diff --git a/GA-Schloss/README.txt b/GA-Schloss/README.txt
new file mode 100644
index 0000000..4f355d2
--- /dev/null
+++ b/GA-Schloss/README.txt
@@ -0,0 +1,28 @@
+
+-------
+Notice:
+-------
+
+   You have to change some configuration files becaus the because
+   the configuration of network interfaces must not be equal.
+
+   !! Take care, to use the right device names !!
+   Maybe they are called i.e. 'enp0sXX', but you can rename it.
+   See also : README.rename.netdevices
+
+   For the backup gateway host:
+      eth1 --> LAN
+      eth2 --> WAN or ppp0 (DSL device)
+
+      eth0 --> WLAN or second LAN or what ever
+      or
+      br0  --> WLAN or second LAN or what ever
+
+
+   So you have to change the following files
+      dsl-provider.GA-Schloss: ppp0 comes over eth2
+      interfaces.GA-Schloss: see above
+      default_isc-dhcp-server.GA-Schloss
+      ipt-firewall.GA-Schloss: LAN device (mostly ) = eth1
+      second LAN WLAN or what ever (if present) = eth0
+         
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/DCMICap.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/DCMICap.dat
new file mode 100755
index 0000000..368e2d4
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/DCMICap.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/GenEvt.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/GenEvt.dat
new file mode 100755
index 0000000..92b4c92
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/GenEvt.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/IPMICFG.exe b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/IPMICFG.exe
new file mode 100755
index 0000000..af97ffe
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/IPMICFG.exe differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/MBType.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/MBType.dat
new file mode 100755
index 0000000..10aa814
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/MBType.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/MRCCode.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/MRCCode.dat
new file mode 100755
index 0000000..518dbbe
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/MRCCode.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/MRCCode2.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/MRCCode2.dat
new file mode 100755
index 0000000..6cadcfc
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/MRCCode2.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/Menu.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/Menu.dat
new file mode 100755
index 0000000..da10666
--- /dev/null
+++ b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/Menu.dat
@@ -0,0 +1,96 @@
+  -m                    Show IP and MAC.
+  -m IP                 Set IP (format: ###.###.###.###).
+  -a MAC                Set MAC (format: ##:##:##:##:##:##).
+  -k                    Show Subnet Mask.
+  -k Mask               Set Subnet Mask (format: ###.###.###.###).
+  -dhcp                 Get the DHCP status.
+  -dhcp on              Enable the DHCP.
+  -dhcp off             Disable the DHCP.
+  -g                    Show Gateway IP.
+  -g IP                 Set Gateway IP (format: ###.###.###.###).
+  -r                    BMC cold reset.
+                        option: -d | Detected IPMI device for BMC reset.
+  -garp on              Enable the Gratuitous ARP.
+  -garp off             Disable the Gratuitous ARP.
+  -fd                   Reset to the factory default.
+                        option: -d | Detected IPMI device for BMC reset.
+  -fdl                  Reset to the factory default. (Clean LAN)
+                        option: -d | Detected IPMI device for BMC reset.
+  -fde                  Reset to the factory default. (Clean FRU & LAN)
+                        option: -d | Detected IPMI device for BMC reset.
+  -ver                  Get Firmware revision.
+  -vlan                 Get VLAN status.
+  -vlan on <vlan tag>   Enable the VLAN and set the VLAN tag.
+                        If VLANtag is not given it uses previously saved value.
+  -vlan off             Disable the VLAN.
+  -selftest             Checking and reporting on the basic health of BMC.
+  -raw                  Send a RAW IPMI request and print response.
+                        Format: NetFn Cmd [Data1 ... DataN]
+  -fru info             Show FRU inventory area Info.
+  -fru list             Show all FRU values.
+  -fru cthelp           Show chassis type code.
+  -fru help             Show help of FRU Write.
+  -fru <field>          Show FRU field value.
+  -fru <field> <value>  Write FRU.
+  -fru 1m               Update Product-Manufacturer from DMITable to IPMI FRU.
+  -fru 1p               Update Product-Product Name from DMITable to IPMI FRU.
+  -fru 1s               Update Product-S/N from DMITable to IPMI FRU.
+  -fru 2m               Update Board-Manufacturer from DMITable to IPMI FRU.
+  -fru 2p               Update Board-Product Name from DMITable to IPMI FRU.
+  -fru 2s               Update Board-S/N from DMITable to IPMI FRU.
+  -fru 3s               Update Chassis-S/N from DMITable to IPMI FRU.
+  -fru backup <file>    Backup FRU to file <Binary format>.
+  -fru restore <file>   Restore FRU from file <Binary format>.
+  -fru tbackup <file>   Backup FRU to file <Text format>.
+  -fru trestore <file>  Restore FRU from file <Text format>.
+  -fru ver <v1> <v2>    Get/Set FRU version. (v1 v2 are BCD format)
+  -sel info             Show SEL info.
+  -sel list             Show SEL records.
+  -sel del              Delete all SEL records.
+  -sel raw              Show SEL raw data.
+  -sdr [full]           Show SDR records and reading.
+  -sdr del <sdr id>     Delete SDR record.
+  -sdr ver <v1> <v2>    Get/Set SDR version. (v1 v2 are BCD format)
+  -nm nmsdr             Display NM SDR.
+  -nm seltime           Get SEL time.
+  -nm deviceid          Get ME Device ID.
+  -nm reset             Reboots ME.
+  -nm reset2default     Force ME reset to Default.
+  -nm updatemode        Force ME to Update Mode.
+  -nm selftest          Get Self Test Results.
+  -nm listimagesinfo    List ME Images information.
+  -nm oemgetpower       OEM Power command for ME.
+  -nm oemgettemp        OEM Temp. command for ME.
+  -nm pstate            Get Max allowed CPU P-State.
+  -nm tstate            Get Max allowed CPU T-State.
+  -nm cpumemtemp        Get CPU/Memory temperature.
+  -nm hostcpudata       Get host CPU data.
+  -fan                  Get Fan Mode.
+  -fan <mode>           Set Fan Mode.
+  -pminfo [full]        Power supply PMBus health.
+  -psfruinfo            Power supply FRU health.
+  -psbbpinfo            Battery backup power status.
+  -autodischarge        Set auto discharge by days.
+   <module> <day>.      
+  -discharge <module>   Manually discharge battery.
+  -user list            List user privilege information.
+  -user help            Show user privilege code.
+  -user add <user id>   Add user.
+   <name> <password>    
+   <privilege>          
+  -user del <user id>   Delete user.
+  -user level <user id> Update user privilege.
+   <privilege>          
+  -user setpwd          Update user password.
+   <user id> <password> 
+  -conf upload <file>   Upload IPMI configuration form binary file.
+   <option>             option: -p | Bypass warning message.
+  -conf download <file> Download IPMI configuration to binary file.
+  -conf tupload <file>  Upload IPMI configuration from text file.
+   <option>             option: -p | Bypass warning message.
+  -conf tdownload       Download IPMI configuration to text file.
+   <file>               
+  -clrint               Clear chassis intrusion.
+  -reset <index>        Reset System and force to boot from device.
+  -soft <index>         Initiate a soft-shutdown for OS and force to boot from
+                        device.
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/PMBusStatus.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/PMBusStatus.dat
new file mode 100755
index 0000000..d5b8630
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/PMBusStatus.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt1.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt1.dat
new file mode 100755
index 0000000..8b10a40
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt1.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt2.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt2.dat
new file mode 100755
index 0000000..6cfe076
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt2.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt3.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt3.dat
new file mode 100755
index 0000000..aef67c7
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt3.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt4.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt4.dat
new file mode 100755
index 0000000..505e391
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt4.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt5.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt5.dat
new file mode 100755
index 0000000..fed4cfc
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/SpecEvt5.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/sdc.exe b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/sdc.exe
new file mode 100755
index 0000000..8ce02a8
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/DOS/sdc.exe differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/IPMICFG_UserGuide.pdf b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/IPMICFG_UserGuide.pdf
new file mode 100755
index 0000000..fe6b137
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/IPMICFG_UserGuide.pdf differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/DCMICap.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/DCMICap.dat
new file mode 100755
index 0000000..368e2d4
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/DCMICap.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/GenEvt.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/GenEvt.dat
new file mode 100755
index 0000000..92b4c92
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/GenEvt.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/IPMICFG-Linux.x86 b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/IPMICFG-Linux.x86
new file mode 100755
index 0000000..d971ad9
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/IPMICFG-Linux.x86 differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/MBType.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/MBType.dat
new file mode 100755
index 0000000..10aa814
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/MBType.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/MRCCode.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/MRCCode.dat
new file mode 100755
index 0000000..518dbbe
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/MRCCode.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/MRCCode2.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/MRCCode2.dat
new file mode 100755
index 0000000..6cadcfc
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/MRCCode2.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/Menu.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/Menu.dat
new file mode 100755
index 0000000..84a1273
--- /dev/null
+++ b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/Menu.dat
@@ -0,0 +1,96 @@
+  -m                    Show IP and MAC.
+  -m IP                 Set IP (format: ###.###.###.###).
+  -a MAC                Set MAC (format: ##:##:##:##:##:##).
+  -k                    Show Subnet Mask.
+  -k Mask               Set Subnet Mask (format: ###.###.###.###).
+  -dhcp                 Get the DHCP status.
+  -dhcp on              Enable the DHCP.
+  -dhcp off             Disable the DHCP.
+  -g                    Show Gateway IP.
+  -g IP                 Set Gateway IP (format: ###.###.###.###).
+  -r                    BMC cold reset.
+                        option: -d | Detected IPMI device for BMC reset.
+  -garp on              Enable the Gratuitous ARP.
+  -garp off             Disable the Gratuitous ARP.
+  -fd                   Reset to the factory default.
+                        option: -d | Detected IPMI device for BMC reset.
+  -fdl                  Reset to the factory default. (Clean LAN)
+                        option: -d | Detected IPMI device for BMC reset.
+  -fde                  Reset to the factory default. (Clean FRU & LAN)
+                        option: -d | Detected IPMI device for BMC reset.
+  -ver                  Get Firmware revision.
+  -vlan                 Get VLAN status.
+  -vlan on <vlan tag>   Enable the VLAN and set the VLAN tag.
+                        If VLANtag is not given it uses previously saved value.
+  -vlan off             Disable the VLAN.
+  -selftest             Checking and reporting on the basic health of BMC.
+  -raw                  Send a RAW IPMI request and print response.
+                        Format: NetFn Cmd [Data1 ... DataN]
+  -fru info             Show FRU inventory area Info.
+  -fru list             Show all FRU values.
+  -fru cthelp           Show chassis type code.
+  -fru help             Show help of FRU Write.
+  -fru <field>          Show FRU field value.
+  -fru <field> <value>  Write FRU.
+  -fru 1m               Update Product-Manufacturer from DMITable to IPMI FRU.
+  -fru 1p               Update Product-Product Name from DMITable to IPMI FRU.
+  -fru 1s               Update Product-S/N from DMITable to IPMI FRU.
+  -fru 2m               Update Board-Manufacturer from DMITable to IPMI FRU.
+  -fru 2p               Update Board-Product Name from DMITable to IPMI FRU.
+  -fru 2s               Update Board-S/N from DMITable to IPMI FRU.
+  -fru 3s               Update Chassis-S/N from DMITable to IPMI FRU.
+  -fru backup <file>    Backup FRU to file <Binary format>.
+  -fru restore <file>   Restore FRU from file <Binary format>.
+  -fru tbackup <file>   Backup FRU to file <Text format>.
+  -fru trestore <file>  Restore FRU from file <Text format>.
+  -fru ver <v1> <v2>    Get/Set FRU version. (v1 v2 are BCD format)
+  -sel info             Show SEL info.
+  -sel list             Show SEL records.
+  -sel del              Delete all SEL records.
+  -sel raw              Show SEL raw data.
+  -sdr [full]           Show SDR records and reading.
+  -sdr del <sdr id>     Delete SDR record.
+  -sdr ver <v1> <v2>    Get/Set SDR version. (v1 v2 are BCD format)
+  -nm nmsdr             Display NM SDR.
+  -nm seltime           Get SEL time.
+  -nm deviceid          Get ME Device ID.
+  -nm reset             Reboots ME.
+  -nm reset2default     Force ME reset to Default.
+  -nm updatemode        Force ME to Update Mode.
+  -nm selftest          Get Self Test Results.
+  -nm listimagesinfo    List ME Images information.
+  -nm oemgetpower       OEM Power command for ME.
+  -nm oemgettemp        OEM Temp. command for ME.
+  -nm pstate            Get Max allowed CPU P-State.
+  -nm tstate            Get Max allowed CPU T-State.
+  -nm cpumemtemp        Get CPU/Memory temperature.
+  -nm hostcpudata       Get host CPU data.
+  -fan                  Get Fan Mode.
+  -fan <mode>           Set Fan Mode.
+  -pminfo [full]        Power supply PMBus health.
+  -psfruinfo            Power supply FRU health.
+  -psbbpinfo            Battery backup power status.
+  -autodischarge        Set auto discharge by days.
+   <module> <day>.      
+  -discharge <module>   Manually discharge battery.
+  -user list            List user privilege information.
+  -user help            Show user privilege code.
+  -user add <user id>   Add user.
+   <name> <password>    
+   <privilege>          
+  -user del <user id>   Delete user.
+  -user level <user id> Update user privilege.
+   <privilege>          
+  -user setpwd          Update user password.
+   <user id> <password> 
+  -conf upload <file>   Upload IPMI configuration form binary file.
+   <option>             option: -p | Bypass warning message.
+  -conf download <file> Download IPMI configuration to binary file.
+  -conf tupload <file>  Upload IPMI configuration from text file.
+   <option>             option: -p | Bypass warning message.
+  -conf tdownload       Download IPMI configuration to text file.
+   <file>               
+  -clrint               Clear chassis intrusion.
+  -reset <index>        Reset System and force to boot from device.
+  -soft <index>         Initiate a soft-shutdown for OS and force to boot from
+                        device.
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/PMBusStatus.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/PMBusStatus.dat
new file mode 100755
index 0000000..d5b8630
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/PMBusStatus.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt1.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt1.dat
new file mode 100755
index 0000000..8b10a40
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt1.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt2.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt2.dat
new file mode 100755
index 0000000..6cfe076
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt2.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt3.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt3.dat
new file mode 100755
index 0000000..aef67c7
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt3.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt4.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt4.dat
new file mode 100755
index 0000000..505e391
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt4.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt5.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt5.dat
new file mode 100755
index 0000000..fed4cfc
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/32bit/SpecEvt5.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/DCMICap.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/DCMICap.dat
new file mode 100755
index 0000000..368e2d4
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/DCMICap.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/GenEvt.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/GenEvt.dat
new file mode 100755
index 0000000..92b4c92
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/GenEvt.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/IPMICFG-Linux.x86_64 b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/IPMICFG-Linux.x86_64
new file mode 100755
index 0000000..1051cd8
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/IPMICFG-Linux.x86_64 differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/MBType.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/MBType.dat
new file mode 100755
index 0000000..10aa814
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/MBType.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/MRCCode.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/MRCCode.dat
new file mode 100755
index 0000000..518dbbe
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/MRCCode.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/MRCCode2.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/MRCCode2.dat
new file mode 100755
index 0000000..6cadcfc
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/MRCCode2.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/Menu.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/Menu.dat
new file mode 100755
index 0000000..84a1273
--- /dev/null
+++ b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/Menu.dat
@@ -0,0 +1,96 @@
+  -m                    Show IP and MAC.
+  -m IP                 Set IP (format: ###.###.###.###).
+  -a MAC                Set MAC (format: ##:##:##:##:##:##).
+  -k                    Show Subnet Mask.
+  -k Mask               Set Subnet Mask (format: ###.###.###.###).
+  -dhcp                 Get the DHCP status.
+  -dhcp on              Enable the DHCP.
+  -dhcp off             Disable the DHCP.
+  -g                    Show Gateway IP.
+  -g IP                 Set Gateway IP (format: ###.###.###.###).
+  -r                    BMC cold reset.
+                        option: -d | Detected IPMI device for BMC reset.
+  -garp on              Enable the Gratuitous ARP.
+  -garp off             Disable the Gratuitous ARP.
+  -fd                   Reset to the factory default.
+                        option: -d | Detected IPMI device for BMC reset.
+  -fdl                  Reset to the factory default. (Clean LAN)
+                        option: -d | Detected IPMI device for BMC reset.
+  -fde                  Reset to the factory default. (Clean FRU & LAN)
+                        option: -d | Detected IPMI device for BMC reset.
+  -ver                  Get Firmware revision.
+  -vlan                 Get VLAN status.
+  -vlan on <vlan tag>   Enable the VLAN and set the VLAN tag.
+                        If VLANtag is not given it uses previously saved value.
+  -vlan off             Disable the VLAN.
+  -selftest             Checking and reporting on the basic health of BMC.
+  -raw                  Send a RAW IPMI request and print response.
+                        Format: NetFn Cmd [Data1 ... DataN]
+  -fru info             Show FRU inventory area Info.
+  -fru list             Show all FRU values.
+  -fru cthelp           Show chassis type code.
+  -fru help             Show help of FRU Write.
+  -fru <field>          Show FRU field value.
+  -fru <field> <value>  Write FRU.
+  -fru 1m               Update Product-Manufacturer from DMITable to IPMI FRU.
+  -fru 1p               Update Product-Product Name from DMITable to IPMI FRU.
+  -fru 1s               Update Product-S/N from DMITable to IPMI FRU.
+  -fru 2m               Update Board-Manufacturer from DMITable to IPMI FRU.
+  -fru 2p               Update Board-Product Name from DMITable to IPMI FRU.
+  -fru 2s               Update Board-S/N from DMITable to IPMI FRU.
+  -fru 3s               Update Chassis-S/N from DMITable to IPMI FRU.
+  -fru backup <file>    Backup FRU to file <Binary format>.
+  -fru restore <file>   Restore FRU from file <Binary format>.
+  -fru tbackup <file>   Backup FRU to file <Text format>.
+  -fru trestore <file>  Restore FRU from file <Text format>.
+  -fru ver <v1> <v2>    Get/Set FRU version. (v1 v2 are BCD format)
+  -sel info             Show SEL info.
+  -sel list             Show SEL records.
+  -sel del              Delete all SEL records.
+  -sel raw              Show SEL raw data.
+  -sdr [full]           Show SDR records and reading.
+  -sdr del <sdr id>     Delete SDR record.
+  -sdr ver <v1> <v2>    Get/Set SDR version. (v1 v2 are BCD format)
+  -nm nmsdr             Display NM SDR.
+  -nm seltime           Get SEL time.
+  -nm deviceid          Get ME Device ID.
+  -nm reset             Reboots ME.
+  -nm reset2default     Force ME reset to Default.
+  -nm updatemode        Force ME to Update Mode.
+  -nm selftest          Get Self Test Results.
+  -nm listimagesinfo    List ME Images information.
+  -nm oemgetpower       OEM Power command for ME.
+  -nm oemgettemp        OEM Temp. command for ME.
+  -nm pstate            Get Max allowed CPU P-State.
+  -nm tstate            Get Max allowed CPU T-State.
+  -nm cpumemtemp        Get CPU/Memory temperature.
+  -nm hostcpudata       Get host CPU data.
+  -fan                  Get Fan Mode.
+  -fan <mode>           Set Fan Mode.
+  -pminfo [full]        Power supply PMBus health.
+  -psfruinfo            Power supply FRU health.
+  -psbbpinfo            Battery backup power status.
+  -autodischarge        Set auto discharge by days.
+   <module> <day>.      
+  -discharge <module>   Manually discharge battery.
+  -user list            List user privilege information.
+  -user help            Show user privilege code.
+  -user add <user id>   Add user.
+   <name> <password>    
+   <privilege>          
+  -user del <user id>   Delete user.
+  -user level <user id> Update user privilege.
+   <privilege>          
+  -user setpwd          Update user password.
+   <user id> <password> 
+  -conf upload <file>   Upload IPMI configuration form binary file.
+   <option>             option: -p | Bypass warning message.
+  -conf download <file> Download IPMI configuration to binary file.
+  -conf tupload <file>  Upload IPMI configuration from text file.
+   <option>             option: -p | Bypass warning message.
+  -conf tdownload       Download IPMI configuration to text file.
+   <file>               
+  -clrint               Clear chassis intrusion.
+  -reset <index>        Reset System and force to boot from device.
+  -soft <index>         Initiate a soft-shutdown for OS and force to boot from
+                        device.
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/PMBusStatus.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/PMBusStatus.dat
new file mode 100755
index 0000000..d5b8630
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/PMBusStatus.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt1.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt1.dat
new file mode 100755
index 0000000..8b10a40
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt1.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt2.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt2.dat
new file mode 100755
index 0000000..6cfe076
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt2.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt3.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt3.dat
new file mode 100755
index 0000000..aef67c7
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt3.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt4.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt4.dat
new file mode 100755
index 0000000..505e391
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt4.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt5.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt5.dat
new file mode 100755
index 0000000..fed4cfc
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Linux/64bit/SpecEvt5.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/ReleaseNotes.txt b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/ReleaseNotes.txt
new file mode 100755
index 0000000..dda7966
--- /dev/null
+++ b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/ReleaseNotes.txt
@@ -0,0 +1,246 @@
+-------------------------------------------------------------------------------
+Supermicro IPMICFG Release Notes
+Copyright(c) 2017 by Super Micro Computer, Inc.          http://supermicro.com/
+-------------------------------------------------------------------------------
+
+-------------------------------------------------------------------------------
+Introduction
+-------------------------------------------------------------------------------
+IPMICFG is a command line tool that let user set IPMI command through keyboard
+controller style (KCS) to the device that support Intelligent Platform
+Management Interface (IPMI) version 2.0 specifications.
+
+-------------------------------------------------------------------------------
+Requirements
+-------------------------------------------------------------------------------
+ - Operating system:
+    * Microsoft DOS 5.0 or later version
+    * Windows Server 2003, 2008, 2012 (32/64bit), 2016
+         - Operating system must be pre-installed Microsoft Visual C++ 2008 SP1
+           Redistributable Package
+           Download Link:
+               http://www.microsoft.com/en-us/download/details.aspx?id=29
+         - Windows 2008 R2 x64 must be pre-installed KB3033929 patch
+           Download Link:
+               https://www.microsoft.com/en-us/download/details.aspx?id=46083
+      Windows 7/8/8.1/10:
+         - Need disabled UAC(User Account Control) or open a command prompt
+           with a run as administrator.
+         - Windows 7 x64 must be pre-installed KB3033929 patch
+           Download Link:
+               https://www.microsoft.com/en-us/download/details.aspx?id=46148
+    * Linux Kernel version 2.6.x or higher.
+      ex: Red Hat Enterprise Linux (RHEL) 6.8 and 7.2,
+          SUSE Linux Enterprise Server (SLES) 11 SP4 and 12 SP1
+          Ubuntu Server 14.04 LTS and 16.04 LTS
+    * Free Disk Space: 200 MB (Linux, Windows)
+    * Available RAM: 64 MB
+ - Hardware:
+    * Baseboard Management Controller (BMC) must support Intelligent Platform
+      Management Interface (IPMI) version 2.0 specifications.
+ - Software:
+    * -tas, -nvme commands must be installed Thin-Agent Service. The TAS
+      minimum required version is 1.4.0.
+
+-------------------------------------------------------------------------------
+Installation and Upgrade Instructions
+-------------------------------------------------------------------------------
+ - DOS
+   Execute IPMICFG.exe
+ - Windows
+   Execute IMPICFG-Win.exe
+ - Linux
+   If your system has installed OpenIPMI driver, you can enabled Linux IPMI
+   driver:
+        # /etc/init.d/ipmi start
+        or
+        # modprobe ipmi_msghandler
+        # modprobe ipmi_devintf
+        # modprobe ipmi_si
+   Then execute IPMICFG-Linux.x86 or IPMICFG-Linux.x86_64
+   
+-------------------------------------------------------------------------------
+Third Party Software
+-------------------------------------------------------------------------------
+ - Phymem
+   Please refer to
+   http://www.codeproject.com/Articles/35378/Access-Physical-Memory-Port-and-PC
+   I-Configuration for more information.
+ - IPMITool
+   Please refer to
+   http://sourceforge.net/projects/ipmitool for more information.
+
+-------------------------------------------------------------------------------
+ IPMICFG 1.27.0 build 170620
+-------------------------------------------------------------------------------
+1.  Add DCMI commands.
+2.  Add MCU ID support for 0xA5, 0xA6, 0xA7 and 0xA8 on IPMICFG with the "tp"
+    command.
+3.  Disabled Microblade "VBAT" sensor all the upper threshold value.
+4.  Fix getting PMBus's detail status has duplicate information.
+5.  Update NM commands to Node Manager 4.0.
+6.  Support ATEN 8U Superblade firmware.
+7.  Update board ID.
+8.  Update KCS driver.
+9.  Modify PMBus Revision info.
+
+-------------------------------------------------------------------------------
+ IPMICFG 1.26.0 build 161123
+-------------------------------------------------------------------------------
+1.  Support MultiNode config ID = 6 and 12.
+2.  Support MultiNode MCU ID = 0xA7.
+3.  Support TAS 1.4.0.
+4.  Update event log description in SEL command.
+5.  Presenting power module full status information in -pminfo command.
+6.  Improve NVME firmware information in "-nvme info" command.
+7.  Support the watchdog sensor in "-sdr" command.
+
+-------------------------------------------------------------------------------
+ IPMICFG 1.25.0 build 160823
+-------------------------------------------------------------------------------
+1.  Support discrete sensor.
+2.  Support NVME 48 nodes.
+3.  Update FRU chassis type.
+4.  Update board id.
+5.  Modify parameter list format.
+6.  Fix FRU fields too many characters lead to FRU wrong issue.
+7.  Add Get/Set host name command.
+8.  Update Windows KCS driver.
+9.  Fix can't boot from UEFI device issue.
+
+-------------------------------------------------------------------------------
+ IPMICFG 1.24.2 build 160517
+-------------------------------------------------------------------------------
+1.  Fix power reading is incorrect with command nm oem power.
+
+-------------------------------------------------------------------------------
+ IPMICFG 1.24.1 build 160222
+-------------------------------------------------------------------------------
+1.  Update Windows KCS driver.
+
+-------------------------------------------------------------------------------
+ IPMICFG 1.24.0 build 160105
+-------------------------------------------------------------------------------
+1.  Add TAS commands. (Not supported DOS)
+2.  Update NVME commands. (Not supported DOS)
+3.  Add summary command.
+4.  Update board id.
+5.  Update MRC Code for SEL.
+6.  Update SEL description.
+7.  Fix MCU Version value wrong issue.
+
+-------------------------------------------------------------------------------
+ IPMICFG 1.23.0 build 151106
+-------------------------------------------------------------------------------
+1.  Support MicroCloud device in tp commands.
+2.  Fix temperature sensor reading can't display negative issue.
+3.  Fix TJmax value wrong issue.
+
+-------------------------------------------------------------------------------
+ IPMICFG 1.22.0 build 150814
+-------------------------------------------------------------------------------
+1.  Update board id.
+2.  Update GUID.
+3.  When impicfg failed, error message will store to stderr variable.
+4.  When input wrong parameter, ipmicfg will print all the parameters
+    explaination and cancel pause screen mechanism. (Not supported DOS)
+5.  When use not root permission account to launch ipmicfg, ipmicfg will show
+    tip message.
+6.  Fix -sdr hang issue at SuperBlade.
+
+-------------------------------------------------------------------------------
+ IPMICFG 1.21.0 build 150615
+-------------------------------------------------------------------------------
+1.  Add BIOS MRC Code for SEL.
+2.  Add support power consumption sensor(SDR record type = 0x0b).
+3.  Add SDR Type 2 to support PS Status Compact SDR.
+4.  Update Fan mode.
+5.  Udpate SEL description and board id.
+6.  Modify FatTwin Right side node ID.
+7.  Modify TwinPro commands.
+8.  Replace KCS driver.
+9.  Update length of PWS Module Number from 12 bytes to 13 bytes.
+10. Fix memory ECC error description.
+
+-------------------------------------------------------------------------------
+Known Issues, Limitations & Restrictions
+-------------------------------------------------------------------------------
+1. 'Destination IP address' in the first entry under alerts subsection is
+   volatile as per the IPMI spec. So, this field will not be saved if restored
+   to factory defaults.
+
+2. Some parameters need IPMI OEM commands support. If not, the execute result
+   will response error message or information. The parameters include:
+  -fd                   Reset to the factory default.
+                        option: -d | Detected IPMI device for BMC reset.
+  -fdl                  Reset to the factory default. (Clean LAN)
+                        option: -d | Detected IPMI device for BMC reset.
+  -fde                  Reset to the factory default. (Clean FRU & LAN)
+                        option: -d | Detected IPMI device for BMC reset.
+  -nm nmsdr             Display NM SDR.
+  -nm seltime           Get SEL time.
+  -nm deviceid          Get ME Device ID.
+  -nm reset             Reboots ME.
+  -nm reset2default     Force ME reset to Default.
+  -nm updatemode        Force ME to Update Mode.
+  -nm selftest          Get Self Test Results.
+  -nm listimagesinfo    List ME Images information.
+  -nm oemgetpower       OEM Power command for ME.
+  -nm oemgettemp        OEM Temp. command for ME.
+  -nm pstate            Get Max allowed CPU P-State.
+  -nm tstate            Get Max allowed CPU T-State.
+  -nm cpumemtemp        Get CPU/Memory temperature.
+  -nm hostcpudata       Get host CPU data.
+  -fan                  Get Fan Mode.
+  -fan <mode>                       Set Fan Mode.
+  -pminfo                           Power supply PMBus health.
+  -psfruinfo                        Power supply FRU health.
+  -psbbpinfo                        Battery backup power status.
+  -autodischarge <module> <day>     Set auto discharge by days.
+  -discharge <module>               Manually discharge battery.
+  -conf upload <file> <option>      Upload IPMI configuration form binary file.
+                                    option: -p | Bypass warning message.
+  -conf download <file>             Download IPMI configuration to binary file.
+  -conf tupload <file> <option>     Upload IPMI configuration from text file.
+                                    option: -p | Bypass warning message.
+  -conf tdownload <file>            Download IPMI configuration to text file.
+  -clrint                           Clear chassis intrusion.
+  -reset <index>                    Reset System and force to boot from device.
+  -soft <index>                     Initiate a soft-shutdown for OS and force
+                                    to boot from device.
+  -recoverbiosinfo                  Get recovery BIOS information.
+  -reset <index>                    Reset System and force to boot from device.
+  -soft <index>                     Initiate a soft-shutdown for OS and force
+                                    to boot from device.
+  -recoverbiosinfo                  Get recovery BIOS information.
+  -nvme list                        Display the existing NVME SSD list.
+  -nvme info                        NVME SSD information.
+  -nvme rescan                      Rescan all devices by in band.
+  -nvme insert <aoc> <group> <slot> Insert SSD by out of band.
+  -nvme locate <HDD Name>           Locate SSD. (in band)
+  -nvme locate <aoc> <group> <slot> Locate SSD. (out of band)
+  -nvme stoplocate <HDD Name>           Stop Locate SSD. (in band)
+  -nvme stoplocate <aoc> <group> <slot> Stop Locate SSD. (out of band)
+  -nvme remove <HDD Name> [option]  Remove NVME device. (in band)
+        Usage: option 0: Do eject after remove (Default).
+               option 1: Do not eject after remove.
+  -nvme remove <aoc> <group> <slot> Remove NVME device. (out of band)
+  -nvme smartdata [HDD Name]        NVME SMART data.
+  -tp info                          Get MCU Info.
+  -tp info <type>                   Get MCU Type Info. (type: 1 - 3)
+  -tp nodeid                        Get Node ID.
+  -tas info                         Get TAS Information.
+  -tas pause                        Pause TAS Service.
+  -tas resume                       Resume TAS Service.
+  -tas refresh                      Trigger TAS to recollect data.
+  -tas clear                        Clear TAS collected data in BMC.
+  -tas period <sec>                 Set TAS update period <limit 5 to 60 sec>.
+  -tas exec <cmd>                   Execute a user's specified command.
+
+-------------------------------------------------------------------------------
+Technical Support
+-------------------------------------------------------------------------------
+Web Site:        www.supermicro.com
+Headquarters:    support@supermicro.com
+European Branch: support@supermicro.nl
+Asian Branch:    support@supermicro.com.tw
\ No newline at end of file
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/DCMICap.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/DCMICap.dat
new file mode 100755
index 0000000..368e2d4
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/DCMICap.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/GenEvt.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/GenEvt.dat
new file mode 100755
index 0000000..92b4c92
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/GenEvt.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/IPMICFG-Win.exe b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/IPMICFG-Win.exe
new file mode 100755
index 0000000..3bd611f
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/IPMICFG-Win.exe differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/MBType.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/MBType.dat
new file mode 100755
index 0000000..10aa814
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/MBType.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/MRCCode.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/MRCCode.dat
new file mode 100755
index 0000000..518dbbe
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/MRCCode.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/MRCCode2.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/MRCCode2.dat
new file mode 100755
index 0000000..6cadcfc
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/MRCCode2.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/Menu.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/Menu.dat
new file mode 100755
index 0000000..da10666
--- /dev/null
+++ b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/Menu.dat
@@ -0,0 +1,96 @@
+  -m                    Show IP and MAC.
+  -m IP                 Set IP (format: ###.###.###.###).
+  -a MAC                Set MAC (format: ##:##:##:##:##:##).
+  -k                    Show Subnet Mask.
+  -k Mask               Set Subnet Mask (format: ###.###.###.###).
+  -dhcp                 Get the DHCP status.
+  -dhcp on              Enable the DHCP.
+  -dhcp off             Disable the DHCP.
+  -g                    Show Gateway IP.
+  -g IP                 Set Gateway IP (format: ###.###.###.###).
+  -r                    BMC cold reset.
+                        option: -d | Detected IPMI device for BMC reset.
+  -garp on              Enable the Gratuitous ARP.
+  -garp off             Disable the Gratuitous ARP.
+  -fd                   Reset to the factory default.
+                        option: -d | Detected IPMI device for BMC reset.
+  -fdl                  Reset to the factory default. (Clean LAN)
+                        option: -d | Detected IPMI device for BMC reset.
+  -fde                  Reset to the factory default. (Clean FRU & LAN)
+                        option: -d | Detected IPMI device for BMC reset.
+  -ver                  Get Firmware revision.
+  -vlan                 Get VLAN status.
+  -vlan on <vlan tag>   Enable the VLAN and set the VLAN tag.
+                        If VLANtag is not given it uses previously saved value.
+  -vlan off             Disable the VLAN.
+  -selftest             Checking and reporting on the basic health of BMC.
+  -raw                  Send a RAW IPMI request and print response.
+                        Format: NetFn Cmd [Data1 ... DataN]
+  -fru info             Show FRU inventory area Info.
+  -fru list             Show all FRU values.
+  -fru cthelp           Show chassis type code.
+  -fru help             Show help of FRU Write.
+  -fru <field>          Show FRU field value.
+  -fru <field> <value>  Write FRU.
+  -fru 1m               Update Product-Manufacturer from DMITable to IPMI FRU.
+  -fru 1p               Update Product-Product Name from DMITable to IPMI FRU.
+  -fru 1s               Update Product-S/N from DMITable to IPMI FRU.
+  -fru 2m               Update Board-Manufacturer from DMITable to IPMI FRU.
+  -fru 2p               Update Board-Product Name from DMITable to IPMI FRU.
+  -fru 2s               Update Board-S/N from DMITable to IPMI FRU.
+  -fru 3s               Update Chassis-S/N from DMITable to IPMI FRU.
+  -fru backup <file>    Backup FRU to file <Binary format>.
+  -fru restore <file>   Restore FRU from file <Binary format>.
+  -fru tbackup <file>   Backup FRU to file <Text format>.
+  -fru trestore <file>  Restore FRU from file <Text format>.
+  -fru ver <v1> <v2>    Get/Set FRU version. (v1 v2 are BCD format)
+  -sel info             Show SEL info.
+  -sel list             Show SEL records.
+  -sel del              Delete all SEL records.
+  -sel raw              Show SEL raw data.
+  -sdr [full]           Show SDR records and reading.
+  -sdr del <sdr id>     Delete SDR record.
+  -sdr ver <v1> <v2>    Get/Set SDR version. (v1 v2 are BCD format)
+  -nm nmsdr             Display NM SDR.
+  -nm seltime           Get SEL time.
+  -nm deviceid          Get ME Device ID.
+  -nm reset             Reboots ME.
+  -nm reset2default     Force ME reset to Default.
+  -nm updatemode        Force ME to Update Mode.
+  -nm selftest          Get Self Test Results.
+  -nm listimagesinfo    List ME Images information.
+  -nm oemgetpower       OEM Power command for ME.
+  -nm oemgettemp        OEM Temp. command for ME.
+  -nm pstate            Get Max allowed CPU P-State.
+  -nm tstate            Get Max allowed CPU T-State.
+  -nm cpumemtemp        Get CPU/Memory temperature.
+  -nm hostcpudata       Get host CPU data.
+  -fan                  Get Fan Mode.
+  -fan <mode>           Set Fan Mode.
+  -pminfo [full]        Power supply PMBus health.
+  -psfruinfo            Power supply FRU health.
+  -psbbpinfo            Battery backup power status.
+  -autodischarge        Set auto discharge by days.
+   <module> <day>.      
+  -discharge <module>   Manually discharge battery.
+  -user list            List user privilege information.
+  -user help            Show user privilege code.
+  -user add <user id>   Add user.
+   <name> <password>    
+   <privilege>          
+  -user del <user id>   Delete user.
+  -user level <user id> Update user privilege.
+   <privilege>          
+  -user setpwd          Update user password.
+   <user id> <password> 
+  -conf upload <file>   Upload IPMI configuration form binary file.
+   <option>             option: -p | Bypass warning message.
+  -conf download <file> Download IPMI configuration to binary file.
+  -conf tupload <file>  Upload IPMI configuration from text file.
+   <option>             option: -p | Bypass warning message.
+  -conf tdownload       Download IPMI configuration to text file.
+   <file>               
+  -clrint               Clear chassis intrusion.
+  -reset <index>        Reset System and force to boot from device.
+  -soft <index>         Initiate a soft-shutdown for OS and force to boot from
+                        device.
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/PMBusStatus.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/PMBusStatus.dat
new file mode 100755
index 0000000..d5b8630
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/PMBusStatus.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt1.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt1.dat
new file mode 100755
index 0000000..8b10a40
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt1.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt2.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt2.dat
new file mode 100755
index 0000000..6cfe076
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt2.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt3.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt3.dat
new file mode 100755
index 0000000..aef67c7
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt3.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt4.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt4.dat
new file mode 100755
index 0000000..505e391
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt4.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt5.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt5.dat
new file mode 100755
index 0000000..fed4cfc
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/SpecEvt5.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/phymem32.sys b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/phymem32.sys
new file mode 100755
index 0000000..d14bac3
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/phymem32.sys differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/pmdll.dll b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/pmdll.dll
new file mode 100755
index 0000000..58e5bcb
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/32bit/pmdll.dll differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/DCMICap.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/DCMICap.dat
new file mode 100755
index 0000000..368e2d4
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/DCMICap.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/GenEvt.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/GenEvt.dat
new file mode 100755
index 0000000..92b4c92
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/GenEvt.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/IPMICFG-Win.exe b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/IPMICFG-Win.exe
new file mode 100755
index 0000000..91fb973
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/IPMICFG-Win.exe differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/MBType.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/MBType.dat
new file mode 100755
index 0000000..10aa814
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/MBType.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/MRCCode.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/MRCCode.dat
new file mode 100755
index 0000000..518dbbe
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/MRCCode.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/MRCCode2.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/MRCCode2.dat
new file mode 100755
index 0000000..6cadcfc
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/MRCCode2.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/Menu.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/Menu.dat
new file mode 100755
index 0000000..da10666
--- /dev/null
+++ b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/Menu.dat
@@ -0,0 +1,96 @@
+  -m                    Show IP and MAC.
+  -m IP                 Set IP (format: ###.###.###.###).
+  -a MAC                Set MAC (format: ##:##:##:##:##:##).
+  -k                    Show Subnet Mask.
+  -k Mask               Set Subnet Mask (format: ###.###.###.###).
+  -dhcp                 Get the DHCP status.
+  -dhcp on              Enable the DHCP.
+  -dhcp off             Disable the DHCP.
+  -g                    Show Gateway IP.
+  -g IP                 Set Gateway IP (format: ###.###.###.###).
+  -r                    BMC cold reset.
+                        option: -d | Detected IPMI device for BMC reset.
+  -garp on              Enable the Gratuitous ARP.
+  -garp off             Disable the Gratuitous ARP.
+  -fd                   Reset to the factory default.
+                        option: -d | Detected IPMI device for BMC reset.
+  -fdl                  Reset to the factory default. (Clean LAN)
+                        option: -d | Detected IPMI device for BMC reset.
+  -fde                  Reset to the factory default. (Clean FRU & LAN)
+                        option: -d | Detected IPMI device for BMC reset.
+  -ver                  Get Firmware revision.
+  -vlan                 Get VLAN status.
+  -vlan on <vlan tag>   Enable the VLAN and set the VLAN tag.
+                        If VLANtag is not given it uses previously saved value.
+  -vlan off             Disable the VLAN.
+  -selftest             Checking and reporting on the basic health of BMC.
+  -raw                  Send a RAW IPMI request and print response.
+                        Format: NetFn Cmd [Data1 ... DataN]
+  -fru info             Show FRU inventory area Info.
+  -fru list             Show all FRU values.
+  -fru cthelp           Show chassis type code.
+  -fru help             Show help of FRU Write.
+  -fru <field>          Show FRU field value.
+  -fru <field> <value>  Write FRU.
+  -fru 1m               Update Product-Manufacturer from DMITable to IPMI FRU.
+  -fru 1p               Update Product-Product Name from DMITable to IPMI FRU.
+  -fru 1s               Update Product-S/N from DMITable to IPMI FRU.
+  -fru 2m               Update Board-Manufacturer from DMITable to IPMI FRU.
+  -fru 2p               Update Board-Product Name from DMITable to IPMI FRU.
+  -fru 2s               Update Board-S/N from DMITable to IPMI FRU.
+  -fru 3s               Update Chassis-S/N from DMITable to IPMI FRU.
+  -fru backup <file>    Backup FRU to file <Binary format>.
+  -fru restore <file>   Restore FRU from file <Binary format>.
+  -fru tbackup <file>   Backup FRU to file <Text format>.
+  -fru trestore <file>  Restore FRU from file <Text format>.
+  -fru ver <v1> <v2>    Get/Set FRU version. (v1 v2 are BCD format)
+  -sel info             Show SEL info.
+  -sel list             Show SEL records.
+  -sel del              Delete all SEL records.
+  -sel raw              Show SEL raw data.
+  -sdr [full]           Show SDR records and reading.
+  -sdr del <sdr id>     Delete SDR record.
+  -sdr ver <v1> <v2>    Get/Set SDR version. (v1 v2 are BCD format)
+  -nm nmsdr             Display NM SDR.
+  -nm seltime           Get SEL time.
+  -nm deviceid          Get ME Device ID.
+  -nm reset             Reboots ME.
+  -nm reset2default     Force ME reset to Default.
+  -nm updatemode        Force ME to Update Mode.
+  -nm selftest          Get Self Test Results.
+  -nm listimagesinfo    List ME Images information.
+  -nm oemgetpower       OEM Power command for ME.
+  -nm oemgettemp        OEM Temp. command for ME.
+  -nm pstate            Get Max allowed CPU P-State.
+  -nm tstate            Get Max allowed CPU T-State.
+  -nm cpumemtemp        Get CPU/Memory temperature.
+  -nm hostcpudata       Get host CPU data.
+  -fan                  Get Fan Mode.
+  -fan <mode>           Set Fan Mode.
+  -pminfo [full]        Power supply PMBus health.
+  -psfruinfo            Power supply FRU health.
+  -psbbpinfo            Battery backup power status.
+  -autodischarge        Set auto discharge by days.
+   <module> <day>.      
+  -discharge <module>   Manually discharge battery.
+  -user list            List user privilege information.
+  -user help            Show user privilege code.
+  -user add <user id>   Add user.
+   <name> <password>    
+   <privilege>          
+  -user del <user id>   Delete user.
+  -user level <user id> Update user privilege.
+   <privilege>          
+  -user setpwd          Update user password.
+   <user id> <password> 
+  -conf upload <file>   Upload IPMI configuration form binary file.
+   <option>             option: -p | Bypass warning message.
+  -conf download <file> Download IPMI configuration to binary file.
+  -conf tupload <file>  Upload IPMI configuration from text file.
+   <option>             option: -p | Bypass warning message.
+  -conf tdownload       Download IPMI configuration to text file.
+   <file>               
+  -clrint               Clear chassis intrusion.
+  -reset <index>        Reset System and force to boot from device.
+  -soft <index>         Initiate a soft-shutdown for OS and force to boot from
+                        device.
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/PMBusStatus.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/PMBusStatus.dat
new file mode 100755
index 0000000..d5b8630
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/PMBusStatus.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt1.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt1.dat
new file mode 100755
index 0000000..8b10a40
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt1.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt2.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt2.dat
new file mode 100755
index 0000000..6cfe076
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt2.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt3.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt3.dat
new file mode 100755
index 0000000..aef67c7
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt3.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt4.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt4.dat
new file mode 100755
index 0000000..505e391
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt4.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt5.dat b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt5.dat
new file mode 100755
index 0000000..fed4cfc
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/SpecEvt5.dat differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/phymem64.sys b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/phymem64.sys
new file mode 100755
index 0000000..0b8798d
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/phymem64.sys differ
diff --git a/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/pmdll.dll b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/pmdll.dll
new file mode 100755
index 0000000..c3d2f58
Binary files /dev/null and b/GA-Schloss/bin/IPMICFG_1.27.0_build.170620/Windows/64bit/pmdll.dll differ
diff --git a/GA-Schloss/bin/admin-stuff b/GA-Schloss/bin/admin-stuff
new file mode 160000
index 0000000..414ae04
--- /dev/null
+++ b/GA-Schloss/bin/admin-stuff
@@ -0,0 +1 @@
+Subproject commit 414ae04eada0ebc45643e82d8742de795e5c5a70
diff --git a/GA-Schloss/bin/manage-gw-config b/GA-Schloss/bin/manage-gw-config
new file mode 160000
index 0000000..e0e37c2
--- /dev/null
+++ b/GA-Schloss/bin/manage-gw-config
@@ -0,0 +1 @@
+Subproject commit e0e37c21b77b5876fb9b5b66204cfcb7eba3cffc
diff --git a/GA-Schloss/bin/monitoring b/GA-Schloss/bin/monitoring
new file mode 160000
index 0000000..9a02312
--- /dev/null
+++ b/GA-Schloss/bin/monitoring
@@ -0,0 +1 @@
+Subproject commit 9a02312bda7beec1b6d6f63d197f2dfd39254680
diff --git a/GA-Schloss/bin/os-upgrade.sh b/GA-Schloss/bin/os-upgrade.sh
new file mode 120000
index 0000000..02ddc66
--- /dev/null
+++ b/GA-Schloss/bin/os-upgrade.sh
@@ -0,0 +1 @@
+admin-stuff/os-upgrade.sh
\ No newline at end of file
diff --git a/GA-Schloss/bin/postfix b/GA-Schloss/bin/postfix
new file mode 160000
index 0000000..c1934d5
--- /dev/null
+++ b/GA-Schloss/bin/postfix
@@ -0,0 +1 @@
+Subproject commit c1934d5bdeee88e6f5b868c7d0bdb955539d34d4
diff --git a/GA-Schloss/bin/test_email.sh b/GA-Schloss/bin/test_email.sh
new file mode 120000
index 0000000..86f3e17
--- /dev/null
+++ b/GA-Schloss/bin/test_email.sh
@@ -0,0 +1 @@
+admin-stuff/test_email.sh
\ No newline at end of file
diff --git a/GA-Schloss/bind/bind.keys b/GA-Schloss/bind/bind.keys
new file mode 100644
index 0000000..db22d4b
--- /dev/null
+++ b/GA-Schloss/bind/bind.keys
@@ -0,0 +1,69 @@
+# The bind.keys file is used to override the built-in DNSSEC trust anchors
+# which are included as part of BIND 9.  As of the current release, the only
+# trust anchors it contains are those for the DNS root zone ("."), and for
+# the ISC DNSSEC Lookaside Validation zone ("dlv.isc.org").  Trust anchors
+# for any other zones MUST be configured elsewhere; if they are configured
+# here, they will not be recognized or used by named.
+#
+# The built-in trust anchors are provided for convenience of configuration.
+# They are not activated within named.conf unless specifically switched on.
+# To use the built-in root key, set "dnssec-validation auto;" in
+# named.conf options.  To use the built-in DLV key, set
+# "dnssec-lookaside auto;".  Without these options being set,
+# the keys in this file are ignored.
+#
+# This file is NOT expected to be user-configured.
+#
+# These keys are current as of Feburary 2017.  If any key fails to
+# initialize correctly, it may have expired.  In that event you should
+# replace this file with a current version.  The latest version of
+# bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys.
+
+managed-keys {
+        # ISC DLV: See https://www.isc.org/solutions/dlv for details.
+        #
+        # NOTE: The ISC DLV zone is being phased out as of February 2017;
+        # the key will remain in place but the zone will be otherwise empty.
+        # Configuring "dnssec-lookaside auto;" to activate this key is
+        # harmless, but is no longer useful and is not recommended.
+        dlv.isc.org. initial-key 257 3 5 "BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2
+                brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+
+                1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5
+                ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk
+                Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM
+                QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt
+                TDN0YUuWrBNh";
+
+        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
+        # for current trust anchor information.
+        #
+        # These keys are activated by setting "dnssec-validation auto;"
+        # in named.conf.
+        #
+        # This key (19036) is to be phased out starting in 2017. It will
+        # remain in the root zone for some time after its successor key
+        # has been added. It will remain this file until it is removed from
+        # the root zone.
+        . initial-key 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
+                FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX
+                bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
+                X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz
+                W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS
+                Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq
+                QxA+Uk1ihz0=";
+
+        # This key (20326) is to be published in the root zone in 2017.
+        # Servers which were already using the old key (19036) should
+        # roll seamlessly to this new one via RFC 5011 rollover. Servers
+        # being set up for the first time can use the contents of this
+        # file as initializing keys; thereafter, the keys in the
+        # managed key database will be trusted and maintained
+        # automatically.
+        . initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+                +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+                ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+                0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+                oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+                RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+                R1AkUTV74bU=";
+};
diff --git a/GA-Schloss/bind/db.0 b/GA-Schloss/bind/db.0
new file mode 100644
index 0000000..e3aabdb
--- /dev/null
+++ b/GA-Schloss/bind/db.0
@@ -0,0 +1,12 @@
+;
+; BIND reverse data file for broadcast zone
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
diff --git a/GA-Schloss/bind/db.127 b/GA-Schloss/bind/db.127
new file mode 100644
index 0000000..cd05bef
--- /dev/null
+++ b/GA-Schloss/bind/db.127
@@ -0,0 +1,13 @@
+;
+; BIND reverse data file for local loopback interface
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
+1.0.0	IN	PTR	localhost.
diff --git a/GA-Schloss/bind/db.255 b/GA-Schloss/bind/db.255
new file mode 100644
index 0000000..e3aabdb
--- /dev/null
+++ b/GA-Schloss/bind/db.255
@@ -0,0 +1,12 @@
+;
+; BIND reverse data file for broadcast zone
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
diff --git a/GA-Schloss/bind/db.empty b/GA-Schloss/bind/db.empty
new file mode 100644
index 0000000..8a12858
--- /dev/null
+++ b/GA-Schloss/bind/db.empty
@@ -0,0 +1,14 @@
+; BIND reverse data file for empty rfc1918 zone
+;
+; DO NOT EDIT THIS FILE - it is used for multiple zones.
+; Instead, copy it, edit named.conf, and use that copy.
+;
+$TTL	86400
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			  86400 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
diff --git a/GA-Schloss/bind/db.local b/GA-Schloss/bind/db.local
new file mode 100644
index 0000000..2f272d4
--- /dev/null
+++ b/GA-Schloss/bind/db.local
@@ -0,0 +1,14 @@
+;
+; BIND data file for local loopback interface
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      2		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
+@	IN	A	127.0.0.1
+@	IN	AAAA	::1
diff --git a/GA-Schloss/bind/db.root b/GA-Schloss/bind/db.root
new file mode 100644
index 0000000..f0b79d2
--- /dev/null
+++ b/GA-Schloss/bind/db.root
@@ -0,0 +1,90 @@
+;       This file holds the information on root name servers needed to
+;       initialize cache of Internet domain name servers
+;       (e.g. reference this file in the "cache  .  <file>"
+;       configuration file of BIND domain name servers).
+;
+;       This file is made available by InterNIC 
+;       under anonymous FTP as
+;           file                /domain/named.cache
+;           on server           FTP.INTERNIC.NET
+;       -OR-                    RS.INTERNIC.NET
+;
+;       last update:    February 17, 2016
+;       related version of root zone:   2016021701
+;
+; formerly NS.INTERNIC.NET
+;
+.                        3600000      NS    A.ROOT-SERVERS.NET.
+A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
+A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30
+;
+; FORMERLY NS1.ISI.EDU
+;
+.                        3600000      NS    B.ROOT-SERVERS.NET.
+B.ROOT-SERVERS.NET.      3600000      A     192.228.79.201
+B.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:84::b
+;
+; FORMERLY C.PSI.NET
+;
+.                        3600000      NS    C.ROOT-SERVERS.NET.
+C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
+C.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2::c
+;
+; FORMERLY TERP.UMD.EDU
+;
+.                        3600000      NS    D.ROOT-SERVERS.NET.
+D.ROOT-SERVERS.NET.      3600000      A     199.7.91.13
+D.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2d::d
+;
+; FORMERLY NS.NASA.GOV
+;
+.                        3600000      NS    E.ROOT-SERVERS.NET.
+E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
+;
+; FORMERLY NS.ISC.ORG
+;
+.                        3600000      NS    F.ROOT-SERVERS.NET.
+F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
+F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2f::f
+;
+; FORMERLY NS.NIC.DDN.MIL
+;
+.                        3600000      NS    G.ROOT-SERVERS.NET.
+G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
+;
+; FORMERLY AOS.ARL.ARMY.MIL
+;
+.                        3600000      NS    H.ROOT-SERVERS.NET.
+H.ROOT-SERVERS.NET.      3600000      A     198.97.190.53
+H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::53
+;
+; FORMERLY NIC.NORDU.NET
+;
+.                        3600000      NS    I.ROOT-SERVERS.NET.
+I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
+I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fe::53
+;
+; OPERATED BY VERISIGN, INC.
+;
+.                        3600000      NS    J.ROOT-SERVERS.NET.
+J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
+J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:c27::2:30
+;
+; OPERATED BY RIPE NCC
+;
+.                        3600000      NS    K.ROOT-SERVERS.NET.
+K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129
+K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fd::1
+;
+; OPERATED BY ICANN
+;
+.                        3600000      NS    L.ROOT-SERVERS.NET.
+L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42
+L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:3::42
+;
+; OPERATED BY WIDE
+;
+.                        3600000      NS    M.ROOT-SERVERS.NET.
+M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
+M.ROOT-SERVERS.NET.      3600000      AAAA  2001:dc3::35
+; End of file
diff --git a/GA-Schloss/bind/master/ga.netz.zone b/GA-Schloss/bind/master/ga.netz.zone
new file mode 100644
index 0000000..1e57d80
--- /dev/null
+++ b/GA-Schloss/bind/master/ga.netz.zone
@@ -0,0 +1,119 @@
+;
+; BIND data file for local ga.netz zone
+;
+$TTL  43200
+@  IN SOA   ns.local.netz. ckubu.oopen.de. (
+      2018032901     ; Serial
+          604800     ; Refresh
+           86400     ; Retry
+         2419200     ; Expire
+          604800 )   ; Negative Cache TTL
+;
+
+
+						IN	NS		ns1.ga.netz.
+						IN	NS		ns2.ga.netz.
+						IN	NS		ns3.ga.netz.
+						IN	NS		ga-st-dc.ga.intra.
+						IN	NS		gaasdc01.ga.intra.
+
+
+; Gateway/Firewall Server
+ga-st-gw          IN A     192.168.11.254
+st-gw             IN CNAME ga-st-gw
+gw-schloss			IN	CNAME ga-st-gw
+ga-st-gw-ipmi     IN A     10.11.11.15
+st-gw-ipmi        IN CNAME ga-st-gw-ipmi
+ga-schloss-ipmi   IN CNAME ga-st-gw-ipmi
+
+ga-nh-gw          IN A     192.168.81.254
+nh-gw             IN CNAME ga-nh-gw
+gw-nh             IN CNAME ga-nh-gw
+ga-nh-gw-ipmi     IN A     192.168.81.15
+nh-gw-ipmi        IN CNAME ga-nh-gw-ipmi
+gw-nh-ipmi        IN CNAME ga-nh-gw-ipmi
+
+
+ga-al-gw          IN A     192.168.10.254
+al-gw             IN CNAME ga-al-gw
+gw-altenschlirf   IN CNAME ga-al-gw
+gw-al-gw-ipmi     IN A     172.17.0.15
+al-gw-ipmi        IN CNAME gw-al-gw-ipmi
+
+ga-st-gw-ersatz   IN A     192.168.11.19
+st-gw-ersatz      IN CNAME ga-st-gw-ersatz
+gw-ersatz         IN CNAME ga-st-gw-ersatz
+ga-st-gw-ersatz-ipmi IN A     10.11.11.16
+st-gw-ersatz-ipmi IN CNAME ga-st-gw-ersatz-ipmi
+gw-ersatz-ipmi    IN CNAME ga-st-gw-ersatz-ipmi
+
+; Controller for Unifi AP's
+ga-st-ctl-unifi   IN A     10.121.15.254
+st-ctl-unifi      IN CNAME ga-st-ctl-unifi
+
+; Unifi Accesspoints
+ap-unifi001       IN A     10.121.1.1
+ap-unifi002       IN A     10.121.1.2
+ap-unifi003       IN A     10.121.1.3
+ap-unifi004       IN A     10.121.1.4
+ap-unifi004       IN A     10.121.1.5
+
+
+
+; KVM Hostsysteme
+ga-st-kvm1        IN A     10.10.11.1
+st-kvm1           IN CNAME ga-st-kvm1
+ga-st-kvm1-ipmi   IN A     10.10.10.115
+st-kvm1-ipmi      IN CNAME ga-st-kvm1-ipmi
+
+ga-al-kvm2        IN A     10.10.10.3
+al-kvm2           IN CNAME ga-al-kvm2
+ga-al-kvm2-ipmi   IN A     10.10.10.115
+al-kvm2-ipmi      IN CNAME ga-al-kvm2-ipmi
+
+
+; Nameserver
+ns1					IN	A 		192.168.11.1
+ns                IN CNAME ns1
+ga-st-ns1         IN CNAME ns1
+st-ns1            IN CNAME ns1
+ns2					IN	A 		192.168.10.254
+ga-al-ns2         IN CNAME ns2
+al-ns2            IN CNAME ns2
+ns3					IN	A 		192.168.81.1
+ga-nh-ns3         IN CNAME ns3
+nh-ns3            IN CNAME ns3
+
+ns.wolle          IN A     10.113.12.3
+
+; Linux Dienste Server 
+ga-st-lsx1        IN A     192.168.11.2
+st-lsx1           IN CNAME ga-st-lsx1
+lsx1              IN CNAME ga-st-lsx1
+
+; Tech wiki
+ga-st-twiki       IN A     192.168.11.5
+st-twiki          IN CNAME ga-st-twiki
+dokuwiki          IN CNAME ga-st-twiki
+techwiki          IN CNAME ga-st-twiki
+wiki              IN CNAME ga-st-twiki
+
+; Backup Server Stockhausen
+ga-st-rsync1      IN A     10.10.11.7
+st-rsync1         IN CNAME ga-st-rsync1
+rsync1            IN CNAME ga-st-rsync1
+
+; Backup Server Altenschlirf
+ga-al-rsync2      IN A     10.10.10.7
+al-rsync2         IN CNAME ga-al-rsync2
+rsync2            IN CNAME ga-al-rsync2
+
+; Xymon Server Altenschlirf
+ga-al-xymon       IN A     192.168.10.16
+al-xymon          IN CNAME ga-al-xymon
+xymon             IN CNAME ga-al-xymon
+
+; Webserver 1 (Altenschlirf)
+ga-al-ws1         IN A     192.168.10.17
+al-ws1            IN CNAME ga-al-ws1
+
diff --git a/GA-Schloss/bind/named.conf b/GA-Schloss/bind/named.conf
new file mode 100644
index 0000000..880786a
--- /dev/null
+++ b/GA-Schloss/bind/named.conf
@@ -0,0 +1,11 @@
+// This is the primary configuration file for the BIND DNS server named.
+//
+// Please read /usr/share/doc/bind9/README.Debian.gz for information on the 
+// structure of BIND configuration files in Debian, *BEFORE* you customize 
+// this configuration file.
+//
+// If you are just adding zones, please do that in /etc/bind/named.conf.local
+
+include "/etc/bind/named.conf.options";
+include "/etc/bind/named.conf.local";
+include "/etc/bind/named.conf.default-zones";
diff --git a/GA-Schloss/bind/named.conf.default-zones b/GA-Schloss/bind/named.conf.default-zones
new file mode 100644
index 0000000..355338b
--- /dev/null
+++ b/GA-Schloss/bind/named.conf.default-zones
@@ -0,0 +1,30 @@
+// prime the server with knowledge of the root servers
+zone "." {
+	type hint;
+	file "/etc/bind/db.root";
+};
+
+// be authoritative for the localhost forward and reverse zones, and for
+// broadcast zones as per RFC 1912
+
+zone "localhost" {
+	type master;
+	file "/etc/bind/db.local";
+};
+
+zone "127.in-addr.arpa" {
+	type master;
+	file "/etc/bind/db.127";
+};
+
+zone "0.in-addr.arpa" {
+	type master;
+	file "/etc/bind/db.0";
+};
+
+zone "255.in-addr.arpa" {
+	type master;
+	file "/etc/bind/db.255";
+};
+
+
diff --git a/GA-Schloss/bind/named.conf.local b/GA-Schloss/bind/named.conf.local
new file mode 100644
index 0000000..68f36eb
--- /dev/null
+++ b/GA-Schloss/bind/named.conf.local
@@ -0,0 +1,125 @@
+//
+// Do any local configuration here
+//
+
+// Consider adding the 1918 zones here, if they are not used in your
+// organization
+//include "/etc/bind/zones.rfc1918";
+
+/* ------------ MASTER ZONES ------------- */
+
+zone "ga.netz" {
+   type master;
+   file "/etc/bind/master/ga.netz.zone";
+   allow-transfer {
+      internaldns;
+   };
+};
+
+
+/* ------------ SLAVE ZONES ------------- */
+
+zone "_msdcs.ga.intra" {
+   type slave;
+   file "/etc/bind/slave/_msdcs.ga.intra";
+   allow-query { any; };
+   allow-transfer {
+      internaldns;
+   };
+   masters {
+      192.168.10.3;
+   };
+
+   // Use this sender IPv4 for zone transfers
+   transfer-source 192.168.11.1 ;
+};
+
+zone "autodiscover.gemeinschaft-altenschlirf.de" {
+   type slave;
+   file "/etc/bind/slave/autodiscover.gemeinschaft-altenschlirf.de.zone";
+   allow-query { any; };
+   allow-transfer {
+      internaldns;
+   };
+   masters {
+      192.168.10.3;
+   };
+
+   // Use this sender IPv4 for zone transfers
+   transfer-source 192.168.11.1 ;
+};
+
+zone "ga.intra" {
+   type slave;
+   file "/etc/bind/slave/ga.intra.zone";
+   allow-query { any; };
+   allow-transfer {
+      internaldns;
+   };
+   masters {
+      192.168.10.3;
+   };
+
+   // Use this sender IPv4 for zone transfers
+   transfer-source 192.168.11.1 ;
+};
+
+zone "citrix.gemeinschaft-altenschlirf.de" {
+   type slave;
+   file "/etc/bind/slave/citrix.gemeinschaft-altenschlirf.de.zone";
+   allow-query { any; };
+   allow-transfer {
+      internaldns;
+   };
+   masters {
+      192.168.10.3;
+   };
+
+   // Use this sender IPv4 for zone transfers
+   transfer-source 192.168.11.1 ;
+};
+
+zone "mail.gemeinschaft-altenschlirf.de" {
+   type slave;
+   file "/etc/bind/slave/mail.gemeinschaft-altenschlirf.de.zone";
+   allow-query { any; };
+   allow-transfer {
+      internaldns;
+   };
+   masters {
+      192.168.10.3;
+   };
+
+   // Use this sender IPv4 for zone transfers
+   transfer-source 192.168.11.1 ;
+};
+
+zone "11.168.192.in-addr.arpa" {
+   type slave;
+   file "/etc/bind/slave/db.11.168.192.in-addr.arpa";
+   allow-query { any; };
+   allow-transfer {
+      internaldns;
+   };
+   masters {
+      192.168.10.3;
+   };
+   
+   // Use this sender IPv4 for zone transfers
+   transfer-source 192.168.11.1 ;
+};
+
+zone "10.168.192.in-addr.arpa" {
+   type slave;
+   file "/etc/bind/slave/db.10.168.192.in-addr.arpa";
+   allow-query { any; };
+   allow-transfer {
+      internaldns;
+   };
+   masters {
+      192.168.10.3;
+   };
+
+   // Use this sender IPv4 for zone transfers
+   transfer-source 192.168.11.1 ;
+};
diff --git a/GA-Schloss/bind/named.conf.local.ORIG b/GA-Schloss/bind/named.conf.local.ORIG
new file mode 100644
index 0000000..7a57b10
--- /dev/null
+++ b/GA-Schloss/bind/named.conf.local.ORIG
@@ -0,0 +1,8 @@
+//
+// Do any local configuration here
+//
+
+// Consider adding the 1918 zones here, if they are not used in your
+// organization
+//include "/etc/bind/zones.rfc1918";
+
diff --git a/GA-Schloss/bind/named.conf.options b/GA-Schloss/bind/named.conf.options
new file mode 100644
index 0000000..250967e
--- /dev/null
+++ b/GA-Schloss/bind/named.conf.options
@@ -0,0 +1,133 @@
+acl internaldns {
+   192.168.11.3;
+   192.168.10.3;
+   192.168.10.6;
+   # Nameserver Gateway Altenschlirf
+   192.168.10.254;
+   172.16.0.1;
+   # Nameserver Gateway Novalishaus
+   192.168.81.1;
+   10.2.11.2;
+   # Nameserver wolle
+   10.113.12.3;
+};
+
+options {
+	directory "/var/cache/bind";
+
+	// If there is a firewall between you and nameservers you want
+	// to talk to, you may need to fix the firewall to allow multiple
+	// ports to talk.  See http://www.kb.cert.org/vuls/id/800113
+
+	// If your ISP provided one or more IP addresses for stable 
+	// nameservers, you probably want to use them as forwarders.  
+	// Uncomment the following block, and insert the addresses replacing 
+	// the all-0's placeholder.
+
+	// forwarders {
+	// 	0.0.0.0;
+	// };
+
+	//========================================================================
+	// If BIND logs error messages about the root key being expired,
+	// you will need to update your keys.  See https://www.isc.org/bind-keys
+	//========================================================================
+	dnssec-validation auto;
+
+   // Security options
+   listen-on port 53 {
+      127.0.0.1;
+      10.10.11.254;
+      192.168.11.1;
+      192.168.11.254;
+   };
+
+   // Use this sender IPv4 for zone transfers
+   //transfer-source 192.168.11.1 ; 
+
+   allow-query {
+      127.0.0.1;
+      192.168.0.0/16;
+      10.0.0.0/8;
+      172.16.0.0/12;
+      2001:6f8:107e::/48;
+      fe80::/8;
+      ::1/128;
+   };
+
+   // caching name services
+   recursion yes;
+
+   allow-recursion {
+      127.0.0.1;
+      192.168.0.0/16;
+      172.16.0.0/12;
+      10.0.0.0/8;
+      fe80::/8;
+      ::1/128;
+   };
+
+   allow-transfer {
+      internaldns;
+   };
+   transfer-source 192.168.11.1;
+   notify-source 192.168.11.1;
+
+
+	auth-nxdomain no;    # conform to RFC1035
+	listen-on-v6 { none; };
+
+   ## - If zone-statistics is "yes", statistic file will be written.
