_client_packet_t:s0"
	}
	secmark zebra_input {
		"system_u:object_r:zebra_server_packet_t:s0"
	}
	secmark zebra_output {
		"system_u:object_r:zebra_client_packet_t:s0"
	}
	secmark zented_input {
		"system_u:object_r:zented_server_packet_t:s0"
	}
	secmark zented_output {
		"system_u:object_r:zented_client_packet_t:s0"
	}
	secmark zope_input {
		"system_u:object_r:zope_server_packet_t:s0"
	}
	secmark zope_output {
		"system_u:object_r:zope_client_packet_t:s0"
	}
	chain INPUT {
		type filter hook input priority 0; policy accept;
		ct state new meta secmark set "default_input_packet"
		ct state new udp dport 7007 meta secmark set "afs_bos_input"
		ct state new tcp dport 2040 meta secmark set "afs_fs_input"
		ct state new udp dport 7000 meta secmark set "afs_fs_input"
		ct state new udp dport 7005 meta secmark set "afs_fs_input"
		ct state new udp dport 7004 meta secmark set "afs_ka_input"
		ct state new udp dport 7002 meta secmark set "afs_pt_input"
		ct state new udp dport 7003 meta secmark set "afs_vl_input"
		ct state new tcp dport 7001 meta secmark set "afs3_callback_input"
		ct state new udp dport 7001 meta secmark set "afs3_callback_input"
		ct state new udp dport 705 meta secmark set "agentx_input"
		ct state new tcp dport 705 meta secmark set "agentx_input"
		ct state new udp dport 10080-10082 meta secmark set "amanda_input"
		ct state new tcp dport 10080-10083 meta secmark set "amanda_input"
		ct state new tcp dport 10024 meta secmark set "amavisd_recv_input"
		ct state new tcp dport 10025 meta secmark set "amavisd_send_input"
		ct state new udp dport 5671-5672 meta secmark set "amqp_input"
		ct state new tcp dport 5671-5672 meta secmark set "amqp_input"
		ct state new udp dport 5190-5193 meta secmark set "aol_input"
		ct state new tcp dport 5190-5193 meta secmark set "aol_input"
		ct state new tcp dport 3551 meta secmark set "apcupsd_input"
		ct state new udp dport 3551 meta secmark set "apcupsd_input"
		ct state new tcp dport 539 meta secmark set "apertus_ldp_input"
		ct state new udp dport 539 meta secmark set "apertus_ldp_input"
		ct state new tcp dport 3142 meta secmark set "aptcacher_input"
		ct state new tcp dport 9292 meta secmark set "armtechdaemon_input"
		ct state new udp dport 9292 meta secmark set "armtechdaemon_input"
		ct state new tcp dport 1720 meta secmark set "asterisk_input"
		ct state new udp dport 2427 meta secmark set "asterisk_input"
		ct state new udp dport 2727 meta secmark set "asterisk_input"
		ct state new udp dport 4569 meta secmark set "asterisk_input"
		ct state new tcp dport 60 meta secmark set "audit_input"
		ct state new tcp dport 113 meta secmark set "auth_input"
		ct state new tcp dport 179 meta secmark set "bgp_input"
		ct state new udp dport 179 meta secmark set "bgp_input"
		ct state new tcp dport 2605 meta secmark set "bgp_input"
		ct state new udp dport 2605 meta secmark set "bgp_input"
		ct state new tcp dport 31416 meta secmark set "boinc_input"
		ct state new tcp dport 1043 meta secmark set "boinc_client_input"
		ct state new udp dport 1034 meta secmark set "boinc_client_input"
		ct state new tcp dport 51235 meta secmark set "certmaster_input"
		ct state new udp dport 323 meta secmark set "chronyd_input"
		ct state new tcp dport 3310 meta secmark set "clamd_input"
		ct state new udp dport 4041 meta secmark set "clockspeed_input"
		ct state new tcp dport 5149 meta secmark set "cluster_input"
		ct state new udp dport 5149 meta secmark set "cluster_input"
		ct state new tcp dport 40040 meta secmark set "cluster_input"
		ct state new tcp dport 50006-50008 meta secmark set "cluster_input"
		ct state new udp dport 50006-50008 meta secmark set "cluster_input"
		ct state new tcp dport 1050 meta secmark set "cma_input"
		ct state new udp dport 1050 meta secmark set "cma_input"
		ct state new tcp dport 25151 meta secmark set "cobbler_input"
		ct state new tcp dport 5001 meta secmark set "commplex_link_input"
		ct state new udp dport 5001 meta secmark set "commplex_link_input"
		ct state new tcp dport 5000 meta secmark set "commplex_main_input"
		ct state new udp dport 5000 meta secmark set "commplex_main_input"
		ct state new udp dport 512 meta secmark set "comsat_input"
		ct state new tcp dport 9618 meta secmark set "condor_input"
		ct state new udp dport 9618 meta secmark set "condor_input"
		ct state new tcp dport 5984 meta secmark set "couchdb_input"
		ct state new udp dport 5984 meta secmark set "couchdb_input"
		ct state new tcp dport 9000 meta secmark set "cslistener_input"
		ct state new udp dport 9000 meta secmark set "cslistener_input"
		ct state new tcp dport 4379 meta secmark set "ctdb_input"
		ct state new udp dport 4397 meta secmark set "ctdb_input"
		ct state new tcp dport 2401 meta secmark set "cvs_input"
		ct state new udp dport 2401 meta secmark set "cvs_input"
		ct state new tcp dport 6767 meta secmark set "cyphesis_input"
		ct state new tcp dport 6769 meta secmark set "cyphesis_input"
		ct state new tcp dport 6780-6799 meta secmark set "cyphesis_input"
		ct state new udp dport 32771 meta secmark set "cyphesis_input"
		ct state new tcp dport 3689 meta secmark set "daap_input"
		ct state new udp dport 3689 meta secmark set "daap_input"
		ct state new tcp dport 1178 meta secmark set "dbskkd_input"
		ct state new udp dport 6276 meta secmark set "dcc_input"
		ct state new udp dport 6277 meta secmark set "dcc_input"
		ct state new tcp dport 5679 meta secmark set "dccm_input"
		ct state new udp dport 5679 meta secmark set "dccm_input"
		ct state new udp dport 68 meta secmark set "dhcpc_input"
		ct state new tcp dport 68 meta secmark set "dhcpc_input"
		ct state new udp dport 546 meta secmark set "dhcpc_input"
		ct state new tcp dport 546 meta secmark set "dhcpc_input"
		ct state new udp dport 5546 meta secmark set "dhcpc_input"
		ct state new tcp dport 5546 meta secmark set "dhcpc_input"
		ct state new udp dport 67 meta secmark set "dhcpd_input"
		ct state new udp dport 547 meta secmark set "dhcpd_input"
		ct state new tcp dport 547 meta secmark set "dhcpd_input"
		ct state new udp dport 548 meta secmark set "dhcpd_input"
		ct state new tcp dport 548 meta secmark set "dhcpd_input"
		ct state new tcp dport 647 meta secmark set "dhcpd_input"
		ct state new udp dport 647 meta secmark set "dhcpd_input"
		ct state new tcp dport 847 meta secmark set "dhcpd_input"
		ct state new udp dport 847 meta secmark set "dhcpd_input"
		ct state new tcp dport 7911 meta secmark set "dhcpd_input"
		ct state new tcp dport 2628 meta secmark set "dict_input"
		ct state new tcp dport 3632 meta secmark set "distccd_input"
		ct state new tcp dport 53 meta secmark set "dns_input"
		ct state new udp dport 53 meta secmark set "dns_input"
		ct state new tcp dport 853 meta secmark set "dns_input"
		ct state new tcp dport 17500 meta secmark set "dropbox_input"
		ct state new udp dport 17500 meta secmark set "dropbox_input"
		ct state new tcp dport 520 meta secmark set "efs_input"
		ct state new tcp dport 3198 meta secmark set "embrace_dp_c_input"
		ct state new udp dport 3198 meta secmark set "embrace_dp_c_input"
		ct state new tcp dport 135 meta secmark set "epmap_input"
		ct state new udp dport 135 meta secmark set "epmap_input"
		ct state new tcp dport 4369 meta secmark set "epmd_input"
		ct state new udp dport 4369 meta secmark set "epmd_input"
		ct state new tcp dport 79 meta secmark set "fingerd_input"
		ct state new tcp dport 21 meta secmark set "ftp_input"
		ct state new tcp dport 990 meta secmark set "ftp_input"
		ct state new udp dport 990 meta secmark set "ftp_input"
		ct state new tcp dport 20 meta secmark set "ftp_data_input"
		ct state new udp dport 1718 meta secmark set "gatekeeper_input"
		ct state new udp dport 1719 meta secmark set "gatekeeper_input"