+   ## -
+   ## - Notice:
+   ## -    The named.stats file may grow very large over the time use some logrotate to keep it
+   ## -    small, this may result in graphs being reset ( something I don't care about here )
+   ## -
+   zone-statistics yes;
+   statistics-file "/var/log/named/named.stats";
+};
+
+logging {
+   channel simple_log {
+      file "/var/log/named/bind.log" versions 3 size 5m;
+      //severity warning;
+      severity info;
+      print-time yes;
+      print-severity yes;
+      print-category  yes;
+   };
+   channel queries_log {
+      file "/var/log/named/query.log" versions 10 size 5m;
+      severity debug;
+      //severity notice;
+      print-time yes;
+      print-severity yes;
+      print-category no;
+   };
+   channel log_zone_transfers {
+      file "/var/log/named/axfr.log" versions 5 size 2m;
+      severity info;
+      print-time yes;
+      print-severity yes;
+      print-category yes;
+   };
+   category resolver {
+      queries_log;
+   };
+   category queries {
+      queries_log;
+   };
+   category xfer-in {
+      log_zone_transfers;
+   };
+   category xfer-out {
+      log_zone_transfers;
+   };
+   category notify {
+      log_zone_transfers;
+   };
+   category default{
+      simple_log;
+   };
+};
+
diff --git a/GA-Schloss/bind/rndc.key b/GA-Schloss/bind/rndc.key
new file mode 100644
index 0000000..88a755e
--- /dev/null
+++ b/GA-Schloss/bind/rndc.key
@@ -0,0 +1,4 @@
+key "rndc-key" {
+	algorithm hmac-md5;
+	secret "R/ilz2UjdXokWgxVai2qYw==";
+};
diff --git a/GA-Schloss/bind/slave/_msdcs.ga.intra b/GA-Schloss/bind/slave/_msdcs.ga.intra
new file mode 100644
index 0000000..eeba905
Binary files /dev/null and b/GA-Schloss/bind/slave/_msdcs.ga.intra differ
diff --git a/GA-Schloss/bind/slave/_msdcs.ga.intra.jnl b/GA-Schloss/bind/slave/_msdcs.ga.intra.jnl
new file mode 100644
index 0000000..5a6feea
Binary files /dev/null and b/GA-Schloss/bind/slave/_msdcs.ga.intra.jnl differ
diff --git a/GA-Schloss/bind/slave/autodiscover.gemeinschaft-altenschlirf.de.zone b/GA-Schloss/bind/slave/autodiscover.gemeinschaft-altenschlirf.de.zone
new file mode 100644
index 0000000..45109dc
Binary files /dev/null and b/GA-Schloss/bind/slave/autodiscover.gemeinschaft-altenschlirf.de.zone differ
diff --git a/GA-Schloss/bind/slave/citrix.gemeinschaft-altenschlirf.de.zone b/GA-Schloss/bind/slave/citrix.gemeinschaft-altenschlirf.de.zone
new file mode 100644
index 0000000..db85a82
Binary files /dev/null and b/GA-Schloss/bind/slave/citrix.gemeinschaft-altenschlirf.de.zone differ
diff --git a/GA-Schloss/bind/slave/db-0soiZLlb b/GA-Schloss/bind/slave/db-0soiZLlb
new file mode 100644
index 0000000..7ae05c6
Binary files /dev/null and b/GA-Schloss/bind/slave/db-0soiZLlb differ
diff --git a/GA-Schloss/bind/slave/db-0uDtfBzL b/GA-Schloss/bind/slave/db-0uDtfBzL
new file mode 100644
index 0000000..9eaf81f
Binary files /dev/null and b/GA-Schloss/bind/slave/db-0uDtfBzL differ
diff --git a/GA-Schloss/bind/slave/db-1Jw0DRGe b/GA-Schloss/bind/slave/db-1Jw0DRGe
new file mode 100644
index 0000000..e3c5d10
Binary files /dev/null and b/GA-Schloss/bind/slave/db-1Jw0DRGe differ
diff --git a/GA-Schloss/bind/slave/db-1JxE1FW6 b/GA-Schloss/bind/slave/db-1JxE1FW6
new file mode 100644
index 0000000..cc001fc
Binary files /dev/null and b/GA-Schloss/bind/slave/db-1JxE1FW6 differ
diff --git a/GA-Schloss/bind/slave/db-1Un14WRP b/GA-Schloss/bind/slave/db-1Un14WRP
new file mode 100644
index 0000000..42a82ed
Binary files /dev/null and b/GA-Schloss/bind/slave/db-1Un14WRP differ
diff --git a/GA-Schloss/bind/slave/db-25yIGaNX b/GA-Schloss/bind/slave/db-25yIGaNX
new file mode 100644
index 0000000..51b8792
Binary files /dev/null and b/GA-Schloss/bind/slave/db-25yIGaNX differ
diff --git a/GA-Schloss/bind/slave/db-28PAMnt6 b/GA-Schloss/bind/slave/db-28PAMnt6
new file mode 100644
index 0000000..a14f2e9
Binary files /dev/null and b/GA-Schloss/bind/slave/db-28PAMnt6 differ
diff --git a/GA-Schloss/bind/slave/db-2SYkW1NK b/GA-Schloss/bind/slave/db-2SYkW1NK
new file mode 100644
index 0000000..cffcfcf
Binary files /dev/null and b/GA-Schloss/bind/slave/db-2SYkW1NK differ
diff --git a/GA-Schloss/bind/slave/db-3Vb2yxdy b/GA-Schloss/bind/slave/db-3Vb2yxdy
new file mode 100644
index 0000000..6c3d60f
Binary files /dev/null and b/GA-Schloss/bind/slave/db-3Vb2yxdy differ
diff --git a/GA-Schloss/bind/slave/db-3cF5Ymrc b/GA-Schloss/bind/slave/db-3cF5Ymrc
new file mode 100644
index 0000000..6545021
Binary files /dev/null and b/GA-Schloss/bind/slave/db-3cF5Ymrc differ
diff --git a/GA-Schloss/bind/slave/db-3g6jEXiZ b/GA-Schloss/bind/slave/db-3g6jEXiZ
new file mode 100644
index 0000000..1ea64c5
Binary files /dev/null and b/GA-Schloss/bind/slave/db-3g6jEXiZ differ
diff --git a/GA-Schloss/bind/slave/db-40HvrzbD b/GA-Schloss/bind/slave/db-40HvrzbD
new file mode 100644
index 0000000..d485d03
Binary files /dev/null and b/GA-Schloss/bind/slave/db-40HvrzbD differ
diff --git a/GA-Schloss/bind/slave/db-4M55eGDl b/GA-Schloss/bind/slave/db-4M55eGDl
new file mode 100644
index 0000000..88b10c6
Binary files /dev/null and b/GA-Schloss/bind/slave/db-4M55eGDl differ
diff --git a/GA-Schloss/bind/slave/db-4kpmYn21 b/GA-Schloss/bind/slave/db-4kpmYn21
new file mode 100644
index 0000000..4d09964
Binary files /dev/null and b/GA-Schloss/bind/slave/db-4kpmYn21 differ
diff --git a/GA-Schloss/bind/slave/db-4vftyAAC b/GA-Schloss/bind/slave/db-4vftyAAC
new file mode 100644
index 0000000..2882497
Binary files /dev/null and b/GA-Schloss/bind/slave/db-4vftyAAC differ
diff --git a/GA-Schloss/bind/slave/db-4xs1aBxT b/GA-Schloss/bind/slave/db-4xs1aBxT
new file mode 100644
index 0000000..db74600
Binary files /dev/null and b/GA-Schloss/bind/slave/db-4xs1aBxT differ
diff --git a/GA-Schloss/bind/slave/db-4yM4pIdj b/GA-Schloss/bind/slave/db-4yM4pIdj
new file mode 100644
index 0000000..ed32ecb
Binary files /dev/null and b/GA-Schloss/bind/slave/db-4yM4pIdj differ
diff --git a/GA-Schloss/bind/slave/db-509JGOS8 b/GA-Schloss/bind/slave/db-509JGOS8
new file mode 100644
index 0000000..e64a0fe
Binary files /dev/null and b/GA-Schloss/bind/slave/db-509JGOS8 differ
diff --git a/GA-Schloss/bind/slave/db-5M9YSfBj b/GA-Schloss/bind/slave/db-5M9YSfBj
new file mode 100644
index 0000000..7f5e80c
Binary files /dev/null and b/GA-Schloss/bind/slave/db-5M9YSfBj differ
diff --git a/GA-Schloss/bind/slave/db-5MokaVTq b/GA-Schloss/bind/slave/db-5MokaVTq
new file mode 100644
index 0000000..f39ca17
Binary files /dev/null and b/GA-Schloss/bind/slave/db-5MokaVTq differ
diff --git a/GA-Schloss/bind/slave/db-5Y4PYI8n b/GA-Schloss/bind/slave/db-5Y4PYI8n
new file mode 100644
index 0000000..714f622
Binary files /dev/null and b/GA-Schloss/bind/slave/db-5Y4PYI8n differ
diff --git a/GA-Schloss/bind/slave/db-5jECdUwa b/GA-Schloss/bind/slave/db-5jECdUwa
new file mode 100644
index 0000000..05644b3
Binary files /dev/null and b/GA-Schloss/bind/slave/db-5jECdUwa differ
diff --git a/GA-Schloss/bind/slave/db-6FZez7DM b/GA-Schloss/bind/slave/db-6FZez7DM
new file mode 100644
index 0000000..2d65ce8
Binary files /dev/null and b/GA-Schloss/bind/slave/db-6FZez7DM differ
diff --git a/GA-Schloss/bind/slave/db-6T2Mebls b/GA-Schloss/bind/slave/db-6T2Mebls
new file mode 100644
index 0000000..4c1d1f1
Binary files /dev/null and b/GA-Schloss/bind/slave/db-6T2Mebls differ
diff --git a/GA-Schloss/bind/slave/db-6UhRGphH b/GA-Schloss/bind/slave/db-6UhRGphH
new file mode 100644
index 0000000..0091738
Binary files /dev/null and b/GA-Schloss/bind/slave/db-6UhRGphH differ
diff --git a/GA-Schloss/bind/slave/db-6kyUibyL b/GA-Schloss/bind/slave/db-6kyUibyL
new file mode 100644
index 0000000..8ab42ee
Binary files /dev/null and b/GA-Schloss/bind/slave/db-6kyUibyL differ
diff --git a/GA-Schloss/bind/slave/db-6qWrhiIV b/GA-Schloss/bind/slave/db-6qWrhiIV
new file mode 100644
index 0000000..9de8acc
Binary files /dev/null and b/GA-Schloss/bind/slave/db-6qWrhiIV differ
diff --git a/GA-Schloss/bind/slave/db-6uGm1EDg b/GA-Schloss/bind/slave/db-6uGm1EDg
new file mode 100644
index 0000000..874d940
Binary files /dev/null and b/GA-Schloss/bind/slave/db-6uGm1EDg differ
diff --git a/GA-Schloss/bind/slave/db-7S495ziz b/GA-Schloss/bind/slave/db-7S495ziz
new file mode 100644
index 0000000..47f4db5
Binary files /dev/null and b/GA-Schloss/bind/slave/db-7S495ziz differ
diff --git a/GA-Schloss/bind/slave/db-7TUJichU b/GA-Schloss/bind/slave/db-7TUJichU
new file mode 100644
index 0000000..687aff9
Binary files /dev/null and b/GA-Schloss/bind/slave/db-7TUJichU differ
diff --git a/GA-Schloss/bind/slave/db-8Hcq2snu b/GA-Schloss/bind/slave/db-8Hcq2snu
new file mode 100644
index 0000000..354c2bc
Binary files /dev/null and b/GA-Schloss/bind/slave/db-8Hcq2snu differ
diff --git a/GA-Schloss/bind/slave/db-8HxlCYfi b/GA-Schloss/bind/slave/db-8HxlCYfi
new file mode 100644
index 0000000..6fd7578
Binary files /dev/null and b/GA-Schloss/bind/slave/db-8HxlCYfi differ
diff --git a/GA-Schloss/bind/slave/db-8JhalMhl b/GA-Schloss/bind/slave/db-8JhalMhl
new file mode 100644
index 0000000..262029f
Binary files /dev/null and b/GA-Schloss/bind/slave/db-8JhalMhl differ
diff --git a/GA-Schloss/bind/slave/db-8RyvBaeM b/GA-Schloss/bind/slave/db-8RyvBaeM
new file mode 100644
index 0000000..01b955f
Binary files /dev/null and b/GA-Schloss/bind/slave/db-8RyvBaeM differ
diff --git a/GA-Schloss/bind/slave/db-8Xk2paMi b/GA-Schloss/bind/slave/db-8Xk2paMi
new file mode 100644
index 0000000..1557326
Binary files /dev/null and b/GA-Schloss/bind/slave/db-8Xk2paMi differ
diff --git a/GA-Schloss/bind/slave/db-8hZAf2MS b/GA-Schloss/bind/slave/db-8hZAf2MS
new file mode 100644
index 0000000..c9f4e97
Binary files /dev/null and b/GA-Schloss/bind/slave/db-8hZAf2MS differ
diff --git a/GA-Schloss/bind/slave/db-8vl5oddV b/GA-Schloss/bind/slave/db-8vl5oddV
new file mode 100644
index 0000000..71cde71
Binary files /dev/null and b/GA-Schloss/bind/slave/db-8vl5oddV differ
diff --git a/GA-Schloss/bind/slave/db-90Ythzlu b/GA-Schloss/bind/slave/db-90Ythzlu
new file mode 100644
index 0000000..a874e5d
Binary files /dev/null and b/GA-Schloss/bind/slave/db-90Ythzlu differ
diff --git a/GA-Schloss/bind/slave/db-99qvwfur b/GA-Schloss/bind/slave/db-99qvwfur
new file mode 100644
index 0000000..b9c71ba
Binary files /dev/null and b/GA-Schloss/bind/slave/db-99qvwfur differ
diff --git a/GA-Schloss/bind/slave/db-9hOGtAML b/GA-Schloss/bind/slave/db-9hOGtAML
new file mode 100644
index 0000000..51211ef
Binary files /dev/null and b/GA-Schloss/bind/slave/db-9hOGtAML differ
diff --git a/GA-Schloss/bind/slave/db-9m1PHKss b/GA-Schloss/bind/slave/db-9m1PHKss
new file mode 100644
index 0000000..e6f08ba
Binary files /dev/null and b/GA-Schloss/bind/slave/db-9m1PHKss differ
diff --git a/GA-Schloss/bind/slave/db-9mBVZ6iR b/GA-Schloss/bind/slave/db-9mBVZ6iR
new file mode 100644
index 0000000..831cde5
Binary files /dev/null and b/GA-Schloss/bind/slave/db-9mBVZ6iR differ
diff --git a/GA-Schloss/bind/slave/db-9rgMjkqZ b/GA-Schloss/bind/slave/db-9rgMjkqZ
new file mode 100644
index 0000000..fa74461
Binary files /dev/null and b/GA-Schloss/bind/slave/db-9rgMjkqZ differ
diff --git a/GA-Schloss/bind/slave/db-9zC2jIaQ b/GA-Schloss/bind/slave/db-9zC2jIaQ
new file mode 100644
index 0000000..a7bac60
Binary files /dev/null and b/GA-Schloss/bind/slave/db-9zC2jIaQ differ
diff --git a/GA-Schloss/bind/slave/db-9zTJrfpO b/GA-Schloss/bind/slave/db-9zTJrfpO
new file mode 100644
index 0000000..42c2f15
Binary files /dev/null and b/GA-Schloss/bind/slave/db-9zTJrfpO differ
diff --git a/GA-Schloss/bind/slave/db-AS53pGoR b/GA-Schloss/bind/slave/db-AS53pGoR
new file mode 100644
index 0000000..f73d811
Binary files /dev/null and b/GA-Schloss/bind/slave/db-AS53pGoR differ
diff --git a/GA-Schloss/bind/slave/db-AdAFcyd0 b/GA-Schloss/bind/slave/db-AdAFcyd0
new file mode 100644
index 0000000..abc2bde
Binary files /dev/null and b/GA-Schloss/bind/slave/db-AdAFcyd0 differ
diff --git a/GA-Schloss/bind/slave/db-B6lBpYvA b/GA-Schloss/bind/slave/db-B6lBpYvA
new file mode 100644
index 0000000..446d19d
Binary files /dev/null and b/GA-Schloss/bind/slave/db-B6lBpYvA differ
diff --git a/GA-Schloss/bind/slave/db-BhoBgsXu b/GA-Schloss/bind/slave/db-BhoBgsXu
new file mode 100644
index 0000000..12d78c8
Binary files /dev/null and b/GA-Schloss/bind/slave/db-BhoBgsXu differ
diff --git a/GA-Schloss/bind/slave/db-Bi8id9qW b/GA-Schloss/bind/slave/db-Bi8id9qW
new file mode 100644
index 0000000..9795fd5
Binary files /dev/null and b/GA-Schloss/bind/slave/db-Bi8id9qW differ
diff --git a/GA-Schloss/bind/slave/db-CQ8e6uuv b/GA-Schloss/bind/slave/db-CQ8e6uuv
new file mode 100644
index 0000000..ce3963c
Binary files /dev/null and b/GA-Schloss/bind/slave/db-CQ8e6uuv differ
diff --git a/GA-Schloss/bind/slave/db-CVkP03G8 b/GA-Schloss/bind/slave/db-CVkP03G8
new file mode 100644
index 0000000..581d48c
Binary files /dev/null and b/GA-Schloss/bind/slave/db-CVkP03G8 differ
diff --git a/GA-Schloss/bind/slave/db-CYRYO9ll b/GA-Schloss/bind/slave/db-CYRYO9ll
new file mode 100644
index 0000000..3a8fa5e
Binary files /dev/null and b/GA-Schloss/bind/slave/db-CYRYO9ll differ
diff --git a/GA-Schloss/bind/slave/db-CbSld5NF b/GA-Schloss/bind/slave/db-CbSld5NF
new file mode 100644
index 0000000..50717b5
Binary files /dev/null and b/GA-Schloss/bind/slave/db-CbSld5NF differ
diff --git a/GA-Schloss/bind/slave/db-D5YRhz7u b/GA-Schloss/bind/slave/db-D5YRhz7u
new file mode 100644
index 0000000..39ed6eb
Binary files /dev/null and b/GA-Schloss/bind/slave/db-D5YRhz7u differ
diff --git a/GA-Schloss/bind/slave/db-DFsMmlrl b/GA-Schloss/bind/slave/db-DFsMmlrl
new file mode 100644
index 0000000..2f072b3
Binary files /dev/null and b/GA-Schloss/bind/slave/db-DFsMmlrl differ
diff --git a/GA-Schloss/bind/slave/db-DHXx7M0M b/GA-Schloss/bind/slave/db-DHXx7M0M
new file mode 100644
index 0000000..b019e1e
Binary files /dev/null and b/GA-Schloss/bind/slave/db-DHXx7M0M differ
diff --git a/GA-Schloss/bind/slave/db-E0FfF3ci b/GA-Schloss/bind/slave/db-E0FfF3ci
new file mode 100644
index 0000000..8f66612
Binary files /dev/null and b/GA-Schloss/bind/slave/db-E0FfF3ci differ
diff --git a/GA-Schloss/bind/slave/db-En2dd4Y8 b/GA-Schloss/bind/slave/db-En2dd4Y8
new file mode 100644
index 0000000..5dbb29c
Binary files /dev/null and b/GA-Schloss/bind/slave/db-En2dd4Y8 differ
diff --git a/GA-Schloss/bind/slave/db-EseqT9Ti b/GA-Schloss/bind/slave/db-EseqT9Ti
new file mode 100644
index 0000000..8679ae9
Binary files /dev/null and b/GA-Schloss/bind/slave/db-EseqT9Ti differ
diff --git a/GA-Schloss/bind/slave/db-F2SMiD7x b/GA-Schloss/bind/slave/db-F2SMiD7x
new file mode 100644
index 0000000..67c08f1
Binary files /dev/null and b/GA-Schloss/bind/slave/db-F2SMiD7x differ
diff --git a/GA-Schloss/bind/slave/db-GEh4qgks b/GA-Schloss/bind/slave/db-GEh4qgks
new file mode 100644
index 0000000..323be0b
Binary files /dev/null and b/GA-Schloss/bind/slave/db-GEh4qgks differ
diff --git a/GA-Schloss/bind/slave/db-GQTDZfYr b/GA-Schloss/bind/slave/db-GQTDZfYr
new file mode 100644
index 0000000..0f78285
Binary files /dev/null and b/GA-Schloss/bind/slave/db-GQTDZfYr differ
diff --git a/GA-Schloss/bind/slave/db-HIsXbFAh b/GA-Schloss/bind/slave/db-HIsXbFAh
new file mode 100644
index 0000000..4aca215
Binary files /dev/null and b/GA-Schloss/bind/slave/db-HIsXbFAh differ
diff --git a/GA-Schloss/bind/slave/db-HcSHsuwW b/GA-Schloss/bind/slave/db-HcSHsuwW
new file mode 100644
index 0000000..b4c9587
Binary files /dev/null and b/GA-Schloss/bind/slave/db-HcSHsuwW differ
diff --git a/GA-Schloss/bind/slave/db-HwTjEoww b/GA-Schloss/bind/slave/db-HwTjEoww
new file mode 100644
index 0000000..a3fef0e
Binary files /dev/null and b/GA-Schloss/bind/slave/db-HwTjEoww differ
diff --git a/GA-Schloss/bind/slave/db-I5jecEKt b/GA-Schloss/bind/slave/db-I5jecEKt
new file mode 100644
index 0000000..5bc109b
Binary files /dev/null and b/GA-Schloss/bind/slave/db-I5jecEKt differ
diff --git a/GA-Schloss/bind/slave/db-IEWbrXYd b/GA-Schloss/bind/slave/db-IEWbrXYd
new file mode 100644
index 0000000..6177838
Binary files /dev/null and b/GA-Schloss/bind/slave/db-IEWbrXYd differ
diff --git a/GA-Schloss/bind/slave/db-ISfDRIip b/GA-Schloss/bind/slave/db-ISfDRIip
new file mode 100644
index 0000000..3013c52
Binary files /dev/null and b/GA-Schloss/bind/slave/db-ISfDRIip differ
diff --git a/GA-Schloss/bind/slave/db-IWuxTb1P b/GA-Schloss/bind/slave/db-IWuxTb1P
new file mode 100644
index 0000000..9899ab0
Binary files /dev/null and b/GA-Schloss/bind/slave/db-IWuxTb1P differ
diff --git a/GA-Schloss/bind/slave/db-IZ1sSWYP b/GA-Schloss/bind/slave/db-IZ1sSWYP
new file mode 100644
index 0000000..b27e062
Binary files /dev/null and b/GA-Schloss/bind/slave/db-IZ1sSWYP differ
diff --git a/GA-Schloss/bind/slave/db-IfEEUyDy b/GA-Schloss/bind/slave/db-IfEEUyDy
new file mode 100644
index 0000000..877ec81
Binary files /dev/null and b/GA-Schloss/bind/slave/db-IfEEUyDy differ
diff --git a/GA-Schloss/bind/slave/db-IjHEXJLA b/GA-Schloss/bind/slave/db-IjHEXJLA
new file mode 100644
index 0000000..d990aa2
Binary files /dev/null and b/GA-Schloss/bind/slave/db-IjHEXJLA differ
diff --git a/GA-Schloss/bind/slave/db-IsxDYOUv b/GA-Schloss/bind/slave/db-IsxDYOUv
new file mode 100644
index 0000000..a1f02d2
Binary files /dev/null and b/GA-Schloss/bind/slave/db-IsxDYOUv differ
diff --git a/GA-Schloss/bind/slave/db-JAzbaQF2 b/GA-Schloss/bind/slave/db-JAzbaQF2
new file mode 100644
index 0000000..8053aea
Binary files /dev/null and b/GA-Schloss/bind/slave/db-JAzbaQF2 differ
diff --git a/GA-Schloss/bind/slave/db-JDhMeiJH b/GA-Schloss/bind/slave/db-JDhMeiJH
new file mode 100644
index 0000000..6d740bd
Binary files /dev/null and b/GA-Schloss/bind/slave/db-JDhMeiJH differ
diff --git a/GA-Schloss/bind/slave/db-JksGmu4b b/GA-Schloss/bind/slave/db-JksGmu4b
new file mode 100644
index 0000000..7cbf6ef
Binary files /dev/null and b/GA-Schloss/bind/slave/db-JksGmu4b differ
diff --git a/GA-Schloss/bind/slave/db-JutjEQ1w b/GA-Schloss/bind/slave/db-JutjEQ1w
new file mode 100644
index 0000000..9078bc8
Binary files /dev/null and b/GA-Schloss/bind/slave/db-JutjEQ1w differ
diff --git a/GA-Schloss/bind/slave/db-K9ZOFkm5 b/GA-Schloss/bind/slave/db-K9ZOFkm5
new file mode 100644
index 0000000..471fc97
Binary files /dev/null and b/GA-Schloss/bind/slave/db-K9ZOFkm5 differ
diff --git a/GA-Schloss/bind/slave/db-KCy6D1az b/GA-Schloss/bind/slave/db-KCy6D1az
new file mode 100644
index 0000000..71cc67f
Binary files /dev/null and b/GA-Schloss/bind/slave/db-KCy6D1az differ
diff --git a/GA-Schloss/bind/slave/db-KMVhw8lt b/GA-Schloss/bind/slave/db-KMVhw8lt
new file mode 100644
index 0000000..0fdd6d2
Binary files /dev/null and b/GA-Schloss/bind/slave/db-KMVhw8lt differ
diff --git a/GA-Schloss/bind/slave/db-KSYpMXO5 b/GA-Schloss/bind/slave/db-KSYpMXO5
new file mode 100644
index 0000000..bac4039
Binary files /dev/null and b/GA-Schloss/bind/slave/db-KSYpMXO5 differ
diff --git a/GA-Schloss/bind/slave/db-KWVb2WUb b/GA-Schloss/bind/slave/db-KWVb2WUb
new file mode 100644
index 0000000..8cc6511
Binary files /dev/null and b/GA-Schloss/bind/slave/db-KWVb2WUb differ
diff --git a/GA-Schloss/bind/slave/db-Ke2XvzQX b/GA-Schloss/bind/slave/db-Ke2XvzQX
new file mode 100644
index 0000000..0bf3c58
Binary files /dev/null and b/GA-Schloss/bind/slave/db-Ke2XvzQX differ
diff --git a/GA-Schloss/bind/slave/db-Klod9W9T b/GA-Schloss/bind/slave/db-Klod9W9T
new file mode 100644
index 0000000..993b27a
Binary files /dev/null and b/GA-Schloss/bind/slave/db-Klod9W9T differ
diff --git a/GA-Schloss/bind/slave/db-Kmw2Tl2D b/GA-Schloss/bind/slave/db-Kmw2Tl2D
new file mode 100644
index 0000000..a5dd2d6
Binary files /dev/null and b/GA-Schloss/bind/slave/db-Kmw2Tl2D differ
diff --git a/GA-Schloss/bind/slave/db-KqtMkxEc b/GA-Schloss/bind/slave/db-KqtMkxEc
new file mode 100644
index 0000000..f86453b
Binary files /dev/null and b/GA-Schloss/bind/slave/db-KqtMkxEc differ
diff --git a/GA-Schloss/bind/slave/db-KsQPqytZ b/GA-Schloss/bind/slave/db-KsQPqytZ
new file mode 100644
index 0000000..20080a4
Binary files /dev/null and b/GA-Schloss/bind/slave/db-KsQPqytZ differ
diff --git a/GA-Schloss/bind/slave/db-L0QhqkPe b/GA-Schloss/bind/slave/db-L0QhqkPe
new file mode 100644
index 0000000..c48413b
Binary files /dev/null and b/GA-Schloss/bind/slave/db-L0QhqkPe differ
diff --git a/GA-Schloss/bind/slave/db-LI9wgl3H b/GA-Schloss/bind/slave/db-LI9wgl3H
new file mode 100644
index 0000000..fb6482f
Binary files /dev/null and b/GA-Schloss/bind/slave/db-LI9wgl3H differ
diff --git a/GA-Schloss/bind/slave/db-LVyTOUxn b/GA-Schloss/bind/slave/db-LVyTOUxn
new file mode 100644
index 0000000..24d9bb4
Binary files /dev/null and b/GA-Schloss/bind/slave/db-LVyTOUxn differ
diff --git a/GA-Schloss/bind/slave/db-LZZapyzM b/GA-Schloss/bind/slave/db-LZZapyzM
new file mode 100644
index 0000000..8230af6
Binary files /dev/null and b/GA-Schloss/bind/slave/db-LZZapyzM differ
diff --git a/GA-Schloss/bind/slave/db-M6ZsDrGy b/GA-Schloss/bind/slave/db-M6ZsDrGy
new file mode 100644
index 0000000..07c8336
Binary files /dev/null and b/GA-Schloss/bind/slave/db-M6ZsDrGy differ
diff --git a/GA-Schloss/bind/slave/db-M8HmkjGY b/GA-Schloss/bind/slave/db-M8HmkjGY
new file mode 100644
index 0000000..5ae4031
Binary files /dev/null and b/GA-Schloss/bind/slave/db-M8HmkjGY differ
diff --git a/GA-Schloss/bind/slave/db-MIbR1Peu b/GA-Schloss/bind/slave/db-MIbR1Peu
new file mode 100644
index 0000000..e526df6
Binary files /dev/null and b/GA-Schloss/bind/slave/db-MIbR1Peu differ
diff --git a/GA-Schloss/bind/slave/db-MlQJnyen b/GA-Schloss/bind/slave/db-MlQJnyen
new file mode 100644
index 0000000..9d5821d
Binary files /dev/null and b/GA-Schloss/bind/slave/db-MlQJnyen differ
diff --git a/GA-Schloss/bind/slave/db-MzWeDdq7 b/GA-Schloss/bind/slave/db-MzWeDdq7
new file mode 100644
index 0000000..ba7279a
Binary files /dev/null and b/GA-Schloss/bind/slave/db-MzWeDdq7 differ
diff --git a/GA-Schloss/bind/slave/db-OjGxRz1s b/GA-Schloss/bind/slave/db-OjGxRz1s
new file mode 100644
index 0000000..7b84983
Binary files /dev/null and b/GA-Schloss/bind/slave/db-OjGxRz1s differ
diff --git a/GA-Schloss/bind/slave/db-PR1HxxwV b/GA-Schloss/bind/slave/db-PR1HxxwV
new file mode 100644
index 0000000..e54c559
Binary files /dev/null and b/GA-Schloss/bind/slave/db-PR1HxxwV differ
diff --git a/GA-Schloss/bind/slave/db-PZXfCOhw b/GA-Schloss/bind/slave/db-PZXfCOhw
new file mode 100644
index 0000000..0986aec
Binary files /dev/null and b/GA-Schloss/bind/slave/db-PZXfCOhw differ
diff --git a/GA-Schloss/bind/slave/db-PoUOBiwg b/GA-Schloss/bind/slave/db-PoUOBiwg
new file mode 100644
index 0000000..3cdc580
Binary files /dev/null and b/GA-Schloss/bind/slave/db-PoUOBiwg differ
diff --git a/GA-Schloss/bind/slave/db-Puqmw7Mk b/GA-Schloss/bind/slave/db-Puqmw7Mk
new file mode 100644
index 0000000..b779e1e
Binary files /dev/null and b/GA-Schloss/bind/slave/db-Puqmw7Mk differ
diff --git a/GA-Schloss/bind/slave/db-PywLA1lv b/GA-Schloss/bind/slave/db-PywLA1lv
new file mode 100644
index 0000000..7af8cc5
Binary files /dev/null and b/GA-Schloss/bind/slave/db-PywLA1lv differ
diff --git a/GA-Schloss/bind/slave/db-QU3izR2Y b/GA-Schloss/bind/slave/db-QU3izR2Y
new file mode 100644
index 0000000..0772bee
Binary files /dev/null and b/GA-Schloss/bind/slave/db-QU3izR2Y differ
diff --git a/GA-Schloss/bind/slave/db-QYijppha b/GA-Schloss/bind/slave/db-QYijppha
new file mode 100644
index 0000000..789d0d8
Binary files /dev/null and b/GA-Schloss/bind/slave/db-QYijppha differ
diff --git a/GA-Schloss/bind/slave/db-QqUQx79r b/GA-Schloss/bind/slave/db-QqUQx79r
new file mode 100644
index 0000000..3d46df3
Binary files /dev/null and b/GA-Schloss/bind/slave/db-QqUQx79r differ
diff --git a/GA-Schloss/bind/slave/db-RUjbEKW7 b/GA-Schloss/bind/slave/db-RUjbEKW7
new file mode 100644
index 0000000..0cfacdc
Binary files /dev/null and b/GA-Schloss/bind/slave/db-RUjbEKW7 differ
diff --git a/GA-Schloss/bind/slave/db-S0jCzXbk b/GA-Schloss/bind/slave/db-S0jCzXbk
new file mode 100644
index 0000000..2cc3a19
Binary files /dev/null and b/GA-Schloss/bind/slave/db-S0jCzXbk differ
diff --git a/GA-Schloss/bind/slave/db-SD61l0TK b/GA-Schloss/bind/slave/db-SD61l0TK
new file mode 100644
index 0000000..b33d4fa
Binary files /dev/null and b/GA-Schloss/bind/slave/db-SD61l0TK differ
diff --git a/GA-Schloss/bind/slave/db-SrN76Twx b/GA-Schloss/bind/slave/db-SrN76Twx
new file mode 100644
index 0000000..a215a79
Binary files /dev/null and b/GA-Schloss/bind/slave/db-SrN76Twx differ
diff --git a/GA-Schloss/bind/slave/db-T3OhjXdI b/GA-Schloss/bind/slave/db-T3OhjXdI
new file mode 100644
index 0000000..4199283
Binary files /dev/null and b/GA-Schloss/bind/slave/db-T3OhjXdI differ
diff --git a/GA-Schloss/bind/slave/db-TUNG5t55 b/GA-Schloss/bind/slave/db-TUNG5t55
new file mode 100644
index 0000000..71a8a65
Binary files /dev/null and b/GA-Schloss/bind/slave/db-TUNG5t55 differ
diff --git a/GA-Schloss/bind/slave/db-TmskCbvn b/GA-Schloss/bind/slave/db-TmskCbvn
new file mode 100644
index 0000000..cb7f5c9
Binary files /dev/null and b/GA-Schloss/bind/slave/db-TmskCbvn differ
diff --git a/GA-Schloss/bind/slave/db-TqmkvRON b/GA-Schloss/bind/slave/db-TqmkvRON
new file mode 100644
index 0000000..7a61569
Binary files /dev/null and b/GA-Schloss/bind/slave/db-TqmkvRON differ
diff --git a/GA-Schloss/bind/slave/db-UcDPbeMI b/GA-Schloss/bind/slave/db-UcDPbeMI
new file mode 100644
index 0000000..c23ff18
Binary files /dev/null and b/GA-Schloss/bind/slave/db-UcDPbeMI differ
diff --git a/GA-Schloss/bind/slave/db-UpxPRQEY b/GA-Schloss/bind/slave/db-UpxPRQEY
new file mode 100644
index 0000000..308c630
Binary files /dev/null and b/GA-Schloss/bind/slave/db-UpxPRQEY differ
diff --git a/GA-Schloss/bind/slave/db-Uv23zju5 b/GA-Schloss/bind/slave/db-Uv23zju5
new file mode 100644
index 0000000..308bb38
Binary files /dev/null and b/GA-Schloss/bind/slave/db-Uv23zju5 differ
diff --git a/GA-Schloss/bind/slave/db-V0PrT5Z8 b/GA-Schloss/bind/slave/db-V0PrT5Z8
new file mode 100644
index 0000000..06d2cb1
Binary files /dev/null and b/GA-Schloss/bind/slave/db-V0PrT5Z8 differ
diff --git a/GA-Schloss/bind/slave/db-V0gMpyfJ b/GA-Schloss/bind/slave/db-V0gMpyfJ
new file mode 100644
index 0000000..d7d571c
Binary files /dev/null and b/GA-Schloss/bind/slave/db-V0gMpyfJ differ
diff --git a/GA-Schloss/bind/slave/db-W09wid10 b/GA-Schloss/bind/slave/db-W09wid10
new file mode 100644
index 0000000..cc13a7e
Binary files /dev/null and b/GA-Schloss/bind/slave/db-W09wid10 differ
diff --git a/GA-Schloss/bind/slave/db-WrjghVez b/GA-Schloss/bind/slave/db-WrjghVez
new file mode 100644
index 0000000..311e8e6
Binary files /dev/null and b/GA-Schloss/bind/slave/db-WrjghVez differ
diff --git a/GA-Schloss/bind/slave/db-WzUbXDXW b/GA-Schloss/bind/slave/db-WzUbXDXW
new file mode 100644
index 0000000..cc46bf1
Binary files /dev/null and b/GA-Schloss/bind/slave/db-WzUbXDXW differ
diff --git a/GA-Schloss/bind/slave/db-X1OyAA4F b/GA-Schloss/bind/slave/db-X1OyAA4F
new file mode 100644
index 0000000..727c212
Binary files /dev/null and b/GA-Schloss/bind/slave/db-X1OyAA4F differ
diff --git a/GA-Schloss/bind/slave/db-X5b8S7gc b/GA-Schloss/bind/slave/db-X5b8S7gc
new file mode 100644
index 0000000..64bbd3b
Binary files /dev/null and b/GA-Schloss/bind/slave/db-X5b8S7gc differ
diff --git a/GA-Schloss/bind/slave/db-XOVQzcsW b/GA-Schloss/bind/slave/db-XOVQzcsW
new file mode 100644
index 0000000..5493476
Binary files /dev/null and b/GA-Schloss/bind/slave/db-XOVQzcsW differ
diff --git a/GA-Schloss/bind/slave/db-Xe6mC1Cc b/GA-Schloss/bind/slave/db-Xe6mC1Cc
new file mode 100644
index 0000000..50d5f55
Binary files /dev/null and b/GA-Schloss/bind/slave/db-Xe6mC1Cc differ
diff --git a/GA-Schloss/bind/slave/db-XfUWRNSm b/GA-Schloss/bind/slave/db-XfUWRNSm
new file mode 100644
index 0000000..a28e8f3
Binary files /dev/null and b/GA-Schloss/bind/slave/db-XfUWRNSm differ
diff --git a/GA-Schloss/bind/slave/db-Xy8ACDm1 b/GA-Schloss/bind/slave/db-Xy8ACDm1
new file mode 100644
index 0000000..9a92af1
Binary files /dev/null and b/GA-Schloss/bind/slave/db-Xy8ACDm1 differ
diff --git a/GA-Schloss/bind/slave/db-XyZAve1B b/GA-Schloss/bind/slave/db-XyZAve1B
new file mode 100644
index 0000000..5e01773
Binary files /dev/null and b/GA-Schloss/bind/slave/db-XyZAve1B differ
diff --git a/GA-Schloss/bind/slave/db-Y0Bta3hr b/GA-Schloss/bind/slave/db-Y0Bta3hr
new file mode 100644
index 0000000..c171b37
Binary files /dev/null and b/GA-Schloss/bind/slave/db-Y0Bta3hr differ
diff --git a/GA-Schloss/bind/slave/db-YoHgiKQw b/GA-Schloss/bind/slave/db-YoHgiKQw
new file mode 100644
index 0000000..431ffd7
Binary files /dev/null and b/GA-Schloss/bind/slave/db-YoHgiKQw differ
diff --git a/GA-Schloss/bind/slave/db-Z1uOn3ea b/GA-Schloss/bind/slave/db-Z1uOn3ea
new file mode 100644
index 0000000..52b2bf7
Binary files /dev/null and b/GA-Schloss/bind/slave/db-Z1uOn3ea differ
diff --git a/GA-Schloss/bind/slave/db-ZGw2ditn b/GA-Schloss/bind/slave/db-ZGw2ditn
new file mode 100644
index 0000000..4e4b28a
Binary files /dev/null and b/GA-Schloss/bind/slave/db-ZGw2ditn differ
diff --git a/GA-Schloss/bind/slave/db-a6Zzf7CV b/GA-Schloss/bind/slave/db-a6Zzf7CV
new file mode 100644
index 0000000..ab472e2
Binary files /dev/null and b/GA-Schloss/bind/slave/db-a6Zzf7CV differ
diff --git a/GA-Schloss/bind/slave/db-aAXlGZsn b/GA-Schloss/bind/slave/db-aAXlGZsn
new file mode 100644
index 0000000..6f55058
Binary files /dev/null and b/GA-Schloss/bind/slave/db-aAXlGZsn differ
diff --git a/GA-Schloss/bind/slave/db-aG1qvlzj b/GA-Schloss/bind/slave/db-aG1qvlzj
new file mode 100644
index 0000000..5339a8f
Binary files /dev/null and b/GA-Schloss/bind/slave/db-aG1qvlzj differ
diff --git a/GA-Schloss/bind/slave/db-aPhEsC9h b/GA-Schloss/bind/slave/db-aPhEsC9h
new file mode 100644
index 0000000..5e04303
Binary files /dev/null and b/GA-Schloss/bind/slave/db-aPhEsC9h differ
diff --git a/GA-Schloss/bind/slave/db-aXxEmnw5 b/GA-Schloss/bind/slave/db-aXxEmnw5
new file mode 100644
index 0000000..960fd0f
Binary files /dev/null and b/GA-Schloss/bind/slave/db-aXxEmnw5 differ
diff --git a/GA-Schloss/bind/slave/db-acsc78K7 b/GA-Schloss/bind/slave/db-acsc78K7
new file mode 100644
index 0000000..ec3b4e6
Binary files /dev/null and b/GA-Schloss/bind/slave/db-acsc78K7 differ
diff --git a/GA-Schloss/bind/slave/db-az91SGoX b/GA-Schloss/bind/slave/db-az91SGoX
new file mode 100644
index 0000000..f5f0276
Binary files /dev/null and b/GA-Schloss/bind/slave/db-az91SGoX differ
diff --git a/GA-Schloss/bind/slave/db-bAQzF9S7 b/GA-Schloss/bind/slave/db-bAQzF9S7
new file mode 100644
index 0000000..f6ae817
Binary files /dev/null and b/GA-Schloss/bind/slave/db-bAQzF9S7 differ
diff --git a/GA-Schloss/bind/slave/db-bJynheqY b/GA-Schloss/bind/slave/db-bJynheqY
new file mode 100644
index 0000000..c214803
Binary files /dev/null and b/GA-Schloss/bind/slave/db-bJynheqY differ
diff --git a/GA-Schloss/bind/slave/db-bP10FcwL b/GA-Schloss/bind/slave/db-bP10FcwL
new file mode 100644
index 0000000..d0c93dd
Binary files /dev/null and b/GA-Schloss/bind/slave/db-bP10FcwL differ
diff --git a/GA-Schloss/bind/slave/db-be5DlVfx b/GA-Schloss/bind/slave/db-be5DlVfx
new file mode 100644
index 0000000..6858f8b
Binary files /dev/null and b/GA-Schloss/bind/slave/db-be5DlVfx differ
diff --git a/GA-Schloss/bind/slave/db-c0ZKBsGZ b/GA-Schloss/bind/slave/db-c0ZKBsGZ
new file mode 100644
index 0000000..f10f96a
Binary files /dev/null and b/GA-Schloss/bind/slave/db-c0ZKBsGZ differ
diff --git a/GA-Schloss/bind/slave/db-cGWBq0mT b/GA-Schloss/bind/slave/db-cGWBq0mT
new file mode 100644
index 0000000..db50961
Binary files /dev/null and b/GA-Schloss/bind/slave/db-cGWBq0mT differ
diff --git a/GA-Schloss/bind/slave/db-cPWAVsH9 b/GA-Schloss/bind/slave/db-cPWAVsH9
new file mode 100644
index 0000000..dc863f0
Binary files /dev/null and b/GA-Schloss/bind/slave/db-cPWAVsH9 differ
diff --git a/GA-Schloss/bind/slave/db-cjhh4VFc b/GA-Schloss/bind/slave/db-cjhh4VFc
new file mode 100644
index 0000000..0b9377a
Binary files /dev/null and b/GA-Schloss/bind/slave/db-cjhh4VFc differ
diff --git a/GA-Schloss/bind/slave/db-cpUSnJus b/GA-Schloss/bind/slave/db-cpUSnJus
new file mode 100644
index 0000000..0af9c3c
Binary files /dev/null and b/GA-Schloss/bind/slave/db-cpUSnJus differ
diff --git a/GA-Schloss/bind/slave/db-cs8tAj42 b/GA-Schloss/bind/slave/db-cs8tAj42
new file mode 100644
index 0000000..4a63e9b
Binary files /dev/null and b/GA-Schloss/bind/slave/db-cs8tAj42 differ
diff --git a/GA-Schloss/bind/slave/db-dJEozorZ b/GA-Schloss/bind/slave/db-dJEozorZ
new file mode 100644
index 0000000..52082e3
Binary files /dev/null and b/GA-Schloss/bind/slave/db-dJEozorZ differ
diff --git a/GA-Schloss/bind/slave/db-dXCQR4nB b/GA-Schloss/bind/slave/db-dXCQR4nB
new file mode 100644
index 0000000..9e48ba4
Binary files /dev/null and b/GA-Schloss/bind/slave/db-dXCQR4nB differ
diff --git a/GA-Schloss/bind/slave/db-dz6zi9QQ b/GA-Schloss/bind/slave/db-dz6zi9QQ
new file mode 100644
index 0000000..28fc4f6
Binary files /dev/null and b/GA-Schloss/bind/slave/db-dz6zi9QQ differ
diff --git a/GA-Schloss/bind/slave/db-dzxtplHx b/GA-Schloss/bind/slave/db-dzxtplHx
new file mode 100644
index 0000000..5d7298b
Binary files /dev/null and b/GA-Schloss/bind/slave/db-dzxtplHx differ
diff --git a/GA-Schloss/bind/slave/db-e5m42nas b/GA-Schloss/bind/slave/db-e5m42nas
new file mode 100644
index 0000000..dbf5354
Binary files /dev/null and b/GA-Schloss/bind/slave/db-e5m42nas differ
diff --git a/GA-Schloss/bind/slave/db-e5qprA5G b/GA-Schloss/bind/slave/db-e5qprA5G
new file mode 100644
index 0000000..bfc3ffb
Binary files /dev/null and b/GA-Schloss/bind/slave/db-e5qprA5G differ
diff --git a/GA-Schloss/bind/slave/db-e6au0K58 b/GA-Schloss/bind/slave/db-e6au0K58
new file mode 100644
index 0000000..ecd75d2
Binary files /dev/null and b/GA-Schloss/bind/slave/db-e6au0K58 differ
diff --git a/GA-Schloss/bind/slave/db-eNlEIENv b/GA-Schloss/bind/slave/db-eNlEIENv
new file mode 100644
index 0000000..911df90
Binary files /dev/null and b/GA-Schloss/bind/slave/db-eNlEIENv differ
diff --git a/GA-Schloss/bind/slave/db-er1JCGlG b/GA-Schloss/bind/slave/db-er1JCGlG
new file mode 100644
index 0000000..d57733f
Binary files /dev/null and b/GA-Schloss/bind/slave/db-er1JCGlG differ
diff --git a/GA-Schloss/bind/slave/db-f1XxHxAN b/GA-Schloss/bind/slave/db-f1XxHxAN
new file mode 100644
index 0000000..3341513
Binary files /dev/null and b/GA-Schloss/bind/slave/db-f1XxHxAN differ
diff --git a/GA-Schloss/bind/slave/db-fPT7QQCJ b/GA-Schloss/bind/slave/db-fPT7QQCJ
new file mode 100644
index 0000000..375085b
Binary files /dev/null and b/GA-Schloss/bind/slave/db-fPT7QQCJ differ
diff --git a/GA-Schloss/bind/slave/db-fnbXZeOQ b/GA-Schloss/bind/slave/db-fnbXZeOQ
new file mode 100644
index 0000000..7dc09c5
Binary files /dev/null and b/GA-Schloss/bind/slave/db-fnbXZeOQ differ
diff --git a/GA-Schloss/bind/slave/db-g8oFLFSz b/GA-Schloss/bind/slave/db-g8oFLFSz
new file mode 100644
index 0000000..019a817
Binary files /dev/null and b/GA-Schloss/bind/slave/db-g8oFLFSz differ
diff --git a/GA-Schloss/bind/slave/db-gCclXOk5 b/GA-Schloss/bind/slave/db-gCclXOk5
new file mode 100644
index 0000000..9c21fde
Binary files /dev/null and b/GA-Schloss/bind/slave/db-gCclXOk5 differ
diff --git a/GA-Schloss/bind/slave/db-gHlL6SGv b/GA-Schloss/bind/slave/db-gHlL6SGv
new file mode 100644
index 0000000..6f3e7b1
Binary files /dev/null and b/GA-Schloss/bind/slave/db-gHlL6SGv differ
diff --git a/GA-Schloss/bind/slave/db-hOAeja3k b/GA-Schloss/bind/slave/db-hOAeja3k
new file mode 100644
index 0000000..80c9172
Binary files /dev/null and b/GA-Schloss/bind/slave/db-hOAeja3k differ
diff --git a/GA-Schloss/bind/slave/db-hUsgVwJ5 b/GA-Schloss/bind/slave/db-hUsgVwJ5
new file mode 100644
index 0000000..ac990f0
Binary files /dev/null and b/GA-Schloss/bind/slave/db-hUsgVwJ5 differ
diff --git a/GA-Schloss/bind/slave/db-hVGv0zHo b/GA-Schloss/bind/slave/db-hVGv0zHo
new file mode 100644
index 0000000..6d811eb
Binary files /dev/null and b/GA-Schloss/bind/slave/db-hVGv0zHo differ
diff --git a/GA-Schloss/bind/slave/db-heQqRWEQ b/GA-Schloss/bind/slave/db-heQqRWEQ
new file mode 100644
index 0000000..0465d66
Binary files /dev/null and b/GA-Schloss/bind/slave/db-heQqRWEQ differ
diff --git a/GA-Schloss/bind/slave/db-hi2rR3rK b/GA-Schloss/bind/slave/db-hi2rR3rK
new file mode 100644
index 0000000..e84c8e0
Binary files /dev/null and b/GA-Schloss/bind/slave/db-hi2rR3rK differ
diff --git a/GA-Schloss/bind/slave/db-i1ff0DlN b/GA-Schloss/bind/slave/db-i1ff0DlN
new file mode 100644
index 0000000..0c260dc
Binary files /dev/null and b/GA-Schloss/bind/slave/db-i1ff0DlN differ
diff --git a/GA-Schloss/bind/slave/db-iW0XqihG b/GA-Schloss/bind/slave/db-iW0XqihG
new file mode 100644
index 0000000..0cba284
Binary files /dev/null and b/GA-Schloss/bind/slave/db-iW0XqihG differ
diff --git a/GA-Schloss/bind/slave/db-inzO1uH0 b/GA-Schloss/bind/slave/db-inzO1uH0
new file mode 100644
index 0000000..57f9e12
Binary files /dev/null and b/GA-Schloss/bind/slave/db-inzO1uH0 differ
diff --git a/GA-Schloss/bind/slave/db-ityzoTUE b/GA-Schloss/bind/slave/db-ityzoTUE
new file mode 100644
index 0000000..4f1aca5
Binary files /dev/null and b/GA-Schloss/bind/slave/db-ityzoTUE differ
diff --git a/GA-Schloss/bind/slave/db-iu0KDxhq b/GA-Schloss/bind/slave/db-iu0KDxhq
new file mode 100644
index 0000000..c2c98c5
Binary files /dev/null and b/GA-Schloss/bind/slave/db-iu0KDxhq differ
diff --git a/GA-Schloss/bind/slave/db-jNe2KfKd b/GA-Schloss/bind/slave/db-jNe2KfKd
new file mode 100644
index 0000000..6eff3cf
Binary files /dev/null and b/GA-Schloss/bind/slave/db-jNe2KfKd differ
diff --git a/GA-Schloss/bind/slave/db-jnDoLm45 b/GA-Schloss/bind/slave/db-jnDoLm45
new file mode 100644
index 0000000..d1b0435
Binary files /dev/null and b/GA-Schloss/bind/slave/db-jnDoLm45 differ
diff --git a/GA-Schloss/bind/slave/db-kQVbIDzo b/GA-Schloss/bind/slave/db-kQVbIDzo
new file mode 100644
index 0000000..e71ca41
Binary files /dev/null and b/GA-Schloss/bind/slave/db-kQVbIDzo differ
diff --git a/GA-Schloss/bind/slave/db-kUVA5TxC b/GA-Schloss/bind/slave/db-kUVA5TxC
new file mode 100644
index 0000000..acea34f
Binary files /dev/null and b/GA-Schloss/bind/slave/db-kUVA5TxC differ
diff --git a/GA-Schloss/bind/slave/db-kzV08WOA b/GA-Schloss/bind/slave/db-kzV08WOA
new file mode 100644
index 0000000..753e373
Binary files /dev/null and b/GA-Schloss/bind/slave/db-kzV08WOA differ
diff --git a/GA-Schloss/bind/slave/db-lKOEh0ek b/GA-Schloss/bind/slave/db-lKOEh0ek
new file mode 100644
index 0000000..183421e
Binary files /dev/null and b/GA-Schloss/bind/slave/db-lKOEh0ek differ
diff --git a/GA-Schloss/bind/slave/db-lhvHSOVE b/GA-Schloss/bind/slave/db-lhvHSOVE
new file mode 100644
index 0000000..3ab2ece
Binary files /dev/null and b/GA-Schloss/bind/slave/db-lhvHSOVE differ
diff --git a/GA-Schloss/bind/slave/db-lsCarCcA b/GA-Schloss/bind/slave/db-lsCarCcA
new file mode 100644
index 0000000..d2e0d42
Binary files /dev/null and b/GA-Schloss/bind/slave/db-lsCarCcA differ
diff --git a/GA-Schloss/bind/slave/db-m52nG5Yd b/GA-Schloss/bind/slave/db-m52nG5Yd
new file mode 100644
index 0000000..8aed517
Binary files /dev/null and b/GA-Schloss/bind/slave/db-m52nG5Yd differ
diff --git a/GA-Schloss/bind/slave/db-mK75fcZr b/GA-Schloss/bind/slave/db-mK75fcZr
new file mode 100644
index 0000000..fe0cc00
Binary files /dev/null and b/GA-Schloss/bind/slave/db-mK75fcZr differ
diff --git a/GA-Schloss/bind/slave/db-mSgSJazF b/GA-Schloss/bind/slave/db-mSgSJazF
new file mode 100644
index 0000000..83b51c0
Binary files /dev/null and b/GA-Schloss/bind/slave/db-mSgSJazF differ
diff --git a/GA-Schloss/bind/slave/db-mg1VwYzG b/GA-Schloss/bind/slave/db-mg1VwYzG
new file mode 100644
index 0000000..c5c1512
Binary files /dev/null and b/GA-Schloss/bind/slave/db-mg1VwYzG differ
diff --git a/GA-Schloss/bind/slave/db-mx1jyrcL b/GA-Schloss/bind/slave/db-mx1jyrcL
new file mode 100644
index 0000000..383d854
Binary files /dev/null and b/GA-Schloss/bind/slave/db-mx1jyrcL differ
diff --git a/GA-Schloss/bind/slave/db-nDlXAK14 b/GA-Schloss/bind/slave/db-nDlXAK14
new file mode 100644
index 0000000..4d67234
Binary files /dev/null and b/GA-Schloss/bind/slave/db-nDlXAK14 differ
diff --git a/GA-Schloss/bind/slave/db-nThY5pRa b/GA-Schloss/bind/slave/db-nThY5pRa
new file mode 100644
index 0000000..8a7b44b
Binary files /dev/null and b/GA-Schloss/bind/slave/db-nThY5pRa differ
diff --git a/GA-Schloss/bind/slave/db-neVccKuJ b/GA-Schloss/bind/slave/db-neVccKuJ
new file mode 100644
index 0000000..e7d8d68
Binary files /dev/null and b/GA-Schloss/bind/slave/db-neVccKuJ differ
diff --git a/GA-Schloss/bind/slave/db-njAfJnTZ b/GA-Schloss/bind/slave/db-njAfJnTZ
new file mode 100644
index 0000000..c342cb1
Binary files /dev/null and b/GA-Schloss/bind/slave/db-njAfJnTZ differ
diff --git a/GA-Schloss/bind/slave/db-nkSZmJV6 b/GA-Schloss/bind/slave/db-nkSZmJV6
new file mode 100644
index 0000000..6fd9eee
Binary files /dev/null and b/GA-Schloss/bind/slave/db-nkSZmJV6 differ
diff --git a/GA-Schloss/bind/slave/db-nsTd8dI6 b/GA-Schloss/bind/slave/db-nsTd8dI6
new file mode 100644
index 0000000..ec9c8f3
Binary files /dev/null and b/GA-Schloss/bind/slave/db-nsTd8dI6 differ
diff --git a/GA-Schloss/bind/slave/db-nyI4brq8 b/GA-Schloss/bind/slave/db-nyI4brq8
new file mode 100644
index 0000000..06a17fe
Binary files /dev/null and b/GA-Schloss/bind/slave/db-nyI4brq8 differ
diff --git a/GA-Schloss/bind/slave/db-oAli8uIQ b/GA-Schloss/bind/slave/db-oAli8uIQ
new file mode 100644
index 0000000..d435bae
Binary files /dev/null and b/GA-Schloss/bind/slave/db-oAli8uIQ differ
diff --git a/GA-Schloss/bind/slave/db-p2XoxYOZ b/GA-Schloss/bind/slave/db-p2XoxYOZ
new file mode 100644
index 0000000..7d70e16
Binary files /dev/null and b/GA-Schloss/bind/slave/db-p2XoxYOZ differ
diff --git a/GA-Schloss/bind/slave/db-p45aWpYy b/GA-Schloss/bind/slave/db-p45aWpYy
new file mode 100644
index 0000000..2caf971
Binary files /dev/null and b/GA-Schloss/bind/slave/db-p45aWpYy differ
diff --git a/GA-Schloss/bind/slave/db-p4KVOtrk b/GA-Schloss/bind/slave/db-p4KVOtrk
new file mode 100644
index 0000000..3805974
Binary files /dev/null and b/GA-Schloss/bind/slave/db-p4KVOtrk differ
diff --git a/GA-Schloss/bind/slave/db-p5OY7bsJ b/GA-Schloss/bind/slave/db-p5OY7bsJ
new file mode 100644
index 0000000..b2e2235
Binary files /dev/null and b/GA-Schloss/bind/slave/db-p5OY7bsJ differ
diff --git a/GA-Schloss/bind/slave/db-pBpwYeJI b/GA-Schloss/bind/slave/db-pBpwYeJI
new file mode 100644
index 0000000..371e4b2
Binary files /dev/null and b/GA-Schloss/bind/slave/db-pBpwYeJI differ
diff --git a/GA-Schloss/bind/slave/db-pLZk0V1h b/GA-Schloss/bind/slave/db-pLZk0V1h
new file mode 100644
index 0000000..35b8a92
Binary files /dev/null and b/GA-Schloss/bind/slave/db-pLZk0V1h differ
diff --git a/GA-Schloss/bind/slave/db-pvmeuum9 b/GA-Schloss/bind/slave/db-pvmeuum9
new file mode 100644
index 0000000..2399295
Binary files /dev/null and b/GA-Schloss/bind/slave/db-pvmeuum9 differ
diff --git a/GA-Schloss/bind/slave/db-qnW8QfVm b/GA-Schloss/bind/slave/db-qnW8QfVm
new file mode 100644
index 0000000..52641e9
Binary files /dev/null and b/GA-Schloss/bind/slave/db-qnW8QfVm differ
diff --git a/GA-Schloss/bind/slave/db-r5FdV8Zu b/GA-Schloss/bind/slave/db-r5FdV8Zu
new file mode 100644
index 0000000..581e3c4
Binary files /dev/null and b/GA-Schloss/bind/slave/db-r5FdV8Zu differ
diff --git a/GA-Schloss/bind/slave/db-rRppZNYm b/GA-Schloss/bind/slave/db-rRppZNYm
new file mode 100644
index 0000000..a418b6b
Binary files /dev/null and b/GA-Schloss/bind/slave/db-rRppZNYm differ
diff --git a/GA-Schloss/bind/slave/db-rY90h3Qi b/GA-Schloss/bind/slave/db-rY90h3Qi
new file mode 100644
index 0000000..b54d13c
Binary files /dev/null and b/GA-Schloss/bind/slave/db-rY90h3Qi differ
diff --git a/GA-Schloss/bind/slave/db-rtFPDU2I b/GA-Schloss/bind/slave/db-rtFPDU2I
new file mode 100644
index 0000000..c8f3326
Binary files /dev/null and b/GA-Schloss/bind/slave/db-rtFPDU2I differ
diff --git a/GA-Schloss/bind/slave/db-smAohm7B b/GA-Schloss/bind/slave/db-smAohm7B
new file mode 100644
index 0000000..173a203
Binary files /dev/null and b/GA-Schloss/bind/slave/db-smAohm7B differ
diff --git a/GA-Schloss/bind/slave/db-sxMiXI1T b/GA-Schloss/bind/slave/db-sxMiXI1T
new file mode 100644
index 0000000..0e5dc46
Binary files /dev/null and b/GA-Schloss/bind/slave/db-sxMiXI1T differ
diff --git a/GA-Schloss/bind/slave/db-szMo4IQH b/GA-Schloss/bind/slave/db-szMo4IQH
new file mode 100644
index 0000000..5397d62
Binary files /dev/null and b/GA-Schloss/bind/slave/db-szMo4IQH differ
diff --git a/GA-Schloss/bind/slave/db-teE0MA0C b/GA-Schloss/bind/slave/db-teE0MA0C
new file mode 100644
index 0000000..f03e8b6
Binary files /dev/null and b/GA-Schloss/bind/slave/db-teE0MA0C differ
diff --git a/GA-Schloss/bind/slave/db-thrBU5W4 b/GA-Schloss/bind/slave/db-thrBU5W4
new file mode 100644
index 0000000..b753b5a
Binary files /dev/null and b/GA-Schloss/bind/slave/db-thrBU5W4 differ
diff --git a/GA-Schloss/bind/slave/db-tpNqQLzz b/GA-Schloss/bind/slave/db-tpNqQLzz
new file mode 100644
index 0000000..5ee848b
Binary files /dev/null and b/GA-Schloss/bind/slave/db-tpNqQLzz differ
diff --git a/GA-Schloss/bind/slave/db-uKbCHCsQ b/GA-Schloss/bind/slave/db-uKbCHCsQ
new file mode 100644
index 0000000..3a5e91e
Binary files /dev/null and b/GA-Schloss/bind/slave/db-uKbCHCsQ differ
diff --git a/GA-Schloss/bind/slave/db-uSk7KcSZ b/GA-Schloss/bind/slave/db-uSk7KcSZ
new file mode 100644
index 0000000..a4ff9b1
Binary files /dev/null and b/GA-Schloss/bind/slave/db-uSk7KcSZ differ
diff --git a/GA-Schloss/bind/slave/db-vlrLdwQn b/GA-Schloss/bind/slave/db-vlrLdwQn
new file mode 100644
index 0000000..089d27f
Binary files /dev/null and b/GA-Schloss/bind/slave/db-vlrLdwQn differ
diff --git a/GA-Schloss/bind/slave/db-vsRTIfnX b/GA-Schloss/bind/slave/db-vsRTIfnX
new file mode 100644
index 0000000..74bc785
Binary files /dev/null and b/GA-Schloss/bind/slave/db-vsRTIfnX differ
diff --git a/GA-Schloss/bind/slave/db-wCzNt4Bu b/GA-Schloss/bind/slave/db-wCzNt4Bu
new file mode 100644
index 0000000..f70f33c
Binary files /dev/null and b/GA-Schloss/bind/slave/db-wCzNt4Bu differ
diff --git a/GA-Schloss/bind/slave/db-wPA81k5F b/GA-Schloss/bind/slave/db-wPA81k5F
new file mode 100644
index 0000000..656ce8e
Binary files /dev/null and b/GA-Schloss/bind/slave/db-wPA81k5F differ
diff --git a/GA-Schloss/bind/slave/db-wp1LZUTK b/GA-Schloss/bind/slave/db-wp1LZUTK
new file mode 100644
index 0000000..93240b8
Binary files /dev/null and b/GA-Schloss/bind/slave/db-wp1LZUTK differ
diff --git a/GA-Schloss/bind/slave/db-xvLgdNiJ b/GA-Schloss/bind/slave/db-xvLgdNiJ
new file mode 100644
index 0000000..c7d8f4f
Binary files /dev/null and b/GA-Schloss/bind/slave/db-xvLgdNiJ differ
diff --git a/GA-Schloss/bind/slave/db-xzGmMc2K b/GA-Schloss/bind/slave/db-xzGmMc2K
new file mode 100644
index 0000000..7f790be
Binary files /dev/null and b/GA-Schloss/bind/slave/db-xzGmMc2K differ
diff --git a/GA-Schloss/bind/slave/db-y032JxTs b/GA-Schloss/bind/slave/db-y032JxTs
new file mode 100644
index 0000000..452494c
Binary files /dev/null and b/GA-Schloss/bind/slave/db-y032JxTs differ
diff --git a/GA-Schloss/bind/slave/db-yUVngucj b/GA-Schloss/bind/slave/db-yUVngucj
new file mode 100644
index 0000000..0faa8b5
Binary files /dev/null and b/GA-Schloss/bind/slave/db-yUVngucj differ
diff --git a/GA-Schloss/bind/slave/db-yqKB0Wxi b/GA-Schloss/bind/slave/db-yqKB0Wxi
new file mode 100644
index 0000000..9dcf48f
Binary files /dev/null and b/GA-Schloss/bind/slave/db-yqKB0Wxi differ
diff --git a/GA-Schloss/bind/slave/db-z2Gbs0Xm b/GA-Schloss/bind/slave/db-z2Gbs0Xm
new file mode 100644
index 0000000..822b6a4
Binary files /dev/null and b/GA-Schloss/bind/slave/db-z2Gbs0Xm differ
diff --git a/GA-Schloss/bind/slave/db-z4iXaqjf b/GA-Schloss/bind/slave/db-z4iXaqjf
new file mode 100644
index 0000000..dfee557
Binary files /dev/null and b/GA-Schloss/bind/slave/db-z4iXaqjf differ
diff --git a/GA-Schloss/bind/slave/db-zy3pocY5 b/GA-Schloss/bind/slave/db-zy3pocY5
new file mode 100644
index 0000000..3d0623e
Binary files /dev/null and b/GA-Schloss/bind/slave/db-zy3pocY5 differ
diff --git a/GA-Schloss/bind/slave/db.10.168.192.in-addr.arpa b/GA-Schloss/bind/slave/db.10.168.192.in-addr.arpa
new file mode 100644
index 0000000..fc3077b
Binary files /dev/null and b/GA-Schloss/bind/slave/db.10.168.192.in-addr.arpa differ
diff --git a/GA-Schloss/bind/slave/db.10.168.192.in-addr.arpa.jnl b/GA-Schloss/bind/slave/db.10.168.192.in-addr.arpa.jnl
new file mode 100644
index 0000000..8087faf
Binary files /dev/null and b/GA-Schloss/bind/slave/db.10.168.192.in-addr.arpa.jnl differ
diff --git a/GA-Schloss/bind/slave/db.11.168.192.in-addr.arpa b/GA-Schloss/bind/slave/db.11.168.192.in-addr.arpa
new file mode 100644
index 0000000..bd6fe18
Binary files /dev/null and b/GA-Schloss/bind/slave/db.11.168.192.in-addr.arpa differ
diff --git a/GA-Schloss/bind/slave/db.11.168.192.in-addr.arpa.jnl b/GA-Schloss/bind/slave/db.11.168.192.in-addr.arpa.jnl
new file mode 100644
index 0000000..c5120d4
Binary files /dev/null and b/GA-Schloss/bind/slave/db.11.168.192.in-addr.arpa.jnl differ
diff --git a/GA-Schloss/bind/slave/ga.intra.zone b/GA-Schloss/bind/slave/ga.intra.zone
new file mode 100644
index 0000000..fc63b6e
Binary files /dev/null and b/GA-Schloss/bind/slave/ga.intra.zone differ
diff --git a/GA-Schloss/bind/slave/ga.intra.zone.jnl b/GA-Schloss/bind/slave/ga.intra.zone.jnl
new file mode 100644
index 0000000..cdde09d
Binary files /dev/null and b/GA-Schloss/bind/slave/ga.intra.zone.jnl differ
diff --git a/GA-Schloss/bind/slave/jn-0lkLceUs b/GA-Schloss/bind/slave/jn-0lkLceUs
new file mode 100644
index 0000000..f75529a
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-0lkLceUs differ
diff --git a/GA-Schloss/bind/slave/jn-17PoOFK2 b/GA-Schloss/bind/slave/jn-17PoOFK2
new file mode 100644
index 0000000..2aead0e
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-17PoOFK2 differ
diff --git a/GA-Schloss/bind/slave/jn-1VktiN6k b/GA-Schloss/bind/slave/jn-1VktiN6k
new file mode 100644
index 0000000..e5ac6db
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-1VktiN6k differ
diff --git a/GA-Schloss/bind/slave/jn-1aRDOeLk b/GA-Schloss/bind/slave/jn-1aRDOeLk
new file mode 100644
index 0000000..98ed4c2
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-1aRDOeLk differ
diff --git a/GA-Schloss/bind/slave/jn-1ij365o4 b/GA-Schloss/bind/slave/jn-1ij365o4
new file mode 100644
index 0000000..89f700b
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-1ij365o4 differ
diff --git a/GA-Schloss/bind/slave/jn-27Mnw757 b/GA-Schloss/bind/slave/jn-27Mnw757
new file mode 100644
index 0000000..7ef3925
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-27Mnw757 differ
diff --git a/GA-Schloss/bind/slave/jn-2M8Cn9GX b/GA-Schloss/bind/slave/jn-2M8Cn9GX
new file mode 100644
index 0000000..788cef1
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-2M8Cn9GX differ
diff --git a/GA-Schloss/bind/slave/jn-2QQIwjuQ b/GA-Schloss/bind/slave/jn-2QQIwjuQ
new file mode 100644
index 0000000..07186b8
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-2QQIwjuQ differ
diff --git a/GA-Schloss/bind/slave/jn-2qpNBFQ1 b/GA-Schloss/bind/slave/jn-2qpNBFQ1
new file mode 100644
index 0000000..9c24359
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-2qpNBFQ1 differ
diff --git a/GA-Schloss/bind/slave/jn-2umZ8yKa b/GA-Schloss/bind/slave/jn-2umZ8yKa
new file mode 100644
index 0000000..6e1f6e1
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-2umZ8yKa differ
diff --git a/GA-Schloss/bind/slave/jn-3cnp33Ur b/GA-Schloss/bind/slave/jn-3cnp33Ur
new file mode 100644
index 0000000..499651b
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-3cnp33Ur differ
diff --git a/GA-Schloss/bind/slave/jn-3g0DDoPx b/GA-Schloss/bind/slave/jn-3g0DDoPx
new file mode 100644
index 0000000..bf2beee
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-3g0DDoPx differ
diff --git a/GA-Schloss/bind/slave/jn-3wmJpl2g b/GA-Schloss/bind/slave/jn-3wmJpl2g
new file mode 100644
index 0000000..60cbbed
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-3wmJpl2g differ
diff --git a/GA-Schloss/bind/slave/jn-42MdAbeE b/GA-Schloss/bind/slave/jn-42MdAbeE
new file mode 100644
index 0000000..51bfefb
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-42MdAbeE differ
diff --git a/GA-Schloss/bind/slave/jn-4RlmRNnM b/GA-Schloss/bind/slave/jn-4RlmRNnM
new file mode 100644
index 0000000..85536a5
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-4RlmRNnM differ
diff --git a/GA-Schloss/bind/slave/jn-4Z52rT1J b/GA-Schloss/bind/slave/jn-4Z52rT1J
new file mode 100644
index 0000000..c813007
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-4Z52rT1J differ
diff --git a/GA-Schloss/bind/slave/jn-4t4bhZCW b/GA-Schloss/bind/slave/jn-4t4bhZCW
new file mode 100644
index 0000000..cd78ea2
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-4t4bhZCW differ
diff --git a/GA-Schloss/bind/slave/jn-4zhocYUa b/GA-Schloss/bind/slave/jn-4zhocYUa
new file mode 100644
index 0000000..c9677a5
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-4zhocYUa differ
diff --git a/GA-Schloss/bind/slave/jn-53BLsS4Z b/GA-Schloss/bind/slave/jn-53BLsS4Z
new file mode 100644
index 0000000..21af7b9
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-53BLsS4Z differ
diff --git a/GA-Schloss/bind/slave/jn-548Tfilb b/GA-Schloss/bind/slave/jn-548Tfilb
new file mode 100644
index 0000000..03d6248
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-548Tfilb differ
diff --git a/GA-Schloss/bind/slave/jn-5BvAqH01 b/GA-Schloss/bind/slave/jn-5BvAqH01
new file mode 100644
index 0000000..cc7e713
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-5BvAqH01 differ
diff --git a/GA-Schloss/bind/slave/jn-5RBWqO8Q b/GA-Schloss/bind/slave/jn-5RBWqO8Q
new file mode 100644
index 0000000..91ea775
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-5RBWqO8Q differ
diff --git a/GA-Schloss/bind/slave/jn-5kQYqIWS b/GA-Schloss/bind/slave/jn-5kQYqIWS
new file mode 100644
index 0000000..dacff20
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-5kQYqIWS differ
diff --git a/GA-Schloss/bind/slave/jn-6Fsbn2rs b/GA-Schloss/bind/slave/jn-6Fsbn2rs
new file mode 100644
index 0000000..d2eddc2
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-6Fsbn2rs differ
diff --git a/GA-Schloss/bind/slave/jn-6IZUPTKd b/GA-Schloss/bind/slave/jn-6IZUPTKd
new file mode 100644
index 0000000..c00e8c7
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-6IZUPTKd differ
diff --git a/GA-Schloss/bind/slave/jn-6ruI2ONv b/GA-Schloss/bind/slave/jn-6ruI2ONv
new file mode 100644
index 0000000..3ae2c28
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-6ruI2ONv differ
diff --git a/GA-Schloss/bind/slave/jn-7RppE9aQ b/GA-Schloss/bind/slave/jn-7RppE9aQ
new file mode 100644
index 0000000..daf79c8
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-7RppE9aQ differ
diff --git a/GA-Schloss/bind/slave/jn-7WQLG9hw b/GA-Schloss/bind/slave/jn-7WQLG9hw
new file mode 100644
index 0000000..09707e1
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-7WQLG9hw differ
diff --git a/GA-Schloss/bind/slave/jn-8LBZBUPj b/GA-Schloss/bind/slave/jn-8LBZBUPj
new file mode 100644
index 0000000..549ba95
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-8LBZBUPj differ
diff --git a/GA-Schloss/bind/slave/jn-8cnnNO6d b/GA-Schloss/bind/slave/jn-8cnnNO6d
new file mode 100644
index 0000000..6819375
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-8cnnNO6d differ
diff --git a/GA-Schloss/bind/slave/jn-8hXnHMEP b/GA-Schloss/bind/slave/jn-8hXnHMEP
new file mode 100644
index 0000000..4f9acbb
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-8hXnHMEP differ
diff --git a/GA-Schloss/bind/slave/jn-8iNqHPdR b/GA-Schloss/bind/slave/jn-8iNqHPdR
new file mode 100644
index 0000000..4e45640
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-8iNqHPdR differ
diff --git a/GA-Schloss/bind/slave/jn-8ofqZdQw b/GA-Schloss/bind/slave/jn-8ofqZdQw
new file mode 100644
index 0000000..66df2d8
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-8ofqZdQw differ
diff --git a/GA-Schloss/bind/slave/jn-8wrBqAr7 b/GA-Schloss/bind/slave/jn-8wrBqAr7
new file mode 100644
index 0000000..83f74c8
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-8wrBqAr7 differ
diff --git a/GA-Schloss/bind/slave/jn-8yBlWXpS b/GA-Schloss/bind/slave/jn-8yBlWXpS
new file mode 100644
index 0000000..6873d77
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-8yBlWXpS differ
diff --git a/GA-Schloss/bind/slave/jn-8z3BlloR b/GA-Schloss/bind/slave/jn-8z3BlloR
new file mode 100644
index 0000000..51e9f3d
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-8z3BlloR differ
diff --git a/GA-Schloss/bind/slave/jn-92ezaQ8G b/GA-Schloss/bind/slave/jn-92ezaQ8G
new file mode 100644
index 0000000..65b2aa3
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-92ezaQ8G differ
diff --git a/GA-Schloss/bind/slave/jn-9DgEjCE8 b/GA-Schloss/bind/slave/jn-9DgEjCE8
new file mode 100644
index 0000000..4f986ba
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-9DgEjCE8 differ
diff --git a/GA-Schloss/bind/slave/jn-9HVInOOL b/GA-Schloss/bind/slave/jn-9HVInOOL
new file mode 100644
index 0000000..4f05d05
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-9HVInOOL differ
diff --git a/GA-Schloss/bind/slave/jn-9JC8nQYP b/GA-Schloss/bind/slave/jn-9JC8nQYP
new file mode 100644
index 0000000..8e706e3
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-9JC8nQYP differ
diff --git a/GA-Schloss/bind/slave/jn-AEWnpBZ7 b/GA-Schloss/bind/slave/jn-AEWnpBZ7
new file mode 100644
index 0000000..a941fec
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-AEWnpBZ7 differ
diff --git a/GA-Schloss/bind/slave/jn-AHo240GA b/GA-Schloss/bind/slave/jn-AHo240GA
new file mode 100644
index 0000000..7e65c60
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-AHo240GA differ
diff --git a/GA-Schloss/bind/slave/jn-BaCOAgJi b/GA-Schloss/bind/slave/jn-BaCOAgJi
new file mode 100644
index 0000000..e8e23bc
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-BaCOAgJi differ
diff --git a/GA-Schloss/bind/slave/jn-BlZjmAZY b/GA-Schloss/bind/slave/jn-BlZjmAZY
new file mode 100644
index 0000000..3e3c072
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-BlZjmAZY differ
diff --git a/GA-Schloss/bind/slave/jn-DJ2uRojk b/GA-Schloss/bind/slave/jn-DJ2uRojk
new file mode 100644
index 0000000..b63cac1
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-DJ2uRojk differ
diff --git a/GA-Schloss/bind/slave/jn-EXv1xNFO b/GA-Schloss/bind/slave/jn-EXv1xNFO
new file mode 100644
index 0000000..fd50d64
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-EXv1xNFO differ
diff --git a/GA-Schloss/bind/slave/jn-EdeAk4Mu b/GA-Schloss/bind/slave/jn-EdeAk4Mu
new file mode 100644
index 0000000..ac8853d
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-EdeAk4Mu differ
diff --git a/GA-Schloss/bind/slave/jn-FCkkzw7H b/GA-Schloss/bind/slave/jn-FCkkzw7H
new file mode 100644
index 0000000..39b11a8
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-FCkkzw7H differ
diff --git a/GA-Schloss/bind/slave/jn-FNmksTP0 b/GA-Schloss/bind/slave/jn-FNmksTP0
new file mode 100644
index 0000000..eb84c28
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-FNmksTP0 differ
diff --git a/GA-Schloss/bind/slave/jn-FbRxfjPY b/GA-Schloss/bind/slave/jn-FbRxfjPY
new file mode 100644
index 0000000..3d0bb2f
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-FbRxfjPY differ
diff --git a/GA-Schloss/bind/slave/jn-Fi13CUaq b/GA-Schloss/bind/slave/jn-Fi13CUaq
new file mode 100644
index 0000000..db09df6
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-Fi13CUaq differ
diff --git a/GA-Schloss/bind/slave/jn-H2dkAye1 b/GA-Schloss/bind/slave/jn-H2dkAye1
new file mode 100644
index 0000000..4b442de
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-H2dkAye1 differ
diff --git a/GA-Schloss/bind/slave/jn-I9Nshkb1 b/GA-Schloss/bind/slave/jn-I9Nshkb1
new file mode 100644
index 0000000..0b9c2fb
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-I9Nshkb1 differ
diff --git a/GA-Schloss/bind/slave/jn-J6dyYJ9A b/GA-Schloss/bind/slave/jn-J6dyYJ9A
new file mode 100644
index 0000000..ddaecac
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-J6dyYJ9A differ
diff --git a/GA-Schloss/bind/slave/jn-JGYqike9 b/GA-Schloss/bind/slave/jn-JGYqike9
new file mode 100644
index 0000000..aa062e1
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-JGYqike9 differ
diff --git a/GA-Schloss/bind/slave/jn-JnnvXN0x b/GA-Schloss/bind/slave/jn-JnnvXN0x
new file mode 100644
index 0000000..de44075
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-JnnvXN0x differ
diff --git a/GA-Schloss/bind/slave/jn-KEBinJm4 b/GA-Schloss/bind/slave/jn-KEBinJm4
new file mode 100644
index 0000000..ee58052
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-KEBinJm4 differ
diff --git a/GA-Schloss/bind/slave/jn-KWfAH9Jg b/GA-Schloss/bind/slave/jn-KWfAH9Jg
new file mode 100644
index 0000000..d02d738
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-KWfAH9Jg differ
diff --git a/GA-Schloss/bind/slave/jn-KdjVlaes b/GA-Schloss/bind/slave/jn-KdjVlaes
new file mode 100644
index 0000000..3c07905
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-KdjVlaes differ
diff --git a/GA-Schloss/bind/slave/jn-KlluluJ4 b/GA-Schloss/bind/slave/jn-KlluluJ4
new file mode 100644
index 0000000..0a9199c
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-KlluluJ4 differ
diff --git a/GA-Schloss/bind/slave/jn-L1RuUuYe b/GA-Schloss/bind/slave/jn-L1RuUuYe
new file mode 100644
index 0000000..f49836c
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-L1RuUuYe differ
diff --git a/GA-Schloss/bind/slave/jn-LQGruEA8 b/GA-Schloss/bind/slave/jn-LQGruEA8
new file mode 100644
index 0000000..da6747e
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-LQGruEA8 differ
diff --git a/GA-Schloss/bind/slave/jn-Lniqp66e b/GA-Schloss/bind/slave/jn-Lniqp66e
new file mode 100644
index 0000000..450d399
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-Lniqp66e differ
diff --git a/GA-Schloss/bind/slave/jn-M3ljop5n b/GA-Schloss/bind/slave/jn-M3ljop5n
new file mode 100644
index 0000000..e852a81
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-M3ljop5n differ
diff --git a/GA-Schloss/bind/slave/jn-M58jV2q9 b/GA-Schloss/bind/slave/jn-M58jV2q9
new file mode 100644
index 0000000..d4a3ce8
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-M58jV2q9 differ
diff --git a/GA-Schloss/bind/slave/jn-M606hob7 b/GA-Schloss/bind/slave/jn-M606hob7
new file mode 100644
index 0000000..5af43d1
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-M606hob7 differ
diff --git a/GA-Schloss/bind/slave/jn-MCE5SgQb b/GA-Schloss/bind/slave/jn-MCE5SgQb
new file mode 100644
index 0000000..01c1d85
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-MCE5SgQb differ
diff --git a/GA-Schloss/bind/slave/jn-MN8Woxod b/GA-Schloss/bind/slave/jn-MN8Woxod
new file mode 100644
index 0000000..8044d37
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-MN8Woxod differ
diff --git a/GA-Schloss/bind/slave/jn-N1Zo6Pek b/GA-Schloss/bind/slave/jn-N1Zo6Pek
new file mode 100644
index 0000000..cbe7032
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-N1Zo6Pek differ
diff --git a/GA-Schloss/bind/slave/jn-NxLyu0ee b/GA-Schloss/bind/slave/jn-NxLyu0ee
new file mode 100644
index 0000000..2b728ec
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-NxLyu0ee differ
diff --git a/GA-Schloss/bind/slave/jn-Ojt7k7Lu b/GA-Schloss/bind/slave/jn-Ojt7k7Lu
new file mode 100644
index 0000000..65b7845
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-Ojt7k7Lu differ
diff --git a/GA-Schloss/bind/slave/jn-PSy8KC0u b/GA-Schloss/bind/slave/jn-PSy8KC0u
new file mode 100644
index 0000000..3daaeb3
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-PSy8KC0u differ
diff --git a/GA-Schloss/bind/slave/jn-Q4bm0rFU b/GA-Schloss/bind/slave/jn-Q4bm0rFU
new file mode 100644
index 0000000..5412dbf
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-Q4bm0rFU differ
diff --git a/GA-Schloss/bind/slave/jn-QXR2KNt1 b/GA-Schloss/bind/slave/jn-QXR2KNt1
new file mode 100644
index 0000000..291df4c
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-QXR2KNt1 differ
diff --git a/GA-Schloss/bind/slave/jn-Qp2sv1By b/GA-Schloss/bind/slave/jn-Qp2sv1By
new file mode 100644
index 0000000..8f7902d
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-Qp2sv1By differ
diff --git a/GA-Schloss/bind/slave/jn-Qs9zh0Cw b/GA-Schloss/bind/slave/jn-Qs9zh0Cw
new file mode 100644
index 0000000..d1c71ab
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-Qs9zh0Cw differ
diff --git a/GA-Schloss/bind/slave/jn-REM8JiWc b/GA-Schloss/bind/slave/jn-REM8JiWc
new file mode 100644
index 0000000..d5d17f2
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-REM8JiWc differ
diff --git a/GA-Schloss/bind/slave/jn-ROwRPf0n b/GA-Schloss/bind/slave/jn-ROwRPf0n
new file mode 100644
index 0000000..1c8689d
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-ROwRPf0n differ
diff --git a/GA-Schloss/bind/slave/jn-RryLoHhe b/GA-Schloss/bind/slave/jn-RryLoHhe
new file mode 100644
index 0000000..816aee0
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-RryLoHhe differ
diff --git a/GA-Schloss/bind/slave/jn-RuyCFNoR b/GA-Schloss/bind/slave/jn-RuyCFNoR
new file mode 100644
index 0000000..f3d971c
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-RuyCFNoR differ
diff --git a/GA-Schloss/bind/slave/jn-S0Pn67Wy b/GA-Schloss/bind/slave/jn-S0Pn67Wy
new file mode 100644
index 0000000..78e64d6
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-S0Pn67Wy differ
diff --git a/GA-Schloss/bind/slave/jn-SK1VFe6Z b/GA-Schloss/bind/slave/jn-SK1VFe6Z
new file mode 100644
index 0000000..aec399b
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-SK1VFe6Z differ
diff --git a/GA-Schloss/bind/slave/jn-Sp4l4sBy b/GA-Schloss/bind/slave/jn-Sp4l4sBy
new file mode 100644
index 0000000..e988286
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-Sp4l4sBy differ
diff --git a/GA-Schloss/bind/slave/jn-SvaYXKij b/GA-Schloss/bind/slave/jn-SvaYXKij
new file mode 100644
index 0000000..da9f166
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-SvaYXKij differ
diff --git a/GA-Schloss/bind/slave/jn-THDFNZSw b/GA-Schloss/bind/slave/jn-THDFNZSw
new file mode 100644
index 0000000..e9c5996
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-THDFNZSw differ
diff --git a/GA-Schloss/bind/slave/jn-TR2IlZQn b/GA-Schloss/bind/slave/jn-TR2IlZQn
new file mode 100644
index 0000000..819da7b
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-TR2IlZQn differ
diff --git a/GA-Schloss/bind/slave/jn-TYh2cjFY b/GA-Schloss/bind/slave/jn-TYh2cjFY
new file mode 100644
index 0000000..d88d53d
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-TYh2cjFY differ
diff --git a/GA-Schloss/bind/slave/jn-Tu0zEKu8 b/GA-Schloss/bind/slave/jn-Tu0zEKu8
new file mode 100644
index 0000000..e88e51d
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-Tu0zEKu8 differ
diff --git a/GA-Schloss/bind/slave/jn-UFLvsEqi b/GA-Schloss/bind/slave/jn-UFLvsEqi
new file mode 100644
index 0000000..7293cce
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-UFLvsEqi differ
diff --git a/GA-Schloss/bind/slave/jn-UTpQakuS b/GA-Schloss/bind/slave/jn-UTpQakuS
new file mode 100644
index 0000000..74a837e
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-UTpQakuS differ
diff --git a/GA-Schloss/bind/slave/jn-UlImA0e9 b/GA-Schloss/bind/slave/jn-UlImA0e9
new file mode 100644
index 0000000..30ed1e2
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-UlImA0e9 differ
diff --git a/GA-Schloss/bind/slave/jn-V3mFbhMb b/GA-Schloss/bind/slave/jn-V3mFbhMb
new file mode 100644
index 0000000..19923a5
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-V3mFbhMb differ
diff --git a/GA-Schloss/bind/slave/jn-VSysjghN b/GA-Schloss/bind/slave/jn-VSysjghN
new file mode 100644
index 0000000..5b7c425
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-VSysjghN differ
diff --git a/GA-Schloss/bind/slave/jn-W0ADrzNY b/GA-Schloss/bind/slave/jn-W0ADrzNY
new file mode 100644
index 0000000..ca86093
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-W0ADrzNY differ
diff --git a/GA-Schloss/bind/slave/jn-W44cJnWN b/GA-Schloss/bind/slave/jn-W44cJnWN
new file mode 100644
index 0000000..0b69c76
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-W44cJnWN differ
diff --git a/GA-Schloss/bind/slave/jn-WcarQoz5 b/GA-Schloss/bind/slave/jn-WcarQoz5
new file mode 100644
index 0000000..4596a6e
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-WcarQoz5 differ
diff --git a/GA-Schloss/bind/slave/jn-X25gM7qL b/GA-Schloss/bind/slave/jn-X25gM7qL
new file mode 100644
index 0000000..2f89cef
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-X25gM7qL differ
diff --git a/GA-Schloss/bind/slave/jn-X6liiLri b/GA-Schloss/bind/slave/jn-X6liiLri
new file mode 100644
index 0000000..d3f149f
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-X6liiLri differ
diff --git a/GA-Schloss/bind/slave/jn-XJbSmm9g b/GA-Schloss/bind/slave/jn-XJbSmm9g
new file mode 100644
index 0000000..23c6e2a
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-XJbSmm9g differ
diff --git a/GA-Schloss/bind/slave/jn-Xqb483un b/GA-Schloss/bind/slave/jn-Xqb483un
new file mode 100644
index 0000000..2e31115
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-Xqb483un differ
diff --git a/GA-Schloss/bind/slave/jn-Y2ynIZR1 b/GA-Schloss/bind/slave/jn-Y2ynIZR1
new file mode 100644
index 0000000..3ab2338
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-Y2ynIZR1 differ
diff --git a/GA-Schloss/bind/slave/jn-Y6BYDU5I b/GA-Schloss/bind/slave/jn-Y6BYDU5I
new file mode 100644
index 0000000..b5de2e7
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-Y6BYDU5I differ
diff --git a/GA-Schloss/bind/slave/jn-Z6mo9TNO b/GA-Schloss/bind/slave/jn-Z6mo9TNO
new file mode 100644
index 0000000..54e6443
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-Z6mo9TNO differ
diff --git a/GA-Schloss/bind/slave/jn-ZU1DEwLZ b/GA-Schloss/bind/slave/jn-ZU1DEwLZ
new file mode 100644
index 0000000..2df7512
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-ZU1DEwLZ differ
diff --git a/GA-Schloss/bind/slave/jn-aGgJnFGB b/GA-Schloss/bind/slave/jn-aGgJnFGB
new file mode 100644
index 0000000..d208c66
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-aGgJnFGB differ
diff --git a/GA-Schloss/bind/slave/jn-b8AboGNV b/GA-Schloss/bind/slave/jn-b8AboGNV
new file mode 100644
index 0000000..bd68e61
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-b8AboGNV differ
diff --git a/GA-Schloss/bind/slave/jn-bSw9PBrs b/GA-Schloss/bind/slave/jn-bSw9PBrs
new file mode 100644
index 0000000..6fead68
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-bSw9PBrs differ
diff --git a/GA-Schloss/bind/slave/jn-bvOVqpr2 b/GA-Schloss/bind/slave/jn-bvOVqpr2
new file mode 100644
index 0000000..08520ea
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-bvOVqpr2 differ
diff --git a/GA-Schloss/bind/slave/jn-bz8aN7OC b/GA-Schloss/bind/slave/jn-bz8aN7OC
new file mode 100644
index 0000000..b59691d
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-bz8aN7OC differ
diff --git a/GA-Schloss/bind/slave/jn-cCkOv1wA b/GA-Schloss/bind/slave/jn-cCkOv1wA
new file mode 100644
index 0000000..a09507d
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-cCkOv1wA differ
diff --git a/GA-Schloss/bind/slave/jn-cWhkiKEI b/GA-Schloss/bind/slave/jn-cWhkiKEI
new file mode 100644
index 0000000..a8d8d9b
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-cWhkiKEI differ
diff --git a/GA-Schloss/bind/slave/jn-cdt4OOCa b/GA-Schloss/bind/slave/jn-cdt4OOCa
new file mode 100644
index 0000000..1e52257
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-cdt4OOCa differ
diff --git a/GA-Schloss/bind/slave/jn-d9pWpUco b/GA-Schloss/bind/slave/jn-d9pWpUco
new file mode 100644
index 0000000..a551c4c
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-d9pWpUco differ
diff --git a/GA-Schloss/bind/slave/jn-dC4oRhki b/GA-Schloss/bind/slave/jn-dC4oRhki
new file mode 100644
index 0000000..ff0ca8e
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-dC4oRhki differ
diff --git a/GA-Schloss/bind/slave/jn-dsusqH0b b/GA-Schloss/bind/slave/jn-dsusqH0b
new file mode 100644
index 0000000..48f51b2
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-dsusqH0b differ
diff --git a/GA-Schloss/bind/slave/jn-dxoizapz b/GA-Schloss/bind/slave/jn-dxoizapz
new file mode 100644
index 0000000..332e40c
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-dxoizapz differ
diff --git a/GA-Schloss/bind/slave/jn-dzKh8u8U b/GA-Schloss/bind/slave/jn-dzKh8u8U
new file mode 100644
index 0000000..eb3aa81
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-dzKh8u8U differ
diff --git a/GA-Schloss/bind/slave/jn-e3zMDLHk b/GA-Schloss/bind/slave/jn-e3zMDLHk
new file mode 100644
index 0000000..4092d56
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-e3zMDLHk differ
diff --git a/GA-Schloss/bind/slave/jn-epdBZSHu b/GA-Schloss/bind/slave/jn-epdBZSHu
new file mode 100644
index 0000000..c23ef9e
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-epdBZSHu differ
diff --git a/GA-Schloss/bind/slave/jn-fHPWgdvZ b/GA-Schloss/bind/slave/jn-fHPWgdvZ
new file mode 100644
index 0000000..60d0fd4
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-fHPWgdvZ differ
diff --git a/GA-Schloss/bind/slave/jn-gaYs3NIG b/GA-Schloss/bind/slave/jn-gaYs3NIG
new file mode 100644
index 0000000..c18ce70
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-gaYs3NIG differ
diff --git a/GA-Schloss/bind/slave/jn-gaupmKBW b/GA-Schloss/bind/slave/jn-gaupmKBW
new file mode 100644
index 0000000..310a663
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-gaupmKBW differ
diff --git a/GA-Schloss/bind/slave/jn-hRPtsjx6 b/GA-Schloss/bind/slave/jn-hRPtsjx6
new file mode 100644
index 0000000..383c238
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-hRPtsjx6 differ
diff --git a/GA-Schloss/bind/slave/jn-hVjOPDhM b/GA-Schloss/bind/slave/jn-hVjOPDhM
new file mode 100644
index 0000000..f37c676
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-hVjOPDhM differ
diff --git a/GA-Schloss/bind/slave/jn-iHyAncbI b/GA-Schloss/bind/slave/jn-iHyAncbI
new file mode 100644
index 0000000..3579129
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-iHyAncbI differ
diff --git a/GA-Schloss/bind/slave/jn-iSDlqxwW b/GA-Schloss/bind/slave/jn-iSDlqxwW
new file mode 100644
index 0000000..7b75d4e
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-iSDlqxwW differ
diff --git a/GA-Schloss/bind/slave/jn-j3lgCeOD b/GA-Schloss/bind/slave/jn-j3lgCeOD
new file mode 100644
index 0000000..15df79b
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-j3lgCeOD differ
diff --git a/GA-Schloss/bind/slave/jn-j7KTZOck b/GA-Schloss/bind/slave/jn-j7KTZOck
new file mode 100644
index 0000000..ac4d0e8
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-j7KTZOck differ
diff --git a/GA-Schloss/bind/slave/jn-k9vgh2kt b/GA-Schloss/bind/slave/jn-k9vgh2kt
new file mode 100644
index 0000000..b1f660d
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-k9vgh2kt differ
diff --git a/GA-Schloss/bind/slave/jn-kmeS3Zuj b/GA-Schloss/bind/slave/jn-kmeS3Zuj
new file mode 100644
index 0000000..188bf71
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-kmeS3Zuj differ
diff --git a/GA-Schloss/bind/slave/jn-l5MKp46e b/GA-Schloss/bind/slave/jn-l5MKp46e
new file mode 100644
index 0000000..bc6dd28
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-l5MKp46e differ
diff --git a/GA-Schloss/bind/slave/jn-lAMYTLw6 b/GA-Schloss/bind/slave/jn-lAMYTLw6
new file mode 100644
index 0000000..e141272
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-lAMYTLw6 differ
diff --git a/GA-Schloss/bind/slave/jn-lPMgCOgt b/GA-Schloss/bind/slave/jn-lPMgCOgt
new file mode 100644
index 0000000..3a71a92
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-lPMgCOgt differ
diff --git a/GA-Schloss/bind/slave/jn-m9fbrXGE b/GA-Schloss/bind/slave/jn-m9fbrXGE
new file mode 100644
index 0000000..1431eb3
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-m9fbrXGE differ
diff --git a/GA-Schloss/bind/slave/jn-mL7uBdvs b/GA-Schloss/bind/slave/jn-mL7uBdvs
new file mode 100644
index 0000000..32bcdc1
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-mL7uBdvs differ
diff --git a/GA-Schloss/bind/slave/jn-nJf67gkW b/GA-Schloss/bind/slave/jn-nJf67gkW
new file mode 100644
index 0000000..93e41c2
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-nJf67gkW differ
diff --git a/GA-Schloss/bind/slave/jn-o3xs5ezl b/GA-Schloss/bind/slave/jn-o3xs5ezl
new file mode 100644
index 0000000..4ecd532
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-o3xs5ezl differ
diff --git a/GA-Schloss/bind/slave/jn-o7RXh44N b/GA-Schloss/bind/slave/jn-o7RXh44N
new file mode 100644
index 0000000..c8016c4
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-o7RXh44N differ
diff --git a/GA-Schloss/bind/slave/jn-ojiVbgnf b/GA-Schloss/bind/slave/jn-ojiVbgnf
new file mode 100644
index 0000000..91c65fa
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-ojiVbgnf differ
diff --git a/GA-Schloss/bind/slave/jn-orgrvBzu b/GA-Schloss/bind/slave/jn-orgrvBzu
new file mode 100644
index 0000000..4c628e3
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-orgrvBzu differ
diff --git a/GA-Schloss/bind/slave/jn-p12wamTM b/GA-Schloss/bind/slave/jn-p12wamTM
new file mode 100644
index 0000000..31ba714
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-p12wamTM differ
diff --git a/GA-Schloss/bind/slave/jn-pURwZ011 b/GA-Schloss/bind/slave/jn-pURwZ011
new file mode 100644
index 0000000..4c0aef9
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-pURwZ011 differ
diff --git a/GA-Schloss/bind/slave/jn-q5tMJAn3 b/GA-Schloss/bind/slave/jn-q5tMJAn3
new file mode 100644
index 0000000..bc34ae4
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-q5tMJAn3 differ
diff --git a/GA-Schloss/bind/slave/jn-qBhF6CBs b/GA-Schloss/bind/slave/jn-qBhF6CBs
new file mode 100644
index 0000000..cd3f330
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-qBhF6CBs differ
diff --git a/GA-Schloss/bind/slave/jn-sId9814k b/GA-Schloss/bind/slave/jn-sId9814k
new file mode 100644
index 0000000..610a8ef
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-sId9814k differ
diff --git a/GA-Schloss/bind/slave/jn-sTQ9uOPf b/GA-Schloss/bind/slave/jn-sTQ9uOPf
new file mode 100644
index 0000000..d0fdd0e
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-sTQ9uOPf differ
diff --git a/GA-Schloss/bind/slave/jn-sVMOXen0 b/GA-Schloss/bind/slave/jn-sVMOXen0
new file mode 100644
index 0000000..244c800
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-sVMOXen0 differ
diff --git a/GA-Schloss/bind/slave/jn-sk1hpHn2 b/GA-Schloss/bind/slave/jn-sk1hpHn2
new file mode 100644
index 0000000..9080996
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-sk1hpHn2 differ
diff --git a/GA-Schloss/bind/slave/jn-sugz5QuM b/GA-Schloss/bind/slave/jn-sugz5QuM
new file mode 100644
index 0000000..e133e4c
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-sugz5QuM differ
diff --git a/GA-Schloss/bind/slave/jn-t5xIzX6M b/GA-Schloss/bind/slave/jn-t5xIzX6M
new file mode 100644
index 0000000..5659de9
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-t5xIzX6M differ
diff --git a/GA-Schloss/bind/slave/jn-tOMTJfAo b/GA-Schloss/bind/slave/jn-tOMTJfAo
new file mode 100644
index 0000000..c634627
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-tOMTJfAo differ
diff --git a/GA-Schloss/bind/slave/jn-txaAd1VC b/GA-Schloss/bind/slave/jn-txaAd1VC
new file mode 100644
index 0000000..06f6ff4
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-txaAd1VC differ
diff --git a/GA-Schloss/bind/slave/jn-tyCAnsUK b/GA-Schloss/bind/slave/jn-tyCAnsUK
new file mode 100644
index 0000000..b01e5fa
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-tyCAnsUK differ
diff --git a/GA-Schloss/bind/slave/jn-uWdwBmI1 b/GA-Schloss/bind/slave/jn-uWdwBmI1
new file mode 100644
index 0000000..e6548c1
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-uWdwBmI1 differ
diff --git a/GA-Schloss/bind/slave/jn-uX5WdYhq b/GA-Schloss/bind/slave/jn-uX5WdYhq
new file mode 100644
index 0000000..97c93a7
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-uX5WdYhq differ
diff --git a/GA-Schloss/bind/slave/jn-vJZLLUfa b/GA-Schloss/bind/slave/jn-vJZLLUfa
new file mode 100644
index 0000000..0041aef
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-vJZLLUfa differ
diff --git a/GA-Schloss/bind/slave/jn-w4E3JcUG b/GA-Schloss/bind/slave/jn-w4E3JcUG
new file mode 100644
index 0000000..dee09cf
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-w4E3JcUG differ
diff --git a/GA-Schloss/bind/slave/jn-warEJPPP b/GA-Schloss/bind/slave/jn-warEJPPP
new file mode 100644
index 0000000..8bc01d8
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-warEJPPP differ
diff --git a/GA-Schloss/bind/slave/jn-wctuz8go b/GA-Schloss/bind/slave/jn-wctuz8go
new file mode 100644
index 0000000..e5cdcc2
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-wctuz8go differ
diff --git a/GA-Schloss/bind/slave/jn-wz6dCwjk b/GA-Schloss/bind/slave/jn-wz6dCwjk
new file mode 100644
index 0000000..6421297
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-wz6dCwjk differ
diff --git a/GA-Schloss/bind/slave/jn-x9vmFcQT b/GA-Schloss/bind/slave/jn-x9vmFcQT
new file mode 100644
index 0000000..bfd6883
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-x9vmFcQT differ
diff --git a/GA-Schloss/bind/slave/jn-xH7ce4Hr b/GA-Schloss/bind/slave/jn-xH7ce4Hr
new file mode 100644
index 0000000..9264a54
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-xH7ce4Hr differ
diff --git a/GA-Schloss/bind/slave/jn-xV2v7Gy7 b/GA-Schloss/bind/slave/jn-xV2v7Gy7
new file mode 100644
index 0000000..9798b0a
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-xV2v7Gy7 differ
diff --git a/GA-Schloss/bind/slave/jn-xbjGhOcl b/GA-Schloss/bind/slave/jn-xbjGhOcl
new file mode 100644
index 0000000..02984dc
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-xbjGhOcl differ
diff --git a/GA-Schloss/bind/slave/jn-yKurTbka b/GA-Schloss/bind/slave/jn-yKurTbka
new file mode 100644
index 0000000..29851c1
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-yKurTbka differ
diff --git a/GA-Schloss/bind/slave/jn-yaDgSvAC b/GA-Schloss/bind/slave/jn-yaDgSvAC
new file mode 100644
index 0000000..34bd86f
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-yaDgSvAC differ
diff --git a/GA-Schloss/bind/slave/jn-ygUYxJqy b/GA-Schloss/bind/slave/jn-ygUYxJqy
new file mode 100644
index 0000000..dfe5107
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-ygUYxJqy differ
diff --git a/GA-Schloss/bind/slave/jn-zFhHmlHn b/GA-Schloss/bind/slave/jn-zFhHmlHn
new file mode 100644
index 0000000..f146a38
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-zFhHmlHn differ
diff --git a/GA-Schloss/bind/slave/jn-zR7ZJGW7 b/GA-Schloss/bind/slave/jn-zR7ZJGW7
new file mode 100644
index 0000000..85b9e5f
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-zR7ZJGW7 differ
diff --git a/GA-Schloss/bind/slave/jn-zUdlDa7c b/GA-Schloss/bind/slave/jn-zUdlDa7c
new file mode 100644
index 0000000..6757e0c
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-zUdlDa7c differ
diff --git a/GA-Schloss/bind/slave/jn-zgqw8gpZ b/GA-Schloss/bind/slave/jn-zgqw8gpZ
new file mode 100644
index 0000000..32f6b36
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-zgqw8gpZ differ
diff --git a/GA-Schloss/bind/slave/jn-zqZaqVwq b/GA-Schloss/bind/slave/jn-zqZaqVwq
new file mode 100644
index 0000000..4a3f1c5
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-zqZaqVwq differ
diff --git a/GA-Schloss/bind/slave/jn-zv8OaeYf b/GA-Schloss/bind/slave/jn-zv8OaeYf
new file mode 100644
index 0000000..8f1164b
Binary files /dev/null and b/GA-Schloss/bind/slave/jn-zv8OaeYf differ
diff --git a/GA-Schloss/bind/slave/mail.gemeinschaft-altenschlirf.de.zone b/GA-Schloss/bind/slave/mail.gemeinschaft-altenschlirf.de.zone
new file mode 100644
index 0000000..3089e4a
Binary files /dev/null and b/GA-Schloss/bind/slave/mail.gemeinschaft-altenschlirf.de.zone differ
diff --git a/GA-Schloss/bind/zones.rfc1918 b/GA-Schloss/bind/zones.rfc1918
new file mode 100644
index 0000000..03b5546
--- /dev/null
+++ b/GA-Schloss/bind/zones.rfc1918
@@ -0,0 +1,20 @@
+zone "10.in-addr.arpa"      { type master; file "/etc/bind/db.empty"; };
+ 
+zone "16.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "17.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "18.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "19.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "20.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "21.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "22.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "23.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "24.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "25.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "26.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "27.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "28.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "29.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "30.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "31.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+
+zone "168.192.in-addr.arpa" { type master; file "/etc/bind/db.empty"; };
diff --git a/GA-Schloss/chap-secrets.GA-Schloss b/GA-Schloss/chap-secrets.GA-Schloss
new file mode 100644
index 0000000..353e180
--- /dev/null
+++ b/GA-Schloss/chap-secrets.GA-Schloss
@@ -0,0 +1,20 @@
+# Secrets for authentication using CHAP
+# client	server	secret			IP addresses
+
+
+
+## - ckubu
+"0025591824365511139967620001@t-online.de" * "67982653"
+
+## - DSL Altenschlirf ST (feste ip-addresse 87.139.62.172)
+## -
+"feste-ip3/5TBX42N4SE8M@t-online-com.de" * "15868583"
+
+## - DSL Altenschlirf Surf (feste ip-addresse 80.153.166.156)
+## -
+"feste-ip6/8TB0GP2GSCDF@t-online-com.de" * "87642121"
+
+## - DSL Altenschlirf 3 (feste ip-addresse 87.128.11.35)
+## -
+"002468512294551125742960001@t-online.de" * "16819924"
+
diff --git a/GA-Schloss/check_net-logrotate.GA-Schloss b/GA-Schloss/check_net-logrotate.GA-Schloss
new file mode 100644
index 0000000..f0a557b
--- /dev/null
+++ b/GA-Schloss/check_net-logrotate.GA-Schloss
@@ -0,0 +1,10 @@
+/var/log/check_net.log
+{
+   rotate 7
+   daily
+   missingok
+   notifempty
+   copytruncate
+   delaycompress
+   compress
+}
diff --git a/GA-Schloss/check_net.service.GA-Schloss b/GA-Schloss/check_net.service.GA-Schloss
new file mode 100644
index 0000000..0eff326
--- /dev/null
+++ b/GA-Schloss/check_net.service.GA-Schloss
@@ -0,0 +1,16 @@
+[Unit]
+Description=Configure Routing for Internet Connections;
+After=network.target
+After=rc-local.service
+
+[Service]
+ExecStart=/usr/local/sbin/check_net.sh
+ExecStartPre=rm -rf /tmp/check_net.sh.LOCK
+ExecStopPost=rm -rf /tmp/check_net.sh.LOCK
+KillMode=control-group
+SendSIGKILL=yes
+TimeoutStopSec=2
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target
diff --git a/GA-Schloss/check_net/check_net.conf b/GA-Schloss/check_net/check_net.conf
new file mode 120000
index 0000000..b38dd07
--- /dev/null
+++ b/GA-Schloss/check_net/check_net.conf
@@ -0,0 +1 @@
+check_net.conf.with_static
\ No newline at end of file
diff --git a/GA-Schloss/check_net/check_net.conf.sample b/GA-Schloss/check_net/check_net.conf.sample
new file mode 100644
index 0000000..bc5f45d
--- /dev/null
+++ b/GA-Schloss/check_net/check_net.conf.sample
@@ -0,0 +1,124 @@
+# - Configuration file for scrupts check_net.sh and netconfig.sh
+# -
+
+LOGGING_CONSOLE=false
+DEBUG=true
+
+# - Where are your scripts located?