		ct state new tcp dport 1721 meta secmark set "gatekeeper_input"
		ct state new tcp dport 7000 meta secmark set "gatekeeper_input"
		ct state new tcp dport 538 meta secmark set "gdomap_input"
		ct state new udp dport 538 meta secmark set "gdomap_input"
		ct state new tcp dport 3050 meta secmark set "gds_db_input"
		ct state new udp dport 3050 meta secmark set "gds_db_input"
		ct state new tcp dport 9418 meta secmark set "git_input"
		ct state new udp dport 9418 meta secmark set "git_input"
		ct state new tcp dport 9191 meta secmark set "glance_registry_input"
		ct state new udp dport 9191 meta secmark set "glance_registry_input"
		ct state new tcp dport 24007 meta secmark set "glusterd_input"
		ct state new tcp dport 24009 meta secmark set "glusterd_input"
		ct state new tcp dport 70 meta secmark set "gopher_input"
		ct state new udp dport 70 meta secmark set "gopher_input"
		ct state new tcp dport 2947 meta secmark set "gpsd_input"
		ct state new tcp dport 50010 meta secmark set "hadoop_datanode_input"
		ct state new tcp dport 8020 meta secmark set "hadoop_namenode_input"
		ct state new tcp dport 7634 meta secmark set "hddtemp_input"
		ct state new tcp dport 5335 meta secmark set "howl_input"
		ct state new udp dport 5353 meta secmark set "howl_input"
		ct state new tcp dport 1782 meta secmark set "hplip_input"
		ct state new tcp dport 2207 meta secmark set "hplip_input"
		ct state new tcp dport 2208 meta secmark set "hplip_input"
		ct state new tcp dport 8290 meta secmark set "hplip_input"
		ct state new tcp dport 50000 meta secmark set "hplip_input"
		ct state new tcp dport 50002 meta secmark set "hplip_input"
		ct state new tcp dport 8292 meta secmark set "hplip_input"
		ct state new tcp dport 9100 meta secmark set "hplip_input"
		ct state new tcp dport 9101 meta secmark set "hplip_input"
		ct state new tcp dport 9102 meta secmark set "hplip_input"
		ct state new tcp dport 9220 meta secmark set "hplip_input"
		ct state new tcp dport 9221 meta secmark set "hplip_input"
		ct state new tcp dport 9222 meta secmark set "hplip_input"
		ct state new tcp dport 9280 meta secmark set "hplip_input"
		ct state new tcp dport 9281 meta secmark set "hplip_input"
		ct state new tcp dport 9282 meta secmark set "hplip_input"
		ct state new tcp dport 9290 meta secmark set "hplip_input"
		ct state new tcp dport 9291 meta secmark set "hplip_input"
		ct state new tcp dport 80 meta secmark set "http_input"
		ct state new tcp dport 443 meta secmark set "http_input"
		ct state new tcp dport 488 meta secmark set "http_input"
		ct state new tcp dport 8008 meta secmark set "http_input"
		ct state new tcp dport 8009 meta secmark set "http_input"
		ct state new tcp dport 8443 meta secmark set "http_input"
		ct state new tcp dport 8448 meta secmark set "http_input"
		ct state new tcp dport 3128 meta secmark set "http_cache_input"
		ct state new udp dport 3130 meta secmark set "http_cache_input"
		ct state new tcp dport 8080 meta secmark set "http_cache_input"
		ct state new tcp dport 8118 meta secmark set "http_cache_input"
		ct state new tcp dport 10001-10010 meta secmark set "http_cache_input"
		ct state new tcp dport 9010 meta secmark set "i18n_input_input"
		ct state new tcp dport 5323 meta secmark set "imaze_input"
		ct state new udp dport 5323 meta secmark set "imaze_input"
		ct state new tcp dport 1 meta secmark set "inetd_child_input"
		ct state new udp dport 1 meta secmark set "inetd_child_input"
		ct state new tcp dport 7 meta secmark set "inetd_child_input"
		ct state new udp dport 7 meta secmark set "inetd_child_input"
		ct state new tcp dport 9 meta secmark set "inetd_child_input"
		ct state new udp dport 9 meta secmark set "inetd_child_input"
		ct state new tcp dport 13 meta secmark set "inetd_child_input"
		ct state new udp dport 13 meta secmark set "inetd_child_input"
		ct state new tcp dport 19 meta secmark set "inetd_child_input"
		ct state new udp dport 19 meta secmark set "inetd_child_input"
		ct state new tcp dport 37 meta secmark set "inetd_child_input"
		ct state new udp dport 37 meta secmark set "inetd_child_input"
		ct state new tcp dport 512 meta secmark set "inetd_child_input"
		ct state new tcp dport 543 meta secmark set "inetd_child_input"
		ct state new tcp dport 544 meta secmark set "inetd_child_input"
		ct state new tcp dport 891 meta secmark set "inetd_child_input"
		ct state new udp dport 891 meta secmark set "inetd_child_input"
		ct state new tcp dport 892 meta secmark set "inetd_child_input"
		ct state new udp dport 892 meta secmark set "inetd_child_input"
		ct state new tcp dport 2105 meta secmark set "inetd_child_input"
		ct state new tcp dport 5666 meta secmark set "inetd_child_input"
		ct state new tcp dport 119 meta secmark set "innd_input"
		ct state new tcp dport 7778 meta secmark set "interwise_input"
		ct state new udp dport 7778 meta secmark set "interwise_input"
		ct state new tcp dport 7410 meta secmark set "ionixnetmon_input"
		ct state new udp dport 7410 meta secmark set "ionixnetmon_input"
		ct state new udp dport 623 meta secmark set "ipmi_input"
		ct state new udp dport 664 meta secmark set "ipmi_input"
		ct state new tcp dport 631 meta secmark set "ipp_input"
		ct state new udp dport 631 meta secmark set "ipp_input"
		ct state new tcp dport 8610-8614 meta secmark set "ipp_input"
		ct state new udp dport 8610-8614 meta secmark set "ipp_input"
		ct state new tcp dport 4500 meta secmark set "ipsecnat_input"
		ct state new udp dport 4500 meta secmark set "ipsecnat_input"
		ct state new tcp dport 6665 meta secmark set "ircd_input"
		ct state new tcp dport 6666 meta secmark set "ircd_input"
		ct state new tcp dport 6667 meta secmark set "ircd_input"
		ct state new tcp dport 6668 meta secmark set "ircd_input"
		ct state new tcp dport 6669 meta secmark set "ircd_input"
		ct state new tcp dport 6697 meta secmark set "ircd_input"
		ct state new udp dport 500 meta secmark set "isakmp_input"
		ct state new tcp dport 3260 meta secmark set "iscsi_input"
		ct state new tcp dport 3205 meta secmark set "isns_input"
		ct state new udp dport 3205 meta secmark set "isns_input"
		ct state new tcp dport 5222 meta secmark set "jabber_client_input"
		ct state new tcp dport 5223 meta secmark set "jabber_client_input"
		ct state new tcp dport 5269 meta secmark set "jabber_interserver_input"
		ct state new tcp dport 3528 meta secmark set "jboss_iiop_input"
		ct state new udp dport 3528 meta secmark set "jboss_iiop_input"
		ct state new tcp dport 88 meta secmark set "kerberos_input"
		ct state new udp dport 88 meta secmark set "kerberos_input"
		ct state new tcp dport 750 meta secmark set "kerberos_input"
		ct state new udp dport 750 meta secmark set "kerberos_input"
		ct state new tcp dport 464 meta secmark set "kerberos_admin_input"
		ct state new udp dport 464 meta secmark set "kerberos_admin_input"
		ct state new tcp dport 749 meta secmark set "kerberos_admin_input"
		ct state new tcp dport 4444 meta secmark set "kerberos_master_input"
		ct state new udp dport 4444 meta secmark set "kerberos_master_input"
		ct state new tcp dport 2501 meta secmark set "kismet_input"
		ct state new tcp dport 754 meta secmark set "kprop_input"
		ct state new udp dport 517 meta secmark set "ktalkd_input"
		ct state new udp dport 518 meta secmark set "ktalkd_input"
		ct state new tcp dport 2379-2381 meta secmark set "kubernetes_input"
		ct state new tcp dport 6443 meta secmark set "kubernetes_input"
		ct state new tcp dport 10248-10250 meta secmark set "kubernetes_input"
		ct state new tcp dport 10256-10257 meta secmark set "kubernetes_input"
		ct state new tcp dport 10259 meta secmark set "kubernetes_input"
		ct state new tcp dport 1701 meta secmark set "l2tp_input"
		ct state new udp dport 1701 meta secmark set "l2tp_input"
		ct state new tcp dport 389 meta secmark set "ldap_input"
		ct state new udp dport 389 meta secmark set "ldap_input"
		ct state new tcp dport 636 meta secmark set "ldap_input"
		ct state new udp dport 636 meta secmark set "ldap_input"
		ct state new tcp dport 3268 meta secmark set "ldap_input"
		ct state new tcp dport 3269 meta secmark set "ldap_input"
		ct state new tcp dport 8765 meta secmark set "lirc_input"
		ct state new tcp dport 5355 meta secmark set "llmnr_input"
		ct state new udp dport 5355 meta secmark set "llmnr_input"
		ct state new tcp dport 24 meta secmark set "lmtp_input"
		ct state new udp dport 24 meta secmark set "lmtp_input"
		ct state new tcp dport 2000 meta secmark set "mail_input"
		ct state new tcp dport 3905 meta secmark set "mail_input"
		ct state new tcp dport 49000 meta secmark set "matahari_input"
		ct state new udp dport 49000 meta secmark set "matahari_input"
		ct state new tcp dport 11211 meta secmark set "memcache_input"
		ct state new udp dport 11211 meta secmark set "memcache_input"
		ct state new tcp dport 5050 meta secmark set "mmcc_input"
		ct state new udp dport 5050 meta secmark set "mmcc_input"
		ct state new tcp dport 2583 meta secmark set "mon_input"
		ct state new udp dport 2583 meta secmark set "mon_input"
		ct state new tcp dport 2812 meta secmark set "monit_input"
		ct state new tcp dport 1234 meta secmark set "monopd_input"
		ct state new tcp dport 20048 meta secmark set "mountd_input"
		ct state new udp dport 20048 meta secmark set "mountd_input"
		ct state new tcp dport 5252 meta secmark set "movaz_ssc_input"
		ct state new udp dport 5252 meta secmark set "movaz_ssc_input"
		ct state new tcp dport 6600 meta secmark set "mpd_input"
		ct state new tcp dport 8787 meta secmark set "msgsrvr_input"
		ct state new udp dport 8787 meta secmark set "msgsrvr_input"
		ct state new tcp dport 1863 meta secmark set "msnp_input"
		ct state new udp dport 1863 meta secmark set "msnp_input"
		ct state new tcp dport 1433-1434 meta secmark set "mssql_input"
		ct state new udp dport 1433-1434 meta secmark set "mssql_input"
		ct state new tcp dport 1755 meta secmark set "ms_streaming_input"
		ct state new udp dport 1755 meta secmark set "ms_streaming_input"
		ct state new tcp dport 4949 meta secmark set "munin_input"
		ct state new udp dport 4949 meta secmark set "munin_input"
		ct state new tcp dport 8005 meta secmark set "mxi_input"
		ct state new udp dport 8005 meta secmark set "mxi_input"
		ct state new tcp dport 1186 meta secmark set "mysqld_input"
		ct state new tcp dport 3306 meta secmark set "mysqld_input"
		ct state new tcp dport 63132-63164 meta secmark set "mysqld_input"
		ct state new tcp dport 2273 meta secmark set "mysqlmanagerd_input"
		ct state new tcp dport 1241 meta secmark set "nessus_input"
		ct state new tcp dport 3129 meta secmark set "netport_input"
		ct state new udp dport 3129 meta secmark set "netport_input"
		ct state new tcp dport 5404 meta secmark set "netsupport_input"
		ct state new udp dport 5404 meta secmark set "netsupport_input"
		ct state new tcp dport 5405 meta secmark set "netsupport_input"
		ct state new udp dport 5405 meta secmark set "netsupport_input"
		ct state new tcp dport 2049 meta secmark set "nfs_input"
		ct state new udp dport 2049 meta secmark set "nfs_input"
		ct state new tcp dport 20049 meta secmark set "nfsrdma_input"
		ct state new udp dport 20049 meta secmark set "nfsrdma_input"
		ct state new udp dport 137 meta secmark set "nmbd_input"
		ct state new udp dport 138 meta secmark set "nmbd_input"
		ct state new tcp dport 3000-3001 meta secmark set "ntop_input"
		ct state new udp dport 3000-3001 meta secmark set "ntop_input"
		ct state new udp dport 123 meta secmark set "ntp_input"
		ct state new tcp dport 4460 meta secmark set "ntske_input"
		ct state new tcp dport 8022 meta secmark set "oa_system_input"
		ct state new udp dport 8022 meta secmark set "oa_system_input"
		ct state new tcp dport 1521 meta secmark set "oracledb_input"
		ct state new udp dport 1521 meta secmark set "oracledb_input"
		ct state new tcp dport 2483 meta secmark set "oracledb_input"
		ct state new udp dport 2483 meta secmark set "oracledb_input"
		ct state new tcp dport 2484 meta secmark set "oracledb_input"
		ct state new udp dport 2484 meta secmark set "oracledb_input"
		ct state new tcp dport 9080 meta secmark set "ocsp_input"
		ct state new tcp dport 4743 meta secmark set "openhpid_input"
		ct state new udp dport 4743 meta secmark set "openhpid_input"
		ct state new tcp dport 1194 meta secmark set "openvpn_input"
		ct state new udp dport 1194 meta secmark set "openvpn_input"
		ct state new tcp dport 1314 meta secmark set "pdps_input"
		ct state new udp dport 1314 meta secmark set "pdps_input"
		ct state new tcp dport 5988 meta secmark set "pegasus_http_input"
		ct state new tcp dport 5989 meta secmark set "pegasus_https_input"
		ct state new udp dport 11371 meta secmark set "pgpkeyserver_input"
		ct state new tcp dport 11371 meta secmark set "pgpkeyserver_input"
		ct state new tcp dport 9125 meta secmark set "pingd_input"
		ct state new tcp dport 2126 meta secmark set "pktcable_cops_input"
		ct state new udp dport 2126 meta secmark set "pktcable_cops_input"
		ct state new tcp dport 106 meta secmark set "pop_input"
		ct state new tcp dport 109 meta secmark set "pop_input"
		ct state new tcp dport 110 meta secmark set "pop_input"
		ct state new tcp dport 143 meta secmark set "pop_input"
		ct state new tcp dport 220 meta secmark set "pop_input"
		ct state new tcp dport 993 meta secmark set "pop_input"
		ct state new tcp dport 995 meta secmark set "pop_input"
		ct state new tcp dport 1109 meta secmark set "pop_input"
		ct state new udp dport 111 meta secmark set "portmap_input"
		ct state new tcp dport 111 meta secmark set "portmap_input"
		ct state new tcp dport 10031 meta secmark set "postfix_policyd_input"
		ct state new tcp dport 5432 meta secmark set "postgresql_input"
		ct state new tcp dport 10023 meta secmark set "postgrey_input"
		ct state new tcp dport 60000 meta secmark set "postgrey_input"
		ct state new tcp dport 1723 meta secmark set "pptp_input"
		ct state new udp dport 1723 meta secmark set "pptp_input"
		ct state new tcp dport 4690 meta secmark set "prelude_input"
		ct state new udp dport 4690 meta secmark set "prelude_input"
		ct state new tcp dport 5298-5299 meta secmark set "presence_input"
		ct state new udp dport 5298-5299 meta secmark set "presence_input"
		ct state new tcp dport 515 meta secmark set "printer_input"
		ct state new tcp dport 5703 meta secmark set "ptal_input"
		ct state new tcp dport 4713 meta secmark set "pulseaudio_input"
		ct state new tcp dport 8140 meta secmark set "puppet_input"
		ct state new udp dport 4011 meta secmark set "pxe_input"
		ct state new udp dport 24441 meta secmark set "pyzor_input"
		ct state new udp dport 1646 meta secmark set "radacct_input"
		ct state new udp dport 1813 meta secmark set "radacct_input"
		ct state new udp dport 1645 meta secmark set "radius_input"
		ct state new udp dport 1812 meta secmark set "radius_input"
		ct state new tcp dport 2083 meta secmark set "radsec_input"
		ct state new tcp dport 2703 meta secmark set "razor_input"
		ct state new tcp dport 6379 meta secmark set "redis_input"
		ct state new tcp dport 26379 meta secmark set "redis_input"
		ct state new tcp dport 6363 meta secmark set "repository_input"
		ct state new tcp dport 11111 meta secmark set "ricci_input"
		ct state new udp dport 11111 meta secmark set "ricci_input"
		ct state new tcp dport 16851 meta secmark set "ricci_modcluster_input"
		ct state new udp dport 16851 meta secmark set "ricci_modcluster_input"