+# -
+check_script=/usr/local/sbin/check_net.sh
+netconfig_script=/usr/local/sbin/netconfig.sh
+
+log_file=/var/log/check_net.log
+
+
+# - Put in your DSL devices (refers to your network configuration)
+# - youe wish be congigured by that script
+# -
+# - Notice:
+# -    If not using multiple default gatways, declare the list in the order of your 
+# -    preferred default gatway devices
+# -
+# -    Example:
+# -       _INITIAL_DEVICE_LIST="eth0:192.168.63.254 ppp-light"
+# -
+_INITIAL_DEVICE_LIST="ppp-ckubu"
+
+# - Set to "false" uses "0.0.0.0" as remote gateway instead of the real address
+# -
+USE_REMOTE_GATEWAY_ADDRESS=true
+#USE_REMOTE_GATEWAY_ADDRESS=false
+
+# - Set default gw (roundrobin)
+# -
+# - !! SET_MULTIPLE_DEFAULT_GW=true does not work for now..
+# -
+SET_MULTIPLE_DEFAULT_GW=false
+#SET_MULTIPLE_DEFAULT_GW=true
+
+
+# - Set to false uses "0.0.0.0" as default gateway adress instaed of real remote address
+# -
+USE_DEFAULT_GW_ADDRESS=true
+#USE_DEFAULT_GW_ADDRESS=false
+
+
+admin_email=root
+from_address="check-inet-devices@`hostname -f`"
+company="CKUBU"
+content_type='Content-Type: text/plain;\n charset="utf-8"'
+
+
+# - rule_local_ips
+# -
+# - Add rule(s) for routing local ip-address(es) through a given extern interface
+# -
+# - Space separated list of entries '<ext-interface>:<local-ip>'
+# -    rule_local_ips="<ext-interface>:<local-ip> [<ext-interface>:<local-ip>] [.."
+# -
+# - Example:
+# - ========
+# - local ip 192.168.10.1 through extern interface ppp-st and 
+# - local ip 192.168.10.13 through extern interface ppp-surf1
+# -     rule_local_ips="ppp-st:192.168.10.1 ppp-surf1:192.168.10.13"
+# -
+rule_local_ips=""
+
+# - rule_remote_ips
+# -
+# - Add rule(s) for routing remote ip-address(es) through a given extern interface
+# -
+# - Space separated list of entries '<ext-interface>:<remote-ip>'
+# -    rule_remote_ips="<ext-interface>:<remote-ip> [<ext-interface>:<remote-ip>] [.."
+# -
+# - Example:
+# - ========
+# - route remote ip-address  141.1.1.1 through extern interface ppp-ckubu and 
+# - also route ip-address 8.8.8.8 through through extern interface ppp-ckubu
+# -     rule_remote_ips="ppp-ckubu:141.1.1.1 ppp-ckubu:8.8.8.8"
+# - 
+rule_remote_ips=""
+
+# - rule_local_nets
+# -
+# - Add rule(s) for routing local networks through a given extern interface out
+# -
+# - Space separated list of entries '<extern-interface>:<local-net>'
+# -    rule_local_nets="<extern-interface>:<local-net> [<extern-interface>:<local-net>] [.."
+# -
+# -
+# - Example:
+# - ========
+# -     rule_local_nets="ppp-st:192.168.11.0/25 ppp-surf1:192.168.11.128/25"
+# -
+rule_local_nets=""
+
+
+
+## ====================================
+## - Don't make changes after this Line
+## ====================================
+
+# ---
+# - Add rule(s) for routing local ip-address(es)
+# ---
+declare -a rule_local_ip_arr
+for _str in $rule_local_ips ; do
+   rule_local_ip_arr+=("$_str")
+done
+
+# ---
+# - Add rule(s) for routing remote ip-address(es)
+# ---
+declare -a rule_remote_ip_arr
+for _str in $rule_remote_ips ; do
+   rule_remote_ip_arr+=("$_str")
+done
+
+# ---
+# - Add rule(s) for routing local networks
+# ---
+declare -a rule_local_net_arr
+for _str in $rule_local_nets ; do
+   rule_local_net_arr+=("$_str")
+done
diff --git a/GA-Schloss/check_net/check_net.conf.with_static b/GA-Schloss/check_net/check_net.conf.with_static
new file mode 100644
index 0000000..7065d6c
--- /dev/null
+++ b/GA-Schloss/check_net/check_net.conf.with_static
@@ -0,0 +1,135 @@
+# - Configuration file for scrupts check_net.sh and netconfig.sh
+# -
+
+LOGGING_CONSOLE=false
+DEBUG=false
+
+# - Where are your scripts located?
+# -
+check_script=/usr/local/sbin/check_net.sh
+netconfig_script=/usr/local/sbin/netconfig.sh
+
+log_file=/var/log/check_net.log
+
+
+# - Put in your DSL devices (refers to your network configuration)
+# - youe wish be congigured by that script
+# -
+# - Notice:
+# -    If not using multiple default gatways, declare the list in the order of your 
+# -    preferred default gatway devices
+# -
+# -    Example:
+# -       _INITIAL_DEVICE_LIST="eth0:192.168.63.254 ppp-light"
+# -
+#_INITIAL_DEVICE_LIST="ppp-surf2 ppp-surf1 ppp-st"
+_INITIAL_DEVICE_LIST="eth9:172.16.11.254 eth11:172.16.12.254 eth10:172.16.13.254"
+
+# - Set to "false" uses "0.0.0.0" as remote gateway instead of the real address
+# -
+USE_REMOTE_GATEWAY_ADDRESS=true
+#USE_REMOTE_GATEWAY_ADDRESS=false
+
+# - Set default gw (roundrobin)
+# -
+# - !! SET_MULTIPLE_DEFAULT_GW=true does not work for now..
+# -
+SET_MULTIPLE_DEFAULT_GW=false
+#SET_MULTIPLE_DEFAULT_GW=true
+
+
+# - Set to false uses "0.0.0.0" as default gateway adress instaed of real remote address
+# -
+USE_DEFAULT_GW_ADDRESS=true
+#USE_DEFAULT_GW_ADDRESS=false
+
+
+# - Hostnames for ping test
+# -
+# - Note: The first two reachable hosts will be used for ping test. 
+# -
+# - Space separated list
+# -
+PING_TEST_HOSTS="oopen.de google.com heise.de debian.org ubuntu.com"
+
+
+admin_email=root
+from_address="check-inet-devices@`hostname -f`"
+company="GA - Schloss"
+content_type='Content-Type: text/plain;\n charset="utf-8"'
+
+
+# - rule_local_ips
+# -
+# - Add rule(s) for routing local ip-address(es) through a given extern interface
+# -
+# - Space separated list of entries '<ext-interface>:<local-ip>'
+# -    rule_local_ips="<ext-interface>:<local-ip> [<ext-interface>:<local-ip>] [.."
+# -
+# - Example:
+# - ========
+# - local ip 192.168.10.1 through extern interface ppp-st and 
+# - local ip 192.168.10.13 through extern interface ppp-surf1
+# -     rule_local_ips="ppp-st:192.168.10.1 ppp-surf1:192.168.10.13"
+# -
+rule_local_ips="eth11:192.168.10.13 eth10:192.168.10.1"
+
+# - rule_remote_ips
+# -
+# - Add rule(s) for routing remote ip-address(es) through a given extern interface
+# -
+# - Space separated list of entries '<ext-interface>:<remote-ip>'
+# -    rule_remote_ips="<ext-interface>:<remote-ip> [<ext-interface>:<remote-ip>] [.."
+# -
+# - Example:
+# - ========
+# - route remote ip-address  141.1.1.1 through extern interface ppp-ckubu and 
+# - also route ip-address 8.8.8.8 through through extern interface ppp-ckubu
+# -     rule_remote_ips="ppp-ckubu:141.1.1.1 ppp-ckubu:8.8.8.8"
+# - 
+rule_remote_ips=""
+
+# - rule_local_nets
+# -
+# - Add rule(s) for routing local networks through a given extern interface out
+# -
+# - Space separated list of entries '<extern-interface>:<local-net>'
+# -    rule_local_nets="<extern-interface>:<local-net> [<extern-interface>:<local-net>] [.."
+# -
+# -
+# - Example:
+# - ========
+# -     rule_local_nets="ppp-st:192.168.11.0/25 ppp-surf1:192.168.11.128/25"
+# -
+#rule_local_nets="ppp-surf2:192.168.11.0/25 ppp-surf2:192.168.11.128/25 ppp-surf2:192.168.10.0/25 ppp-surf1:192.168.10.128/25"
+rule_local_nets="eth9:192.168.11.0/25 eth9:192.168.11.128/25 eth9:192.168.10.0/25 eth11:192.168.10.128/25"
+
+
+
+## ====================================
+## - Don't make changes after this Line
+## ====================================
+
+# ---
+# - Add rule(s) for routing local ip-address(es)
+# ---
+declare -a rule_local_ip_arr
+for _str in $rule_local_ips ; do
+   rule_local_ip_arr+=("$_str")
+done
+
+# ---
+# - Add rule(s) for routing remote ip-address(es)
+# ---
+declare -a rule_remote_ip_arr
+for _str in $rule_remote_ips ; do
+   rule_remote_ip_arr+=("$_str")
+done
+
+# ---
+# - Add rule(s) for routing local networks
+# ---
+declare -a rule_local_net_arr
+for _str in $rule_local_nets ; do
+   rule_local_net_arr+=("$_str")
+done
diff --git a/GA-Schloss/check_net/check_net.conf.without_static b/GA-Schloss/check_net/check_net.conf.without_static
new file mode 100644
index 0000000..b46ecfa
--- /dev/null
+++ b/GA-Schloss/check_net/check_net.conf.without_static
@@ -0,0 +1,126 @@
+# - Configuration file for scrupts check_net.sh and netconfig.sh
+# -
+
+LOGGING_CONSOLE=false
+DEBUG=true
+
+# - Where are your scripts located?
+# -
+check_script=/usr/local/sbin/check_net.sh
+netconfig_script=/usr/local/sbin/netconfig.sh
+
+log_file=/var/log/check_net.log
+
+
+# - Put in your DSL devices (refers to your network configuration)
+# - youe wish be congigured by that script
+# -
+# - Notice:
+# -    If not using multiple default gatways, declare the list in the order of your 
+# -    preferred default gatway devices
+# -
+# -    Example:
+# -       _INITIAL_DEVICE_LIST="eth0:192.168.63.254 ppp-light"
+# -
+_INITIAL_DEVICE_LIST="ppp-surf2 ppp-surf1 ppp-st"
+#_INITIAL_DEVICE_LIST="eth9:172.16.11.254 ppp-surf1 ppp-st"
+
+# - Set to "false" uses "0.0.0.0" as remote gateway instead of the real address
+# -
+USE_REMOTE_GATEWAY_ADDRESS=true
+#USE_REMOTE_GATEWAY_ADDRESS=false
+
+# - Set default gw (roundrobin)
+# -
+# - !! SET_MULTIPLE_DEFAULT_GW=true does not work for now..
+# -
+SET_MULTIPLE_DEFAULT_GW=false
+#SET_MULTIPLE_DEFAULT_GW=true
+
+
+# - Set to false uses "0.0.0.0" as default gateway adress instaed of real remote address
+# -
+USE_DEFAULT_GW_ADDRESS=true
+#USE_DEFAULT_GW_ADDRESS=false
+
+
+admin_email=root
+from_address="check-inet-devices@`hostname -f`"
+company="GA - Schloss"
+content_type='Content-Type: text/plain;\n charset="utf-8"'
+
+
+# - rule_local_ips
+# -
+# - Add rule(s) for routing local ip-address(es) through a given extern interface
+# -
+# - Space separated list of entries '<ext-interface>:<local-ip>'
+# -    rule_local_ips="<ext-interface>:<local-ip> [<ext-interface>:<local-ip>] [.."
+# -
+# - Example:
+# - ========
+# - local ip 192.168.10.1 through extern interface ppp-st and 
+# - local ip 192.168.10.13 through extern interface ppp-surf1
+# -     rule_local_ips="ppp-st:192.168.10.1 ppp-surf1:192.168.10.13"
+# -
+rule_local_ips="ppp-st:192.168.10.1 ppp-surf1:192.168.10.13"
+
+# - rule_remote_ips
+# -
+# - Add rule(s) for routing remote ip-address(es) through a given extern interface
+# -
+# - Space separated list of entries '<ext-interface>:<remote-ip>'
+# -    rule_remote_ips="<ext-interface>:<remote-ip> [<ext-interface>:<remote-ip>] [.."
+# -
+# - Example:
+# - ========
+# - route remote ip-address  141.1.1.1 through extern interface ppp-ckubu and 
+# - also route ip-address 8.8.8.8 through through extern interface ppp-ckubu
+# -     rule_remote_ips="ppp-ckubu:141.1.1.1 ppp-ckubu:8.8.8.8"
+# - 
+rule_remote_ips=""
+
+# - rule_local_nets
+# -
+# - Add rule(s) for routing local networks through a given extern interface out
+# -
+# - Space separated list of entries '<extern-interface>:<local-net>'
+# -    rule_local_nets="<extern-interface>:<local-net> [<extern-interface>:<local-net>] [.."
+# -
+# -
+# - Example:
+# - ========
+# -     rule_local_nets="ppp-st:192.168.11.0/25 ppp-surf1:192.168.11.128/25"
+# -
+rule_local_nets="ppp-surf2:192.168.11.0/25 ppp-surf2:192.168.11.128/25 ppp-surf2:192.168.10.0/25 ppp-surf1:192.168.10.128/25"
+#rule_local_nets="eth9:192.168.11.0/25 eth9:192.168.11.128/25 eth9:192.168.10.0/25 ppp-surf1:192.168.10.128/25"
+
+
+
+## ====================================
+## - Don't make changes after this Line
+## ====================================
+
+# ---
+# - Add rule(s) for routing local ip-address(es)
+# ---
+declare -a rule_local_ip_arr
+for _str in $rule_local_ips ; do
+   rule_local_ip_arr+=("$_str")
+done
+
+# ---
+# - Add rule(s) for routing remote ip-address(es)
+# ---
+declare -a rule_remote_ip_arr
+for _str in $rule_remote_ips ; do
+   rule_remote_ip_arr+=("$_str")
+done
+
+# ---
+# - Add rule(s) for routing local networks
+# ---
+declare -a rule_local_net_arr
+for _str in $rule_local_nets ; do
+   rule_local_net_arr+=("$_str")
+done
diff --git a/GA-Schloss/cron_root.GA-Schloss b/GA-Schloss/cron_root.GA-Schloss
new file mode 100644
index 0000000..5f7ffd9
--- /dev/null
+++ b/GA-Schloss/cron_root.GA-Schloss
@@ -0,0 +1,46 @@
+# DO NOT EDIT THIS FILE - edit the master and reinstall.
+# (/tmp/crontab.TA9geJ/crontab installed on Tue Mar 20 13:20:07 2018)
+# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
+# Edit this file to introduce tasks to be run by cron.
+# 
+# Each task to run has to be defined through a single line
+# indicating with different fields when the task will be run
+# and what command to run for the task
+# 
+# To define the time you can provide concrete values for
+# minute (m), hour (h), day of month (dom), month (mon),
+# and day of week (dow) or use '*' in these fields (for 'any').# 
+# Notice that tasks will be started based on the cron's system
+# daemon's notion of time and timezones.
+# 
+# Output of the crontab jobs (including errors) is sent through
+# email to the user the crontab file belongs to (unless redirected).
+# 
+# For example, you can run a backup of all your user accounts
+# at 5 a.m every week with:
+# 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/
+# 
+# For more information see the manual pages of crontab(5) and cron(8)
+# 
+# m h  dom mon dow   command
+
+PATH=/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+
+# - Save gateway configuration
+# -
+09 3 * * * /root/bin/manage-gw-config/copy_gateway-config.sh GA-Schloss
+
+
+# - Check if postfix mailservice is running. Restart service if needed
+# -
+*/15 * * * * /root/bin/monitoring/check_postfix.sh
+
+# - Check forwarding ( /proc/sys/net/ipv4/ip_forward contains "1" )
+# - if not set this entry to "1"
+# -
+0-59/2 * * * * /root/bin/monitoring/check_forwarding.sh
+
+# - check if openvpn is running if not restart the service
+# -
+0-59/30 * * * * /root/bin/monitoring/check_vpn.sh
diff --git a/GA-Schloss/default_isc-dhcp-server.GA-Schloss b/GA-Schloss/default_isc-dhcp-server.GA-Schloss
new file mode 100644
index 0000000..c16b24e
--- /dev/null
+++ b/GA-Schloss/default_isc-dhcp-server.GA-Schloss
@@ -0,0 +1,22 @@
+# Defaults for isc-dhcp-server initscript
+# sourced by /etc/init.d/isc-dhcp-server
+# installed at /etc/default/isc-dhcp-server by the maintainer scripts
+
+#
+# This is a POSIX shell fragment
+#
+
+# Path to dhcpd's config file (default: /etc/dhcp/dhcpd.conf).
+#DHCPD_CONF=/etc/dhcp/dhcpd.conf
+
+# Path to dhcpd's PID file (default: /var/run/dhcpd.pid).
+#DHCPD_PID=/var/run/dhcpd.pid
+
+# Additional options to start dhcpd with.
+#	Don't use options -cf or -pf here; use DHCPD_CONF/ DHCPD_PID instead
+#OPTIONS=""
+
+# On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
+#	Separate multiple interfaces with spaces, e.g. "eth0 eth1".
+#INTERFACESv4="bond1 bond0.77 bond0.78 bond1:ap"
+INTERFACESv4="bond1 bond0.77 bond0.78 bond1.121"
diff --git a/GA-Schloss/dhcpd.conf.GA-Schloss b/GA-Schloss/dhcpd.conf.GA-Schloss
new file mode 100644
index 0000000..5c5a947
--- /dev/null
+++ b/GA-Schloss/dhcpd.conf.GA-Schloss
@@ -0,0 +1,1792 @@
+#
+# Sample configuration file for ISC dhcpd for Debian
+#
+#
+
+# The ddns-updates-style parameter controls whether or not the server will
+# attempt to do a DNS update when a lease is confirmed. We default to the
+# behavior of the version 2 packages ('none', since DHCP v2 didn't
+# have support for DDNS.)
+ddns-update-style none;
+
+# option definitions common to all supported networks...
+
+option routers 192.168.11.254;
+option subnet-mask 255.255.255.0;
+option broadcast-address 192.168.11.255;
+
+option domain-name "ga.intra";
+option domain-name-servers 192.168.11.3, 192.168.10.3 ;
+option netbios-name-servers 192.168.11.3;
+option ntp-servers          192.168.11.254;
+
+default-lease-time 43200;
+max-lease-time 259200;
+
+# If this DHCP server is the official DHCP server for the local
+# network, the authoritative directive should be uncommented.
+#authoritative;
+authoritative;
+
+# Use this to send dhcp log messages to a different log file (you also
+# have to hack syslog.conf to complete the redirection).
+log-facility local7;
+
+# No service will be given on this subnet, but declaring it helps the 
+# DHCP server to understand the network topology.
+
+subnet 192.168.11.0 netmask 255.255.255.0 {
+
+   # --- 192.168.11.128/26 ---
+   # network address....: 192.168.11.128
+   # Broadcast address..: 192.168.11.191
+   # netmask............: 255.255.255.128
+   # network range......: 192.168.11.128 - 192.168.11.191
+   # Usable range.......: 192.168.11.129 - 192.168.11.190
+
+   # möglich bis 192.168.11.240 incl.
+
+   option routers 192.168.11.254;
+   option subnet-mask 255.255.255.0;
+   option broadcast-address 192.168.11.255;
+
+   option domain-name "ga.intra";
+   option domain-name-servers 192.168.11.3, 192.168.10.3;
+   #option domain-name-servers 192.168.11.254;
+   option netbios-name-servers 192.168.11.3;
+   option ntp-servers          192.168.11.254;
+
+   #next-server 192.168.11.20;        # address of the telephone system
+   next-server 192.168.10.20;        # address of the telephone system
+  filename "Alcatel";               # filename getting from telephone system
+
+   default-lease-time 86400;
+   max-lease-time 259200;
+
+   # !! 
+   # Known clients are simply clients with host declaration
+   # !!
+
+   # Unknown clients get this pool.
+   pool {
+      default-lease-time 3600 ;
+      max-lease-time 10800 ;
+      range 192.168.11.193 192.168.11.220;
+      deny known-clients;
+      allow unknown-clients;
+   }
+
+   # Known clients with "fixed-address" must be NOT IN the pool range NEITHER IN subnet range.
+
+   ## Known clients without "fixed-address" get this pool.
+   #pool {
+   #   max-lease-time 259200;
+   #   range 192.168.11.1 192.168.11.191 ;
+   #   deny unknown-clients;
+   #   allow known-clients;
+   #}
+
+}
+
+#### SERVER ####
+
+## Host GAASESX4 (Backupserver) - Torwärterhaus Keller (Büro Lassek)
+#host GAASESX4 {
+#   hardware ethernet 00:24:8c:76:f4:ab ;
+#   fixed-address  192.168.11.2 ; hat jetzt die 10.10.11.2
+#}
+
+## Host ga-st-lsx1 (auf ga-st-kvm1) - Linux Dienste Server
+host ga-st-lsx1 {
+   hardware ethernet 52:54:00:ff:71:19 ;
+   fixed-address  192.168.11.2 ; 
+}
+
+## Server ga-st-dc (Domaincontroller Sockhausen) - Notstromraum
+## --- static ---
+#host ga-st-dc3 {
+#   hardware ethernet 52:54:00:4c:44:24 ;
+#   fixed-address  192.168.11.3 ;
+#}
+
+## Server ga-st-fs2 (Fileserver) - Notstromraum (st-kvm1)
+## --- static ---
+#host ga-st-fs2 {
+#   hardware ethernet 52:54:00:b8:cb:d3 ;
+#   fixed-address  192.168.11.4 ;
+#}
+
+## Server ga-it-wiki (Wiki für die IT-Abteilung) - Notstromraum (GAASESX2)
+host ga-it-wiki {
+   hardware ethernet 52:54:00:32:ad:f8 ;
+   fixed-address  192.168.11.5 ;
+}
+
+## Server ga-st-ks1 (Kameraserver Stockhausen Win10)
+## --- static ---
+#host ga-st-ks1win10 {
+#   hardware ethernet 52:54:00:4b:3b:46 ;
+#   fixed-address  192.168.11.6 ;
+#}
+
+## Server GAASBS03 (Backupserver Stockhausen) - GAASESX4
+host GAASBS02 {
+   hardware ethernet 00:0c:29:18:38:cf ;
+   fixed-address  192.168.11.7 ;
+}
+
+## Server ga-st-ds2 (Neuer Diensteserver (WSUS))- Notstromraum (ga-st-kvm1)
+## --- static ---
+#host ga-st-ds2 {
+#   hardware ethernet 52:54:00:b2:c9:00 ;
+#   fixed-address  192.168.11.8 ;
+#}
+
+#### DRUCKER ####
+
+## Drucker GA12DRDEL01 (Drucker (Dell 1135n Laser MFP)) - Lädchen für alles
+host GA12DRDEL01 {
+   hardware ethernet 00:15:99:a0:3e:a0 ;
+   fixed-address  192.168.11.9 ;
+}
+
+## Drucker EPSONBX535WD (Drucker (Epson BX535WD)) - Hopfengarten Büro
+host EPSONBX535WD {
+   hardware ethernet 00:26:ab:70:72:dd ;
+   fixed-address  192.168.11.10 ;
+}
+
+## Drucker GA14DRLEX01 (Drucker (Lexmark X860)) - Alte Schmiede (Leasing Schäfer)
+host GA14DRLEX01 {
+   hardware ethernet 00:21:b7:d8:29:35 ;
+   fixed-address  192.168.11.11 ;
+}
+
+## Drucker DELL8F9A32 (Drucker (Dell C1760nw)) - Alte Schmiede (Tobias Rädler)
+host DELL8F9A32 {
+   hardware ethernet 08:00:37:c4:86:30 ;
+   fixed-address  192.168.11.12 ;
+}
+
+## Drucker SHARP MX-3610N (Mulitifunktionsgerät) - Torwärterhaus (Alte Schmiede)
+host sharp-mx-4500n {
+   hardware ethernet 68:79:ed:75:01:2f ;
+   fixed-address  192.168.11.13 ;
+}
+
+## Drucker EPSON105321 (Drucker (Epson WF-3520DWF) - Wollwerkstatt
+host GA14DREP01 {
+   hardware ethernet b0:e8:92:10:53:21 ;
+   fixed-address  192.168.11.14 ;
+}
+
+## Drucker DELL B1260dn - Welzhaus
+host ga13drdel01 {
+   hardware ethernet 00:15:99:e0:7b:4d ;
+   fixed-address  192.168.11.15 ;
+}
+
+## Drucker Samsung M2835DW - Schloss Süd unten
+host ga17drsam01 {
+   hardware ethernet 30:cd:a7:f0:08:2e ;
+   fixed-address  192.168.11.16 ;
+}
+
+## Drucker Lexmark C935 - Welzhhof (Öffentlichkeitsarbeit Ulrike)
+#host ET0004009A7F00 {
+#   hardware ethernet 00:04:00:9a:7f:00 ;
+#   fixed-address  192.168.11.17 ;
+#}
+
+## Drucker Samsung - Hausmeisterei
+## ehemals Michael privat
+host ga-st-dr1801 {
+   hardware ethernet 00:15:99:71:2e:f0 ;
+   fixed-address  192.168.11.18 ;
+}
+
+## Host gw-ersatz (Host kann im Notfall einen der drei Gateways ersetzten)
+host gw-ersatz {
+   hardware ethernet a0:36:9f:a0:64:78;
+   fixed-address 192.168.11.19;
+}
+
+#### Begin TK-ANLAGE ####
+
+## TK-Anlage Stockhausen
+#host ??? {
+#   hardware ethernet 00:80:9f:70:d2:c8 ;
+#   fixed-address  192.168.11.20 ;
+#}
+
+## TK-Anlage Stockhausen
+#host ??? {
+#   hardware ethernet  ;
+#   fixed-address  192.168.11.21 ;
+#}
+
+#### Ende TK-ANLAGE ####
+
+## ga-st-kotk (Windows 10 VM zur Konfiguration der TK-Anlagen)
+host ga-st-tk-mgmt {
+   hardware ethernet 00:0c:29:27:0e:e4 ;
+   fixed-address 192.168.11.23 ;
+}
+
+#### Verschiedenes ####
+## Drucker HP Color Laserjet Pro MFP M177fw (ehemals Wiesenbhaus)
+host ga-st-dr1601 {
+   hardware ethernet 48:0f:cf:cb:f8:47 ;
+   fixed-address  192.168.11.28 ;
+}
+
+#### ETA Heizkessel ####
+## - ETA Pellet Heizkessel 
+## - Standort: Stockhausen Welzhof (ehemals Stall)
+## - Datum: 20.12.2016
+## - 
+host st-eta-kessel {
+   hardware ethernet 00:24:96:01:8c:f0;
+   fixed-address 192.168.11.29;
+}
+
+## --- Telefone 192.168.11.33 - 192.168.11.126
+## ---
+## ---    --- 192.168.11.32/27 ---
+## ---    Addresses..........: 32
+## ---    Network range......: 192.168.11.32 - 192.168.11.63
+## ---    Usable range.......: 192.168.11.33 - 192.168.11.62
+## ---
+## ---    --- 192.168.11.64/26 ---
+## ---    Addresses..........: 64
+## ---    Network range......: 192.168.11.64 - 192.168.11.127
+## ---    Usable range.......: 192.168.11.65 - 192.168.11.126
+
+## - Telefon Nr.: 685
+## -    Ort:  Stockhausen - Tegut
+## -    Name: Tegut Lädchen
+## -
+host tel-685 {
+   hardware ethernet 00:80:9f:62:8e:8f ;
+   fixed-address 192.168.11.33 ;
+}
+
+## - Telefon Nr.: 160
+## -    Ort:  Stockhausen - Schlossstrasse
+## -    Name: Hausmeister
+## -
+host tel-160 {
+   hardware ethernet 00:80:9f:85:0a:bb ;
+   fixed-address 192.168.11.34 ;
+}
+
+## - Telefon Nr.: 690
+## -    Ort:  Stockhausen - Welzhof
+## -    Name: Ulrike
+## -
+host tel-690 {
+   hardware ethernet 00:80:9f:62:ec:29 ;
+   fixed-address 192.168.11.35 ;
+}
+
+## - Telefon Nr.: 164
+## -    Ort:  Stockhausen - IT Büro
+## -    Name: Wolfgang
+## -
+host tel-164 {
+   hardware ethernet 00:80:9f:62:ec:2d ;
+   fixed-address 192.168.11.36 ;
+}
+
+## - Telefon Nr.: 362
+## -    Ort:  Stockhausen - Gutshaus
+## -    Name: GH Büro
+## -
+## - bisherige IPv4-Adresse: 192.168.11.97
+## -
+host tel-362 {
+   hardware ethernet 00:80:9f:62:8e:5b ;
+   fixed-address 192.168.11.37 ;
+}
+
+## - Telefon Nr.: 340
+## -    Ort:  Stockhausen - HG
+## -    Name: Hopfengarten
+## -
+## - bisherige IPv4-Adresse: 192.168.11.99
+## -
+host tel-340 {
+   hardware ethernet 00:80:9f:62:8e:87 ;
+   fixed-address 192.168.11.38 ;
+}
+
+## - Telefon Nr.: 490
+## -    Ort:  Stockhausen - Gelbes Haus
+## -    Name: Inge Osthaus
+## -
+## - bisherige IPv4-Adresse: 192.168.11.100
+## -
+host tel-490 {
+   hardware ethernet 00:80:9f:85:c7:a8 ;
+   fixed-address 192.168.11.39 ;
+}
+
+## - Telefon Nr.: 480
+## -    Ort:  Stockhausen - Gelbes Haus
+## -    Name: Bosselmann
+## -
+## - bisherige IPv4-Adresse: 192.168.11.101
+## -
+host tel-480 {
+   hardware ethernet 00:80:9f:62:8e:98 ;
+   fixed-address 192.168.11.40 ;
+}
+
+## - SSüd oben (Büro)
+## - Telefon Nr.: 432
+## -    Ort:  Stockhausen - SSüd oben
+## -    Name: SSüd oben Büro
+## -
+host tel-432 {
+   hardware ethernet 00:80:9f:62:8e:8d ;
+   fixed-address 192.168.11.41 ;
+}
+
+## - Telefon Nr.: 341
+## -    Ort:  Stockhausen - HG
+## -    Name: Corinna privat
+## -
+## - bisherige IPv4-Adresse: 192.168.11.102
+## -
+host tel-341 {
+   hardware ethernet 00:80:9f:86:c8:20 ;
+   fixed-address 192.168.11.42 ;
+}
+
+## - Telefon Nr.: 481
+## -    Ort:  Stockhausen - Gelbes Haus
+## -    Name: Bosselm SchlafZi
+## -
+## - bisherige IPv4-Adresse: 192.168.11.144
+## -
+host tel-481 {
+   hardware ethernet 00:80:9f:62:8e:77 ;
+   fixed-address 192.168.11.43 ;
+}
+
+## - Telefon Nr.: 750
+## -    Ort:  Stockhausen - Welzhaus
+## -    Name: Welzhaus
+## -
+host tel-750 {
+   hardware ethernet 00:80:9f:ac:58:77 ;
+   fixed-address 192.168.11.44 ;
+}
+
+## - Telefon Nr.: 710
+## -    Ort:  Stockhausen - Campus
+## -    Name: Campus Pierre
+## -
+## - bisherige IPv4-Adresse: 192.168.11.103
+## -
+host tel-710 {
+   hardware ethernet 00:80:9f:62:8e:9b ;
+   fixed-address 192.168.11.45 ;
+}
+
+## - Telefon Nr.: 359
+## -    Ort:  Stockhausen - HG
+## -    Name: Carmen Kreutzer
+## -
+host tel-359 {
+   hardware ethernet 00:80:9f:62:8e:5f ;
+   fixed-address 192.168.11.46 ;
+}
+
+## - Telefon Nr.: 150
+## -    Ort:  Stockhausen - Verwaltung
+## -    Name: Büro Stockhausen
+## -
+## - bisherige IPv4-Adresse: 192.168.11.104
+## -
+host tel-150 {
+   hardware ethernet 00:80:9f:62:8e:71 ;
+   fixed-address 192.168.11.47 ;
+}
+
+## - Telefon Nr.: 660
+## -    Ort:  Stockhausen - Park
+## -    Name: Parkpflege
+## -
+## - bisherige IPv4-Adresse: 192.168.11.105
+## -
+host tel-660 {
+   hardware ethernet 00:80:9f:62:8e:6f ;
+   fixed-address 192.168.11.48 ;
+}
+
+## - Telefon Nr.: 486
+## -    Ort:  Haus am Park
+## -    Name: Olhaver
+## -    Ersatz wegen defekter Zweidraht-Leitung von 485
+## -
+host tel-486 {
+   hardware ethernet 00:80:9f:62:8e:6c ;
+   fixed-address 192.168.11.49 ;
+}
+
+## - Telefon Nr.: 421
+## -    Ort:  Stockhausen - Schloss Süd unten
+## -    Name: SSü Wohnzimmer
+## -
+## - bisherige IPv4-Adresse: 192.168.11.114
+## -
+host tel-421 {
+   hardware ethernet 00:80:9f:62:8e:69 ;
+   fixed-address 192.168.11.50 ;
+}
+
+## - Telefon Nr.: 427
+## -    Ort:  Stockhausen - Schloss Süd unten
+## -    Name: Astrid Büro
+## -
+## - bisherige IPv4-Adresse: 192.168.11.118
+## -
+host tel-427 {
+   hardware ethernet 00:80:9f:c6:b3:68 ;
+   fixed-address 192.168.11.51 ;
+}
+
+## - Telefon Nr.: 363
+## -    Ort:  Stockhausen - Gutshaus
+## -    Name: GH kleine Gruppe
+## -
+## - bisherige IPv4-Adresse: 192.168.11.121
+## -
+host tel-363 {
+   hardware ethernet 00:80:9f:62:8e:80 ;
+   fixed-address 192.168.11.52 ;
+}
+
+## - Telefon Nr.: 159
+## -    Ort:  Stockhausen - Verwaltung
+## -    Name: Yvonne Jäger
+## -
+## - bisherige IPv4-Adresse: 192.168.11.122
+## -
+host tel-159 {
+   hardware ethernet 00:80:9f:68:65:d3 ;
+   fixed-address 192.168.11.53 ;
+}
+
+## - Telefon Nr.: 439
+## -    Ort:  Stockhausen - Schloss Süd oben
+## -    Name: Lungu/Leicht
+## -
+## - bisherige IPv4-Adresse: 192.168.11.128
+## -
+host tel-439 {
+   hardware ethernet 00:80:9f:62:8e:7f ;
+   fixed-address 192.168.11.54 ;
+}
+
+## - Telefon Nr.: 496
+## -    Ort:  Stockhausen - Gelbes Haus
+## -    Name: Jöckel/Schmidl
+## -
+## - bisherige IPv4-Adresse: 192.168.11.134
+## -
+host tel-496 {
+   hardware ethernet 00:80:9f:85:00:9d ;
+   fixed-address 192.168.11.55 ;
+}
+
+## - Telefon Nr.: 151
+## -    Ort:  Stockhausen - Verwaltung
+## -    Name: Büro Lassek 2
+## -
+## - bisherige IPv4-Adresse: 192.168.11.135
+## -
+host tel-151 {
+   hardware ethernet 00:80:9f:62:8e:6d ;
+   fixed-address 192.168.11.56 ;
+}
+
+## - Telefon Nr.: 342
+## -    Ort:  Stockhausen - HG
+## -    Name: HG Büro
+## -
+host tel-342 {
+   hardware ethernet 00:80:9f:c5:e9:82 ;
+   fixed-address 192.168.11.57 ;
+}
+
+## - Telefon Nr.: 429
+## -    Ort:  Stockhausen - Schloss Süd unten
+## -    Name: Heidi Oeser
+## -
+## - bisherige IPv4-Adresse: 192.168.11.136
+## -
+host tel-429 {
+   hardware ethernet 00:80:9f:bb:a8:1c ;
+   fixed-address 192.168.11.58 ;
+}
+
+## - Telefon Nr.: 753
+## -    Ort:  Stockhausen - Welzhaus
+## -    Name: Erwin
+## -
+host tel-753 {
+   hardware ethernet 00:80:9f:ac:58:9e ;
+   fixed-address 192.168.11.59 ;
+}
+
+## - Telefon Nr.: 436
+## -    Ort:  Stockhausen - Schloss Süd oben
+## -    Name: Elisabeth v Heyl
+## -
+host tel-436 {
+   hardware ethernet 00:80:9f:62:8e:61 ;
+   fixed-address 192.168.11.60 ;
+}
+
+## - Telefon Nr.: 670
+## -    Ort:  Stockhausen - Wolle
+## -    Name: Wollwerkstatt
+## -
+host tel-670 {
+   hardware ethernet 00:80:9f:62:8e:78 ;
+   fixed-address 192.168.11.61 ;
+}
+
+## - Telefon Nr.: 482
+## -    Ort:  Stockhausen - Gelbes Haus
+## -    Name: Bosselm Büro
+## -
+## - bisherige IPv4-Adresse: 192.168.11.138
+## -
+host tel-482 {
+   hardware ethernet 00:80:9f:85:00:e2 ;
+   fixed-address 192.168.11.62 ;
+}
+
+## - Telefon Nr.: 158
+## -    Ort:  Stockhausen - Geschäftsleitung
+## -    Name: Tobias Raedler
+## -
+## - bisherige IPv4-Adresse: 192.168.11.143
+## -
+host tel-158 {
+   hardware ethernet 00:80:9f:8d:8c:99 ;
+   fixed-address 192.168.11.63 ;
+}
+
+## - Telefon Nr.: 650
+## -    Ort:  Stockhausen - Garten
+## -    Name: Gärtnerei Büro
+## -
+host tel-650 {
+   hardware ethernet 00:80:9f:ca:fd:f2 ;
+   fixed-address 192.168.11.64 ;
+}
+
+## - Telefon Nr.: 163
+## -    Ort:  Stockhausen - Schlossstrasse
+## -    Name: Hausmeister
+## -
+host tel-163 {
+   hardware ethernet 00:80:9f:62:8f:6d ;
+   fixed-address 192.168.11.65 ;
+}
+
+## - Telefon Nr.: 358
+## -    Ort:  Stockhausen - HG
+## -    Name: Wolfgang
+## -
+host tel-358 {
+   hardware ethernet 00:80:9f:62:8e:68 ;
+   fixed-address 192.168.11.66 ;
+}
+
+## - Telefon Nr.: 754
+## -    Ort:  Stockhausen - Welzhaus
+## -    Name: Barbara Hammerma
+## -
+host tel-754 {
+   hardware ethernet 00:80:9f:62:8e:62 ;
+   fixed-address 192.168.11.67 ;
+}
+
+## - Telefon Nr.: 495
+## -    Ort:  Stockhausen - Gelbes Haus
+## -    Name: Harald Schmidl
+## -
+host tel-495 {
+   hardware ethernet 00:80:9f:ac:58:56 ;
+   fixed-address 192.168.11.68 ;
+}
+
+## - Telefon Nr.: 419
+## -    Ort:  Stockhausen - Snord
+## -    Name: SN Fröhner priv.
+## -
+host tel-419 {
+   hardware ethernet 00:80:9f:62:8e:84 ;
+   fixed-address 192.168.11.69 ;
+}
+
+## - Telefon Nr.: 725
+## -    Ort:  Campus - Schmitz
+## -    Name: Schmitz Küche
+## -
+host tel-725 {
+   hardware ethernet 00:80:9f:62:8e:8c ;
+   fixed-address 192.168.11.70 ;
+}
+
+## - Telefon Nr.: 726
+## -    Ort:  Campus - Schmitz
+## -    Name: Schmitz Theke
+## -
+host tel-726 {
+   hardware ethernet 00:80:9f:d4:11:3c ;
+   fixed-address 192.168.11.71 ;
+}
+
+
+## - Telefon Nr.: 154
+## -    Ort:  Stockhausen - Feriengruppe Campus
+## -    Name: Feriengr. Campus
+## -
+## -
+host tel-154 {
+   hardware ethernet 00:80:9f:8d:8c:bd ;
+   fixed-address 192.168.11.72 ;
+}
+
+## - Telefon Nr.: 720
+## -    Ort:  Stockhausen - Campus
+## -    Name: Campus Verwalt.2
+## -
+host tel-720 {
+   hardware ethernet 00:80:9f:5e:f5:c8 ;
+   fixed-address 192.168.11.73 ;
+}
+
+## - Telefon Nr.: 751
+## -    Ort:  Stockhausen - Campus
+## -    Name: Gaestehaus Zimmer 1
+## -
+host tel-715 {
+   hardware ethernet 00:80:9f:bb:a8:67 ;
+   fixed-address 192.168.11.74 ;
+}
+
+## - Telefon Nr.: 680
+## -    Ort:  Stockhausen - Kontiki
+## -    Name: Kontiki
+## -
+host tel-680 {
+   hardware ethernet 00:80:9f:62:8e:75 ;
+   fixed-address 192.168.11.75 ;
+}
+## - Telefon Nr.: 751
+## -    Ort:  Stockhausen - Welzhaus
+## -    Name: Tröber, Sabine
+## -    Typ:  Octophon IP 130
+## -
+## - bisherige IPv4-Adresse: 192.168.10.85
+## -
+host tel-751 {
+   hardware ethernet 00:80:9f:88:a4:64 ;
+      fixed-address 192.168.11.76 ;
+}
+
+## - Telefon Nr.: 770
+## -    Ort:  Stockhausen - Schlossstraße
+## -    Name: Schlossstraße
+## -
+## - bisherige IPv4-Adresse: 192.168.11.155
+## -
+host tel-770 {
+   hardware ethernet 00:80:9f:62:c5:77 ;
+   fixed-address 192.168.11.77 ;
+}
+
+## -  Telefon Nr.: 437
+## -     Ort: Stockhausen - Schloss Sued oben
+## -     Name: Ssüd oben Gast
+## - 
+host tel-437 {
+   hardware ethernet 00:80:9f:62:8e:85 ;
+   fixed-address 192.168.11.78 ;
+}
+
+## - Telefon Nr.: 700
+## -    Ort:  Stockhausen - Campus
+## -    Name: Campus Verwalt.1
+## -
+host tel-700 {
+   hardware ethernet 00:80:9f:62:8e:93 ;
+   fixed-address 192.168.11.79 ;
+}
+
+## - Telefon Nr.: 675
+## -    Ort:  Stockhausen - Geschäftsleitung
+## -    Name: Chr. Bachmann
+## -
+host tel-675 {
+   hardware ethernet 00:80:9f:62:8e:67 ;
+   fixed-address 192.168.11.80 ;
+}
+
+## - Telefon Nr.: 420
+## -    Ort:  Stockhausen - Ssued
+## -    Name: Ssü unten Wohnb.
+## -
+host tel-420 {
+   hardware ethernet 00:80:9f:8d:8c:a2 ;
+   fixed-address 192.168.11.81 ;
+}
+
+## - Telefon Nr.: 166 (zum Testen)
+## -    Ort:  Stockhausen - IT Büro
+## -    Name: IT Sekretaer
+## -
+host tel-166 {
+   hardware ethernet 48:7a:55:03:05:c5 ;
+   fixed-address 192.168.11.82 ;
+}
+
+## - Telefon Nr.: 430
+## -    Ort:  Stockhausen - Ssued
+## -    Name: Ssü oben Wohnb.
+## -
+host tel-430 {
+   hardware ethernet 00:80:9f:ac:58:5c ;
+   fixed-address 192.168.11.83 ;
+}
+
+## - Telefon Nr.: 402
+## -    Ort:  Stockhausen - Snord
+## -    Name: SNord Büro
+## -
+host tel-402 {
+   hardware ethernet 00:80:9f:62:8e:65 ;
+   fixed-address 192.168.11.84 ;
+}
+
+## - Telefon Nr.: 665
+## -    Ort:  Stockhausen - Brennholz
+## -    Name: Brennholzwerkst.
+## -
+host tel-665 {
+   hardware ethernet 00:80:9f:88:a3:25 ;
+   fixed-address 192.168.11.85 ;
+}
+
+## - Telefon Nr.: 157
+## -    Ort:  Stockhausen - Geschäftsleitung
+## -    Name: Baubüro MFischer
+## -
+host tel-157 {
+   hardware ethernet 00:80:9f:85:00:dc ;
+   fixed-address 192.168.11.86 ;
+}
+
+## - Telefon Nr.: 424
+## -    Ort:  Stockhausen - Ssued
+## -    Name: Dienstz. Schloss
+## -
+host tel-424 {
+   hardware ethernet 00:80:9f:ba:98:2f ;
+   fixed-address 192.168.11.87 ;
+}
+
+## - Telefon Nr.: 757
+## -    Ort:  Stockhausen - Welzhaus
+## -    Name: Anne Kleinhans
+## -
+host tel-757 {
+   hardware ethernet 00:80:9f:c5:e9:7f ;
+   fixed-address 192.168.11.88 ;
+}
+
+## - Telefon Nr.: 666
+## -    Ort:  Stockhausen - Brennholz
+## -    Name: Brennh/Park Büro
+## -
+host tel-666 {
+   hardware ethernet 00:80:9f:62:8e:72 ;
+   fixed-address 192.168.11.89 ;
+}
+
+## - Telefon Nr.: 364
+## -    Ort:  Stockhausen - Gutshaus
+## -    Name: GH Sophie
+## -
+host tel-364 {
+   hardware ethernet 00:80:9f:62:8e:79 ;
+   fixed-address 192.168.11.90 ;
+}
+
+## - Telefon Nr.: 727
+## -    Ort:  Stockhausen - Schmitz IP-AB Wandler
+## -    Name: Campus Schmitz mobil
+## -
+#host tel-727 {
+#   hardware ethernet ??? ;
+#   fixed-address 192.168.11.91 ;
+#}
+
+## - Telefon Nr.: 165
+## -    Ort: Stockhausen - Notstromraum (Server)
+## -    Name: Serverraum
+## - 
+host tel-165 {
+   hardware ethernet 00:80:9f:d3:5c:be ;
+   fixed-address 192.168.11.92 ;
+}
+
+## - Telefon Nr.: 360
+## -    Ort:  Stockhausen - Gutshaus
+## -    Name: Gutshaus Whg.
+## -
+host tel-360 {
+#   hardware ethernet 00:80:9f:62:8e:99 ;
+   hardware ethernet 00:80:9f:ac:58:65 ;
+   fixed-address 192.168.11.93 ;
+}
+
+## - Telefon Nr.: 156
+## -    Ort:  Stockhausen - Almut König (Kulturbeauftragte)
+## -    Name: Almut König
+## -
+host tel-156 {
+   hardware ethernet 00:80:9f:62:8e:99 ;
+   fixed-address 192.168.11.94 ;
+}
+
+
+## - Telefon Nr.: 378
+## -    Ort:  Stockhausen - Gutshaus
+## -    Name: GH Müller Büro
+## -
+host tel-378 {
+   hardware ethernet 00:80:9f:62:8e:96 ;
+   fixed-address 192.168.11.95 ;
+}
+
+## - Telefon Nr.: 152
+## -    Ort:  Stockhausen - Alte Schmiede
+## -    Name: Konferenzraum
+## -
+host tel-152 {
+   hardware ethernet 00:80:9f:e4:ad:46 ;
+   fixed-address 192.168.11.96 ;
+}
+
+## - ehemals Tel. 436 Elisabeth v. Heyl
+
+## - Telefon Nr.: 379
+## -    Ort:  Stockhausen - Gutshaus
+## -    Name: GH Müller privat
+## -
+host tel-379 {
+   hardware ethernet 00:80:9f:62:8e:9c ;
+   fixed-address 192.168.11.97 ;
+}
+
+## - Telefon Nr.: 365
+## -    Ort:  Stockhausen - Gutshaus
+## -    Name: GH Seminarist
+## -
+## - bisherige IPv4-Adresse: 192.168.11.151
+## -
+host tel-365 {
+   hardware ethernet 00:80:9f:62:8e:9d ;
+   fixed-address 192.168.11.98 ;
+}
+
+## ---
+## --- Server (temporaer)
+## ---
+## Server GAASBS01 (Ersatz-Backupserver Stockhausen) - GASTESX3
+host GAASBS01 {
+   hardware ethernet 00:50:56:97:3b:28 ;
+   fixed-address  192.168.11.107 ;
+}
+
+## ---
+## --- Rechner 192.168.11.129 192.168.11.191
+## ---
+## ---    --- 192.168.11.128/26 ---
+## ---    Addresses..........: 64
+## ---    Network range......: 192.168.11.128 - 192.168.11.191
+## ---    Usable range.......: 192.168.11.129 - 192.168.11.190
+
+## - Rechner Nr.: 129
+## -    Ort:  Stockhausen - tegut
+## -    Name: GA12WKS26
+## -
+## - bisherige IPv4-Adresse: 192.168.11.205
+## - static -
+#host ga-st-cl1226 {
+#   hardware ethernet 78:2b:cb:b4:64:ba ;
+#   fixed-address 192.168.11.129 ;
+#}
+
+## - Rechner Nr.: 130
+## -    Ort:  Stockhausen - Öffentlichkeit
+## -    Name: GA13WKS01
+## -
+## - bisherige IPv4-Adresse: 192.168.11.210
+## -
+host Desktop-GA13WKS01 {
+   hardware ethernet 78:45:C4:38:9C:9F ;
+   fixed-address 192.168.11.130 ;
+}
+
+## - Rechner Nr.: 131
+## -    Ort:  Stockhausen - Wollwerkstatt
+## -    Name: GA12WKS31
+## -
+## - bisherige IPv4-Adresse: 192.168.11.206
+## -
+host Desktop-GA12WKS31 {
+   hardware ethernet 00:1a:6b:4e:0f:a3 ;
+   fixed-address 192.168.11.131 ;
+}
+
+## - Rechner Nr.: 132
+## -    Ort:  Stockhausen - Schloss Nord
+## -    Name: GA15WKS03
+## -
+## - bisherige IPv4-Adresse: 192.168.11.207
+## -
+host Desktop-GA15WKS03 {
+   hardware ethernet 00:01:2e:00:9e:25 ;
+   fixed-address 192.168.11.132 ;
+}
+
+## - Rechner Nr.: 133
+## -    Ort:  Stockhausen - Öffentlichkeit
+## -    Name: GA10WKS08
+## -
+## - bisherige IPv4-Adresse: 192.168.11.109
+## -
+host Desktop-GA10WKS08 {
+   hardware ethernet 00:26:9E:37:AF:92 ;
+   fixed-address 192.168.11.133 ;
+}
+
+## - Rechner Nr.: 134
+## -    Ort:  Stockhausen - Gutshaus
+## -    Name: GA08WKS32
+## -
+## - bisherige IPv4-Adresse: 192.168.11.110
+## -
+host Desktop-GA08WKS32 {
+   hardware ethernet 00:1F:C6:B6:BC:8E ;
+   fixed-address 192.168.11.134 ;
+}
+
+## - Rechner Nr.: 135
+## -    Ort:  Stockhausen - Brennholz
+## -    Name: GA14WKS03
+## -
+## - bisherige IPv4-Adresse: 192.168.11.130
+## -
+host Desktop-GA14WKS03 {
+   hardware ethernet 00:01:2E:4F:F2:F9 ;
+   fixed-address 192.168.11.135 ;
+}
+
+## - Rechner Nr.: 136
+## -    Ort:  Stockhausen - Hopfengarten
+## -    Name: GA12WKS29
+## -
+## - bisherige IPv4-Adresse: 192.168.11.131
+## -
+host Desktop-GA12WKS29 {
+   hardware ethernet 00:01:2E:3A:43:05 ;
+   fixed-address 192.168.11.136 ;
+}
+
+## - Rechner Nr.: 137
+## -    Ort:  Stockhausen - IT
+## -    Name: GA13WKS03
+## -
+## - bisherige IPv4-Adresse: 192.168.11.142
+## -
+host Desktop-GA13WKS03 {
+   hardware ethernet C8:1F:66:05:51:09 ;
+   fixed-address 192.168.11.137 ;
+}
+
+## - Rechner Nr.: 138
+## -    Ort:  Stockhausen - Schloss Süd oben
+## -    Name: GA14WKS02
+## -
+## - bisherige IPv4-Adresse: 192.168.11.145
+## -
+host Desktop-GA14WKS02 {
+   hardware ethernet c8:1f:66:1d:8f:bc ;
+   fixed-address 192.168.11.138 ;
+}
+
+## - Rechner Nr.: 139
+## -    Ort:  Stockhausen - Geschäftsleitung
+## -    Name: GA15WKS04
+## -
+## - bisherige IPv4-Adresse: 192.168.11.149
+## -
+host Desktop-GA15WKS04 {
+   hardware ethernet 30:5A:3A:48:15:93 ;
+   fixed-address 192.168.11.139 ;
+}
+
+## - Rechner Nr.: 140
+## -    Ort:  Stockhausen - Garten
+## -    Name: GA11WKS27
+## -
+## - bisherige IPv4-Adresse: 192.168.11.153
+## -
+host Desktop-GA11WKS27 {
+   hardware ethernet 54:04:A6:7E:B2:22 ;
+   fixed-address 192.168.11.140 ;
+}
+
+## - Rechner Nr.: 141
+## -    Ort:  Stockhausen - Hausmeister (neu)
+## -    Name: GA16NBK03 (ehemals GA13NBK04)
+## -
+## - bisherige IPv4-Adresse: 192.168.11.156
+## -
+host Notebook-GA16NBK03 {
+   hardware ethernet 00:27:13:b2:49:fd ;
+   fixed-address 192.168.11.141 ;
+}
+
+## - Rechner Nr.: 142
+## -    Ort:  Stockhausen - IT
+## -    Name: GA14NBK02
+## -
+## - bisherige IPv4-Adresse: 192.168.11.157
+## -
+host Notebook-GA14NBK02 {
+   hardware ethernet c4:54:44:30:d3:0f ;
+   fixed-address 192.168.11.142 ;
+}
+
+## - Rechner Nr.: 143
+## -    Ort:  Stockhausen - Geschäftsleitung
+## -    Name: GA11WKS28
+## -
+## - bisherige IPv4-Adresse: 192.168.11.167
+## -
+host Desktop-GA11WKS28 {
+   hardware ethernet 78:2B:CB:B4:B3:40 ;
+   fixed-address 192.168.11.143 ;
+}
+
+## - Rechner Nr.: 144
+## -    Ort:  Stockhausen - Verwaltung
+## -    Name: GA10WKS33
+## -
+## - bisherige IPv4-Adresse: 192.168.11.196
+## -
+host Desktop-GA10WKS33 {
+   hardware ethernet 00:24:21:20:93:83 ;
+   fixed-address 192.168.11.144 ;
+}
+
+## - Rechner Nr.: 145
+## -    Ort:  Stockhausen - Schloss Süd
+## -    Name: GA10WKS25
+## -
+## - bisherige IPv4-Adresse: 192.168.11.197
+## -
+host Desktop-GA10WKS25 {
+   hardware ethernet 00:1F:1F:FA:3F:AA ;
+   fixed-address 192.168.11.145 ;
+}
+
+## - Rechner Nr.: 146
+## -    Ort:  Stockhausen - Verwaltung
+## -    Name: GA15WKS02
+## -
+## - bisherige IPv4-Adresse: 192.168.11.198
+## -
+host Desktop-GA15WKS02 {
+   hardware ethernet 00:01:2E:00:BF:6F ;
+   fixed-address 192.168.11.146 ;
+}
+
+## - Rechner Nr.: 147
+## -    Ort:  Stockhausen - Geschäftsleitung
+## -    Name: GA10WKS30
+## -
+## - bisherige IPv4-Adresse: 192.168.11.199
+## -
+host Desktop-GA10WKS30 {
+   hardware ethernet 00:1F:C6:81:40:F8 ;
+   fixed-address 192.168.11.147 ;
+}
+
+## - Rechner Nr.: 148
+## -    Ort:  Stockhausen - Welzhaus
+## -    Name: GA12NBK01
+## -
+## - bisherige IPv4-Adresse: 192.168.11.200
+## -
+host Notebook-GA12NBK01 {
+   hardware ethernet d4:be:d9:57:f4:83 ;
+   fixed-address 192.168.11.148 ;
+}
+
+## - Rechner Nr.: 149
+## -    Ort:  Stockhausen - Geschäftsleitung
+## -    Name: GA13NBK06
+## -
+## - bisherige IPv4-Adresse: ...
+## -
+host Notebook-GA13NBK06 {
+   hardware ethernet E0:DB:55:CF:38:D3 ;
+   fixed-address 192.168.11.149 ;
+}
+
+## - Rechner Nr.: 150
+## -    Ort:  Stockhausen - Hopfengarten
+## -    Name: wolf-mint
+## -
+## - bisherige IPv4-Adresse: 192.168.11.220
+## -
+host Desktop-wolf-mint {
+   hardware ethernet 52:54:00:16:10:b1 ;
+   fixed-address 192.168.11.150 ;
+}
+
+## - Rechner Nr.: 151
+## -    Ort:  Stockhausen - Hopfengarten
+## -    Name: wolf
+## -
+## - bisherige IPv4-Adresse: 192.168.11.112
+## -
+host Notebook-wolf {
+   hardware ethernet 00:26:2d:f3:b6:70 ;
+   fixed-address 192.168.11.151 ;
+}
+
+## - Rechner Nr.: 152
+## -    Ort:  Stockhausen - Hopfengarten - Corinna
+## -    Name: edge
+## -
+## - bisherige IPv4-Adresse: 192.168.11.152
+## -
+host Notebook-edge {
+   hardware ethernet 3c:97:0e:dc:d3:8e ;
+   fixed-address 192.168.11.152 ;
+}
+
+## - Rechner Nr.: 153
+## -    Ort:  Stockhausen - Hopfengarten
+## -    Name: odroid
+## -
+## - bisherige IPv4-Adresse: ...
+## -
+host Server-odroidwolf {
+   hardware ethernet 00:1e:06:10:41:c3 ;
+   fixed-address 192.168.11.153 ;
+}
+
+## - Rechner Nr.: 154
+## -    Ort:  Stockhausen - Pfoertnerhaus - Buero IT
+## -    Name: wolf-x1 (Laptop IT)
+## -
+## - bisherige IPv4-Adresse: 192.168.11.191
+## -
+host wolf-x1 {
+   hardware ethernet 28:d2:44:88:00:b0 ;
+   fixed-address 192.168.11.154 ;
+}
+
+## - Rechner Nr.: 155
+## -    Ort:  Stockhausen - Hopfengarten
+## -    Name: wolf-sidu
+## -    ehemals: hgqnas
+## -
+host wolf-sidu {
+   hardware ethernet 52:54:00:5d:a5:4a ;
+   fixed-address 192.168.11.155 ;
+}
+
+
+## - Rechner Nr.: 156
+## -    Ort:  Stockhausen - IT (Ersatz Rechner)
+## -    Name: GA15WKS05
+## -
+## -
+host Desktop-GA15WKS05 {
+   hardware ethernet 00:01:2e:65:34:79 ;
+   fixed-address 192.168.11.156 ;
+}
+
+## - Rechner Nr.: 157
+## -    Ort:  Stockhausen - Verwaltung (Almut - Kulturkreis)
+## -    Name: GA16NBK02
+## -
+## - bisherige IPv4-Adresse: neu
+## -
+host Desktop-GA16NBK02 {
+   hardware ethernet 70:5a:0f:d4:75:95 ;
+   fixed-address 192.168.11.157 ;
+}
+
+## - Rechner Nr.: 158
+## -    Ort:  Stockhausen - IT Büro (Computerkurs)
+## -    Lenovo G560 Debian LXDE (Windows 10 Home)
+## -    Name: lenny
+## -
+host lenny {
+   hardware ethernet 88:ae:1d:da:81:68 ;
+   fixed-address 192.168.11.158 ;
+}
+
+## - Rechner Nr.: 159
+## -    Ort:  Stockhausen - Konferenzraum
+## -    Intel NUC (Windows 10 LTSB 2016
+## -    Name: ga-st-cl1802
+## -    neu am 01.06.2018
+## -
+host ga-st-cl1802 {
+   hardware ethernet 94:c6:91:1c:5a:17 ;
+   fixed-address 192.168.11.159 ;
+}
+
+## - Rechner Nr.: 160
+## -    Ort:  Stockhausen - Baubüro - Georg (neu)
+## -    Intel Nuc Windows 8.1
+## -    Name: GA16WKS01
+## -
+## - bisherige IPv4-Adresse: 
+## -
+host Desktop-GA16WKS01 {
+   hardware ethernet f4:4d:30:64:37:a8 ;
+   fixed-address 192.168.11.160 ;
+}
+
+
+## - Rechner Nr.: 161
+## -    Ort:  Stockhausen - gelbes Haus
+## -    Name: hbosselmann-PC
+## -
+## - bisherige IPv4-Adresse: 192.168.11.227
+## -
+host Desktop-hbosselmann-PC {
+   hardware ethernet fc:3f:db:8d:e9:66 ;
+   fixed-address 192.168.11.161 ;
+}
+
+## - Rechner Nr.: 162
+## -    Ort:  Stockhausen - Vermittlungskreis
+## -    Name: GA16NBK01
+## -
+## - bisherige IPv4-Adresse: keine (neu)
+## -
+host Desktop-GA16NBK01 {
+   hardware ethernet 1c:39:47:b3:01:60 ;
+   fixed-address 192.168.11.162 ;
+}
+
+## - Rechner Nr.: 163
+## -    Ort:  Stockhausen - Kontiki
+## -    Name: GA17NBK01
+## -
+## - bisherige IPv4-Adresse: keine (neu)
+## -
+host Desktop-GA17NBK01 {
+   hardware ethernet c8:5b:76:47:09:e5 ;
+   fixed-address 192.168.11.163 ;
+}
+
+## - Rechner Nr.: 164
+## -    Ort:  Stockhausen - Ersatz Notebook
+## -    Name: GA12NBK07
+## -
+## - bisherige IPv4-Adresse: keine (Gesche privat)
+## -
+host Desktop-GA12NBK07 {
+   hardware ethernet 5c:f9:dd:3d:7e:55 ;
+   fixed-address 192.168.11.164 ;
+}
+
+## - Rechner Nr.: 165
+## -    Ort:  Stockhausen - Konfereznraum
+## -    Name: GA17WKS01
+## -
+## - bisherige IPv4-Adresse: neu
+## -
+host Desktop-GA17WKS01 {
+   hardware ethernet f4:4d:30:68:dc:e7 ;
+   fixed-address 192.168.11.165 ;
+}
+
+## - Monitor Nr.: 166
+## -    Ort:  Stockhausen - Konfereznraum
+## -    Name: ga-st-monitor
+## -
+## - bisherige IPv4-Adresse: neu
+## -
+host ga-st-monitor {
+   hardware ethernet 10:4f:a8:8e:c2:5f ;
+   fixed-address 192.168.11.166 ;
+}
+
+#### Stockhausen - Weinberg ####
+
+subnet 192.168.77.0 netmask 255.255.255.0 {
+
+   # --- 192.168.77.160/27 ---
+   # network address....: 192.168.77.160
+   # Broadcast address..: 192.168.77.191
+   # netmask............: 255.255.255.224
+   # network range......: 192.168.77.160 - 192.168.77.191
+   # Usable range.......: 192.168.77.161 - 192.168.77.190
+
+   #range 192.168.77.161 192.168.77.190;
+
+   range 192.168.77.97 192.168.77.126;
+
+   option routers 192.168.77.254;
+   option subnet-mask 255.255.255.0;
+   option broadcast-address 192.168.77.255;
+
+   option domain-name "ga.intra";
+   option domain-name-servers 192.168.11.3, 192.168.10.3;
+   #option domain-name-servers 192.168.11.254;
+   option netbios-name-servers 192.168.11.3;
+   option ntp-servers          192.168.11.254;
+
+   next-server 192.168.11.20;        # address of the telephone system
+   filename "Alcatel";               # filename getting from telephone system
+
+   default-lease-time 86400;
+   max-lease-time 259200;
+
+}
+
+## - Telefone - ##
+   # --- 192.168.77.0/27 ---
+   # network address....: 192.168.77.0
+   # Broadcast address..: 192.168.77.31
+   # netmask............: 255.255.255.224
+   # network range......: 192.168.77.0 - 192.168.77.31
+   # Usable range.......: 192.168.77.1 - 192.168.77.30
+
+
+## - Telefon Nr.: 440
+## -    Ort:  Stockhausen - Weinberg
+## -    Name: Weinberg
+## -
+host tel-440 {
+   hardware ethernet 00:80:9f:62:8e:94 ;
+   fixed-address 192.168.77.19 ;
+}
+
+## - Telefon Nr.: 441
+## -    Ort:  Stockhausen - Weinberg
+## -    Name: Haas Büro
+## -
+host tel-441 {
+   hardware ethernet 00:80:9f:62:8e:92 ;
+   fixed-address 192.168.77.20 ;
+}
+
+## - Telefon Nr.: 445
+## -    Ort:  Stockhausen - Weinberg
+## -    Name: Teichhaus
+## -
+host tel-445 {
+   hardware ethernet 00:80:9f:62:8e:7c ;
+   fixed-address 192.168.77.21 ;
+}
+
+## - Telefon Nr.: 443
+## -    Ort:  Stockhausen - Weinberg
+## -    Name: Haas privat
+## -
+host tel-443 {
+   hardware ethernet 00:80:9f:62:8f:83 ;
+   fixed-address 192.168.77.24 ;
+}
+
+## - Telefon Nr.: 449
+## -    Ort:  Stockhausen - Weinberg
+## -    Name: Felicia
+## -
+host tel-449 {
+   hardware ethernet 00:80:9f:ca:fe:9e ;
+   fixed-address 192.168.77.25 ;
+}
+
+## - Telefon Nr.: 442
+## -    Ort:  Stockhausen - Weinberg
+## -    Name: Weinberg 1. Stock
+## -
+host tel-442 {
+   hardware ethernet 00:80:9f:62:8e:30 ;
+   fixed-address 192.168.77.26 ;
+}
+
+## - Telefon Nr.: 444
+## -    Ort:  Stockhausen - Weinberg
+## -    Name: Müller,Kerstin
+## -
+host tel-444 {
+   hardware ethernet 00:80:9f:85:01:be ;
+   fixed-address 192.168.77.27 ;
+}
+
+## - Telefon Nr.: 446 
+## -    Ort:  Stockhausen - Weinberg
+## -    Name: Weinberg
+## - ehemals Venschott privat
+host tel-446 {
+   hardware ethernet 00:80:9f:62:8e:74 ;
+   fixed-address 192.168.77.28 ;
+}
+
+
+## - Sonstiges  - ##
+   # --- 192.168.77.32/27 ---
+   # network address....: 192.168.77.32
+   # Broadcast address..: 192.168.77.63
+   # netmask............: 255.255.255.224
+   # network range......: 192.168.77.32 - 192.168.77.63
+   # Usable range.......: 192.168.77.33 - 192.168.77.62
+
+
+## - WLAN-Router (Teichhaus) 
+## -    Ort:  Stockhausen - Weinberg
+## -    Name: ap_tplink003
+## -
+host ap-tplink003 {
+   hardware ethernet c4:6e:1f:2b:9c:57 ;
+   fixed-address 192.168.77.33 ;
+}
+
+## - Drucker HP Laserjet Pro mfp m177fw
+## -    Ort:  Stockhausen - Weinberg (Büro)
+## -    Name: GA15DRHP01
+## -
+host GA15DRHP01 {
+  hardware ethernet 5c:b9:01:11:00:22 ;
+  fixed-address 192.168.77.35 ;
+}
+
+## - Rechner Nr.: 40
+## -    Ort:  Stockhausen - Weinberg
+## -    Name: GA07WKS34
+## -
+host Desktop-GA07WKS34 {
+   hardware ethernet 00:19:db:4b:51:e1 ;
+   fixed-address 192.168.77.40 ;
+}
+
+#### Stockhausen - Hochstrasse ####
+
+subnet 192.168.78.0 netmask 255.255.255.0 {
+
+   # --- 192.168.78.160/27 ---
+   # network address....: 192.168.78.160
+   # Broadcast address..: 192.168.78.191
+   # netmask............: 255.255.255.224
+   # network range......: 192.168.78.160 - 192.168.78.191
+   # Usable range.......: 192.168.78.161 - 192.168.78.190
+
+   #range 192.168.78.161 192.168.78.190;
+
+   range 192.168.78.97 192.168.78.126;
+
+   option routers 192.168.78.254;
+   option subnet-mask 255.255.255.0;
+   option broadcast-address 192.168.78.255;
+
+   option domain-name "ga.intra";
+   option domain-name-servers 192.168.11.3, 192.168.10.3;
+   #option domain-name-servers 192.168.11.254;
+   option netbios-name-servers 192.168.11.3;
+   option ntp-servers          192.168.11.254;
+
+   next-server 192.168.11.20;        # address of the telephone system
+   filename "Alcatel";               # filename getting from telephone system
+
+   default-lease-time 86400;
+   max-lease-time 259200;
+
+}
+
+
+## Drucker DELL B1265dn - Hochstrasse (Norbert)
+host ga16drdel01 {
+   hardware ethernet 30:cd:a7:9f:30:1c ;
+   fixed-address  192.168.78.15 ;
+}
+
+## Drucker HP OfficeJet 7600 (?) - Hochstrasse (Norbert)
+host HP41F330 {
+   hardware ethernet 9c:b6:54:41:f3:30 ;
+   fixed-address  192.168.78.16 ;
+}
+
+## AP TP-Link WR841N (privates WLAN in Wohnung oben)
+host ap-tplink001-st {
+   hardware ethernet 98:de:d0:b9:8a:62 ;
+   fixed-address 192.168.78.21 ;
+}
+
+## --- Telefone 192.168.78.33 - 192.168.78.62
+## ---
+## ---    --- 192.168.78.32/27 ---
+## ---    Addresses..........: 32
+## ---    Network range......: 192.168.78.32 - 192.168.78.63
+## ---    Usable range.......: 192.168.78.33 - 192.168.78.62
+## ---
+
+
+## - Telefon Nr.: 320
+## -    Ort:  Stockhausen - Hochstrasse
+## -    Name: Hochstrasse
+## -
+host tel-320 {
+   hardware ethernet 00:80:9f:62:8e:8b ;
+   fixed-address 192.168.78.33 ;
+}
+
+## - Telefon Nr.: 321
+## -    Ort:  Stockhausen - Hochstrasse
+## -    Name: Hochstrasse
+## -
+host tel-321 {
+   hardware ethernet 00:80:9f:62:8e:90 ;
+   fixed-address 192.168.78.34 ;
+}
+
+## - Telefon Nr.: 322
+## -    Ort:  Stockhausen - Hochstrasse
+## -    Name: Jan Philipp
+## -
+host tel-322 {
+   hardware ethernet 00:80:9f:8d:8c:c5 ;
+   fixed-address 192.168.78.35 ;
+}
+
+## - Telefon Nr.: 339
+## -    Ort:  Stockhausen - Hochstrasse
+## -    Name: Venschott privat
+## -
+host tel-339 {
+   hardware ethernet 00:80:9f:62:8e:82 ;
+   fixed-address 192.168.78.37 ;
+}
+
+## - Telefon Nr.: 433
+## -    Ort:  Stockhausen - Schloss Süd oben (alt)
+## -    Ort:  Stockhausen Hochstrasse (neu)
+## -    Name: Alexander
+## -
+## - bisherige IPv4-Adresse: 192.168.11.60
+## -
+host tel-433 {
+   hardware ethernet 00:80:9f:58:fb:59 ;
+   fixed-address 192.168.78.39 ;
+}
+
+## --- Rechner  192.168.78.65 - 192.168.78.94
+## ---
+## ---    --- 192.168.78.32/27 ---
+## ---    Addresses..........: 32
+## ---    Network range......: 192.168.78.64 - 192.168.78.95
+## ---    Usable range.......: 192.168.78.65 - 192.168.78.94
+## ---
+
+## - Rechner Nr.: 65
+## -    Ort:  Stockhausen - Hochstrasse (Norbert)
+## -    Name: GA15WKS05
+## -
+## - bisherige IPv4-Adresse: 192.168.78.24
+## -
+host Desktop-GA13NBK05 {
+   hardware ethernet b8:ca:3a:bf:03:38 ;
+   fixed-address 192.168.78.65 ;
+}
+
+## - Rechner Nr.: 66
+## -    Ort:  Stockhausen - Hochstrasse
+## -    Name: GA14NBK03
+## -
+host Desktop-GA14NBK03 {
+   hardware ethernet 54:ee:75:0a:0f:a4 ;
+   fixed-address 192.168.78.66 ;
+}
+
+## - Rechner Nr.: ???
+## -    Ort:  Stockhausen - Hochstrasse
+## -    Name: ???
+## -
+## - bisherige IPv4-Adresse: 192.168.78.28?
+## -
+host Desktop-keineAhnung {
+   hardware ethernet b8:70:f4:70:69:71 ;
+   fixed-address 192.168.78.67 ;
+}
+
+## --- DHCP-Bereich  192.168.78.97 - 192.168.78.126
+## ---
+## ---    --- 192.168.78.32/27 ---
+## ---    Addresses..........: 32
+## ---    Network range......: 192.168.78.96- 192.168.78.127
+## ---    Usable range.......: 192.168.78.97 - 192.168.78.126
+## ---
+
+
+## - No DHCP
+## -
+subnet 10.10.11.0 netmask 255.255.255.0 {
+}
+subnet 172.16.0.0 netmask 255.255.255.0 {
+}
+subnet 172.16.11.0 netmask 255.255.255.0 {
+}
+subnet 172.17.0.0 netmask 255.255.255.0 {
+}
+subnet 10.1.9.0 netmask 255.255.255.0 {
+}
+subnet 10.113.0.0 netmask 255.255.0.0 {
+}
+subnet 10.112.1.0 netmask 255.255.255.0 {
+}
+subnet 10.121.0.0 netmask 255.255.240.0 {
+
+   range 10.121.2.1 10.121.15.254;
+
+   option routers 10.121.15.254;
+   option subnet-mask 255.255.240.0;
+   option broadcast-address 10.121.15.255;
+
+   option domain-name "ga.intra";
+   option domain-name-servers 192.168.11.1, 192.168.11.3;
+   #option domain-name-servers 192.168.11.254;
+   option netbios-name-servers 192.168.11.3;
+   option ntp-servers          192.168.11.254;
+
+   #next-server 192.168.11.20;        # address of the telephone system
+   #filename "Alcatel";               # filename getting from telephone system
+
+   default-lease-time 86400;
+   max-lease-time 259200;
+}
+
+# - Aps
+# -
+host ap-unifi001 {
+   hardware ethernet 78:8a:20:d3:9b:41;
+   fixed-address ap-unifi001.ga.netz;
+}
+
+host ap-unifi002 {
+   hardware ethernet fc:ec:da:10:9a:3b;
+   fixed-address ap-unifi002.ga.netz;
+}
+
+host ap-unifi003 {
+   hardware ethernet fc:ec:da:10:96:60;
+   fixed-address ap-unifi003.ga.netz;
+}
+
+# - WLAN feste IP Addressen
+# -
+host wolf-x1-wlan {
+   hardware ethernet e8:2a:ea:09:28:7e;
+   fixed-address 10.121.0.33;
+}
+
+#subnet 10.152.187.0 netmask 255.255.255.0 {
+#}
+
+# This is a very basic subnet declaration.
+
+#subnet 10.254.239.0 netmask 255.255.255.224 {
+#  range 10.254.239.10 10.254.239.20;
+#  option routers rtr-239-0-1.example.org, rtr-239-0-2.example.org;
+#}
+
+# This declaration allows BOOTP clients to get dynamic addresses,
+# which we don't really recommend.
+
+#subnet 10.254.239.32 netmask 255.255.255.224 {
+#  range dynamic-bootp 10.254.239.40 10.254.239.60;
+#  option broadcast-address 10.254.239.31;
+#  option routers rtr-239-32-1.example.org;
+#}
+
+# A slightly different configuration for an internal subnet.
+#subnet 10.5.5.0 netmask 255.255.255.224 {
+#  range 10.5.5.26 10.5.5.30;
+#  option domain-name-servers ns1.internal.example.org;
+#  option domain-name "internal.example.org";
+#  option routers 10.5.5.1;
+#  option broadcast-address 10.5.5.31;
+#  default-lease-time 600;
+#  max-lease-time 7200;
+#}
+
+# Hosts which require special configuration options can be listed in
+# host statements.   If no address is specified, the address will be
+# allocated dynamically (if possible), but the host-specific information
+# will still come from the host declaration.
+
+#host passacaglia {
+#  hardware ethernet 0:0:c0:5d:bd:95;
+#  filename "vmunix.passacaglia";
+#  server-name "toccata.fugue.com";
+#}
+
+# Fixed IP addresses can also be specified for hosts.   These addresses
+# should not also be listed as being available for dynamic assignment.
+# Hosts for which fixed IP addresses have been specified can boot using
+# BOOTP or DHCP.   Hosts for which no fixed address is specified can only
+# be booted with DHCP, unless there is an address range on the subnet
+# to which a BOOTP client is connected which has the dynamic-bootp flag
+# set.
+#host fantasia {
+#  hardware ethernet 08:00:07:26:c0:a5;
+#  fixed-address fantasia.fugue.com;
+#}
+
+# You can declare a class of clients and then do address allocation
+# based on that.   The example below shows a case where all clients
+# in a certain class get addresses on the 10.17.224/24 subnet, and all
+# other clients get addresses on the 10.0.29/24 subnet.
+
+#class "foo" {
+#  match if substring (option vendor-class-identifier, 0, 4) = "SUNW";
+#}
+
+#shared-network 224-29 {
+#  subnet 10.17.224.0 netmask 255.255.255.0 {
+#    option routers rtr-224.example.org;
+#  }
+#  subnet 10.0.29.0 netmask 255.255.255.0 {
+#    option routers rtr-29.example.org;
+#  }
+#  pool {
+#    allow members of "foo";
+#    range 10.17.224.10 10.17.224.250;
+#  }
+#  pool {
+#    deny members of "foo";
+#    range 10.0.29.10 10.0.29.230;
+#  }
+#}
diff --git a/GA-Schloss/dhcpd6.conf.GA-Schloss b/GA-Schloss/dhcpd6.conf.GA-Schloss
new file mode 100644
index 0000000..87786b4
--- /dev/null
+++ b/GA-Schloss/dhcpd6.conf.GA-Schloss
@@ -0,0 +1,102 @@
+# Server configuration file example for DHCPv6
+# From the file used for TAHI tests - addresses chosen
+# to match TAHI rather than example block.
+
+# IPv6 address valid lifetime
+#  (at the end the address is no longer usable by the client)
+#  (set to 30 days, the usual IPv6 default)
+default-lease-time 2592000;
+
+# IPv6 address preferred lifetime
+#  (at the end the address is deprecated, i.e., the client should use
+#   other addresses for new connections)
+#  (set to 7 days, the	usual IPv6 default)
+preferred-lifetime 604800;
+
+# T1, the delay before Renew
+#  (default is 1/2 preferred lifetime)
+#  (set to 1 hour)
+option dhcp-renewal-time 3600;
+
+# T2, the delay before Rebind (if Renews failed)
+#  (default is 3/4 preferred lifetime)
+#  (set to 2 hours)
+option dhcp-rebinding-time 7200;
+
+# Enable RFC 5007 support (same than for DHCPv4)
+allow leasequery;
+
+# Global definitions for name server address(es) and domain search list
+option dhcp6.name-servers 3ffe:501:ffff:100:200:ff:fe00:3f3e;
+option dhcp6.domain-search "test.example.com","example.com";
+
+# Set preference to 255 (maximum) in order to avoid waiting for
+# additional servers when there is only one
+##option dhcp6.preference 255;
+
+# Server side command to enable rapid-commit (2 packet exchange)
+##option dhcp6.rapid-commit;
+
+# The delay before information-request refresh
+#  (minimum is 10 minutes, maximum one day, default is to not refresh)
+#  (set to 6 hours)
+option dhcp6.info-refresh-time 21600;
+
+# Static definition (must be global)
+#host myclient {
+#	# The entry is looked up by this
+#	host-identifier option
+#		dhcp6.client-id 00:01:00:01:00:04:93:e0:00:00:00:00:a2:a2;
+#
+#	# A fixed address
+#	fixed-address6 3ffe:501:ffff:100::1234;
+#
+#	# A fixed prefix
+#	fixed-prefix6 3ffe:501:ffff:101::/64;
+#
+#	# Override of the global definitions,
+#	# works only when a resource (address or prefix) is assigned
+#	option dhcp6.name-servers 3ffe:501:ffff:100:200:ff:fe00:4f4e;
+#
+#	# For debug (to see when the entry statements are executed)
+#	#  (log "sol" when a matching Solicitation is received)
+#	##if packet(0,1) = 1 { log(debug,"sol"); }
+#}
+#
+#host otherclient {
+#        # This host entry is hopefully matched if the client supplies a DUID-LL
+#        # or DUID-LLT containing this MAC address.
+#        hardware ethernet 01:00:80:a2:55:67;
+#
+#        fixed-address6 3ffe:501:ffff:100::4321;
+#}
+
+# The subnet where the server is attached
+#  (i.e., the server has an address in this subnet)
+#subnet6 3ffe:501:ffff:100::/64 {
+#	# Two addresses available to clients
+#	#  (the third client should get NoAddrsAvail)
+#	range6 3ffe:501:ffff:100::10 3ffe:501:ffff:100::11;
+#
+#	# Use the whole /64 prefix for temporary addresses
+#	#  (i.e., direct application of RFC 4941)
+#	range6 3ffe:501:ffff:100:: temporary;
+#
+#	# Some /64 prefixes available for Prefix Delegation (RFC 3633)
+#	prefix6 3ffe:501:ffff:100:: 3ffe:501:ffff:111:: /64;
+#}
+
+# A second subnet behind a relay agent
+#subnet6 3ffe:501:ffff:101::/64 {
+#	range6 3ffe:501:ffff:101::10 3ffe:501:ffff:101::11;
+#
+#	# Override of the global definitions,
+#	# works only when a resource (address or prefix) is assigned
+#	option dhcp6.name-servers 3ffe:501:ffff:101:200:ff:fe00:3f3e;
+#
+#}
+
+# A third subnet behind a relay agent chain
+#subnet6 3ffe:501:ffff:102::/64 {
+#	range6 3ffe:501:ffff:102::10 3ffe:501:ffff:102::11;
+#}
diff --git a/GA-Schloss/hostname.GA-Schloss b/GA-Schloss/hostname.GA-Schloss
new file mode 100644
index 0000000..dc86b0b
--- /dev/null
+++ b/GA-Schloss/hostname.GA-Schloss
@@ -0,0 +1 @@
+ga-st-gw
diff --git a/GA-Schloss/hosts.GA-Schloss b/GA-Schloss/hosts.GA-Schloss
new file mode 100644
index 0000000..5a4275a
--- /dev/null
+++ b/GA-Schloss/hosts.GA-Schloss
@@ -0,0 +1,9 @@
+127.0.0.1	localhost
+127.0.1.1	ga-st-gw.ga.netz	ga-st-gw
+
+# The following lines are desirable for IPv6 capable hosts
+::1     localhost ip6-localhost ip6-loopback
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
+
+192.168.10.254 ga-al-gw.ga.netz ga-al-gw
diff --git a/GA-Schloss/interfaces.GA-Schloss b/GA-Schloss/interfaces.GA-Schloss
new file mode 100644
index 0000000..17837e7
--- /dev/null
+++ b/GA-Schloss/interfaces.GA-Schloss
@@ -0,0 +1,256 @@
+# This file describes the network interfaces available on your system
+# and how to activate them. For more information, see interfaces(5).
+
+source /etc/network/interfaces.d/*
+
+# The loopback network interface
+auto lo
+iface lo inet loopback
+
+
+## - Uplink static line to Altenschlirf (Router)
+## -
+auto eth3
+iface eth3 inet static
+   address 172.16.0.2
+   network 172.16.0.0
+   netmask 255.255.255.0
+   broadcast 172.16.0.255
+   ## - Static routes to Altenschlirf
+   ## -
+   post-up /sbin/route add -net 10.10.10.0 netmask 255.255.255.0 gw 172.16.0.1
+   post-up /sbin/route add -net 192.168.10.0 netmask 255.255.255.0 gw 172.16.0.1
+   post-up /sbin/route add -net 10.122.1.0 netmask 255.255.255.0 gw 172.16.0.1
+   post-up /sbin/route add -net 10.123.0.0 netmask 255.255.0.0 gw 172.16.0.1
+   # - Telefon neu
+   post-up /sbin/route add -net 172.16.210.0 netmask 255.255.255.0 gw 172.16.0.1
+
+## - Uplink static line to Altenschlirf (Router IPMI)
+## -
+auto eth7
+iface eth7 inet static
+   address 172.17.0.2
+   network 172.17.0.0
+   netmask 255.255.255.0
+   broadcast 172.17.0.255
+
+
+# ---
+# - eth8 UPLINK DSL Telefon (FritBox)
+# ----
+auto eth8
+iface eth8 inet static
+   address 172.16.211.1
+   network 172.16.211.0
+   netmask 255.255.255.0
+   gateway 172.16.211.254
+   broadcast 172.16.211.255
+
+#iface eth8 inet manual
+# up vconfig add eth8 211
+#
+#auto eth8.211 
+#iface eth8.211 inet static
+#   address 172.16.211.254
+#   network 172.16.211.0
+#   netmask 255.255.255.0
+#   gateway 172.16.211.254
+#   broadcast 172.16.211.255
+#   pre-up /sbin/ifconfig eth8 up
+
+
+## - Uplink DSL surf2 via (static) line to Zyxel 6501
+## -
+auto eth9
+iface eth9 inet static
+   address 172.16.11.1
+   network 172.16.11.0
+   netmask 255.255.255.0
+   gateway 172.16.11.254
+   broadcast 172.16.11.255
+
+
+## - Uplink DSL surf1 via (static) line to Fritz!Box
+## -
+auto eth10
+iface eth10 inet static
+   address 172.16.13.1
+   network 172.16.13.0
+   netmask 255.255.255.0
+   gateway 172.16.13.254
+   broadcast 172.16.13.255
+
+
+## - Uplink DSL surf1 via (static) line to Fritz!Box
+## -
+auto eth11
+iface eth11 inet static
+   address 172.16.12.1
+   network 172.16.12.0
+   netmask 255.255.255.0
+   gateway 172.16.12.254
+   broadcast 172.16.12.255
+
+## - LAG bond0 on interfaces eth0 and eth4
+## -
+auto bond0
+iface bond0 inet static
+   address 10.1.9.254
+   network 10.1.16.0
+   netmask 255.255.255.0
+   slaves eth0 eth4
+   # Mode: active-backup (mode 4)
+   #    also possible: "802.3ad"
+   bond_mode 4
+   bond_miimon 100
+   bond_lacp_rate 1
+   bond_ad_select count
+   bond_downdelay 200
+   bond_updelay 200
+   # Mode: active-backup (mode 5)
+   #    also possible: "balance-tlb"
+   #bond_mode 6
+   #bond_miimon 100
+   #bond_downdelay 200
+   #bond_updelay 200
+   # Mode: active-backup (mode 6)
+   #    also possible: "balance-alb"
+   #bond_mode 6
+   #bond_miimon 100
+   #bond_downdelay 200
+   #bond_updelay 200
+   post-up vconfig add bond0 11
+   post-up vconfig add bond0 77
+   post-up vconfig add bond0 78
+
+## - VLAN 11 on interface bond0
+## -    network: 10.10.11.0
+## - VLAN 77 on interface bond0
+## -    network: 192.168.77.0
+## - VLAN 78 on interface bond0
+## -    network: 192.168.78.0
+## -
+auto bond0.11 bond0.77 bond0.78
+iface bond0.11 inet static
+   address 10.10.11.254
+   network 10.10.11.0
+   netmask 255.255.255.0
+
+iface bond0.77 inet static
+   address 192.168.77.254
+   network 192.168.77.0
+   netmask 255.255.255.0
+
+iface bond0.78 inet static
+   address 192.168.78.254
+   network 192.168.78.0
+   netmask 255.255.255.0
+
+## - LAG bond1 on interfaces eth1 and eth5
+## -    network: 192.168.11.0
+## -
+auto bond1
+iface bond1 inet static
+   address 192.168.11.254
+   network 192.168.11.0
+   netmask 255.255.255.0
+   slaves eth1 eth5
+   # Mode: active-backup (mode 4)
+   #    also possible: "802.3ad"
+   bond_mode 4
+   bond_miimon 100
+   bond_downdelay 200
+   bond_updelay 200
+   bond_lacp_rate 1
+   bond_ad_select count
+   # Mode: active-backup (mode 5)
+   #    also possible: "balance-tlb"
+   #bond_mode 6
+   #bond_miimon 100
+   #bond_downdelay 200
+   #bond_updelay 200
+   # Mode: active-backup (mode 6)
+   #    also possible: "balance-alb"
+   #bond_mode 6
+   #bond_miimon 100
+   #bond_downdelay 200
+   #bond_updelay 200
+   post-up vconfig add bond1 121
+   post-up /sbin/route add -net 10.11.16.0 netmask 255.255.255.0 gw 192.168.11.6
+
+auto bond1:0
+iface bond1:0 inet static
+   address 192.168.11.1
+   netmask 255.255.255.255
+
+auto bond1:1
+iface bond1:1 inet static
+   address 10.10.9.254
+   network 10.10.9.0
+   netmask 255.255.255.0
+   broadcast 10.10.9.255
+
+auto bond1:ap
+iface bond1:ap inet static
+   address 10.112.1.254
+   network 10.112.1.0
+   netmask 255.255.255.0
+   broadcast 10.112.1.255
+   ## -Network Accesspoints
+   ## -
+   post-up /sbin/route add -net 10.113.1.0/24 gw 10.112.1.1
+   post-up /sbin/route add -net 10.113.2.0/24 gw 10.112.1.2
+   post-up /sbin/route add -net 10.113.3.0/24 gw 10.112.1.3
+   post-up /sbin/route add -net 10.113.4.0/24 gw 10.112.1.4
+   post-up /sbin/route add -net 10.113.5.0/24 gw 10.112.1.5
+   post-up /sbin/route add -net 10.113.6.0/24 gw 10.112.1.6
+   post-up /sbin/route add -net 10.113.7.0/24 gw 10.112.1.7
+   post-up /sbin/route add -net 10.113.8.0/24 gw 10.112.1.8
+   post-up /sbin/route add -net 10.113.9.0/24 gw 10.112.1.9
+   post-up /sbin/route add -net 10.113.10.0/24 gw 10.112.1.10
+   post-up /sbin/route add -net 10.113.11.0/24 gw 10.112.1.11
+   post-up /sbin/route add -net 10.113.12.0/24 gw 10.112.1.12
+   post-up /sbin/route add -net 10.113.13.0/24 gw 10.112.1.13
+   post-up /sbin/route add -net 10.113.14.0/24 gw 10.112.1.14
+
+auto bond1:ipmi
+iface bond1:ipmi inet static
+   address 10.11.11.254
+   network 10.11.11.0
+   netmask 255.255.255.0
+   broadcast 10.11.11.255
+
+auto bond1.121
+iface bond1.121 inet static
+   address 10.121.15.254
+   network 10.121.0.0
+   netmask 255.255.240.0
+   broadcast 10.121.15.255
+
+
+
+
+### - DSL st
+### -
+#auto dsl-st
+#iface dsl-st inet ppp
+#   pre-up /sbin/ifconfig eth10 up
+#   #pre-up vconfig add eth10 7
+#   #pre-up /sbin/ifconfig eth10.7 up
+#   provider dsl-st
+#   #post-down /sbin/ifconfig eth10.7 down
+#   #post-down vconfig rem eth10.7
+#   post-down /sbin/ifconfig eth10 down
+
+
+## - DSL surf1
+## -
+#auto dsl-surf1
+#iface dsl-surf1 inet ppp
+#   pre-up /sbin/ifconfig eth11 up
+#   #pre-up vconfig add eth11 7
+#   #pre-up /sbin/ifconfig eth11.7 up
+#   provider dsl-surf1
+#   #post-down /sbin/ifconfig eth11.7 down
+#   #post-down vconfig rem eth11.7
+##   post-down /sbin/ifconfig eth11 down
diff --git a/GA-Schloss/ipt-firewall.service.GA-Schloss b/GA-Schloss/ipt-firewall.service.GA-Schloss
new file mode 100644
index 0000000..9842090
--- /dev/null
+++ b/GA-Schloss/ipt-firewall.service.GA-Schloss
@@ -0,0 +1,14 @@
+[Unit]
+Description=IPv4 Firewall with iptables
+After=network.target
+
+[Service]
+SyslogIdentifier="ipt-gateway"
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/sbin/ipt-firewall-gateway start
+ExecStop=/usr/local/sbin/ipt-firewall-gateway stop
+User=root
+
+[Install]
+WantedBy=multi-user.target
diff --git a/GA-Schloss/ipt-firewall/default_ports.conf b/GA-Schloss/ipt-firewall/default_ports.conf
new file mode 100644
index 0000000..a6ee932
--- /dev/null
+++ b/GA-Schloss/ipt-firewall/default_ports.conf
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+# =============
+# --- Define Ports for Services out
+# =============
+
+standard_ident_port=113
+standard_silc_port=706
+standard_irc_port=6667
+standard_jabber_port=5222
+standard_smtp_port=25
+standard_ssh_port=22
+standard_http_port=80
+standard_https_port=443
+standard_ftp_port=21
+standard_tftp_udp_port=69
+standard_ntp_port=123
+standard_snmp_port=161
+standard_snmp_trap_port=162
+standard_timeserver_port=37
+standard_pgp_keyserver_port=11371
+standard_telnet_port=23
+standard_whois_port=43
+standard_cpan_wait_port=1404
+standard_xymon_port=1984
+standard_hbci_port=3000
+standard_mysql_port=3306
+standard_ipp_port=631
+standard_cups_port=$standard_ipp_port
+standard_print_raw_port=515
+standard_print_port=9100
+standard_remote_console_port=5900
+
+# - IPsec - Internet Security Association and
+# -  Key Management Protocol
+standard_isakmp_port=500
+standard_ipsec_nat_t=4500
+
+
+# - Comma separated lists
+# -
+standard_http_ports="80,443"
+standard_mailuser_ports="587,465,110,995,143,993"
+
diff --git a/GA-Schloss/ipt-firewall/include_functions.conf b/GA-Schloss/ipt-firewall/include_functions.conf
new file mode 100644
index 0000000..9bb5205
--- /dev/null
+++ b/GA-Schloss/ipt-firewall/include_functions.conf
@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+
+# =============
+# --- Some functions
+# =============
+
+# - Is this script running on terminal ?
+# -
+if [[ -t 1 ]] ; then
+      terminal=true
+else
+   terminal=false
+fi
+
+echononl(){
+   echo X\\c > /tmp/shprompt$$
+   if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
+      echo -e -n "$*\\c" 1>&2
+   else
+       echo -e -n "$*" 1>&2
+   fi
+   rm /tmp/shprompt$$
+}
+echo_done() {
+   if $terminal ; then
+      echo -e "\033[75G[ \033[32mdone\033[m ]"
+   else
+      echo " [ done ]"
+   fi
+}
+echo_ok() {
+   if $terminal ; then
+      echo -e "\033[75G[ \033[32mok\033[m ]"
+   else
+      echo " [ ok ]"
+   fi
+}
+echo_warning() {
+   if $terminal ; then
+      echo -e "\033[75G[ \033[33m\033[1mwarn\033[m ]"
+   else
+      echo " [ warning ]"
+   fi
+}
+echo_failed(){
+   if $terminal ; then
+      echo -e "\033[75G[ \033[1;31mfailed\033[m ]"
+   else
+      echo ' [ failed! ]'
+   fi
+}
+echo_skipped() {
+   if $terminal ; then
+      echo -e "\033[75G[ \033[37mskipped\033[m ]"
+   else
+      echo " [ skipped ]"
+   fi
+}
+
+
+fatal (){
+   echo ""
+   echo ""
+   if $terminal ; then
+      echo -e "\t[ \033[31m\033[1mFatal\033[m ]: \033[37m\033[1m$*\033[m"
+      echo ""
+      echo -e "\t\033[31m\033[1m           Firewall Script will be interrupted..\033[m\033[m"
+   else
+      echo "fatal: $*"
+      echo "Firewall Script will be interrupted.."
+   fi
+   echo ""
+   exit 1
+}
+
+error(){
+   echo ""
+   if $terminal ; then
+      echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*"
+   else
+      echo "Error: $*"
+   fi
+   echo ""
+}
+
+warn (){
+   echo ""
+   if $terminal ; then
+      echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*"
+   else
+      echo "Warning: $*"
+   fi
+   echo ""
+}
+
+info (){
+   echo ""
+   if $terminal ; then
+      echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*"
+   else
+      echo "Info: $*"
+   fi
+   echo ""
+}
+
+## - Check if a given array (parameter 2) contains a given string (parameter 1)
+## -
+containsElement () {
+   local e
+   for e in "${@:2}"; do [[ "$e" == "$1" ]] && return 0; done
+   return 1
+}
+
diff --git a/GA-Schloss/ipt-firewall/index.html b/GA-Schloss/ipt-firewall/index.html
new file mode 100644
index 0000000..b3e50af
--- /dev/null
+++ b/GA-Schloss/ipt-firewall/index.html
@@ -0,0 +1 @@
+87.139.62.172
\ No newline at end of file
diff --git a/GA-Schloss/ipt-firewall/interfaces_ipv4.conf b/GA-Schloss/ipt-firewall/interfaces_ipv4.conf
new file mode 100644
index 0000000..d2ed231
--- /dev/null
+++ b/GA-Schloss/ipt-firewall/interfaces_ipv4.conf
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+# =============
+# --- Define Network Interfaces / Ip-Adresses / Ports
+# =============
+
+# - Extern Interfaces DSL Lines
+# -    (blank separated list)
+#ext_if_dsl_1="ppp-st"
+ext_if_dsl_1=""
+#ext_if_dsl_2="ppp-surf1"
+ext_if_dsl_2=""
+ext_if_dsl_3=""
+ext_if_dsl_4=""
+
+ext_ifs_dsl="$ext_if_dsl_1 $ext_if_dsl_2 $ext_if_dsl_3 $ext_if_dsl_4"
+
+# - Extern Interfaces Static Lines
+# -    (blank separated list)
+ext_if_static_1="eth9"
+ext_if_static_2="eth11"
+ext_if_static_3="eth10"
+
+ext_ifs_static="$ext_if_static_1 $ext_if_static_2 $ext_if_static_3"
+
+# - VPN Interfaces
+# -    (blank separated list)
+vpn_ifs="tun+"
+
+# - Local Interfaces
+local_if_1="bond1"
+local_if_2="bond0.11"
+local_if_3="bond0.77"
+local_if_4="bond0.78"
+local_if_5="bond1.121"
+local_if_6="eth3"
+local_if_7="eth7"
+
+local_ifs="$local_if_1 $local_if_2 $local_if_3 $local_if_4 $local_if_5 $local_if_6 $local_if_7"
+
+# - Devices given in list "nat_devices" will be natted
+# -
+# - Notice: Devices "ext_if_dsl_n" will be natted and must not been given here.
+# -
+# - Blank separated list
+# -
+nat_devices=""
+
+# - Are local alias interfaces like eth0:0 defined"
+# -
+local_alias_interfaces=true
diff --git a/GA-Schloss/ipt-firewall/ipt-firewall-gateway.conf b/GA-Schloss/ipt-firewall/ipt-firewall-gateway.conf
new file mode 100644
index 0000000..bd21b64
--- /dev/null
+++ b/GA-Schloss/ipt-firewall/ipt-firewall-gateway.conf
@@ -0,0 +1,1668 @@
+#!/usr/bin/env bash
+
+## - Configuration file for firewall script IPv4
+## -    ipt-firewall-gateway
+## -    ipt-firewall-flush
+## -
+
+#######################################################################
+# -------------------------- Configuration -------------------------- #
+
+# =============
+# --- Define programs
+# =============
+
+ipt=/sbin/iptables
+tc=/sbin/tc
+
+
+# =============
+# -  Load Kernel Modules
+# =============
+
+/sbin/modprobe ip_tables > /dev/null 2>&1
+/sbin/modprobe iptable_nat > /dev/null 2>&1
+/sbin/modprobe iptable_filter > /dev/null 2>&1
+/sbin/modprobe iptable_mangle > /dev/null 2>&1
+/sbin/modprobe iptable_raw > /dev/null 2>&1
+
+/sbin/modprobe nf_conntrack > /dev/null 2>&1
+/sbin/modprobe nf_nat > /dev/null 2>&1
+
+# - Note:! 
+# -    Since Kernel 4.7 the automatic conntrack helper assignment
+# -    is disabled by default (net.netfilter.nf_conntrack_helper = 0).
+# -    Enable it by setting this variable in file /etc/sysctl.conf:
+# -
+# -       net.netfilter.nf_conntrack_helper = 1
+# -
+# -    Reboot or type "sysctl -p"
+
+# - Load module for FTP Connection tracking and NAT
+# -
+/sbin/modprobe nf_conntrack_ftp > /dev/null 2>&1
+/sbin/modprobe nf_nat_ftp > /dev/null 2>&1
+
+# - Load modules for SIP VOIP
+# -
+/sbin/modprobe nf_conntrack_sip > /dev/null 2>&1
+/sbin/modprobe nf_nat_sip > /dev/null 2>&1
+
+
+
+# =============
+# --- Logging
+# =============
+
+log_all=false
+
+log_syn_flood=false
+log_fragments=false
+log_new_not_sync=false
+log_invalid_state=false
+log_invalid_flags=false
+log_spoofed=false
+log_spoofed_out=false
+log_to_lo=false
+log_not_wanted=false
+log_blocked=false
+log_unprotected=false
+log_prohibited=false
+log_voip=false
+log_rejected=true
+
+log_ssh=false
+
+# - Log using the specified syslog level. 7 (debug) is a good choice 
+# - unless you specifically need something else. 
+# -
+log_level=debug
+
+# - logging messages
+# -
+log_prefix="IPv4:"
+
+
+# ---
+# - Log all traffic for givven ip address
+# ---
+
+log_ips=""
+
+
+
+# =============
+# --- Define Network Interfaces / Ip-Adresses / Ports
+# =============
+
+# - Extern Interfaces DSL Lines
+# -    (blank separated list)
+ext_if_dsl_1="ppp-st"
+ext_if_dsl_2="ppp-surf1"
+ext_if_dsl_3=""
+ext_if_dsl_4=""
+
+ext_ifs_dsl="$ext_if_dsl_1 $ext_if_dsl_2 $ext_if_dsl_3 $ext_if_dsl_4"
+
+# - Extern Interfaces Static Lines
+# -    (blank separated list)
+ext_if_static_1="eth9"
+ext_if_static_2=""
+ext_if_static_3=""
+ext_if_static="$ext_if_static_1 $ext_if_static_2 $ext_if_static_3"
+
+# - VPN Interfaces
+# -    (blank separated list)
+vpn_ifs="tun+"
+
+# - Local Interfaces
+local_if_1="bond1"
+local_if_2="bond0.11"
+local_if_3="bond0.77"
+local_if_4="bond0.78"
+local_if_5="eth3"
+local_if_6="eth7"
+local_if_7=""
+
+local_ifs="$local_if_1 $local_if_2 $local_if_3 $local_if_4 $local_if_5 $local_if_6 $local_if_7"
+
+# - Are local alias interfaces like eth0:0 defined"
+# -
+local_alias_interfaces=true
+
+
+
+# =============
+# --- Define Ports for Services out
+# =============
+
+standard_ident_port=113
+standard_silc_port=706
+standard_irc_port=6667
+standard_jabber_port=5222
+standard_smtp_port=25
+standard_ssh_port=22
+standard_http_port=80
+standard_https_port=443
+standard_ftp_port=21
+standard_tftp_udp_port=69
+standard_ntp_port=123
+standard_timeserver_port=37
+standard_pgp_keyserver_port=11371
+standard_telnet_port=23
+standard_whois_port=43
+standard_cpan_wait_port=1404
+standard_hbci_port=3000
+standard_mysql_port=3306
+standard_cups_port=631
+standard_print_port=9100
+standard_remote_console_port=5900
+
+
+# - Comma separated lists
+# -
+standard_http_ports="80,443"
+standard_mailuser_ports="587,465,110,995,143,993"
+
+
+
+# =============
+# --- Interfaces completly blocked
+# =============
+
+# - Interfaces to block (note: they will all be blocked)
+# -
+# - Here: eth1 is used for DSL Line, that becomes an extra 
+# - interface (ppp-light). A further use of eth1 (which would 
+# - be possible) is not configured at time, so you can block it.
+# -
+blocked_ifs=""
+
+
+
+# =============
+# --- Interfaces not firewalled
+# =============
+
+# - Note:
+# - Can be (for example) an interface, whose (complete) traffic is 
+# - protected by a firewall on an other system in the local area 
+# -
+# - Here: the static line castle stockhausen
+# -
+unprotected_ifs=""
+
+
+# =============
+# --- Networks not firewalled through extern interfaces
+# =============
+
+# - Allow these networks any access to the internet.
+# -
+# - Blank separated list of networks
+# -
+any_access_to_inet_networks=""
+
+
+
+# =============
+# - Allow local services from given local networks
+# =============
+
+# - allow_local_net_to_local_service
+# - 
+# - allow_local_net_to_local_service="local-net:local-service:port:protocol"
+# -
+# - Only 'tcp' and 'udp' are allowed valuse for protocol.
+# -
+# - Use this parameter to (only) give some local netwoks access to special local 
+# - services (but not for all local networks as you can configure later).
+# -
+# - If you plan to separate local networks (see parameter 'separate_local_networks'), but 
+# - to allow these networks some special local services, you can also use this parameter.
+# -
+# - Example:
+# -    allow access from 10.113.0.0/16 to https service at 192.168.10.1
+# -    allow access from 10.113.0.0/16 to https service at 192.168.10.13
+# -
+# -    allow_local_net_to_local_service="10.113.0.0/16:192.168.10.1:$standard_https_port:tcp 
+# -                                      10.113.0.0/16192.168.10.13:$standard_https_port:tcp"
+# -
+# - Blank separated list
+# -    
+allow_local_net_to_local_service="10.113.0.0/16:192.168.10.1:$standard_https_port:tcp
+                                  10.113.0.0/16:192.168.10.13:$standard_https_port:tcp"
+#allow_local_net_to_local_service=""
+
+
+
+
+# =============
+# --- Separate local Networks
+# =============
+
+# - Don't allow these networks any connections to other local networks
+# -
+# - Example:
+# -    separate_local_networks="10.113.1.0/24 10.113.2.0/24"
+# -
+# - 10.113.0.0/16: Accesspoint Networks Schloss
+# - 10.123.0.0/16: Accesspoint Networks Altenschlirf
+# -
+separate_local_networks="10.113.0.0/16 10.123.0.0/16"
+#separate_local_networks=""
+
+
+
+# =============
+# --- Traffic Shaping
+# =============
+
+TRAFFIC_SHAPING=false
+
+RATE_UP=10000
+LIMIT_UP=$(expr $RATE_UP / 100 \* 85)
+
+LIMIT_CLASS=$(expr $LIMIT_UP / 7)
+
+RTP_PORTS_START=49152
+RTP_PORTS_END=49408
+SIP_PORT_REMOTE=5060
+SIP_PORT_LOCAL=5067
+SIP_LOCAL_IP=192.168.63.240
+STUN_PORTS=3478
+
+TC_DEV=$ext_if_dsl_1
+
+
+
+# =============
+# ---- Allow Forwarding (private) IPs / IP-Ranges
+# =============
+
+# - Maybe useful in case of virtual hosts with private addresses or
+# - if using a vpn network to forward into private areas.
+# -
+# - Note: this rules takes affect before rules to protect against
+# -       unwanted packages e.g. blocking private addresses on
+# -       externel interfaces.
+# -       
+# - Note: you can specify networks using CIDR notation
+# -       like "192.168.2.0/24"
+# -
+forward_private_ips=""
+
+
+
+# =============
+# --- Services local machine / local networksa
+# =============
+
+# ======
+# - IPv6 over IPv4 (SixXS)
+# ======
+
+local_sixxs_service=false
+tic_server=tic.sixxs.net
+six_pop_server=deham01.sixxs.net
+
+
+# ======
+# - VPN Service
+# ======
+
+# - VPN Service on Gateway?
+local_vpn_service=true
+vpn_gw_ports="1194 1195 1196"
+
+# - VPN Services DMZ (reachable also from WAN)
+# -
+# - vpn_server_dmz_arr=[<ip-address>]=<dsl-device>
+# -
+# - Note:
+# -    Each extern interface can have only one thuch service 
+# -
+# - Example:
+# -   vpn_server_dmz_arr[192.168.10.1]=$ext_if_dsl_1
+# -   vpn_server_dmz_arr[192.168.10.13]=$ext_if_dsl_2
+# -
+declare -A vpn_server_dmz_arr
+#vpn_server_dmz_arr[192.168.10.1]=$ext_if_dsl_1
+
+# - Local VPN Ports
+# -
+# - Blank separated list
+vpn_local_net_ports="1194"
+
+
+# ======
+# - DHCP Service
+# ======
+
+# - DHCP Server Gateway
+local_dhcp_service=true
+
+
+# ======
+# - DNS Service
+# ======
+
+# - DNS Service Gateway
+local_dns_service=true
+
+# - DNS Server local Networks
+# -
+# - 192.168.11.1    - ga-schloss
+# - 192.168.11.3    - GAASDC03.ga.intra (windows server Schloss)
+# - 192.168.10.254  - ga-al
+# - 192.168.10.3    - GAASDC01.ga.intra (Windows Server Altenschlirf)
+# - 192.168.81.1    - ga-nh (Novalishaus)
+# - 
+# - Blank separated list
+dns_server_ips="192.168.11.1 192.168.11.3 192.168.10.3 192.168.10.254 192.168.81.1 172.16.0.1"
+
+
+# ======
+# - SSH
+# ======
+
+# - SSH Service Gateway
+local_ssh_service=true
+
+# - SSH Ports
+# -
+# - blank separated list
+# -
+ssh_ports="22"
+
+
+# ======
+# - HTTP(S) Service
+# ======
+
+# - HTTP(S) Service Gateway
+local_http_service=false
+
+# - HTTP(S) Services only locale Networks
+# -
+# - Telefonanlage
+# - =============
+# - 192.168.10.20    Telefon Anlage Altenschlirf
+# - 192.168.11.20    Telefon Anlage Schloss
+# - 192.168.81.20    Telefon Anlage Novalishaus
+# -
+# - 192.168.10.16    Xymon Server
+# - 
+# - Drucker
+# - =======
+# - 
+# -
+# - Switches
+# - ========
+# - 172.16.0.243     Uplink Schloss / IPMI Altenschlirf
+# -
+# -
+# - IPMI
+# - ====
+# - 172.17.0.15      IPMI Gateway Altenschlirf
+# -
+# - Blank separated list of ipv4-addresses
+# -
+http_server_only_local_ips="
+   172.16.0.243
+   172.17.0.15
+   192.168.10.20
+   192.168.11.20
+   192.168.81.20
+   192.168.10.16"
+
+# - HTTP(S) Services DMZ (reachable also from WAN)
+# -
+# - http_server_dmz_arr[<ip-address>]=<dsl-device>
+# -
+# - Note:
+# -    Each extern interface can have only one service on a certain port.
+# -
+# - 192.168.10.1     Mail Server incomming on ppp-st ($ext_if_dsl_1)
+# - 192.168.10.13    Citrix Server incomming on ppp-surf1 ($ext_if_dsl_2)
+# -
+# - Example:
+# -    http_server_dmz_arr[192.168.10.1]=$ext_if_dsl_2
+# -    http_server_dmz_arr[192.168.10.13]=$ext_if_dsl_1
+# -
+# - WebServer Luna: 192.168.63.20 (ppp-ckubu = $ext_if_dsl_1)
+declare -A http_server_dmz_arr
+#http_server_dmz_arr[192.168.10.1]=$ext_if_dsl_1
+
+# - HTTPS Services DMZ only port 443 (reachable also from WAN)
+# -
+# - http__ssl_server_dmz_arr[<ip-address>]=<dsl-device>
+# -
+# - Note:
+# -    Each extern interface can have only one thuch service 
+# -
+# - 192.168.10.1     Mail Server incomming on ppp-st ($ext_if_dsl_1)
+# - 192.168.10.13    Citrix Server incomming on ppp-surf1 ($ext_if_dsl_2)
+# -
+# - Example:
+# -
+# -    http_ssl_server_dmz_arr[192.168.10.1]=$ext_if_dsl_1
+# -    http_ssl_server_dmz_arr[192.168.10.13]=$ext_if_dsl_2
+# -
+declare -A http_ssl_server_dmz_arr
+http_ssl_server_dmz_arr[192.168.10.1]=$ext_if_dsl_1
+http_ssl_server_dmz_arr[192.168.10.13]=$ext_if_dsl_2
+
+# - HTTP(S) Ports 
+# -
+# - comma separated list
+# -
+http_ports="80,443"
+
+
+# ======
+# - Mail Services
+# ======
+
+# - Mailserver (SMTP(POP/IMAP) Gateway
+# -
+# - NOT YET IMPLEMENTED
+# -
+#local_mail_service=false
+
+# - Mail Services smtp,smtps/pop(s)/imap(s) only local Networks
+# -
+# - comma separated list
+# -
+mail_server_only_local_ips=""
+
+# - Mails Services DMZ smtp,smtps/pop(s)/imap(s) (reachable also from WAN)
+# -
+# - mail_server_dmz_arr[<ip-address>]=<dsl-device>
+# -
+# - multiple declarations are possible
+# -
+# - Example:
+# -    Mail Server:   192.168.10.1 incomming on ppp-st ($ext_if_dsl_1)
+# -
+# -    mail_server_dmz_arr[192.168.10.1]=$ext_if_dsl_1
+# -
+declare -A mail_server_dmz_arr
+mail_server_dmz_arr[192.168.10.1]=$ext_if_dsl_1
+
+# - Mail client ports (smtps/pop(s)/imap(s)
+# -
+# - comma separated list
+mail_user_ports="587,465,110,995,143,993"
+
+# - Mail Server (local Networks) SMTP Port
+# -
+mail_smtp_port=$standard_smtp_port
+
+
+# ======
+# - FTP Service
+# ======
+
+# - FTP Service Gateway
+# -
+local_ftp_service=false
+
+# - FTP Server at local Networks
+# -
+# - comma separated list
+# -
+ftp_server_only_local_ips=""
+
+# - FTP Service DMZ
+# -
+# - Note:
+# -    Each extern interface can have only one thuch service 
+# -
+# - ftp_server_dmz_arr[<ip-address>]=<dsl-device>
+# - ftp_passive_port_range=<first-port:last-port>
+# -
+declare -A ftp_server_dmz_arr
+#ftp_server_dmz_arr[192.168.63.20]=$ext_if_dsl_1
+ftp_passive_port_range="50000:50400"
+
+# - FTP Ports
+# -
+# - Hard scriptetd:
+# -    FTP Control Port: 21
+# -    FTP Data Port:    20
+
+
+# ======
+# - TFTP Service Gateway
+# ======
+
+# - TFTP Server Gateway (Port udp 69)
+local_tftp_service=false
+
+# - TFTP Server at local Networks
+# -
+# - 192.168.10.20   - Telefonanlage (Schloss)
+# -
+tftp_server_ips="192.168.10.20"
+
+# - TFTF Ports
+# -
+# - Note: its udp !
+# -
+tftp_udp_port=69
+
+
+# ======
+# - LDAP Service
+# ======
+
+# - Is this a LDAP Server ?
+# -
+local_ldap_service=false
+
+# - LDAP Service local Networks
+# -
+# - Ports: 389 udp 
+# -        389 tcp
+# -
+# - Ports LDAP SSL: 636 tcp
+# -
+ldap_server_local_ips=""
+ldap_udp_ports="389"
+ldap_tcp_ports="389 636"
+
+
+# ======
+# - Samba Service
+# ======
+
+# - Samba Server Gateway
+# -
+local_samba_service=false
+
+# - Samba Service
+# -
+# - Ports: 137,138 udp 
+# -        139,445 tcp
+# -
+samba_udp_ports="137:138"
+samba_tcp_ports="137 138 139 445"
+
+# - Samba Service local networks
+# -
+# - ??     Windows Server Altenschlirf
+# -
+samba_server_local_ips=""
+
+# - Samba Service DMZ
+# - 
+# - Note:
+# -    Each extern interface can have only one thuch service 
+# -
+# -    samba_server_dmz_arr[<ip-address>]=<dsl-device>
+# -
+declare -A samba_server_dmz_arr
+#samba_server_dmz_arr[192.168.10.10]=$ext_if_dsl_1
+
+
+# ======
+# - NTP Service
+# ======
+
+# - NTP Service Gateway
+# -
+local_ntp_service=true
+
+
+# ======
+# - SNMP Service
+# ======
+
+# - SNMP services local Networks
+# -
+# - Blank separated list of ipv4-addresses
+# -
+snmp_server_ips=""
+
+# - SNMP Port
+# -
+snmp_port="161"
+
+
+# ======
+# - Mumble Service
+# ======
+
+# - NOT YET IMPLEMENTED
+
+# - Mumble ports
+mumble_ports="64738"
+
+
+# ======
+# - XyMon Service
+# ======
+
+# - XyMon Service Gateway (usually TCP port 1984)
+# -
+local_xymon_server=false
+
+# - XyMon Service (usually TCP port 1984)
+# -
+# - Comma separated list of ip's
+# -
+xymon_server_ips="192.168.10.16"
+local_xymon_client=""
+
+# - XyMon Ports
+# -
+xymon_port=1984
+
+
+# ======
+# - Munin Service
+# ======
+
+# - Munin Service Gateway (usually TCP port 4949)
+# -
+local_munin_server=false
+
+# - If 'local_munin_server=' provide service also to inet?
+# -
+provide_munin_service_to_inet=true
+munin_remote_port="4949"
+
+# - Munin Server local Networks (usually TCP port 4949)
+# -
+# - Blank separated list
+munin_local_server_ips=""
+
+# - Munin Remote Server
+# -
+# - Note: 
+# - The munin server himself initiates the connection to the concerning clients.
+# - In case of natted (local) networks you have to also nat the incomming
+# - requests from munin server.
+# -
+# - Note:
+# -    Each extern interface can have only one thuch service 
+# -
+# - munin_local_client_ip_arr[<ip-address>]=<dsl-device>
+# -
+#munin_remote_server="83.223.86.163"
+munin_remote_server=""
+
+# - Munin - clients on local network (server is $munin_remote_server)
+# -
+# - Example:
+# -    munin_local_client_ip_arr[192.168.63.20]=$ext_if_dsl_1
+# -
+declare -A munin_local_client_ip_arr
+#munin_local_client_ip_arr[192.168.63.20]=$ext_if_dsl_1
+
+# - Munin Port
+# -
+munin_local_port=4949
+
+
+# ======
+# - PowerChut Network Shutdown (PCNS)
+# ======
+
+# - PCNS local Services
+# -
+pcns_server_ips=""
+
+# - local USV
+# -
+usv_ip=""
+
+# - PCNS Ports
+# -
+# - Webinterface (https): tcp 6547
+# - Connection usv:       tcp/udp 3052
+# -
+pcns_tcp_port=3052
+pcns_udp_port=3052
+pcns_web_port=6547
+
+
+# ======
+# - Remote Console (VNC Service)
+# ======
+
+# - VNC Service local network
+# 
+# - Blank separated list
+# -
+# - 172.17.0.15      IPMI Gateway Altenschlirf
+# - 172.16.11.15     IPMI Gateway Schloss
+# - 10.11.11.16      IPMI Gateway Ersatz
+# - 192.168.81.15  Gateway Novalishaus
+# -
+rm_server_ips="172.17.0.15 172.16.11.15 10.11.11.16 192.168.81.15"
+
+# - VNC Service DMZ
+# -
+# - Note:
+# -    Each extern interface can have only one thuch service 
+# -
+# -    rm_server_dmz_arr[<ip-address>]=<dsl-device>
+# -
+declare -A rm_server_dmz_arr
+#rm_server_dmz_arr[192.168.63.20]=$ext_if_dsl_1
+
+# - Remote Console (VNC) Port
+# -
+remote_console_port=5900
+
+
+# ======
+# - Ubiquiti Unifi
+# ======
+
+# - Notice:
+# -    The Accesspoint IP is not needed (i think so), because the 
+# -    AP uses port 8080 for cummunication with the controller, and
+# -    this port will be configured with the rules concerning the 
+# -    controllers.
+# -
+# - again: setting unifi_ap_local_ips is not needed
+#unifi_ap_local_ips="192.168.64.50"
+
+unifi_controller_gateway_ips=""
+unify_controller_local_net_ips=""
+unify_controller_ports="8080,8443"
+
+provide_hotspot=true
+hotspot_ports="8880,8843"
+
+
+# ======
+# - IPMI Tools 
+# ======
+
+# - IPMI Tools local Networks
+# -
+# - Blank seoarated list
+# -
+# - 172.17.0.15    Gateway Altenschlirf
+# - 172.16.11.15   Gateway Schloss
+# - 10.11.11.16    Ersatz Gateway
+# - 192.168.81.15  Gateway Novalishaus
+# -
+ipmi_server_ips="
+   172.17.0.15
+   172.16.11.15
+   10.11.11.16
+   192.168.81.15"
+
+# - IPMI Tools Port
+# -
+# - UDP 623:  Access IPMI Programms (as IPMIView or FreeIPMI)
+# - TCP 623:  Virtual Media for Remote Console
+# - TCP 3520: "This is TCP Port 3520 which is also needed in addition to TCP port 5900 to be able to use iKVM."
+# -
+ipmi_udp_port=623
+ipmi_tcp_ports="623 3520"
+
+
+# =============
+# - Protocols Out for give src ip-addresses
+# =============
+
+# - Rsync Protocol
+# -
+# - The given server address (from local network) can access rsyncd at (any) remote machine
+# -
+# - Needed for some integrated provider of clamav-unofficial-sigs
+# -
+local_rsync_out=false
+rsync_out_ips=""
+rsync_ports="873"
+
+
+
+# =============
+# --- Scanner
+# =============
+
+# ======
+# - Brother (brscan)
+# ======
+
+# - IP Adresses Brother Scanner
+# -
+# - Blank seoarated list
+# -
+brother_scanner_ips=""
+brscan_port=54921
+
+
+
+# =============
+# --- Telefon Systems
+# =============
+
+# - IP Adresses Telephone Systems (Telefonanlagen)
+# -
+# - Dont't foregt to add ip-adresses also to http(s) service if the
+# - systems provide webinterfaces!
+# -
+tele_sys_ips="
+   192.168.10.20
+   192.168.11.20
+   192.168.81.20"
+tele_sys_remote_sip_server_port=5060
+tele_sys_local_sip_server_port=5067
+allow_between_tele_systems=true
+
+VOIP_PORTS="69 5000:5099 7775 32000:32512"
+# -    TFTP=69 (used from telephones getting their connection data / firmwareupdate )
+# -    RTP_PORTS= UDP i.e. 5000:5099 or here
+# -    RTP_PORTS_END=5099
+#SIP_PORT_REMOTE=5060
+#SIP_PORT_LOCAL=5067
+#SIP_LOCAL_IP=192.168.63.240
+#STUN_PORTS=3478
+udp_voip_ports="7775 5000:5099"
+
+
+# =====
+# - Telekom Internet TV (Entertain)
+# =====
+
+telekom_internet_tv=false
+tv_ip=""
+tv_extern_if="eth2.8"
+tv_local_if="$local_if_1"
+
+
+# =============
+# --- Masuqerading
+# =============
+
+# - Masquerade TCP Connections
+# -
+# -    masquerade_tcp_con="<src-network>:<dst-host>:<dst-port>:<output-device> [<src-network>:<dst-host>:..]"
+# -
+# -    172.16.11.254: Zyxel Speedport 5501
+# -    192.168.11.29: VNC Service Heizungssystem
+# -
+# -    masquerade_tcp_con="10.0.0.0/8:172.16.11.254:80:${local_if_7} 
+# -                        10.0.0.0/8:192.168.62.244:443:${local_if_1}"
+# -
+masquerade_tcp_cons="10.0.0.0/8:192.168.11.29:5900:${local_if_1}
+                     192.168.63.0/24:192.168.11.29:5900:${local_if_1}
+                     192.168.10.131/32:192.168.11.29:5900:${local_if_1}
+                     10.0.0.0/8:172.16.11.254:80:${ext_if_static_1}
+                     192.168.63.0/24:172.16.11.254:80:${ext_if_static_1}"
+
+
+# =============
+# --- Portforwarding
+# =============
+
+# - Portforwarding TCP
+# -
+# - portforward_tcp="<device-in>:<port-in>:<ip-to-forward>:<port-out>"
+# -
+# - multiple declarations are possible
+# - 
+# - Example:
+# -    portforward_tcp="$ext_if_dsl_1:9997:192.168.52.25:22 $ext_if_dsl_1:9998:192.168.53.24:22"
+# -
+portforward_tcp=""
+
+# - Portforwarding UDP
+# -
+# - portforward_udp="<device-in>:<udp-port-in>:<ip-to-forward>:<udp-port-out>"
+# -
+# - multiple declarations are possible
+# - 
+# - Example:
+# -    portforward_udp="$ext_if_dsl_1:1094:192.168.52.25:1094 $ext_if_dsl_1:9999:192.168.53.24:1095"
+# -
+portforward_udp=""
+
+
+
+# =============
+# --- Basic behavior
+# =============
+
+# ===
+# = Services allowed out to the world wide web
+# ===
+
+allow_ssh_request_out=true
+allow_http_request_out=true
+allow_smtp_request_out=true
+allow_mail_request_out=true
+allow_ftp_request_out=true
+allow_tftp_request_out=true
+allow_ntp_request_out=true
+allow_timeserver_request_out=true
+allow_pgpserver_request_out=true
+allow_telnet_request_out=true
+allow_whois_request_out=true
+allow_cpan_wait_request_out=true
+allow_hbci_request_out=true
+allow_jabber_request_out=true
+allow_silc_request_out=true
+allow_irc_request_out=true
+allow_mysql_request_out=true
+allow_ipmi_request_out=true
+allow_remote_console_request_out=true
+
+allow_samba_requests_out=true
+
+allow_vpn_out=true
+vpn_out_ports="1194 1195 1196"
+
+
+# ===
+# = Services allowed between local networks
+# ===
+
+# - These Parameters are only considered, if traffic 
+# - between local networks are not permitted, thats 
+# - if 'permit_between_local_networks=false' (see below).
+# - 
+allow_ssh_between_local_nets=true
+allow_samba_between_local_nets=false
+allow_ldap_between_local_nets=false
+allow_printing_between_local_nets=true
+allow_scanning_between_local_nets=true
+
+
+# ===
+# = Other Parameters
+# ===
+
+# - Permit internet access to all machines at local network
+# - Does not include this server itself
+# -
+permit_local_net_to_inet=true
+
+# - Do not block any traffic between local machines
+# -
+permit_between_local_networks=true
+
+# - Do not block any ICMP traffic
+# -
+permit_all_icmp_traffic=true
+
+# - Access to Mailservices (LAN and WAN) (pop/imap/smtps) from local (gateway) machine.
+# -
+# - Maybe useful for testing purpose with telnet or openssl
+# -
+provide_mailservice_from_local=true
+
+# - iPerf is a tool for active measurements of the maximum achievable bandwidth on IP networks. 
+# - It supports tuning of various parameters related to timing, buffers and protocols (TCP, UDP, 
+# - SCTP with IPv4 and IPv6). For each test it reports the bandwidth, loss, and other parameters.
+# -
+create_iperf_rules=false
+
+
+
+# =============
+# - MAC Address Filtering
+# =============
+
+# - MAC Addreses alowed to all destinations (gateway, remote, local networks)
+# -
+# - Blank separated list
+# -
+#allow_all_mac_src_addresses="c4:54:44:30:d3:0f"
+allow_all_mac_src_addresses=""
+
+# - MAC Addreses alowed to local networks (gateway, local networks)
+# -
+# - Blank separated list
+# -
+#allow_local_mac_src_addresses="c4:54:44:30:d3:0f"
+allow_local_mac_src_addresses=""
+
+
+# - MAC Addreses alowed to remote networks
+# -
+# - Blank separated list
+# -
+#allow_remote_mac_src_addresses="c4:54:44:30:d3:0f"
+allow_remote_mac_src_addresses=""
+
+
+
+
+# =============
+# --- Block IP's / IP-Ranges
+# =============
+
+# -    222.184.0.0/13 CHINANET-JS
+# -    61.160.0.0/16 - CHINANET-JS
+# -    116.8.0.0/14 CHINANET-GX
+# -
+blocked_ips="222.184.0.0/13 61.160.0.0/16 116.8.0.0/14"
+
+
+# =============
+# --- Block Ports on extern Interfaces
+# =============
+
+# - Generally (for all interfaces) block this ports
+# -
+# - Portmapper
+# - tcp 111
+# - udp 111
+# -
+# - Authentication tap ident
+# - tcp 113
+# -
+# - Location Service
+# - tcp 135
+# -
+# - Windows Stuff
+# - tcp 137:139
+# - udp 137:139
+# - tcp 445
+# -
+block_tcp_ports="111 135 631"
+block_udp_ports="111"
+if ! $allow_samba_requests_out ; then
+   block_tcp_ports="$block_udp_ports 137:139 445"
+   block_udp_ports="$block_udp_ports 137:139"
+fi
+
+block_ident=true
+
+
+# =============
+# - Packets not wanted on gateway on local Interfaces
+# =============
+
+not_wanted_on_gw_tcp_ports="111 113 135 631"
+not_wanted_on_gw_udp_ports="111 631"
+if ! $local_samba_service ; then
+   not_wanted_on_gw_tcp_ports="$not_wanted_on_gw_tcp_ports 137:139 445"
+   not_wanted_on_gw_udp_ports="$not_wanted_on_gw_udp_ports 137:139"
+fi
+
+not_wanted_ident=true
+
+
+# =============
+# --- Router 
+# =============
+
+# - Set to "true" to secure/tune the kernel
+# -
+adjust_kernel_parameters=true
+
+# - Protection against several attacks
+# -
+protect_against_several_attacks=true
+
+
+
+# =============
+# --- Kernel related - Adjust Kernel Parameters (Security/Tuning)
+# =============
+
+# - Activate forwarding
+# -
+# - Enable/disable forwarding to and between interfaces
+# -
+kernel_activate_forwarding=true
+
+# - Activate kernel support for dynamic IP adresses
+# - (not needed in case of static IP)
+# -
+# - see also https://www.frozentux.net/iptables-tutorial/other/ip_dynaddr.txt
+# -
+# - The values for the ip_dynaddr sysctl are [*]:
+# -
+# -   1:  To enable:
+# -   2:  To enable verbosity:
+# -   4:  To enable RST-provoking:
+# -   8:  To enable asymetric routing work-around [**]
+# -
+# -  [*] At boot, by default no address rewriting is attempted.
+# -  [**] This code is currently totaly untested.
+# -
+# - Flags can be combined by adding them. Common settings
+# - would be:
+# -
+# - To enable rewriting in quiet mode:
+# -   # echo 1 > /proc/sys/net/ipv4/ip_dynaddr
+# - To enable rewriting in verbose mode:
+# -   # echo 3 > /proc/sys/net/ipv4/ip_dynaddr
+# - To enable quiet RST-provoking mode (1+4):
+# -   # echo 5 > /proc/sys/net/ipv4/ip_dynaddr
+# - ...
+# -
+kernel_support_dynaddr=true
+dynaddr_flag="5"
+
+# - Reduce DoS'ing ability by reducing timeouts
+# -
+kernel_reduce_timeouts=true
+
+# - Hardening TCP/IP Stack Against SYN Floods
+# -
+# - Enable syn cookies prevents against the common 'syn flood attack'
+# -
+kernel_tcp_syncookies=true
+
+# - Protection against ICMP bogus error responses
+# -
+kernel_protect_against_icmp_bogus_messages=true
+
+# - Ignore Broadcast Pings
+# -
+kernel_ignore_broadcast_ping=true
+
+# - Deactivate Source Routed Packets
+# -
+kernel_deactivate_source_route=true
+
+# - Deactivate sending ICMP redirects
+# -
+# - Note: IP TV requires sending ICMP redirects. So if IP TV is provided, this
+# -       Parameter will be set to "false"
+# -
+# - ICMP redirects are used by routers to specify better routing paths out of 
+# - one network, based on the host choice, so basically it affects the way 
+# - packets are routed and destinations. 
+# -
+kernel_dont_accept_redirects=true
+
+# - Activate Reverse Path Filtering (Antispoofing)
+# -
+# - Reverse Pfadfilterung aktivieren. Dies hilft durch automatisches Ablehnen 
+# - von Quelladressen, die nicht mit dem Netzwerkinterface übereinstimmen, 
+# - sicherzustellen, dass Pakete legitime Quelladressen benutzen. Dies hat
+# - Sicherheitsvorteile, da es IP Spoofing verhindert. Wir müssen es für 
+# - alle net/ipv4/conf/* aktivieren, da sonst die Validierung der Quelle 
+# - nicht voll funktionsfähig ist. 
+# -
+kernel_activate_rp_filter=true
+
+# - Logging of spoofed (source routed" and "redirect") packets
+# -
+kernel_log_martians=false
+
+
+
+# =============
+# --- Some further Ports/IP-Address Configuration
+# =============
+
+# - unpriviligierte Ports
+# -
+unprivports="1024:65535"
+
+# - Loopback
+loopback="127.0.0.0/8"
+
+# - Private Networks
+priv_class_a="10.0.0.0/8"
+priv_class_b="172.16.0.0/12"
+priv_class_c="192.168.0.0/16"
+
+# - Multicast Addresse
+class_d_multicast="224.0.0.0/4"
+
+# Reserved Addresse
+class_e_reserved="240.0.0.0/5"
+
+
+# ----------------------- End: Configuration ----------------------- #
+######################################################################
+
+
+## ====================================
+## - Don't make changes after this Line
+## ====================================
+
+
+# -----------
+# --- Define Arrays
+# -----------
+
+# ---
+# - Masquerade TCP Connections
+# ---
+declare -a masquerade_tcp_con_arr
+for _str in $masquerade_tcp_cons ; do
+   masquerade_tcp_con_arr+=("$_str")
+done
+
+
+# ---
+# - Extern Network interfaces (DSL, Staic Lines, All together)
+# ---
+declare -a dsl_device_arr
+declare -a ext_if_arr
+for _dev in $ext_ifs_dsl ; do
+   dsl_device_arr+=("$_dev")
+   ext_if_arr+=("$_dev")
+done
+for _dev in $ext_if_static ; do
+   ext_if_arr+=("$_dev")
+done
+
+# ---
+# - VPN Interfaces
+# ---
+declare -a vpn_if_arr
+for _dev in $vpn_ifs ; do
+   vpn_if_arr+=("$_dev")
+done
+
+# ---
+# - Local Network Interfaces
+# ---
+declare -a local_if_arr
+for _dev in $local_ifs ; do
+   local_if_arr+=("$_dev")
+done
+
+# ---
+# - Network Interfaces completly blocked
+# ---
+declare -a blocked_if_arr
+for _dev in $blocked_ifs ; do
+   blocked_if_arr+=("$_dev")
+done
+
+# ---
+# - Network Interfaces not firewalled
+# ---
+declare -a unprotected_if_arr
+for _dev in $unprotected_ifs ; do
+   unprotected_if_arr+=("$_dev")
+done
+
+# ---
+# - Allow these local networks any access to the internet
+# ---
+declare -a any_access_to_inet_network_arr
+for _net in $any_access_to_inet_networks ; do
+   any_access_to_inet_network_arr+=("$_net")
+done
+
+# ---
+# - Allow local services from given local networks
+# ---
+declare -a allow_local_net_to_local_service_arr 
+for _val in $allow_local_net_to_local_service ; do
+   allow_local_net_to_local_service_arr+=("$_val")
+done
+
+# ---
+# - Separate local Networks
+# ---
+declare -a separate_local_network_arr
+for _net in $separate_local_networks ; do
+   separate_local_network_arr+=("$_net")
+done
+
+# ---
+# - Generally block ports on extern interfaces
+# ---
+declare -a block_tcp_port_arr
+for _port in $block_tcp_ports ; do
+   block_tcp_port_arr+=("$_port")
+done
+
+declare -a block_udp_port_arr
+for _port in $block_udp_ports ; do
+   block_udp_port_arr+=("$_port")
+done
+
+# ---
+# - Not wanted on intern interfaces
+# ---
+declare -a not_wanted_on_gw_tcp_port_arr
+for _port in $not_wanted_on_gw_tcp_ports ; do
+   not_wanted_on_gw_tcp_port_arr+=("$_port")
+done
+
+declare -a not_wanted_on_gw_udp_port_arr
+for _port in $not_wanted_on_gw_udp_ports ; do
+   not_wanted_on_gw_udp_port_arr+=("$_port")
+done
+
+# ---
+# - Private IPs / IP-Ranges allowed to forward
+# ---
+declare -a forward_private_ip_arr
+for _ip in $forward_private_ips ; do
+   forward_private_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses to log
+# ---
+declare -a log_ip_arr
+for _ip in $log_ips ; do
+   log_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses Gateway
+# ---
+declare -a gateway_address_arr
+read -a gateway_address_arr <<<$(ifconfig | grep "inet Ad" | awk '{print$2}' | cut -d':' -f2)
+
+# ---
+# - IP Adresses DNS Server
+# ---
+declare -a dns_server_ip_arr
+for _ip in $dns_server_ips ; do
+   dns_server_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Adresses HTTP Server only local Networks
+# ---
+declare -a http_server_only_local_ip_arr
+for _ip in $http_server_only_local_ips ; do
+   http_server_only_local_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses Mail Server only local Networks
+# ---
+declare -a mail_server_only_local_ip_arr
+for _ip in $mail_server_only_local_ips ; do
+   mail_server_only_local_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses FTP Server
+# ---
+declare -a ftp_server_only_local_ip_arr
+for _ip in $ftp_server_only_local_ips ; do
+   ftp_server_only_local_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses Samba Server
+# ---
+declare -a samba_server_local_ip_arr
+for _ip in $samba_server_local_ips ; do
+   samba_server_local_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses LDAP Server
+# ---
+declare -a ldap_server_local_ip_arr
+for _ip in $ldap_server_local_ips ; do
+   ldap_server_local_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Adresses Telephone Systems
+# ---
+declare -a tele_sys_ip_arr
+for _ip in $tele_sys_ips ; do
+   tele_sys_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Adresses SNMP Server
+# ---
+declare -a snmp_server_ip_arr
+for _ip in $snmp_server_ips ; do
+   snmp_server_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Adresses Munin Service 
+# ---
+declare -a munin_local_server_ip_arr
+for _ip in $munin_local_server_ips ; do
+   munin_local_server_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Adresses XyMon
+# ---
+declare -a xymon_server_ip_arr
+for _ip in $xymon_server_ips ; do
+   xymon_server_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Adresses IPMI interface
+# ---
+declare -a ipmi_server_ip_arr
+for _ip in $ipmi_server_ips ; do
+   ipmi_server_ip_arr+=("$_ip")
+done
+
+# ---
+# -IP Addresses Ubiquiti Unifi Accesspoints
+# ---
+declare -a unifi_ap_local_ip_arr
+for _ip in $unifi_ap_local_ips ; do
+   unifi_ap_local_ip_arr+=("$_ip")
+done
+declare -a unifi_controller_gateway_ip_arr
+for _ip in $unifi_controller_gateway_ips ; do
+   unifi_controller_gateway_ip_arr+=("$_ip")
+done
+declare -a unify_controller_local_net_ip_arr
+for _ip in $unify_controller_local_net_ips ; do
+   unify_controller_local_net_ip_arr+=("$_ip")
+done
+
+
+# ---
+# - IP Adresses Brother Scanner (brscan)
+# ---
+declare -a brother_scanner_ip_arr
+for _ip in $brother_scanner_ips ; do
+   brother_scanner_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses PCNS Server
+# ---
+declare -a pcns_server_ip_arr
+for _ip in $pcns_server_ips ; do
+   pcns_server_ip_arr+=("$_ip")
+done
+
+
+# ---
+# - IP Addresses VNC Service
+# ---
+declare -a rm_server_ip_arr
+for _ip in $rm_server_ips ; do
+   rm_server_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses Rsync Out
+# ---
+# local
+declare -a rsync_out_ip_arr
+for _ip in $rsync_out_ips ; do
+   rsync_out_ip_arr+=("$_ip")
+done
+
+# ---
+# - SSH Ports
+# ---
+declare -a ssh_port_arr
+for _port in $ssh_ports ; do
+   ssh_port_arr+=("$_port")
+done
+
+# ---
+# - VPN Ports
+# ---
+declare -a vpn_gw_port_arr
+for _port in $vpn_gw_ports ; do
+   vpn_gw_port_arr+=("$_port")
+done
+declare -a vpn_local_net_port_arr
+for _port in $vpn_local_net_ports ; do
+   vpn_local_net_port_arr+=("$_port")
+done
+declare -a vpn_out_port_arr
+for _port in $vpn_out_ports ; do
+   vpn_out_port_arr+=("$_port")
+done
+
+# ---
+# - Rsync Out Ports
+# --
+declare -a rsync_port_arr
+for _port in $rsync_ports ; do
+   rsync_port_arr+=("$_port")
+done
+
+# ---
+# - Samba Ports
+# ---
+
+declare -a samba_udp_port_arr
+for _port in $samba_udp_ports ; do
+   samba_udp_port_arr+=("$_port")
+done
+
+declare -a samba_tcp_port_arr
+for _port in $samba_tcp_ports ; do
+   samba_tcp_port_arr+=("$_port")
+done
+
+# ---
+# - LDAP Ports
+# ---
+
+declare -a ldap_udp_port_arr
+for _port in $ldap_udp_ports ; do
+   ldap_udp_port_arr+=("$_port")
+done
+
+declare -a ldap_tcp_port_arr
+for _port in $ldap_tcp_ports ; do
+   ldap_tcp_port_arr+=("$_port")
+done
+
+# ---
+# - IPMI
+# ---
+
+declare -a ipmi_tcp_port_arr
+for _port in $ipmi_tcp_ports ; do
+   ipmi_tcp_port_arr+=("$_port")
+done
+
+
+# ---
+# - Portforwrds TCP
+# ---
+declare -a portforward_tcp_arr
+for _str in $portforward_tcp ; do
+   portforward_tcp_arr+=("$_str")
+done
+
+# ---
+# - Portforwrds UDP
+# ---
+declare -a portforward_udp_arr
+for _str in $portforward_udp ; do
+   portforward_udp_arr+=("$_str")
+done
+
+# ---
+# - MAC Address Filtering
+# ---
+declare -a allow_all_mac_src_address_arr
+for _mac in $allow_all_mac_src_addresses ; do
+   allow_all_mac_src_address_arr+=("$_mac")
+done
+
+declare -a allow_local_mac_src_address_arr
+for _mac in $allow_local_mac_src_addresses ; do
+   allow_local_mac_src_address_arr+=("$_mac")
+done
+
+declare -a allow_remote_mac_src_address_arr
+for _mac in $allow_remote_mac_src_addresses ; do
+   allow_remote_mac_src_address_arr+=("$_mac")
+done
+
+
+# =============
+# --- Some functions
+# =============
+echononl(){
+   echo X\\c > /tmp/shprompt$$
+   if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
+      echo -e -n "$*\\c" 1>&2
+   else
+       echo -e -n "$*" 1>&2
+   fi
+   rm /tmp/shprompt$$
+}
+echo_done() {
+   echo -e "\033[75G[ \033[32mdone\033[m ]"
+}
+echo_ok() {
+   echo -e "\033[75G[ \033[32mok\033[m ]"
+}
+echo_warning() {
+   echo -e "\033[75G[ \033[33m\033[1mwarn\033[m ]"
+}
+echo_failed(){
+   echo -e "\033[75G[ \033[1;31mfailed\033[m ]"
+}
+echo_skipped() {
+   echo -e "\033[75G[ \033[33m\033[1mskipped\033[m ]"
+}
+
+
+fatal (){
+   echo ""
+   echo -e "fatal Error: $*"
+   echo ""
+   echo -e "\t\033[31m\033[1mScript will be interrupted..\033[m\033[m"
+   echo ""
+   exit 1
+}
+
+error(){
+   echo ""
+   echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*"
+   echo ""
+}
+
+warn (){
+   echo ""
+   echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*"
+   echo ""
+}
+
+info (){
+   echo ""
+   echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*"
+   echo ""
+}
+
+## - Check if a given array (parameter 2) contains a given string (parameter 1)
+## -
+containsElement () {
+   local e
+   for e in "${@:2}"; do [[ "$e" == "$1" ]] && return 0; done
+   return 1
+}
+
diff --git a/GA-Schloss/ipt-firewall/load_modules_ipv4.conf b/GA-Schloss/ipt-firewall/load_modules_ipv4.conf
new file mode 100644
index 0000000..bc383f0
--- /dev/null
+++ b/GA-Schloss/ipt-firewall/load_modules_ipv4.conf
@@ -0,0 +1,36 @@
+# =============
+# -  Load Kernel Modules
+# =============
+
+# - Note:! 
+# -    Since Kernel 4.7 the automatic conntrack helper assignment
+# -    is disabled by default (net.netfilter.nf_conntrack_helper = 0).
+# -    Enable it by setting this variable in file /etc/sysctl.conf:
+# -
+# -       net.netfilter.nf_conntrack_helper = 1
+# -
+# -    Reboot or type "sysctl -p"
+
+
+ip_tables
+
+iptable_nat
+iptable_filter
+iptable_mangle
+iptable_raw
+
+# - Load base modules for tracking
+# -
+nf_conntrack
+nf_nat
+
+# - Load module for FTP Connection tracking and NAT
+# -
+nf_conntrack_ftp
+nf_nat_ftp
+
+# - Load modules for SIP VOIP
+# -
+nf_conntrack_sip
+nf_nat_sip
+
diff --git a/GA-Schloss/ipt-firewall/load_modules_ipv6.conf b/GA-Schloss/ipt-firewall/load_modules_ipv6.conf
new file mode 100644
index 0000000..2c55689
--- /dev/null
+++ b/GA-Schloss/ipt-firewall/load_modules_ipv6.conf
@@ -0,0 +1,9 @@
+# =============
+# -  Load Kernel Modules
+# =============
+
+ip6_tables
+ip6table_filter
+ip6t_REJECT
+
+ip6table_mangle
diff --git a/GA-Schloss/ipt-firewall/logging_ipv4.conf b/GA-Schloss/ipt-firewall/logging_ipv4.conf
new file mode 100644
index 0000000..904ff86
--- /dev/null
+++ b/GA-Schloss/ipt-firewall/logging_ipv4.conf
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+# =============
+# --- Logging
+# =============
+
+log_all=false
+
+log_syn_flood=false
+log_fragments=false
+log_new_not_sync=false
+log_invalid_state=false
+log_invalid_flags=false
+log_spoofed=false
+log_spoofed_out=false
+log_to_lo=false
+log_not_wanted=false
+log_blocked=false
+log_unprotected=false
+log_prohibited=false
+log_voip=false
+log_rejected=false
+
+log_ssh=false
+
+# - Log using the specified syslog level. 7 (debug) is a good choice 
+# - unless you specifically need something else. 
+# -
+log_level=debug
+
+# - logging messages
+# -
+log_prefix="IPv4:"
+
+
+# ---
+# - Log all traffic for givven ip address
+# ---
+
+#log_ips="192.168.10.13"
+log_ips=""
diff --git a/GA-Schloss/ipt-firewall/logging_ipv6.conf b/GA-Schloss/ipt-firewall/logging_ipv6.conf
new file mode 100644
index 0000000..a024215
--- /dev/null
+++ b/GA-Schloss/ipt-firewall/logging_ipv6.conf
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+# =============
+# --- Logging
+# =============
+
+log_all=false
+
+log_syn_flood=false
+log_fragments=false
+log_new_not_sync=false
+log_invalid_state=false
+log_invalid_flags=false
+log_spoofed=false
+log_spoofed_out=false
+log_to_lo=false
+log_not_wanted=false
+log_blocked=false
+log_unprotected=false
+log_prohibited=false
+log_voip=false
+log_rejected=false
+
+log_ssh=false
+
+# - Log using the specified syslog level. 7 (debug) is a good choice 
+# - unless you specifically need something else. 
+# -
+log_level=debug
+
+# - logging messages
+# -
+log_prefix="IPv6:"
+
+
+# ---
+# - Log all traffic for givven ip address
+# ---
+
+log_ips=""
diff --git a/GA-Schloss/ipt-firewall/main_ipv4.conf b/GA-Schloss/ipt-firewall/main_ipv4.conf
new file mode 100644
index 0000000..e8ec8e9
--- /dev/null
+++ b/GA-Schloss/ipt-firewall/main_ipv4.conf
@@ -0,0 +1,1494 @@
+#!/usr/bin/env bash
+
+## ---------------------------------------------------------
+## --- Main Configurations Ipv4 Firewall Script ipt-firewall
+## ---------------------------------------------------------
+
+# ---
+# - IPv4 Addresses Gateway
+# ---
+declare -a gateway_ipv4_address_arr
+read -a gateway_ipv4_address_arr <<<$(ifconfig | grep "inet Ad" | awk '{print$2}' | cut -d':' -f2)
+
+
+# =============
+# --- Interfaces completly blocked
+# =============
+
+# - Interfaces to block (note: they will all be blocked)
+# -
+# - For Example: eth1 is used for DSL Line, that becomes an extra 
+# - interface (ppp-light). A further use of eth1 (which would 
+# - be possible) is not configured at time, so you can block it.
+# -
+blocked_ifs=""
+
+
+
+# =============
+# --- Interfaces not firewalled
+# =============
+
+# - Note:
+# - Can be (for example) an interface, whose (complete) traffic is 
+# - protected by a firewall on an other system in the local area 
+# -
+# - Here: the static line castle stockhausen
+# -
+unprotected_ifs=""
+
+
+
+# =============
+# --- Networks not firewalled through extern interfaces
+# =============
+
+# - Allow these networks any access to the internet.
+# -
+# - Blank separated list of networks
+# -
+any_access_to_inet_networks=""
+
+
+# - Allow these networks getting any access from the internet.
+# -
+# - Note:
+# - =====
+# -    Traffic recieved on natted interfaces will be ommitted!
+# -
+# - Blank separated list of networks
+# -
+any_access_from_inet_networks=""
+
+
+
+# =============
+# - Allow local services from given extern networks
+# =============
+
+# - allow_ext_net_to_local_service
+# - 
+# - allow_ext_net_to_local_service="ext-net:local-address:port:protocol"
+# -
+# - Note:
+# - =====
+# -    - Only 'tcp' and 'udp' are allowed valuse for protocol.
+# -    - Traffic recieved on natted interfaces will be ommitted!
+# -
+# - Use this parameter to (only) give some local netwoks access to special local 
+# - services (but not for all local networks as you can configure later).
+# -
+# - If you plan to separate networks (see parameter 'separate_local_networks'), but 
+# - to allow these networks some special local services, you can also use this parameter.
+# -
+# - Example:
+# -    allow access from 194.150.169.139 to ssh service at 83.223.73.210 on port 1036
+# -    allow access from 86.73.85.0/24 to https service at 83.223.73.204
+# -
+# -    allow_ext_net_to_local_service="194.150.169.139/32:83.223.73.210:1036:tcp 
+# -                                    86.73.85.0/24:83.223.73.204:$standard_https_port:tcp"
+# -
+# - Blank separated list
+# -    
+allow_ext_net_to_local_service=""
+
+
+
+# =============
+# - Allow all traffic from extern address/network to local address/network
+# =============
+
+# - allow_ext_net_to_local_net
+# -
+# -    allow_ext_net_to_local_net="<src-ext-net>:<dst-local-net> [<src-ext-net>:<dst-local-net>] [..]"
+# -
+# - All traffic from the given first network to the given second network is allowed
+# -
+# - Note:
+# - =====
+# -    - Traffic recieved on natted interfaces will be ommitted!
+# -    - If you want allow both directions, you have to make two entries - one for evry directions.
+# -
+# - Example:
+# -   allow_ext_net_to_local_net="86.223.85.0/24:86.223.73.192/26
+# -                               83.223.86.96/32:86.223.73.0/24"
+# - 
+# -
+# - 172.16.12.0/24 --> 192.168.10.0    # From VPN Fritzbox surf1 to 192.168.10.0
+# - 172.16.12.0/24 --> 192.168.11.0    # From VPN Fritzbox surf1 to 192.168.11.0
+# - 172.16.12.0/24 --> 192.168.77.0    # From VPN Fritzbox surf1 to 192.168.77.0
+# - 172.16.12.0/24 --> 192.168.78.0    # From VPN Fritzbox surf1 to 192.168.78.0
+# -
+# - 172.16.13.0/24 --> 192.168.10.0    # From VPN Fritzbox st to 192.168.10.0
+# - 172.16.13.0/24 --> 192.168.11.0    # From VPN Fritzbox st to 192.168.11.0
+# - 172.16.13.0/24 --> 192.168.77.0    # From VPN Fritzbox st to 192.168.77.0
+# - 172.16.13.0/24 --> 192.168.78.0    # From VPN Fritzbox st to 192.168.78.0
+# -
+# - Blank separated list
+# -
+allow_ext_net_to_local_net="
+   172.16.12.0/24:192.168.10.0/24
+   172.16.12.0/24:192.168.11.0/24
+   172.16.12.0/24:192.168.77.0/24
+   172.16.12.0/24:192.168.78.0/24
+   172.16.13.0/24:192.168.10.0/24
+   172.16.13.0/24:192.168.11.0/24
+   172.16.13.0/24:192.168.77.0/24
+   172.16.13.0/24:192.168.78.0/24
+"
+
+
+
+# =============
+# - Block all extern traffic to (given) local network
+# =============
+
+# - block_all_ext_to_local_net
+# -
+# -    block_all_ext_to_local_net="<local-net> [<local-net [<local-net .."
+# -
+# - Blocks all extern traffic to given local network(s)
+# -
+# - Note:
+# - =====
+# -    - Traffic recieved on natted interfaces will be ommitted!
+# -
+# - Example:
+# -    block_all_ext_to_local_net="83.223.73.32/29 83.223.73.48/29"
+# - 
+# - Blank separated list
+# -
+block_all_ext_to_local_net=""
+
+
+
+# =============
+# - Allow local services from given local networks
+# =============
+
+# - allow_local_net_to_local_service
+# - 
+# - allow_local_net_to_local_service="local-net:local-service:port:protocol"
+# -
+# - Only 'tcp' and 'udp' are allowed valuse for protocol.
+# -
+# - Use this parameter to (only) give some local netwoks access to special local 
+# - services (but not for all local networks as you can configure later).
+# -
+# - If you plan to separate local networks (see parameter 'separate_local_networks'), but 
+# - to allow these networks some special local services, you can also use this parameter.
+# -
+# - Example:
+# -    allow access from 10.113.0.0/16 to https service at 192.168.10.1
+# -    allow access from 10.113.0.0/16 to https service at 192.168.10.13
+# -
+# -    allow_local_net_to_local_service="10.113.0.0/16:192.168.10.1:$standard_https_port:tcp 
+# -                                      10.113.0.0/16192.168.10.13:$standard_https_port:tcp"
+# -
+# - 192.168.10.1     Mailserver
+# - 192.168.10.13    Citrix Server
+# - 192.168.11.8     WESUS Rechner Stockhausen
+# - 192.168.10.15    WESUS Rechner Altenschlirf
+# -
+# - Drucker
+# - =======
+# - 192.168.11.10    Drucker Hopfengarten Epson (Stylus Office BX535WD)
+# -
+# - Blank separated list
+# -    
+#allow_local_net_to_local_service=""
+allow_local_net_to_local_service="
+   10.121.0.0/20:192.168.10.1:$standard_https_port:tcp
+   10.121.0.0/20:192.168.10.13:$standard_https_port:tcp
+   10.113.0.0/16:192.168.10.1:$standard_https_port:tcp
+   10.113.0.0/16:192.168.10.13:$standard_https_port:tcp
+   10.121.0.0/20:192.168.11.8:8530:tcp
+   10.121.0.0/20:192.168.11.8:8531:tcp
+   10.113.0.0/16:192.168.10.15:8530:tcp
+   10.113.0.0/16:192.168.10.15:8531:tcp
+   10.113.0.0/16:192.168.11.10:$standard_print_port:tcp
+   10.121.0.0/20:192.168.11.10:$standard_print_port:tcp
+   10.113.0.0/16:192.168.11.10:$standard_ipp_port:tcp
+   10.121.0.0/20:192.168.11.10:$standard_ipp_port:tcp
+   10.113.0.0/16:192.168.11.10:$standard_print_raw_port:tcp
+   10.121.0.0/20:192.168.11.10:$standard_print_raw_port:tcp
+"
+
+
+# =============
+# - Allow all traffic from local network to local ip-address
+# =============
+
+# - allow_local_net_to_local_ip
+# -
+# -    allow_local_net_to_local_ip="<src-local-net>:<dst-local-ip> [<src-local-net>:<dst-local-ip>] [..]"
+# -
+# - All traffic from the given network to the given ip address is allowed
+# -
+# - Example:
+# -   allow_local_net_to_local_ip="10.113.0.0/16:192.168.10.1 
+# -                                10.113.0.0/16:192.168.10.13"
+# -
+# - Blank separated list
+# -
+allow_local_net_to_local_ip=""
+
+
+
+# =============
+# - Allow all traffic from local ip-address to local network
+# =============
+
+# - allow_local_ip_to_local_net
+# -
+# -    allow_local_ip_to_local_net="<src-local-ip>:<dst-local-net> [<src-local-ip>:<dst-local-net>] [..]"
+# -
+# - All traffic from the given ip address to the given network is allowed
+# -
+# - Example:
+# -   allow_local_ip_to_local_net="192.168.10.9:10.10.10.0/24
+# -                                192.168.10.16:10.10.10.0/24"
+# - 
+# - Blank separated list
+# -
+allow_local_ip_to_local_net=""
+
+
+
+# =============
+# - Allow all traffic from (one) local network to (another) local network
+# =============
+
+# - allow_local_net_to_local_net
+# -
+# -    allow_local_net_to_local_net="<src-local-net>:<dst-local-net> [<src-local-net>:<dst-local-net>] [..]"
+# -
+# - All traffic from the given first network to the given second network is allowed
+# -
+# - Notice:
+# -    If you want allow both directions, you have to make two entries - one for evry directions.
+# -
+# - Example:
+# -   allow_local_net_to_local_net="192.168.11.0/24:10.10.11.0/24
+# -                                 192.168.78.0/24:10.10.11.0/24"
+# - 
+# - Blank separated list
+# -
+allow_local_net_to_local_net=""
+
+
+
+# =============
+# - Allow local ip address from given local interface
+# =============
+
+# - allow_local_if_to_local_ip
+# -
+# - All traffic from the given network interface to the given ip address is allowed
+# -
+# - Example:
+# -   allow_local_if_to_local_ip="${local_if_1}:192.168.10.1
+# -                               ${local_if_2}:192.168.10.13"
+# -
+# - Blank separated list
+# -
+allow_local_if_to_local_ip=""
+
+
+
+# =============
+# --- Separate local Networks
+# =============
+
+# - Don't allow these networks any connections to other local networks
+# -
+# - Example:
+# -    separate_local_networks="10.113.1.0/24 10.113.2.0/24"
+# -
+# - Blank separated list
+# -
+separate_local_networks="
+   10.113.0.0/16 
+   10.123.0.0/16"
+
+
+
+# =============
+# --- Separate local Interfaces
+# =============
+
+# - Don't allow these networks any connections to other local networks
+# -
+# - Example:
+# -    separate_local_networks="$local_if_1 $local_if_2"
+# -
+separate_local_ifs="${local_if_5}"
+
+
+
+# =============
+# --- Traffic Shaping
+# =============
+
+TRAFFIC_SHAPING=false
+
+RATE_UP=10000
+LIMIT_UP=$(expr $RATE_UP / 100 \* 85)
+
+LIMIT_CLASS=$(expr $LIMIT_UP / 7)
+
+RTP_PORTS_START=49152
+RTP_PORTS_END=49408
+SIP_PORT_REMOTE=5060
+SIP_PORT_LOCAL=5067
+SIP_LOCAL_IP=192.168.63.240
+STUN_PORTS=3478
+
+TC_DEV=$ext_if_dsl_1
+
+
+
+# =============
+# ---- Allow Forwarding (private) IPs / IP-Ranges
+# =============
+
+# - Maybe useful in case of virtual hosts with private addresses or
+# - if using a vpn network to forward into private areas.
+# -
+# - Note: this rules takes affect before rules to protect against
+# -       unwanted packages e.g. blocking private addresses on
+# -       externel interfaces.
+# -       
+# - Note: you can specify networks using CIDR notation
+# -       like "192.168.2.0/24"
+# -
+forward_private_ips=""
+
+
+
+# =============
+# --- Services local machine / local networksa
+# =============
+
+# ======
+# - IPv6 over IPv4 (SixXS)
+# ======
+
+local_sixxs_service=false
+tic_server=tic.sixxs.net
+six_pop_server=deham01.sixxs.net
+
+
+# ======
+# - VPN Service
+# ======
+
+# - VPN Service on Gateway?
+local_vpn_service=true
+vpn_gw_ports="1194 1195 1196"
+
+# - VPN Services DMZ (reachable also from WAN)
+# -
+# - vpn_server_dmz_arr=[<ip-address>]=<dsl-device>
+# -
+# - Note:
+# -    Each extern interface can have only one thuch service 
+# -
+# -   vpn_server_dmz_arr[192.168.10.1]=$ext_if_dsl_2
+# -   vpn_server_dmz_arr[192.168.10.13]=$ext_if_dsl_1
+# -
+# - Multiple settins of this parameter is possible
+# -
+declare -A vpn_server_dmz_arr
+
+# - Local VPN Ports
+# -
+# - Blank separated list
+vpn_local_net_ports="1194"
+
+
+# ======
+# - DHCP Service
+# ======
+
+# - Ist this Gateway DHCP Client?
+# - 
+# - local_dhcp_client_interfaces="<interface1> [<interface> [.."
+# -
+# - Example:
+# -    dhcp_client_interfaces="$ext_if_static_1"
+# -
+dhcp_client_interfaces=""
+
+# - DHCP Server Gateway
+# -
+local_dhcp_service=true
+
+# - Are DHCP Failover Servers present?
+# -
+# - Balnk separated list
+# -
+dhcp_failover_server_ips=""
+
+dhcp_failover_port=647
+
+
+# ======
+# - DNS Service
+# ======
+
+# - DNS Service Gateway
+# -
+local_dns_service=true
+
+# - DNS Server local Networks
+# -
+# - 192.168.11.1    - ga-schloss
+# - 192.168.11.3    - GAASDC03.ga.intra (windows server Schloss)
+# - 192.168.10.254  - ga-al
+# - 192.168.10.3    - GAASDC01.ga.intra (Windows Server Altenschlirf)
+# - 192.168.81.1    - ga-nh (Novalishaus)
+# - 
+# - Blank separated list
+# -
+dns_server_ips="192.168.11.1
+                192.168.11.3
+                192.168.11.23
+                192.168.10.3
+                192.168.10.254
+                192.168.81.1
+                172.16.0.1"
+
+
+# ======
+# - SSH
+# ======
+
+# - SSH Service Gateway
+# -
+local_ssh_service=true
+
+
+# - SSH Services local Networks
+# -
+# - Blank separated list
+# -
+ssh_server_only_local_ips=""
+
+
+# - SSH Services DMZ (reachable also from WAN)
+# -
+# - ssh_server_dmz_arr[<ip-address>]=<extern-device>
+# -
+# - Note:
+# -    Each extern interface can have only one service on a certain port.
+# -
+# -    ssh_server_dmz_arr[192.168.10.1]=$ext_if_dsl_2
+# -    ssh_server_dmz_arr[192.168.10.13]=$ext_if_dsl_1
+# -
+# - Multiple settins of this parameter is possible
+# -
+declare -A ssh_server_dmz_arr
+
+
+# - SSH Ports used on Gateway and also local machines
+# -
+# - blank separated list
+# -
+ssh_ports="22"
+
+
+# ======
+# - HTTP(S) Service
+# ======
+
+# - HTTP(S) Service Gateway
+# -
+local_http_service=false
+
+
+# - HTTP(S) Services only locale Networks
+# -
+# - Telefonanlage
+# - =============
+# - 192.168.10.20    Telefon Anlage Altenschlirf
+# - 192.168.11.20    Telefon Anlage Schloss
+# - 192.168.81.20    Telefon Anlage Novalishaus
+# -
+# - 192.168.10.16    Xymon Server
+# - 
+# - Drucker
+# - =======
+# - 
+# -
+# - Accesspoints
+# - ============
+# - 10.112.1.0/24    Accesspoints Schloss
+# - 10.122.1.0/24    Accesspoints Altenschlirf
+# -
+# - 10.121.15.254    Unifi Controller Schloss
+# -
+# - Switches
+# - ========
+# - 172.16.0.243     Uplink Schloss / IPMI Altenschlirf
+# - 10.10.10.247
+# - 10.10.10.248
+# - 10.10.10.249
+# -
+# -
+# - Blank separated list
+# -
+http_server_only_local_ips="
+   172.16.0.243
+   192.168.10.20
+   192.168.11.20
+   192.168.81.20
+   192.168.10.16
+   192.168.10.1
+   192.168.10.13
+   10.112.1.0/24
+   10.122.1.0/24
+   10.121.15.254
+   10.10.10.247
+   10.10.10.248
+   10.10.10.249"
+
+
+# - HTTP(S) Services DMZ (reachable also from WAN)
+# -
+# - http_server_dmz_arr[<ip-address>]=<dsl-device>
+# -
+# - Note:
+# -    Each extern interface can have only one service on a certain port.
+# -
+# - Example:
+# -    Mail Server:   192.168.10.1 incomming on ppp-st ($ext_if_dsl_2)
+# -    Citrix Server: 192.168.10.13 incomming on ppp-surf1 ($ext_if_dsl_1)
+# -
+# -    http_server_dmz_arr[192.168.10.1]=$ext_if_dsl_2
+# -    http_server_dmz_arr[192.168.10.13]=$ext_if_dsl_1
+# -
+# - WebServer Luna: 192.168.63.20 (ppp-ckubu = $ext_if_dsl_1)
+# -
+# - Multiple settins of this parameter is possible
+# -
+declare -A http_server_dmz_arr
+
+
+# - HTTPS Services DMZ only port 443 (reachable also from WAN)
+# -
+# - http__ssl_server_dmz_arr[<ip-address>]=<dsl-device>
+# -
+# - Note:
+# -    Each extern interface can have only one thuch service 
+# -
+# - Example:
+# -    Mail Server:   192.168.10.1 incomming on ppp-st ($ext_if_dsl_2)
+# -    Citrix Server: 192.168.10.13 incomming on eth11 (DSL-surf1) ($ext_if_static_2)
+# -
+# -    http_ssl_server_dmz_arr[192.168.10.1]=$ext_if_dsl_2
+# -    http_ssl_server_dmz_arr[192.168.10.13]=$ext_if_dsl_1
+# -
+# - Multiple settins of this parameter is possible
+# -
+declare -A http_ssl_server_dmz_arr
+#http_ssl_server_dmz_arr[192.168.10.1]=$ext_if_dsl_1
+#http_ssl_server_dmz_arr[192.168.10.13]=$ext_if_dsl_2
+
+
+# - HTTP(S) Ports 
+# -
+# - comma separated list
+# -
+http_ports="$standard_http_ports"
+
+
+# ======
+# - Mail Services
+# ======
+
+# - SMTP server (i.e. mail relay service) Gateway
+# -
+local_smtp_service=false
+
+
+# - Mailserver (SMTP(POP/IMAP) Gateway
+# -
+# - NOT YET IMPLEMENTED
+# -
+local_mail_service=false
+
+
+# - Mail Services smtp,smtps/pop(s)/imap(s) only local Networks
+# -
+# - comma separated list
+# -
+mail_server_only_local_ips=""
+
+
+# - Mails Services DMZ smtp,smtps/pop(s)/imap(s) (reachable also from WAN)
+# -
+# - mail_server_dmz_arr[<ip-address>]=<dsl-device>
+# -
+# - Multiple declarations are possible
+# -
+# - Example:
+# -    Mail Server:   192.168.10.1 incomming on ppp-st ($ext_if_dsl_2)
+# -
+# -    mail_server_dmz_arr[192.168.10.1]=$ext_if_dsl_2
+# -
+declare -A mail_server_dmz_arr
+#mail_server_dmz_arr[192.168.10.1]=$ext_if_dsl_1
+
+
+# - Mail client ports (smtps/pop(s)/imap(s)
+# -
+# - comma separated list
+# -
+mail_user_ports="$standard_mailuser_ports"
+
+
+# - Mail Server (local Networks) SMTP Port
+# -
+mail_smtp_port="$standard_smtp_port"
+
+
+# ======
+# - FTP Service
+# ======
+
+# - FTP Service Gateway
+# -
+local_ftp_service=false
+
+# - FTP Server at local Networks
+# -
+# - comma separated list
+# -
+ftp_server_only_local_ips=""
+
+# - FTP Service DMZ
+# -
+# - Note:
+# -    Each extern interface can have only one thuch service 
+# -
+# - ftp_server_dmz_arr[<ip-address>]=<dsl-device>
+# - ftp_passive_port_range=<first-port:last-port>
+# -
+declare -A ftp_server_dmz_arr
+#ftp_server_dmz_arr[192.168.63.20]=$ext_if_dsl_1
+ftp_passive_port_range="50000:50400"
+
+# - FTP Ports
+# -
+# - Hard scriptetd:
+# -    FTP Control Port: 21
+# -    FTP Data Port:    20
+
+
+# ======
+# - TFTP Service Gateway
+# ======
+
+# - TFTP Server Gateway (Port udp 69)
+local_tftp_service=false
+
+# - TFTP Server at local Networks
+# -
+# - 192.168.10.20   - Telefonanlage (Schloss)
+# -
+tftp_server_ips="192.168.10.20"
+
+# - TFTF Ports
+# -
+# - Note: its udp !
+# -
+tftp_udp_port=69
+
+
+# ======
+# - LDAP Service
+# ======
+
+# - Is this a LDAP Server ?
+# -
+local_ldap_service=false
+
+# - LDAP Service local Networks
+# -
+# - Ports: 389 udp 
+# -        389 tcp
+# -
+# - Ports LDAP SSL: 636 tcp
+# -
+ldap_server_local_ips=""
+ldap_udp_ports="389"
+ldap_tcp_ports="389 636"
+
+
+# ======
+# - Samba Service
+# ======
+
+# - Samba Server Gateway
+# -
+local_samba_service=false
+
+# - Samba Service
+# -
+# - Ports: 137,138 udp 
+# -        139,445 tcp
+# -
+samba_udp_ports="137:138"
+samba_tcp_ports="137 138 139 445"
+
+# - Samba Service local networks
+# -
+# - ??     Windows Server Altenschlirf
+# -
+samba_server_local_ips=""
+
+# - Samba Service DMZ
+# -
+# -    samba_server_dmz_arr[<ip-address>]=<dsl-device>
+# -
+# - Note:
+# -    Each extern interface can have only one thuch service 
+# -
+# - Multiple settins of this parameter is possible
+# -
+declare -A samba_server_dmz_arr
+
+
+# ======
+# - NTP Service
+# ======
+
+# - NTP Service Gateway
+# -
+local_ntp_service=true
+
+
+# ======
+# - SNMP Service
+# ======
+
+# - SNMP services local Networks
+# -
+snmp_server_ips=""
+
+# - SNMP Port
+# -
+# - snmp_port        Port Agent
+# - snmp_trap_port   Port Management Station
+# -
+snmp_port="$standard_snmp_port"
+snmp_trap_port="$standard_snmp_trap_port"
+
+
+# ======
+# - Mumble Service
+# ======
+
+# - NOT YET IMPLEMENTED
+
+# - Mumble ports
+# -
+mumble_ports="64738"
+
+
+# ======
+# - XyMon Service
+# ======
+
+# - XyMon Service Gateway (usually TCP port 1984)
+# -
+local_xymon_server=false
+
+# - XyMon Service (usually TCP port 1984)
+# -
+# - Blank separated list of ip's
+# -
+xymon_server_ips="192.168.10.16"
+local_xymon_client=""
+
+# - XyMon Ports
+# -
+xymon_port="$standard_xymon_port"
+
+
+# ======
+# - Munin Service
+# ======
+
+# - Munin Service Gateway (usually TCP port 4949)
+# -
+local_munin_server=false
+
+
+# - If 'local_munin_server=' provide service also to inet?
+# -
+provide_munin_service_to_inet=true
+munin_remote_port="4949"
+
+
+# - Munin Server local Networks (usually TCP port 4949)
+# -
+# - Blank separated list
+# -
+munin_local_server_ips=""
+
+
+# - Munin Remote Server
+# -
+# - Note: 
+# - The munin server himself initiates the connection to the concerning clients.
+# - In case of natted (local) networks you have to also nat the incomming
+# - requests from munin server.