		ct state new tcp dport 513 meta secmark set "rlogind_input"
		ct state new tcp dport 953 meta secmark set "rndc_input"
		ct state new udp dport 953 meta secmark set "rndc_input"
		ct state new tcp dport 8953 meta secmark set "rndc_input"
		ct state new udp dport 8953 meta secmark set "rndc_input"
		ct state new udp dport 520 meta secmark set "router_input"
		ct state new udp dport 521 meta secmark set "router_input"
		ct state new tcp dport 521 meta secmark set "router_input"
		ct state new tcp dport 514 meta secmark set "rsh_input"
		ct state new tcp dport 873 meta secmark set "rsync_input"
		ct state new udp dport 873 meta secmark set "rsync_input"
		ct state new tcp dport 554 meta secmark set "rtsp_input"
		ct state new udp dport 554 meta secmark set "rtsp_input"
		ct state new udp dport 513 meta secmark set "rwho_input"
		ct state new tcp dport 9875 meta secmark set "sap_input"
		ct state new udp dport 9875 meta secmark set "sap_input"
		ct state new tcp dport 3636 meta secmark set "servistaitsm_input"
		ct state new udp dport 3636 meta secmark set "servistaitsm_input"
		ct state new tcp dport 4190 meta secmark set "sieve_input"
		ct state new tcp dport 5060 meta secmark set "sip_input"
		ct state new udp dport 5060 meta secmark set "sip_input"
		ct state new tcp dport 5061 meta secmark set "sip_input"
		ct state new udp dport 5061 meta secmark set "sip_input"
		ct state new tcp dport 3874 meta secmark set "sixxsconfig_input"
		ct state new udp dport 3874 meta secmark set "sixxsconfig_input"
		ct state new tcp dport 137-139 meta secmark set "smbd_input"
		ct state new tcp dport 445 meta secmark set "smbd_input"
		ct state new tcp dport 25 meta secmark set "smtp_input"
		ct state new tcp dport 465 meta secmark set "smtp_input"
		ct state new tcp dport 587 meta secmark set "smtp_input"
		ct state new udp dport 161 meta secmark set "snmp_input"
		ct state new udp dport 162 meta secmark set "snmp_input"
		ct state new tcp dport 199 meta secmark set "snmp_input"
		ct state new tcp dport 1161 meta secmark set "snmp_input"
		ct state new tcp dport 8000 meta secmark set "soundd_input"
		ct state new tcp dport 9433 meta secmark set "soundd_input"
		ct state new tcp dport 16001 meta secmark set "soundd_input"
		ct state new tcp dport 783 meta secmark set "spamd_input"
		ct state new tcp dport 11332 meta secmark set "spamd_input"
		ct state new tcp dport 11333 meta secmark set "spamd_input"
		ct state new tcp dport 11334 meta secmark set "spamd_input"
		ct state new tcp dport 11335 meta secmark set "spamd_input"
		ct state new tcp dport 8036 meta secmark set "speech_input"
		ct state new udp dport 3401 meta secmark set "squid_input"
		ct state new tcp dport 3401 meta secmark set "squid_input"
		ct state new udp dport 4827 meta secmark set "squid_input"
		ct state new tcp dport 4827 meta secmark set "squid_input"
		ct state new tcp dport 1900 meta secmark set "ssdp_input"
		ct state new udp dport 1900 meta secmark set "ssdp_input"
		ct state new tcp dport 22 meta secmark set "ssh_input"
		ct state new tcp dport 3690 meta secmark set "svn_input"
		ct state new udp dport 3690 meta secmark set "svn_input"
		ct state new tcp dport 427 meta secmark set "svrloc_input"
		ct state new udp dport 427 meta secmark set "svrloc_input"
		ct state new tcp dport 901 meta secmark set "swat_input"
		ct state new tcp dport 22000 meta secmark set "syncthing_input"
		ct state new tcp dport 8384 meta secmark set "syncthing_admin_input"
		ct state new udp dport 21027 meta secmark set "syncthing_discovery_input"
		ct state new tcp dport 9911 meta secmark set "sype_transport_input"
		ct state new udp dport 9911 meta secmark set "sype_transport_input"
		ct state new udp dport 514 meta secmark set "syslogd_input"
		ct state new tcp dport 6514 meta secmark set "syslog_tls_input"
		ct state new udp dport 6514 meta secmark set "syslog_tls_input"
		ct state new tcp dport 30003 meta secmark set "tcs_input"
		ct state new tcp dport 23 meta secmark set "telnetd_input"
		ct state new udp dport 69 meta secmark set "tftp_input"
		ct state new tcp dport 6969 meta secmark set "tor_input"
		ct state new tcp dport 9001 meta secmark set "tor_input"
		ct state new tcp dport 9030 meta secmark set "tor_input"
		ct state new tcp dport 9050 meta secmark set "tor_input"
		ct state new tcp dport 9051 meta secmark set "tor_input"
		ct state new udp dport 64000-64010 meta secmark set "traceroute_input"
		ct state new tcp dport 8081 meta secmark set "transproxy_input"
		ct state new tcp dport 10200 meta secmark set "trisoap_input"
		ct state new udp dport 10200 meta secmark set "trisoap_input"
		ct state new tcp dport 8200 meta secmark set "trivnet1_input"
		ct state new udp dport 8200 meta secmark set "trivnet1_input"
		ct state new tcp dport 3493 meta secmark set "ups_input"
		ct state new tcp dport 540 meta secmark set "uucpd_input"
		ct state new tcp dport 6081-6082 meta secmark set "varnishd_input"
		ct state new tcp dport 16509 meta secmark set "virt_input"
		ct state new udp dport 16509 meta secmark set "virt_input"
		ct state new tcp dport 16514 meta secmark set "virt_input"
		ct state new udp dport 16514 meta secmark set "virt_input"
		ct state new tcp dport 1533 meta secmark set "virtual_places_input"
		ct state new udp dport 1533 meta secmark set "virtual_places_input"
		ct state new tcp dport 49152-49216 meta secmark set "virt_migration_input"
		ct state new tcp dport 5900 meta secmark set "vnc_input"
		ct state new udp dport 2048 meta secmark set "wccp_input"
		ct state new tcp dport 9090 meta secmark set "websm_input"
		ct state new udp dport 9090 meta secmark set "websm_input"
		ct state new tcp dport 43 meta secmark set "whois_input"
		ct state new udp dport 43 meta secmark set "whois_input"
		ct state new tcp dport 4321 meta secmark set "whois_input"
		ct state new udp dport 4321 meta secmark set "whois_input"
		ct state new tcp dport 3261 meta secmark set "winshadow_input"
		ct state new udp dport 3261 meta secmark set "winshadow_input"
		ct state new tcp dport 5357 meta secmark set "wsdapi_input"
		ct state new udp dport 5357 meta secmark set "wsdapi_input"
		ct state new tcp dport 3378 meta secmark set "wsicopy_input"
		ct state new udp dport 3378 meta secmark set "wsicopy_input"
		ct state new udp dport 177 meta secmark set "xdmcp_input"
		ct state new tcp dport 177 meta secmark set "xdmcp_input"
		ct state new tcp dport 8002 meta secmark set "xen_input"
		ct state new tcp dport 7100 meta secmark set "xfs_input"
		ct state new tcp dport 6000-6020 meta secmark set "xserver_input"
		ct state new tcp dport 236 meta secmark set "zarafa_input"
		ct state new tcp dport 237 meta secmark set "zarafa_input"
		ct state new tcp dport 10051 meta secmark set "zabbix_input"
		ct state new tcp dport 10050 meta secmark set "zabbix_agent_input"
		ct state new tcp dport 2181 meta secmark set "zookeeper_client_input"
		ct state new tcp dport 3888 meta secmark set "zookeeper_election_input"
		ct state new tcp dport 2888 meta secmark set "zookeeper_leader_input"
		ct state new tcp dport 2600-2604 meta secmark set "zebra_input"
		ct state new tcp dport 2606 meta secmark set "zebra_input"
		ct state new udp dport 2600-2604 meta secmark set "zebra_input"
		ct state new udp dport 2606 meta secmark set "zebra_input"
		ct state new tcp dport 1229 meta secmark set "zented_input"
		ct state new udp dport 1229 meta secmark set "zented_input"
		ct state new tcp dport 8021 meta secmark set "zope_input"
		ip protocol icmp meta secmark set "icmp_packet"
		ip6 nexthdr icmpv6 meta secmark set "icmp_packet"
		ct state new ct secmark set meta secmark
		ct state established,related meta secmark set ct secmark
	}
	chain FORWARD {
		type filter hook forward priority 0; policy accept;