+# -
+# - Note:
+# -    Each extern interface can have only one thuch service 
+# -
+# - munin_local_client_ip_arr[<ip-address>]=<dsl-device>
+# -
+# - Multiple settins of this parameter is possible
+# -
+#munin_remote_server="83.223.86.163"
+munin_remote_server=""
+
+
+# - Munin - clients on local network (server is $munin_remote_server)
+# -
+# - Example:
+# -    munin_local_client_ip_arr[192.168.63.20]=$ext_if_dsl_1
+# -
+declare -A munin_local_client_ip_arr
+
+# - Munin Port
+# -
+munin_local_port=4949
+
+
+# ======
+# - PowerChut Network Shutdown (PCNS)
+# ======
+
+# - PCNS local Services
+# -
+pcns_server_ips=""
+
+# - local USV
+# -
+usv_ip=""
+
+# - PCNS Ports
+# -
+# - Webinterface (https): tcp 6547
+# - Connection usv:       tcp/udp 3052
+# -
+pcns_tcp_port=3052
+pcns_udp_port=3052
+pcns_web_port=6547
+
+
+# ======
+# - Remote Console (VNC Service)
+# ======
+
+# - VNC Service local network
+# -
+# - Blank separated list
+# -
+rm_server_ips=""
+
+# - VNC Service DMZ
+# -
+# - Note:
+# -    Each extern interface can have only one thuch service 
+# -
+# -    rm_server_dmz_arr[<ip-address>]=<dsl-device>
+# -
+declare -A rm_server_dmz_arr
+
+
+# - Remote Console (VNC) Port
+# -
+remote_console_port=5900
+
+
+# ======
+# - Ubiquiti Unifi
+# ======
+
+# - By default, the UniFi controller will operate on the following ports:
+# -
+# -    unifi_http_port=8080 (port for UAP to inform controller)
+# -    unifi_https_port=8443 (port for controller GUI / API, as seen in web browser)
+# -    unifi_portal_http_port=8880 (port for HTTP portal redirect)
+# -    unifi_portal_https_port=8843 (port for HTTPS portal redirect)
+# -    unifi_http_port=6789 (port used for throughput measurement)
+# -    unifi_db_port=27117 (local-bound port for DB server)
+# -
+# -
+# - In version 4.5.2 and later, users can also define the port assigned to STUN services, 
+# - for scenarios where two or more separate UniFi instances are desired on the 
+# - same controller machine.
+# -
+# - unifi_stun_port=3478 # UDP port used for STUN
+# -
+# -
+# - Ubiquity Networks uses port 10001/UDP for its AirControl 
+# - management discovery protocol
+# -
+# -    unifi_aircontroll_port=10001
+# -
+# -
+# - Since v3.2.9+ and v4.6.0+, two more ports are being reserved for device redirector. 
+# - There is no need to open firewall for these ports on controller. However, on 
+# - controller, avoid to use these ports:
+# -
+# -    port 8881 for redirector port for wireless clients
+# -    port 8882 for redirector port for wired clients
+# -
+# -
+# - For AP-EDU Broadcasts:
+# -
+# -    UDP ports 5656-5699
+# -
+unify_tcp_ports="8080,8443,8880,8843,6789,27117"
+unify_udp_ports="3478"
+unify_broadcast_udp_ports="10001,5656:5699"
+
+# - Unifi Controller at gateway?
+# -
+local_unifi_controller_service=true
+
+# - UniFi Controllers on local network (other than this machine)
+# -
+unify_controller_local_net_ips=""
+
+
+# ======
+# - IPMI Tools 
+# ======
+
+# - IPMI Tools local Networks
+# -
+# - 172.17.0.15    Gateway Altenschlirf
+# - 172.16.11.15   Gateway Schloss
+# - 10.11.11.16    Ersatz Gateway
+# - 192.168.81.15  Gateway Novalishaus
+# -
+# - Blank seoarated list
+# -
+ipmi_server_ips="
+   172.17.0.15
+   172.16.11.15
+   10.11.11.16
+   192.168.81.15"
+
+# - IPMI Tools Port
+# -
+# - UDP 623:  Access IPMI Programms (as IPMIView or FreeIPMI)
+# - TCP 623:  Virtual Media for Remote Console
+# - TCP 3520: "This is TCP Port 3520 which is also needed in addition to TCP port 5900 to be able to use iKVM."
+# -
+ipmi_udp_ports="623 5900"
+ipmi_tcp_ports="80 443 623 3520"
+
+
+# =============
+# - Rsync Out for given src ip-addresses
+# =============
+
+# - Rsync Protocol
+# -
+# - The given server address (from local network) can access rsyncd at (any) remote machine
+# -
+# - Needed for some integrated provider of clamav-unofficial-sigs
+# -
+rsync_out_ips=""
+rsync_ports="873"
+
+# - rsync out from this machine?
+# - 
+local_rsync_out=false
+
+
+
+# =============
+# - Printer
+# =============
+
+# - IP Addresses Printer
+# -
+# - Blank separated list
+# -
+printer_ips=""
+
+
+
+# =============
+# --- Scanner
+# =============
+
+# ======
+# - Brother (brscan)
+# ======
+
+# - IP Adresses Brother Scanner
+# -
+# - Blank seoarated list
+# -
+brother_scanner_ips=""
+brscan_port=54921
+
+
+
+# =============
+# --- Telefon Systems
+# =============
+
+# - IP Adresses Telephone Systems (Telefonanlagen)
+# -
+# - Dont't foregt to add ip-adresses also to http(s) service if the
+# - systems provide webinterfaces!
+# -
+# - Blank seoarated list
+# -
+tele_sys_ips="
+   192.168.10.20
+   192.168.11.20
+   192.168.81.20"
+tele_sys_remote_sip_server_port=5060
+tele_sys_local_sip_server_port=5067
+allow_between_tele_systems=true
+
+VOIP_PORTS="69 5000:5099 7775 32000:32512"
+# -    TFTP=69 (used from telephones getting their connection data / firmwareupdate )
+# -    RTP_PORTS= UDP i.e. 5000:5099 or here
+# -    RTP_PORTS_END=5099
+#SIP_PORT_REMOTE=5060
+#SIP_PORT_LOCAL=5067
+#SIP_LOCAL_IP=192.168.63.240
+#STUN_PORTS=3478
+udp_voip_ports="7775 5000:5099"
+
+
+# =====
+# - Telekom Internet TV (Entertain)
+# =====
+
+telekom_internet_tv=false
+tv_ip="192.168.63.5"
+tv_extern_if="eth2.8"
+tv_local_if="$local_if_1"
+
+
+
+# ======
+# - Other local Services 
+# ======
+
+# - You can configure further local services here.
+# -
+# -    other_services="<ip-addr-of-service>:<port>:<protocol> [<ip-addr-of-service>:<port>:<protocol> [.."
+# -
+# - Blank seperated list
+# -
+other_services=""
+
+
+# =============
+# --- Masuqerading
+# =============
+
+# - Masquerade (NAT) networks
+# -
+# -    nat_networks="<src-network>:<output-device> [<src-network>:<output-device>] [.."
+# -
+# - Multiple declarations (blank separated list) are possible
+# -
+# - Example:
+# -    nat_network="172.16.1.0/24:${local_if_2}
+# -                 172.16.63.0/24:${ext_if_static_1}"
+# -
+# - 172.16.11.0/24  Zyxel VDSL 50 Schloss (172.16.11.254)
+# -                 IPMI Gateway Schloss (172.16.11.15)
+# -
+#nat_networks="
+#   172.16.11.0/24:${ext_if_static_1}"
+
+#nat_networks="
+#   172.16.11.0/24:${ext_if_static_1}
+#   172.16.12.0/24:${ext_if_static_2}"
+
+nat_networks="
+   172.16.11.254/32:${ext_if_static_1}
+   172.16.12.254/32:${ext_if_static_2}
+   172.16.13.254/32:${ext_if_static_3}"
+
+
+# - Masquerade TCP Connections
+# -
+# -    masquerade_tcp_con="<src-network>:<dst-host>:<dst-port>:<output-device> [<src-network>:<dst-host>:..]"
+# -
+# - Example:
+# -
+# -    masquerade_tcp_con="192.168.63.0/24:192.168.62.244:80:${local_if_1} 
+# -                        10.0.0.0/8:192.168.62.244:443:${local_if_1}"
+# -
+# -    192.168.64.55: Repeater TP-Link TL-WA850RE
+# -
+# - Blank separated list
+# -
+masquerade_tcp_cons="10.0.0.0/8:192.168.11.29:5900:${local_if_1}
+                     192.168.63.0/24:192.168.11.29:5900:${local_if_1}
+                     192.168.10.131/32:192.168.11.29:5900:${local_if_1}
+                     10.0.0.0/8:172.16.11.254:80:${ext_if_static_1}
+                     192.168.63.0/24:172.16.11.254:80:${ext_if_static_1}
+                     10.0.0.0/8:172.16.12.254:80:${ext_if_static_2}
+                     192.168.63.0/24:172.16.12.254:80:${ext_if_static_2}
+                     10.0.0.0/8:172.16.13.254:80:${ext_if_static_3}
+                     192.168.63.0/24:172.16.13.254:80:${ext_if_static_3}"
+
+
+# =============
+# --- Portforwarding
+# =============
+
+# - Portforwarding TCP
+# -
+# - portforward_tcp="<device-in>:<port-in>:<ip-to-forward>:<port-out>"
+# -
+# - Multiple declarations are possible
+# - 
+# - Example:
+# -    portforward_tcp="$ext_if_dsl_1:9997:192.168.52.25:22
+# -                     $ext_if_dsl_1:9998:192.168.53.24:22"
+# -
+# - Blank separated list
+# -
+portforward_tcp="
+   ${ext_if_static_2}:443:192.168.10.13:443
+   ${ext_if_static_3}:443:192.168.10.1:443
+   ${ext_if_static_3}:587:192.168.10.1:587
+   ${ext_if_static_3}:110:192.168.10.1:110
+   ${ext_if_static_3}:143:192.168.10.1:143
+   ${ext_if_static_3}:995:192.168.10.1:995
+   ${ext_if_static_3}:993:192.168.10.1:993
+   ${ext_if_static_3}:25:192.168.10.1:25"
+
+
+# - Portforwarding UDP
+# -
+# - portforward_udp="<device-in>:<udp-port-in>:<ip-to-forward>:<udp-port-out>"
+# -
+# - Multiple declarations are possible
+# - 
+# - Example:
+# -    portforward_udp="$ext_if_dsl_1:1094:192.168.52.25:1094
+# -                     $ext_if_dsl_1:9999:192.168.53.24:1095"
+# -
+# - Blank separated list
+# -
+portforward_udp=""
+
+
+
+# =============
+# --- Basic behavior
+# =============
+
+# ===
+# = Services allowed out to the world wide web
+# ===
+
+allow_ssh_request_out=true
+allow_http_request_out=true
+allow_smtp_request_out=true
+allow_mail_request_out=true
+allow_ftp_request_out=true
+allow_tftp_request_out=true
+allow_ntp_request_out=true
+allow_timeserver_request_out=true
+allow_pgpserver_request_out=true
+allow_telnet_request_out=true
+allow_whois_request_out=true
+allow_cpan_wait_request_out=true
+allow_hbci_request_out=true
+allow_jabber_request_out=true
+allow_silc_request_out=true
+allow_irc_request_out=true
+allow_mysql_request_out=true
+allow_ipmi_request_out=true
+allow_remote_console_request_out=true
+
+allow_samba_requests_out=true
+
+allow_vpn_out=true
+vpn_out_ports="1194 1195 1196"
+
+allow_cisco_vpn_out=false
+cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"
+cisco_vpn_out_protocol="esp"
+
+
+# ===
+# = Services allowed between local networks
+# ===
+
+# - These Parameters are only considered, if traffic 
+# - between local networks are not permitted, thats 
+# - if 'permit_between_local_networks=false' (see below).
+# - 
+allow_ssh_between_local_nets=true
+allow_samba_between_local_nets=false
+allow_ldap_between_local_nets=false
+allow_printing_between_local_nets=true
+allow_scanning_between_local_nets=true
+
+
+# ===
+# = Other Parameters
+# ===
+
+# - Permit internet access to all machines at local network
+# - Does not include this server itself
+# -
+permit_local_net_to_inet=true
+
+# - Do not block any traffic between local machines
+# -
+permit_between_local_networks=true
+
+# - Do not block any ICMP traffic
+# -
+permit_all_icmp_traffic=true
+
+# - Access to Mailservices (LAN and WAN) (pop/imap/smtps) from local (gateway) machine.
+# -
+# - Maybe useful for testing purpose with telnet or openssl
+# -
+provide_mailservice_from_local=true
+
+# - iPerf is a tool for active measurements of the maximum achievable bandwidth on IP networks. 
+# - It supports tuning of various parameters related to timing, buffers and protocols (TCP, UDP, 
+# - SCTP with IPv4 and IPv6). For each test it reports the bandwidth, loss, and other parameters.
+# -
+create_iperf_rules=false
+
+
+
+# =============
+# - MAC Address Filtering
+# =============
+
+# - MAC Addreses alowed to all destinations (gateway, remote, local networks)
+# -
+# - Blank separated list
+# -
+#allow_all_mac_src_addresses="c4:54:44:30:d3:0f 40:f0:2f:5c:a2:83"
+allow_all_mac_src_addresses=""
+
+# - MAC Addreses alowed to local networks (gateway, local networks)
+# -
+# - Blank separated list
+# -
+#allow_local_mac_src_addresses="c4:54:44:30:d3:0f 40:f0:2f:5c:a2:83"
+allow_local_mac_src_addresses=""
+
+
+# - MAC Addreses alowed to remote networks
+# -
+# - Blank separated list
+# -
+#allow_remote_mac_src_addresses="c4:54:44:30:d3:0f 40:f0:2f:5c:a2:83"
+allow_remote_mac_src_addresses=""
+
+
+
+
+# =============
+# --- Block IP's / IP-Ranges
+# =============
+
+# -    222.184.0.0/13 CHINANET-JS
+# -    61.160.0.0/16 - CHINANET-JS
+# -    116.8.0.0/14 CHINANET-GX
+# -
+# - Blank separated list
+# -
+blocked_ips="222.184.0.0/13 61.160.0.0/16 116.8.0.0/14"
+
+
+# =============
+# --- Block Ports on extern Interfaces
+# =============
+
+# - Generally (for all interfaces) block this ports
+# -
+# - Portmapper
+# - tcp 111
+# - udp 111
+# -
+# - Authentication tap ident
+# - tcp 113
+# -
+# - Location Service
+# - tcp 135
+# -
+# - Windows Stuff
+# - tcp 137:139
+# - udp 137:139
+# - tcp 445
+# -
+block_tcp_ports="111 135 631"
+block_udp_ports="111"
+if ! $allow_samba_requests_out ; then
+   block_tcp_ports="$block_udp_ports 137:139 445"
+   block_udp_ports="$block_udp_ports 137:139"
+fi
+
+block_ident=true
+
+
+# =============
+# - Packets not wanted on gateway on local Interfaces
+# =============
+
+not_wanted_on_gw_tcp_ports="111 113 135 631"
+not_wanted_on_gw_udp_ports="111 631"
+if ! $local_samba_service ; then
+   not_wanted_on_gw_tcp_ports="$not_wanted_on_gw_tcp_ports 137:139 445"
+   not_wanted_on_gw_udp_ports="$not_wanted_on_gw_udp_ports 137:139"
+fi
+
+not_wanted_ident=true
+
+
+# =============
+# --- Router 
+# =============
+
+# - Set to "true" to secure/tune the kernel
+# -
+adjust_kernel_parameters=true
+
+# - Protection against several attacks
+# -
+protect_against_several_attacks=true
+
+
+
+# =============
+# --- Kernel related - Adjust Kernel Parameters (Security/Tuning)
+# =============
+
+# - Activate forwarding
+# -
+# - Enable/disable forwarding to and between interfaces
+# -
+kernel_activate_forwarding=true
+
+# - Activate kernel support for dynamic IP adresses
+# - (not needed in case of static IP)
+# -
+# - see also https://www.frozentux.net/iptables-tutorial/other/ip_dynaddr.txt
+# -
+# - The values for the ip_dynaddr sysctl are [*]:
+# -
+# -   1:  To enable:
+# -   2:  To enable verbosity:
+# -   4:  To enable RST-provoking:
+# -   8:  To enable asymetric routing work-around [**]
+# -
+# -  [*] At boot, by default no address rewriting is attempted.
+# -  [**] This code is currently totaly untested.
+# -
+# - Flags can be combined by adding them. Common settings
+# - would be:
+# -
+# - To enable rewriting in quiet mode:
+# -   # echo 1 > /proc/sys/net/ipv4/ip_dynaddr
+# - To enable rewriting in verbose mode:
+# -   # echo 3 > /proc/sys/net/ipv4/ip_dynaddr
+# - To enable quiet RST-provoking mode (1+4):
+# -   # echo 5 > /proc/sys/net/ipv4/ip_dynaddr
+# - ...
+# -
+kernel_support_dynaddr=true
+dynaddr_flag="5"
+
+# - Reduce DoS'ing ability by reducing timeouts
+# -
+kernel_reduce_timeouts=true
+
+# - Hardening TCP/IP Stack Against SYN Floods
+# -
+# - Enable syn cookies prevents against the common 'syn flood attack'
+# -
+kernel_tcp_syncookies=true
+
+# - Protection against ICMP bogus error responses
+# -
+kernel_protect_against_icmp_bogus_messages=true
+
+# - Ignore Broadcast Pings
+# -
+kernel_ignore_broadcast_ping=true
+
+# - Deactivate Source Routed Packets
+# -
+kernel_deactivate_source_route=true
+
+# - Deactivate sending ICMP redirects
+# -
+# - Note: IP TV requires sending ICMP redirects. So if IP TV is provided, this
+# -       Parameter will be set to "false"
+# -
+# - ICMP redirects are used by routers to specify better routing paths out of 
+# - one network, based on the host choice, so basically it affects the way 
+# - packets are routed and destinations. 
+# -
+kernel_dont_accept_redirects=true
+
+# - Activate Reverse Path Filtering (Antispoofing)
+# -
+# - Reverse Pfadfilterung aktivieren. Dies hilft durch automatisches Ablehnen 
+# - von Quelladressen, die nicht mit dem Netzwerkinterface übereinstimmen, 
+# - sicherzustellen, dass Pakete legitime Quelladressen benutzen. Dies hat
+# - Sicherheitsvorteile, da es IP Spoofing verhindert. Wir müssen es für 
+# - alle net/ipv4/conf/* aktivieren, da sonst die Validierung der Quelle 
+# - nicht voll funktionsfähig ist. 
+# -
+kernel_activate_rp_filter=true
+
+# - Logging of spoofed (source routed" and "redirect") packets
+# -
+kernel_log_martians=false
+
+
+
+# =============
+# --- Some further Ports/IP-Address Configuration
+# =============
+
+# - unpriviligierte Ports
+# -
+unprivports="1024:65535"
+
+# - Loopback
+loopback="127.0.0.0/8"
+
+# - Private Networks
+priv_class_a="10.0.0.0/8"
+priv_class_b="172.16.0.0/12"
+priv_class_c="192.168.0.0/16"
+
+# - Multicast Addresse
+class_d_multicast="224.0.0.0/4"
+
+# Reserved Addresse
+class_e_reserved="240.0.0.0/5"
+
diff --git a/GA-Schloss/ipt-firewall/post_decalrations.conf b/GA-Schloss/ipt-firewall/post_decalrations.conf
new file mode 100644
index 0000000..7d0e9bf
--- /dev/null
+++ b/GA-Schloss/ipt-firewall/post_decalrations.conf
@@ -0,0 +1,505 @@
+#!/usr/bin/env bash
+
+
+# -----------
+# --- Define Arrays
+# -----------
+
+# ---
+# - Masquerade TCP Connections
+# ---
+
+declare -a nat_network_arr
+for _net in $nat_networks ; do
+   nat_network_arr+=("$_net")
+done
+
+declare -a masquerade_tcp_con_arr
+for _str in $masquerade_tcp_cons ; do
+   masquerade_tcp_con_arr+=("$_str")
+done
+
+
+# ---
+# - Extern Network interfaces (DSL, Staic Lines, All together)
+# ---
+declare -a nat_device_arr
+declare -a dsl_device_arr
+declare -a ext_if_arr
+for _dev in $ext_ifs_dsl ; do
+   dsl_device_arr+=("$_dev")
+   ext_if_arr+=("$_dev")
+   nat_device_arr+=("$_dev")
+done
+for _dev in $ext_ifs_static ; do
+   ext_if_arr+=("$_dev")
+done
+for _dev in $nat_devices ; do
+   if ! containsElement $_dev "${nat_device_arr[@]}" ; then
+      nat_device_arr+=("$_dev")
+   fi
+done
+
+# ---
+# - VPN Interfaces
+# ---
+declare -a vpn_if_arr
+for _dev in $vpn_ifs ; do
+   vpn_if_arr+=("$_dev")
+done
+
+# ---
+# - Local Network Interfaces
+# ---
+declare -a local_if_arr
+for _dev in $local_ifs ; do
+   local_if_arr+=("$_dev")
+done
+
+# ---
+# - Network Interfaces completly blocked
+# ---
+declare -a blocked_if_arr
+for _dev in $blocked_ifs ; do
+   blocked_if_arr+=("$_dev")
+done
+
+# ---
+# - Network Interfaces not firewalled
+# ---
+declare -a unprotected_if_arr
+for _dev in $unprotected_ifs ; do
+   unprotected_if_arr+=("$_dev")
+done
+
+# ---
+# - Allow these local networks any access to the internet
+# ---
+declare -a any_access_to_inet_network_arr
+for _net in $any_access_to_inet_networks ; do
+   any_access_to_inet_network_arr+=("$_net")
+done
+
+declare -a any_access_from_inet_network_arr
+for _net in $any_access_from_inet_networks ; do
+   any_access_from_inet_network_arr+=("$_net")
+done
+
+# ---
+# - Allow local services from given extern networks
+# ---
+declare -a allow_ext_net_to_local_service_arr 
+for _val in $allow_ext_net_to_local_service ; do
+   allow_ext_net_to_local_service_arr+=("$_val")
+done
+
+# ---
+# - Allow all traffic from extern address/network to local address/network
+# ---
+declare -a allow_ext_net_to_local_net_arr
+for _val in $allow_ext_net_to_local_net ; do
+   allow_ext_net_to_local_net_arr+=("$_val")
+done
+
+# ---
+# - Block all extern traffic to (given) local network
+# ---
+declare -a block_all_ext_to_local_net_arr
+for _net in $block_all_ext_to_local_net ; do
+   block_all_ext_to_local_net_arr+=("$_net")
+done
+
+# ---
+# - Allow local services from given local networks
+# ---
+declare -a allow_local_net_to_local_service_arr 
+for _val in $allow_local_net_to_local_service ; do
+   allow_local_net_to_local_service_arr+=("$_val")
+done
+
+# ---
+# - Allow all traffic from local network to local ip-address
+# ---
+declare -a allow_local_net_to_local_ip_arr
+for _val in $allow_local_net_to_local_ip ; do
+   allow_local_net_to_local_ip_arr+=("$_val")
+done
+
+# ---
+# - Allow all traffic from local ip-address to local network
+# ---
+declare -a allow_local_ip_to_local_net_arr
+for _val in $allow_local_ip_to_local_net ; do
+   allow_local_ip_to_local_net_arr+=("$_val")
+done
+
+# ---
+# - Allow all traffic from (one) local network to (another) local network
+# ---
+declare -a allow_local_net_to_local_net_arr
+for _val in $allow_local_net_to_local_net ; do
+   allow_local_net_to_local_net_arr+=("$_val")
+done
+
+# ---
+# - Allow local ip address from given local interface
+# ---
+declare -a allow_local_if_to_local_ip_arr
+for _val in $allow_local_if_to_local_ip ; do
+   allow_local_if_to_local_ip_arr+=("$_val")
+done
+
+# ---
+# - Separate local Networks
+# ---
+declare -a separate_local_network_arr
+for _net in $separate_local_networks ; do
+   separate_local_network_arr+=("$_net")
+done
+
+# ---
+# - Separate local Interfaces
+# ---
+declare -a separate_local_if_arr
+for _net in $separate_local_ifs ; do
+   separate_local_if_arr+=("$_net")
+done
+
+# ---
+# - Generally block ports on extern interfaces
+# ---
+declare -a block_tcp_port_arr
+for _port in $block_tcp_ports ; do
+   block_tcp_port_arr+=("$_port")
+done
+
+declare -a block_udp_port_arr
+for _port in $block_udp_ports ; do
+   block_udp_port_arr+=("$_port")
+done
+
+# ---
+# - Not wanted on intern interfaces
+# ---
+declare -a not_wanted_on_gw_tcp_port_arr
+for _port in $not_wanted_on_gw_tcp_ports ; do
+   not_wanted_on_gw_tcp_port_arr+=("$_port")
+done
+
+declare -a not_wanted_on_gw_udp_port_arr
+for _port in $not_wanted_on_gw_udp_ports ; do
+   not_wanted_on_gw_udp_port_arr+=("$_port")
+done
+
+# ---
+# - Private IPs / IP-Ranges allowed to forward
+# ---
+declare -a forward_private_ip_arr
+for _ip in $forward_private_ips ; do
+   forward_private_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses to log
+# ---
+declare -a log_ip_arr
+for _ip in $log_ips ; do
+   log_ip_arr+=("$_ip")
+done
+
+# ---
+# - Network Devices local DHCP Client
+# ---
+declare -a dhcp_client_interfaces_arr
+for _dev in $dhcp_client_interfaces ; do
+   dhcp_client_interfaces_arr+=("$_dev")
+done
+
+# ---
+# - IP Addresses DHCP Failover Server
+# ---
+declare -a dhcp_failover_server_ip_arr
+for _ip in $dhcp_failover_server_ips ; do
+   dhcp_failover_server_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Adresses DNS Server
+# ---
+declare -a dns_server_ip_arr
+for _ip in $dns_server_ips ; do
+   dns_server_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Adresses SSH Server only at ocal Networks
+# ---
+declare -a ssh_server_only_local_ip_arr
+for _ip in $ssh_server_only_local_ips ; do
+   ssh_server_only_local_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Adresses HTTP Server only local Networks
+# ---
+declare -a http_server_only_local_ip_arr
+for _ip in $http_server_only_local_ips ; do
+   http_server_only_local_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses Mail Server only local Networks
+# ---
+declare -a mail_server_only_local_ip_arr
+for _ip in $mail_server_only_local_ips ; do
+   mail_server_only_local_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses FTP Server
+# ---
+declare -a ftp_server_only_local_ip_arr
+for _ip in $ftp_server_only_local_ips ; do
+   ftp_server_only_local_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses Samba Server
+# ---
+declare -a samba_server_local_ip_arr
+for _ip in $samba_server_local_ips ; do
+   samba_server_local_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses LDAP Server
+# ---
+declare -a ldap_server_local_ip_arr
+for _ip in $ldap_server_local_ips ; do
+   ldap_server_local_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Adresses Telephone Systems
+# ---
+declare -a tele_sys_ip_arr
+for _ip in $tele_sys_ips ; do
+   tele_sys_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Adresses SNMP Server
+# ---
+declare -a snmp_server_ip_arr
+for _ip in $snmp_server_ips ; do
+   snmp_server_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Adresses Munin Service 
+# ---
+declare -a munin_local_server_ip_arr
+for _ip in $munin_local_server_ips ; do
+   munin_local_server_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Adresses XyMon
+# ---
+declare -a xymon_server_ip_arr
+for _ip in $xymon_server_ips ; do
+   xymon_server_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Adresses IPMI interface
+# ---
+declare -a ipmi_server_ip_arr
+for _ip in $ipmi_server_ips ; do
+   ipmi_server_ip_arr+=("$_ip")
+done
+
+# ---
+# -IP Addresses Ubiquiti Unifi Accesspoints
+# ---
+declare -a unifi_ap_local_ip_arr
+for _ip in $unifi_ap_local_ips ; do
+   unifi_ap_local_ip_arr+=("$_ip")
+done
+declare -a unifi_controller_gateway_ip_arr
+for _ip in $unifi_controller_gateway_ips ; do
+   unifi_controller_gateway_ip_arr+=("$_ip")
+done
+declare -a unify_controller_local_net_ip_arr
+for _ip in $unify_controller_local_net_ips ; do
+   unify_controller_local_net_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses Printer
+# -
+declare -a printer_ip_arr
+for _ip in $printer_ips ; do
+   printer_ip_arr+=("$_ip")
+done
+
+
+# ---
+# - IP Adresses Brother Scanner (brscan)
+# ---
+declare -a brother_scanner_ip_arr
+for _ip in $brother_scanner_ips ; do
+   brother_scanner_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses PCNS Server
+# ---
+declare -a pcns_server_ip_arr
+for _ip in $pcns_server_ips ; do
+   pcns_server_ip_arr+=("$_ip")
+done
+
+
+# ---
+# - IP Addresses VNC Service
+# ---
+declare -a rm_server_ip_arr
+for _ip in $rm_server_ips ; do
+   rm_server_ip_arr+=("$_ip")
+done
+
+# ---
+# - IP Addresses Rsync Out
+# ---
+# local
+declare -a rsync_out_ip_arr
+for _ip in $rsync_out_ips ; do
+   rsync_out_ip_arr+=("$_ip")
+done
+
+# ---
+# - Other local Services
+# ---
+declare -a other_service_arr
+for _val in $other_services ; do
+   other_service_arr+=("$_val")
+done
+
+# ---
+# - SSH Ports
+# ---
+declare -a ssh_port_arr
+for _port in $ssh_ports ; do
+   ssh_port_arr+=("$_port")
+done
+
+# ---
+# - Cisco kompartible VPN Ports
+# ---
+declare -a cisco_vpn_out_port_arr
+for _port in $cisco_vpn_out_ports ; do
+   cisco_vpn_out_port_arr+=("$_port")
+done
+
+# ---
+# - VPN Ports
+# ---
+declare -a vpn_gw_port_arr
+for _port in $vpn_gw_ports ; do
+   vpn_gw_port_arr+=("$_port")
+done
+declare -a vpn_local_net_port_arr
+for _port in $vpn_local_net_ports ; do
+   vpn_local_net_port_arr+=("$_port")
+done
+declare -a vpn_out_port_arr
+for _port in $vpn_out_ports ; do
+   vpn_out_port_arr+=("$_port")
+done
+
+# ---
+# - Rsync Out Ports
+# --
+declare -a rsync_port_arr
+for _port in $rsync_ports ; do
+   rsync_port_arr+=("$_port")
+done
+
+# ---
+# - Samba Ports
+# ---
+
+declare -a samba_udp_port_arr
+for _port in $samba_udp_ports ; do
+   samba_udp_port_arr+=("$_port")
+done
+
+declare -a samba_tcp_port_arr
+for _port in $samba_tcp_ports ; do
+   samba_tcp_port_arr+=("$_port")
+done
+
+# ---
+# - LDAP Ports
+# ---
+
+declare -a ldap_udp_port_arr
+for _port in $ldap_udp_ports ; do
+   ldap_udp_port_arr+=("$_port")
+done
+
+declare -a ldap_tcp_port_arr
+for _port in $ldap_tcp_ports ; do
+   ldap_tcp_port_arr+=("$_port")
+done
+
+# ---
+# - IPMI
+# ---
+
+declare -a ipmi_udp_port_arr
+for _port in $ipmi_udp_ports ; do
+   ipmi_udp_port_arr+=("$_port")
+done
+
+declare -a ipmi_tcp_port_arr
+for _port in $ipmi_tcp_ports ; do
+   ipmi_tcp_port_arr+=("$_port")
+done
+
+
+# ---
+# - Portforwrds TCP
+# ---
+declare -a portforward_tcp_arr
+for _str in $portforward_tcp ; do
+   portforward_tcp_arr+=("$_str")
+done
+
+# ---
+# - Portforwrds UDP
+# ---
+declare -a portforward_udp_arr
+for _str in $portforward_udp ; do
+   portforward_udp_arr+=("$_str")
+done
+
+# ---
+# - MAC Address Filtering
+# ---
+declare -a allow_all_mac_src_address_arr
+for _mac in $allow_all_mac_src_addresses ; do
+   allow_all_mac_src_address_arr+=("$_mac")
+done
+
+declare -a allow_local_mac_src_address_arr
+for _mac in $allow_local_mac_src_addresses ; do
+   allow_local_mac_src_address_arr+=("$_mac")
+done
+
+declare -a allow_remote_mac_src_address_arr
+for _mac in $allow_remote_mac_src_addresses ; do
+   allow_remote_mac_src_address_arr+=("$_mac")
+done
+
diff --git a/GA-Schloss/mailname.GA-Schloss b/GA-Schloss/mailname.GA-Schloss
new file mode 100644
index 0000000..caa315f
--- /dev/null
+++ b/GA-Schloss/mailname.GA-Schloss
@@ -0,0 +1 @@
+ga-st-gw.ga.netz
diff --git a/GA-Schloss/main.cf.GA-Schloss b/GA-Schloss/main.cf.GA-Schloss
new file mode 100644
index 0000000..19623e5
--- /dev/null
+++ b/GA-Schloss/main.cf.GA-Schloss
@@ -0,0 +1,268 @@
+# ============ Basic settings ============
+
+# Debian specific:  Specifying a file name will cause the first
+# line of that file to be used as the name.  The Debian default
+# is /etc/mailname.
+#myorigin = /etc/mailname
+myorigin = /etc/mailname
+
+smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
+biff = no
+
+# appending .domain is the MUA's job.
+append_dot_mydomain = no
+
+# Uncomment the next line to generate "delayed mail" warnings
+#delay_warning_time = 4h
+
+readme_directory = /usr/share/doc/postfix
+html_directory = /usr/share/doc/postfix/html
+
+## - The Internet protocols Postfix will attempt to use when making 
+## - or accepting connections.
+## - DEFAULT: ipv4
+inet_protocols = ipv4
+
+#inet_interfaces = all
+inet_interfaces =
+   127.0.0.1
+   #192.168.11.254
+
+myhostname = ga-st-gw.ga.netz
+
+mydestination = 
+   ga-st-gw.ga.netz
+   localhost
+
+## - The list of "trusted" SMTP clients that have more 
+## - privileges than "strangers"
+## -
+mynetworks = 
+   127.0.0.0/8
+   192.168.11.254/32
+
+smtp_bind_address = 192.168.11.254
+smtp_bind_address6 = 
+
+
+## - The method to generate the default value for the mynetworks parameter.
+## -
+## -   mynetworks_style = host" when Postfix should "trust" only the local machine
+## -   mynetworks_style = subnet (default value) "when Postfix should "trust" SMTP 
+## -                       clients in the same IP subnetworks as the local machine.
+## -   mynetworks_style = class" when Postfix should "trust" SMTP clients in the same 
+## -                      IP class A/B/C networks as the local machine.
+## -
+#mynetworks_style = host
+
+
+## - The maximal size of any local(8) individual mailbox or maildir file, 
+## - or zero (no limit). In fact, this limits the size of any file that is 
+## - written to upon local delivery, including files written by external 
+## - commands that are executed by the local(8) delivery agent. 
+## -
+mailbox_size_limit = 0
+
+## - The maximal size in bytes of a message, including envelope information.
+## -
+## - we user 50MB
+## -
+message_size_limit = 52480000
+
+## - The system-wide recipient address extension delimiter
+## -
+recipient_delimiter = +
+
+## - The alias databases that are used for local(8) delivery.
+## -
+alias_maps =
+   hash:/etc/aliases
+
+## - The alias databases for local(8) delivery that are updated 
+## - with "newaliases" or with "sendmail -bi". 
+## -
+alias_database =
+   hash:/etc/aliases
+
+
+## - The maximal time a message is queued before it is sent back as 
+## - undeliverable. Defaults to 5d (5 days)
+## - Specify 0 when mail delivery should be tried only once.
+## - 
+maximal_queue_lifetime = 3d
+bounce_queue_lifetime = $maximal_queue_lifetime
+
+## - delay_warning_time (default: 0h)
+## -
+## - The time after which the sender receives a copy of the message 
+## - headers of mail that is still queued. To enable this feature, 
+## - specify a non-zero time value (an integral value plus an optional 
+## - one-letter suffix that specifies the time unit). 
+## - Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). 
+## - The default time unit is h (hours). 
+delay_warning_time = 1d
+
+
+
+# ============ Relay parameters ============
+
+#relayhost =
+
+
+# ============ SASL authentication ============
+
+# Enable SASL authentication
+smtp_sasl_auth_enable = yes
+
+# Forwarding to the ip-adress of host b.mx.oopen.de
+relayhost = [b.mx.oopen.de]
+
+# File including login data
+smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
+
+# Force using a (TLS) security connection
+# obsulete - use smtp_tls_security_level instead
+#smtp_use_tls = yes
+#smtp_tls_enforce_peername = no
+smtp_tls_security_level = encrypt
+
+# Disallow methods that allow anonymous authentication.
+smtp_sasl_security_options = noanonymous
+
+
+
+# ============ TLS parameters ============
+
+## - Aktiviert TLS für den Mailempfang
+## -
+## - may:
+## - Opportunistic TLS. Use TLS if this is supported by the remote 
+## - SMTP server, otherwise use plaintext
+## -
+## - This overrides the obsolete parameters smtpd_use_tls and 
+## - smtpd_enforce_tls. This parameter is ignored with 
+## - "smtpd_tls_wrappermode = yes".
+#smtpd_use_tls=yes
+smtp_tls_security_level=encrypt
+
+## - Aktiviert TLS für den Mailversand
+## -
+## - may:
+## - Opportunistic TLS: announce STARTTLS support to SMTP clients, 
+## - but do not require that clients use TLS encryption.
+# smtp_use_tls=yes
+smtpd_tls_security_level=may
+
+## -    0 Disable logging of TLS activity. 
+## -    1 Log TLS handshake and certificate information. 
+## -    2 Log levels during TLS negotiation. 
+## -    3 Log hexadecimal and ASCII dump of TLS negotiation process. 
+## -    4 Also log hexadecimal and ASCII dump of complete transmission after STARTTLS. 
+## -
+smtpd_tls_loglevel = 1
+smtp_tls_loglevel = 1
+
+smtpd_tls_cert_file = /etc/postfix/ssl/mailserver.crt
+smtpd_tls_key_file = /etc/postfix/ssl/mailserver.key
+
+## - File with DH parameters that the Postfix SMTP server should use with EDH ciphers.
+## - 
+## - Dont't forget to create it, e.g with openssl:
+## -    openssl dhparam -out /etc/postfix/ssl/dh_1024.pem -2 1024
+## -
+#smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_1024.pem
+## - also possible to use 2048 key with that parameter
+## -
+smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem
+
+## - File with DH parameters that the Postfix SMTP server should use with EDH ciphers. 
+## - 
+## - Dont't forget to create it, e.g with openssl:
+## -    openssl dhparam -out /etc/postfix/ssl/dh_512.pem -2 512
+## -
+smtpd_tls_dh512_param_file = /etc/postfix/ssl/dh_512.pem
+
+
+## - File containing CA certificates of root CAs trusted to sign either remote SMTP 
+## - server certificates or intermediate CA certificates. These are loaded into 
+## - memory !! BEFORE !! the smtp(8) client enters the chroot jail.
+## - 
+smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
+
+## - Directory with PEM format certificate authority certificates that the Postfix SMTP 
+## - client uses to verify a remote SMTP server certificate. Don't forget to create the 
+## - necessary "hash" links with, for example, "
+## - /bin/c_rehash /etc/postfix/certs". 
+## -
+## - !! Note !!
+## - To use this option in chroot mode, this directory (or a copy) must be inside 
+## - the chroot jail. 
+## -
+## - Note that a chrooted daemon resolves all filenames relative to the Postfix 
+## - queue directory (/var/spool/postfix)
+## -
+#smtpd_tls_CApath = /etc/postfix/certs
+
+
+# Disable SSLv2 SSLv3 - Postfix SMTP server 
+# 
+# List of TLS protocols that the Postfix SMTP server will exclude or  
+# include with opportunistic TLS encryption.  
+smtpd_tls_protocols = !SSLv2, !SSLv3
+# 
+# The SSL/TLS protocols accepted by the Postfix SMTP server  
+# with mandatory TLS encryption. 
+smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
+
+
+# Disable SSLv2 SSLv3 - Postfix SMTP client 
+#  
+# List of TLS protocols that the Postfix SMTP client will exclude or  
+# include with opportunistic TLS encryption.  
+smtp_tls_protocols = !SSLv2, !SSLv3
+# 
+# List of SSL/TLS protocols that the Postfix SMTP client will use  
+# with mandatory TLS encryption 
+smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
+
+
+## - Activate des "Ephemeral Elliptic Curve Diffie-Hellman" (EECDH) key exchange 
+## -    openssl > 1.0
+## -
+smtpd_tls_eecdh_grade = strong
+
+# standard list cryptographic algorithm
+tls_preempt_cipherlist = yes
+
+# Disable ciphers which are less than 256-bit:
+#
+#smtpd_tls_mandatory_ciphers = high
+#
+# opportunistic
+smtpd_tls_ciphers = high
+
+
+# Exclude ciphers
+#smtpd_tls_exclude_ciphers =
+#   RC4
+#   aNULL
+#   SEED-SHA
+#   EXP
+#   MD5
+smtpd_tls_exclude_ciphers =
+   aNULL
+   eNULL
+   EXPORT
+   DES
+   RC4
+   MD5
+   PSK
+   aECDH
+   EDH-DSS-DES-CBC3-SHA
+   EDH-RSA-DES-CDC3-SHA
+   KRB5-DE5, CBC3-SHA
+
+
+smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
+smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
+
diff --git a/GA-Schloss/openvpn/ccd/server-gw-ckubu/gw-ckubu b/GA-Schloss/openvpn/ccd/server-gw-ckubu/gw-ckubu
new file mode 100644
index 0000000..053b6c1
--- /dev/null
+++ b/GA-Schloss/openvpn/ccd/server-gw-ckubu/gw-ckubu
@@ -0,0 +1,21 @@
+ifconfig-push 10.1.11.2 255.255.255.0
+push "route 192.168.11.0 255.255.255.0 10.1.11.1"
+push "route 192.168.10.0 255.255.255.0 10.1.11.1"
+push "route 192.168.77.0 255.255.255.0 10.1.11.1"
+push "route 192.168.78.0 255.255.255.0 10.1.11.1"
+push "route 172.16.11.0 255.255.255.0 10.1.11.1"
+push "route 172.16.12.0 255.255.255.0 10.1.11.1"
+push "route 10.10.11.0 255.255.255.0 10.1.11.1"
+push "route 10.10.9.0 255.255.255.0 10.1.11.1"
+push "route 10.10.10.0 255.255.255.0 10.1.11.1"
+push "route 10.11.11.0 255.255.255.0 10.1.11.1"
+push "route 10.112.1.0 255.255.255.0 10.1.11.1"
+push "route 10.113.0.0 255.255.0.0 10.1.11.1"
+push "route 10.121.0.0 255.255.240.0 10.1.11.1"
+push "route 10.122.1.0 255.255.255.0 10.1.11.1"
+push "route 10.123.0.0 255.255.0.0 10.1.11.1"
+push "route 172.17.0.0 255.255.255.0 10.1.11.1"
+push "route 172.16.211.0 255.255.255.0 10.1.11.1"
+push "route 172.16.210.0 255.255.255.0 10.1.11.1"
+iroute 192.168.63.0 255.255.255.0
+iroute 192.168.64.0 255.255.255.0
diff --git a/GA-Schloss/openvpn/ccd/server-gw-nh/gw-nh b/GA-Schloss/openvpn/ccd/server-gw-nh/gw-nh
new file mode 100644
index 0000000..399ac64
--- /dev/null
+++ b/GA-Schloss/openvpn/ccd/server-gw-nh/gw-nh
@@ -0,0 +1,6 @@
+ifconfig-push 10.2.11.2 255.255.255.0
+push "route 192.168.11.0 255.255.255.0 10.2.11.1"
+push "route 192.168.10.0 255.255.255.0 10.2.11.1"
+push "route 10.10.11.0 255.255.255.0 10.2.11.1"
+push "route 10.10.10.0 255.255.255.0 10.2.11.1"
+iroute 192.168.81.0 255.255.255.0
diff --git a/GA-Schloss/openvpn/ccd/server-home/chris b/GA-Schloss/openvpn/ccd/server-home/chris
new file mode 100644
index 0000000..bbda4ab
--- /dev/null
+++ b/GA-Schloss/openvpn/ccd/server-home/chris
@@ -0,0 +1 @@
+ifconfig-push 10.0.11.2 255.255.255.0
diff --git a/GA-Schloss/openvpn/ccd/server-home/wadmin b/GA-Schloss/openvpn/ccd/server-home/wadmin
new file mode 100644
index 0000000..5c7bac6
--- /dev/null
+++ b/GA-Schloss/openvpn/ccd/server-home/wadmin
@@ -0,0 +1,2 @@
+ifconfig-push 10.0.11.3 255.255.255.0
+push "route 10.113.0.0 255.255.0.0"
diff --git a/GA-Schloss/openvpn/clien-configs/gw-ckubu.conf b/GA-Schloss/openvpn/clien-configs/gw-ckubu.conf
new file mode 100644
index 0000000..0666fe9
--- /dev/null
+++ b/GA-Schloss/openvpn/clien-configs/gw-ckubu.conf
@@ -0,0 +1,223 @@
+##############################################
+# Sample client-side OpenVPN 2.0 config file #
+# for connecting to multi-client server.     #
+#                                            #
+# This configuration can be used by multiple #
+# clients, however each client should have   #
+# its own cert and key files.                #
+#                                            #
+# On Windows, you might want to rename this  #
+# file so it has a .ovpn extension           #
+##############################################
+
+# Specify that we are a client and that we
+# will be pulling certain config file directives
+# from the server.
+client
+
+# Use the same setting as you are using on
+# the server.
+# On most systems, the VPN will not function
+# unless you partially or fully disable
+# the firewall for the TUN/TAP interface.
+;dev tap
+dev tun
+
+# Are we connecting to a TCP or
+# UDP server?  Use the same setting as
+# on the server
+proto udp
+
+# The hostname/IP and port of the server.
+# You can have multiple remote entries
+# to load balance between the servers.
+remote ga-st-gw-surf2.oopen.de 1195
+
+topology subnet
+
+# Keep trying indefinitely to resolve the
+# host name of the OpenVPN server.  Very useful
+# on machines which are not permanently connected
+# to the internet such as laptops.
+resolv-retry infinite
+
+# Most clients don't need to bind to
+# a specific local port number.
+nobind
+
+# Try to preserve some state across restarts.
+persist-key
+persist-tun
+
+# Server CA
+<ca>
+-----BEGIN CERTIFICATE-----
+MIIFKjCCBBKgAwIBAgIJANXFq8sijdObMA0GCSqGSIb3DQEBCwUAMIG+MQswCQYD
+VQQGEwJERTEPMA0GA1UECBMGSGVzc2VuMRQwEgYDVQQHEwtTdG9ja2hhdXNlbjEY
+MBYGA1UEChMPR0EgQWx0ZW5zY2hsaXJmMRkwFwYDVQQLExBOZXR3b3JrIFNlcnZp
+Y2VzMRIwEAYDVQQDEwlWUE4tR0EtY2ExDzANBgNVBCkTBlZQTiBHQTEuMCwGCSqG
+SIb3DQEJARYfaXRAZ2VtZWluc2NoYWZ0LWFsdGVuc2NobGlyZi5kZTAeFw0xNTEw
+MDkxNTQwMzBaFw00NTEwMDgxNTQwMzBaMIG+MQswCQYDVQQGEwJERTEPMA0GA1UE
+CBMGSGVzc2VuMRQwEgYDVQQHEwtTdG9ja2hhdXNlbjEYMBYGA1UEChMPR0EgQWx0
+ZW5zY2hsaXJmMRkwFwYDVQQLExBOZXR3b3JrIFNlcnZpY2VzMRIwEAYDVQQDEwlW
+UE4tR0EtY2ExDzANBgNVBCkTBlZQTiBHQTEuMCwGCSqGSIb3DQEJARYfaXRAZ2Vt
+ZWluc2NoYWZ0LWFsdGVuc2NobGlyZi5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAKLTHSHgX6/Ibr3AlmJfQ3k3yTvaD031Ps3c+bsXgOQEPNO4x7er
+8R47osA7FHNKI8ob7jnX/xJSJcsE2B1zsYpceW7IN/Mmmz0eZyIr7B0tu2dFixxC
+t4Vi4dBTh8ZvEaTZ3YUzROBc/YnWFyq3NFZ0DLdJBX+lFXAYg7qVyD7RCB1Yrwxq
+rJFYK28qeIi4WHfHQICZ1dBlf7qpnL76MjfzjjiTTs4MZwjYRT2RJaPOhnNzPaeF
+c11kP8T+ER46TqYbmBuImpoOntca002opJxw9iXoYJRLYYfhs4XS654iApGbG0vc
+2Kd7uH+QyWElW19EDmeDRJM6Bc0LUu1rKtkCAwEAAaOCAScwggEjMB0GA1UdDgQW
+BBQ1n9sNhkD5ZQ7jRXnON5gNKFeVWTCB8wYDVR0jBIHrMIHogBQ1n9sNhkD5ZQ7j
+RXnON5gNKFeVWaGBxKSBwTCBvjELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAGA1UEAxMJVlBOLUdBLWNh
+MQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEWH2l0QGdlbWVpbnNjaGFm
+dC1hbHRlbnNjaGxpcmYuZGWCCQDVxavLIo3TmzAMBgNVHRMEBTADAQH/MA0GCSqG
+SIb3DQEBCwUAA4IBAQCXp1hi923vehUa/Gd9Ze9UobRo0kPCLxgQkPOotUPAX+Dp
+BDJOIHzoijORN4LmtQV+UNbRGsGU+Mwbejx1b4NHrFtj6KaCbCdB3bumcSmfFbaJ
+QM+qvMtQYXx1NnFnoV6PYD9ZjfsY0AaVi5FB/eHnP5xuGzmbq7gPgG5sz2RO5jcR
+1jO26hbrOINfYplu/NNQqBfRJPwyPFjHcCD/wWE63fnue3A5Oj6jUcuNLbOAHJEy
+Pu37BPHNzjnTUdOe9scXp3WMCJXOtdxoZkfHfGKXYhz//XwX6X/hJMzOZ2K+kUHC
+NfKwQ6snmDzycXtx0EqsYjzGgxbOR0qJbK/pJhii
+-----END CERTIFICATE-----
+</ca>
+
+# Client Certificate
+<cert>
+-----BEGIN CERTIFICATE-----
+MIIFhDCCBGygAwIBAgIBBDANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCREUx
+DzANBgNVBAgTBkhlc3NlbjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoT
+D0dBIEFsdGVuc2NobGlyZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAG
+A1UEAxMJVlBOLUdBLWNhMQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEW
+H2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNjaGxpcmYuZGUwHhcNMTUxMDA5MTYwNzUz
+WhcNMzUxMDA5MTYwNzUzWjCBvTELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczERMA8GA1UEAxMIZ3ctY2t1YnUx
+DzANBgNVBCkTBlZQTiBHQTEuMCwGCSqGSIb3DQEJARYfaXRAZ2VtZWluc2NoYWZ0
+LWFsdGVuc2NobGlyZi5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AK7355Rx645LFvVBtQAzVNqcEVSj4xQP9B3jMiCUSP1G2LJ2EjsjPKLy5IGa5YWr
+w904xeDK7q8REvGPeDp4pT+56k6O2j7md9XOy1Y6yr+X1qVlSRXO4Hta+cKWinAY
+vjtPIL3FubVGB/FUrXZWR/GD7nyKnelCI6Gntvt2wwWt3aj+yPoV9J86MN1NwFAz
+Cxn2UcufcFPHfIDFaXpMuwbsRuRudxh3fBRYRkmarB+mRl/3HHEzpCX0gpKWVv2v
+a8RaDu/T5mg2yOiMHHUS+D40LmTdo7yzfizoVlVbGrNG5AbXs/gZRKMOLZIPyGR2
+r+eD+2KhOpFW+kdjwsPFe0ECAwEAAaOCAYowggGGMAkGA1UdEwQCMAAwLQYJYIZI
+AYb4QgENBCAWHkVhc3ktUlNBIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E
+FgQUdxceVU2ZsbHErH1NiTl5R5Oj99kwgfMGA1UdIwSB6zCB6IAUNZ/bDYZA+WUO
+40V5zjeYDShXlVmhgcSkgcEwgb4xCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNz
+ZW4xFDASBgNVBAcTC1N0b2NraGF1c2VuMRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxp
+cmYxGTAXBgNVBAsTEE5ldHdvcmsgU2VydmljZXMxEjAQBgNVBAMTCVZQTi1HQS1j
+YTEPMA0GA1UEKRMGVlBOIEdBMS4wLAYJKoZIhvcNAQkBFh9pdEBnZW1laW5zY2hh
+ZnQtYWx0ZW5zY2hsaXJmLmRlggkA1cWryyKN05swEwYDVR0lBAwwCgYIKwYBBQUH
+AwIwCwYDVR0PBAQDAgeAMBMGA1UdEQQMMAqCCGd3LWNrdWJ1MA0GCSqGSIb3DQEB
+CwUAA4IBAQBBTSwtPN85g+0QPT8XvxYQFv9PedtEFdKf4R5JWisSI0hyvW9Sf3Vc
+4bc2GYIIG2DFSJip2lUgyvC3yOqKtT6vF32M4NS+GglDOycXWbpZNB9vtjrDvpo/
+Xhv8dSuwE9BIsoJF+peEbP6lINGi6W/p61NHWmO1ClvtZyRxb4YnqOmIEr9s3XP7
+Mm6nttX7690jwZoae/xwGOy17eUz/cGLBq2t7t7m1rhU4ErvGgJOP9PKHkgFrYjm
+jHeBXLbHsff+Tq10bhyiDb0hsAoZi1bViGpRtfaQ+eC0rXnDy/C+/nm+SzlEKeiC
+2XmTO8dbNgoOqETj7d/iDd4copvdzZYw
+-----END CERTIFICATE-----
+</cert>
+
+# Client Key
+<key>
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI5AUTsVDif7oCAggA
+MBQGCCqGSIb3DQMHBAg12+MbxEoyygSCBMgCrl75V6WYOCdXaXmPDePYFZnY1rms
+O7VBq16osPoJCUbnowfDlWyj73kM0kypBQPK1l9ZtXiC50BgbjPS16CeeAZNvFyr
+/1glAmHv4wKArmzF8GL98vEDsKbnBV9nFnPe1YV+Rq4QqeSiOmnWJOqoFbpYDJiO
+f2Io1g9DgoYYjMhvvjMk/mG4Oa6aOueMDYBFQ17NCNwXDj65HI685SiMEYzksQEW
+GcerSML5Q9PDwbaiH+xs1AVp3MEa65PDj3KW7jcB8LenSAzodXo6dhzJelSgv2Bo
+Q769n14ZetOK0Mv/o4blxQAPsbfknKylg/tvGIkFt38mH3PBJeXCNElyWHZJD6BR
+xZah53ajLQa6XXhV2LOj+qKjgvIH4lwb10nr+eL3VdXKPXdMrGQUHHx59Z5zGnwK
+qoRvKOtx/Lk56c+ycjCo0MJW4QddxB8rBmMEduUcI+jIk0ffF26F/uWh/gZO59hj
+Tu6cGAgZY5hxkofm+b4FdyC8dNgQUspPqs9iIqkMSjttzuihme2qdQg5cgl0F2Zp
+u7FTp/E8CsRX+MpVm/i+/0oXi9hspvEwfZcg1hpk3LdF2w3Ym+Wj/jlBiUbTC17K
+YSLQQk2WEWLbvhGLA/3Hp2auYm0h4PxyG9lp1RTkK6WJSz+Vjc/Y8V01Ml5l7pT5
+22eTksbqTeNcasCZkm7dEfAiuA222qS6OUZLzUkX9cBb6EXG/XIQ0qzY6c0UR/38
+qfU0aP1Z08mIwMhGfyn/QmYTcxMw2rov6eHt2tsemDFXNf3qj2dUvJn91nu4b0OQ
+3ddYB6mazfwCOqXeAzxv+POxuJvjUIx3MmIyQtQTvlNa0nzg89DNlAtBrRKDJVvS
+mRLEBT/mFTz6KPpdfVp+qdx+akAQ7YCpmRfBs1Am685b9azOs8+VQOl8rp4PpkU3
+T2rSCRpc7O6hW+YZYBwEMgJn0Qs5YXyiE8Js+k9QB5d20hGIJQAQ6hAyLLamHcj4
+K6KaBhycvsXvB27drkkofQOVEIV751McsgwC+cxS2DRaJf4udr20Pg/2Trc539kp
+anj/hT2auv3/rGGTfY9RLblp00eCjKazltsg3/DbQ5S34hSxnipfa7o6PACxqgAk
+qgZ0G5K/smgql5nppPpE8udS0utfDKgi7lCwlviIfKY/UjsQwRr3wh1L2NrjG1nY
+f7df0/WfVAc9+LA7QBVtKp68oh2wTCGQXdhgjwJgDMJp7xA/I1kd6tsjkXPjPNct
+tg1MZYL/jDjAEzC96ikhLCjbybLVmL3NJKC8Y5+kpxrIs7W4T+ZwTXwfgBUN58Kw
+ZHK7JSQzlBKmLlRbpYcjT+Ra5Mf78xA0ZsJ5D7yVoKYmMRfGfDAXQ4s3ri/EyC5h
+t4FeFvUdrr4fTu3FlxCAOhxV6rFG/pkjIe/o0JHEZpTvxnd9algrNCTu4D6EFJTW
+tQNfQY0mctQhtuMoqG51dB1jVRnZ+f+b7bzBnsesSzJNXKcrq8N0mgcZx0nNDn65
+Db32YOv28+JaID53Bq811tHtsybiuTCx+77oubUaH1it5xIMe7NzL9/gQAPkfn5r
+LnaDPGgPFEy6UaErrCOo10CkLq61VoCj8DgQz5fQ41OQrd0WbKYR5yqh/nTXpFus
+z3U=
+-----END ENCRYPTED PRIVATE KEY-----
+</key>
+
+# Verify server certificate by checking
+# that the certicate has the nsCertType
+# field set to "server".  This is an
+# important precaution to protect against
+# a potential attack discussed here:
+#  http://openvpn.net/howto.html#mitm
+#
+# To use this feature, you will need to generate
+# your server certificates with the nsCertType
+# field set to "server".  The build-key-serve
+#
+# Note!
+# This option has been deprecated since version 2.4 and 
+# will be removed from later distributions.
+#
+#ns-cert-type server
+
+# If a tls-auth key is used on the server
+# then every client must also have the key.
+#
+# Don't forget to set the 'key-direction' Parameter if using
+# Inline Key. Usualy , sever has key direction '0', while client
+# has ke direction '1'.
+#
+key-direction 1
+<tls-auth>
+-----BEGIN OpenVPN Static key V1-----
+2e6c91c0db488d5f018432f60605fbba
+5ec1afd4522ddd28d917ade2c7515daf
+9a7a3104b523c929f10a2ccdd2197b83
+949e5644669ab0f82b62e08aa887252a
+cc20618f9f8c1b0eeded6ea92a392e79
+e477a890e2800cf0cf340ac6139cf7a6
+0cfc5c713a39e8b2c44347006bb90583
+8fe0bccf4feea50e7880ee7c7c510114
+e9613960f8af9096fc46d75886b1bdbd
+773b77d9044db17109a5615614797b98
+bdacaae155966bad69819d08f1c8cafa
+1cf102981e2188d155d26043b59538b9
+15c1d67430d6b67c9c313123fb7cb427
+29cc6972e63470c74c6bf2342fb57ba3
+50d3254df49d2158f4faf5bc38fa9d69
+1014d126eac903e30f6c97df69a3b665
+-----END OpenVPN Static key V1-----
+</tls-auth>
+
+# Select a cryptographic cipher.
+# If the cipher option is used on the server
+# then you must also specify it here.
+;cipher BF-CBC        # Blowfish (default)
+;cipher AES-128-CBC   # AES
+;cipher DES-EDE3-CBC  # Triple-DES
+
+# Enable compression on the VPN link.
+# Don't enable this unless it is also
+# enabled in the server config file.
+comp-lzo
+
+# Verbosity level.
+# 0 -- quiet except for fatal errors.
+# 1 -- mostly quiet, but display non-fatal network errors.
+# 3 -- medium output, good for normal operation.
+# 9 -- verbose, good for troubleshooting
+verb 1
+
+# Setting 'pull' on the client takes care to get the 'push' durectives
+# from the server
+pull
diff --git a/GA-Schloss/openvpn/crl.pem b/GA-Schloss/openvpn/crl.pem
new file mode 100644
index 0000000..d31cf45
--- /dev/null
+++ b/GA-Schloss/openvpn/crl.pem
@@ -0,0 +1,13 @@
+-----BEGIN X509 CRL-----
+MIICBTCB7jANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCREUxDzANBgNVBAgT
+Bkhlc3NlbjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVu
+c2NobGlyZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAGA1UEAxMJVlBO
+LUdBLWNhMQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEWH2l0QGdlbWVp
+bnNjaGFmdC1hbHRlbnNjaGxpcmYuZGUXDTE4MDMyMjE3MjQzMVoXDTI4MDMxOTE3
+MjQzMVowDQYJKoZIhvcNAQELBQADggEBAIgttSiPDGlBMvJoxR4hMTsRI6bQs6Sm
+QE3/eF6UkBYYXNVzLJCoyR5eDYXSLCx3uQGLkFKSLHR5+WUGIWzhd47dtL9SUdcG
+tmr3F5Fz6TFbRApomoh3luUSZoALnegpvvsYIBimtihEga2rZzfHWqZR5trrZliO
+MDzqgC4xLCks1NSNGpFkz5rI7bpr+Yomg8tSY01T3KGvE23mAOShuGJB1JWu1exJ
+8wHiLGBvrspdkkUoDrCRDLy8VaXpqUYnvnDdw2dkRPWoI9GlhkU2Gvyok7pezGMu
+2l9Waen+WAfWJ+WXuUJ5XlOLaXTj04ZoL1JUwYHv39ljqzoHNQkv5lw=
+-----END X509 CRL-----
diff --git a/GA-Schloss/openvpn/easy-rsa/build-ca b/GA-Schloss/openvpn/easy-rsa/build-ca
new file mode 120000
index 0000000..b76c6bc
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/build-ca
@@ -0,0 +1 @@
+/usr/share/easy-rsa/build-ca
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/build-dh b/GA-Schloss/openvpn/easy-rsa/build-dh
new file mode 120000
index 0000000..2baa885
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/build-dh
@@ -0,0 +1 @@
+/usr/share/easy-rsa/build-dh
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/build-inter b/GA-Schloss/openvpn/easy-rsa/build-inter
new file mode 120000
index 0000000..cada729
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/build-inter
@@ -0,0 +1 @@
+/usr/share/easy-rsa/build-inter
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/build-key b/GA-Schloss/openvpn/easy-rsa/build-key
new file mode 120000
index 0000000..715432c
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/build-key
@@ -0,0 +1 @@
+/usr/share/easy-rsa/build-key
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/build-key-pass b/GA-Schloss/openvpn/easy-rsa/build-key-pass
new file mode 120000
index 0000000..49d0356
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/build-key-pass
@@ -0,0 +1 @@
+/usr/share/easy-rsa/build-key-pass
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/build-key-pkcs12 b/GA-Schloss/openvpn/easy-rsa/build-key-pkcs12
new file mode 120000
index 0000000..cf8e73e
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/build-key-pkcs12
@@ -0,0 +1 @@
+/usr/share/easy-rsa/build-key-pkcs12
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/build-key-server b/GA-Schloss/openvpn/easy-rsa/build-key-server
new file mode 120000
index 0000000..528087d
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/build-key-server
@@ -0,0 +1 @@
+/usr/share/easy-rsa/build-key-server
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/build-req b/GA-Schloss/openvpn/easy-rsa/build-req
new file mode 120000
index 0000000..870d885
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/build-req
@@ -0,0 +1 @@
+/usr/share/easy-rsa/build-req
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/build-req-pass b/GA-Schloss/openvpn/easy-rsa/build-req-pass
new file mode 120000
index 0000000..d35daa8
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/build-req-pass
@@ -0,0 +1 @@
+/usr/share/easy-rsa/build-req-pass
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/clean-all b/GA-Schloss/openvpn/easy-rsa/clean-all
new file mode 120000
index 0000000..c9f2970
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/clean-all
@@ -0,0 +1 @@
+/usr/share/easy-rsa/clean-all
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/inherit-inter b/GA-Schloss/openvpn/easy-rsa/inherit-inter
new file mode 120000
index 0000000..87736c6
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/inherit-inter
@@ -0,0 +1 @@
+/usr/share/easy-rsa/inherit-inter
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/list-crl b/GA-Schloss/openvpn/easy-rsa/list-crl
new file mode 120000
index 0000000..dfe3fa0
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/list-crl
@@ -0,0 +1 @@
+/usr/share/easy-rsa/list-crl
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/openssl-0.9.6.cnf b/GA-Schloss/openvpn/easy-rsa/openssl-0.9.6.cnf
new file mode 100644
index 0000000..fb08fea
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/openssl-0.9.6.cnf
@@ -0,0 +1,268 @@
+# For use with easy-rsa version 2.0
+
+#
+# OpenSSL example configuration file.
+# This is mostly being used for generation of certificate requests.
+#
+
+# This definition stops the following lines choking if HOME isn't
+# defined.
+HOME			= .
+RANDFILE		= $ENV::HOME/.rnd
+
+# Extra OBJECT IDENTIFIER info:
+#oid_file		= $ENV::HOME/.oid
+oid_section		= new_oids
+
+# To use this configuration file with the "-extfile" option of the
+# "openssl x509" utility, name here the section containing the
+# X.509v3 extensions to use:
+# extensions		= 
+# (Alternatively, use a configuration file that has only
+# X.509v3 extensions in its main [= default] section.)
+
+[ new_oids ]
+
+# We can add new OIDs in here for use by 'ca' and 'req'.
+# Add a simple OID like this:
+# testoid1=1.2.3.4
+# Or use config file substitution like this:
+# testoid2=${testoid1}.5.6
+
+####################################################################
+[ ca ]
+default_ca	= CA_default		# The default ca section
+
+####################################################################
+[ CA_default ]
+
+dir		= $ENV::KEY_DIR		# Where everything is kept
+certs		= $dir			# Where the issued certs are kept
+crl_dir		= $dir			# Where the issued crl are kept
+database	= $dir/index.txt	# database index file.
+new_certs_dir	= $dir			# default place for new certs.
+
+certificate	= $dir/ca.crt	 	# The CA certificate
+serial		= $dir/serial 		# The current serial number
+crl		= $dir/crl.pem 		# The current CRL
+private_key	= $dir/ca.key	 	# The private key
+RANDFILE	= $dir/.rand		# private random number file
+
+x509_extensions	= usr_cert		# The extentions to add to the cert
+
+# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
+# so this is commented out by default to leave a V1 CRL.
+# crl_extensions	= crl_ext
+
+default_days	= 3650			# how long to certify for
+default_crl_days= 30			# how long before next CRL
+default_md	= sha256		# which md to use.
+preserve	= no			# keep passed DN ordering
+
+# A few difference way of specifying how similar the request should look
+# For type CA, the listed attributes must be the same, and the optional
+# and supplied fields are just that :-)
+policy		= policy_anything
+
+# For the CA policy
+[ policy_match ]
+countryName		= match
+stateOrProvinceName	= match
+organizationName	= match
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+# For the 'anything' policy
+# At this point in time, you must list all acceptable 'object'
+# types.
+[ policy_anything ]
+countryName		= optional
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+####################################################################
+[ req ]
+default_bits		= $ENV::KEY_SIZE
+default_keyfile 	= privkey.pem
+default_md		= sha256
+distinguished_name	= req_distinguished_name
+attributes		= req_attributes
+x509_extensions	= v3_ca	# The extentions to add to the self signed cert
+
+# Passwords for private keys if not present they will be prompted for
+# input_password = secret
+# output_password = secret
+
+# This sets a mask for permitted string types. There are several options. 
+# default: PrintableString, T61String, BMPString.
+# pkix	 : PrintableString, BMPString.
+# utf8only: only UTF8Strings.
+# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
+# MASK:XXXX a literal mask value.
+# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
+# so use this option with caution!
+string_mask = nombstr
+
+# req_extensions = v3_req # The extensions to add to a certificate request
+
+[ req_distinguished_name ]
+countryName			= Country Name (2 letter code)
+countryName_default		= $ENV::KEY_COUNTRY
+countryName_min			= 2
+countryName_max			= 2
+
+stateOrProvinceName		= State or Province Name (full name)
+stateOrProvinceName_default	= $ENV::KEY_PROVINCE
+
+localityName			= Locality Name (eg, city)
+localityName_default		= $ENV::KEY_CITY
+
+0.organizationName		= Organization Name (eg, company)
+0.organizationName_default	= $ENV::KEY_ORG
+
+# we can do this but it is not needed normally :-)
+#1.organizationName		= Second Organization Name (eg, company)
+#1.organizationName_default	= World Wide Web Pty Ltd
+
+organizationalUnitName		= Organizational Unit Name (eg, section)
+#organizationalUnitName_default	=
+
+commonName			= Common Name (eg, your name or your server\'s hostname)
+commonName_max			= 64
+
+emailAddress			= Email Address
+emailAddress_default		= $ENV::KEY_EMAIL
+emailAddress_max		= 40
+
+# JY -- added for batch mode
+organizationalUnitName_default = $ENV::KEY_OU
+commonName_default = $ENV::KEY_CN
+
+# SET-ex3			= SET extension number 3
+
+[ req_attributes ]
+challengePassword		= A challenge password
+challengePassword_min		= 4
+challengePassword_max		= 20
+
+unstructuredName		= An optional company name
+
+[ usr_cert ]
+
+# These extensions are added when 'ca' signs a request.
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+
+# This is OK for an SSL server.
+# nsCertType			= server
+
+# For an object signing certificate this would be used.
+# nsCertType = objsign
+
+# For normal client use this is typical
+# nsCertType = client, email
+
+# and for everything including object signing:
+# nsCertType = client, email, objsign
+
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+# This will be displayed in Netscape's comment listbox.
+nsComment			= "Easy-RSA Generated Certificate"
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
+extendedKeyUsage=clientAuth
+keyUsage = digitalSignature
+
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+subjectAltName=$ENV::KEY_ALTNAMES
+
+# Copy subject details
+# issuerAltName=issuer:copy
+
+#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
+#nsBaseUrl
+#nsRevocationUrl
+#nsRenewalUrl
+#nsCaPolicyUrl
+#nsSslServerName
+
+[ server ]
+
+# JY ADDED -- Make a cert with nsCertType set to "server"
+basicConstraints=CA:FALSE
+nsCertType			= server
+nsComment			= "Easy-RSA Generated Server Certificate"
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
+extendedKeyUsage=serverAuth
+keyUsage = digitalSignature, keyEncipherment
+subjectAltName=$ENV::KEY_ALTNAMES
+
+[ v3_req ]
+
+# Extensions to add to a certificate request
+
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+[ v3_ca ]
+
+
+# Extensions for a typical CA
+
+
+# PKIX recommendation.
+
+subjectKeyIdentifier=hash
+
+authorityKeyIdentifier=keyid:always,issuer:always
+
+# This is what PKIX recommends but some broken software chokes on critical
+# extensions.
+#basicConstraints = critical,CA:true
+# So we do this instead.
+basicConstraints = CA:true
+
+# Key usage: this is typical for a CA certificate. However since it will
+# prevent it being used as an test self-signed certificate it is best
+# left out by default.
+# keyUsage = cRLSign, keyCertSign
+
+# Some might want this also
+# nsCertType = sslCA, emailCA
+
+# Include email address in subject alt name: another PKIX recommendation
+# subjectAltName=email:copy
+# Copy issuer details
+# issuerAltName=issuer:copy
+
+# DER hex encoding of an extension: beware experts only!
+# obj=DER:02:03
+# Where 'obj' is a standard or added object
+# You can even override a supported extension:
+# basicConstraints= critical, DER:30:03:01:01:FF
+
+[ crl_ext ]
+
+# CRL extensions.
+# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
+
+# issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always,issuer:always
diff --git a/GA-Schloss/openvpn/easy-rsa/openssl-0.9.8.cnf b/GA-Schloss/openvpn/easy-rsa/openssl-0.9.8.cnf
new file mode 100644
index 0000000..90331a0
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/openssl-0.9.8.cnf
@@ -0,0 +1,293 @@
+# For use with easy-rsa version 2.0
+
+#
+# OpenSSL example configuration file.
+# This is mostly being used for generation of certificate requests.
+#
+
+# This definition stops the following lines choking if HOME isn't
+# defined.
+HOME			= .
+RANDFILE		= $ENV::HOME/.rnd
+openssl_conf		= openssl_init
+
+[ openssl_init ]
+# Extra OBJECT IDENTIFIER info:
+#oid_file		= $ENV::HOME/.oid
+oid_section		= new_oids
+engines                 = engine_section
+
+# To use this configuration file with the "-extfile" option of the
+# "openssl x509" utility, name here the section containing the
+# X.509v3 extensions to use:
+# extensions		=
+# (Alternatively, use a configuration file that has only
+# X.509v3 extensions in its main [= default] section.)
+
+[ new_oids ]
+
+# We can add new OIDs in here for use by 'ca' and 'req'.
+# Add a simple OID like this:
+# testoid1=1.2.3.4
+# Or use config file substitution like this:
+# testoid2=${testoid1}.5.6
+
+####################################################################
+[ ca ]
+default_ca	= CA_default		# The default ca section
+
+####################################################################
+[ CA_default ]
+
+dir		= $ENV::KEY_DIR		# Where everything is kept
+certs		= $dir			# Where the issued certs are kept
+crl_dir		= $dir			# Where the issued crl are kept
+database	= $dir/index.txt	# database index file.
+new_certs_dir	= $dir			# default place for new certs.
+
+certificate	= $dir/ca.crt	 	# The CA certificate
+serial		= $dir/serial 		# The current serial number
+crl		= $dir/crl.pem 		# The current CRL
+private_key	= $dir/ca.key	 	# The private key
+RANDFILE	= $dir/.rand		# private random number file
+
+x509_extensions	= usr_cert		# The extentions to add to the cert
+
+# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
+# so this is commented out by default to leave a V1 CRL.
+# crl_extensions	= crl_ext
+
+default_days	= 3650			# how long to certify for
+default_crl_days= 30			# how long before next CRL
+default_md	= sha256		# which md to use.
+preserve	= no			# keep passed DN ordering
+
+# A few difference way of specifying how similar the request should look
+# For type CA, the listed attributes must be the same, and the optional
+# and supplied fields are just that :-)
+policy		= policy_anything
+
+# For the CA policy
+[ policy_match ]
+countryName		= match
+stateOrProvinceName	= match
+organizationName	= match
+organizationalUnitName	= optional
+commonName		= supplied
+name			= optional
+emailAddress		= optional
+
+# For the 'anything' policy
+# At this point in time, you must list all acceptable 'object'
+# types.
+[ policy_anything ]
+countryName		= optional
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+name			= optional
+emailAddress		= optional
+
+####################################################################
+[ req ]
+default_bits		= $ENV::KEY_SIZE
+default_keyfile 	= privkey.pem
+default_md		= sha256
+distinguished_name	= req_distinguished_name
+attributes		= req_attributes
+x509_extensions	= v3_ca	# The extentions to add to the self signed cert
+
+# Passwords for private keys if not present they will be prompted for
+# input_password = secret
+# output_password = secret
+
+# This sets a mask for permitted string types. There are several options.
+# default: PrintableString, T61String, BMPString.
+# pkix	 : PrintableString, BMPString.
+# utf8only: only UTF8Strings.
+# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
+# MASK:XXXX a literal mask value.
+# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
+# so use this option with caution!
+string_mask = nombstr
+
+# req_extensions = v3_req # The extensions to add to a certificate request
+
+[ req_distinguished_name ]
+countryName			= Country Name (2 letter code)
+countryName_default		= $ENV::KEY_COUNTRY
+countryName_min			= 2
+countryName_max			= 2
+
+stateOrProvinceName		= State or Province Name (full name)
+stateOrProvinceName_default	= $ENV::KEY_PROVINCE
+
+localityName			= Locality Name (eg, city)
+localityName_default		= $ENV::KEY_CITY
+
+0.organizationName		= Organization Name (eg, company)
+0.organizationName_default	= $ENV::KEY_ORG
+
+# we can do this but it is not needed normally :-)
+#1.organizationName		= Second Organization Name (eg, company)
+#1.organizationName_default	= World Wide Web Pty Ltd
+
+organizationalUnitName		= Organizational Unit Name (eg, section)
+#organizationalUnitName_default	=
+
+commonName			= Common Name (eg, your name or your server\'s hostname)
+commonName_max			= 64
+
+name				= Name
+name_max			= 64
+
+emailAddress			= Email Address
+emailAddress_default		= $ENV::KEY_EMAIL
+emailAddress_max		= 40
+
+# JY -- added for batch mode
+organizationalUnitName_default = $ENV::KEY_OU
+commonName_default = $ENV::KEY_CN
+name_default = $ENV::KEY_NAME
+
+# SET-ex3			= SET extension number 3
+
+[ req_attributes ]
+challengePassword		= A challenge password
+challengePassword_min		= 4
+challengePassword_max		= 20
+
+unstructuredName		= An optional company name
+
+[ usr_cert ]
+
+# These extensions are added when 'ca' signs a request.
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+
+# This is OK for an SSL server.
+# nsCertType			= server
+
+# For an object signing certificate this would be used.
+# nsCertType = objsign
+
+# For normal client use this is typical
+# nsCertType = client, email
+
+# and for everything including object signing:
+# nsCertType = client, email, objsign
+
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+# This will be displayed in Netscape's comment listbox.
+nsComment			= "Easy-RSA Generated Certificate"
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
+extendedKeyUsage=clientAuth
+keyUsage = digitalSignature
+
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+subjectAltName=$ENV::KEY_ALTNAMES
+
+# Copy subject details
+# issuerAltName=issuer:copy
+
+#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
+#nsBaseUrl
+#nsRevocationUrl
+#nsRenewalUrl
+#nsCaPolicyUrl
+#nsSslServerName
+
+[ server ]
+
+# JY ADDED -- Make a cert with nsCertType set to "server"
+basicConstraints=CA:FALSE
+nsCertType			= server
+nsComment			= "Easy-RSA Generated Server Certificate"
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
+extendedKeyUsage=serverAuth
+keyUsage = digitalSignature, keyEncipherment
+subjectAltName=$ENV::KEY_ALTNAMES
+
+[ v3_req ]
+
+# Extensions to add to a certificate request
+
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+[ v3_ca ]
+
+
+# Extensions for a typical CA
+
+
+# PKIX recommendation.
+
+subjectKeyIdentifier=hash
+
+authorityKeyIdentifier=keyid:always,issuer:always
+
+# This is what PKIX recommends but some broken software chokes on critical
+# extensions.
+#basicConstraints = critical,CA:true
+# So we do this instead.
+basicConstraints = CA:true
+
+# Key usage: this is typical for a CA certificate. However since it will
+# prevent it being used as an test self-signed certificate it is best
+# left out by default.
+# keyUsage = cRLSign, keyCertSign
+
+# Some might want this also
+# nsCertType = sslCA, emailCA
+
+# Include email address in subject alt name: another PKIX recommendation
+# subjectAltName=email:copy
+# Copy issuer details
+# issuerAltName=issuer:copy
+
+# DER hex encoding of an extension: beware experts only!
+# obj=DER:02:03
+# Where 'obj' is a standard or added object
+# You can even override a supported extension:
+# basicConstraints= critical, DER:30:03:01:01:FF
+
+[ crl_ext ]
+
+# CRL extensions.
+# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
+
+# issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always,issuer:always
+
+[ engine_section ]
+#
+# If you are using PKCS#11
+# Install engine_pkcs11 of opensc (www.opensc.org)
+# And uncomment the following
+# verify that dynamic_path points to the correct location
+#
+#pkcs11 = pkcs11_section
+
+[ pkcs11_section ]
+engine_id = pkcs11
+dynamic_path = /usr/lib/engines/engine_pkcs11.so
+MODULE_PATH = $ENV::PKCS11_MODULE_PATH
+PIN = $ENV::PKCS11_PIN
+init = 0
diff --git a/GA-Schloss/openvpn/easy-rsa/openssl-1.0.0.cnf b/GA-Schloss/openvpn/easy-rsa/openssl-1.0.0.cnf
new file mode 100644
index 0000000..5245ed7
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/openssl-1.0.0.cnf
@@ -0,0 +1,288 @@
+# For use with easy-rsa version 2.0 and OpenSSL 1.0.0*
+
+# This definition stops the following lines choking if HOME isn't
+# defined.
+HOME			= .
+RANDFILE		= $ENV::HOME/.rnd
+openssl_conf		= openssl_init
+
+[ openssl_init ]
+# Extra OBJECT IDENTIFIER info:
+#oid_file		= $ENV::HOME/.oid
+oid_section		= new_oids
+engines			= engine_section
+
+# To use this configuration file with the "-extfile" option of the
+# "openssl x509" utility, name here the section containing the
+# X.509v3 extensions to use:
+# extensions		=
+# (Alternatively, use a configuration file that has only
+# X.509v3 extensions in its main [= default] section.)
+
+[ new_oids ]
+
+# We can add new OIDs in here for use by 'ca' and 'req'.
+# Add a simple OID like this:
+# testoid1=1.2.3.4
+# Or use config file substitution like this:
+# testoid2=${testoid1}.5.6
+
+####################################################################
+[ ca ]
+default_ca	= CA_default		# The default ca section
+
+####################################################################
+[ CA_default ]
+
+dir		= $ENV::KEY_DIR		# Where everything is kept
+certs		= $dir			# Where the issued certs are kept
+crl_dir		= $dir			# Where the issued crl are kept
+database	= $dir/index.txt	# database index file.
+new_certs_dir	= $dir			# default place for new certs.
+
+certificate	= $dir/ca.crt	 	# The CA certificate
+serial		= $dir/serial 		# The current serial number
+crl		= $dir/crl.pem 		# The current CRL
+private_key	= $dir/ca.key		# The private key
+RANDFILE	= $dir/.rand		# private random number file
+
+x509_extensions	= usr_cert		# The extentions to add to the cert
+
+# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
+# so this is commented out by default to leave a V1 CRL.
+# crl_extensions	= crl_ext
+
+default_days	= 3650			# how long to certify for
+default_crl_days= 3650			# how long before next CRL
+default_md	= sha256		# use public key default MD
+preserve	= no			# keep passed DN ordering
+
+# A few difference way of specifying how similar the request should look
+# For type CA, the listed attributes must be the same, and the optional
+# and supplied fields are just that :-)
+policy		= policy_anything
+
+# For the CA policy
+[ policy_match ]
+countryName		= match
+stateOrProvinceName	= match
+organizationName	= match
+organizationalUnitName	= optional
+commonName		= supplied
+name			= optional
+emailAddress		= optional
+
+# For the 'anything' policy
+# At this point in time, you must list all acceptable 'object'
+# types.
+[ policy_anything ]
+countryName		= optional
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+name			= optional
+emailAddress		= optional
+
+####################################################################
+[ req ]
+default_bits		= $ENV::KEY_SIZE
+default_keyfile 	= privkey.pem
+default_md		= sha256
+distinguished_name	= req_distinguished_name
+attributes		= req_attributes
+x509_extensions	= v3_ca	# The extentions to add to the self signed cert
+
+# Passwords for private keys if not present they will be prompted for
+# input_password = secret
+# output_password = secret
+
+# This sets a mask for permitted string types. There are several options.
+# default: PrintableString, T61String, BMPString.
+# pkix	 : PrintableString, BMPString (PKIX recommendation after 2004).
+# utf8only: only UTF8Strings (PKIX recommendation after 2004).
+# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
+# MASK:XXXX a literal mask value.
+string_mask = nombstr
+
+# req_extensions = v3_req # The extensions to add to a certificate request
+
+[ req_distinguished_name ]
+countryName			= Country Name (2 letter code)
+countryName_default		= $ENV::KEY_COUNTRY
+countryName_min			= 2
+countryName_max			= 2
+
+stateOrProvinceName		= State or Province Name (full name)
+stateOrProvinceName_default	= $ENV::KEY_PROVINCE
+
+localityName			= Locality Name (eg, city)
+localityName_default		= $ENV::KEY_CITY
+
+0.organizationName		= Organization Name (eg, company)
+0.organizationName_default	= $ENV::KEY_ORG
+
+# we can do this but it is not needed normally :-)
+#1.organizationName		= Second Organization Name (eg, company)
+#1.organizationName_default	= World Wide Web Pty Ltd
+
+organizationalUnitName		= Organizational Unit Name (eg, section)
+#organizationalUnitName_default	=
+
+commonName			= Common Name (eg, your name or your server\'s hostname)
+commonName_max			= 64
+
+name				= Name
+name_max			= 64
+
+emailAddress			= Email Address
+emailAddress_default		= $ENV::KEY_EMAIL
+emailAddress_max		= 40
+
+# JY -- added for batch mode
+organizationalUnitName_default = $ENV::KEY_OU
+commonName_default = $ENV::KEY_CN
+name_default = $ENV::KEY_NAME
+
+
+# SET-ex3			= SET extension number 3
+
+[ req_attributes ]
+challengePassword		= A challenge password
+challengePassword_min		= 4
+challengePassword_max		= 20
+
+unstructuredName		= An optional company name
+
+[ usr_cert ]
+
+# These extensions are added when 'ca' signs a request.
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+
+# This is OK for an SSL server.
+# nsCertType			= server
+
+# For an object signing certificate this would be used.
+# nsCertType = objsign
+
+# For normal client use this is typical
+# nsCertType = client, email
+
+# and for everything including object signing:
+# nsCertType = client, email, objsign
+
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+# This will be displayed in Netscape's comment listbox.
+nsComment			= "Easy-RSA Generated Certificate"
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
+extendedKeyUsage=clientAuth
+keyUsage = digitalSignature
+
+
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+subjectAltName=$ENV::KEY_ALTNAMES
+
+# Copy subject details
+# issuerAltName=issuer:copy
+
+#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
+#nsBaseUrl
+#nsRevocationUrl
+#nsRenewalUrl
+#nsCaPolicyUrl
+#nsSslServerName
+
+[ server ]
+
+# JY ADDED -- Make a cert with nsCertType set to "server"
+basicConstraints=CA:FALSE
+nsCertType                     = server
+nsComment                      = "Easy-RSA Generated Server Certificate"
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
+extendedKeyUsage=serverAuth
+keyUsage = digitalSignature, keyEncipherment
+subjectAltName=$ENV::KEY_ALTNAMES
+
+[ v3_req ]
+
+# Extensions to add to a certificate request
+
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+[ v3_ca ]
+
+
+# Extensions for a typical CA
+
+
+# PKIX recommendation.
+
+subjectKeyIdentifier=hash
+
+authorityKeyIdentifier=keyid:always,issuer:always
+
+# This is what PKIX recommends but some broken software chokes on critical
+# extensions.
+#basicConstraints = critical,CA:true
+# So we do this instead.
+basicConstraints = CA:true
+
+# Key usage: this is typical for a CA certificate. However since it will
+# prevent it being used as an test self-signed certificate it is best
+# left out by default.
+# keyUsage = cRLSign, keyCertSign
+
+# Some might want this also
+# nsCertType = sslCA, emailCA
+
+# Include email address in subject alt name: another PKIX recommendation
+# subjectAltName=email:copy
+# Copy issuer details
+# issuerAltName=issuer:copy
+
+# DER hex encoding of an extension: beware experts only!
+# obj=DER:02:03
+# Where 'obj' is a standard or added object
+# You can even override a supported extension:
+# basicConstraints= critical, DER:30:03:01:01:FF
+
+[ crl_ext ]
+
+# CRL extensions.
+# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
+
+# issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always,issuer:always
+
+[ engine_section ]
+#
+# If you are using PKCS#11
+# Install engine_pkcs11 of opensc (www.opensc.org)
+# And uncomment the following
+# verify that dynamic_path points to the correct location
+#
+#pkcs11 = pkcs11_section
+
+[ pkcs11_section ]
+engine_id = pkcs11
+dynamic_path = /usr/lib/engines/engine_pkcs11.so
+MODULE_PATH = $ENV::PKCS11_MODULE_PATH
+PIN = $ENV::PKCS11_PIN
+init = 0
diff --git a/GA-Schloss/openvpn/easy-rsa/openssl.cnf b/GA-Schloss/openvpn/easy-rsa/openssl.cnf
new file mode 120000
index 0000000..9cc2ab3
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/openssl.cnf
@@ -0,0 +1 @@
+openssl-1.0.0.cnf
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/pkitool b/GA-Schloss/openvpn/easy-rsa/pkitool
new file mode 120000
index 0000000..2f7047b
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/pkitool
@@ -0,0 +1 @@
+/usr/share/easy-rsa/pkitool
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/revoke-full b/GA-Schloss/openvpn/easy-rsa/revoke-full
new file mode 120000
index 0000000..5612776
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/revoke-full
@@ -0,0 +1 @@
+/usr/share/easy-rsa/revoke-full
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/sign-req b/GA-Schloss/openvpn/easy-rsa/sign-req
new file mode 120000
index 0000000..aad0401
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/sign-req
@@ -0,0 +1 @@
+/usr/share/easy-rsa/sign-req
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/easy-rsa/vars b/GA-Schloss/openvpn/easy-rsa/vars
new file mode 100644
index 0000000..23f368b
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/vars
@@ -0,0 +1,95 @@
+# easy-rsa parameter settings
+
+# NOTE: If you installed from an RPM,
+# don't edit this file in place in
+# /usr/share/openvpn/easy-rsa --
+# instead, you should copy the whole
+# easy-rsa directory to another location
+# (such as /etc/openvpn) so that your
+# edits will not be wiped out by a future
+# OpenVPN package upgrade.