	}
	chain OUTPUT {
		type filter hook output priority 0; policy accept;
		ct state new meta secmark set "default_output_packet"
		ct state new udp dport 7007 meta secmark set "afs_bos_output"
		ct state new tcp dport 2040 meta secmark set "afs_fs_output"
		ct state new udp dport 7000 meta secmark set "afs_fs_output"
		ct state new udp dport 7005 meta secmark set "afs_fs_output"
		ct state new udp dport 7004 meta secmark set "afs_ka_output"
		ct state new udp dport 7002 meta secmark set "afs_pt_output"
		ct state new udp dport 7003 meta secmark set "afs_vl_output"
		ct state new tcp dport 7001 meta secmark set "afs3_callback_output"
		ct state new udp dport 7001 meta secmark set "afs3_callback_output"
		ct state new udp dport 705 meta secmark set "agentx_output"
		ct state new tcp dport 705 meta secmark set "agentx_output"
		ct state new udp dport 10080-10082 meta secmark set "amanda_output"
		ct state new tcp dport 10080-10083 meta secmark set "amanda_output"
		ct state new tcp dport 10024 meta secmark set "amavisd_recv_output"
		ct state new tcp dport 10025 meta secmark set "amavisd_send_output"
		ct state new udp dport 5671-5672 meta secmark set "amqp_output"
		ct state new tcp dport 5671-5672 meta secmark set "amqp_output"
		ct state new udp dport 5190-5193 meta secmark set "aol_output"
		ct state new tcp dport 5190-5193 meta secmark set "aol_output"
		ct state new tcp dport 3551 meta secmark set "apcupsd_output"
		ct state new udp dport 3551 meta secmark set "apcupsd_output"
		ct state new tcp dport 539 meta secmark set "apertus_ldp_output"
		ct state new udp dport 539 meta secmark set "apertus_ldp_output"
		ct state new tcp dport 3142 meta secmark set "aptcacher_output"
		ct state new tcp dport 9292 meta secmark set "armtechdaemon_output"
		ct state new udp dport 9292 meta secmark set "armtechdaemon_output"
		ct state new tcp dport 1720 meta secmark set "asterisk_output"
		ct state new udp dport 2427 meta secmark set "asterisk_output"
		ct state new udp dport 2727 meta secmark set "asterisk_output"
		ct state new udp dport 4569 meta secmark set "asterisk_output"
		ct state new tcp dport 60 meta secmark set "audit_output"
		ct state new tcp dport 113 meta secmark set "auth_output"
		ct state new tcp dport 179 meta secmark set "bgp_output"
		ct state new udp dport 179 meta secmark set "bgp_output"
		ct state new tcp dport 2605 meta secmark set "bgp_output"
		ct state new udp dport 2605 meta secmark set "bgp_output"
		ct state new tcp dport 31416 meta secmark set "boinc_output"
		ct state new tcp dport 1043 meta secmark set "boinc_client_output"
		ct state new udp dport 1034 meta secmark set "boinc_client_output"
		ct state new tcp dport 51235 meta secmark set "certmaster_output"
		ct state new udp dport 323 meta secmark set "chronyd_output"
		ct state new tcp dport 3310 meta secmark set "clamd_output"
		ct state new udp dport 4041 meta secmark set "clockspeed_output"
		ct state new tcp dport 5149 meta secmark set "cluster_output"
		ct state new udp dport 5149 meta secmark set "cluster_output"
		ct state new tcp dport 40040 meta secmark set "cluster_output"
		ct state new tcp dport 50006-50008 meta secmark set "cluster_output"
		ct state new udp dport 50006-50008 meta secmark set "cluster_output"
		ct state new tcp dport 1050 meta secmark set "cma_output"
		ct state new udp dport 1050 meta secmark set "cma_output"
		ct state new tcp dport 25151 meta secmark set "cobbler_output"
		ct state new tcp dport 5001 meta secmark set "commplex_link_output"
		ct state new udp dport 5001 meta secmark set "commplex_link_output"
		ct state new tcp dport 5000 meta secmark set "commplex_main_output"
		ct state new udp dport 5000 meta secmark set "commplex_main_output"
		ct state new udp dport 512 meta secmark set "comsat_output"
		ct state new tcp dport 9618 meta secmark set "condor_output"
		ct state new udp dport 9618 meta secmark set "condor_output"
		ct state new tcp dport 5984 meta secmark set "couchdb_output"
		ct state new udp dport 5984 meta secmark set "couchdb_output"
		ct state new tcp dport 9000 meta secmark set "cslistener_output"
		ct state new udp dport 9000 meta secmark set "cslistener_output"
		ct state new tcp dport 4379 meta secmark set "ctdb_output"
		ct state new udp dport 4397 meta secmark set "ctdb_output"
		ct state new tcp dport 2401 meta secmark set "cvs_output"
		ct state new udp dport 2401 meta secmark set "cvs_output"
		ct state new tcp dport 6767 meta secmark set "cyphesis_output"
		ct state new tcp dport 6769 meta secmark set "cyphesis_output"
		ct state new tcp dport 6780-6799 meta secmark set "cyphesis_output"
		ct state new udp dport 32771 meta secmark set "cyphesis_output"
		ct state new tcp dport 3689 meta secmark set "daap_output"
		ct state new udp dport 3689 meta secmark set "daap_output"
		ct state new tcp dport 1178 meta secmark set "dbskkd_output"
		ct state new udp dport 6276 meta secmark set "dcc_output"
		ct state new udp dport 6277 meta secmark set "dcc_output"
		ct state new tcp dport 5679 meta secmark set "dccm_output"
		ct state new udp dport 5679 meta secmark set "dccm_output"
		ct state new udp dport 68 meta secmark set "dhcpc_output"
		ct state new tcp dport 68 meta secmark set "dhcpc_output"
		ct state new udp dport 546 meta secmark set "dhcpc_output"
		ct state new tcp dport 546 meta secmark set "dhcpc_output"
		ct state new udp dport 5546 meta secmark set "dhcpc_output"
		ct state new tcp dport 5546 meta secmark set "dhcpc_output"
		ct state new udp dport 67 meta secmark set "dhcpd_output"
		ct state new udp dport 547 meta secmark set "dhcpd_output"
		ct state new tcp dport 547 meta secmark set "dhcpd_output"
		ct state new udp dport 548 meta secmark set "dhcpd_output"
		ct state new tcp dport 548 meta secmark set "dhcpd_output"
		ct state new tcp dport 647 meta secmark set "dhcpd_output"
		ct state new udp dport 647 meta secmark set "dhcpd_output"
		ct state new tcp dport 847 meta secmark set "dhcpd_output"
		ct state new udp dport 847 meta secmark set "dhcpd_output"
		ct state new tcp dport 7911 meta secmark set "dhcpd_output"
		ct state new tcp dport 2628 meta secmark set "dict_output"
		ct state new tcp dport 3632 meta secmark set "distccd_output"
		ct state new tcp dport 53 meta secmark set "dns_output"
		ct state new udp dport 53 meta secmark set "dns_output"
		ct state new tcp dport 853 meta secmark set "dns_output"
		ct state new tcp dport 17500 meta secmark set "dropbox_output"
		ct state new udp dport 17500 meta secmark set "dropbox_output"
		ct state new tcp dport 520 meta secmark set "efs_output"
		ct state new tcp dport 3198 meta secmark set "embrace_dp_c_output"
		ct state new udp dport 3198 meta secmark set "embrace_dp_c_output"
		ct state new tcp dport 135 meta secmark set "epmap_output"
		ct state new udp dport 135 meta secmark set "epmap_output"
		ct state new tcp dport 4369 meta secmark set "epmd_output"
		ct state new udp dport 4369 meta secmark set "epmd_output"
		ct state new tcp dport 79 meta secmark set "fingerd_output"
		ct state new tcp dport 21 meta secmark set "ftp_output"
		ct state new tcp dport 990 meta secmark set "ftp_output"
		ct state new udp dport 990 meta secmark set "ftp_output"
		ct state new tcp dport 20 meta secmark set "ftp_data_output"
		ct state new udp dport 1718 meta secmark set "gatekeeper_output"
		ct state new udp dport 1719 meta secmark set "gatekeeper_output"
		ct state new tcp dport 1721 meta secmark set "gatekeeper_output"
		ct state new tcp dport 7000 meta secmark set "gatekeeper_output"
		ct state new tcp dport 538 meta secmark set "gdomap_output"
		ct state new udp dport 538 meta secmark set "gdomap_output"
		ct state new tcp dport 3050 meta secmark set "gds_db_output"
		ct state new udp dport 3050 meta secmark set "gds_db_output"
		ct state new tcp dport 9418 meta secmark set "git_output"
		ct state new udp dport 9418 meta secmark set "git_output"
		ct state new tcp dport 9191 meta secmark set "glance_registry_output"
		ct state new udp dport 9191 meta secmark set "glance_registry_output"
		ct state new tcp dport 24007 meta secmark set "glusterd_output"
		ct state new tcp dport 24009 meta secmark set "glusterd_output"
		ct state new tcp dport 70 meta secmark set "gopher_output"
		ct state new udp dport 70 meta secmark set "gopher_output"
		ct state new tcp dport 2947 meta secmark set "gpsd_output"
		ct state new tcp dport 50010 meta secmark set "hadoop_datanode_output"
		ct state new tcp dport 8020 meta secmark set "hadoop_namenode_output"
		ct state new tcp dport 7634 meta secmark set "hddtemp_output"
		ct state new tcp dport 5335 meta secmark set "howl_output"
		ct state new udp dport 5353 meta secmark set "howl_output"
		ct state new tcp dport 1782 meta secmark set "hplip_output"
		ct state new tcp dport 2207 meta secmark set "hplip_output"
		ct state new tcp dport 2208 meta secmark set "hplip_output"
		ct state new tcp dport 8290 meta secmark set "hplip_output"
		ct state new tcp dport 50000 meta secmark set "hplip_output"
		ct state new tcp dport 50002 meta secmark set "hplip_output"
		ct state new tcp dport 8292 meta secmark set "hplip_output"
		ct state new tcp dport 9100 meta secmark set "hplip_output"
		ct state new tcp dport 9101 meta secmark set "hplip_output"
		ct state new tcp dport 9102 meta secmark set "hplip_output"
		ct state new tcp dport 9220 meta secmark set "hplip_output"
		ct state new tcp dport 9221 meta secmark set "hplip_output"
		ct state new tcp dport 9222 meta secmark set "hplip_output"
		ct state new tcp dport 9280 meta secmark set "hplip_output"
		ct state new tcp dport 9281 meta secmark set "hplip_output"
		ct state new tcp dport 9282 meta secmark set "hplip_output"
		ct state new tcp dport 9290 meta secmark set "hplip_output"
		ct state new tcp dport 9291 meta secmark set "hplip_output"
		ct state new tcp dport 80 meta secmark set "http_output"
		ct state new tcp dport 443 meta secmark set "http_output"
		ct state new tcp dport 488 meta secmark set "http_output"
		ct state new tcp dport 8008 meta secmark set "http_output"
		ct state new tcp dport 8009 meta secmark set "http_output"
		ct state new tcp dport 8443 meta secmark set "http_output"
		ct state new tcp dport 8448 meta secmark set "http_output"
		ct state new tcp dport 3128 meta secmark set "http_cache_output"
		ct state new udp dport 3130 meta secmark set "http_cache_output"
		ct state new tcp dport 8080 meta secmark set "http_cache_output"
		ct state new tcp dport 8118 meta secmark set "http_cache_output"
		ct state new tcp dport 10001-10010 meta secmark set "http_cache_output"
		ct state new tcp dport 9010 meta secmark set "i18n_input_output"
		ct state new tcp dport 5323 meta secmark set "imaze_output"
		ct state new udp dport 5323 meta secmark set "imaze_output"
		ct state new tcp dport 1 meta secmark set "inetd_child_output"
		ct state new udp dport 1 meta secmark set "inetd_child_output"
		ct state new tcp dport 7 meta secmark set "inetd_child_output"
		ct state new udp dport 7 meta secmark set "inetd_child_output"
		ct state new tcp dport 9 meta secmark set "inetd_child_output"
		ct state new udp dport 9 meta secmark set "inetd_child_output"
		ct state new tcp dport 13 meta secmark set "inetd_child_output"
		ct state new udp dport 13 meta secmark set "inetd_child_output"
		ct state new tcp dport 19 meta secmark set "inetd_child_output"
		ct state new udp dport 19 meta secmark set "inetd_child_output"
		ct state new tcp dport 37 meta secmark set "inetd_child_output"
		ct state new udp dport 37 meta secmark set "inetd_child_output"
		ct state new tcp dport 512 meta secmark set "inetd_child_output"
		ct state new tcp dport 543 meta secmark set "inetd_child_output"
		ct state new tcp dport 544 meta secmark set "inetd_child_output"
		ct state new tcp dport 891 meta secmark set "inetd_child_output"
		ct state new udp dport 891 meta secmark set "inetd_child_output"
		ct state new tcp dport 892 meta secmark set "inetd_child_output"
		ct state new udp dport 892 meta secmark set "inetd_child_output"
		ct state new tcp dport 2105 meta secmark set "inetd_child_output"
		ct state new tcp dport 5666 meta secmark set "inetd_child_output"
		ct state new tcp dport 119 meta secmark set "innd_output"
		ct state new tcp dport 7778 meta secmark set "interwise_output"
		ct state new udp dport 7778 meta secmark set "interwise_output"
		ct state new tcp dport 7410 meta secmark set "ionixnetmon_output"
		ct state new udp dport 7410 meta secmark set "ionixnetmon_output"
		ct state new udp dport 623 meta secmark set "ipmi_output"
		ct state new udp dport 664 meta secmark set "ipmi_output"
		ct state new tcp dport 631 meta secmark set "ipp_output"
		ct state new udp dport 631 meta secmark set "ipp_output"
		ct state new tcp dport 8610-8614 meta secmark set "ipp_output"
		ct state new udp dport 8610-8614 meta secmark set "ipp_output"
		ct state new tcp dport 4500 meta secmark set "ipsecnat_output"
		ct state new udp dport 4500 meta secmark set "ipsecnat_output"
		ct state new tcp dport 6665 meta secmark set "ircd_output"
		ct state new tcp dport 6666 meta secmark set "ircd_output"
		ct state new tcp dport 6667 meta secmark set "ircd_output"
		ct state new tcp dport 6668 meta secmark set "ircd_output"
		ct state new tcp dport 6669 meta secmark set "ircd_output"
		ct state new tcp dport 6697 meta secmark set "ircd_output"
		ct state new udp dport 500 meta secmark set "isakmp_output"
		ct state new tcp dport 3260 meta secmark set "iscsi_output"
		ct state new tcp dport 3205 meta secmark set "isns_output"
		ct state new udp dport 3205 meta secmark set "isns_output"
		ct state new tcp dport 5222 meta secmark set "jabber_client_output"
		ct state new tcp dport 5223 meta secmark set "jabber_client_output"
		ct state new tcp dport 5269 meta secmark set "jabber_interserver_output"
		ct state new tcp dport 3528 meta secmark set "jboss_iiop_output"
		ct state new udp dport 3528 meta secmark set "jboss_iiop_output"
		ct state new tcp dport 88 meta secmark set "kerberos_output"
		ct state new udp dport 88 meta secmark set "kerberos_output"
		ct state new tcp dport 750 meta secmark set "kerberos_output"
		ct state new udp dport 750 meta secmark set "kerberos_output"
		ct state new tcp dport 464 meta secmark set "kerberos_admin_output"
		ct state new udp dport 464 meta secmark set "kerberos_admin_output"
		ct state new tcp dport 749 meta secmark set "kerberos_admin_output"
		ct state new tcp dport 4444 meta secmark set "kerberos_master_output"
		ct state new udp dport 4444 meta secmark set "kerberos_master_output"
		ct state new tcp dport 2501 meta secmark set "kismet_output"
		ct state new tcp dport 754 meta secmark set "kprop_output"
		ct state new udp dport 517 meta secmark set "ktalkd_output"
		ct state new udp dport 518 meta secmark set "ktalkd_output"
		ct state new tcp dport 2379-2381 meta secmark set "kubernetes_output"
		ct state new tcp dport 6443 meta secmark set "kubernetes_output"
		ct state new tcp dport 10248-10250 meta secmark set "kubernetes_output"
		ct state new tcp dport 10256-10257 meta secmark set "kubernetes_output"
		ct state new tcp dport 10259 meta secmark set "kubernetes_output"
		ct state new tcp dport 1701 meta secmark set "l2tp_output"
		ct state new udp dport 1701 meta secmark set "l2tp_output"
		ct state new tcp dport 389 meta secmark set "ldap_output"
		ct state new udp dport 389 meta secmark set "ldap_output"