+
+# This variable should point to
+# the top level of the easy-rsa
+# tree.
+##export EASY_RSA="`pwd`"
+export BASE_DIR="/etc/openvpn"
+export EASY_RSA="$BASE_DIR/easy-rsa"
+
+#
+# This variable should point to
+# the requested executables
+#
+export OPENSSL="openssl"
+export PKCS11TOOL="pkcs11-tool"
+export GREP="grep"
+
+
+# This variable should point to
+# the openssl.cnf file included
+# with easy-rsa.
+export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`
+
+# Edit this variable to point to
+# your soon-to-be-created key
+# directory.
+#
+# WARNING: clean-all will do
+# a rm -rf on this directory
+# so make sure you define
+# it correctly!
+##export KEY_DIR="$EASY_RSA/keys"
+export KEY_DIR="$BASE_DIR/keys"
+
+# Issue rm -rf warning
+echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
+
+# PKCS11 fixes
+export PKCS11_MODULE_PATH="dummy"
+export PKCS11_PIN="dummy"
+
+# Increase this to 2048 if you
+# are paranoid.  This will slow
+# down TLS negotiation performance
+# as well as the one-time DH parms
+# generation process.
+export KEY_SIZE=2048
+
+# In how many days should the root CA key expire?
+##export CA_EXPIRE=3650
+export CA_EXPIRE=10957
+
+# In how many days should certificates expire?
+##export KEY_EXPIRE=3650
+export KEY_EXPIRE=7305
+
+# These are the default values for fields
+# which will be placed in the certificate.
+# Don't leave any of these fields blank.
+##export KEY_COUNTRY="US"
+export KEY_COUNTRY="DE"
+##export KEY_PROVINCE="CA"
+export KEY_PROVINCE="Hessen"
+##export KEY_CITY="SanFrancisco"
+export KEY_CITY="Stockhausen"
+##export KEY_ORG="Fort-Funston"
+export KEY_ORG="GA Altenschlirf"
+##export KEY_EMAIL="me@myhost.mydomain"
+export KEY_EMAIL="it@gemeinschaft-altenschlirf.de"
+##export KEY_OU="MyOrganizationalUnit"
+export KEY_OU="Network Services"
+
+# X509 Subject Field
+##export KEY_NAME="EasyRSA"
+export KEY_NAME="VPN GA"
+
+# PKCS11 Smart Card
+# export PKCS11_MODULE_PATH="/usr/lib/changeme.so"
+# export PKCS11_PIN=1234
+
+# If you'd like to sign all keys with the same Common Name, uncomment the KEY_CN export below
+# You will also need to make sure your OpenVPN server config has the duplicate-cn option set
+## export KEY_CN="CommonName"
+export KEY_CN="VPN-GA-ca"
+
+export KEY_ALTNAMES="VPN GA"
diff --git a/GA-Schloss/openvpn/easy-rsa/whichopensslcnf b/GA-Schloss/openvpn/easy-rsa/whichopensslcnf
new file mode 120000
index 0000000..d1d4acf
--- /dev/null
+++ b/GA-Schloss/openvpn/easy-rsa/whichopensslcnf
@@ -0,0 +1 @@
+/usr/share/easy-rsa/whichopensslcnf
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/ipp.txt b/GA-Schloss/openvpn/ipp.txt
new file mode 100644
index 0000000..e69de29
diff --git a/GA-Schloss/openvpn/keys/01.pem b/GA-Schloss/openvpn/keys/01.pem
new file mode 100644
index 0000000..1cf5b2e
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/01.pem
@@ -0,0 +1,101 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Validity
+            Not Before: Oct  9 15:46:37 2015 GMT
+            Not After : Oct  9 15:46:37 2035 GMT
+        Subject: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=server/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:be:0c:c2:ab:db:2f:7f:ba:ff:65:4c:17:07:46:
+                    61:5e:56:85:8b:8f:d4:13:05:8b:be:9b:a2:d8:3a:
+                    68:b4:5f:c1:31:fa:27:4e:cd:15:8c:d5:9d:76:ca:
+                    ca:3d:4d:90:f4:16:51:4b:b2:50:12:0d:73:cc:b7:
+                    66:7c:87:39:ae:2a:20:38:80:bc:45:51:40:16:3f:
+                    1e:93:99:ad:4f:e9:6c:d7:1f:fe:be:36:2b:63:58:
+                    84:47:1a:c0:31:2f:9c:37:6d:9d:ba:10:c4:c2:4a:
+                    93:0a:d5:4e:70:00:46:13:6f:bd:1a:02:6a:11:06:
+                    69:3a:a8:ad:72:94:63:2d:c9:12:1a:1a:4b:e9:67:
+                    e9:64:8c:df:de:70:df:ac:7b:4a:1f:5a:3a:30:f7:
+                    19:51:04:73:8a:ce:7f:b1:cb:8c:ab:97:b8:15:b6:
+                    e1:5c:c1:9c:c7:91:cc:52:fe:c7:33:71:1a:b1:2a:
+                    99:c9:c4:ef:3e:dd:5d:eb:1e:5b:fc:f9:04:c2:0b:
+                    68:5e:69:24:8d:68:59:db:70:3e:b9:b8:75:69:d3:
+                    67:af:0b:b3:1d:d7:42:6c:08:24:5a:d9:18:18:b7:
+                    bb:f5:b6:f2:73:da:14:7b:3f:56:7d:79:df:da:09:
+                    1a:52:c1:2c:e1:f8:7c:5a:3b:fb:44:d2:f4:2d:43:
+                    13:d9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Server
+            Netscape Comment: 
+                Easy-RSA Generated Server Certificate
+            X509v3 Subject Key Identifier: 
+                6C:63:B8:00:5F:EA:CD:9C:61:19:41:5B:5A:56:AB:4A:A2:E1:C3:13
+            X509v3 Authority Key Identifier: 
+                keyid:35:9F:DB:0D:86:40:F9:65:0E:E3:45:79:CE:37:98:0D:28:57:95:59
+                DirName:/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+                serial:D5:C5:AB:CB:22:8D:D3:9B
+
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Key Encipherment
+            X509v3 Subject Alternative Name: 
+                DNS:server
+    Signature Algorithm: sha256WithRSAEncryption
+         92:dc:23:54:f7:13:0a:b8:0f:dd:89:fc:33:4a:98:1b:de:fa:
+         4e:2e:bb:6f:e1:37:ec:75:f9:6b:40:00:cb:3f:bd:d9:52:31:
+         df:2a:29:8a:4d:15:0a:87:73:15:31:1a:4b:d5:66:d1:a0:60:
+         11:13:0f:c3:36:62:89:ed:be:5b:8d:dd:3c:f9:15:4a:a4:0f:
+         d7:9f:09:5a:ce:aa:a4:be:8a:b4:99:09:d4:16:fb:6c:23:74:
+         b4:01:57:a5:2d:18:0d:f7:b8:87:ee:3e:e8:22:5d:10:85:a6:
+         4b:e6:18:4a:de:aa:5f:0b:4c:12:ea:f8:71:c8:dd:94:21:da:
+         c5:85:8e:0a:da:bc:bc:9c:5c:13:65:b5:36:71:04:da:d5:97:
+         46:b1:19:60:17:50:eb:eb:02:1b:fe:22:dc:cf:c8:7d:4c:61:
+         27:eb:f1:5b:c5:54:78:eb:64:b9:d5:6d:cd:2d:29:21:33:7e:
+         6a:29:60:25:a0:88:94:5e:0a:a6:ed:ac:d9:c1:b7:ff:9e:1b:
+         bc:e1:8f:aa:b1:a4:b7:a7:f6:d7:e8:9e:49:f4:22:9b:bd:10:
+         30:56:55:9a:d7:c7:6f:78:e6:04:5e:5c:2e:ae:3a:3b:4b:9e:
+         92:e1:09:46:42:8c:d4:7d:dc:72:87:0a:7f:5b:70:32:2c:a5:
+         f8:0d:27:af
+-----BEGIN CERTIFICATE-----
+MIIFmjCCBIKgAwIBAgIBATANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCREUx
+DzANBgNVBAgTBkhlc3NlbjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoT
+D0dBIEFsdGVuc2NobGlyZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAG
+A1UEAxMJVlBOLUdBLWNhMQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEW
+H2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNjaGxpcmYuZGUwHhcNMTUxMDA5MTU0NjM3
+WhcNMzUxMDA5MTU0NjM3WjCBuzELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczEPMA0GA1UEAxMGc2VydmVyMQ8w
+DQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEWH2l0QGdlbWVpbnNjaGFmdC1h
+bHRlbnNjaGxpcmYuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+
+DMKr2y9/uv9lTBcHRmFeVoWLj9QTBYu+m6LYOmi0X8Ex+idOzRWM1Z12yso9TZD0
+FlFLslASDXPMt2Z8hzmuKiA4gLxFUUAWPx6Tma1P6WzXH/6+NitjWIRHGsAxL5w3
+bZ26EMTCSpMK1U5wAEYTb70aAmoRBmk6qK1ylGMtyRIaGkvpZ+lkjN/ecN+se0of
+Wjow9xlRBHOKzn+xy4yrl7gVtuFcwZzHkcxS/sczcRqxKpnJxO8+3V3rHlv8+QTC
+C2heaSSNaFnbcD65uHVp02evC7Md10JsCCRa2RgYt7v1tvJz2hR7P1Z9ed/aCRpS
+wSzh+HxaO/tE0vQtQxPZAgMBAAGjggGiMIIBnjAJBgNVHRMEAjAAMBEGCWCGSAGG
++EIBAQQEAwIGQDA0BglghkgBhvhCAQ0EJxYlRWFzeS1SU0EgR2VuZXJhdGVkIFNl
+cnZlciBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUbGO4AF/qzZxhGUFbWlarSqLhwxMw
+gfMGA1UdIwSB6zCB6IAUNZ/bDYZA+WUO40V5zjeYDShXlVmhgcSkgcEwgb4xCzAJ
+BgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNzZW4xFDASBgNVBAcTC1N0b2NraGF1c2Vu
+MRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxpcmYxGTAXBgNVBAsTEE5ldHdvcmsgU2Vy
+dmljZXMxEjAQBgNVBAMTCVZQTi1HQS1jYTEPMA0GA1UEKRMGVlBOIEdBMS4wLAYJ
+KoZIhvcNAQkBFh9pdEBnZW1laW5zY2hhZnQtYWx0ZW5zY2hsaXJmLmRlggkA1cWr
+yyKN05swEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgWgMBEGA1UdEQQK
+MAiCBnNlcnZlcjANBgkqhkiG9w0BAQsFAAOCAQEAktwjVPcTCrgP3Yn8M0qYG976
+Ti67b+E37HX5a0AAyz+92VIx3yopik0VCodzFTEaS9Vm0aBgERMPwzZiie2+W43d
+PPkVSqQP158JWs6qpL6KtJkJ1Bb7bCN0tAFXpS0YDfe4h+4+6CJdEIWmS+YYSt6q
+XwtMEur4ccjdlCHaxYWOCtq8vJxcE2W1NnEE2tWXRrEZYBdQ6+sCG/4i3M/IfUxh
+J+vxW8VUeOtkudVtzS0pITN+ailgJaCIlF4Kpu2s2cG3/54bvOGPqrGkt6f21+ie
+SfQim70QMFZVmtfHb3jmBF5cLq46O0uekuEJRkKM1H3ccocKf1twMiyl+A0nrw==
+-----END CERTIFICATE-----
diff --git a/GA-Schloss/openvpn/keys/02.pem b/GA-Schloss/openvpn/keys/02.pem
new file mode 100644
index 0000000..a855db0
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/02.pem
@@ -0,0 +1,99 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Validity
+            Not Before: Oct  9 15:48:51 2015 GMT
+            Not After : Oct  9 15:48:51 2035 GMT
+        Subject: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=chris/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c2:55:cc:8d:85:d0:e6:9b:70:86:aa:59:b4:d3:
+                    a1:bd:0a:42:e8:42:4d:de:b7:4c:fc:c1:42:9c:dc:
+                    01:fd:6b:c8:5a:0f:3f:d9:29:6c:fe:4e:5c:77:9e:
+                    ad:42:ce:db:ea:55:e6:aa:c0:3b:81:90:a9:b7:0b:
+                    07:9a:0e:4e:c6:79:13:a3:f0:5e:c8:b2:b7:aa:49:
+                    16:f0:58:ed:04:fc:22:e3:e1:64:68:53:f2:ca:c0:
+                    98:24:00:83:5e:80:14:d4:02:83:21:85:e7:f4:77:
+                    a1:c7:a1:cc:3d:75:af:cd:c4:df:72:63:83:7b:f6:
+                    77:bd:4f:b5:ec:82:93:c4:c0:2f:ba:66:3b:9b:90:
+                    b9:ef:48:a7:43:77:88:32:8e:11:4c:e1:d5:91:e2:
+                    ee:fd:f6:6a:67:e9:cd:24:fb:34:70:92:4c:80:85:
+                    a5:41:34:db:22:f6:c5:18:82:30:60:53:e1:8c:84:
+                    a5:de:9d:41:5d:ac:db:d8:c1:f6:aa:84:72:ee:38:
+                    73:49:26:e3:9f:58:ff:b0:63:b6:79:92:6f:20:e2:
+                    d4:f0:96:96:8e:51:1d:bf:98:c5:38:48:c5:52:bd:
+                    dd:ae:1c:4c:c7:04:25:82:df:1d:a0:8d:05:d3:7a:
+                    31:db:46:a4:c6:1a:0c:91:e8:05:8a:d5:8b:35:02:
+                    b6:ed
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                Easy-RSA Generated Certificate
+            X509v3 Subject Key Identifier: 
+                A3:D8:CF:8D:23:44:DB:48:37:2E:C1:70:7F:80:39:59:B8:B6:42:F0
+            X509v3 Authority Key Identifier: 
+                keyid:35:9F:DB:0D:86:40:F9:65:0E:E3:45:79:CE:37:98:0D:28:57:95:59
+                DirName:/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+                serial:D5:C5:AB:CB:22:8D:D3:9B
+
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Alternative Name: 
+                DNS:chris
+    Signature Algorithm: sha256WithRSAEncryption
+         73:75:c5:a6:45:7d:6e:25:7d:d0:c2:1a:cc:09:aa:55:ce:1a:
+         a4:c6:b5:34:3e:72:a6:8e:92:25:20:19:3e:4c:5b:63:db:23:
+         cb:5d:d5:30:7e:81:17:98:ec:dc:97:d9:af:8e:2b:75:80:32:
+         17:bf:50:e7:e2:09:fc:f7:22:f3:91:24:55:47:34:f2:9d:92:
+         9e:79:ae:e0:ab:a4:4f:27:32:4a:81:57:f6:5c:63:6f:45:0f:
+         dc:c9:39:b9:3a:c0:3d:9b:80:24:b8:3a:12:3f:12:03:af:51:
+         f4:68:ef:05:01:b2:c9:b9:a9:3b:8b:e6:7f:cd:dd:eb:45:96:
+         98:94:d9:3c:f6:f7:a7:5d:6a:04:78:4b:d6:14:59:68:bf:9b:
+         06:95:b8:c9:6e:de:ea:69:69:dc:81:57:fa:ed:cb:fd:50:74:
+         8f:99:16:7f:78:b7:6a:42:65:cf:2f:6b:3a:d8:56:b1:88:13:
+         05:53:49:e5:cc:b9:73:5c:21:62:1c:c7:bd:6b:10:10:9b:00:
+         19:7a:a4:11:ad:a1:21:e4:71:d6:b6:0e:9e:50:72:6e:df:43:
+         7f:c8:42:94:66:1b:1c:a5:b0:07:d1:3b:85:7f:07:e8:65:b2:
+         74:ba:c2:04:e9:fb:3e:c7:d2:c7:74:4e:0d:bc:09:89:49:0b:
+         dc:c2:af:47
+-----BEGIN CERTIFICATE-----
+MIIFfjCCBGagAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCREUx
+DzANBgNVBAgTBkhlc3NlbjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoT
+D0dBIEFsdGVuc2NobGlyZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAG
+A1UEAxMJVlBOLUdBLWNhMQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEW
+H2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNjaGxpcmYuZGUwHhcNMTUxMDA5MTU0ODUx
+WhcNMzUxMDA5MTU0ODUxWjCBujELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczEOMAwGA1UEAxMFY2hyaXMxDzAN
+BgNVBCkTBlZQTiBHQTEuMCwGCSqGSIb3DQEJARYfaXRAZ2VtZWluc2NoYWZ0LWFs
+dGVuc2NobGlyZi5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMJV
+zI2F0OabcIaqWbTTob0KQuhCTd63TPzBQpzcAf1ryFoPP9kpbP5OXHeerULO2+pV
+5qrAO4GQqbcLB5oOTsZ5E6PwXsiyt6pJFvBY7QT8IuPhZGhT8srAmCQAg16AFNQC
+gyGF5/R3ocehzD11r83E33Jjg3v2d71PteyCk8TAL7pmO5uQue9Ip0N3iDKOEUzh
+1ZHi7v32amfpzST7NHCSTICFpUE02yL2xRiCMGBT4YyEpd6dQV2s29jB9qqEcu44
+c0km459Y/7BjtnmSbyDi1PCWlo5RHb+YxThIxVK93a4cTMcEJYLfHaCNBdN6MdtG
+pMYaDJHoBYrVizUCtu0CAwEAAaOCAYcwggGDMAkGA1UdEwQCMAAwLQYJYIZIAYb4
+QgENBCAWHkVhc3ktUlNBIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU
+o9jPjSNE20g3LsFwf4A5Wbi2QvAwgfMGA1UdIwSB6zCB6IAUNZ/bDYZA+WUO40V5
+zjeYDShXlVmhgcSkgcEwgb4xCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNzZW4x
+FDASBgNVBAcTC1N0b2NraGF1c2VuMRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxpcmYx
+GTAXBgNVBAsTEE5ldHdvcmsgU2VydmljZXMxEjAQBgNVBAMTCVZQTi1HQS1jYTEP
+MA0GA1UEKRMGVlBOIEdBMS4wLAYJKoZIhvcNAQkBFh9pdEBnZW1laW5zY2hhZnQt
+YWx0ZW5zY2hsaXJmLmRlggkA1cWryyKN05swEwYDVR0lBAwwCgYIKwYBBQUHAwIw
+CwYDVR0PBAQDAgeAMBAGA1UdEQQJMAeCBWNocmlzMA0GCSqGSIb3DQEBCwUAA4IB
+AQBzdcWmRX1uJX3QwhrMCapVzhqkxrU0PnKmjpIlIBk+TFtj2yPLXdUwfoEXmOzc
+l9mvjit1gDIXv1Dn4gn89yLzkSRVRzTynZKeea7gq6RPJzJKgVf2XGNvRQ/cyTm5
+OsA9m4AkuDoSPxIDr1H0aO8FAbLJuak7i+Z/zd3rRZaYlNk89venXWoEeEvWFFlo
+v5sGlbjJbt7qaWncgVf67cv9UHSPmRZ/eLdqQmXPL2s62FaxiBMFU0nlzLlzXCFi
+HMe9axAQmwAZeqQRraEh5HHWtg6eUHJu30N/yEKUZhscpbAH0TuFfwfoZbJ0usIE
+6fs+x9LHdE4NvAmJSQvcwq9H
+-----END CERTIFICATE-----
diff --git a/GA-Schloss/openvpn/keys/03.pem b/GA-Schloss/openvpn/keys/03.pem
new file mode 100644
index 0000000..4efaf5f
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/03.pem
@@ -0,0 +1,99 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 3 (0x3)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Validity
+            Not Before: Oct  9 15:54:15 2015 GMT
+            Not After : Oct  9 15:54:15 2035 GMT
+        Subject: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=wadmin/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b6:f8:b1:f2:dd:fd:65:5f:86:7e:3f:39:d0:f2:
+                    ca:b4:f5:64:ea:5a:79:9f:cc:14:7b:ed:7a:3f:be:
+                    8d:ba:6a:d6:89:92:1a:26:c4:11:4e:86:10:8c:71:
+                    d4:f9:d1:bd:d7:65:2f:56:81:1e:38:81:61:fd:62:
+                    f4:5b:3c:c8:34:9d:00:47:ee:16:a0:52:a9:ca:df:
+                    09:d0:94:c1:7d:cd:f7:a7:0c:7a:ce:d1:4a:c5:99:
+                    56:29:32:f9:b4:fb:d3:4a:36:1d:ff:b7:9f:50:c8:
+                    ca:2d:a0:31:77:8b:09:fa:15:08:fe:42:f4:3e:dd:
+                    98:cb:bb:19:d2:d0:57:50:a9:4d:93:dd:91:39:3e:
+                    4f:38:32:6d:b8:99:f9:ea:93:47:28:82:e9:75:f5:
+                    4b:c2:55:3b:65:ae:5d:f6:4c:d2:c6:9d:18:86:eb:
+                    4d:83:36:e4:ab:c1:66:cf:77:f7:0b:fa:3d:9b:1f:
+                    40:2b:28:01:c0:88:c7:bc:18:83:26:b7:41:5e:9e:
+                    8c:d2:fe:e9:39:d4:ec:2b:be:4d:7e:fd:a0:dc:04:
+                    b4:00:e4:ca:85:59:01:55:a8:d3:48:be:41:12:7c:
+                    8e:ee:79:8d:a7:89:ad:ab:71:a8:d0:d1:a9:ce:9f:
+                    7e:a4:2a:17:26:18:90:bf:13:d9:f1:a3:be:a6:b9:
+                    09:51
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                Easy-RSA Generated Certificate
+            X509v3 Subject Key Identifier: 
+                B9:71:69:E0:F6:17:0F:A6:D3:C4:AF:28:C6:A5:B1:E9:58:2F:6C:86
+            X509v3 Authority Key Identifier: 
+                keyid:35:9F:DB:0D:86:40:F9:65:0E:E3:45:79:CE:37:98:0D:28:57:95:59
+                DirName:/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+                serial:D5:C5:AB:CB:22:8D:D3:9B
+
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Alternative Name: 
+                DNS:wadmin
+    Signature Algorithm: sha256WithRSAEncryption
+         99:1d:d1:a2:eb:8c:d5:89:c3:1f:0a:8f:10:85:99:92:f6:58:
+         da:99:b3:d3:01:9a:b4:7c:b2:9b:61:9e:7f:dd:41:24:ec:75:
+         19:82:35:aa:2b:74:14:29:55:6c:74:08:d0:18:95:8f:b9:1e:
+         12:1e:80:78:58:b5:e0:b0:f5:08:17:d9:36:e9:42:a1:a6:cc:
+         7a:be:92:a7:f3:9b:6b:2f:d8:db:4b:50:ca:dd:f2:de:90:d9:
+         2a:2e:8d:81:76:7e:a0:2e:28:a0:3d:e6:fc:31:4b:d7:b4:6d:
+         7f:a0:f9:f1:6f:d8:ea:7d:a2:e0:a6:2e:db:52:96:2c:7a:b6:
+         10:5a:15:bb:07:34:88:5f:74:d2:6c:e6:7e:f1:7f:20:47:56:
+         be:78:be:1e:37:35:79:c1:a9:0d:bf:df:11:7d:09:97:c7:93:
+         9c:27:11:5b:b4:99:fe:fc:77:2b:39:52:7c:a7:d5:85:1c:71:
+         b9:4f:45:ce:48:bf:04:8e:25:87:3b:ad:55:54:ea:4c:2c:38:
+         8f:14:c2:49:d1:62:c4:d5:bc:4d:94:5f:4f:8f:bf:19:25:f0:
+         20:f9:2d:3c:ca:18:d2:7c:2f:f9:ca:a4:fd:3e:7a:67:74:d9:
+         fc:b6:74:e9:40:61:7d:5f:1e:97:a3:d4:2a:11:53:a5:e6:08:
+         b4:4c:56:bb
+-----BEGIN CERTIFICATE-----
+MIIFgDCCBGigAwIBAgIBAzANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCREUx
+DzANBgNVBAgTBkhlc3NlbjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoT
+D0dBIEFsdGVuc2NobGlyZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAG
+A1UEAxMJVlBOLUdBLWNhMQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEW
+H2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNjaGxpcmYuZGUwHhcNMTUxMDA5MTU1NDE1
+WhcNMzUxMDA5MTU1NDE1WjCBuzELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczEPMA0GA1UEAxMGd2FkbWluMQ8w
+DQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEWH2l0QGdlbWVpbnNjaGFmdC1h
+bHRlbnNjaGxpcmYuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2
++LHy3f1lX4Z+PznQ8sq09WTqWnmfzBR77Xo/vo26ataJkhomxBFOhhCMcdT50b3X
+ZS9WgR44gWH9YvRbPMg0nQBH7hagUqnK3wnQlMF9zfenDHrO0UrFmVYpMvm0+9NK
+Nh3/t59QyMotoDF3iwn6FQj+QvQ+3ZjLuxnS0FdQqU2T3ZE5Pk84Mm24mfnqk0co
+gul19UvCVTtlrl32TNLGnRiG602DNuSrwWbPd/cL+j2bH0ArKAHAiMe8GIMmt0Fe
+nozS/uk51Owrvk1+/aDcBLQA5MqFWQFVqNNIvkESfI7ueY2nia2rcajQ0anOn36k
+KhcmGJC/E9nxo76muQlRAgMBAAGjggGIMIIBhDAJBgNVHRMEAjAAMC0GCWCGSAGG
++EIBDQQgFh5FYXN5LVJTQSBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE
+FLlxaeD2Fw+m08SvKMalselYL2yGMIHzBgNVHSMEgeswgeiAFDWf2w2GQPllDuNF
+ec43mA0oV5VZoYHEpIHBMIG+MQswCQYDVQQGEwJERTEPMA0GA1UECBMGSGVzc2Vu
+MRQwEgYDVQQHEwtTdG9ja2hhdXNlbjEYMBYGA1UEChMPR0EgQWx0ZW5zY2hsaXJm
+MRkwFwYDVQQLExBOZXR3b3JrIFNlcnZpY2VzMRIwEAYDVQQDEwlWUE4tR0EtY2Ex
+DzANBgNVBCkTBlZQTiBHQTEuMCwGCSqGSIb3DQEJARYfaXRAZ2VtZWluc2NoYWZ0
+LWFsdGVuc2NobGlyZi5kZYIJANXFq8sijdObMBMGA1UdJQQMMAoGCCsGAQUFBwMC
+MAsGA1UdDwQEAwIHgDARBgNVHREECjAIggZ3YWRtaW4wDQYJKoZIhvcNAQELBQAD
+ggEBAJkd0aLrjNWJwx8KjxCFmZL2WNqZs9MBmrR8spthnn/dQSTsdRmCNaordBQp
+VWx0CNAYlY+5HhIegHhYteCw9QgX2TbpQqGmzHq+kqfzm2sv2NtLUMrd8t6Q2Sou
+jYF2fqAuKKA95vwxS9e0bX+g+fFv2Op9ouCmLttSlix6thBaFbsHNIhfdNJs5n7x
+fyBHVr54vh43NXnBqQ2/3xF9CZfHk5wnEVu0mf78dys5Unyn1YUccblPRc5IvwSO
+JYc7rVVU6kwsOI8UwknRYsTVvE2UX0+Pvxkl8CD5LTzKGNJ8L/nKpP0+emd02fy2
+dOlAYX1fHpej1CoRU6XmCLRMVrs=
+-----END CERTIFICATE-----
diff --git a/GA-Schloss/openvpn/keys/04.pem b/GA-Schloss/openvpn/keys/04.pem
new file mode 100644
index 0000000..28a35cd
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/04.pem
@@ -0,0 +1,99 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4 (0x4)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Validity
+            Not Before: Oct  9 16:07:53 2015 GMT
+            Not After : Oct  9 16:07:53 2035 GMT
+        Subject: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=gw-ckubu/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:ae:f7:e7:94:71:eb:8e:4b:16:f5:41:b5:00:33:
+                    54:da:9c:11:54:a3:e3:14:0f:f4:1d:e3:32:20:94:
+                    48:fd:46:d8:b2:76:12:3b:23:3c:a2:f2:e4:81:9a:
+                    e5:85:ab:c3:dd:38:c5:e0:ca:ee:af:11:12:f1:8f:
+                    78:3a:78:a5:3f:b9:ea:4e:8e:da:3e:e6:77:d5:ce:
+                    cb:56:3a:ca:bf:97:d6:a5:65:49:15:ce:e0:7b:5a:
+                    f9:c2:96:8a:70:18:be:3b:4f:20:bd:c5:b9:b5:46:
+                    07:f1:54:ad:76:56:47:f1:83:ee:7c:8a:9d:e9:42:
+                    23:a1:a7:b6:fb:76:c3:05:ad:dd:a8:fe:c8:fa:15:
+                    f4:9f:3a:30:dd:4d:c0:50:33:0b:19:f6:51:cb:9f:
+                    70:53:c7:7c:80:c5:69:7a:4c:bb:06:ec:46:e4:6e:
+                    77:18:77:7c:14:58:46:49:9a:ac:1f:a6:46:5f:f7:
+                    1c:71:33:a4:25:f4:82:92:96:56:fd:af:6b:c4:5a:
+                    0e:ef:d3:e6:68:36:c8:e8:8c:1c:75:12:f8:3e:34:
+                    2e:64:dd:a3:bc:b3:7e:2c:e8:56:55:5b:1a:b3:46:
+                    e4:06:d7:b3:f8:19:44:a3:0e:2d:92:0f:c8:64:76:
+                    af:e7:83:fb:62:a1:3a:91:56:fa:47:63:c2:c3:c5:
+                    7b:41
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                Easy-RSA Generated Certificate
+            X509v3 Subject Key Identifier: 
+                77:17:1E:55:4D:99:B1:B1:C4:AC:7D:4D:89:39:79:47:93:A3:F7:D9
+            X509v3 Authority Key Identifier: 
+                keyid:35:9F:DB:0D:86:40:F9:65:0E:E3:45:79:CE:37:98:0D:28:57:95:59
+                DirName:/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+                serial:D5:C5:AB:CB:22:8D:D3:9B
+
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Alternative Name: 
+                DNS:gw-ckubu
+    Signature Algorithm: sha256WithRSAEncryption
+         41:4d:2c:2d:3c:df:39:83:ed:10:3d:3f:17:bf:16:10:16:ff:
+         4f:79:db:44:15:d2:9f:e1:1e:49:5a:2b:12:23:48:72:bd:6f:
+         52:7f:75:5c:e1:b7:36:19:82:08:1b:60:c5:48:98:a9:da:55:
+         20:ca:f0:b7:c8:ea:8a:b5:3e:af:17:7d:8c:e0:d4:be:1a:09:
+         43:3b:27:17:59:ba:59:34:1f:6f:b6:3a:c3:be:9a:3f:5e:1b:
+         fc:75:2b:b0:13:d0:48:b2:82:45:fa:97:84:6c:fe:a5:20:d1:
+         a2:e9:6f:e9:eb:53:47:5a:63:b5:0a:5b:ed:67:24:71:6f:86:
+         27:a8:e9:88:12:bf:6c:dd:73:fb:32:6e:a7:b6:d5:fb:eb:dd:
+         23:c1:9a:1a:7b:fc:70:18:ec:b5:ed:e5:33:fd:c1:8b:06:ad:
+         ad:ee:de:e6:d6:b8:54:e0:4a:ef:1a:02:4e:3f:d3:ca:1e:48:
+         05:ad:88:e6:8c:77:81:5c:b6:c7:b1:f7:fe:4e:ad:74:6e:1c:
+         a2:0d:bd:21:b0:0a:19:8b:56:d5:88:6a:51:b5:f6:90:f9:e0:
+         b4:ad:79:c3:cb:f0:be:fe:79:be:4b:39:44:29:e8:82:d9:79:
+         93:3b:c7:5b:36:0a:0e:a8:44:e3:ed:df:e2:0d:de:1c:a2:9b:
+         dd:cd:96:30
+-----BEGIN CERTIFICATE-----
+MIIFhDCCBGygAwIBAgIBBDANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCREUx
+DzANBgNVBAgTBkhlc3NlbjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoT
+D0dBIEFsdGVuc2NobGlyZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAG
+A1UEAxMJVlBOLUdBLWNhMQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEW
+H2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNjaGxpcmYuZGUwHhcNMTUxMDA5MTYwNzUz
+WhcNMzUxMDA5MTYwNzUzWjCBvTELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczERMA8GA1UEAxMIZ3ctY2t1YnUx
+DzANBgNVBCkTBlZQTiBHQTEuMCwGCSqGSIb3DQEJARYfaXRAZ2VtZWluc2NoYWZ0
+LWFsdGVuc2NobGlyZi5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AK7355Rx645LFvVBtQAzVNqcEVSj4xQP9B3jMiCUSP1G2LJ2EjsjPKLy5IGa5YWr
+w904xeDK7q8REvGPeDp4pT+56k6O2j7md9XOy1Y6yr+X1qVlSRXO4Hta+cKWinAY
+vjtPIL3FubVGB/FUrXZWR/GD7nyKnelCI6Gntvt2wwWt3aj+yPoV9J86MN1NwFAz
+Cxn2UcufcFPHfIDFaXpMuwbsRuRudxh3fBRYRkmarB+mRl/3HHEzpCX0gpKWVv2v
+a8RaDu/T5mg2yOiMHHUS+D40LmTdo7yzfizoVlVbGrNG5AbXs/gZRKMOLZIPyGR2
+r+eD+2KhOpFW+kdjwsPFe0ECAwEAAaOCAYowggGGMAkGA1UdEwQCMAAwLQYJYIZI
+AYb4QgENBCAWHkVhc3ktUlNBIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E
+FgQUdxceVU2ZsbHErH1NiTl5R5Oj99kwgfMGA1UdIwSB6zCB6IAUNZ/bDYZA+WUO
+40V5zjeYDShXlVmhgcSkgcEwgb4xCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNz
+ZW4xFDASBgNVBAcTC1N0b2NraGF1c2VuMRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxp
+cmYxGTAXBgNVBAsTEE5ldHdvcmsgU2VydmljZXMxEjAQBgNVBAMTCVZQTi1HQS1j
+YTEPMA0GA1UEKRMGVlBOIEdBMS4wLAYJKoZIhvcNAQkBFh9pdEBnZW1laW5zY2hh
+ZnQtYWx0ZW5zY2hsaXJmLmRlggkA1cWryyKN05swEwYDVR0lBAwwCgYIKwYBBQUH
+AwIwCwYDVR0PBAQDAgeAMBMGA1UdEQQMMAqCCGd3LWNrdWJ1MA0GCSqGSIb3DQEB
+CwUAA4IBAQBBTSwtPN85g+0QPT8XvxYQFv9PedtEFdKf4R5JWisSI0hyvW9Sf3Vc
+4bc2GYIIG2DFSJip2lUgyvC3yOqKtT6vF32M4NS+GglDOycXWbpZNB9vtjrDvpo/
+Xhv8dSuwE9BIsoJF+peEbP6lINGi6W/p61NHWmO1ClvtZyRxb4YnqOmIEr9s3XP7
+Mm6nttX7690jwZoae/xwGOy17eUz/cGLBq2t7t7m1rhU4ErvGgJOP9PKHkgFrYjm
+jHeBXLbHsff+Tq10bhyiDb0hsAoZi1bViGpRtfaQ+eC0rXnDy/C+/nm+SzlEKeiC
+2XmTO8dbNgoOqETj7d/iDd4copvdzZYw
+-----END CERTIFICATE-----
diff --git a/GA-Schloss/openvpn/keys/05.pem b/GA-Schloss/openvpn/keys/05.pem
new file mode 100644
index 0000000..db7a79c
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/05.pem
@@ -0,0 +1,99 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 5 (0x5)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Validity
+            Not Before: Oct  9 16:27:27 2015 GMT
+            Not After : Oct  9 16:27:27 2035 GMT
+        Subject: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=gw-nh/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:be:07:2f:b4:84:d8:b2:81:07:71:2f:e2:03:49:
+                    36:37:7c:1e:c0:25:7d:56:ca:e8:cc:22:d3:8d:f3:
+                    04:87:7d:2b:7c:ad:e3:28:ce:69:45:d9:5e:c1:bd:
+                    eb:72:a5:66:b0:73:30:d0:62:c4:44:54:e1:16:cf:
+                    82:82:d4:c1:87:ae:ff:f2:c3:0a:c8:cc:cf:c3:9f:
+                    c0:b7:0f:32:38:61:53:76:3e:24:b9:0e:37:85:68:
+                    ff:1c:fd:d8:39:c0:f8:da:23:cf:3c:30:c1:3d:68:
+                    5c:6b:f6:31:04:7d:11:67:bd:de:33:ee:b5:8a:69:
+                    92:10:46:eb:1b:52:1f:7b:8f:e7:46:7a:9d:70:39:
+                    ce:cf:2f:26:1b:fb:f5:1b:2b:af:6b:c1:18:64:21:
+                    6e:3d:b0:de:28:e9:30:e2:3b:a5:fd:d5:c0:80:8e:
+                    4c:08:80:53:0a:04:93:6e:b8:e7:66:8d:f3:19:df:
+                    0d:8c:da:40:ce:3f:23:a7:8e:18:8e:9a:76:fb:2e:
+                    52:b3:da:14:da:69:c2:07:09:2a:db:70:37:1b:f5:
+                    fa:c5:31:3f:0e:d6:07:30:63:da:1c:0a:fb:2e:45:
+                    3c:58:6b:48:9b:fb:f1:50:70:7a:3a:3d:bd:a7:31:
+                    8b:04:22:97:27:ff:cd:20:2a:e6:58:7b:57:14:bf:
+                    7d:3b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                Easy-RSA Generated Certificate
+            X509v3 Subject Key Identifier: 
+                4A:3F:A6:14:BC:62:49:79:F5:0C:48:73:5C:C9:5A:1E:A0:36:BB:E8
+            X509v3 Authority Key Identifier: 
+                keyid:35:9F:DB:0D:86:40:F9:65:0E:E3:45:79:CE:37:98:0D:28:57:95:59
+                DirName:/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+                serial:D5:C5:AB:CB:22:8D:D3:9B
+
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Alternative Name: 
+                DNS:gw-nh
+    Signature Algorithm: sha256WithRSAEncryption
+         75:a5:dd:59:e4:3d:33:1c:ca:6f:8b:7f:97:cb:cf:4e:12:af:
+         cf:c7:7d:a8:f4:d4:95:38:30:e5:1b:ff:f5:20:0e:ef:b7:25:
+         75:c7:44:3e:9a:78:e4:fe:6d:9a:5b:a1:cc:6e:4d:7e:cb:a7:
+         c7:95:fa:7f:e7:c2:38:e1:9c:2e:79:7b:61:b0:d9:6e:2c:dd:
+         28:4e:31:d5:66:45:c8:74:06:fc:c9:4d:a8:96:25:04:a5:2f:
+         45:f1:64:13:50:41:e1:86:d7:4e:4e:38:69:d6:00:e4:24:d6:
+         65:38:17:50:ee:d5:d8:f8:bd:80:07:e2:d1:b4:ed:d9:d3:a5:
+         a4:ba:37:50:6e:bb:48:30:9e:e7:93:1d:2e:89:da:b6:b0:04:
+         f6:1b:48:38:e2:66:3a:c0:82:e0:a2:00:60:cb:05:93:13:85:
+         cc:aa:e1:a1:c7:a3:7f:d9:96:46:e9:d8:da:c8:0d:c9:da:19:
+         12:98:56:46:ff:9f:ae:ec:82:fb:df:67:ae:72:63:68:76:e0:
+         d3:00:2c:8c:ee:26:c8:31:ad:b7:c7:44:4d:00:6d:c9:dc:e3:
+         73:74:9f:24:be:5a:1c:9f:5d:3f:34:ce:b5:af:8b:00:63:0f:
+         26:d2:42:2a:7e:13:f6:2c:33:6c:8c:0d:e7:3b:87:aa:f7:ec:
+         fa:da:2c:d4
+-----BEGIN CERTIFICATE-----
+MIIFfjCCBGagAwIBAgIBBTANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCREUx
+DzANBgNVBAgTBkhlc3NlbjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoT
+D0dBIEFsdGVuc2NobGlyZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAG
+A1UEAxMJVlBOLUdBLWNhMQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEW
+H2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNjaGxpcmYuZGUwHhcNMTUxMDA5MTYyNzI3
+WhcNMzUxMDA5MTYyNzI3WjCBujELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczEOMAwGA1UEAxMFZ3ctbmgxDzAN
+BgNVBCkTBlZQTiBHQTEuMCwGCSqGSIb3DQEJARYfaXRAZ2VtZWluc2NoYWZ0LWFs
+dGVuc2NobGlyZi5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL4H
+L7SE2LKBB3Ev4gNJNjd8HsAlfVbK6Mwi043zBId9K3yt4yjOaUXZXsG963KlZrBz
+MNBixERU4RbPgoLUwYeu//LDCsjMz8OfwLcPMjhhU3Y+JLkON4Vo/xz92DnA+Noj
+zzwwwT1oXGv2MQR9EWe93jPutYppkhBG6xtSH3uP50Z6nXA5zs8vJhv79Rsrr2vB
+GGQhbj2w3ijpMOI7pf3VwICOTAiAUwoEk26452aN8xnfDYzaQM4/I6eOGI6advsu
+UrPaFNppwgcJKttwNxv1+sUxPw7WBzBj2hwK+y5FPFhrSJv78VBwejo9vacxiwQi
+lyf/zSAq5lh7VxS/fTsCAwEAAaOCAYcwggGDMAkGA1UdEwQCMAAwLQYJYIZIAYb4
+QgENBCAWHkVhc3ktUlNBIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU
+Sj+mFLxiSXn1DEhzXMlaHqA2u+gwgfMGA1UdIwSB6zCB6IAUNZ/bDYZA+WUO40V5
+zjeYDShXlVmhgcSkgcEwgb4xCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNzZW4x
+FDASBgNVBAcTC1N0b2NraGF1c2VuMRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxpcmYx
+GTAXBgNVBAsTEE5ldHdvcmsgU2VydmljZXMxEjAQBgNVBAMTCVZQTi1HQS1jYTEP
+MA0GA1UEKRMGVlBOIEdBMS4wLAYJKoZIhvcNAQkBFh9pdEBnZW1laW5zY2hhZnQt
+YWx0ZW5zY2hsaXJmLmRlggkA1cWryyKN05swEwYDVR0lBAwwCgYIKwYBBQUHAwIw
+CwYDVR0PBAQDAgeAMBAGA1UdEQQJMAeCBWd3LW5oMA0GCSqGSIb3DQEBCwUAA4IB
+AQB1pd1Z5D0zHMpvi3+Xy89OEq/Px32o9NSVODDlG//1IA7vtyV1x0Q+mnjk/m2a
+W6HMbk1+y6fHlfp/58I44ZwueXthsNluLN0oTjHVZkXIdAb8yU2oliUEpS9F8WQT
+UEHhhtdOTjhp1gDkJNZlOBdQ7tXY+L2AB+LRtO3Z06WkujdQbrtIMJ7nkx0uidq2
+sAT2G0g44mY6wILgogBgywWTE4XMquGhx6N/2ZZG6djayA3J2hkSmFZG/5+u7IL7
+32eucmNoduDTACyM7ibIMa23x0RNAG3J3ONzdJ8kvlocn10/NM61r4sAYw8m0kIq
+fhP2LDNsjA3nO4eq9+z62izU
+-----END CERTIFICATE-----
diff --git a/GA-Schloss/openvpn/keys/06.pem b/GA-Schloss/openvpn/keys/06.pem
new file mode 100644
index 0000000..699f2f1
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/06.pem
@@ -0,0 +1,99 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 6 (0x6)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Validity
+            Not Before: Nov 26 19:57:11 2015 GMT
+            Not After : Nov 26 19:57:11 2035 GMT
+        Subject: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=madmin/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d9:35:1c:5e:da:a9:31:86:bb:22:31:76:a9:51:
+                    18:4a:ed:5a:9e:e8:fd:16:85:32:a8:0b:91:87:e3:
+                    92:12:12:a7:06:da:c5:c9:48:9b:fa:94:81:36:63:
+                    d3:11:25:0b:3d:3d:fc:94:3b:e3:91:1a:e1:cf:d0:
+                    53:88:0e:9e:79:5d:6e:18:6d:a0:71:8e:ec:f3:3e:
+                    50:08:4d:73:7c:23:d0:af:ff:ae:c1:ad:5b:99:cd:
+                    bf:f2:04:43:09:79:83:f2:ac:10:0e:0c:0d:ec:b6:
+                    81:f9:65:75:3c:ea:c2:52:2a:32:1b:a8:d1:af:c7:
+                    85:66:a7:73:af:14:dd:95:41:a0:ed:52:79:44:ce:
+                    b7:0b:3e:19:80:ef:71:b2:15:6e:7a:96:0f:10:2f:
+                    50:8a:f8:90:f6:8f:6a:fe:b5:21:ef:78:95:0e:94:
+                    2f:aa:f7:16:b4:73:f2:62:32:8a:8c:c7:e6:d5:bf:
+                    fc:78:e1:fc:43:d4:d0:93:08:26:8e:f6:a8:31:2b:
+                    4f:6e:cd:88:ae:14:e7:0d:c5:ec:49:09:7a:16:6e:
+                    10:d5:83:04:a3:e3:1f:b0:c4:1e:55:65:10:60:5a:
+                    c8:72:e0:9b:c6:b4:26:39:5d:69:55:0e:de:5c:75:
+                    f9:ea:2f:be:9e:61:b1:59:f4:b0:47:03:a4:43:99:
+                    c1:99
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                Easy-RSA Generated Certificate
+            X509v3 Subject Key Identifier: 
+                E9:A6:ED:67:0C:62:23:7A:B3:23:F4:D7:93:5B:63:76:C9:4A:94:A7
+            X509v3 Authority Key Identifier: 
+                keyid:35:9F:DB:0D:86:40:F9:65:0E:E3:45:79:CE:37:98:0D:28:57:95:59
+                DirName:/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+                serial:D5:C5:AB:CB:22:8D:D3:9B
+
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Alternative Name: 
+                DNS:madmin
+    Signature Algorithm: sha256WithRSAEncryption
+         1b:67:ed:5b:7b:f6:b5:bf:83:3b:7e:22:4f:0c:82:c2:07:94:
+         2a:78:50:f8:85:a5:8f:83:d7:88:8c:99:fe:8a:2d:00:9c:93:
+         f6:9a:96:67:ca:ed:4d:81:06:4a:c3:5f:85:5c:b6:31:c4:5c:
+         78:28:fd:72:07:72:5b:84:ac:6e:58:b6:98:57:04:cd:5d:d5:
+         f1:36:f7:39:d2:79:bf:b8:66:48:25:e5:37:27:77:af:0f:e2:
+         0c:9d:53:e3:eb:1f:62:a2:ea:17:16:6e:75:25:28:c0:d3:b0:
+         fd:8d:79:b8:9a:1a:1e:c0:7f:b7:d6:70:ce:b0:6a:8e:30:2b:
+         a5:c8:70:bd:a5:df:f7:b8:a3:8a:b7:96:da:b0:6a:03:a3:31:
+         02:cf:7d:1d:49:39:88:26:dc:39:f3:2c:f9:c5:4a:13:f8:28:
+         d0:a0:1f:59:2d:ea:62:22:ef:cd:6d:95:c8:a9:11:55:da:30:
+         da:38:d5:92:d5:94:60:12:9e:a8:d9:cb:3e:c6:90:21:04:a3:
+         97:b7:5a:1f:77:d5:4f:95:ab:4f:b6:3d:bc:6a:6c:5c:1e:5e:
+         16:9b:28:2e:1c:6a:20:64:8d:f3:42:e5:b0:a4:0d:59:b5:5d:
+         e8:4f:31:04:78:1c:86:f9:8d:38:0c:28:ab:94:c1:bd:bd:be:
+         84:f4:2d:d6
+-----BEGIN CERTIFICATE-----
+MIIFgDCCBGigAwIBAgIBBjANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCREUx
+DzANBgNVBAgTBkhlc3NlbjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoT
+D0dBIEFsdGVuc2NobGlyZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAG
+A1UEAxMJVlBOLUdBLWNhMQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEW
+H2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNjaGxpcmYuZGUwHhcNMTUxMTI2MTk1NzEx
+WhcNMzUxMTI2MTk1NzExWjCBuzELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczEPMA0GA1UEAxMGbWFkbWluMQ8w
+DQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEWH2l0QGdlbWVpbnNjaGFmdC1h
+bHRlbnNjaGxpcmYuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ
+NRxe2qkxhrsiMXapURhK7Vqe6P0WhTKoC5GH45ISEqcG2sXJSJv6lIE2Y9MRJQs9
+PfyUO+ORGuHP0FOIDp55XW4YbaBxjuzzPlAITXN8I9Cv/67BrVuZzb/yBEMJeYPy
+rBAODA3stoH5ZXU86sJSKjIbqNGvx4Vmp3OvFN2VQaDtUnlEzrcLPhmA73GyFW56
+lg8QL1CK+JD2j2r+tSHveJUOlC+q9xa0c/JiMoqMx+bVv/x44fxD1NCTCCaO9qgx
+K09uzYiuFOcNxexJCXoWbhDVgwSj4x+wxB5VZRBgWshy4JvGtCY5XWlVDt5cdfnq
+L76eYbFZ9LBHA6RDmcGZAgMBAAGjggGIMIIBhDAJBgNVHRMEAjAAMC0GCWCGSAGG
++EIBDQQgFh5FYXN5LVJTQSBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE
+FOmm7WcMYiN6syP015NbY3bJSpSnMIHzBgNVHSMEgeswgeiAFDWf2w2GQPllDuNF
+ec43mA0oV5VZoYHEpIHBMIG+MQswCQYDVQQGEwJERTEPMA0GA1UECBMGSGVzc2Vu
+MRQwEgYDVQQHEwtTdG9ja2hhdXNlbjEYMBYGA1UEChMPR0EgQWx0ZW5zY2hsaXJm
+MRkwFwYDVQQLExBOZXR3b3JrIFNlcnZpY2VzMRIwEAYDVQQDEwlWUE4tR0EtY2Ex
+DzANBgNVBCkTBlZQTiBHQTEuMCwGCSqGSIb3DQEJARYfaXRAZ2VtZWluc2NoYWZ0
+LWFsdGVuc2NobGlyZi5kZYIJANXFq8sijdObMBMGA1UdJQQMMAoGCCsGAQUFBwMC
+MAsGA1UdDwQEAwIHgDARBgNVHREECjAIggZtYWRtaW4wDQYJKoZIhvcNAQELBQAD
+ggEBABtn7Vt79rW/gzt+Ik8MgsIHlCp4UPiFpY+D14iMmf6KLQCck/aalmfK7U2B
+BkrDX4VctjHEXHgo/XIHcluErG5YtphXBM1d1fE29znSeb+4Zkgl5Tcnd68P4gyd
+U+PrH2Ki6hcWbnUlKMDTsP2NebiaGh7Af7fWcM6wao4wK6XIcL2l3/e4o4q3ltqw
+agOjMQLPfR1JOYgm3DnzLPnFShP4KNCgH1kt6mIi781tlcipEVXaMNo41ZLVlGAS
+nqjZyz7GkCEEo5e3Wh931U+Vq0+2PbxqbFweXhabKC4caiBkjfNC5bCkDVm1XehP
+MQR4HIb5jTgMKKuUwb29voT0LdY=
+-----END CERTIFICATE-----
diff --git a/GA-Schloss/openvpn/keys/ca.crt b/GA-Schloss/openvpn/keys/ca.crt
new file mode 100644
index 0000000..1530382
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/ca.crt
@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFKjCCBBKgAwIBAgIJANXFq8sijdObMA0GCSqGSIb3DQEBCwUAMIG+MQswCQYD
+VQQGEwJERTEPMA0GA1UECBMGSGVzc2VuMRQwEgYDVQQHEwtTdG9ja2hhdXNlbjEY
+MBYGA1UEChMPR0EgQWx0ZW5zY2hsaXJmMRkwFwYDVQQLExBOZXR3b3JrIFNlcnZp
+Y2VzMRIwEAYDVQQDEwlWUE4tR0EtY2ExDzANBgNVBCkTBlZQTiBHQTEuMCwGCSqG
+SIb3DQEJARYfaXRAZ2VtZWluc2NoYWZ0LWFsdGVuc2NobGlyZi5kZTAeFw0xNTEw
+MDkxNTQwMzBaFw00NTEwMDgxNTQwMzBaMIG+MQswCQYDVQQGEwJERTEPMA0GA1UE
+CBMGSGVzc2VuMRQwEgYDVQQHEwtTdG9ja2hhdXNlbjEYMBYGA1UEChMPR0EgQWx0
+ZW5zY2hsaXJmMRkwFwYDVQQLExBOZXR3b3JrIFNlcnZpY2VzMRIwEAYDVQQDEwlW
+UE4tR0EtY2ExDzANBgNVBCkTBlZQTiBHQTEuMCwGCSqGSIb3DQEJARYfaXRAZ2Vt
+ZWluc2NoYWZ0LWFsdGVuc2NobGlyZi5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAKLTHSHgX6/Ibr3AlmJfQ3k3yTvaD031Ps3c+bsXgOQEPNO4x7er
+8R47osA7FHNKI8ob7jnX/xJSJcsE2B1zsYpceW7IN/Mmmz0eZyIr7B0tu2dFixxC
+t4Vi4dBTh8ZvEaTZ3YUzROBc/YnWFyq3NFZ0DLdJBX+lFXAYg7qVyD7RCB1Yrwxq
+rJFYK28qeIi4WHfHQICZ1dBlf7qpnL76MjfzjjiTTs4MZwjYRT2RJaPOhnNzPaeF
+c11kP8T+ER46TqYbmBuImpoOntca002opJxw9iXoYJRLYYfhs4XS654iApGbG0vc
+2Kd7uH+QyWElW19EDmeDRJM6Bc0LUu1rKtkCAwEAAaOCAScwggEjMB0GA1UdDgQW
+BBQ1n9sNhkD5ZQ7jRXnON5gNKFeVWTCB8wYDVR0jBIHrMIHogBQ1n9sNhkD5ZQ7j
+RXnON5gNKFeVWaGBxKSBwTCBvjELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAGA1UEAxMJVlBOLUdBLWNh
+MQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEWH2l0QGdlbWVpbnNjaGFm
+dC1hbHRlbnNjaGxpcmYuZGWCCQDVxavLIo3TmzAMBgNVHRMEBTADAQH/MA0GCSqG
+SIb3DQEBCwUAA4IBAQCXp1hi923vehUa/Gd9Ze9UobRo0kPCLxgQkPOotUPAX+Dp
+BDJOIHzoijORN4LmtQV+UNbRGsGU+Mwbejx1b4NHrFtj6KaCbCdB3bumcSmfFbaJ
+QM+qvMtQYXx1NnFnoV6PYD9ZjfsY0AaVi5FB/eHnP5xuGzmbq7gPgG5sz2RO5jcR
+1jO26hbrOINfYplu/NNQqBfRJPwyPFjHcCD/wWE63fnue3A5Oj6jUcuNLbOAHJEy
+Pu37BPHNzjnTUdOe9scXp3WMCJXOtdxoZkfHfGKXYhz//XwX6X/hJMzOZ2K+kUHC
+NfKwQ6snmDzycXtx0EqsYjzGgxbOR0qJbK/pJhii
+-----END CERTIFICATE-----
diff --git a/GA-Schloss/openvpn/keys/ca.key b/GA-Schloss/openvpn/keys/ca.key
new file mode 100644
index 0000000..5a85ad6
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/ca.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCi0x0h4F+vyG69
+wJZiX0N5N8k72g9N9T7N3Pm7F4DkBDzTuMe3q/EeO6LAOxRzSiPKG+451/8SUiXL
+BNgdc7GKXHluyDfzJps9HmciK+wdLbtnRYscQreFYuHQU4fGbxGk2d2FM0TgXP2J
+1hcqtzRWdAy3SQV/pRVwGIO6lcg+0QgdWK8MaqyRWCtvKniIuFh3x0CAmdXQZX+6
+qZy++jI38444k07ODGcI2EU9kSWjzoZzcz2nhXNdZD/E/hEeOk6mG5gbiJqaDp7X
+GtNNqKSccPYl6GCUS2GH4bOF0uueIgKRmxtL3Nine7h/kMlhJVtfRA5ng0STOgXN
+C1LtayrZAgMBAAECggEAXi+szGnUMATLOmxrEWB10WrZtwt+iuPwfnjy5KzF3CAv
+Z3Gd5btKcOiiTnxeagpbBZB+j2tImzp1riiRMwg3jQfNHq4m3zpX1lT956BsprxL
+iYOK4sAdFMWMRkvrYHfjRu7X2zM7BmYEK3VyVT1AwznCGUveKGZALmWf3ZDDEsI/
+saDKiIfMPL5E/4oYLW52Y5W/u7elkp6iTbRAFUatm/a3HsKIMmlk/BVfdWePgAU9
+/jYM0IN2ujG+d5zGE0EH46a4+tBHV6ciuDv7eMz/ok9DeLRcZp+AEFXs5RoNYTLV
+mbfLGOn1wLKneRC9sPETfLiyDg6Jt+eGefL0vr7lmQKBgQDMWXWNy2YzLLw4CFag
+UR/5jNiLlfRSinku4N/1fxpA3wNdF/YPZirlGmM5XsWxRxzaiFBZUPh2ScE4FjeF
+68Lv3haswxVJ9Bxi9NxXoLaW1MYocbsqIWg4ewXbvmdPpwtGUdxEhq6IvWSLoUAd
+Z9nCD0W0zCY8Q36b3CH5QZl2YwKBgQDL+sVgNV+UCTn0k/TChEoiNZq4M7rbRjgF
+utshj2ClVUoebPNd7Bc1zbQbgS4YBtHo1TB1Td1dr2GMz/264q5KQviA2z6PklUv
+/VF150KEhsenMwlZAM48RRiw7gNehPpawuczrzogCElVjKUXMo3eSYzUYcH5sgEk
+G1YwE2IQkwKBgQCMxZfYrWTjHg8vXncmi5xGUkOerReZgPEIXTuLKBsS007C483L
+P+uO1gXCsMnpXP7AgKUxUjlHa3mixJNNO2OX0Fu4ec+BmZuwg9QCvaDq+PrlQ6vW
+0xqzxfP8NAeBdKass5nUzx8O7cGE+vlrCG6XY+P2L6irXSesARKaXhl01wKBgQCy
+rOy91KLvapGQsxXgWb8SbkAkAHQ6ZSznoAEZSZ2P1cECG8+mQwslvxV4TlTRCRBQ
+UoaLCnTQ/rKFhR+t16hyNm21edc4LidezRfRHoz+x40V4bfbdcAxvRjeyu66meMv
+I7EgbeqNapTKUlO+mTL6NxUcaLFghtNHDIcXv7LT7wKBgAY6qGB42RFmlZBhCzBO
+FAjLF3oxyf32bcAPLx7bHFQFyZcnuEOVK9ZVThSIkW9uidrd+QJ1mixBIw8HVbI+
+7TVX9KnFXx8FIlqTS+foKaOUmeazrB3bTF/xeQhvKFveRZnpgWvxur6Jueh/9D3p
+iGGxP0SeYuAWBX6AjMcFZ2OK
+-----END PRIVATE KEY-----
diff --git a/GA-Schloss/openvpn/keys/chris.crt b/GA-Schloss/openvpn/keys/chris.crt
new file mode 100644
index 0000000..a855db0
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/chris.crt
@@ -0,0 +1,99 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Validity
+            Not Before: Oct  9 15:48:51 2015 GMT
+            Not After : Oct  9 15:48:51 2035 GMT
+        Subject: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=chris/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c2:55:cc:8d:85:d0:e6:9b:70:86:aa:59:b4:d3:
+                    a1:bd:0a:42:e8:42:4d:de:b7:4c:fc:c1:42:9c:dc:
+                    01:fd:6b:c8:5a:0f:3f:d9:29:6c:fe:4e:5c:77:9e:
+                    ad:42:ce:db:ea:55:e6:aa:c0:3b:81:90:a9:b7:0b:
+                    07:9a:0e:4e:c6:79:13:a3:f0:5e:c8:b2:b7:aa:49:
+                    16:f0:58:ed:04:fc:22:e3:e1:64:68:53:f2:ca:c0:
+                    98:24:00:83:5e:80:14:d4:02:83:21:85:e7:f4:77:
+                    a1:c7:a1:cc:3d:75:af:cd:c4:df:72:63:83:7b:f6:
+                    77:bd:4f:b5:ec:82:93:c4:c0:2f:ba:66:3b:9b:90:
+                    b9:ef:48:a7:43:77:88:32:8e:11:4c:e1:d5:91:e2:
+                    ee:fd:f6:6a:67:e9:cd:24:fb:34:70:92:4c:80:85:
+                    a5:41:34:db:22:f6:c5:18:82:30:60:53:e1:8c:84:
+                    a5:de:9d:41:5d:ac:db:d8:c1:f6:aa:84:72:ee:38:
+                    73:49:26:e3:9f:58:ff:b0:63:b6:79:92:6f:20:e2:
+                    d4:f0:96:96:8e:51:1d:bf:98:c5:38:48:c5:52:bd:
+                    dd:ae:1c:4c:c7:04:25:82:df:1d:a0:8d:05:d3:7a:
+                    31:db:46:a4:c6:1a:0c:91:e8:05:8a:d5:8b:35:02:
+                    b6:ed
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                Easy-RSA Generated Certificate
+            X509v3 Subject Key Identifier: 
+                A3:D8:CF:8D:23:44:DB:48:37:2E:C1:70:7F:80:39:59:B8:B6:42:F0
+            X509v3 Authority Key Identifier: 
+                keyid:35:9F:DB:0D:86:40:F9:65:0E:E3:45:79:CE:37:98:0D:28:57:95:59
+                DirName:/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+                serial:D5:C5:AB:CB:22:8D:D3:9B
+
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Alternative Name: 
+                DNS:chris
+    Signature Algorithm: sha256WithRSAEncryption
+         73:75:c5:a6:45:7d:6e:25:7d:d0:c2:1a:cc:09:aa:55:ce:1a:
+         a4:c6:b5:34:3e:72:a6:8e:92:25:20:19:3e:4c:5b:63:db:23:
+         cb:5d:d5:30:7e:81:17:98:ec:dc:97:d9:af:8e:2b:75:80:32:
+         17:bf:50:e7:e2:09:fc:f7:22:f3:91:24:55:47:34:f2:9d:92:
+         9e:79:ae:e0:ab:a4:4f:27:32:4a:81:57:f6:5c:63:6f:45:0f:
+         dc:c9:39:b9:3a:c0:3d:9b:80:24:b8:3a:12:3f:12:03:af:51:
+         f4:68:ef:05:01:b2:c9:b9:a9:3b:8b:e6:7f:cd:dd:eb:45:96:
+         98:94:d9:3c:f6:f7:a7:5d:6a:04:78:4b:d6:14:59:68:bf:9b:
+         06:95:b8:c9:6e:de:ea:69:69:dc:81:57:fa:ed:cb:fd:50:74:
+         8f:99:16:7f:78:b7:6a:42:65:cf:2f:6b:3a:d8:56:b1:88:13:
+         05:53:49:e5:cc:b9:73:5c:21:62:1c:c7:bd:6b:10:10:9b:00:
+         19:7a:a4:11:ad:a1:21:e4:71:d6:b6:0e:9e:50:72:6e:df:43:
+         7f:c8:42:94:66:1b:1c:a5:b0:07:d1:3b:85:7f:07:e8:65:b2:
+         74:ba:c2:04:e9:fb:3e:c7:d2:c7:74:4e:0d:bc:09:89:49:0b:
+         dc:c2:af:47
+-----BEGIN CERTIFICATE-----
+MIIFfjCCBGagAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCREUx
+DzANBgNVBAgTBkhlc3NlbjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoT
+D0dBIEFsdGVuc2NobGlyZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAG
+A1UEAxMJVlBOLUdBLWNhMQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEW
+H2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNjaGxpcmYuZGUwHhcNMTUxMDA5MTU0ODUx
+WhcNMzUxMDA5MTU0ODUxWjCBujELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczEOMAwGA1UEAxMFY2hyaXMxDzAN
+BgNVBCkTBlZQTiBHQTEuMCwGCSqGSIb3DQEJARYfaXRAZ2VtZWluc2NoYWZ0LWFs
+dGVuc2NobGlyZi5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMJV
+zI2F0OabcIaqWbTTob0KQuhCTd63TPzBQpzcAf1ryFoPP9kpbP5OXHeerULO2+pV
+5qrAO4GQqbcLB5oOTsZ5E6PwXsiyt6pJFvBY7QT8IuPhZGhT8srAmCQAg16AFNQC
+gyGF5/R3ocehzD11r83E33Jjg3v2d71PteyCk8TAL7pmO5uQue9Ip0N3iDKOEUzh
+1ZHi7v32amfpzST7NHCSTICFpUE02yL2xRiCMGBT4YyEpd6dQV2s29jB9qqEcu44
+c0km459Y/7BjtnmSbyDi1PCWlo5RHb+YxThIxVK93a4cTMcEJYLfHaCNBdN6MdtG
+pMYaDJHoBYrVizUCtu0CAwEAAaOCAYcwggGDMAkGA1UdEwQCMAAwLQYJYIZIAYb4
+QgENBCAWHkVhc3ktUlNBIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU
+o9jPjSNE20g3LsFwf4A5Wbi2QvAwgfMGA1UdIwSB6zCB6IAUNZ/bDYZA+WUO40V5
+zjeYDShXlVmhgcSkgcEwgb4xCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNzZW4x
+FDASBgNVBAcTC1N0b2NraGF1c2VuMRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxpcmYx
+GTAXBgNVBAsTEE5ldHdvcmsgU2VydmljZXMxEjAQBgNVBAMTCVZQTi1HQS1jYTEP
+MA0GA1UEKRMGVlBOIEdBMS4wLAYJKoZIhvcNAQkBFh9pdEBnZW1laW5zY2hhZnQt
+YWx0ZW5zY2hsaXJmLmRlggkA1cWryyKN05swEwYDVR0lBAwwCgYIKwYBBQUHAwIw
+CwYDVR0PBAQDAgeAMBAGA1UdEQQJMAeCBWNocmlzMA0GCSqGSIb3DQEBCwUAA4IB
+AQBzdcWmRX1uJX3QwhrMCapVzhqkxrU0PnKmjpIlIBk+TFtj2yPLXdUwfoEXmOzc
+l9mvjit1gDIXv1Dn4gn89yLzkSRVRzTynZKeea7gq6RPJzJKgVf2XGNvRQ/cyTm5
+OsA9m4AkuDoSPxIDr1H0aO8FAbLJuak7i+Z/zd3rRZaYlNk89venXWoEeEvWFFlo
+v5sGlbjJbt7qaWncgVf67cv9UHSPmRZ/eLdqQmXPL2s62FaxiBMFU0nlzLlzXCFi
+HMe9axAQmwAZeqQRraEh5HHWtg6eUHJu30N/yEKUZhscpbAH0TuFfwfoZbJ0usIE
+6fs+x9LHdE4NvAmJSQvcwq9H
+-----END CERTIFICATE-----
diff --git a/GA-Schloss/openvpn/keys/chris.csr b/GA-Schloss/openvpn/keys/chris.csr
new file mode 100644
index 0000000..f5b80c4
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/chris.csr
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIDADCCAegCAQAwgboxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNzZW4xFDAS
+BgNVBAcTC1N0b2NraGF1c2VuMRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxpcmYxGTAX
+BgNVBAsTEE5ldHdvcmsgU2VydmljZXMxDjAMBgNVBAMTBWNocmlzMQ8wDQYDVQQp
+EwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEWH2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNj
+aGxpcmYuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDCVcyNhdDm
+m3CGqlm006G9CkLoQk3et0z8wUKc3AH9a8haDz/ZKWz+Tlx3nq1CztvqVeaqwDuB
+kKm3CweaDk7GeROj8F7IsreqSRbwWO0E/CLj4WRoU/LKwJgkAINegBTUAoMhhef0
+d6HHocw9da/NxN9yY4N79ne9T7XsgpPEwC+6ZjubkLnvSKdDd4gyjhFM4dWR4u79
+9mpn6c0k+zRwkkyAhaVBNNsi9sUYgjBgU+GMhKXenUFdrNvYwfaqhHLuOHNJJuOf
+WP+wY7Z5km8g4tTwlpaOUR2/mMU4SMVSvd2uHEzHBCWC3x2gjQXTejHbRqTGGgyR
+6AWK1Ys1ArbtAgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEALQQyO03pfqcxjaL6
+bti4kEDOqIfTtFvfEYGEl+PIRfdAbBvwCC8678FjW3UmZfIVd6RAWPjaecpb0eBL
+XSOmINJ2kPAMX1nuSUO54GlTfqhbjjpM4moyU9izd5rEg7sjH8M/HhRQcMtI7hWo
+kfiuRrthvnTb1rJBPrpVGpY/RvtNMszDj4RW8DibdJ6P7WpSsapT2DgmjZRsLOcA
+ibdd0fwUkD/qDsAaufPA64CEXCy+RM4fRbIVuqLzn2tbeRFlgZQHCrDtE6SMZatQ
+L+Mlh5WmkRTvPXdoFG1puWUqIBexEucDq4/WzVLqyOdMFvnVZe/aLsBSl4Wpl6yK
+pXsrWw==
+-----END CERTIFICATE REQUEST-----
diff --git a/GA-Schloss/openvpn/keys/chris.key b/GA-Schloss/openvpn/keys/chris.key
new file mode 100644
index 0000000..5f64f29
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/chris.key
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI+jIr9p0kDOwCAggA
+MBQGCCqGSIb3DQMHBAioBIsOmRuGwQSCBMhBAGgoiZwsFZ/DnpLs6FB/yLIXK4Fg
+3ui9yocjEvIYIQpXzQkl/imfk7Kh0Q30MCr+c4y3djQDVgNIGo6lWWWCDoIBbaSq
+gki2iacoHOdQyZn6/1e5yAcFzqBXfGZRw4gUGa45ohAo9y1Tjn1cfdoNXvHzh4mp
+hv/k5sTPsr7WmUBfSHnxKch9tL4lN6KLCYHn9s4aDpJgu5O3aYG7bPxEvtRKvNjX
+RyXoiGMeiNAnWC0qR1cL9Jld7RyudB4TDAvNzzKaZqKR/DX16b7WYr9gISUWJ4mH
+rZ+YGwW0oaTjFQUL2gKSR9273nERV3sOwDDDLLpzBgkT8J/yoivT2yYcmQ7dniqP
+pUvWbbOAOsXnfmzzail12PrEQ8sgfJQH/4VyzbpAGg+vc/4B+tz7V/DBxrkbJgHN
+AwVpkPfLhBbrhM4x4Jt5mKhMnOrmq2ZeWpfOYVgRMNcohOd78RxGT4TYTIviYwYQ
+emi2huIjDfRcUS+pa+WPtj+9PKg8uv7E0b+TgIuP9/1q437SIzMllyFycBChegrp
+6XNoNXn75wLl37gtiFLpMAGJlIqiL3nCdiOtxe+zmPgF0zBHhJZgwb1tGLZqkErU
+FNKljcu9OHRK89+8En9YscLh2KBD64sUvNJMIOmnqo+H5yZEJ+lSHpRIdjC+uLZI
+sDqdz+MEG8Yb5yfkspy8sZB1mOSYUs5t35H6OtHK4KBoYKfll8nwOpUKRFDfBHgg
+v+sI2RC+vmSPbl4XRdjCG1lr6d68v44PWIxEwKvrXxLDs3oKxAr3RyrB8XW/5qzx
+shOxX+xrzJjqSsxpAwhIhDK1gmn0/mm2qLz01hDswX1eVZI9kF2Bc32SlqIlBh+V
+DPAEsODiwLwtWNzNtFn0Nh1gAOF4Urj8CKqDzYBnBssG5S8rZ0mgjea7k83uY+5G
+Qa+EW90/G37QguN1iQI51otBuwNCkv3IPGx6tCRcND4V3vK19IjCNv1yMJxx1p5z
+/ZalztyXgBYmfBYkdolrqs6XdTADHH6kCtyVj0CK89ZBQMdRa3O/b/eSXQE+xGJG
+QzzfFk5GSmWt5qllNd7SeyHMc7Hl3y+u/zCZXl7UkO8QRSC8lS/b6fR2bVqW6QQ0
+Bg9pZA8luVqkHH6dNbaqZuoF3ZI8uL/cMQ6YPi8cg3ypXX4BdJK2XvSvnbhRye6t
+f3W160SO4HnW7hZzN4KC1vh3dmF+9St5gkVHYa8UauHXsevH+T1HiLH3g+BwqP7X
+GAexij7qZilsd4o0ntgbdmGeIJr4QcHJFRcjhg1rRM9r528GhoJKJeB1BznCSWB0
+E2q12IknYLeB+h8j6vqNvGgkY8jkFtwmuSJ/KWui3wLEggTTuVE4niAYGkSiXtQZ
+qaamSD3Yrfttg+WJDdnSs6Akn4PUTBB6uyPmv3j0Bzcb1LC9rsFYGK+urtSze9Lm
+qWVlsbo/r3Mj9+ennAlfTcXQkqLw8qOGwEyVMGMjw8NR3FPfKyorRBuUZ1l23mta
+PAl/oud5ALVYoGTqx3QLb2/54wqG29yi9nhKaImn2SyFKQ3fNbwwOzt8RS2PVEed
+NYJnbR2stA0Bwk5W3jXBDt1WmJu7bEcpmDJ8a8a6m8xtTDnGSAL+Yfe0x/InMNxQ
+ubI=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/GA-Schloss/openvpn/keys/crl.pem b/GA-Schloss/openvpn/keys/crl.pem
new file mode 120000
index 0000000..d00f007
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/crl.pem
@@ -0,0 +1 @@
+../crl.pem
\ No newline at end of file
diff --git a/GA-Schloss/openvpn/keys/dh2048.pem b/GA-Schloss/openvpn/keys/dh2048.pem
new file mode 100644
index 0000000..ab34429
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/dh2048.pem
@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEAmEpXz6H2VOdJJfAGOqCpVkxgbcXG/FIjSbfIRMllYCdwTh5HiDxR
+kAaQCELrknCs1RbdBORzBYVhX6ESJkCqpJGkvroTSRHMUFspOntrW1ag4PwV1RRP
+g6V9Rqbq8tTxdbQQA1IkCjCTdlzyNA2TRlEUb0fLqnAnnt1W8zPpfWJTQUl1pxVh
+HoCDhFZdKgVZ81IY3B8CFHLI22T7dRy/5CzAG0A+8R20PeSQDwxnmKK5byIuhjCU
+wgghYThhyPZ6fCpHX1DLryQSvXV63wIY8Nz9vnqcacYK1E+LN/jNbGYC6nAC0Z2s
+eRpvGNoI2KCVAzvxCJJhuTadqmEW3fhvwwIBAg==
+-----END DH PARAMETERS-----
diff --git a/GA-Schloss/openvpn/keys/gw-ckubu.crt b/GA-Schloss/openvpn/keys/gw-ckubu.crt
new file mode 100644
index 0000000..28a35cd
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/gw-ckubu.crt
@@ -0,0 +1,99 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4 (0x4)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Validity
+            Not Before: Oct  9 16:07:53 2015 GMT
+            Not After : Oct  9 16:07:53 2035 GMT
+        Subject: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=gw-ckubu/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:ae:f7:e7:94:71:eb:8e:4b:16:f5:41:b5:00:33:
+                    54:da:9c:11:54:a3:e3:14:0f:f4:1d:e3:32:20:94:
+                    48:fd:46:d8:b2:76:12:3b:23:3c:a2:f2:e4:81:9a:
+                    e5:85:ab:c3:dd:38:c5:e0:ca:ee:af:11:12:f1:8f:
+                    78:3a:78:a5:3f:b9:ea:4e:8e:da:3e:e6:77:d5:ce:
+                    cb:56:3a:ca:bf:97:d6:a5:65:49:15:ce:e0:7b:5a:
+                    f9:c2:96:8a:70:18:be:3b:4f:20:bd:c5:b9:b5:46:
+                    07:f1:54:ad:76:56:47:f1:83:ee:7c:8a:9d:e9:42:
+                    23:a1:a7:b6:fb:76:c3:05:ad:dd:a8:fe:c8:fa:15:
+                    f4:9f:3a:30:dd:4d:c0:50:33:0b:19:f6:51:cb:9f:
+                    70:53:c7:7c:80:c5:69:7a:4c:bb:06:ec:46:e4:6e:
+                    77:18:77:7c:14:58:46:49:9a:ac:1f:a6:46:5f:f7:
+                    1c:71:33:a4:25:f4:82:92:96:56:fd:af:6b:c4:5a:
+                    0e:ef:d3:e6:68:36:c8:e8:8c:1c:75:12:f8:3e:34:
+                    2e:64:dd:a3:bc:b3:7e:2c:e8:56:55:5b:1a:b3:46:
+                    e4:06:d7:b3:f8:19:44:a3:0e:2d:92:0f:c8:64:76:
+                    af:e7:83:fb:62:a1:3a:91:56:fa:47:63:c2:c3:c5:
+                    7b:41
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                Easy-RSA Generated Certificate
+            X509v3 Subject Key Identifier: 
+                77:17:1E:55:4D:99:B1:B1:C4:AC:7D:4D:89:39:79:47:93:A3:F7:D9
+            X509v3 Authority Key Identifier: 
+                keyid:35:9F:DB:0D:86:40:F9:65:0E:E3:45:79:CE:37:98:0D:28:57:95:59
+                DirName:/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+                serial:D5:C5:AB:CB:22:8D:D3:9B
+
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Alternative Name: 
+                DNS:gw-ckubu
+    Signature Algorithm: sha256WithRSAEncryption
+         41:4d:2c:2d:3c:df:39:83:ed:10:3d:3f:17:bf:16:10:16:ff:
+         4f:79:db:44:15:d2:9f:e1:1e:49:5a:2b:12:23:48:72:bd:6f:
+         52:7f:75:5c:e1:b7:36:19:82:08:1b:60:c5:48:98:a9:da:55:
+         20:ca:f0:b7:c8:ea:8a:b5:3e:af:17:7d:8c:e0:d4:be:1a:09:
+         43:3b:27:17:59:ba:59:34:1f:6f:b6:3a:c3:be:9a:3f:5e:1b:
+         fc:75:2b:b0:13:d0:48:b2:82:45:fa:97:84:6c:fe:a5:20:d1:
+         a2:e9:6f:e9:eb:53:47:5a:63:b5:0a:5b:ed:67:24:71:6f:86:
+         27:a8:e9:88:12:bf:6c:dd:73:fb:32:6e:a7:b6:d5:fb:eb:dd:
+         23:c1:9a:1a:7b:fc:70:18:ec:b5:ed:e5:33:fd:c1:8b:06:ad:
+         ad:ee:de:e6:d6:b8:54:e0:4a:ef:1a:02:4e:3f:d3:ca:1e:48:
+         05:ad:88:e6:8c:77:81:5c:b6:c7:b1:f7:fe:4e:ad:74:6e:1c:
+         a2:0d:bd:21:b0:0a:19:8b:56:d5:88:6a:51:b5:f6:90:f9:e0:
+         b4:ad:79:c3:cb:f0:be:fe:79:be:4b:39:44:29:e8:82:d9:79:
+         93:3b:c7:5b:36:0a:0e:a8:44:e3:ed:df:e2:0d:de:1c:a2:9b:
+         dd:cd:96:30
+-----BEGIN CERTIFICATE-----
+MIIFhDCCBGygAwIBAgIBBDANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCREUx
+DzANBgNVBAgTBkhlc3NlbjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoT
+D0dBIEFsdGVuc2NobGlyZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAG
+A1UEAxMJVlBOLUdBLWNhMQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEW
+H2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNjaGxpcmYuZGUwHhcNMTUxMDA5MTYwNzUz
+WhcNMzUxMDA5MTYwNzUzWjCBvTELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczERMA8GA1UEAxMIZ3ctY2t1YnUx
+DzANBgNVBCkTBlZQTiBHQTEuMCwGCSqGSIb3DQEJARYfaXRAZ2VtZWluc2NoYWZ0
+LWFsdGVuc2NobGlyZi5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AK7355Rx645LFvVBtQAzVNqcEVSj4xQP9B3jMiCUSP1G2LJ2EjsjPKLy5IGa5YWr
+w904xeDK7q8REvGPeDp4pT+56k6O2j7md9XOy1Y6yr+X1qVlSRXO4Hta+cKWinAY
+vjtPIL3FubVGB/FUrXZWR/GD7nyKnelCI6Gntvt2wwWt3aj+yPoV9J86MN1NwFAz
+Cxn2UcufcFPHfIDFaXpMuwbsRuRudxh3fBRYRkmarB+mRl/3HHEzpCX0gpKWVv2v
+a8RaDu/T5mg2yOiMHHUS+D40LmTdo7yzfizoVlVbGrNG5AbXs/gZRKMOLZIPyGR2
+r+eD+2KhOpFW+kdjwsPFe0ECAwEAAaOCAYowggGGMAkGA1UdEwQCMAAwLQYJYIZI
+AYb4QgENBCAWHkVhc3ktUlNBIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E
+FgQUdxceVU2ZsbHErH1NiTl5R5Oj99kwgfMGA1UdIwSB6zCB6IAUNZ/bDYZA+WUO
+40V5zjeYDShXlVmhgcSkgcEwgb4xCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNz
+ZW4xFDASBgNVBAcTC1N0b2NraGF1c2VuMRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxp
+cmYxGTAXBgNVBAsTEE5ldHdvcmsgU2VydmljZXMxEjAQBgNVBAMTCVZQTi1HQS1j
+YTEPMA0GA1UEKRMGVlBOIEdBMS4wLAYJKoZIhvcNAQkBFh9pdEBnZW1laW5zY2hh
+ZnQtYWx0ZW5zY2hsaXJmLmRlggkA1cWryyKN05swEwYDVR0lBAwwCgYIKwYBBQUH
+AwIwCwYDVR0PBAQDAgeAMBMGA1UdEQQMMAqCCGd3LWNrdWJ1MA0GCSqGSIb3DQEB
+CwUAA4IBAQBBTSwtPN85g+0QPT8XvxYQFv9PedtEFdKf4R5JWisSI0hyvW9Sf3Vc
+4bc2GYIIG2DFSJip2lUgyvC3yOqKtT6vF32M4NS+GglDOycXWbpZNB9vtjrDvpo/
+Xhv8dSuwE9BIsoJF+peEbP6lINGi6W/p61NHWmO1ClvtZyRxb4YnqOmIEr9s3XP7
+Mm6nttX7690jwZoae/xwGOy17eUz/cGLBq2t7t7m1rhU4ErvGgJOP9PKHkgFrYjm
+jHeBXLbHsff+Tq10bhyiDb0hsAoZi1bViGpRtfaQ+eC0rXnDy/C+/nm+SzlEKeiC
+2XmTO8dbNgoOqETj7d/iDd4copvdzZYw
+-----END CERTIFICATE-----
diff --git a/GA-Schloss/openvpn/keys/gw-ckubu.csr b/GA-Schloss/openvpn/keys/gw-ckubu.csr
new file mode 100644
index 0000000..686008f
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/gw-ckubu.csr
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIDAzCCAesCAQAwgb0xCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNzZW4xFDAS
+BgNVBAcTC1N0b2NraGF1c2VuMRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxpcmYxGTAX
+BgNVBAsTEE5ldHdvcmsgU2VydmljZXMxETAPBgNVBAMTCGd3LWNrdWJ1MQ8wDQYD
+VQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEWH2l0QGdlbWVpbnNjaGFmdC1hbHRl
+bnNjaGxpcmYuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCu9+eU
+ceuOSxb1QbUAM1TanBFUo+MUD/Qd4zIglEj9RtiydhI7Izyi8uSBmuWFq8PdOMXg
+yu6vERLxj3g6eKU/uepOjto+5nfVzstWOsq/l9alZUkVzuB7WvnClopwGL47TyC9
+xbm1RgfxVK12Vkfxg+58ip3pQiOhp7b7dsMFrd2o/sj6FfSfOjDdTcBQMwsZ9lHL
+n3BTx3yAxWl6TLsG7EbkbncYd3wUWEZJmqwfpkZf9xxxM6Ql9IKSllb9r2vEWg7v
+0+ZoNsjojBx1Evg+NC5k3aO8s34s6FZVWxqzRuQG17P4GUSjDi2SD8hkdq/ng/ti
+oTqRVvpHY8LDxXtBAgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEABTwNV3bioK+L
+xQPEZiKN82VZn6E/ChjvF9triY7aS8wckX0sFzkKNGUl7pxlv12hm13Bq97DUtJW
+n4es+x5XJbIdg45FBwtlM9eX1N54lOp3tTWOF+YQD2Wfdz1tpUOnizulNZIhRVp+
+HF/ikbl+VDDyEC6x0mr8MA1l5zISxzIwwroOUbA9+hb+1Uf3IDJwfwdvRANaQhYv
+7YrqsRjbACs03ST/bwn70f0Lhq4lwBXxdPTVVd9UzyCPYZLIw07Bznd54nhR6dwQ
+pnYM93xDIT6yVQjnCU91Nqd4iLxOWdMIJUyrtjrAg7crWTLlcFIUCOrrU8qhrJze
+5iYIZBGXWg==
+-----END CERTIFICATE REQUEST-----
diff --git a/GA-Schloss/openvpn/keys/gw-ckubu.key b/GA-Schloss/openvpn/keys/gw-ckubu.key
new file mode 100644
index 0000000..7fc685d
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/gw-ckubu.key
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI5AUTsVDif7oCAggA
+MBQGCCqGSIb3DQMHBAg12+MbxEoyygSCBMgCrl75V6WYOCdXaXmPDePYFZnY1rms
+O7VBq16osPoJCUbnowfDlWyj73kM0kypBQPK1l9ZtXiC50BgbjPS16CeeAZNvFyr
+/1glAmHv4wKArmzF8GL98vEDsKbnBV9nFnPe1YV+Rq4QqeSiOmnWJOqoFbpYDJiO
+f2Io1g9DgoYYjMhvvjMk/mG4Oa6aOueMDYBFQ17NCNwXDj65HI685SiMEYzksQEW
+GcerSML5Q9PDwbaiH+xs1AVp3MEa65PDj3KW7jcB8LenSAzodXo6dhzJelSgv2Bo
+Q769n14ZetOK0Mv/o4blxQAPsbfknKylg/tvGIkFt38mH3PBJeXCNElyWHZJD6BR
+xZah53ajLQa6XXhV2LOj+qKjgvIH4lwb10nr+eL3VdXKPXdMrGQUHHx59Z5zGnwK
+qoRvKOtx/Lk56c+ycjCo0MJW4QddxB8rBmMEduUcI+jIk0ffF26F/uWh/gZO59hj
+Tu6cGAgZY5hxkofm+b4FdyC8dNgQUspPqs9iIqkMSjttzuihme2qdQg5cgl0F2Zp
+u7FTp/E8CsRX+MpVm/i+/0oXi9hspvEwfZcg1hpk3LdF2w3Ym+Wj/jlBiUbTC17K
+YSLQQk2WEWLbvhGLA/3Hp2auYm0h4PxyG9lp1RTkK6WJSz+Vjc/Y8V01Ml5l7pT5
+22eTksbqTeNcasCZkm7dEfAiuA222qS6OUZLzUkX9cBb6EXG/XIQ0qzY6c0UR/38
+qfU0aP1Z08mIwMhGfyn/QmYTcxMw2rov6eHt2tsemDFXNf3qj2dUvJn91nu4b0OQ
+3ddYB6mazfwCOqXeAzxv+POxuJvjUIx3MmIyQtQTvlNa0nzg89DNlAtBrRKDJVvS
+mRLEBT/mFTz6KPpdfVp+qdx+akAQ7YCpmRfBs1Am685b9azOs8+VQOl8rp4PpkU3
+T2rSCRpc7O6hW+YZYBwEMgJn0Qs5YXyiE8Js+k9QB5d20hGIJQAQ6hAyLLamHcj4
+K6KaBhycvsXvB27drkkofQOVEIV751McsgwC+cxS2DRaJf4udr20Pg/2Trc539kp
+anj/hT2auv3/rGGTfY9RLblp00eCjKazltsg3/DbQ5S34hSxnipfa7o6PACxqgAk
+qgZ0G5K/smgql5nppPpE8udS0utfDKgi7lCwlviIfKY/UjsQwRr3wh1L2NrjG1nY
+f7df0/WfVAc9+LA7QBVtKp68oh2wTCGQXdhgjwJgDMJp7xA/I1kd6tsjkXPjPNct
+tg1MZYL/jDjAEzC96ikhLCjbybLVmL3NJKC8Y5+kpxrIs7W4T+ZwTXwfgBUN58Kw
+ZHK7JSQzlBKmLlRbpYcjT+Ra5Mf78xA0ZsJ5D7yVoKYmMRfGfDAXQ4s3ri/EyC5h
+t4FeFvUdrr4fTu3FlxCAOhxV6rFG/pkjIe/o0JHEZpTvxnd9algrNCTu4D6EFJTW
+tQNfQY0mctQhtuMoqG51dB1jVRnZ+f+b7bzBnsesSzJNXKcrq8N0mgcZx0nNDn65
+Db32YOv28+JaID53Bq811tHtsybiuTCx+77oubUaH1it5xIMe7NzL9/gQAPkfn5r
+LnaDPGgPFEy6UaErrCOo10CkLq61VoCj8DgQz5fQ41OQrd0WbKYR5yqh/nTXpFus
+z3U=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/GA-Schloss/openvpn/keys/gw-nh.crt b/GA-Schloss/openvpn/keys/gw-nh.crt
new file mode 100644
index 0000000..db7a79c
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/gw-nh.crt
@@ -0,0 +1,99 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 5 (0x5)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Validity
+            Not Before: Oct  9 16:27:27 2015 GMT
+            Not After : Oct  9 16:27:27 2035 GMT
+        Subject: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=gw-nh/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:be:07:2f:b4:84:d8:b2:81:07:71:2f:e2:03:49:
+                    36:37:7c:1e:c0:25:7d:56:ca:e8:cc:22:d3:8d:f3:
+                    04:87:7d:2b:7c:ad:e3:28:ce:69:45:d9:5e:c1:bd:
+                    eb:72:a5:66:b0:73:30:d0:62:c4:44:54:e1:16:cf:
+                    82:82:d4:c1:87:ae:ff:f2:c3:0a:c8:cc:cf:c3:9f:
+                    c0:b7:0f:32:38:61:53:76:3e:24:b9:0e:37:85:68:
+                    ff:1c:fd:d8:39:c0:f8:da:23:cf:3c:30:c1:3d:68:
+                    5c:6b:f6:31:04:7d:11:67:bd:de:33:ee:b5:8a:69:
+                    92:10:46:eb:1b:52:1f:7b:8f:e7:46:7a:9d:70:39:
+                    ce:cf:2f:26:1b:fb:f5:1b:2b:af:6b:c1:18:64:21:
+                    6e:3d:b0:de:28:e9:30:e2:3b:a5:fd:d5:c0:80:8e:
+                    4c:08:80:53:0a:04:93:6e:b8:e7:66:8d:f3:19:df:
+                    0d:8c:da:40:ce:3f:23:a7:8e:18:8e:9a:76:fb:2e:
+                    52:b3:da:14:da:69:c2:07:09:2a:db:70:37:1b:f5:
+                    fa:c5:31:3f:0e:d6:07:30:63:da:1c:0a:fb:2e:45:
+                    3c:58:6b:48:9b:fb:f1:50:70:7a:3a:3d:bd:a7:31:
+                    8b:04:22:97:27:ff:cd:20:2a:e6:58:7b:57:14:bf:
+                    7d:3b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                Easy-RSA Generated Certificate
+            X509v3 Subject Key Identifier: 
+                4A:3F:A6:14:BC:62:49:79:F5:0C:48:73:5C:C9:5A:1E:A0:36:BB:E8
+            X509v3 Authority Key Identifier: 
+                keyid:35:9F:DB:0D:86:40:F9:65:0E:E3:45:79:CE:37:98:0D:28:57:95:59
+                DirName:/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+                serial:D5:C5:AB:CB:22:8D:D3:9B
+
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Alternative Name: 
+                DNS:gw-nh
+    Signature Algorithm: sha256WithRSAEncryption
+         75:a5:dd:59:e4:3d:33:1c:ca:6f:8b:7f:97:cb:cf:4e:12:af:
+         cf:c7:7d:a8:f4:d4:95:38:30:e5:1b:ff:f5:20:0e:ef:b7:25:
+         75:c7:44:3e:9a:78:e4:fe:6d:9a:5b:a1:cc:6e:4d:7e:cb:a7:
+         c7:95:fa:7f:e7:c2:38:e1:9c:2e:79:7b:61:b0:d9:6e:2c:dd:
+         28:4e:31:d5:66:45:c8:74:06:fc:c9:4d:a8:96:25:04:a5:2f:
+         45:f1:64:13:50:41:e1:86:d7:4e:4e:38:69:d6:00:e4:24:d6:
+         65:38:17:50:ee:d5:d8:f8:bd:80:07:e2:d1:b4:ed:d9:d3:a5:
+         a4:ba:37:50:6e:bb:48:30:9e:e7:93:1d:2e:89:da:b6:b0:04:
+         f6:1b:48:38:e2:66:3a:c0:82:e0:a2:00:60:cb:05:93:13:85:
+         cc:aa:e1:a1:c7:a3:7f:d9:96:46:e9:d8:da:c8:0d:c9:da:19:
+         12:98:56:46:ff:9f:ae:ec:82:fb:df:67:ae:72:63:68:76:e0:
+         d3:00:2c:8c:ee:26:c8:31:ad:b7:c7:44:4d:00:6d:c9:dc:e3:
+         73:74:9f:24:be:5a:1c:9f:5d:3f:34:ce:b5:af:8b:00:63:0f:
+         26:d2:42:2a:7e:13:f6:2c:33:6c:8c:0d:e7:3b:87:aa:f7:ec:
+         fa:da:2c:d4
+-----BEGIN CERTIFICATE-----
+MIIFfjCCBGagAwIBAgIBBTANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCREUx
+DzANBgNVBAgTBkhlc3NlbjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoT
+D0dBIEFsdGVuc2NobGlyZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAG
+A1UEAxMJVlBOLUdBLWNhMQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEW
+H2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNjaGxpcmYuZGUwHhcNMTUxMDA5MTYyNzI3
+WhcNMzUxMDA5MTYyNzI3WjCBujELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczEOMAwGA1UEAxMFZ3ctbmgxDzAN
+BgNVBCkTBlZQTiBHQTEuMCwGCSqGSIb3DQEJARYfaXRAZ2VtZWluc2NoYWZ0LWFs
+dGVuc2NobGlyZi5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL4H
+L7SE2LKBB3Ev4gNJNjd8HsAlfVbK6Mwi043zBId9K3yt4yjOaUXZXsG963KlZrBz
+MNBixERU4RbPgoLUwYeu//LDCsjMz8OfwLcPMjhhU3Y+JLkON4Vo/xz92DnA+Noj
+zzwwwT1oXGv2MQR9EWe93jPutYppkhBG6xtSH3uP50Z6nXA5zs8vJhv79Rsrr2vB
+GGQhbj2w3ijpMOI7pf3VwICOTAiAUwoEk26452aN8xnfDYzaQM4/I6eOGI6advsu
+UrPaFNppwgcJKttwNxv1+sUxPw7WBzBj2hwK+y5FPFhrSJv78VBwejo9vacxiwQi
+lyf/zSAq5lh7VxS/fTsCAwEAAaOCAYcwggGDMAkGA1UdEwQCMAAwLQYJYIZIAYb4
+QgENBCAWHkVhc3ktUlNBIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU
+Sj+mFLxiSXn1DEhzXMlaHqA2u+gwgfMGA1UdIwSB6zCB6IAUNZ/bDYZA+WUO40V5
+zjeYDShXlVmhgcSkgcEwgb4xCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNzZW4x
+FDASBgNVBAcTC1N0b2NraGF1c2VuMRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxpcmYx
+GTAXBgNVBAsTEE5ldHdvcmsgU2VydmljZXMxEjAQBgNVBAMTCVZQTi1HQS1jYTEP
+MA0GA1UEKRMGVlBOIEdBMS4wLAYJKoZIhvcNAQkBFh9pdEBnZW1laW5zY2hhZnQt
+YWx0ZW5zY2hsaXJmLmRlggkA1cWryyKN05swEwYDVR0lBAwwCgYIKwYBBQUHAwIw
+CwYDVR0PBAQDAgeAMBAGA1UdEQQJMAeCBWd3LW5oMA0GCSqGSIb3DQEBCwUAA4IB
+AQB1pd1Z5D0zHMpvi3+Xy89OEq/Px32o9NSVODDlG//1IA7vtyV1x0Q+mnjk/m2a
+W6HMbk1+y6fHlfp/58I44ZwueXthsNluLN0oTjHVZkXIdAb8yU2oliUEpS9F8WQT
+UEHhhtdOTjhp1gDkJNZlOBdQ7tXY+L2AB+LRtO3Z06WkujdQbrtIMJ7nkx0uidq2
+sAT2G0g44mY6wILgogBgywWTE4XMquGhx6N/2ZZG6djayA3J2hkSmFZG/5+u7IL7
+32eucmNoduDTACyM7ibIMa23x0RNAG3J3ONzdJ8kvlocn10/NM61r4sAYw8m0kIq
+fhP2LDNsjA3nO4eq9+z62izU
+-----END CERTIFICATE-----
diff --git a/GA-Schloss/openvpn/keys/gw-nh.csr b/GA-Schloss/openvpn/keys/gw-nh.csr
new file mode 100644
index 0000000..fc3fd3c
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/gw-nh.csr
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIDADCCAegCAQAwgboxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNzZW4xFDAS
+BgNVBAcTC1N0b2NraGF1c2VuMRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxpcmYxGTAX
+BgNVBAsTEE5ldHdvcmsgU2VydmljZXMxDjAMBgNVBAMTBWd3LW5oMQ8wDQYDVQQp
+EwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEWH2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNj
+aGxpcmYuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+By+0hNiy
+gQdxL+IDSTY3fB7AJX1WyujMItON8wSHfSt8reMozmlF2V7BvetypWawczDQYsRE
+VOEWz4KC1MGHrv/ywwrIzM/Dn8C3DzI4YVN2PiS5DjeFaP8c/dg5wPjaI888MME9
+aFxr9jEEfRFnvd4z7rWKaZIQRusbUh97j+dGep1wOc7PLyYb+/UbK69rwRhkIW49
+sN4o6TDiO6X91cCAjkwIgFMKBJNuuOdmjfMZ3w2M2kDOPyOnjhiOmnb7LlKz2hTa
+acIHCSrbcDcb9frFMT8O1gcwY9ocCvsuRTxYa0ib+/FQcHo6Pb2nMYsEIpcn/80g
+KuZYe1cUv307AgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEAe4iSoHDP3XIYoKQS
+XqGBRcSZfZDfGvT03SKa8gMJKasntjqMN8YncQLoWMbRptsFTX7SW4Nfy5G8Qs3B
+fLa5fI1wDOLn6sGknL1di/kAVZMrBZKeEQosKSOXIGIxw2RPqgMkZgjIv2Zkn6jD
+Vj7Bwi9Et9X/QYE5YUbtFBy9YkH88low1ptyveSuUwH5taUNZGrmdSn7ERTzdCk7
+uwJipg09g+jHsLwnO1nEc5ndLk+cnKQ1wpuInh7ASWF0cxV6/73BW6pfTWuvIiGz
+C9xMImTW/FQ3YChGLP/LSNx1q4YMLe7GiKjO0CMpNkzQjv1xqL7BkLuAGFl8G1bR
+68kU2Q==
+-----END CERTIFICATE REQUEST-----
diff --git a/GA-Schloss/openvpn/keys/gw-nh.key b/GA-Schloss/openvpn/keys/gw-nh.key
new file mode 100644
index 0000000..6f51409
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/gw-nh.key
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIfFEEBI5TU4wCAggA
+MBQGCCqGSIb3DQMHBAhOg8WplS3B4QSCBMjncG99GrUpu5n9rRr6cYp05VeUieib
+tSzfHncSSq91g5Fpi6+iGSp49FCtCVP9g6KnNy8EukBe2msGHKdQz1sWBvn2ElZs
+Qm06cMWwPx4s1sgeGYOWRc/rHEKyKHn1Y8DjjqvThsg11LfajeQsd7G0MxKQKTt7
+x9kTB5JudITa/ADSRGvV9tiCPiFgLu6Nriva4spVP3lh9LmCbJIY52915PpZtTD5
+wNYA1x7J3w74tubhykNGH1dz5SQwt8vatYXEGkhSHGUnGCrPkW1QlACo7MkgEXe/
+tUf2FqSrOcnOtOtD2srlUZbZO/k2N3pIlzKjM2UXtxVS4iBrEHNalIfxCRnIFuVx
+MhR8y5uQdiNwPPDOZfpiYsSGJpjJx57yi9Ii2Bs7oEXfTPTum5Y5cRyH5lN//3ek
+AN4zsCmTUPwHc2GVlcte9gpiWQvZ0hO4tl50kjtSzMFRHEARE7Ne0yrRE2YYxXQ1
+FQkbXiLPHnRkFsvNsiu0hFtX9BvXRFgC7jeYj+EHyaxbFPn4HqRaLO63A+BrA0xX
+GXiVLP12WcHmAKFcHRC1bCAzCKFlroXyohyhEneSnF92wVqq048QkRqBUyYy9sw7
+IBxVMpFrKsn2F8L/4G6wK203Z4pXyxS36PnbuQcO7HhAA/ddpObvlR0APrSiOUO0
+wjwE6sUe6cL9HAC7qK5G8ueEcaNOSfi0AMiJXAl3viLoPsdcnb2f6QYaq3DSc91r
+cWbzuHWLQodfT4+4Ua3G861MLjy2a3O2yikZqfZUiXMKUKwYXM5HyfD8SxMQP+E4
+b0CYLRrMattgJErgU/kOtRMeyZM9WxY+vzOyRnKP8IKHdcGZl0q7WYWVlG4jsEuj
+OQPKHFlNb/0+Z7x0Na8x9YzQvdpGB4/sDica2f3iSyA+khnmM75k1Pz1KbFwHfe7
+Bwmz0HvOeXepydmru/UDMR0mHWVYDrxUzOEE7fdM2pr0/xO+9pwVlTIugAg9wben
+MBMYtxZiPKIAvGu42IpmXZC+Z9BcuVMDoAhKv5IGxE1wWhashhMR3eOKGgEsRQ8V
+BKNSYzBVen9XlKb32xB74xgcokv1suczERUfn5JyDt7xltSTPRola0HjwvLzXYiz
+ncgGlOmhcuHCRqIH03GlPXPIonqYcAZoCcp0YBhoWQHWRBqTwIIRRRVLewIs+zUZ
+/B5shBdQfVoFC+6BL39qDuF9hlk9JSzUek8agVP2Lrpf5jRbo4S7/joxPj/he4N8
+LLkeqvrqBJ9BkIpXUIca90a5bp5PR5KLjlLvQFljZQ0pW90l0jGH3LxvTRAxYnGe
+rK3J9fnJkj3jOxCnJ6INQPNi1RBORO4JFZzLpVEmM4dVM5OcmraYV9HieUGTQAF0
+qM++6cCWKlF3NbIHYfuRZMxLXLB2mhn++XTchHnbQeAFw8k/KwEx9Ajo5C548I38
+Ja5KnEKXhQ5D5Q9MHANyq6oJPKkVhN2alv/pEFoupngbr3NiNgIKdUKJC9JLDFnA
+5QkKgpwt9S7RKnp1HWiAbwCFbG5/acN/kyQtL9vCdiDuUrJ6Po+FIfbgollZRn46
+xQ/U3NdiQvdM51JAvwgXNJhgzgSOMvGghj65neh2m4HZl1dTq6qGI1vnLEC5Cag8
+a1s=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/GA-Schloss/openvpn/keys/index.txt b/GA-Schloss/openvpn/keys/index.txt
new file mode 100644
index 0000000..38f33ab
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/index.txt
@@ -0,0 +1,6 @@
+V	351009154637Z		01	unknown	/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=server/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+V	351009154851Z		02	unknown	/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=chris/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+V	351009155415Z		03	unknown	/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=wadmin/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+V	351009160753Z		04	unknown	/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=gw-ckubu/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+V	351009162727Z		05	unknown	/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=gw-nh/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+V	351126195711Z		06	unknown	/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=madmin/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
diff --git a/GA-Schloss/openvpn/keys/index.txt.attr b/GA-Schloss/openvpn/keys/index.txt.attr
new file mode 100644
index 0000000..8f7e63a
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/index.txt.attr
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/GA-Schloss/openvpn/keys/index.txt.attr.old b/GA-Schloss/openvpn/keys/index.txt.attr.old
new file mode 100644
index 0000000..8f7e63a
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/index.txt.attr.old
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/GA-Schloss/openvpn/keys/index.txt.old b/GA-Schloss/openvpn/keys/index.txt.old
new file mode 100644
index 0000000..8e15930
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/index.txt.old
@@ -0,0 +1,5 @@
+V	351009154637Z		01	unknown	/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=server/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+V	351009154851Z		02	unknown	/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=chris/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+V	351009155415Z		03	unknown	/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=wadmin/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+V	351009160753Z		04	unknown	/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=gw-ckubu/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+V	351009162727Z		05	unknown	/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=gw-nh/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
diff --git a/GA-Schloss/openvpn/keys/madmin.crt b/GA-Schloss/openvpn/keys/madmin.crt
new file mode 100644
index 0000000..699f2f1
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/madmin.crt
@@ -0,0 +1,99 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 6 (0x6)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Validity
+            Not Before: Nov 26 19:57:11 2015 GMT
+            Not After : Nov 26 19:57:11 2035 GMT
+        Subject: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=madmin/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:d9:35:1c:5e:da:a9:31:86:bb:22:31:76:a9:51:
+                    18:4a:ed:5a:9e:e8:fd:16:85:32:a8:0b:91:87:e3:
+                    92:12:12:a7:06:da:c5:c9:48:9b:fa:94:81:36:63:
+                    d3:11:25:0b:3d:3d:fc:94:3b:e3:91:1a:e1:cf:d0:
+                    53:88:0e:9e:79:5d:6e:18:6d:a0:71:8e:ec:f3:3e:
+                    50:08:4d:73:7c:23:d0:af:ff:ae:c1:ad:5b:99:cd:
+                    bf:f2:04:43:09:79:83:f2:ac:10:0e:0c:0d:ec:b6:
+                    81:f9:65:75:3c:ea:c2:52:2a:32:1b:a8:d1:af:c7:
+                    85:66:a7:73:af:14:dd:95:41:a0:ed:52:79:44:ce:
+                    b7:0b:3e:19:80:ef:71:b2:15:6e:7a:96:0f:10:2f:
+                    50:8a:f8:90:f6:8f:6a:fe:b5:21:ef:78:95:0e:94:
+                    2f:aa:f7:16:b4:73:f2:62:32:8a:8c:c7:e6:d5:bf:
+                    fc:78:e1:fc:43:d4:d0:93:08:26:8e:f6:a8:31:2b:
+                    4f:6e:cd:88:ae:14:e7:0d:c5:ec:49:09:7a:16:6e:
+                    10:d5:83:04:a3:e3:1f:b0:c4:1e:55:65:10:60:5a:
+                    c8:72:e0:9b:c6:b4:26:39:5d:69:55:0e:de:5c:75:
+                    f9:ea:2f:be:9e:61:b1:59:f4:b0:47:03:a4:43:99:
+                    c1:99
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                Easy-RSA Generated Certificate
+            X509v3 Subject Key Identifier: 
+                E9:A6:ED:67:0C:62:23:7A:B3:23:F4:D7:93:5B:63:76:C9:4A:94:A7
+            X509v3 Authority Key Identifier: 
+                keyid:35:9F:DB:0D:86:40:F9:65:0E:E3:45:79:CE:37:98:0D:28:57:95:59
+                DirName:/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+                serial:D5:C5:AB:CB:22:8D:D3:9B
+
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Alternative Name: 
+                DNS:madmin
+    Signature Algorithm: sha256WithRSAEncryption
+         1b:67:ed:5b:7b:f6:b5:bf:83:3b:7e:22:4f:0c:82:c2:07:94:
+         2a:78:50:f8:85:a5:8f:83:d7:88:8c:99:fe:8a:2d:00:9c:93:
+         f6:9a:96:67:ca:ed:4d:81:06:4a:c3:5f:85:5c:b6:31:c4:5c:
+         78:28:fd:72:07:72:5b:84:ac:6e:58:b6:98:57:04:cd:5d:d5:
+         f1:36:f7:39:d2:79:bf:b8:66:48:25:e5:37:27:77:af:0f:e2:
+         0c:9d:53:e3:eb:1f:62:a2:ea:17:16:6e:75:25:28:c0:d3:b0:
+         fd:8d:79:b8:9a:1a:1e:c0:7f:b7:d6:70:ce:b0:6a:8e:30:2b:
+         a5:c8:70:bd:a5:df:f7:b8:a3:8a:b7:96:da:b0:6a:03:a3:31:
+         02:cf:7d:1d:49:39:88:26:dc:39:f3:2c:f9:c5:4a:13:f8:28:
+         d0:a0:1f:59:2d:ea:62:22:ef:cd:6d:95:c8:a9:11:55:da:30:
+         da:38:d5:92:d5:94:60:12:9e:a8:d9:cb:3e:c6:90:21:04:a3:
+         97:b7:5a:1f:77:d5:4f:95:ab:4f:b6:3d:bc:6a:6c:5c:1e:5e:
+         16:9b:28:2e:1c:6a:20:64:8d:f3:42:e5:b0:a4:0d:59:b5:5d:
+         e8:4f:31:04:78:1c:86:f9:8d:38:0c:28:ab:94:c1:bd:bd:be:
+         84:f4:2d:d6
+-----BEGIN CERTIFICATE-----
+MIIFgDCCBGigAwIBAgIBBjANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCREUx
+DzANBgNVBAgTBkhlc3NlbjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoT
+D0dBIEFsdGVuc2NobGlyZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAG
+A1UEAxMJVlBOLUdBLWNhMQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEW
+H2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNjaGxpcmYuZGUwHhcNMTUxMTI2MTk1NzEx
+WhcNMzUxMTI2MTk1NzExWjCBuzELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczEPMA0GA1UEAxMGbWFkbWluMQ8w
+DQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEWH2l0QGdlbWVpbnNjaGFmdC1h
+bHRlbnNjaGxpcmYuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ
+NRxe2qkxhrsiMXapURhK7Vqe6P0WhTKoC5GH45ISEqcG2sXJSJv6lIE2Y9MRJQs9
+PfyUO+ORGuHP0FOIDp55XW4YbaBxjuzzPlAITXN8I9Cv/67BrVuZzb/yBEMJeYPy
+rBAODA3stoH5ZXU86sJSKjIbqNGvx4Vmp3OvFN2VQaDtUnlEzrcLPhmA73GyFW56
+lg8QL1CK+JD2j2r+tSHveJUOlC+q9xa0c/JiMoqMx+bVv/x44fxD1NCTCCaO9qgx
+K09uzYiuFOcNxexJCXoWbhDVgwSj4x+wxB5VZRBgWshy4JvGtCY5XWlVDt5cdfnq
+L76eYbFZ9LBHA6RDmcGZAgMBAAGjggGIMIIBhDAJBgNVHRMEAjAAMC0GCWCGSAGG
++EIBDQQgFh5FYXN5LVJTQSBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE
+FOmm7WcMYiN6syP015NbY3bJSpSnMIHzBgNVHSMEgeswgeiAFDWf2w2GQPllDuNF
+ec43mA0oV5VZoYHEpIHBMIG+MQswCQYDVQQGEwJERTEPMA0GA1UECBMGSGVzc2Vu
+MRQwEgYDVQQHEwtTdG9ja2hhdXNlbjEYMBYGA1UEChMPR0EgQWx0ZW5zY2hsaXJm
+MRkwFwYDVQQLExBOZXR3b3JrIFNlcnZpY2VzMRIwEAYDVQQDEwlWUE4tR0EtY2Ex
+DzANBgNVBCkTBlZQTiBHQTEuMCwGCSqGSIb3DQEJARYfaXRAZ2VtZWluc2NoYWZ0
+LWFsdGVuc2NobGlyZi5kZYIJANXFq8sijdObMBMGA1UdJQQMMAoGCCsGAQUFBwMC
+MAsGA1UdDwQEAwIHgDARBgNVHREECjAIggZtYWRtaW4wDQYJKoZIhvcNAQELBQAD
+ggEBABtn7Vt79rW/gzt+Ik8MgsIHlCp4UPiFpY+D14iMmf6KLQCck/aalmfK7U2B
+BkrDX4VctjHEXHgo/XIHcluErG5YtphXBM1d1fE29znSeb+4Zkgl5Tcnd68P4gyd
+U+PrH2Ki6hcWbnUlKMDTsP2NebiaGh7Af7fWcM6wao4wK6XIcL2l3/e4o4q3ltqw
+agOjMQLPfR1JOYgm3DnzLPnFShP4KNCgH1kt6mIi781tlcipEVXaMNo41ZLVlGAS
+nqjZyz7GkCEEo5e3Wh931U+Vq0+2PbxqbFweXhabKC4caiBkjfNC5bCkDVm1XehP
+MQR4HIb5jTgMKKuUwb29voT0LdY=
+-----END CERTIFICATE-----
diff --git a/GA-Schloss/openvpn/keys/madmin.csr b/GA-Schloss/openvpn/keys/madmin.csr
new file mode 100644
index 0000000..35bd9db
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/madmin.csr
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIDATCCAekCAQAwgbsxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNzZW4xFDAS
+BgNVBAcTC1N0b2NraGF1c2VuMRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxpcmYxGTAX
+BgNVBAsTEE5ldHdvcmsgU2VydmljZXMxDzANBgNVBAMTBm1hZG1pbjEPMA0GA1UE
+KRMGVlBOIEdBMS4wLAYJKoZIhvcNAQkBFh9pdEBnZW1laW5zY2hhZnQtYWx0ZW5z
+Y2hsaXJmLmRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2TUcXtqp
+MYa7IjF2qVEYSu1anuj9FoUyqAuRh+OSEhKnBtrFyUib+pSBNmPTESULPT38lDvj
+kRrhz9BTiA6eeV1uGG2gcY7s8z5QCE1zfCPQr/+uwa1bmc2/8gRDCXmD8qwQDgwN
+7LaB+WV1POrCUioyG6jRr8eFZqdzrxTdlUGg7VJ5RM63Cz4ZgO9xshVuepYPEC9Q
+iviQ9o9q/rUh73iVDpQvqvcWtHPyYjKKjMfm1b/8eOH8Q9TQkwgmjvaoMStPbs2I
+rhTnDcXsSQl6Fm4Q1YMEo+MfsMQeVWUQYFrIcuCbxrQmOV1pVQ7eXHX56i++nmGx
+WfSwRwOkQ5nBmQIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBAHRLYmGOPJ95FLAh
+oaA71mlotuX2B7N49V3OQmIXr4oMPMZwGLTPA7tKEA8falp2riTaz7kS2pAY1pG0
+v84Suy8J1P34Po5FOsxL92lmumnPfttGBjOE5djVhXw5ES/MnJIR9aZq2dGJvOF8
+Bi4Ys4nurGdCvHLwBQdO/4WL7lf34lM01z3+DaNwhKkD5eQMgACVO0ALIZ7WKbh/
+UaRnB9RlTd8oerkohivVWyaiNryIWLZDL7lUCu9QIfc4eVPbROsYGoiQ9GUnS4It
+zLBXelPWQi9odlwe8fZ1F+GxETzZuFtcP+ecigqX9OwnaBf15yZ/gxZiAj7cRMBm
+LrCUjSA=
+-----END CERTIFICATE REQUEST-----
diff --git a/GA-Schloss/openvpn/keys/madmin.key b/GA-Schloss/openvpn/keys/madmin.key
new file mode 100644
index 0000000..404897c
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/madmin.key
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIVWFb2HHiFsoCAggA
+MBQGCCqGSIb3DQMHBAg/ZPMf/AEB0QSCBMivNQy6fm7MNypg5I1upqmCZpEkDaP8
+lxPZWWDfv+quEGgEWWCxgfsEAIgHLRFtQtjBzpGMA0VK6IR1Anvlab+HcapXeYEb
+fmUlc9JSpuJNPQdFruBP+QzE2W/X4Fz3pOUSjMjBIEA/p2XAdd1NcYKifdDRX7xR
+AYsiH7JSqyVA5b1h8urSwb63Cqb/dQE+GEWJvvBd7bxdbcVlSzATaM3C3zQQMR6Z
+Xx7W6jhAR/1yvpLSMpZixBi7F1Ox7zUUS8Ppu6m5y3GJGQ9eduz/gWLzWeOov/cV
+LoS3Dny8CmDX9c6NIgZPmupDOTfMEaDSa0EqRDRXjJJRo5gGxCvFs0CCZxEY90CR
+s+g8ULFWwWndYmFDn2bHEPA8uPgvrddVh/I2k2A5WROjoIbmq51waA++V4S2/ZDX
++6vf2SvMg7uFbhVex4eAoqyxC7hRH8BCTrDuV/p99w/opbHi062LE4qF/QH3Agl0
+O4kNwzk6XBwIMp57kAagGV6UUwFWJYUSHwY1IOULQ/EUk8lkBz5GlDy2RO7LJYGi
+snCUm/JYHW+HlflguAN+Jafo1MTjGOH1As88bt1qOBhYDBhYKmAQdMzJN4zfhw6l
+ykXtderJYaBVc8BedRDbibMGjMif7/mSZzZi/c/xBFhg8YPoqrvz9yUI+Us4WSgx
+Rk6GBN2s1sBn2JMDF7ofjD6oE96eWC60eTOD6qEyQTcCjLMO0GRL/71JDOw9Q/aE
+ssR5mRxKfBhy/vApT8QR2RfQ/7LUuoNbedv+xCoy20p6vBBt9a4+qvX5YhkdVt2S
+MY5ebZgeVSTWECwXB2w+TFDO00L6Kxe25DBMGw+sogefzk3pC8I9vhGJ48glWQVx
+9sV0ILpVjnpuPveK7OgYQMj88hzpl1/GWqGjf9ZD7NcOhCKpOIuxMPeKXTZmG9HS
+qmjvC/G4pVpUh8s3zxTMtmckzEkd1uK1MlEh+V59O6zNeEO291cqwnoSiojkbeHi
+smU/9IddaBUbsLyDNCYSbP9aDQdQocAPis3TTDMsp7WnUopBUcefgd3f+spe/QAW
+1DM5ezQb2Fqc/t+Gzxq3ZF+2rQ+3sgWuO9+Qr9rNNjWTA3/h4UCAGzE0nBM+xacl
+r1effXLK/+i32PNcyDK37inS/Ysi25CItkKVJeWCLFDo4HYtbI3vrE+LJrEGoG/z
+91rpeojEAh2MM43h6AzAV/BK7TuOXGHM/AqMDFqCOnGk27GNcsvAHrZ1ZprdCwdP
+HzuDyt3IEKuOmWWiUM4VWlctq5ydg0nkDEl3AnqigjeYzCD2tb8iHE95E1COo3Xi
+Kt8OBCSKhgu5i2HbgQEUTvB5B5IouBW+gHK1fxNGZErcU1feBNwheU3UbJHVAB0G
+4nzgC43Uy5IE6Bb8y3s9fWYlaQ8gVAfSeDKAWE65meO2hz2FjbY3NwA8UJ1k6PMY
+sE6+a/VBAvKw5B7/oZNRAdZd5SVN6WQiX65FyBXVlvTCpd7jNNrh9ExTBPbqi7Nx
+4Kh2YoWsJBpFKNcUNIrdryewqJQO+rN26by9S/b8I5q+y61TMygyeKXccFGj8Rfh
+Jj7f+bcO8PXQFRGVzhVMBCOJ2RBP1hHBQSZ3sl9R+BCyf3MYD+SpgpY1e7BIUr0b
+Lb8=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/GA-Schloss/openvpn/keys/serial b/GA-Schloss/openvpn/keys/serial
new file mode 100644
index 0000000..2c7456e
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/serial
@@ -0,0 +1 @@
+07
diff --git a/GA-Schloss/openvpn/keys/serial.old b/GA-Schloss/openvpn/keys/serial.old
new file mode 100644
index 0000000..cd672a5
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/serial.old
@@ -0,0 +1 @@
+06
diff --git a/GA-Schloss/openvpn/keys/server.crt b/GA-Schloss/openvpn/keys/server.crt
new file mode 100644
index 0000000..1cf5b2e
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/server.crt
@@ -0,0 +1,101 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Validity
+            Not Before: Oct  9 15:46:37 2015 GMT
+            Not After : Oct  9 15:46:37 2035 GMT
+        Subject: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=server/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:be:0c:c2:ab:db:2f:7f:ba:ff:65:4c:17:07:46:
+                    61:5e:56:85:8b:8f:d4:13:05:8b:be:9b:a2:d8:3a:
+                    68:b4:5f:c1:31:fa:27:4e:cd:15:8c:d5:9d:76:ca:
+                    ca:3d:4d:90:f4:16:51:4b:b2:50:12:0d:73:cc:b7:
+                    66:7c:87:39:ae:2a:20:38:80:bc:45:51:40:16:3f:
+                    1e:93:99:ad:4f:e9:6c:d7:1f:fe:be:36:2b:63:58:
+                    84:47:1a:c0:31:2f:9c:37:6d:9d:ba:10:c4:c2:4a:
+                    93:0a:d5:4e:70:00:46:13:6f:bd:1a:02:6a:11:06:
+                    69:3a:a8:ad:72:94:63:2d:c9:12:1a:1a:4b:e9:67:
+                    e9:64:8c:df:de:70:df:ac:7b:4a:1f:5a:3a:30:f7:
+                    19:51:04:73:8a:ce:7f:b1:cb:8c:ab:97:b8:15:b6:
+                    e1:5c:c1:9c:c7:91:cc:52:fe:c7:33:71:1a:b1:2a:
+                    99:c9:c4:ef:3e:dd:5d:eb:1e:5b:fc:f9:04:c2:0b:
+                    68:5e:69:24:8d:68:59:db:70:3e:b9:b8:75:69:d3:
+                    67:af:0b:b3:1d:d7:42:6c:08:24:5a:d9:18:18:b7:
+                    bb:f5:b6:f2:73:da:14:7b:3f:56:7d:79:df:da:09:
+                    1a:52:c1:2c:e1:f8:7c:5a:3b:fb:44:d2:f4:2d:43:
+                    13:d9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Server
+            Netscape Comment: 
+                Easy-RSA Generated Server Certificate
+            X509v3 Subject Key Identifier: 
+                6C:63:B8:00:5F:EA:CD:9C:61:19:41:5B:5A:56:AB:4A:A2:E1:C3:13
+            X509v3 Authority Key Identifier: 
+                keyid:35:9F:DB:0D:86:40:F9:65:0E:E3:45:79:CE:37:98:0D:28:57:95:59
+                DirName:/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+                serial:D5:C5:AB:CB:22:8D:D3:9B
+
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Key Encipherment
+            X509v3 Subject Alternative Name: 
+                DNS:server
+    Signature Algorithm: sha256WithRSAEncryption
+         92:dc:23:54:f7:13:0a:b8:0f:dd:89:fc:33:4a:98:1b:de:fa:
+         4e:2e:bb:6f:e1:37:ec:75:f9:6b:40:00:cb:3f:bd:d9:52:31:
+         df:2a:29:8a:4d:15:0a:87:73:15:31:1a:4b:d5:66:d1:a0:60:
+         11:13:0f:c3:36:62:89:ed:be:5b:8d:dd:3c:f9:15:4a:a4:0f:
+         d7:9f:09:5a:ce:aa:a4:be:8a:b4:99:09:d4:16:fb:6c:23:74:
+         b4:01:57:a5:2d:18:0d:f7:b8:87:ee:3e:e8:22:5d:10:85:a6:
+         4b:e6:18:4a:de:aa:5f:0b:4c:12:ea:f8:71:c8:dd:94:21:da:
+         c5:85:8e:0a:da:bc:bc:9c:5c:13:65:b5:36:71:04:da:d5:97:
+         46:b1:19:60:17:50:eb:eb:02:1b:fe:22:dc:cf:c8:7d:4c:61:
+         27:eb:f1:5b:c5:54:78:eb:64:b9:d5:6d:cd:2d:29:21:33:7e:
+         6a:29:60:25:a0:88:94:5e:0a:a6:ed:ac:d9:c1:b7:ff:9e:1b:
+         bc:e1:8f:aa:b1:a4:b7:a7:f6:d7:e8:9e:49:f4:22:9b:bd:10:
+         30:56:55:9a:d7:c7:6f:78:e6:04:5e:5c:2e:ae:3a:3b:4b:9e:
+         92:e1:09:46:42:8c:d4:7d:dc:72:87:0a:7f:5b:70:32:2c:a5:
+         f8:0d:27:af
+-----BEGIN CERTIFICATE-----
+MIIFmjCCBIKgAwIBAgIBATANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCREUx
+DzANBgNVBAgTBkhlc3NlbjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoT
+D0dBIEFsdGVuc2NobGlyZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAG
+A1UEAxMJVlBOLUdBLWNhMQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEW
+H2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNjaGxpcmYuZGUwHhcNMTUxMDA5MTU0NjM3
+WhcNMzUxMDA5MTU0NjM3WjCBuzELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczEPMA0GA1UEAxMGc2VydmVyMQ8w
+DQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEWH2l0QGdlbWVpbnNjaGFmdC1h
+bHRlbnNjaGxpcmYuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+
+DMKr2y9/uv9lTBcHRmFeVoWLj9QTBYu+m6LYOmi0X8Ex+idOzRWM1Z12yso9TZD0
+FlFLslASDXPMt2Z8hzmuKiA4gLxFUUAWPx6Tma1P6WzXH/6+NitjWIRHGsAxL5w3
+bZ26EMTCSpMK1U5wAEYTb70aAmoRBmk6qK1ylGMtyRIaGkvpZ+lkjN/ecN+se0of
+Wjow9xlRBHOKzn+xy4yrl7gVtuFcwZzHkcxS/sczcRqxKpnJxO8+3V3rHlv8+QTC
+C2heaSSNaFnbcD65uHVp02evC7Md10JsCCRa2RgYt7v1tvJz2hR7P1Z9ed/aCRpS
+wSzh+HxaO/tE0vQtQxPZAgMBAAGjggGiMIIBnjAJBgNVHRMEAjAAMBEGCWCGSAGG
++EIBAQQEAwIGQDA0BglghkgBhvhCAQ0EJxYlRWFzeS1SU0EgR2VuZXJhdGVkIFNl
+cnZlciBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUbGO4AF/qzZxhGUFbWlarSqLhwxMw
+gfMGA1UdIwSB6zCB6IAUNZ/bDYZA+WUO40V5zjeYDShXlVmhgcSkgcEwgb4xCzAJ
+BgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNzZW4xFDASBgNVBAcTC1N0b2NraGF1c2Vu
+MRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxpcmYxGTAXBgNVBAsTEE5ldHdvcmsgU2Vy
+dmljZXMxEjAQBgNVBAMTCVZQTi1HQS1jYTEPMA0GA1UEKRMGVlBOIEdBMS4wLAYJ
+KoZIhvcNAQkBFh9pdEBnZW1laW5zY2hhZnQtYWx0ZW5zY2hsaXJmLmRlggkA1cWr
+yyKN05swEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgWgMBEGA1UdEQQK
+MAiCBnNlcnZlcjANBgkqhkiG9w0BAQsFAAOCAQEAktwjVPcTCrgP3Yn8M0qYG976
+Ti67b+E37HX5a0AAyz+92VIx3yopik0VCodzFTEaS9Vm0aBgERMPwzZiie2+W43d
+PPkVSqQP158JWs6qpL6KtJkJ1Bb7bCN0tAFXpS0YDfe4h+4+6CJdEIWmS+YYSt6q
+XwtMEur4ccjdlCHaxYWOCtq8vJxcE2W1NnEE2tWXRrEZYBdQ6+sCG/4i3M/IfUxh
+J+vxW8VUeOtkudVtzS0pITN+ailgJaCIlF4Kpu2s2cG3/54bvOGPqrGkt6f21+ie
+SfQim70QMFZVmtfHb3jmBF5cLq46O0uekuEJRkKM1H3ccocKf1twMiyl+A0nrw==
+-----END CERTIFICATE-----
diff --git a/GA-Schloss/openvpn/keys/server.csr b/GA-Schloss/openvpn/keys/server.csr
new file mode 100644
index 0000000..964027c
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/server.csr
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIDATCCAekCAQAwgbsxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNzZW4xFDAS
+BgNVBAcTC1N0b2NraGF1c2VuMRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxpcmYxGTAX
+BgNVBAsTEE5ldHdvcmsgU2VydmljZXMxDzANBgNVBAMTBnNlcnZlcjEPMA0GA1UE
+KRMGVlBOIEdBMS4wLAYJKoZIhvcNAQkBFh9pdEBnZW1laW5zY2hhZnQtYWx0ZW5z
+Y2hsaXJmLmRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvgzCq9sv
+f7r/ZUwXB0ZhXlaFi4/UEwWLvpui2DpotF/BMfonTs0VjNWddsrKPU2Q9BZRS7JQ
+Eg1zzLdmfIc5riogOIC8RVFAFj8ek5mtT+ls1x/+vjYrY1iERxrAMS+cN22duhDE
+wkqTCtVOcABGE2+9GgJqEQZpOqitcpRjLckSGhpL6WfpZIzf3nDfrHtKH1o6MPcZ
+UQRzis5/scuMq5e4FbbhXMGcx5HMUv7HM3EasSqZycTvPt1d6x5b/PkEwgtoXmkk
+jWhZ23A+ubh1adNnrwuzHddCbAgkWtkYGLe79bbyc9oUez9WfXnf2gkaUsEs4fh8
+Wjv7RNL0LUMT2QIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBAA8po3xtTV2ncixm
+RYLsqAVziil/1PyPZxep9OXZK22gac+rpWh8BG/tfApMcnAArSxAx6cIyU3cADqt
+7NYCrvAT1NHsPiL1AbQwfuhxBRdYRax668kSMeUtTuzafuULLNwtdtIvsamW7hBu
+73BeQxSG1pyIv0rlkShvsIcXr4AbnpO3tt/LV3Cf+LpRcy3HvRywkqWQB/7ET/c8
+R53XLnLpe+f8uq9eQSOZOEyntG7J3Pbwmy1iBd6I8o3EUyGzKcjTsealBui4QZ/T
+DY/FM/BcRP+jkvuW3M9p0cdDJyKb/YOM6e0aNAFZidwchRHucbk8U81XMX/Lp4eb
+SCAFcc4=
+-----END CERTIFICATE REQUEST-----
diff --git a/GA-Schloss/openvpn/keys/server.key b/GA-Schloss/openvpn/keys/server.key
new file mode 100644
index 0000000..1f8df82
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/server.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC+DMKr2y9/uv9l
+TBcHRmFeVoWLj9QTBYu+m6LYOmi0X8Ex+idOzRWM1Z12yso9TZD0FlFLslASDXPM
+t2Z8hzmuKiA4gLxFUUAWPx6Tma1P6WzXH/6+NitjWIRHGsAxL5w3bZ26EMTCSpMK
+1U5wAEYTb70aAmoRBmk6qK1ylGMtyRIaGkvpZ+lkjN/ecN+se0ofWjow9xlRBHOK
+zn+xy4yrl7gVtuFcwZzHkcxS/sczcRqxKpnJxO8+3V3rHlv8+QTCC2heaSSNaFnb
+cD65uHVp02evC7Md10JsCCRa2RgYt7v1tvJz2hR7P1Z9ed/aCRpSwSzh+HxaO/tE
+0vQtQxPZAgMBAAECggEBAIhxStXtH9XZIADOtv2/FqqO/YOr9/rMEX7/59LLZF6T
+HHXP/aaCcIVS26DsiHOom3fSCf2JgBjl1YxU41xmDRAwKD/IlOJDKfqOyFn5i8cC
+c+SikNZot4+0fgs6dl8ZqlLU/NcXsNs4hQbTC2Q3nhfYMfBZaWLdsnCtpxDK3cWB
+BVu6kD5/535WUdSrOWm5Cn8pnqZDKHGp92hzkiF8tL+HChuihgxgGBZulHFv2our
+SyEOuG72guAnRB8YKbYsS/CidJH3t8rpHf8RkkmWMybLeuzxReEZk+bmLZwC7wCg
+Gx0atAyB1uj0RZyr+5izWXnY+zOkRnKM1e+PiwDHFwECgYEA++8fnEhBMlISOrhB
+J4GbV7tov2X9x3YCHeuAd3/50pucrWQVbAkL2F9kYLjLP4HMQKqC33OinOuJfrkU
+KBmfi+6xPShRxpIjzVkvdWUgkbpJeMtfWOJ+meMAHTRdO+vqGZgmBSelYeO9PYVU
+OFfOuiZbvbcz900rHoIWrsEStWECgYEAwR31p0LTr9yWgzQTpNYTaUG5jFXBkB3i
+8Kc0gtDijeLuXGsD5DUuKp3uD8l4YoIIDojFEWiy4Fy0/C1dVHM3xTjB9VgS13I/
+/Wl428TQlGEM4YTMkxDDaKw7y51rRq7g3SMSa212FYqOz1JQ4uR4I842MMtpyAH8
+lNn+IVkA+XkCgYBOLq0OoNWquhFyK4/8pJoCpeQh0ZLp/VM22ciqTQrIMwZyQKbt
+Ofl1ElViNrbMZIlwX/nxQj9qlyW6L9FziFAc6twR8JtAFkYKCe1SbymmT7tRQzu5
+p8BGHU4BwihU2idx/ed+ngkS0cv+dYvnWEiNOC4sN9hmnIoPE6vaW4xkwQKBgCRB
+i60rTrLlpxxa2pVH270XKc6/CugTtFeaDLHCpcYdpMKVFNXzZgd6PweXu5JC92BD
+LTxne63DufbeTXddaksMrN1y+5aXTIw3EQmxmbdBwTlVxVKXAxjTvSYtF8bdbjoW
+K48frdu9d7JUsfrnCecu/92JUwLJ3LHVe3CnVReBAoGBAOA2oIXTin1nl7gHDaTO
+S/oWzZGaDNXhC3Jbx58wTTtm0l7WgIWRoQN0sxjHMcwjM9WWRyN+D2RG8eANXSsZ
+O4w42OE1bCY9AXWsV24t0wfRZogRmjmIMIQdMrFogBdDHT+qL05bkLLqZ501npEy
+HvQbWGaqr5d/BS1tWF6WO10K
+-----END PRIVATE KEY-----
diff --git a/GA-Schloss/openvpn/keys/ta.key b/GA-Schloss/openvpn/keys/ta.key
new file mode 100644
index 0000000..70f679f
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/ta.key
@@ -0,0 +1,21 @@
+#
+# 2048 bit OpenVPN static key
+#
+-----BEGIN OpenVPN Static key V1-----
+2e6c91c0db488d5f018432f60605fbba
+5ec1afd4522ddd28d917ade2c7515daf
+9a7a3104b523c929f10a2ccdd2197b83
+949e5644669ab0f82b62e08aa887252a
+cc20618f9f8c1b0eeded6ea92a392e79
+e477a890e2800cf0cf340ac6139cf7a6
+0cfc5c713a39e8b2c44347006bb90583
+8fe0bccf4feea50e7880ee7c7c510114
+e9613960f8af9096fc46d75886b1bdbd
+773b77d9044db17109a5615614797b98
+bdacaae155966bad69819d08f1c8cafa
+1cf102981e2188d155d26043b59538b9
+15c1d67430d6b67c9c313123fb7cb427
+29cc6972e63470c74c6bf2342fb57ba3
+50d3254df49d2158f4faf5bc38fa9d69
+1014d126eac903e30f6c97df69a3b665
+-----END OpenVPN Static key V1-----
diff --git a/GA-Schloss/openvpn/keys/wadmin.crt b/GA-Schloss/openvpn/keys/wadmin.crt
new file mode 100644
index 0000000..4efaf5f
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/wadmin.crt
@@ -0,0 +1,99 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 3 (0x3)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Validity
+            Not Before: Oct  9 15:54:15 2015 GMT
+            Not After : Oct  9 15:54:15 2035 GMT
+        Subject: C=DE, ST=Hessen, L=Stockhausen, O=GA Altenschlirf, OU=Network Services, CN=wadmin/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b6:f8:b1:f2:dd:fd:65:5f:86:7e:3f:39:d0:f2:
+                    ca:b4:f5:64:ea:5a:79:9f:cc:14:7b:ed:7a:3f:be:
+                    8d:ba:6a:d6:89:92:1a:26:c4:11:4e:86:10:8c:71:
+                    d4:f9:d1:bd:d7:65:2f:56:81:1e:38:81:61:fd:62:
+                    f4:5b:3c:c8:34:9d:00:47:ee:16:a0:52:a9:ca:df:
+                    09:d0:94:c1:7d:cd:f7:a7:0c:7a:ce:d1:4a:c5:99:
+                    56:29:32:f9:b4:fb:d3:4a:36:1d:ff:b7:9f:50:c8:
+                    ca:2d:a0:31:77:8b:09:fa:15:08:fe:42:f4:3e:dd:
+                    98:cb:bb:19:d2:d0:57:50:a9:4d:93:dd:91:39:3e:
+                    4f:38:32:6d:b8:99:f9:ea:93:47:28:82:e9:75:f5:
+                    4b:c2:55:3b:65:ae:5d:f6:4c:d2:c6:9d:18:86:eb:
+                    4d:83:36:e4:ab:c1:66:cf:77:f7:0b:fa:3d:9b:1f:
+                    40:2b:28:01:c0:88:c7:bc:18:83:26:b7:41:5e:9e:
+                    8c:d2:fe:e9:39:d4:ec:2b:be:4d:7e:fd:a0:dc:04:
+                    b4:00:e4:ca:85:59:01:55:a8:d3:48:be:41:12:7c:
+                    8e:ee:79:8d:a7:89:ad:ab:71:a8:d0:d1:a9:ce:9f:
+                    7e:a4:2a:17:26:18:90:bf:13:d9:f1:a3:be:a6:b9:
+                    09:51
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                Easy-RSA Generated Certificate
+            X509v3 Subject Key Identifier: 
+                B9:71:69:E0:F6:17:0F:A6:D3:C4:AF:28:C6:A5:B1:E9:58:2F:6C:86
+            X509v3 Authority Key Identifier: 
+                keyid:35:9F:DB:0D:86:40:F9:65:0E:E3:45:79:CE:37:98:0D:28:57:95:59
+                DirName:/C=DE/ST=Hessen/L=Stockhausen/O=GA Altenschlirf/OU=Network Services/CN=VPN-GA-ca/name=VPN GA/emailAddress=it@gemeinschaft-altenschlirf.de
+                serial:D5:C5:AB:CB:22:8D:D3:9B
+
+            X509v3 Extended Key Usage: 
+                TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature
+            X509v3 Subject Alternative Name: 
+                DNS:wadmin
+    Signature Algorithm: sha256WithRSAEncryption
+         99:1d:d1:a2:eb:8c:d5:89:c3:1f:0a:8f:10:85:99:92:f6:58:
+         da:99:b3:d3:01:9a:b4:7c:b2:9b:61:9e:7f:dd:41:24:ec:75:
+         19:82:35:aa:2b:74:14:29:55:6c:74:08:d0:18:95:8f:b9:1e:
+         12:1e:80:78:58:b5:e0:b0:f5:08:17:d9:36:e9:42:a1:a6:cc:
+         7a:be:92:a7:f3:9b:6b:2f:d8:db:4b:50:ca:dd:f2:de:90:d9:
+         2a:2e:8d:81:76:7e:a0:2e:28:a0:3d:e6:fc:31:4b:d7:b4:6d:
+         7f:a0:f9:f1:6f:d8:ea:7d:a2:e0:a6:2e:db:52:96:2c:7a:b6:
+         10:5a:15:bb:07:34:88:5f:74:d2:6c:e6:7e:f1:7f:20:47:56:
+         be:78:be:1e:37:35:79:c1:a9:0d:bf:df:11:7d:09:97:c7:93:
+         9c:27:11:5b:b4:99:fe:fc:77:2b:39:52:7c:a7:d5:85:1c:71:
+         b9:4f:45:ce:48:bf:04:8e:25:87:3b:ad:55:54:ea:4c:2c:38:
+         8f:14:c2:49:d1:62:c4:d5:bc:4d:94:5f:4f:8f:bf:19:25:f0:
+         20:f9:2d:3c:ca:18:d2:7c:2f:f9:ca:a4:fd:3e:7a:67:74:d9:
+         fc:b6:74:e9:40:61:7d:5f:1e:97:a3:d4:2a:11:53:a5:e6:08:
+         b4:4c:56:bb
+-----BEGIN CERTIFICATE-----
+MIIFgDCCBGigAwIBAgIBAzANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMCREUx
+DzANBgNVBAgTBkhlc3NlbjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoT
+D0dBIEFsdGVuc2NobGlyZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczESMBAG
+A1UEAxMJVlBOLUdBLWNhMQ8wDQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEW
+H2l0QGdlbWVpbnNjaGFmdC1hbHRlbnNjaGxpcmYuZGUwHhcNMTUxMDA5MTU1NDE1
+WhcNMzUxMDA5MTU1NDE1WjCBuzELMAkGA1UEBhMCREUxDzANBgNVBAgTBkhlc3Nl
+bjEUMBIGA1UEBxMLU3RvY2toYXVzZW4xGDAWBgNVBAoTD0dBIEFsdGVuc2NobGly
+ZjEZMBcGA1UECxMQTmV0d29yayBTZXJ2aWNlczEPMA0GA1UEAxMGd2FkbWluMQ8w
+DQYDVQQpEwZWUE4gR0ExLjAsBgkqhkiG9w0BCQEWH2l0QGdlbWVpbnNjaGFmdC1h
+bHRlbnNjaGxpcmYuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2
++LHy3f1lX4Z+PznQ8sq09WTqWnmfzBR77Xo/vo26ataJkhomxBFOhhCMcdT50b3X
+ZS9WgR44gWH9YvRbPMg0nQBH7hagUqnK3wnQlMF9zfenDHrO0UrFmVYpMvm0+9NK
+Nh3/t59QyMotoDF3iwn6FQj+QvQ+3ZjLuxnS0FdQqU2T3ZE5Pk84Mm24mfnqk0co
+gul19UvCVTtlrl32TNLGnRiG602DNuSrwWbPd/cL+j2bH0ArKAHAiMe8GIMmt0Fe
+nozS/uk51Owrvk1+/aDcBLQA5MqFWQFVqNNIvkESfI7ueY2nia2rcajQ0anOn36k
+KhcmGJC/E9nxo76muQlRAgMBAAGjggGIMIIBhDAJBgNVHRMEAjAAMC0GCWCGSAGG
++EIBDQQgFh5FYXN5LVJTQSBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYE
+FLlxaeD2Fw+m08SvKMalselYL2yGMIHzBgNVHSMEgeswgeiAFDWf2w2GQPllDuNF
+ec43mA0oV5VZoYHEpIHBMIG+MQswCQYDVQQGEwJERTEPMA0GA1UECBMGSGVzc2Vu
+MRQwEgYDVQQHEwtTdG9ja2hhdXNlbjEYMBYGA1UEChMPR0EgQWx0ZW5zY2hsaXJm
+MRkwFwYDVQQLExBOZXR3b3JrIFNlcnZpY2VzMRIwEAYDVQQDEwlWUE4tR0EtY2Ex
+DzANBgNVBCkTBlZQTiBHQTEuMCwGCSqGSIb3DQEJARYfaXRAZ2VtZWluc2NoYWZ0
+LWFsdGVuc2NobGlyZi5kZYIJANXFq8sijdObMBMGA1UdJQQMMAoGCCsGAQUFBwMC
+MAsGA1UdDwQEAwIHgDARBgNVHREECjAIggZ3YWRtaW4wDQYJKoZIhvcNAQELBQAD
+ggEBAJkd0aLrjNWJwx8KjxCFmZL2WNqZs9MBmrR8spthnn/dQSTsdRmCNaordBQp
+VWx0CNAYlY+5HhIegHhYteCw9QgX2TbpQqGmzHq+kqfzm2sv2NtLUMrd8t6Q2Sou
+jYF2fqAuKKA95vwxS9e0bX+g+fFv2Op9ouCmLttSlix6thBaFbsHNIhfdNJs5n7x
+fyBHVr54vh43NXnBqQ2/3xF9CZfHk5wnEVu0mf78dys5Unyn1YUccblPRc5IvwSO
+JYc7rVVU6kwsOI8UwknRYsTVvE2UX0+Pvxkl8CD5LTzKGNJ8L/nKpP0+emd02fy2
+dOlAYX1fHpej1CoRU6XmCLRMVrs=
+-----END CERTIFICATE-----
diff --git a/GA-Schloss/openvpn/keys/wadmin.csr b/GA-Schloss/openvpn/keys/wadmin.csr
new file mode 100644
index 0000000..0caf9f9
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/wadmin.csr
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIDATCCAekCAQAwgbsxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNzZW4xFDAS
+BgNVBAcTC1N0b2NraGF1c2VuMRgwFgYDVQQKEw9HQSBBbHRlbnNjaGxpcmYxGTAX
+BgNVBAsTEE5ldHdvcmsgU2VydmljZXMxDzANBgNVBAMTBndhZG1pbjEPMA0GA1UE
+KRMGVlBOIEdBMS4wLAYJKoZIhvcNAQkBFh9pdEBnZW1laW5zY2hhZnQtYWx0ZW5z
+Y2hsaXJmLmRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtvix8t39
+ZV+Gfj850PLKtPVk6lp5n8wUe+16P76NumrWiZIaJsQRToYQjHHU+dG912UvVoEe
+OIFh/WL0WzzINJ0AR+4WoFKpyt8J0JTBfc33pwx6ztFKxZlWKTL5tPvTSjYd/7ef
+UMjKLaAxd4sJ+hUI/kL0Pt2Yy7sZ0tBXUKlNk92ROT5PODJtuJn56pNHKILpdfVL
+wlU7Za5d9kzSxp0YhutNgzbkq8Fmz3f3C/o9mx9AKygBwIjHvBiDJrdBXp6M0v7p
+OdTsK75Nfv2g3AS0AOTKhVkBVajTSL5BEnyO7nmNp4mtq3Go0NGpzp9+pCoXJhiQ
+vxPZ8aO+prkJUQIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBALEFfyQawpvGPUqd
+/8l/cvrmgTplTcoHOG+GR6VIeY8nMuOXtX28lQRyORStukZLAxqYgd4xBETYfFIX
+FNMtHeouUD716OLaiVrGX3Vi5gY86fL1Uw5Rssu4Chc3EF2bbbkhZDQSBSKldMwU
+xU2IIstX4HRy1a0IyXhQviU53NZinnAAw7w30mc5M8HRZxN3VI/cU0vObCCnly45
+u98I/e1ETpu2pUFtylKDo7TkmCI5dZIXlNzB5CqSupWXN4cDcpjwg1pdL2Xbp2Vv
+APev0quH5IJDrbcEoMHNLnELAnWvWFEni+VPzzLPwdhMCB960RkRV2PcmqwPVp2p
+8j3GLQE=
+-----END CERTIFICATE REQUEST-----
diff --git a/GA-Schloss/openvpn/keys/wadmin.key b/GA-Schloss/openvpn/keys/wadmin.key
new file mode 100644
index 0000000..881c272
--- /dev/null
+++ b/GA-Schloss/openvpn/keys/wadmin.key
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIzVaR+NyEkEkCAggA
+MBQGCCqGSIb3DQMHBAiFw7KoOWsYqgSCBMiuQLtxLOKWhpBuVPz4uoFiEen3XBj6
+vKSobxJ59Nam63+KYVJ9JmSY5kbvNQ6fUzLyui/UviG2yK+asxokiTQd7w+86ZAZ
+XtAw13gbdT5yodm3/Lja1IMBDszX+L+E54lTXUkr/xLKfb2A+y/dE/vq4YaWoGya
+AKMwZOqxD1JKTW2S+gLnP/9qaaavNCYoBqwve0T/VnphFyS6UlqvWtS2KHCncI7y
+YOHj+QiPbunqQilWoft3ZGQlBHwqUMCIVHr5xaJ/bYpKprSmnfFb2a7LZ9lsLFgL
+Bzi0EBrvAWILMbNE3h67scHMGNdGDm8XfAH90l2YyumEG3OyNbmN+ci4F1+dDElk
+GMeOjw4jw0ni12P2R9RfnB/CyxxdJw+SuFSf49wqcPfJFWll50sdrPGGPhcAGxbL
+SGfJhXqZ4V97Uh6lBZoYxiz0jeL5LzluUHvDHe1NcibZ/yDeAxW5wkCZ1FslPzXX
+NW+fEDFU0cTdOPdP1IerN5JNHc333XkpdGNfnRiMmB3c+1vOzTd56SblIS0C/kKO
+WzyZzesjSoI1xeKEEB74LPPexr++dIYGyyuaxC7t5o9QygRBOuWJ1AOr9dIJ7wsN
+lSNVlLPltkkKtirrpYt4XpHEOLWpI09zYeP7aPhHrxYT8OMQ/lIo+pEFRp+K4Fi2
+pMo5syDbLa53WRMdP7aSd79IvRxFPYjAcnTNjcXFsSsi8HeGQ5QBSL/DhbUUnM6R
+DUbFAJFBFQoYeEoPHtyJdWBsq0AKsIht61LcqRxWx+Dd6rVLf/1jaEUdFY51/N7Z
+KpCpE2Tbv2M5+FemApmlZy/LHMARuus+mwwfnUT9x2kZR9+O6ay5ArHpFBuZBca5
+ro4H3xOIVEU2fc+4ve0OEEZ5mQkizJIo71Dmi7xN1uTu+Cj8XjcW4l2ZHgONv25f
+5qqriu4SBwUyJ16rH3s3g9P+RN8XXaxvlqft6NT4vjwFWyB65qWiMAuLfsWjnlBZ
+D4xqrpk5SnWKbwcjxv2Yzuuhme3fAJ8fzHSEXbucgaNiU2DwdE6dDgX5VrYaGGHa
+aKm4wY/dSsk7a2E5DXb6W6ersf9e67DNZOnjDTMD/Iz6hnWMwH4G0Z78ipB2wKSB
+JhFoAMFnjnteGE33ti0LiGanmPzctF9g5kKlqUQoedvYKHbTop0/8X2EJKp6PRyk
+IVX2seHV2nNTc5CWXLuY4jhRl42NHtwWz/ZI0R8uF0Ue0rENB1EnQy+zC5Ytwu9E
+wq1q7mHJHoZvO0qsCO4C+WMq6Nl9lHrrZznAfAV2uPYlQ9ZfOe1s68ETVDugqs3n
+PG+HH8D/TpzSDXaoeoNfYiWkmwdpizVANmLHWF4bra/4WNOh4HEC7kZ7zZqA+m1T
+pAG0hceOe1DrMH2xemgtOee4/yuX7Jwf4dQA5aAqTAs5ZWMK6CGCAZohsMCODq+b
+0LUhFT/oBQlrtWq5YRq3NMZVIDhcJc2w6kPS8Gg2HT2JgchcixYnm8PiBR7QtOC1
+6YpBUxwDBAt/gBgZzVgEo0fl4A+FLj41GPv1MODhZ90G9jo9hi26c+v4He4pNEGw
+l5+27/bONC4cQAYLXSafYpXgphe3Pug9LFi1bFGdIAbl8zrJyxEl7SCOjrvpdK6v
+B1o=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/GA-Schloss/openvpn/server-gw-ckubu.conf b/GA-Schloss/openvpn/server-gw-ckubu.conf
new file mode 100644
index 0000000..fabc43c
--- /dev/null
+++ b/GA-Schloss/openvpn/server-gw-ckubu.conf
@@ -0,0 +1,300 @@
+#################################################
+# Sample OpenVPN 2.0 config file for            #
+# multi-client server.                          #
+#                                               #
+# This file is for the server side              #
+# of a many-clients <-> one-server              #
+# OpenVPN configuration.                        #
+#                                               #
+# OpenVPN also supports                         #
+# single-machine <-> single-machine             #
+# configurations (See the Examples page         #
+# on the web site for more info).               #
+#                                               #
+# This config should work on Windows            #
+# or Linux/BSD systems.  Remember on            #
+# Windows to quote pathnames and use            #
+# double backslashes, e.g.:                     #
+# "C:\\Program Files\\OpenVPN\\config\\foo.key" #
+#                                               #
+# Comments are preceded with '#' or ';'         #
+#################################################
+
+# Which local IP address should OpenVPN
+# listen on? (optional)
+;local a.b.c.d
+
+# Which TCP/UDP port should OpenVPN listen on?
+# If you want to run multiple OpenVPN instances
+# on the same machine, use a different port
+# number for each one.  You will need to
+# open up this port on your firewall.
+port 1195
+
+# TCP or UDP server?
+;proto tcp
+proto udp
+
+
+topology subnet
+route 192.168.63.0 255.255.255.0 10.1.11.1
+route 192.168.64.0 255.255.255.0 10.1.11.1
+
+# "dev tun" will create a routed IP tunnel,
+# "dev tap" will create an ethernet tunnel.
+# Use "dev tap" if you are ethernet bridging.
+# If you want to control access policies
+# over the VPN, you must create firewall
+# rules for the the TUN/TAP interface.
+# On non-Windows systems, you can give
+# an explicit unit number, such as tun0.
+# On Windows, use "dev-node" for this.
+# On most systems, the VPN will not function
+# unless you partially or fully disable
+# the firewall for the TUN/TAP interface.
+;dev tap
+dev tun
+
+# Windows needs the TAP-Win32 adapter name
+# from the Network Connections panel if you
+# have more than one.  On XP SP2 or higher,
+# you may need to selectively disable the
+# Windows firewall for the TAP adapter.
+# Non-Windows systems usually don't need this.
+;dev-node MyTap
+
+# SSL/TLS root certificate (ca), certificate
+# (cert), and private key (key).  Each client
+# and the server must have their own cert and
+# key file.  The server and all clients will
+# use the same ca file.
+#
+# See the "easy-rsa" directory for a series
+# of scripts for generating RSA certificates
+# and private keys.  Remember to use
+# a unique Common Name for the server
+# and each of the client certificates.
+#
+# Any X509 key management system can be used.
+# OpenVPN can also use a PKCS #12 formatted key file
+# (see "pkcs12" directive in man page).
+ca keys/ca.crt
+cert keys/server.crt
+key keys/server.key  # This file should be kept secret
+
+# Diffie hellman parameters.
+# Generate your own with:
+#   openssl dhparam -out dh1024.pem 1024
+# Substitute 2048 for 1024 if you are using
+# 2048 bit keys. 
+dh keys/dh2048.pem
+
+# Configure server mode and supply a VPN subnet
+# for OpenVPN to draw client addresses from.
+# The server will take 10.8.0.1 for itself,
+# the rest will be made available to clients.
+# Each client will be able to reach the server
+# on 10.8.0.1. Comment this line out if you are
+# ethernet bridging. See the man page for more info.
+server 10.1.11.0 255.255.255.0
+
+# Maintain a record of client <-> virtual IP address
+# associations in this file.  If OpenVPN goes down or
+# is restarted, reconnecting clients can be assigned
+# the same virtual IP address from the pool that was
+# previously assigned.
+ifconfig-pool-persist /etc/openvpn/ipp.txt
+
+# Configure server mode for ethernet bridging.
+# You must first use your OS's bridging capability
+# to bridge the TAP interface with the ethernet
+# NIC interface.  Then you must manually set the
+# IP/netmask on the bridge interface, here we
+# assume 10.8.0.4/255.255.255.0.  Finally we
+# must set aside an IP range in this subnet
+# (start=10.8.0.50 end=10.8.0.100) to allocate
+# to connecting clients.  Leave this line commented
+# out unless you are ethernet bridging.
+;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
+
+# Push routes to the client to allow it
+# to reach other private subnets behind
+# the server.  Remember that these
+# private subnets will also need
+# to know to route the OpenVPN client
+# address pool (10.8.0.0/255.255.255.0)
+# back to the OpenVPN server.
+;push "route 192.168.23.0 255.255.255.0"
+;push "route 192.168.81.0 255.255.255.0"
+
+# To assign specific IP addresses to specific
+# clients or if a connecting client has a private
+# subnet behind it that should also have VPN access,
+# use the subdirectory "ccd" for client-specific
+# configuration files (see man page for more info).
+
+# EXAMPLE: Suppose the client
+# having the certificate common name "Thelonious"
+# also has a small subnet behind his connecting
+# machine, such as 192.168.40.128/255.255.255.248.
+# First, uncomment out these lines:
+client-config-dir /etc/openvpn/ccd/server-gw-ckubu
+;route 192.168.40.128 255.255.255.248
+# Then create a file ccd/Thelonious with this line:
+#   iroute 192.168.40.128 255.255.255.248
+# This will allow Thelonious' private subnet to
+# access the VPN.  This example will only work
+# if you are routing, not bridging, i.e. you are
+# using "dev tun" and "server" directives.
+
+# EXAMPLE: Suppose you want to give
+# Thelonious a fixed VPN IP address of 10.9.0.1.
+# First uncomment out these lines:
+;client-config-dir ccd
+;route 10.9.0.0 255.255.255.252
+# Then add this line to ccd/Thelonious:
+#   ifconfig-push 10.9.0.1 10.9.0.2
+
+# Suppose that you want to enable different
+# firewall access policies for different groups
+# of clients.  There are two methods:
+# (1) Run multiple OpenVPN daemons, one for each
+#     group, and firewall the TUN/TAP interface
+#     for each group/daemon appropriately.
+# (2) (Advanced) Create a script to dynamically
+#     modify the firewall in response to access
+#     from different clients.  See man
+#     page for more info on learn-address script.
+;learn-address ./script
+
+# If enabled, this directive will configure
+# all clients to redirect their default
+# network gateway through the VPN, causing
+# all IP traffic such as web browsing and
+# and DNS lookups to go through the VPN
+# (The OpenVPN server machine may need to NAT
+# the TUN/TAP interface to the internet in
+# order for this to work properly).
+# CAVEAT: May break client's network config if
+# client's local DHCP server packets get routed
+# through the tunnel.  Solution: make sure
+# client's local DHCP server is reachable via
+# a more specific route than the default route
+# of 0.0.0.0/0.0.0.0.
+;push "redirect-gateway"
+
+# Certain Windows-specific network settings
+# can be pushed to clients, such as DNS
+# or WINS server addresses.  CAVEAT:
+# http://openvpn.net/faq.html#dhcpcaveats
+;push "dhcp-option DNS 10.8.0.1"
+;push "dhcp-option WINS 10.8.0.1"
+;push "dhcp-option DNS 192.168.11.1"
+;push "dhcp-option DOMAIN ga.intra"
+
+# Uncomment this directive to allow different
+# clients to be able to "see" each other.
+# By default, clients will only see the server.
+# To force clients to only see the server, you
+# will also need to appropriately firewall the
+# server's TUN/TAP interface.
+client-to-client
+
+# Uncomment this directive if multiple clients
+# might connect with the same certificate/key
+# files or common names.  This is recommended
+# only for testing purposes.  For production use,
+# each client should have its own certificate/key
+# pair.
+#
+# IF YOU HAVE NOT GENERATED INDIVIDUAL
+# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
+# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
+# UNCOMMENT THIS LINE OUT.
+;duplicate-cn
+
+# The keepalive directive causes ping-like
+# messages to be sent back and forth over
+# the link so that each side knows when
+# the other side has gone down.
+# Ping every 10 seconds, assume that remote
+# peer is down if no ping received during
+# a 120 second time period.
+keepalive 10 120
+
+# For extra security beyond that provided
+# by SSL/TLS, create an "HMAC firewall"
+# to help block DoS attacks and UDP port flooding.
+#
+# Generate with:
+#   openvpn --genkey --secret ta.key
+#
+# The server and each client must have
+# a copy of this key.
+# The second parameter should be '0'
+# on the server and '1' on the clients.
+;tls-auth ta.key 0 # This file is secret
+tls-auth keys/ta.key 0
+
+# Select a cryptographic cipher.
+# This config item must be copied to
+# the client config file as well.
+;cipher BF-CBC        # Blowfish (default)
+;cipher AES-128-CBC   # AES
+;cipher DES-EDE3-CBC  # Triple-DES
+
+# Enable compression on the VPN link.
+# If you enable it here, you must also
+# enable it in the client config file.
+comp-lzo
+
+# The maximum number of concurrently connected
+# clients we want to allow.
+;max-clients 100
+
+# It's a good idea to reduce the OpenVPN
+# daemon's privileges after initialization.
+#
+# You can uncomment this out on
+# non-Windows systems.
+user nobody
+group nogroup
+
+# The persist options will try to avoid
+# accessing certain resources on restart
+# that may no longer be accessible because
+# of the privilege downgrade.
+persist-key
+persist-tun
+persist-local-ip
+persist-remote-ip
+# Output a short status file showing
+# current connections, truncated
+# and rewritten every minute.
+status /var/log/openvpn/status-server-gw-ckubu.log
+
+# By default, log messages will go to the syslog (or
+# on Windows, if running as a service, they will go to
+# the "\Program Files\OpenVPN\log" directory).
+# Use log or log-append to override this default.
+# "log" will truncate the log file on OpenVPN startup,
+# while "log-append" will append to it.  Use one
+# or the other (but not both).
+log         /var/log/openvpn/server-gw-ckubu.log
+;log-append  openvpn.log
+
+# Set the appropriate level of log
+# file verbosity.
+#
+# 0 is silent, except for fatal errors
+# 4 is reasonable for general usage
+# 5 and 6 can help to debug connection problems
+# 9 is extremely verbose
+verb 4
+
+# Silence repeating messages.  At most 20
+# sequential messages of the same message
+# category will be output to the log.
+;mute 20
+
+#crl-verify /etc/openvpn/keys/crl.pem
diff --git a/GA-Schloss/openvpn/server-gw-nh.conf b/GA-Schloss/openvpn/server-gw-nh.conf
new file mode 100644
index 0000000..ae57ef8
--- /dev/null
+++ b/GA-Schloss/openvpn/server-gw-nh.conf
@@ -0,0 +1,299 @@
+#################################################
+# Sample OpenVPN 2.0 config file for            #
+# multi-client server.                          #
+#                                               #
+# This file is for the server side              #
+# of a many-clients <-> one-server              #
+# OpenVPN configuration.                        #
+#                                               #
+# OpenVPN also supports                         #
+# single-machine <-> single-machine             #
+# configurations (See the Examples page         #
+# on the web site for more info).               #
+#                                               #
+# This config should work on Windows            #
+# or Linux/BSD systems.  Remember on            #
+# Windows to quote pathnames and use            #
+# double backslashes, e.g.:                     #
+# "C:\\Program Files\\OpenVPN\\config\\foo.key" #
+#                                               #
+# Comments are preceded with '#' or ';'         #
+#################################################
+
+# Which local IP address should OpenVPN
+# listen on? (optional)
+;local a.b.c.d
+
+# Which TCP/UDP port should OpenVPN listen on?
+# If you want to run multiple OpenVPN instances
+# on the same machine, use a different port
+# number for each one.  You will need to
+# open up this port on your firewall.
+port 1196
+
+# TCP or UDP server?
+;proto tcp
+proto udp
+
+
+topology subnet
+route 192.168.81.0 255.255.255.0 10.2.11.1
+
+# "dev tun" will create a routed IP tunnel,
+# "dev tap" will create an ethernet tunnel.
+# Use "dev tap" if you are ethernet bridging.
+# If you want to control access policies
+# over the VPN, you must create firewall
+# rules for the the TUN/TAP interface.
+# On non-Windows systems, you can give
+# an explicit unit number, such as tun0.
+# On Windows, use "dev-node" for this.
+# On most systems, the VPN will not function
+# unless you partially or fully disable
+# the firewall for the TUN/TAP interface.
+;dev tap
+dev tun
+
+# Windows needs the TAP-Win32 adapter name
+# from the Network Connections panel if you
+# have more than one.  On XP SP2 or higher,
+# you may need to selectively disable the
+# Windows firewall for the TAP adapter.
+# Non-Windows systems usually don't need this.
+;dev-node MyTap
+
+# SSL/TLS root certificate (ca), certificate
+# (cert), and private key (key).  Each client
+# and the server must have their own cert and
+# key file.  The server and all clients will
+# use the same ca file.
+#
+# See the "easy-rsa" directory for a series
+# of scripts for generating RSA certificates
+# and private keys.  Remember to use
+# a unique Common Name for the server
+# and each of the client certificates.
+#
+# Any X509 key management system can be used.
+# OpenVPN can also use a PKCS #12 formatted key file
+# (see "pkcs12" directive in man page).
+ca keys/ca.crt
+cert keys/server.crt
+key keys/server.key  # This file should be kept secret
+
+# Diffie hellman parameters.
+# Generate your own with:
+#   openssl dhparam -out dh1024.pem 1024
+# Substitute 2048 for 1024 if you are using
+# 2048 bit keys. 
+dh keys/dh2048.pem
+
+# Configure server mode and supply a VPN subnet
+# for OpenVPN to draw client addresses from.
+# The server will take 10.8.0.1 for itself,
+# the rest will be made available to clients.
+# Each client will be able to reach the server
+# on 10.8.0.1. Comment this line out if you are
+# ethernet bridging. See the man page for more info.
+server 10.2.11.0 255.255.255.0
+
+# Maintain a record of client <-> virtual IP address
+# associations in this file.  If OpenVPN goes down or
+# is restarted, reconnecting clients can be assigned
+# the same virtual IP address from the pool that was
+# previously assigned.
+ifconfig-pool-persist /etc/openvpn/ipp.txt
+
+# Configure server mode for ethernet bridging.
+# You must first use your OS's bridging capability
+# to bridge the TAP interface with the ethernet
+# NIC interface.  Then you must manually set the
+# IP/netmask on the bridge interface, here we
+# assume 10.8.0.4/255.255.255.0.  Finally we
+# must set aside an IP range in this subnet
+# (start=10.8.0.50 end=10.8.0.100) to allocate
+# to connecting clients.  Leave this line commented
+# out unless you are ethernet bridging.
+;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
+
+# Push routes to the client to allow it
+# to reach other private subnets behind
+# the server.  Remember that these
+# private subnets will also need
+# to know to route the OpenVPN client
+# address pool (10.8.0.0/255.255.255.0)
+# back to the OpenVPN server.
+;push "route 192.168.23.0 255.255.255.0"
+;push "route 192.168.81.0 255.255.255.0"
+
+# To assign specific IP addresses to specific
+# clients or if a connecting client has a private
+# subnet behind it that should also have VPN access,
+# use the subdirectory "ccd" for client-specific
+# configuration files (see man page for more info).
+
+# EXAMPLE: Suppose the client
+# having the certificate common name "Thelonious"
+# also has a small subnet behind his connecting
+# machine, such as 192.168.40.128/255.255.255.248.
+# First, uncomment out these lines:
+client-config-dir /etc/openvpn/ccd/server-gw-nh
+;route 192.168.40.128 255.255.255.248
+# Then create a file ccd/Thelonious with this line:
+#   iroute 192.168.40.128 255.255.255.248
+# This will allow Thelonious' private subnet to
+# access the VPN.  This example will only work
+# if you are routing, not bridging, i.e. you are
+# using "dev tun" and "server" directives.
+
+# EXAMPLE: Suppose you want to give
+# Thelonious a fixed VPN IP address of 10.9.0.1.
+# First uncomment out these lines:
+;client-config-dir ccd
+;route 10.9.0.0 255.255.255.252
+# Then add this line to ccd/Thelonious:
+#   ifconfig-push 10.9.0.1 10.9.0.2
+
+# Suppose that you want to enable different
+# firewall access policies for different groups
+# of clients.  There are two methods:
+# (1) Run multiple OpenVPN daemons, one for each
+#     group, and firewall the TUN/TAP interface
+#     for each group/daemon appropriately.
+# (2) (Advanced) Create a script to dynamically
+#     modify the firewall in response to access
+#     from different clients.  See man
+#     page for more info on learn-address script.
+;learn-address ./script
+
+# If enabled, this directive will configure
+# all clients to redirect their default
+# network gateway through the VPN, causing
+# all IP traffic such as web browsing and
+# and DNS lookups to go through the VPN
+# (The OpenVPN server machine may need to NAT
+# the TUN/TAP interface to the internet in
+# order for this to work properly).
+# CAVEAT: May break client's network config if
+# client's local DHCP server packets get routed
+# through the tunnel.  Solution: make sure
+# client's local DHCP server is reachable via
+# a more specific route than the default route
+# of 0.0.0.0/0.0.0.0.
+;push "redirect-gateway"
+
+# Certain Windows-specific network settings
+# can be pushed to clients, such as DNS
+# or WINS server addresses.  CAVEAT:
+# http://openvpn.net/faq.html#dhcpcaveats
+;push "dhcp-option DNS 10.8.0.1"
+;push "dhcp-option WINS 10.8.0.1"
+push "dhcp-option DNS 192.168.11.1"
+push "dhcp-option DOMAIN ga.intra"
+
+# Uncomment this directive to allow different
+# clients to be able to "see" each other.
+# By default, clients will only see the server.
+# To force clients to only see the server, you
+# will also need to appropriately firewall the
+# server's TUN/TAP interface.
+client-to-client
+
+# Uncomment this directive if multiple clients
+# might connect with the same certificate/key
+# files or common names.  This is recommended
+# only for testing purposes.  For production use,
+# each client should have its own certificate/key
+# pair.
+#
+# IF YOU HAVE NOT GENERATED INDIVIDUAL
+# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
+# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
+# UNCOMMENT THIS LINE OUT.
+;duplicate-cn
+
+# The keepalive directive causes ping-like
+# messages to be sent back and forth over
+# the link so that each side knows when
+# the other side has gone down.
+# Ping every 10 seconds, assume that remote
+# peer is down if no ping received during
+# a 120 second time period.
+keepalive 10 120
+
+# For extra security beyond that provided
+# by SSL/TLS, create an "HMAC firewall"
+# to help block DoS attacks and UDP port flooding.
+#
+# Generate with:
+#   openvpn --genkey --secret ta.key
+#
+# The server and each client must have
+# a copy of this key.
+# The second parameter should be '0'
+# on the server and '1' on the clients.
+;tls-auth ta.key 0 # This file is secret
+tls-auth keys/ta.key 0
+
+# Select a cryptographic cipher.
+# This config item must be copied to
+# the client config file as well.
+;cipher BF-CBC        # Blowfish (default)
+;cipher AES-128-CBC   # AES
+;cipher DES-EDE3-CBC  # Triple-DES
+
+# Enable compression on the VPN link.
+# If you enable it here, you must also
+# enable it in the client config file.
+comp-lzo
+
+# The maximum number of concurrently connected
+# clients we want to allow.
+;max-clients 100
+
+# It's a good idea to reduce the OpenVPN
+# daemon's privileges after initialization.
+#
+# You can uncomment this out on
+# non-Windows systems.
+user nobody
+group nogroup
+
+# The persist options will try to avoid
+# accessing certain resources on restart
+# that may no longer be accessible because
+# of the privilege downgrade.
+persist-key
+persist-tun
+persist-local-ip
+persist-remote-ip
+# Output a short status file showing
+# current connections, truncated
+# and rewritten every minute.
+status /var/log/openvpn/status-server-gw-nh.log
+
+# By default, log messages will go to the syslog (or
+# on Windows, if running as a service, they will go to
+# the "\Program Files\OpenVPN\log" directory).
+# Use log or log-append to override this default.
+# "log" will truncate the log file on OpenVPN startup,
+# while "log-append" will append to it.  Use one
+# or the other (but not both).
+log         /var/log/openvpn/server-gw-nh.log
+;log-append  openvpn.log
+
+# Set the appropriate level of log
+# file verbosity.
+#
+# 0 is silent, except for fatal errors
+# 4 is reasonable for general usage
+# 5 and 6 can help to debug connection problems
+# 9 is extremely verbose
+verb 0
+
+# Silence repeating messages.  At most 20
+# sequential messages of the same message
+# category will be output to the log.
+;mute 20
+
+#crl-verify /etc/openvpn/keys/crl.pem
diff --git a/GA-Schloss/openvpn/server-home.conf b/GA-Schloss/openvpn/server-home.conf
new file mode 100644
index 0000000..f6aa692
--- /dev/null
+++ b/GA-Schloss/openvpn/server-home.conf
@@ -0,0 +1,315 @@
+#################################################
+# Sample OpenVPN 2.0 config file for            #
+# multi-client server.                          #
+#                                               #
+# This file is for the server side              #
+# of a many-clients <-> one-server              #
+# OpenVPN configuration.                        #
+#                                               #
+# OpenVPN also supports                         #
+# single-machine <-> single-machine             #
+# configurations (See the Examples page         #
+# on the web site for more info).               #
+#                                               #
+# This config should work on Windows            #
+# or Linux/BSD systems.  Remember on            #
+# Windows to quote pathnames and use            #
+# double backslashes, e.g.:                     #
+# "C:\\Program Files\\OpenVPN\\config\\foo.key" #
+#                                               #
+# Comments are preceded with '#' or ';'         #
+#################################################
+
+# Which local IP address should OpenVPN
+# listen on? (optional)
+;local a.b.c.d
+
+# Which TCP/UDP port should OpenVPN listen on?
+# If you want to run multiple OpenVPN instances
+# on the same machine, use a different port
+# number for each one.  You will need to
+# open up this port on your firewall.
+port 1194
+
+# TCP or UDP server?
+;proto tcp
+proto udp
+
+
+topology subnet
+
+# "dev tun" will create a routed IP tunnel,
+# "dev tap" will create an ethernet tunnel.
+# Use "dev tap0" if you are ethernet bridging
+# and have precreated a tap0 virtual interface
+# and bridged it with your ethernet interface.
+# If you want to control access policies
+# over the VPN, you must create firewall
+# rules for the the TUN/TAP interface.
+# On non-Windows systems, you can give
+# an explicit unit number, such as tun0.
+# On Windows, use "dev-node" for this.
+# On most systems, the VPN will not function
+# unless you partially or fully disable
+# the firewall for the TUN/TAP interface.
+;dev tap
+dev tun
+
+# Windows needs the TAP-Win32 adapter name
+# from the Network Connections panel if you
+# have more than one.  On XP SP2 or higher,
+# you may need to selectively disable the
+# Windows firewall for the TAP adapter.
+# Non-Windows systems usually don't need this.
+;dev-node MyTap
+
+# SSL/TLS root certificate (ca), certificate
+# (cert), and private key (key).  Each client
+# and the server must have their own cert and
+# key file.  The server and all clients will
+# use the same ca file.
+#
+# See the "easy-rsa" directory for a series
+# of scripts for generating RSA certificates
+# and private keys.  Remember to use
+# a unique Common Name for the server
+# and each of the client certificates.
+#
+# Any X509 key management system can be used.
+# OpenVPN can also use a PKCS #12 formatted key file
+# (see "pkcs12" directive in man page).
+ca  keys/ca.crt
+cert keys/server.crt
+key keys/server.key  # This file should be kept secret
+
+# Diffie hellman parameters.