		ct state new tcp dport 636 meta secmark set "ldap_output"
		ct state new udp dport 636 meta secmark set "ldap_output"
		ct state new tcp dport 3268 meta secmark set "ldap_output"
		ct state new tcp dport 3269 meta secmark set "ldap_output"
		ct state new tcp dport 8765 meta secmark set "lirc_output"
		ct state new tcp dport 5355 meta secmark set "llmnr_output"
		ct state new udp dport 5355 meta secmark set "llmnr_output"
		ct state new tcp dport 24 meta secmark set "lmtp_output"
		ct state new udp dport 24 meta secmark set "lmtp_output"
		ct state new tcp dport 2000 meta secmark set "mail_output"
		ct state new tcp dport 3905 meta secmark set "mail_output"
		ct state new tcp dport 49000 meta secmark set "matahari_output"
		ct state new udp dport 49000 meta secmark set "matahari_output"
		ct state new tcp dport 11211 meta secmark set "memcache_output"
		ct state new udp dport 11211 meta secmark set "memcache_output"
		ct state new tcp dport 5050 meta secmark set "mmcc_output"
		ct state new udp dport 5050 meta secmark set "mmcc_output"
		ct state new tcp dport 2583 meta secmark set "mon_output"
		ct state new udp dport 2583 meta secmark set "mon_output"
		ct state new tcp dport 2812 meta secmark set "monit_output"
		ct state new tcp dport 1234 meta secmark set "monopd_output"
		ct state new tcp dport 20048 meta secmark set "mountd_output"
		ct state new udp dport 20048 meta secmark set "mountd_output"
		ct state new tcp dport 5252 meta secmark set "movaz_ssc_output"
		ct state new udp dport 5252 meta secmark set "movaz_ssc_output"
		ct state new tcp dport 6600 meta secmark set "mpd_output"
		ct state new tcp dport 8787 meta secmark set "msgsrvr_output"
		ct state new udp dport 8787 meta secmark set "msgsrvr_output"
		ct state new tcp dport 1863 meta secmark set "msnp_output"
		ct state new udp dport 1863 meta secmark set "msnp_output"
		ct state new tcp dport 1433-1434 meta secmark set "mssql_output"
		ct state new udp dport 1433-1434 meta secmark set "mssql_output"
		ct state new tcp dport 1755 meta secmark set "ms_streaming_output"
		ct state new udp dport 1755 meta secmark set "ms_streaming_output"
		ct state new tcp dport 4949 meta secmark set "munin_output"
		ct state new udp dport 4949 meta secmark set "munin_output"
		ct state new tcp dport 8005 meta secmark set "mxi_output"
		ct state new udp dport 8005 meta secmark set "mxi_output"
		ct state new tcp dport 1186 meta secmark set "mysqld_output"
		ct state new tcp dport 3306 meta secmark set "mysqld_output"
		ct state new tcp dport 63132-63164 meta secmark set "mysqld_output"
		ct state new tcp dport 2273 meta secmark set "mysqlmanagerd_output"
		ct state new tcp dport 1241 meta secmark set "nessus_output"
		ct state new tcp dport 3129 meta secmark set "netport_output"
		ct state new udp dport 3129 meta secmark set "netport_output"
		ct state new tcp dport 5404 meta secmark set "netsupport_output"
		ct state new udp dport 5404 meta secmark set "netsupport_output"
		ct state new tcp dport 5405 meta secmark set "netsupport_output"
		ct state new udp dport 5405 meta secmark set "netsupport_output"
		ct state new tcp dport 2049 meta secmark set "nfs_output"
		ct state new udp dport 2049 meta secmark set "nfs_output"
		ct state new tcp dport 20049 meta secmark set "nfsrdma_output"
		ct state new udp dport 20049 meta secmark set "nfsrdma_output"
		ct state new udp dport 137 meta secmark set "nmbd_output"
		ct state new udp dport 138 meta secmark set "nmbd_output"
		ct state new tcp dport 3000-3001 meta secmark set "ntop_output"
		ct state new udp dport 3000-3001 meta secmark set "ntop_output"
		ct state new udp dport 123 meta secmark set "ntp_output"
		ct state new tcp dport 4460 meta secmark set "ntske_output"
		ct state new tcp dport 8022 meta secmark set "oa_system_output"
		ct state new udp dport 8022 meta secmark set "oa_system_output"
		ct state new tcp dport 1521 meta secmark set "oracledb_output"
		ct state new udp dport 1521 meta secmark set "oracledb_output"
		ct state new tcp dport 2483 meta secmark set "oracledb_output"
		ct state new udp dport 2483 meta secmark set "oracledb_output"
		ct state new tcp dport 2484 meta secmark set "oracledb_output"
		ct state new udp dport 2484 meta secmark set "oracledb_output"
		ct state new tcp dport 9080 meta secmark set "ocsp_output"
		ct state new tcp dport 4743 meta secmark set "openhpid_output"
		ct state new udp dport 4743 meta secmark set "openhpid_output"
		ct state new tcp dport 1194 meta secmark set "openvpn_output"
		ct state new udp dport 1194 meta secmark set "openvpn_output"
		ct state new tcp dport 1314 meta secmark set "pdps_output"
		ct state new udp dport 1314 meta secmark set "pdps_output"
		ct state new tcp dport 5988 meta secmark set "pegasus_http_output"
		ct state new tcp dport 5989 meta secmark set "pegasus_https_output"
		ct state new udp dport 11371 meta secmark set "pgpkeyserver_output"
		ct state new tcp dport 11371 meta secmark set "pgpkeyserver_output"
		ct state new tcp dport 9125 meta secmark set "pingd_output"
		ct state new tcp dport 2126 meta secmark set "pktcable_cops_output"
		ct state new udp dport 2126 meta secmark set "pktcable_cops_output"
		ct state new tcp dport 106 meta secmark set "pop_output"
		ct state new tcp dport 109 meta secmark set "pop_output"
		ct state new tcp dport 110 meta secmark set "pop_output"
		ct state new tcp dport 143 meta secmark set "pop_output"
		ct state new tcp dport 220 meta secmark set "pop_output"
		ct state new tcp dport 993 meta secmark set "pop_output"
		ct state new tcp dport 995 meta secmark set "pop_output"
		ct state new tcp dport 1109 meta secmark set "pop_output"
		ct state new udp dport 111 meta secmark set "portmap_output"
		ct state new tcp dport 111 meta secmark set "portmap_output"
		ct state new tcp dport 10031 meta secmark set "postfix_policyd_output"
		ct state new tcp dport 5432 meta secmark set "postgresql_output"
		ct state new tcp dport 10023 meta secmark set "postgrey_output"
		ct state new tcp dport 60000 meta secmark set "postgrey_output"
		ct state new tcp dport 1723 meta secmark set "pptp_output"
		ct state new udp dport 1723 meta secmark set "pptp_output"
		ct state new tcp dport 4690 meta secmark set "prelude_output"
		ct state new udp dport 4690 meta secmark set "prelude_output"
		ct state new tcp dport 5298-5299 meta secmark set "presence_output"
		ct state new udp dport 5298-5299 meta secmark set "presence_output"
		ct state new tcp dport 515 meta secmark set "printer_output"
		ct state new tcp dport 5703 meta secmark set "ptal_output"
		ct state new tcp dport 4713 meta secmark set "pulseaudio_output"
		ct state new tcp dport 8140 meta secmark set "puppet_output"
		ct state new udp dport 4011 meta secmark set "pxe_output"
		ct state new udp dport 24441 meta secmark set "pyzor_output"
		ct state new udp dport 1646 meta secmark set "radacct_output"
		ct state new udp dport 1813 meta secmark set "radacct_output"
		ct state new udp dport 1645 meta secmark set "radius_output"
		ct state new udp dport 1812 meta secmark set "radius_output"
		ct state new tcp dport 2083 meta secmark set "radsec_output"
		ct state new tcp dport 2703 meta secmark set "razor_output"
		ct state new tcp dport 6379 meta secmark set "redis_output"
		ct state new tcp dport 26379 meta secmark set "redis_output"
		ct state new tcp dport 6363 meta secmark set "repository_output"
		ct state new tcp dport 11111 meta secmark set "ricci_output"
		ct state new udp dport 11111 meta secmark set "ricci_output"
		ct state new tcp dport 16851 meta secmark set "ricci_modcluster_output"
		ct state new udp dport 16851 meta secmark set "ricci_modcluster_output"
		ct state new tcp dport 513 meta secmark set "rlogind_output"
		ct state new tcp dport 953 meta secmark set "rndc_output"
		ct state new udp dport 953 meta secmark set "rndc_output"
		ct state new tcp dport 8953 meta secmark set "rndc_output"
		ct state new udp dport 8953 meta secmark set "rndc_output"
		ct state new udp dport 520 meta secmark set "router_output"
		ct state new udp dport 521 meta secmark set "router_output"
		ct state new tcp dport 521 meta secmark set "router_output"
		ct state new tcp dport 514 meta secmark set "rsh_output"
		ct state new tcp dport 873 meta secmark set "rsync_output"
		ct state new udp dport 873 meta secmark set "rsync_output"
		ct state new tcp dport 554 meta secmark set "rtsp_output"
		ct state new udp dport 554 meta secmark set "rtsp_output"
		ct state new udp dport 513 meta secmark set "rwho_output"
		ct state new tcp dport 9875 meta secmark set "sap_output"
		ct state new udp dport 9875 meta secmark set "sap_output"
		ct state new tcp dport 3636 meta secmark set "servistaitsm_output"
		ct state new udp dport 3636 meta secmark set "servistaitsm_output"
		ct state new tcp dport 4190 meta secmark set "sieve_output"
		ct state new tcp dport 5060 meta secmark set "sip_output"
		ct state new udp dport 5060 meta secmark set "sip_output"
		ct state new tcp dport 5061 meta secmark set "sip_output"
		ct state new udp dport 5061 meta secmark set "sip_output"
		ct state new tcp dport 3874 meta secmark set "sixxsconfig_output"
		ct state new udp dport 3874 meta secmark set "sixxsconfig_output"
		ct state new tcp dport 137-139 meta secmark set "smbd_output"
		ct state new tcp dport 445 meta secmark set "smbd_output"
		ct state new tcp dport 25 meta secmark set "smtp_output"
		ct state new tcp dport 465 meta secmark set "smtp_output"
		ct state new tcp dport 587 meta secmark set "smtp_output"
		ct state new udp dport 161 meta secmark set "snmp_output"
		ct state new udp dport 162 meta secmark set "snmp_output"
		ct state new tcp dport 199 meta secmark set "snmp_output"
		ct state new tcp dport 1161 meta secmark set "snmp_output"
		ct state new tcp dport 8000 meta secmark set "soundd_output"
		ct state new tcp dport 9433 meta secmark set "soundd_output"
		ct state new tcp dport 16001 meta secmark set "soundd_output"
		ct state new tcp dport 783 meta secmark set "spamd_output"
		ct state new tcp dport 11332 meta secmark set "spamd_output"
		ct state new tcp dport 11333 meta secmark set "spamd_output"
		ct state new tcp dport 11334 meta secmark set "spamd_output"
		ct state new tcp dport 11335 meta secmark set "spamd_output"
		ct state new tcp dport 8036 meta secmark set "speech_output"
		ct state new udp dport 3401 meta secmark set "squid_output"
		ct state new tcp dport 3401 meta secmark set "squid_output"
		ct state new udp dport 4827 meta secmark set "squid_output"
		ct state new tcp dport 4827 meta secmark set "squid_output"
		ct state new tcp dport 1900 meta secmark set "ssdp_output"
		ct state new udp dport 1900 meta secmark set "ssdp_output"
		ct state new tcp dport 22 meta secmark set "ssh_output"
		ct state new tcp dport 3690 meta secmark set "svn_output"
		ct state new udp dport 3690 meta secmark set "svn_output"
		ct state new tcp dport 427 meta secmark set "svrloc_output"
		ct state new udp dport 427 meta secmark set "svrloc_output"
		ct state new tcp dport 901 meta secmark set "swat_output"
		ct state new tcp dport 22000 meta secmark set "syncthing_output"
		ct state new tcp dport 8384 meta secmark set "syncthing_admin_output"
		ct state new udp dport 21027 meta secmark set "syncthing_discovery_output"
		ct state new tcp dport 9911 meta secmark set "sype_transport_output"
		ct state new udp dport 9911 meta secmark set "sype_transport_output"
		ct state new udp dport 514 meta secmark set "syslogd_output"
		ct state new tcp dport 6514 meta secmark set "syslog_tls_output"
		ct state new udp dport 6514 meta secmark set "syslog_tls_output"
		ct state new tcp dport 30003 meta secmark set "tcs_output"
		ct state new tcp dport 23 meta secmark set "telnetd_output"
		ct state new udp dport 69 meta secmark set "tftp_output"
		ct state new tcp dport 6969 meta secmark set "tor_output"
		ct state new tcp dport 9001 meta secmark set "tor_output"
		ct state new tcp dport 9030 meta secmark set "tor_output"
		ct state new tcp dport 9050 meta secmark set "tor_output"
		ct state new tcp dport 9051 meta secmark set "tor_output"
		ct state new udp dport 64000-64010 meta secmark set "traceroute_output"
		ct state new tcp dport 8081 meta secmark set "transproxy_output"
		ct state new tcp dport 10200 meta secmark set "trisoap_output"
		ct state new udp dport 10200 meta secmark set "trisoap_output"
		ct state new tcp dport 8200 meta secmark set "trivnet1_output"
		ct state new udp dport 8200 meta secmark set "trivnet1_output"
		ct state new tcp dport 3493 meta secmark set "ups_output"
		ct state new tcp dport 540 meta secmark set "uucpd_output"
		ct state new tcp dport 6081-6082 meta secmark set "varnishd_output"
		ct state new tcp dport 16509 meta secmark set "virt_output"
		ct state new udp dport 16509 meta secmark set "virt_output"
		ct state new tcp dport 16514 meta secmark set "virt_output"
		ct state new udp dport 16514 meta secmark set "virt_output"
		ct state new tcp dport 1533 meta secmark set "virtual_places_output"
		ct state new udp dport 1533 meta secmark set "virtual_places_output"
		ct state new tcp dport 49152-49216 meta secmark set "virt_migration_output"
		ct state new tcp dport 5900 meta secmark set "vnc_output"
		ct state new udp dport 2048 meta secmark set "wccp_output"
		ct state new tcp dport 9090 meta secmark set "websm_output"
		ct state new udp dport 9090 meta secmark set "websm_output"
		ct state new tcp dport 43 meta secmark set "whois_output"
		ct state new udp dport 43 meta secmark set "whois_output"
		ct state new tcp dport 4321 meta secmark set "whois_output"
		ct state new udp dport 4321 meta secmark set "whois_output"
		ct state new tcp dport 3261 meta secmark set "winshadow_output"
		ct state new udp dport 3261 meta secmark set "winshadow_output"
		ct state new tcp dport 5357 meta secmark set "wsdapi_output"
		ct state new udp dport 5357 meta secmark set "wsdapi_output"
		ct state new tcp dport 3378 meta secmark set "wsicopy_output"
		ct state new udp dport 3378 meta secmark set "wsicopy_output"
		ct state new udp dport 177 meta secmark set "xdmcp_output"
		ct state new tcp dport 177 meta secmark set "xdmcp_output"
		ct state new tcp dport 8002 meta secmark set "xen_output"
		ct state new tcp dport 7100 meta secmark set "xfs_output"
		ct state new tcp dport 6000-6020 meta secmark set "xserver_output"
		ct state new tcp dport 236 meta secmark set "zarafa_output"
		ct state new tcp dport 237 meta secmark set "zarafa_output"
		ct state new tcp dport 10051 meta secmark set "zabbix_output"
		ct state new tcp dport 10050 meta secmark set "zabbix_agent_output"
		ct state new tcp dport 2181 meta secmark set "zookeeper_client_output"
		ct state new tcp dport 3888 meta secmark set "zookeeper_election_output"
		ct state new tcp dport 2888 meta secmark set "zookeeper_leader_output"
		ct state new tcp dport 2600-2604 meta secmark set "zebra_output"
		ct state new tcp dport 2606 meta secmark set "zebra_output"
		ct state new udp dport 2600-2604 meta secmark set "zebra_output"
		ct state new udp dport 2606 meta secmark set "zebra_output"
		ct state new tcp dport 1229 meta secmark set "zented_output"
		ct state new udp dport 1229 meta secmark set "zented_output"
		ct state new tcp dport 8021 meta secmark set "zope_output"
		ip protocol icmp meta secmark set "icmp_packet"
		ip6 nexthdr icmpv6 meta secmark set "icmp_packet"
		ct state new ct secmark set meta secmark
		ct state established,related meta secmark set ct secmark
	}
}