+# Generate your own with:
+#   openssl dhparam -out dh1024.pem 1024
+# Substitute 2048 for 1024 if you are using
+# 2048 bit keys. 
+dh  keys/dh2048.pem
+
+# Configure server mode and supply a VPN subnet
+# for OpenVPN to draw client addresses from.
+# The server will take 10.8.0.1 for itself,
+# the rest will be made available to clients.
+# Each client will be able to reach the server
+# on 10.8.0.1. Comment this line out if you are
+# ethernet bridging. See the man page for more info.
+server 10.0.11.0 255.255.255.0
+
+# Maintain a record of client <-> virtual IP address
+# associations in this file.  If OpenVPN goes down or
+# is restarted, reconnecting clients can be assigned
+# the same virtual IP address from the pool that was
+# previously assigned.
+ifconfig-pool-persist ipp.txt
+
+# Configure server mode for ethernet bridging.
+# You must first use your OS's bridging capability
+# to bridge the TAP interface with the ethernet
+# NIC interface.  Then you must manually set the
+# IP/netmask on the bridge interface, here we
+# assume 10.8.0.4/255.255.255.0.  Finally we
+# must set aside an IP range in this subnet
+# (start=10.8.0.50 end=10.8.0.100) to allocate
+# to connecting clients.  Leave this line commented
+# out unless you are ethernet bridging.
+;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
+
+# Configure server mode for ethernet bridging
+# using a DHCP-proxy, where clients talk
+# to the OpenVPN server-side DHCP server
+# to receive their IP address allocation
+# and DNS server addresses.  You must first use
+# your OS's bridging capability to bridge the TAP
+# interface with the ethernet NIC interface.
+# Note: this mode only works on clients (such as
+# Windows), where the client-side TAP adapter is
+# bound to a DHCP client.
+;server-bridge
+
+# Push routes to the client to allow it
+# to reach other private subnets behind
+# the server.  Remember that these
+# private subnets will also need
+# to know to route the OpenVPN client
+# address pool (10.8.0.0/255.255.255.0)
+# back to the OpenVPN server.
+;push "route 192.168.10.0 255.255.255.0"
+push "route 192.168.11.0 255.255.255.0"
+push "route 192.168.10.0 255.255.255.0"
+push "route 10.10.11.0 255.255.255.0"
+
+
+# To assign specific IP addresses to specific
+# clients or if a connecting client has a private
+# subnet behind it that should also have VPN access,
+# use the subdirectory "ccd" for client-specific
+# configuration files (see man page for more info).
+
+# EXAMPLE: Suppose the client
+# having the certificate common name "Thelonious"
+# also has a small subnet behind his connecting
+# machine, such as 192.168.40.128/255.255.255.248.
+# First, uncomment out these lines:
+client-config-dir /etc/openvpn/ccd/server-home
+;route 192.168.40.128 255.255.255.248
+# Then create a file ccd/Thelonious with this line:
+#   iroute 192.168.40.128 255.255.255.248
+# This will allow Thelonious' private subnet to
+# access the VPN.  This example will only work
+# if you are routing, not bridging, i.e. you are
+# using "dev tun" and "server" directives.
+
+# EXAMPLE: Suppose you want to give
+# Thelonious a fixed VPN IP address of 10.9.0.1.
+# First uncomment out these lines:
+;client-config-dir ccd
+;route 10.9.0.0 255.255.255.252
+# Then add this line to ccd/Thelonious:
+#   ifconfig-push 10.9.0.1 10.9.0.2
+
+# Suppose that you want to enable different
+# firewall access policies for different groups
+# of clients.  There are two methods:
+# (1) Run multiple OpenVPN daemons, one for each
+#     group, and firewall the TUN/TAP interface
+#     for each group/daemon appropriately.
+# (2) (Advanced) Create a script to dynamically
+#     modify the firewall in response to access
+#     from different clients.  See man
+#     page for more info on learn-address script.
+;learn-address ./script
+
+# If enabled, this directive will configure
+# all clients to redirect their default
+# network gateway through the VPN, causing
+# all IP traffic such as web browsing and
+# and DNS lookups to go through the VPN
+# (The OpenVPN server machine may need to NAT
+# or bridge the TUN/TAP interface to the internet
+# in order for this to work properly).
+;push "redirect-gateway def1 bypass-dhcp"
+
+# Certain Windows-specific network settings
+# can be pushed to clients, such as DNS
+# or WINS server addresses.  CAVEAT:
+# http://openvpn.net/faq.html#dhcpcaveats
+# The addresses below refer to the public
+# DNS servers provided by opendns.com.
+;push "dhcp-option DNS 208.67.222.222"
+;push "dhcp-option DNS 208.67.220.220"
+push "dhcp-option DNS 192.168.11.1"
+push "dhcp-option DOMAIN ga.intra"
+
+# Uncomment this directive to allow different
+# clients to be able to "see" each other.
+# By default, clients will only see the server.
+# To force clients to only see the server, you
+# will also need to appropriately firewall the
+# server's TUN/TAP interface.
+client-to-client
+
+# Uncomment this directive if multiple clients
+# might connect with the same certificate/key
+# files or common names.  This is recommended
+# only for testing purposes.  For production use,
+# each client should have its own certificate/key
+# pair.
+#
+# IF YOU HAVE NOT GENERATED INDIVIDUAL
+# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
+# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
+# UNCOMMENT THIS LINE OUT.
+;duplicate-cn
+
+# The keepalive directive causes ping-like
+# messages to be sent back and forth over
+# the link so that each side knows when
+# the other side has gone down.
+# Ping every 10 seconds, assume that remote
+# peer is down if no ping received during
+# a 120 second time period.
+keepalive 10 120
+
+# For extra security beyond that provided
+# by SSL/TLS, create an "HMAC firewall"
+# to help block DoS attacks and UDP port flooding.
+#
+# Generate with:
+#   openvpn --genkey --secret ta.key
+#
+# The server and each client must have
+# a copy of this key.
+# The second parameter should be '0'
+# on the server and '1' on the clients.
+;tls-auth ta.key 0 # This file is secret
+tls-auth keys/ta.key 0
+
+# Select a cryptographic cipher.
+# This config item must be copied to
+# the client config file as well.
+;cipher BF-CBC        # Blowfish (default)
+;cipher AES-128-CBC   # AES
+;cipher DES-EDE3-CBC  # Triple-DES
+
+# Enable compression on the VPN link.
+# If you enable it here, you must also
+# enable it in the client config file.
+comp-lzo
+
+# The maximum number of concurrently connected
+# clients we want to allow.
+;max-clients 100
+
+# It's a good idea to reduce the OpenVPN
+# daemon's privileges after initialization.
+#
+# You can uncomment this out on
+# non-Windows systems.
+user nobody
+group nogroup
+
+# The persist options will try to avoid
+# accessing certain resources on restart
+# that may no longer be accessible because
+# of the privilege downgrade.
+persist-key
+persist-tun
+persist-local-ip
+persist-remote-ip
+
+# Output a short status file showing
+# current connections, truncated
+# and rewritten every minute.
+status /var/log/openvpn/status-server-home.log
+
+# By default, log messages will go to the syslog (or
+# on Windows, if running as a service, they will go to
+# the "\Program Files\OpenVPN\log" directory).
+# Use log or log-append to override this default.
+# "log" will truncate the log file on OpenVPN startup,
+# while "log-append" will append to it.  Use one
+# or the other (but not both).
+;log         openvpn.log
+;log-append  openvpn.log
+log         /var/log/openvpn/server-home.log
+
+# Set the appropriate level of log
+# file verbosity.
+#
+# 0 is silent, except for fatal errors
+# 4 is reasonable for general usage
+# 5 and 6 can help to debug connection problems
+# 9 is extremely verbose
+verb 4
+
+# Silence repeating messages.  At most 20
+# sequential messages of the same message
+# category will be output to the log.
+;mute 20
+
+
+# CRL (certificate revocation list) verification
+crl-verify /etc/openvpn/crl.pem
diff --git a/GA-Schloss/openvpn/update-resolv-conf b/GA-Schloss/openvpn/update-resolv-conf
new file mode 100755
index 0000000..fc2f031
--- /dev/null
+++ b/GA-Schloss/openvpn/update-resolv-conf
@@ -0,0 +1,58 @@
+#!/bin/bash
+# 
+# Parses DHCP options from openvpn to update resolv.conf
+# To use set as 'up' and 'down' script in your openvpn *.conf:
+# up /etc/openvpn/update-resolv-conf
+# down /etc/openvpn/update-resolv-conf
+#
+# Used snippets of resolvconf script by Thomas Hood and Chris Hanson.
+# Licensed under the GNU GPL.  See /usr/share/common-licenses/GPL. 
+# 
+# Example envs set from openvpn:
+#
+#     foreign_option_1='dhcp-option DNS 193.43.27.132'
+#     foreign_option_2='dhcp-option DNS 193.43.27.133'
+#     foreign_option_3='dhcp-option DOMAIN be.bnc.ch'
+#
+
+[ -x /sbin/resolvconf ] || exit 0
+[ "$script_type" ] || exit 0
+[ "$dev" ] || exit 0
+
+split_into_parts()
+{
+	part1="$1"
+	part2="$2"
+	part3="$3"
+}
+
+case "$script_type" in
+  up)
+	NMSRVRS=""
+	SRCHS=""
+	for optionvarname in ${!foreign_option_*} ; do
+		option="${!optionvarname}"
+		echo "$option"
+		split_into_parts $option
+		if [ "$part1" = "dhcp-option" ] ; then
+			if [ "$part2" = "DNS" ] ; then
+				NMSRVRS="${NMSRVRS:+$NMSRVRS }$part3"
+			elif [ "$part2" = "DOMAIN" ] ; then
+				SRCHS="${SRCHS:+$SRCHS }$part3"
+			fi
+		fi
+	done
+	R=""
+	[ "$SRCHS" ] && R="search $SRCHS
+"
+	for NS in $NMSRVRS ; do
+        	R="${R}nameserver $NS
+"
+	done
+	echo -n "$R" | /sbin/resolvconf -a "${dev}.openvpn"
+	;;
+  down)
+	/sbin/resolvconf -d "${dev}.openvpn"
+	;;
+esac
+
diff --git a/GA-Schloss/pap-secrets.GA-Schloss b/GA-Schloss/pap-secrets.GA-Schloss
new file mode 100644
index 0000000..fd6bbc9
--- /dev/null
+++ b/GA-Schloss/pap-secrets.GA-Schloss
@@ -0,0 +1,57 @@
+#
+# /etc/ppp/pap-secrets
+#
+# This is a pap-secrets file to be used with the AUTO_PPP function of
+# mgetty. mgetty-0.99 is preconfigured to startup pppd with the login option
+# which will cause pppd to consult /etc/passwd (and /etc/shadow in turn)
+# after a user has passed this file. Don't be disturbed therefore by the fact
+# that this file defines logins with any password for users. /etc/passwd
+# (again, /etc/shadow, too) will catch passwd mismatches.
+#
+# This file should block ALL users that should not be able to do AUTO_PPP.
+# AUTO_PPP bypasses the usual login program so it's necessary to list all
+# system userids with regular passwords here.
+#
+# ATTENTION: The definitions here can allow users to login without a
+# password if you don't use the login option of pppd! The mgetty Debian
+# package already provides this option; make sure you don't change that.
+
+# INBOUND connections
+
+# Every regular user can use PPP and has to use passwords from /etc/passwd
+*	hostname	""	*
+
+# UserIDs that cannot use PPP at all. Check your /etc/passwd and add any
+# other accounts that should not be able to use pppd!
+guest	hostname	"*"	-
+master	hostname	"*"	-
+root	hostname	"*"	-
+support	hostname	"*"	-
+stats	hostname	"*"	-
+
+# OUTBOUND connections
+
+# Here you should add your userid password to connect to your providers via
+# PAP. The * means that the password is to be used for ANY host you connect
+# to. Thus you do not have to worry about the foreign machine name. Just
+# replace password with your password.
+# If you have different providers with different passwords then you better
+# remove the following line.
+
+#	*	password
+
+
+## - ckubu
+"0025591824365511139967620001@t-online.de" * "67982653"
+
+## - DSL Altenschlirf ST (feste ip-addresse 87.139.62.172)
+## -
+"feste-ip3/5TBX42N4SE8M@t-online-com.de" * "15868583"
+
+## - DSL Altenschlirf Surf (feste ip-addresse 80.153.166.156)
+## -
+"feste-ip6/8TB0GP2GSCDF@t-online-com.de" * "87642121"
+
+## - DSL Altenschlirf Surf2 (feste ip-addresse 87.128.11.35)
+## -
+"002468512294551125742960001@t-online.de" * "16819924"
diff --git a/GA-Schloss/peers/dsl-ckubu b/GA-Schloss/peers/dsl-ckubu
new file mode 100644
index 0000000..15e2919
--- /dev/null
+++ b/GA-Schloss/peers/dsl-ckubu
@@ -0,0 +1,23 @@
+# Minimalistic default options file for DSL/PPPoE connections
+
+noipdefault
+
+## - !! Keine Default Route
+## -
+#defaultroute
+#replacedefaultroute
+nodefaultroute
+#noreplacedefaultroute
+
+hide-password
+#lcp-echo-interval 30
+#lcp-echo-failure 4
+noauth
+persist
+#mtu 1492
+#persist
+#maxfail 0
+#holdoff 20
+ifname ppp-ckubu
+plugin rp-pppoe.so eth9.7
+user "0025591824365511139967620001@t-online.de"
diff --git a/GA-Schloss/peers/dsl-st b/GA-Schloss/peers/dsl-st
new file mode 100644
index 0000000..21e3e37
--- /dev/null
+++ b/GA-Schloss/peers/dsl-st
@@ -0,0 +1,24 @@
+# Minimalistic default options file for DSL/PPPoE connections
+
+noipdefault
+
+## - !! Keine Default Route
+## -
+#defaultroute
+#replacedefaultroute
+nodefaultroute
+#noreplacedefaultroute
+
+hide-password
+#lcp-echo-interval 30
+#lcp-echo-failure 4
+noauth
+persist
+mtu 1452
+#persist
+#maxfail 0
+#holdoff 20
+ifname ppp-st
+#plugin rp-pppoe.so eth10.7
+plugin rp-pppoe.so eth10
+user "feste-ip3/5TBX42N4SE8M@t-online-com.de"
diff --git a/GA-Schloss/peers/dsl-surf1 b/GA-Schloss/peers/dsl-surf1
new file mode 100644
index 0000000..3148a3a
--- /dev/null
+++ b/GA-Schloss/peers/dsl-surf1
@@ -0,0 +1,24 @@
+# Minimalistic default options file for DSL/PPPoE connections
+
+noipdefault
+
+## - !! Keine Default Route
+## -
+#defaultroute
+#replacedefaultroute
+nodefaultroute
+#noreplacedefaultroute
+
+hide-password
+#lcp-echo-interval 30
+#lcp-echo-failure 4
+noauth
+persist
+mtu 1452
+#persist
+#maxfail 0
+#holdoff 20
+ifname ppp-surf1
+#plugin rp-pppoe.so eth11.7
+plugin rp-pppoe.so eth11
+user "feste-ip6/8TB0GP2GSCDF@t-online-com.de"
diff --git a/GA-Schloss/peers/dsl-surf2 b/GA-Schloss/peers/dsl-surf2
new file mode 120000
index 0000000..a8f20a4
--- /dev/null
+++ b/GA-Schloss/peers/dsl-surf2
@@ -0,0 +1 @@
+dsl-surf2.VDSL
\ No newline at end of file
diff --git a/GA-Schloss/peers/dsl-surf2.DSL b/GA-Schloss/peers/dsl-surf2.DSL
new file mode 100644
index 0000000..dc042e0
--- /dev/null
+++ b/GA-Schloss/peers/dsl-surf2.DSL
@@ -0,0 +1,23 @@
+# Minimalistic default options file for DSL/PPPoE connections
+
+noipdefault
+
+## - !! Keine Default Route
+## -
+defaultroute
+replacedefaultroute
+#nodefaultroute
+#noreplacedefaultroute
+
+hide-password
+#lcp-echo-interval 30
+#lcp-echo-failure 4
+noauth
+persist
+#mtu 1492
+#persist
+#maxfail 0
+#holdoff 20
+ifname ppp-surf2
+plugin rp-pppoe.so eth8
+user "002468512294551125742960001@t-online.de"
diff --git a/GA-Schloss/peers/dsl-surf2.VDSL b/GA-Schloss/peers/dsl-surf2.VDSL
new file mode 100644
index 0000000..a788c9d
--- /dev/null
+++ b/GA-Schloss/peers/dsl-surf2.VDSL
@@ -0,0 +1,23 @@
+# Minimalistic default options file for DSL/PPPoE connections
+
+noipdefault
+
+## - !! Keine Default Route
+## -
+defaultroute
+replacedefaultroute
+#nodefaultroute
+#noreplacedefaultroute
+
+hide-password
+#lcp-echo-interval 30
+#lcp-echo-failure 4
+noauth
+persist
+#mtu 1492
+#persist
+#maxfail 0
+#holdoff 20
+ifname ppp-surf2
+plugin rp-pppoe.so eth8.7
+user "002468512294551125742960001@t-online.de"
diff --git a/GA-Schloss/peers/provider b/GA-Schloss/peers/provider
new file mode 100644
index 0000000..e74d71a
--- /dev/null
+++ b/GA-Schloss/peers/provider
@@ -0,0 +1,35 @@
+# example configuration for a dialup connection authenticated with PAP or CHAP
+#
+# This is the default configuration used by pon(1) and poff(1).
+# See the manual page pppd(8) for information on all the options.
+
+# MUST CHANGE: replace myusername@realm with the PPP login name given to
+# your by your provider.
+# There should be a matching entry with the password in /etc/ppp/pap-secrets
+# and/or /etc/ppp/chap-secrets.
+user "myusername@realm"
+
+# MUST CHANGE: replace ******** with the phone number of your provider.
+# The /etc/chatscripts/pap chat script may be modified to change the
+# modem initialization string.
+connect "/usr/sbin/chat -v -f /etc/chatscripts/pap -T ********"
+
+# Serial device to which the modem is connected.
+/dev/modem
+
+# Speed of the serial line.
+115200
+
+# Assumes that your IP address is allocated dynamically by the ISP.
+noipdefault
+# Try to get the name server addresses from the ISP.
+usepeerdns
+# Use this connection as the default route.
+defaultroute
+
+# Makes pppd "dial again" when the connection is lost.
+persist
+
+# Do not ask the remote to authenticate.
+noauth
+
diff --git a/GA-Schloss/rc.local.GA-Schloss b/GA-Schloss/rc.local.GA-Schloss
new file mode 100755
index 0000000..e9d34e4
--- /dev/null
+++ b/GA-Schloss/rc.local.GA-Schloss
@@ -0,0 +1,25 @@
+#!/bin/sh -e
+#
+# rc.local
+#
+# This script is executed at the end of each multiuser runlevel.
+# Make sure that the script will "exit 0" on success or any other
+# value on error.
+#
+# In order to enable or disable this script just change the execution
+# bits.
+#
+# By default this script does nothing.
+
+
+sleep 2
+systemctl restart ipt-firewall || /bin/true
+#/etc/init.d/ipt-firewall || /bin/true
+
+#sleep 2
+#/sbin/route add -net 10.11.16.0 netmask 255.255.255.0 gw 192.168.11.6 || /bin/true
+
+#sleep 60
+#/root/bin/netconfig_dsl.sh -i &
+
+exit 0
diff --git a/GA-Schloss/resolv.conf.GA-Schloss b/GA-Schloss/resolv.conf.GA-Schloss
new file mode 100644
index 0000000..2ee4bfd
--- /dev/null
+++ b/GA-Schloss/resolv.conf.GA-Schloss
@@ -0,0 +1,2 @@
+search ga.intra ga.netz
+nameserver 127.0.0.1
diff --git a/GA-Schloss/sasl_passwd.GA-Schloss b/GA-Schloss/sasl_passwd.GA-Schloss
new file mode 100644
index 0000000..461553a
--- /dev/null
+++ b/GA-Schloss/sasl_passwd.GA-Schloss
@@ -0,0 +1 @@
+[b.mx.oopen.de] ga@b.mx.oopen.de:eiP0oi5ohngeipei
diff --git a/GA-Schloss/sasl_passwd.db.GA-Schloss b/GA-Schloss/sasl_passwd.db.GA-Schloss
new file mode 100644
index 0000000..954b24b
Binary files /dev/null and b/GA-Schloss/sasl_passwd.db.GA-Schloss differ
diff --git a/GA-Schloss/sbin/check_net.sh b/GA-Schloss/sbin/check_net.sh
new file mode 100755
index 0000000..0ee4573
--- /dev/null
+++ b/GA-Schloss/sbin/check_net.sh
@@ -0,0 +1,623 @@
+#!/usr/bin/env bash
+
+## -------------------------------------------------------------------
+## --- All Configurations ill be done in /etc/check_net/check_net.conf
+## -------------------------------------------------------------------
+
+## - Load Configuration
+## -
+source /etc/check_net/check_net.conf
+
+
+## ------------------
+## --- Some functions
+## ------------------
+
+## - Check if a given array (parameter 2) contains a given string (parameter 1)
+## -
+fatal(){
+   echo ""
+   echo -e "[ \033[31m\033[1mError\033[m ]: $*"
+   echo ""
+   echo -e "\t\033[31m\033[1mScript is canceled\033[m\033[m"
+   echo ""
+
+   echo "" >> $log_file
+   echo "[ Error ]: $*" >> $log_file
+   echo "" >> $log_file
+   echo "           Script is canceled." >> $log_file
+   echo "" >> $log_file
+
+   exit 1
+}
+containsElement () {
+   local e
+   for e in "${@:2}"; do [[ "$e" == "$1" ]] && return 0; done
+   return 1
+}
+set_ping_addresses () {
+
+   if $DEBUG ; then
+      echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] Try to set IP-Address(es) for ping test. This may take some time.." >> $log_file
+   fi
+
+   ping_test_ip=""
+   unset ping_ip_arr 
+   declare -i i=0
+   for _host in $PING_TEST_HOSTS ; do
+      while [ $i -lt 2 ]; do
+         if dig +short $_host > /dev/null 2>&1 ; then
+            ping_test_ip=`dig +short $_host | head -1`
+            if ping -q -c2 $ping_test_ip >/dev/null 2>&1 ; then
+               ping_ip_arr+=("$ping_test_ip")
+               let i++
+               break
+            fi
+         fi
+         break
+      done
+   done
+
+   if [ ${#ping_ip_arr[@]} -lt 1 ]; then
+      echo "`date +'%Y-%m-%d %H:%M:%S'` [ Error ] Setting IP-Address(es) for ping test FAILED!" >> $log_file
+   else
+      if $DEBUG ; then
+         echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] IP-Addresses for ping tests set to ${ping_ip_arr[@]}" >> $log_file 
+      fi
+   fi
+}
+usage() { 
+   echo  
+   [ -n  "$1" ] && echo -e "[ \033[1;31mError\033[m ] : $1\n" 
+ 
+echo -e "   Usage:" 
+echo -e "          \033[1m`basename $0` [OPTIONS] <device1> <device2> ..\033[m" 
+echo "" 
+echo -e "   This script checks the status (online/offline) of the given devices. Afterward another"
+echo "      script called \033[1m`basename $netconfig_script`\033[m will be triggered to configure"
+echo "      the routing depending on the status of the devices."
+echo ""
+echo -e "   It is strongly recommend to put \033[1mall devices, which should have a connection to"
+echo -e "   the internet\033[m, on the command line."
+echo ""
+echo -e "   \033[1mNotice\033[m"
+echo -e "      On static line devices \033[1mappend \":<gateway>\"\033[m. This is very important,"
+echo -e "      otherwise this script will \033[1mNOT work as expected\033[m."
+echo -e "      Example:"
+echo -e "            \033[1m`basename $0` -l \"eth0 ppp-light\" eth0:172.16.0.1 ppp-light\033[m"
+echo ""
+echo -e "   The declaration of the device(s) is mandatory."
+echo ""
+echo -e "   Options:"
+echo ""
+echo -e "      \033[1m-h\033[m"
+echo -e "         Prints this help\033[m"
+echo ""   
+echo -e "      \033[1m-l <list of online devices>\033[m"
+echo -e "         List of all (internet) devices known as online."
+echo ""
+
+exit 1
+}
+
+
+if [[ $EUID -ne 0 ]]; then
+   fatal "This script must be run as root" 1>&2
+fi
+
+if [[ ! -f "$netconfig_script" ]]; then
+   fatal "Netconfig script \"$netconfig_script\" not found!"
+fi
+
+
+## -------------------------------------------------
+## --- If script is  already running, stop execution
+## -------------------------------------------------
+
+LOCK_DIR=/tmp/`basename $0`.LOCK
+if mkdir "$LOCK_DIR" 2> /dev/null ; then
+
+   ## - Remove lockdir when the script finishes, or when it receives a signal
+   trap 'rm -rf "$LOCK_DIR"' 0 2 15
+
+else
+
+   datum=`date +"%d.%m.%Y"`
+   msg="[ Error ]: A previos instance of script \"`basename $0`\" seems already be running.\n\n           Exiting now.."
+   echo -e "To:${admin_email}\n${content_type}\nSubject:DSL Script Error $company -- $datum\n\n${msg}\n" | /usr/sbin/sendmail -F "DSL Monitoring $company" -f $from_address $admin_email 2> /dev/null
+
+   if $LOGGING_CONSOLE ; then
+      echo ""
+      echo "[ Error ]: A previos instance script \"`basename $0`\" seems already be running."
+      echo ""
+      echo "           Exiting now.."
+      echo ""
+   fi
+   exit 1
+
+fi
+
+
+## -------------
+## --- Configure
+## -------------
+
+while getopts l:h opt ; do
+   case $opt in
+      h) usage ;;
+      l) ONLINE_DEVICE_LIST=$OPTARG
+         ;;
+   esac
+done
+
+shift `expr $OPTIND - 1`
+
+INITIAL_DEVICE_LIST="$@"
+if [[ -z "$INITIAL_DEVICE_LIST" ]]; then
+   INITIAL_DEVICE_LIST=$_INITIAL_DEVICE_LIST
+fi
+
+[[ -z "$INITIAL_DEVICE_LIST" ]] && usage "No device list given"
+      
+
+## - Define (non associative) array
+## -
+declare -a inet_devices_arr
+declare -a dsl_devices_arr
+declare -a static_devices_arr
+declare -a online_devices_arr
+declare -A static_gw_arr
+declare -A dsl_gw_available_arr
+
+for _device in $INITIAL_DEVICE_LIST ; do
+   if [[ "$_device" =~ : ]]; then
+      static_gateway="${_device##*:}"
+      _device="${_device%:*}"
+      static_gw_arr[$_device]="$static_gateway"
+
+      static_devices_arr+=("$_device")
+
+   else
+      dsl_devices_arr+=("$_device")
+   fi
+   inet_devices_arr+=("$_device")
+done
+
+for _online_device in $ONLINE_DEVICE_LIST ; do
+   online_devices_arr+=("$_online_device")
+done
+
+## - Define associative array
+## -
+declare -A remote_gw_arr
+declare -A filetime_PID_arr
+for inet_device in "${online_devices_arr[@]}" ; do
+
+   if containsElement "$inet_device" "${dsl_devices_arr[@]}" ; then
+      remote_gw_address="$(ip addr show $inet_device 2> /dev/null | grep peer | awk '{print$4}' | cut -d "/" -f1)"
+   else
+      remote_gw_address=${static_gw_arr[$inet_device]}
+   fi
+
+   remote_gw_arr[$inet_device]=$remote_gw_address
+   _pid_file=/var/run/${inet_device}.pid
+   if [ -f $_pid_file ]; then
+      filetime_PID_arr[$inet_device]=`stat -c %Y /var/run/${inet_device}.pid`
+   else
+      filetime_PID_arr[$inet_device]="NOT FOUND"
+   fi
+done
+
+declare -a ping_ip_arr;
+
+
+#echo "--"
+#for _key in "${!filetime_PID_arr[@]}" ; do
+#   echo "filetime_PID_arr[$_key]: ${filetime_PID_arr[$_key]}"
+#done
+#
+#for _key in "${!remote_gw_arr[@]}" ; do
+#   echo "remote_gw_arr[$_key]: ${remote_gw_arr[$_key]}"
+#done
+#
+#for _device in ${online_devices_arr[@]} ; do
+#   echo "$_device is online"
+#done
+#echo "--"
+#exit
+
+echo "" >> $log_file
+echo "" >> $log_file
+echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] ## ---" >> $log_file
+echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] ## --- Starting script `basename $0`" >> $log_file
+echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] ## ---" >> $log_file
+echo "" >> $log_file
+echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] Devices configured..: ${inet_devices_arr[@]}" >> $log_file
+echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] Devices Online......: ${online_devices_arr[@]}" >> $log_file
+echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] DSL Devices.........: ${dsl_devices_arr[@]}" >> $log_file
+echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] Static Devices......: ${static_devices_arr[@]}" >> $log_file
+echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] Remote Gateways.....: ${remote_gw_arr[@]}" >> $log_file
+echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] ## ---" >> $log_file
+
+echo "" >> $log_file
+echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] ## --- Initial Setup:" >> $log_file
+
+## - Initial: get ping addresses
+## -
+set_ping_addresses
+echo "" >> $log_file
+
+while true ; do
+
+   changed=false
+
+   for inet_device in "${inet_devices_arr[@]}" ; do
+
+      if $DEBUG ; then
+         echo "`date +'%Y-%m-%d %H:%M:%S'` [ Debug ] ## --- Device $inet_device" >> $log_file
+      fi
+
+      ## - Set interface name, routing tables name and, if available, remote gateway.
+      ## -
+      if containsElement "$inet_device" "${dsl_devices_arr[@]}" ; then
+
+         ## - Is remote a remote gateway for this device knpn?
+         ## -
+         remote_gw_address="$(ip addr show $inet_device 2> /dev/null | grep peer | awk '{print$4}' | cut -d "/" -f1)"
+         iface_name="dsl-`echo $inet_device | cut -d '-' -f2`"
+         rt_name="dsl_`echo $inet_device | cut -d '-' -f2`"
+         if [[ -n "$remote_gw_address" ]]; then
+            if $DEBUG ; then
+               echo "`date +'%Y-%m-%d %H:%M:%S'` [ Debug ] Add $remote_gw_address to array dsl_gw_available_arr for DSL line $inet_device" >> $log_file
+            fi
+            dsl_gw_available_arr[$inet_device]=$remote_gw_address
+         else
+            if $DEBUG ; then
+               echo "`date +'%Y-%m-%d %H:%M:%S'` [ Debug ] No remote gateway found for DSL line $inet_device" >> $log_file
+            fi
+            if [[ ${dsl_gw_available_arr[$inet_device]+_} ]]; then
+               if $DEBUG; then
+                  echo "`date +'%Y-%m-%d %H:%M:%S'` [ Debug ] Unset dsl_gw_available_arr for DSL line $inet_device" >> $log_file
+               fi
+               unset ${dsl_gw_available_arr[$inet_device]}
+            fi
+         fi
+      else
+         remote_gw_address=${static_gw_arr[$inet_device]}
+         iface_name=$inet_device
+         rt_name="static_`echo $inet_device | cut -d '-' -f1`"
+      fi
+
+      
+      ## ---
+      ## ---  Check if routing through this connection works
+      ## ---
+
+      ## - Notice:
+      ## -    if no remote gateway is known (remote_gw_address is empty), then we don't
+      ## -    need to test here. 
+      ## -
+      device_is_online=false
+      if [[ -n "$remote_gw_address" ]]; then
+
+
+         ## - Check if routing through this dsl connection realy works
+         ## -
+         if [ ${#ping_ip_arr[@]} -lt 1 ]; then
+            echo "`date +'%Y-%m-%d %H:%M:%S'` [ Warn  ] No ip-address for ping-test is set. Skipping test.." >> $log_file
+         else
+            failed=true
+            for _key in ${!ping_ip_arr[@]} ; do
+               /sbin/ip rule add to ${ping_ip_arr[$_key]} table $rt_name
+               if ping -q -c2 ${ping_ip_arr[$_key]} >/dev/null 2>&1 ; then
+                  if $DEBUG ; then
+                     _local_gw=`curl -4 https://meine-ip.oopen.de 2> /dev/null` 
+                     if [ -n "$_local_gw" ]; then
+                        echo "`date +'%Y-%m-%d %H:%M:%S'` [ Debug ] Using local gateway \"$_local_gw\" for ping test" >> $log_file
+                     fi
+                     echo "`date +'%Y-%m-%d %H:%M:%S'` [ Debug ] Ping test (to ${ping_ip_arr[$_key]}) for device \"${inet_device}\" was successful." >> $log_file
+                  fi
+                  /sbin/ip rule del to ${ping_ip_arr[$_key]} table $rt_name
+                  failed=false
+                  device_is_online=true
+                  break
+               fi
+               /sbin/ip rule del to ${ping_ip_arr[$_key]} table $rt_name
+            done
+            if $failed ; then
+               echo "`date +'%Y-%m-%d %H:%M:%S'` [ Error ] Ping test for device \"${inet_device}\" failed" >> $log_file
+               #echo "`date +'%Y-%m-%d %H:%M:%S'` [ Error ] Status Devices \"$inet_device\" changed" >> $log_file
+               #echo "`date +'%Y-%m-%d %H:%M:%S'` [ Error ] Devices \"$inet_device\" is now OFFLINE" >> $log_file
+
+               ## - Remote gateway is not reachable. So empty variable "remote_gw_address"
+               #remote_gw_address=
+
+            fi # End: if $failed
+            
+         fi # End: if [ ${#ping_ip_arr[@]} -lt 1 ]; then
+
+      fi # End: if [[ -n "$remote_gw_address" ]]
+
+
+      ## ---
+      ## --- Now check, if something has changed
+      ## ---
+
+      if $device_is_online; then
+
+         if containsElement "$inet_device" ${online_devices_arr[@]} ; then
+
+            ## - <before>  <now>
+            ## -
+            ## -  online    online
+            if $DEBUG ; then
+               echo "`date +'%Y-%m-%d %H:%M:%S'` [ Debug ] $inet_device is still online" >> $log_file
+            fi
+
+            ## - Check if remote gateway has changed
+            ## -
+            if [ "$remote_gw_address" != "${remote_gw_arr[$inet_device]}" ]; then
+               echo "`date +'%Y-%m-%d %H:%M:%S'` [ WARN  ] Remote Gateway on device \"$inet_device\" has changed: ${remote_gw_arr[$inet_device]} --> $remote_gw_address" >> $log_file
+               remote_gw_arr[$inet_device]=$remote_gw_address
+
+               _pid_file=/var/run/${inet_device}.pid
+               if [ -f $_pid_file ]; then
+                  filetime_PID_arr[$inet_device]=`stat -c %Y $_pid_file`
+               fi
+               changed=true
+            else
+               if $DEBUG ; then
+                  echo "`date +'%Y-%m-%d %H:%M:%S'` [ Debug ] Remote Gateway on device \"$inet_device\": still ${remote_gw_arr[$inet_device]}" >> $log_file
+               fi
+
+               ## - Test if pid-file's modify time hs changed
+               ## -
+               ## - Notice: that happens if your provider forces a reconnect (mostly one time a day
+               ## -         or in other words after 1440 minutes)
+               ## -
+               _pid_file=/var/run/${inet_device}.pid
+               if [ -f $_pid_file ]; then
+                  if [ "`stat -c %Y $_pid_file`" != "${filetime_PID_arr[$inet_device]}" ]; then
+                     echo "`date +'%Y-%m-%d %H:%M:%S'` [ Warn  ] Modify time for pid-file \"${inet_device}.pid\" has changed" >> $log_file
+                     filetime_PID_arr[$inet_device]=`stat -c %Y $_pid_file`
+                     changed=true
+                  fi
+               fi
+
+            fi
+
+         else
+            ## - <before>  <now>
+            ## -
+            ## -  offline   online
+            echo "`date +'%Y-%m-%d %H:%M:%S'` [ Warn  ] Status Devices \"$inet_device\" changed" >> $log_file
+            echo "`date +'%Y-%m-%d %H:%M:%S'` [ Warn  ] Devices \"$inet_device\" is now online" >> $log_file
+
+            ## - Add device to array online_devices_arr
+            ## -            
+            online_devices_arr+=("$inet_device")
+            ## - Add device to array remote_gw_arr
+            ## -
+            remote_gw_arr[$inet_device]=$remote_gw_address
+
+            _pid=/var/run/${inet_device}.pid
+            if [ -f "$_pid" ]; then
+               filetime_PID_arr[$inet_device]=`stat -c %Y /var/run/${inet_device}.pid`
+            fi
+            changed=true
+         fi # END: if containsElement "$inet_device" ${online_devices_arr[@]}
+
+      else # ELSE: if $device_is_online; then
+
+         if containsElement "$inet_device" ${online_devices_arr[@]} ; then
+
+            ## - <before>  <now>
+            ## -
+            ## -  online    offline
+            echo "`date +'%Y-%m-%d %H:%M:%S'` [ Error ] Status Devices \"$inet_device\" changed" >> $log_file
+            echo "`date +'%Y-%m-%d %H:%M:%S'` [ Error ] Devices \"$inet_device\" is now OFFLINE" >> $log_file
+
+            ## - In case of DSL Device, have a look at the ppp deamon
+            ## -
+            if containsElement "$inet_device" "${dsl_devices_arr[@]}" ; then
+               if ps -x | grep -E "/usr/sbin/pppd\s+call\s+$iface_name" > /dev/null 2>&1 ; then
+                  echo "`date +'%Y-%m-%d %H:%M:%S'` [ Warn  ] pppd for \"$iface_name\" is running: Waiting another period"  >> $log_file
+               else
+                  echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] Trying to start pppd for \"$inet_device\".." >> $log_file
+                  /usr/sbin/pppd call $iface_name > /dev/null 2>&1
+               fi
+            fi
+
+            ## - Remove device from array online_devices_arr
+            ## - 
+            for _index in ${!online_devices_arr[@]} ; do
+               if [ "${online_devices_arr[$_index]}" = "$inet_device" ]; then
+                  unset online_devices_arr[$_index]
+                  break
+               fi
+            done
+            ## - Also remove device from remote_gw_arr
+            ## -
+            unset remote_gw_arr[$inet_device]
+
+            ## - In case of DSL Device, kill the concerning the ppp deamon
+            ## -
+            if containsElement "$inet_device" "${dsl_devices_arr[@]}" ; then
+               _pid=`ps -ax | grep -e "pppd call $iface_name" | grep -v grep | awk '{print$1}'`
+               echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] Kill ppp-daemon for $iface_name (pid $_pid)" >> $log_file
+
+               kill -9 $_pid
+            fi
+
+            changed=true
+         else
+            ## - <before>  <now>
+            ## -
+            ## -  offline   offline
+            if $DEBUG ; then
+               echo "`date +'%Y-%m-%d %H:%M:%S'` [ Debug ] $inet_device is still offline" >> $log_file
+            fi
+
+            ## - In case of DSL Device, have a look at the ppp deamon
+            ## -
+            if containsElement "$inet_device" "${dsl_devices_arr[@]}" ; then
+               if ps -x | grep -E "/usr/sbin/pppd\s+call\s+$iface_name" > /dev/null 2>&1 ; then
+                  echo "`date +'%Y-%m-%d %H:%M:%S'` [ Warn  ] pppd for \"$iface_name\" is running: Waiting another period"  >> $log_file
+               else
+                  echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] Trying to start pppd for \"$inet_device\".." >> $log_file
+                  /usr/sbin/pppd call $iface_name > /dev/null 2>&1
+               fi
+            fi
+
+         fi # END: if containsElement "$inet_device" ${online_devices_arr[@]}
+
+      fi # END: if $device_is_online; then
+
+   done # End: for inet_device in "${inet_devices_arr[@]}"
+
+
+   if $changed ; then
+      echo "`date +'%Y-%m-%d %H:%M:%S'` [ Warn  ] Status Online Devices changed" >> $log_file
+      echo "`date +'%Y-%m-%d %H:%M:%S'` [ Warn  ] Online Devices: ${online_devices_arr[@]}" >> $log_file
+      echo "`date +'%Y-%m-%d %H:%M:%S'` [ Warn  ] Reconfigure Routing: invoking script \"$netconfig_script\".." >> $log_file
+      if [[ -z "${online_devices_arr[@]}" ]]; then
+         if $DEBUG ; then
+            echo "`date +'%Y-%m-%d %H:%M:%S'` [ Debug ] $netconfig_script $INITIAL_DEVICE_LIST" >> $log_file 
+         fi
+
+         $netconfig_script $INITIAL_DEVICE_LIST > /dev/null 2>&1
+      else
+         
+         _LIST=
+         for _device in ${online_devices_arr[@]} ; do
+            _LIST="$_LIST $_device"
+         done
+         _LIST=`echo "${_LIST}" | sed -e 's/^[ \t]*//'`
+         if $DEBUG ; then
+            echo "`date +'%Y-%m-%d %H:%M:%S'` [ Debug ] $netconfig_script -l \"$_LIST\" $INITIAL_DEVICE_LIST" >> $log_file 
+         fi
+         $netconfig_script -l "$_LIST" $INITIAL_DEVICE_LIST > /dev/null 2>&1
+      fi
+
+      datum=`date +"%d.%m.%Y"`
+      msg="[ `date +\"%H:%M:%S\"` ]: Status Online Devices changed..\n              Online Devices: ${online_devices_arr[@]}\n\n              Script \"$netconfig_script\" was invoked to reconfigure routing."
+      echo -e "To:${admin_email}\n${content_type}\nSubject:DSL Status changed $company -- $datum\n\n${msg}\n" | /usr/sbin/sendmail -F "DSL Monitoring $company" -f $from_address $admin_email 2> /dev/null
+   fi # END if $changed
+
+
+   ## - Set IP-adresses for Ping-Test at next run
+   ## -
+   if [[ ${#online_devices_arr[@]} -gt 0 ]]; then
+
+      ## - Try to set IP-Addresses for ping test
+      ## -
+      set_ping_addresses
+
+   elif [[ ${#dsl_gw_available_arr[@]} -gt 0 ]]; then
+
+      echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] Try to set default gateway to an existing DSL line .." >> $log_file
+
+      __set_default_gatway=false
+      default_gw_deleted=false
+
+      for _device in "${dsl_devices_arr[@]}" ; do
+
+         if $DEBUG ; then
+            echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] Device: $_device - Gateway: ${dsl_gw_available_arr[$_device]}" >> $log_file
+         fi
+
+         if [[ -n "${dsl_gw_available_arr[$_device]}" ]]; then
+
+            ## - Delete old default route
+            ## -
+            if ! $default_gw_deleted ; then
+               if $DEBUG ; then
+                  echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] /sbin/ip route delete default" >> $log_file
+                  /sbin/ip route delete default >> $log_file 2>&1
+               else
+                  /sbin/ip route delete default > /dev/null 2>&1
+               fi
+               default_gw_deleted=true
+            fi
+            
+            ## - Try to set default gateway to this DSL connection
+            ## -
+            if $DEBUG ; then
+               echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] /sbin/ip route add default via ${dsl_gw_available_arr[$_device]} dev $_device" >> $log_file
+               /sbin/ip route add default via ${dsl_gw_available_arr[$_device]} dev $_device >> $log_file 2>&1
+            else
+               /sbin/ip route add default via ${dsl_gw_available_arr[$_device]} dev $_device > /dev/null 2>&1
+            fi
+            if [[ "$?" == "0" ]]; then
+               __set_default_gatway=true
+               break
+            fi
+         fi
+
+      done # END: for _device in "${inet_devices_arr[@]}"
+
+      if ! $__set_default_gatway ; then
+         echo "`date +'%Y-%m-%d %H:%M:%S'` [ Error ] No default gateway (for DSL Device ${_device}) is set!"  >> $log_file
+      else
+         echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] Default gateway on DSL Device $_device is set to ${inet_devices_arr[$_device]}"  >> $log_file 
+
+
+         ## - Try to set IP-Addresses for ping test
+         ## -
+         set_ping_addresses
+      fi
+
+   elif [[  ${#static_devices_arr[@]} -gt 0 ]]; then
+
+      echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] Try to set default gateway to an existing static line .." >> $log_file
+
+      __set_default_gatway=false
+      default_gw_deleted=false
+
+      for _device in "${static_devices_arr[@]}" ; do
+
+            ## - Delete old default route
+            ## -
+            if ! $default_gw_deleted ; then
+               if $DEBUG ; then
+                  echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] /sbin/ip route delete default" >> $log_file
+                  /sbin/ip route delete default >> $log_file 2>&1
+               else
+                  /sbin/ip route delete default > /dev/null 2>&1
+               fi
+               default_gw_deleted=true
+            fi
+
+            ## - Set new default route
+            ## -
+            if $DEBUG ; then
+               echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] /sbin/ip route add default via ${static_gw_arr[$_device]} dev $_device" >> $log_file
+               /sbin/ip route add default via ${static_gw_arr[$_device]} dev $_device >> $log_file 2>&1
+            else
+               /sbin/ip route add default via ${static_gw_arr[$_device]} dev $_device > /dev/null 2>&1
+            fi
+
+            if [[ "$?" == 0 ]] ; then
+               __set_default_gatway=true
+               break
+            fi
+      done
+
+      if ! $__set_default_gatway ; then
+         echo "`date +'%Y-%m-%d %H:%M:%S'` [ Error ] No default gateway is set!"  >> $log_file
+      else
+         echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] Default gateway is set to ${static_gw_arr[$_device]}"  >> $log_file
+
+         ## - Try to set IP-Addresses for ping test
+         ## -
+         set_ping_addresses
+
+      fi
+
+   fi # if [[ ${#online_devices_arr[@]} -gt 0 ]]
+
+   sleep 30
+
+done
+
+exit 0
diff --git a/GA-Schloss/sbin/ipt-firewall-gateway b/GA-Schloss/sbin/ipt-firewall-gateway
new file mode 100755
index 0000000..5be1a57
--- /dev/null
+++ b/GA-Schloss/sbin/ipt-firewall-gateway
@@ -0,0 +1,3947 @@
+#!/usr/bin/env bash
+
+### BEGIN INIT INFO
+# Provides:          ipt-firewall
+# Required-Start:    $local_fs $remote_fs $syslog $network $time
+# Required-Stop:     $local_fs $remote_fs $syslog $network
+# Should-Start:
+# Should-Stop:
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: IPv4 Firewall
+### END INIT INFO
+
+
+# -------------
+# - Settings
+# -------------
+
+ipt_conf_dir="/etc/ipt-firewall"
+
+inc_functions_file="${ipt_conf_dir}/include_functions.conf"
+
+load_modules_file=${ipt_conf_dir}/load_modules_ipv4.conf
+
+conf_logging=${ipt_conf_dir}/logging_ipv4.conf
+conf_interfaces=${ipt_conf_dir}/interfaces_ipv4.conf
+conf_default_ports=${ipt_conf_dir}/default_ports.conf
+conf_main=${ipt_conf_dir}/main_ipv4.conf
+conf_post_declarations=${ipt_conf_dir}/post_decalrations.conf
+
+# -------------
+# - Some checks and preloads..
+# -------------
+
+ipt=$(which iptables)
+
+if [[ -z "$ipt" ]] ; then
+   echo ""
+   echo -e "\tiptables was not found on this server!"
+   echo
+   echo -e "\tFirewall Script was stopped!"
+   echo
+   exit 1
+fi
+
+if [[ ! -f "$inc_functions_file" ]] ; then
+   echo ""
+   echo -e "\tMissing include file '$inc_functions_file'"
+   echo
+   echo -e "\tFirewall Script was stopped!"
+   echo
+   exit 1
+else
+   source $inc_functions_file
+fi
+
+if [[ ! -f "$load_modules_file" ]]; then
+   warn "No modules for loading configured. Missing file '$load_modules_file'!"
+else
+
+   while read -r module ; do
+      if ! lsmod | grep -q -E "^$module\s+" ; then
+         /sbin/modprobe  $module > /dev/null 2>&1
+         if [[ "$?" != "0" ]]; then
+            warn "Loading module '$module' failed!"
+         fi
+      fi
+   done < <(sed -ne 's/^[[:space:]]*\([^#].*\)[[:space:]]*/\1/p' $load_modules_file)
+
+fi
+
+if [[ ! -f "$conf_logging" ]]; then
+   fatal "Missing configuration for logging - file '$conf_logging'"
+else
+   source $conf_logging
+fi
+
+if [[ ! -f "$conf_default_ports" ]]; then
+   fatal "Missing configuration for default_ports - file '$conf_default_ports'"
+else
+   source $conf_default_ports
+fi
+
+if [[ ! -f "$conf_interfaces" ]]; then
+   fatal "Missing interface configurations  - file '$conf_interfaces'"
+else
+   source $conf_interfaces
+fi
+
+if [[ ! -f "$conf_main" ]]; then
+   fatal "Missing main configurations  - file '$conf_main'"
+else
+   source $conf_main
+fi
+
+if [[ ! -f "$conf_post_declarations" ]]; then
+   fatal "Missing post declarations  - file '$conf_post_declarations'"
+else
+   source $conf_post_declarations
+fi
+
+
+echo
+if $terminal ; then
+   echo -e "\033[37m\033[1m\tStarting firewall iptables (IpV4)..\033[m"
+else
+   echo "Starting firewall iptables (IpV4).."
+fi
+echo
+
+
+# -------------
+# --- Activate IP Forwarding
+# -------------
+
+## - IP Forwarding aktivieren/deaktivieren. 
+## -
+## - Dieses benötigen wir lediglich bei einem Rechner in mehreren Netzen. 
+## - Es ist anzuraten, diese Einstellung vor allen anderen vorzunehmen, 
+## - weil hiermit auch andere (de)aktiviert werden.
+## -
+if $kernel_activate_forwarding ; then
+   echo 1 > /proc/sys/net/ipv4/ip_forward
+   echononl "\tActivate Forwarding.."
+   echo_done
+else
+   echo 0 > /proc/sys/net/ipv4/ip_forward
+   echononl "\t\033[33m\033[1mDisable Forwarding.."
+   echo_done
+fi
+
+if $kernel_support_dynaddr ; then
+   echononl "\tActivate kernel support for dynamic addresses.."
+   if [[ -n $dynaddr_flag ]] && [[ $dynaddr_flag =~ ^-?[0-9]+$ ]]; then
+      echo $dynaddr_flag > /proc/sys/net/ipv4/ip_dynaddr
+      echo_done
+   else
+      echo_failed
+   fi
+else
+   echo 0 > /proc/sys/net/ipv4/ip_dynaddr
+   echononl "\t\033[33m\033[1mDisable Forwarding..\033[m"
+   echo_done
+fi
+
+# -------------
+# --- Adjust Kernel Parameters (Security/Tuning)
+# -------------
+
+echononl "\tAdjust Kernel Parameters (Security/Tuning).."
+
+if $adjust_kernel_parameters ; then
+   ## - Reduce DoS'ing ability by reducing timeouts
+   ## -
+   if $kernel_reduce_timeouts ; then
+      echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
+      echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time
+      echo 1 > /proc/sys/net/ipv4/tcp_window_scaling
+      echo 0 > /proc/sys/net/ipv4/tcp_sack
+   fi
+
+   ## - SYN COOKIES
+   ## -
+   if  $kernel_tcp_syncookies ; then
+      echo 1 > /proc/sys/net/ipv4/tcp_syncookies
+      echo 2048 > /proc/sys/net/ipv4/tcp_max_syn_backlog
+      echo 3 > /proc/sys/net/ipv4/tcp_synack_retries
+   fi
+
+   ## - Protection against ICMP bogus error responses
+   ## -
+   if $kernel_protect_against_icmp_bogus_messages ; then
+      echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
+   fi
+
+   ## - Ignore Broadcast Pings
+   ## - 
+   if $kernel_ignore_broadcast_ping ; then
+      echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
+   fi
+
+   ## - Deactivate Source Routed Packets
+   ## - 
+   if $kernel_deactivate_source_route ; then
+      for asr in /proc/sys/net/ipv4/conf/*/accept_source_route ; do
+         echo 0 > $asr
+      done
+   fi
+
+   ## - Deactivate sending ICMP redirects
+   ## -
+   if ! $telekom_internet_tv ; then
+      if $kernel_dont_accept_redirects ; then
+         for rp_filter in /proc/sys/net/ipv4/conf/*/rp_filter ; do
+            echo 1 > $rp_filter
+         done
+      else
+         for rp_filter in /proc/sys/net/ipv4/conf/*/rp_filter ; do
+            echo 0 > $rp_filter
+         done
+      fi
+   fi
+
+   ## - Logging of spoofed (source routed" and "redirect") packets
+   ## -
+   if $kernel_log_martians ; then
+      echo "0" > /proc/sys/net/ipv4/conf/all/log_martians
+   fi
+
+   echo_done # Adjust Kernel Parameters (Security/Tuning)
+else
+   echo_skipped
+fi
+
+
+# -------------
+# --- Set default policies / Flush Rules
+# -------------
+
+echo
+echononl "\tFlushing firewall iptable (IPv4).."
+
+# - default policies
+# -
+$ipt -P INPUT ACCEPT
+$ipt -P OUTPUT ACCEPT
+$ipt -P FORWARD ACCEPT
+
+## - flush chains
+## -
+$ipt -F
+$ipt -F INPUT
+$ipt -F OUTPUT
+$ipt -F FORWARD
+$ipt -F -t mangle
+$ipt -F -t nat
+$ipt -F -t raw
+$ipt -X
+$ipt -Z
+
+$ipt -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+
+unset natted_interface_arr
+declare -a natted_interface_arr
+
+for _dev in ${nat_device_arr[@]} ; do
+   $ipt -t nat -A POSTROUTING -o $_dev -j MASQUERADE
+   natted_interface_arr+=("$_dev")
+done
+
+if [[ ${#nat_network_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _val in "${nat_network_arr[@]}" ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+
+      # - Prevent natting on an interface already natted
+      # -
+      if containsElement "${_val_arr[1]}" "${nat_device_arr[@]}" ; then
+         continue
+      fi
+
+      $ipt -t nat -A POSTROUTING -o ${_val_arr[1]} -d ${_val_arr[0]} -j MASQUERADE
+   done
+fi
+
+if $telekom_internet_tv ; then
+   $ipt -t nat -A POSTROUTING -o $tv_extern_if -j MASQUERADE
+fi
+
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+if [[ ${#masquerade_tcp_con_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _val in "${masquerade_tcp_con_arr[@]}" ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${_val_arr[3]}" ]] ; then
+         no_if_for_ip_arr+=("${_val_arr[1]}")
+         continue
+      fi
+      $ipt -t nat -A POSTROUTING -o ${_val_arr[3]} -p tcp -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -j MASQUERADE
+   done
+fi
+
+#echo_done # Flushing firewall iptable (IPv4)..
+if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+   echo_warning
+   for _ip in ${no_if_for_ip_arr[@]} ; do
+      warn "Masquerading for ip '$_ip' was omitted - No idestination interface present!"
+   done
+else
+   echo_done
+fi
+echo
+
+
+# -------------
+# - Log given IP Addresses
+# -------------
+
+echononl "\tLog given IP Addresses"
+if [[ ${#log_ip_arr[@]} -gt 0 ]]; then
+   for _ip in ${log_ip_arr[@]} ; do
+      $ipt -A INPUT -s $_ip -j LOG --log-prefix "IPv4: $_ip IN: " --log-level $log_level
+      $ipt -A OUTPUT -d $_ip -j LOG --log-prefix "IPv4: $_ip OUT: " --log-level $log_level
+      $ipt -A FORWARD -s $_ip -j LOG --log-prefix "IPv4: $_ip FORWARD FROM: " --log-level $log_level
+      $ipt -A FORWARD -d $_ip -j LOG --log-prefix "IPv4: $_ip FORWARD TO: " --log-level $log_level
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# -------------
+# --- Stopping firewall if only flushing was requested (parameter flush)
+# -------------
+
+case $1 in
+   flush)
+      warn No firewall rules are active!
+      exit 0;;
+esac
+
+
+# ---
+# - Stop here, if no extern interface is configured
+# ---
+
+if [[ ${#ext_if_arr[@]} -lt 1 ]] ; then
+   fatal "No extern Interface is configured!"
+fi
+
+
+
+# -------------
+# --- Traffic Shaping
+# -------------
+
+echo ""
+if $terminal ; then
+   echononl "\033[37m\033[1m\tStarting outbound shaping...\033[m"
+else
+   echo -n "Starting outbound shaping"
+fi
+
+if $TRAFFIC_SHAPING  && [[ -n "$TC_DEV" ]] ; then
+
+   tc=$(which tc)
+
+   if [[ -z "$tc" ]]; then
+      echo_skipped
+      warn "'tc'-programm not found. Outbound shaping was ommitted!"
+   else
+
+      ## - Löschen aller Klassen für $TC_DEV und der Filterregeln
+      ## -
+      $tc qdisc del dev $TC_DEV root 2> /dev/null > /dev/null
+      $ipt -t mangle -D POSTROUTING -o $TC_DEV -j MYSHAPER-OUT 2> /dev/null > /dev/null
+      $ipt -t mangle -F MYSHAPER-OUT 
+      $ipt -t mangle -X MYSHAPER-OUT
+
+
+      # add HTB root qdisc
+      $tc qdisc add dev $TC_DEV root handle 1:0 htb default 26
+
+      # add main rate limit class(es)
+      $tc class add dev $TC_DEV parent 1: classid 1:1 htb rate ${LIMIT_UP}kbit 
+
+      # create fair-share-classes, descending priority 
+      $tc class add dev $TC_DEV parent 1:1 classid 1:20 htb rate ${LIMIT_CLASS}kbit ceil ${LIMIT_UP}kbit prio 0
+      $tc class add dev $TC_DEV parent 1:1 classid 1:21 htb rate ${LIMIT_CLASS}kbit ceil ${LIMIT_UP}kbit prio 1
+      $tc class add dev $TC_DEV parent 1:1 classid 1:22 htb rate ${LIMIT_CLASS}kbit ceil ${LIMIT_UP}kbit prio 2
+      $tc class add dev $TC_DEV parent 1:1 classid 1:23 htb rate ${LIMIT_CLASS}kbit ceil ${LIMIT_UP}kbit prio 3
+      $tc class add dev $TC_DEV parent 1:1 classid 1:24 htb rate ${LIMIT_CLASS}kbit ceil ${LIMIT_UP}kbit prio 4
+      $tc class add dev $TC_DEV parent 1:1 classid 1:25 htb rate ${LIMIT_CLASS}kbit ceil ${LIMIT_UP}kbit prio 5
+      $tc class add dev $TC_DEV parent 1:1 classid 1:26 htb rate ${LIMIT_CLASS}kbit ceil ${LIMIT_UP}kbit prio 6
+
+
+      # attach qdisc to leaf classes 
+      #
+      #    here we at SFQ to each priority class.  SFQ insures that
+      #    within each class connections will be treated (almost) fairly.
+      $tc qdisc add dev $TC_DEV parent 1:20 handle 20: sfq perturb 10
+      $tc qdisc add dev $TC_DEV parent 1:21 handle 21: sfq perturb 10
+      $tc qdisc add dev $TC_DEV parent 1:22 handle 22: sfq perturb 10
+      $tc qdisc add dev $TC_DEV parent 1:23 handle 23: sfq perturb 10
+      $tc qdisc add dev $TC_DEV parent 1:24 handle 24: sfq perturb 10
+      $tc qdisc add dev $TC_DEV parent 1:25 handle 25: sfq perturb 10
+      $tc qdisc add dev $TC_DEV parent 1:26 handle 26: sfq perturb 10
+
+
+      # filter traffic into classes by fwmark
+      #
+      #    here we direct traffic into priority class according to
+      #    the fwmark set on the packet (we set fwmark with iptables
+      #    later).  Note that above we've set the default priority
+      #    class to 1:26 so unmarked packets (or packets marked with
+      #    unfamiliar IDs) will be defaulted to the lowest priority
+      #    class.
+      $tc filter add dev $TC_DEV parent 1:0 prio 0 protocol ip handle 20 fw flowid 1:20
+      $tc filter add dev $TC_DEV parent 1:0 prio 0 protocol ip handle 21 fw flowid 1:21
+      $tc filter add dev $TC_DEV parent 1:0 prio 0 protocol ip handle 22 fw flowid 1:22
+      $tc filter add dev $TC_DEV parent 1:0 prio 0 protocol ip handle 23 fw flowid 1:23
+      $tc filter add dev $TC_DEV parent 1:0 prio 0 protocol ip handle 24 fw flowid 1:24
+      $tc filter add dev $TC_DEV parent 1:0 prio 0 protocol ip handle 25 fw flowid 1:25
+      $tc filter add dev $TC_DEV parent 1:0 prio 0 protocol ip handle 26 fw flowid 1:26
+
+
+      # add MYSHAPER-OUT chain to the mangle table in iptables
+      #
+      #    this sets up the table we'll use
+      #    to filter and mark packets.
+      $ipt -t mangle -N MYSHAPER-OUT
+      $ipt -t mangle -I POSTROUTING -o $TC_DEV -j MYSHAPER-OUT
+
+
+      # add fwmark entries to classify different types of traffic
+      #
+      #    Set fwmark from 20-26 according to
+      #    desired class. 20 is highest prio.
+
+      # mark 20 - high prio 0
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j MARK --set-mark 20
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j RETURN
+      $ipt -t mangle -A MYSHAPER-OUT -p icmp -j MARK --set-mark 20
+      $ipt -t mangle -A MYSHAPER-OUT -p icmp -j RETURN
+
+      # mark 21 - high prio 1 
+      #    - DNS Service
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --dport 53 -j MARK --set-mark 21
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --dport 53 -j RETURN
+
+      # mark 22 - high prio 2
+      #    - VoIP SIP (sip ports, rtp ports, stun ports(3478))
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --sport ${RTP_PORTS_START}:${RTP_PORTS_END} -j MARK --set-mark 22
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --sport ${RTP_PORTS_START}:${RTP_PORTS_END} -j RETURN
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --dport ${SIP_PORT_REMOTE} -j MARK --set-mark 22
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --dport ${SIP_PORT_REMOTE} -j RETURN
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --sport ${SIP_PORT_LOCAL} -j MARK --set-mark 22
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --sport ${SIP_PORT_LOCAL} -j RETURN
+      $ipt -t mangle -A MYSHAPER-OUT -p udp -m multiport --dport ${STUN_PORTS} -j MARK --set-mark 22
+      $ipt -t mangle -A MYSHAPER-OUT -p udp -m multiport --dport ${STUN_PORTS} -j RETURN
+
+      # mark 23 - prio 3
+      #    - OpenVPN
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m multiport --sport 1094,1095 -j MARK --set-mark 23 
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m multiport --sport 1094,1095 -j RETURN
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp --dport 22 -j MARK --set-mark 23
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp --dport 22 -j RETURN
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp --sport 22 -j MARK --set-mark 23 
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp --sport 22 -j RETURN
+
+      # mark 24 - prio 4
+      #    - WWW
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m multiport --dport 80,443 -j MARK --set-mark 24
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m multiport --dport 80,443 -j RETURN
+
+
+      # mark 25 - prio 5
+      #    - Mailtraffic
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m multiport --dport 587,110,995,143,993 -j MARK --set-mark 25
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m multiport --dport 587,110,995,143,993 -j RETURN
+
+
+      # Remaining packets are marked according to TOS
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m tos --tos Minimize-Delay -m mark --mark 0 -j MARK --set-mark 22
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m tos --tos Maximize-Throughput -m mark --mark 0 -j MARK --set-mark 22
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m tos --tos Minimize-Cost -m mark --mark 0 -j MARK --set-mark 25
+      # redundant- mark any unmarked packets as 26 (low prio)
+      $ipt -t mangle -A MYSHAPER-OUT -m mark --mark 0 -j MARK --set-mark 26
+
+      echo_done
+   fi
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Provide (Telekom) IP TV
+# ---
+
+echo
+echononl "\tProvide (Telekom) Internet TV"
+
+if $telekom_internet_tv && [[ -n "$tv_local_if" ]] ; then
+
+   # - Telekom VDSL - Rules for IPTV 
+   # -
+   $ipt -A INPUT -i $tv_local_if -p igmp -s $tv_ip -j ACCEPT
+   #$ipt -A INPUT -i $tv_local_if -p igmp -j DROP
+
+   $ipt -A FORWARD -s $tv_ip -j ACCEPT
+   $ipt -A FORWARD -d $tv_ip -j ACCEPT
+
+   $ipt -A FORWARD -i $tv_ip -j ACCEPT
+   $ipt -A FORWARD -o $tv_ip -j ACCEPT
+
+
+   # - Forward all networks defined defind by igmpproxy
+   # - (see: phyint eth2.8 upstream  ratelimit 0  threshold 1)
+   #
+   #$ipt -A FORWARD -s 217.0.119.0/24 -d 224.0.0.0/4 -j ACCEPT
+   #$ipt -A FORWARD -s 193.158.35.0/24 -d 224.0.0.0/4 -j ACCEPT
+   #$ipt -A FORWARD -s 239.35.100.6/24 -d 224.0.0.0/4 -j ACCEPT
+   #$ipt -A FORWARD -s 93.230.64.0/19 -d 224.0.0.0/4 -j ACCEPT
+   $ipt -A FORWARD -d 224.0.0.0/4 -j ACCEPT
+   $ipt -A FORWARD -s 224.0.0.0/4 -j ACCEPT
+
+   $ipt -A OUTPUT -d 224.0.0.0/4 -j ACCEPT
+   $ipt -A INPUT -d 224.0.0.0/4 -j ACCEPT
+
+   $ipt -A INPUT -i $tv_extern_if -d 224.0.0.0/4 -j ACCEPT
+   $ipt -A INPUT -i $tv_local_if -d 224.0.0.0/4 -j ACCEPT
+   $ipt -A OUTPUT -o $tv_extern_if -d 224.0.0.0/4 -j ACCEPT
+   $ipt -A OUTPUT -o $tv_local_if -d 224.0.0.0/4 -j ACCEPT
+
+   #$ipt -A FORWARD -d 224.0.0.0/4 -j ACCEPT
+   $ipt -A FORWARD -i $tv_local_if -o $tv_extern_if -j ACCEPT
+   $ipt -A FORWARD -i $tv_extern_if -d 224.0.0.0/4 -j ACCEPT
+   
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# -------------
+# --- Pass through Devices Interfaces (not firewalled)
+# -------------
+
+if [[ ${#unprotected_if_arr[@]} -gt 0 ]]; then
+   echononl "\tPass through Devices (not firewalled)"
+   for _dev in ${unprotected_if_arr[@]} ; do
+      if $log_unprotected || $log_all ; then
+         $ipt -A INPUT -i $_dev -j LOG --log-prefix "$log_prefix Not firewalled ${_dev}: " --log-level $log_level
+         $ipt -A OUTPUT -o $_dev -j LOG --log-prefix "$log_prefix Not firewalled ${_dev}: " --log-level $log_level
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -i $_dev -j LOG --log-prefix "$log_prefix Not firewalled ${_dev}: " --log-level $log_level
+            $ipt -A FORWARD -o $_dev -j LOG --log-prefix "$log_prefix Not firewalled ${_dev}: " --log-level $log_level
+         fi
+      fi
+      $ipt -A INPUT -i $_dev -j ACCEPT
+      $ipt -A OUTPUT -o $_dev -j ACCEPT
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -i $_dev -j ACCEPT
+         $ipt -A FORWARD -o $_dev -j ACCEPT
+      fi
+   done
+   echo_done
+fi
+
+
+
+# -------------
+# --- Block IPs / Networks / Interfaces
+# -------------
+echononl "\tBlock IPs / Networks / Interfaces.."
+
+
+# ---
+# - Block IPs
+# ---
+
+for _ip in $blocked_ips ; do
+   for _dev in ${ext_if_arr[@]} ; do
+      if $log_blocked_ip || $log_all ; then
+         $ipt -A INPUT -i $_dev -s $_ip -j LOG --log-prefix "$log_prefix Blocked ${_ip}: " --log-level $log_level
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -i $_dev -s $_ip -j LOG --log-prefix "$log_prefix Blocked ${_ip}: " --log-level $log_level
+         fi
+      fi
+      $ipt -A INPUT -i $_dev -s $_ip -j DROP
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -i $_dev -s $_ip -j DROP
+      fi
+   done
+done
+
+
+# ---
+# - Block Interfaces
+# ---
+
+for _if in ${blocked_if_arr[@]} ; do
+   if $log_blocked_if || $log_all ; then
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -i $_if -j LOG --log-prefix "$log_prefix Blocked IF ${_if}: " --log-level $log_level
+         $ipt -A FORWARD -o $_if -j LOG --log-prefix "$log_prefix Blocked IF ${_if}: " --log-level $log_level
+      fi
+      $ipt -A INPUT -i $_if -j LOG --log-prefix "$log_prefix Blocked IF ${_if}: " --log-level $log_level
+      $ipt -A OUTPUT -o $_if -j LOG --log-prefix "$log_prefix Blocked IF ${_if}: " --log-level $log_level
+   fi
+   if $kernel_activate_forwarding ; then
+      $ipt -A FORWARD -i $_if -j DROP
+      $ipt -A FORWARD -o $_if -j DROP
+   fi
+   $ipt -A INPUT -i $_if -j DROP
+   $ipt -A OUTPUT -o $_if -j DROP
+done
+
+echo_done # Block IPs / Networks / Interfaces..
+
+
+# ---
+# - Allow Forwarding certain private Addresses
+# ---
+
+echononl "\tAllow forwarding (private) IPs / IP-Ranges.."
+if [[ ${#forward_private_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${forward_private_ip_arr[@]}; do
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -d $_ip -j ACCEPT
+         $ipt -A FORWARD -s $_ip -j ACCEPT
+         echo_done
+      else
+         echo_skipped
+      fi
+   done
+else
+   echo_skipped
+fi
+
+
+# -------------
+# --- Protections against several attacks / unwanted packages
+# -------------
+echo
+echononl "\tProtections against several attacks / unwanted packages.."
+
+if $protect_against_several_attacks ; then
+
+   # ---
+   # - Protection against syn-flooding
+   # ---
+
+   $ipt -N syn-flood
+   $ipt -A syn-flood -m limit --limit 1/second --limit-burst 3 -j RETURN
+   if $log_syn_flood || $log_all ; then
+      $ipt -A syn-flood -j LOG --log-prefix "$log_prefix SYN flood: " --log-level $log_level
+   fi
+   $ipt -A syn-flood -j DROP
+
+
+   # ---
+   # - Drop Fragments
+   # ---
+
+   # I have to say that fragments scare me more than anything.
+   # Sending lots of non-first fragments was what allowed Jolt2  to effectively "drown"
+   # Firewall-1. Fragments can be overlapped, and the subsequent interpretation of such
+   # fragments is very OS-dependent (see this paper for details).
+   # I am not going to trust any fragments.
+   # Log fragments just to see if we get any, and deny them too
+
+   for _dev in ${ext_if_arr[@]} ; do
+      if $log_fragments || $log_all ; then
+         $ipt -A INPUT -i $_dev -f -j LOG --log-prefix "$log_prefix IPTABLES FRAGMENTS: " --log-level $log_level
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -i $_dev -f -j LOG --log-prefix "$log_prefix IPTABLES FRAGMENTS: " --log-level $log_level
+         fi
+      fi
+      $ipt -A INPUT -i $_dev -f -j DROP
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -i $_dev -f -j DROP
+      fi
+   done
+
+
+   # ---
+   # - drop new packages without syn flag
+   # ---
+
+   #if $log_new_not_sync || $log_all  ; then
+   #   $ipt -A INPUT -p tcp ! --syn -m conntrack --ctstate NEW -j  LOG --log-prefix "$log_prefix New but not SYN: " --log-level $log_level
+   #   $ipt -A OUTPUT -p tcp ! --syn -m conntrack --ctstate NEW -j LOG --log-prefix "$log_prefix New but not SYN: " --log-level $log_level
+   #   if $kernel_activate_forwarding ; then
+   #      $ipt -A FORWARD -p tcp ! --syn -m conntrack --ctstate NEW -j LOG --log-prefix "$log_prefix New but not SYN: " --log-level $log_level
+   #   fi
+   #fi
+   #$ipt -A INPUT -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
+   #$ipt -A OUTPUT -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
+   #if $kernel_activate_forwarding ; then
+   #   $ipt -A FORWARD -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
+   #fi
+
+
+   # ---
+   # - drop invalid packages
+   # ---
+
+   #if $log_invalid_state || $log_all  ; then
+   #   $ipt -A INPUT -m conntrack --ctstate INVALID -j LOG --log-prefix "$log_prefix Invalid state: " --log-level $log_level
+   #   if $kernel_activate_forwarding ; then
+   #      $ipt -A FORWARD -m conntrack --ctstate INVALID -j LOG --log-prefix "$log_prefix Invalid state: " --log-level $log_level
+   #   fi
+   #fi
+   #$ipt -A INPUT -m conntrack --ctstate INVALID -j DROP
+   #if $kernel_activate_forwarding ; then
+   #   $ipt -A FORWARD -m conntrack --ctstate INVALID -j DROP
+   #fi
+
+
+   # ---
+   # - ungewöhnliche Flags verwerfen
+   # ---
+
+   for _dev in ${ext_if_arr[@]} ; do
+      if $log_invalid_flags || $log_all ; then
+         $ipt -A INPUT -i $_dev -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j LOG --log-prefix "$log_prefix Invalid flags: " --log-level $log_level
+         $ipt -A INPUT -i $_dev -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG --log-prefix "$log_prefix Invalid flags: " --log-level $log_level
+         $ipt -A INPUT -i $_dev -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "$log_prefix Invalid flags: " --log-level $log_level
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -i $_dev -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j LOG --log-prefix "$log_prefix Invalid flags: " --log-level $log_level
+            $ipt -A FORWARD -i $_dev -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG --log-prefix "$log_prefix Invalid flags: " --log-level $log_level
+            $ipt -A FORWARD -i $_dev -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "$log_prefix Invalid flags: " --log-level $log_level
+         fi
+      fi
+      $ipt -A INPUT -i $_dev -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
+      $ipt -A INPUT -i $_dev -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
+      $ipt -A INPUT -i $_dev -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -i $_dev -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
+         $ipt -A FORWARD -i $_dev -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
+         $ipt -A FORWARD -i $_dev -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
+      fi
+   done
+
+
+   # ---
+   # - Refuse private addresses on extern interfaces
+   # ---
+
+   # Refuse packets claiming to be from a 
+   #   Class A private network
+   #   Class B private network
+   #   Class C private network
+   #   loopback interface
+   #   Class D multicast address
+   #   Class E reserved IP address
+   #   broadcast address
+   for _dev in ${dsl_device_arr[@]} ; do
+      if $log_spoofed || $log_all ; then
+         $ipt -A INPUT -i $_dev -s $priv_class_a -j LOG --log-prefix "$log_prefix Class A private net: " --log-level $log_level
+         $ipt -A INPUT -i $_dev -s $priv_class_b -j LOG --log-prefix "$log_prefix Class B private net: " --log-level $log_level
+         $ipt -A INPUT -i $_dev -s $priv_class_c -j LOG --log-prefix "$log_prefix Class C private net: " --log-level $log_level
+         $ipt -A INPUT -i $_dev -s $loopback -j LOG --log-prefix "$log_prefix From Loopback: " --log-level $log_level
+         $ipt -A INPUT -i $_dev -s $class_d_multicast -j LOG --log-prefix "$log_prefix Class D Multicast: " --log-level $log_level
+         $ipt -A INPUT -i $_dev -s $class_e_reserved -j LOG --log-prefix "$log_prefix Class E reserved: " --log-level $log_level
+         #$ipt -A INPUT -i $_dev -d $broadcast_addr -j LOG --log-prefix "$log_prefix Broadcast Address: " --log-level $log_level
+         #
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -i $_dev -s $priv_class_a -j LOG --log-prefix "$log_prefix Class A private net: " --log-level $log_level
+            $ipt -A FORWARD -i $_dev -s $priv_class_b -j LOG --log-prefix "$log_prefix Class B private net: " --log-level $log_level
+            $ipt -A FORWARD -i $_dev -s $priv_class_c -j LOG --log-prefix "$log_prefix Class C private net: " --log-level $log_level
+            $ipt -A FORWARD -i $_dev -s $loopback -j LOG --log-prefix "$log_prefix From Loopback: " --log-level $log_level
+            $ipt -A FORWARD -i $_dev -s $class_d_multicast -j LOG --log-prefix "$log_prefix Class D Multicast: " --log-level $log_level
+            $ipt -A FORWARD -i $_dev -s $class_e_reserved -j LOG --log-prefix "$log_prefix Class E reserved: " --log-level $log_level
+            #$ipt -A FORWARD -i $_dev -d $broadcast_addr -j LOG --log-prefix "$log_prefix Broadcast Address: " --log-level $log_level
+         fi
+      fi
+      # Refuse packets claiming to be from a Class A private network.
+      $ipt -A INPUT -i $_dev -s $priv_class_a -j DROP
+      # Refuse packets claiming to be from a Class B private network.
+      $ipt -A INPUT -i $_dev -s $priv_class_b -j DROP
+      # Retfuse packets claiming to be from a Class C private network.
+      $ipt -A INPUT -i $_dev -s $priv_class_c -j DROP
+      # Refuse packets claiming to be from loopback interface.
+      $ipt -A INPUT -i $_dev -s $loopback -j DROP
+      # Refuse Class D multicast addresses. Multicast is illegal as a source address.
+      $ipt -A INPUT -i $_dev -s $class_d_multicast -j DROP
+      # Refuse Class E reserved IP addresses.
+      $ipt -A INPUT -i $_dev -s $class_e_reserved -j DROP
+      # Refuse broadcast address packets.
+      #$ipt -A INPUT -i $_dev -d $broadcast_addr -j DROP
+      if $kernel_activate_forwarding ; then
+         # Refuse packets claiming to be from a Class A private network.
+         $ipt -A FORWARD -i $_dev -s $priv_class_a -j DROP
+         # Refuse packets claiming to be from a Class B private network.
+         $ipt -A FORWARD -i $_dev -s $priv_class_b -j DROP
+         # Refuse packets claiming to be from a Class C private network.
+         $ipt -A FORWARD -i $_dev -s $priv_class_c -j DROP
+         # Refuse packets claiming to be from loopback interface.
+         $ipt -A FORWARD -i $_dev -s $loopback -j DROP
+         # Refuse Class D multicast addresses. Multicast is illegal as a source address.
+         $ipt -A FORWARD -i $_dev -s $class_d_multicast -j DROP
+         # Refuse Class E reserved IP addresses.
+         $ipt -A FORWARD -i $_dev -s $class_e_reserved -j DROP
+         # Refuse broadcast address packets.
+         #$ipt -A FORWARD -i $_dev -d $broadcast_addr -j DROP
+      fi
+   done
+
+
+   # ---
+   # - Refuse packets claiming to be to the loopback interface.
+   # ---
+
+   # Refusing packets claiming to be to the loopback interface protects against
+   # source quench, whereby a machine can be told to slow itself down by an icmp source
+   # quench to the loopback.
+   for _dev in ${ext_if_arr[@]} ; do
+      if $log_to_lo || $log_all ; then
+         $ipt -A INPUT -i $_dev -d $loopback -j LOG --log-prefix "$log_prefix To Loopback: " --log-level $log_level
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -i $_dev -d $loopback -j LOG --log-prefix "$log_prefix To Loopback: " --log-level $log_level
+         fi
+      fi
+      $ipt -A INPUT -i $_dev -d $loopback -j DROP
+      if $kernel_activate_forwarding  ; then
+         $ipt -A FORWARD -i $_dev -d $loopback -j DROP
+      fi
+   done
+
+
+   # ---
+   # - Don't allow spoofing from that server
+   # ---
+
+   for _dev in ${dsl_device_arr[@]} ; do
+      if $log_spoofed_out || $log_all ; then
+         $ipt -A OUTPUT -o $_dev -s $priv_class_a -j LOG --log-prefix "$log_prefix out Class A: " --log-level $log_level
+         $ipt -A OUTPUT -o $_dev -s $priv_class_b -j LOG --log-prefix "$log_prefix out Class B: " --log-level $log_level
+         $ipt -A OUTPUT -o $_dev -s $priv_class_c -j LOG --log-prefix "$log_prefix out Class C: " --log-level $log_level
+         $ipt -A OUTPUT -o $_dev -s $loopback -j LOG --log-prefix "$log_prefix out Loopback: " --log-level $log_level
+      fi
+      $ipt -A OUTPUT -o $_dev -s $priv_class_a -j DROP
+      $ipt -A OUTPUT -o $_dev -s $priv_class_b -j DROP
+      $ipt -A OUTPUT -o $_dev -s $priv_class_c -j DROP
+      $ipt -A OUTPUT -o $_dev -s $loopback -j DROP
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# -------------
+# --- Log VoIP Traffic (local telephone systems ( ${tel_sys_ip_arr[@]})
+# -------------
+
+if $log_voip || $log_all ; then
+   for _ip in ${tel_sys_ip_arr[@]} ; do
+      $ipt -A FORWARD -d $_ip -j LOG --log-prefix "$log_prefix [VoIP] " --log-level $log_level
+   done
+fi
+#for _PORT in ${VOIP_PORTS} ; do
+#   $ipt -A FORWARD -p udp --sport $_PORT -j LOG --log-prefix "$log_prefix [VoIP] " --log-level $log_level
+#done
+
+
+# -------------
+# ------------- Stopping firewall here if requested (parameter stop)
+# -------------
+
+
+case $1 in
+   sto*)
+      echo
+      if $terminal ; then
+         echo -e "\t\033[37m\033[1mStop was requested. No more firewall rules..\033[m"
+      else
+         echo "Stop was requested. No more firewall rules.."
+      fi
+      echo
+      exit 0;;
+esac
+
+
+echo
+
+
+# -------------
+# --- iPerf
+# -------------
+
+# iPerf is a tool for active measurements of the maximum achievable bandwidth on IP networks. 
+# It supports tuning of various parameters related to timing, buffers and protocols (TCP, UDP, 
+# SCTP with IPv4 and IPv6). For each test it reports the bandwidth, loss, and other parameters.
+
+echononl "\tCreate \"iPerf\" rules.."
+if $create_iperf_rules ; then
+   $ipt -A INPUT -p tcp --dport 5001 -j ACCEPT
+   $ipt -A INPUT -p tcp --sport 5001 -j ACCEPT
+   #
+   $ipt -A OUTPUT -p tcp --dport 5001 -j ACCEPT
+   $ipt -A OUTPUT -p tcp --sport 5001 -j ACCEPT
+   if $kernel_activate_forwarding ; then
+      $ipt -A FORWARD -p tcp --dport 5001 -j ACCEPT
+      $ipt -A FORWARD -p tcp --sport 5001 -j ACCEPT
+   fi
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Drop packets not wanted on gateway
+# ---
+
+echononl "\tDrop packets not wanted on gateway"
+
+for _dev in ${local_if_arr[@]} ; do
+   if $log_not_wanted || $log_all ; then
+      if $not_wanted_ident ; then
+         $ipt -A INPUT -i $_dev -p tcp --dport $standard_ident_port -j LOG --log-prefix "$log_prefix not wanted: " --log-level $log_level
+      fi
+      for _port in ${not_wanted_on_gw_tcp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p tcp --dport $_port -j LOG --log-prefix "$log_prefix not wanted: " --log-level $log_level
+      done
+      for _port in ${not_wanted_on_gw_udp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p udp --dport $_port -j LOG --log-prefix "$log_prefix not wanted: " --log-level $log_level
+      done
+   fi
+   if $not_wanted_ident ; then
+      $ipt -A INPUT -i $_dev -p tcp --dport $standard_ident_port -j REJECT --reject-with tcp-reset 
+   fi
+   for _port in ${not_wanted_on_gw_tcp_port_arr[@]} ; do
+      $ipt -A INPUT -i $_dev -p tcp --dport $_port -j DROP
+   done
+   for _port in ${not_wanted_on_gw_udp_port_arr[@]} ; do
+      $ipt -A INPUT -i $_dev -p udp --dport $_port -j DROP
+   done
+done
+
+echo_done
+
+
+# -------------
+# --- Generally prohibited from WAN
+# -------------
+
+echononl "\tGenerally prohibited from WAN"
+
+for _dev in ${ext_if_arr[@]} ; do
+   if $log_prohibited || $log_all ; then
+      if $block_ident ; then
+         $ipt -A INPUT -p tcp -i $_dev --dport $standard_ident_port -j LOG --log-prefix "$log_prefix gen. prohibited: " --log-level $log_level
+      fi
+      for _port in ${block_tcp_port_arr[@]} ; do
+         $ipt -A INPUT -p tcp -i $_dev --dport $_port -j LOG --log-prefix "$log_prefix gen. prohibited: " --log-level $log_level
+      done
+      for _port in ${block_udp_port_arr[@]} ; do
+         $ipt -A INPUT -p udp -i $_dev --dport $_port -j LOG --log-prefix "$log_prefix gen. prohibited: " --log-level $log_level
+      done
+      if $kernel_activate_forwarding ; then
+         if $block_ident ; then
+            $ipt -A FORWARD -p tcp -i $_dev --dport $standard_ident_port -j LOG --log-prefix "$log_prefix gen. prohibited: " --log-level $log_level
+         fi
+         for _port in ${block_tcp_port_arr[@]} ; do
+            $ipt -A FORWARD -p tcp -i $_dev --dport $_port -j LOG --log-prefix "$log_prefix gen. prohibited: " --log-level $log_level
+         done
+         for _port in ${block_udp_port_arr[@]} ; do
+            $ipt -A FORWARD -p udp -i $_dev --dport $_port -j LOG --log-prefix "$log_prefix gen. prohibited: " --log-level $log_level
+         done
+      fi
+   fi
+   if $block_ident ; then
+       $ipt -A INPUT -p tcp -i $_dev --dport $standard_ident_port -j REJECT --reject-with tcp-reset
+   fi
+   for _port in ${block_tcp_port_arr[@]} ; do
+      $ipt -A INPUT -p tcp -i $_dev --dport $_port -j DROP
+   done
+   for _port in ${block_udp_port_arr[@]} ; do
+      $ipt -A INPUT -p udp -i $_dev --dport $_port -j DROP
+   done
+   if $kernel_activate_forwarding ; then
+      if $block_ident ; then
+         $ipt -A FORWARD -p tcp -i $_dev --dport $standard_ident_port -j REJECT --reject-with tcp-reset
+      fi
+      for _port in ${block_tcp_port_arr[@]} ; do
+         $ipt -A FORWARD -p tcp -i $_dev --dport $_port -j DROP
+      done
+      for _port in ${block_udp_port_arr[@]} ; do
+         $ipt -A FORWARD -p udp -i $_dev --dport $_port -j DROP
+      done
+   fi
+done
+
+echo_done
+echo
+
+
+# -------------
+# --- Traffic generally allowed
+# -------------
+
+echononl "\tLoopback device generally allowed.."
+
+# ---
+# - Loopback device
+# ---
+
+$ipt -A INPUT -i lo -j ACCEPT
+$ipt -A OUTPUT -o lo -j ACCEPT
+
+echo_done
+
+
+# ---
+# - Allow all Traffic from source mac-address
+# ---
+
+echononl "\tAllow all Traffic from MAC Source-Address"
+
+if [[ ${#allow_all_mac_src_address_arr[@]} -gt 0 ]] ; then
+   for _mac in ${allow_all_mac_src_address_arr[@]} ; do
+      for _dev in ${local_if_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -m mac --mac-source $_mac -j ACCEPT
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -i $_dev -m mac --mac-source $_mac -j ACCEPT
+         fi
+      done 
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Allow local Traffic from source mac-address
+# ---
+
+echononl "\tAllow local Traffic from MAC Source-Address"
+
+
+if [[ ${#allow_local_mac_src_address_arr[@]} -gt 0 ]] ; then
+   for _mac in ${allow_local_mac_src_address_arr[@]} ; do
+      for _dev in ${local_if_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -m mac --mac-source $_mac -j ACCEPT
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -o $_dev -m mac --mac-source $_mac -j ACCEPT
+         fi
+      done 
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Allow remote Traffic from source mac-address
+# ---
+
+echononl "\tAllow remote Traffic from MAC Source-Address"
+
+
+if [[ ${#allow_remote_mac_src_address_arr[@]} -gt 0 ]] ; then
+   for _mac in ${allow_remote_mac_src_address_arr[@]} ; do
+      for _dev in ${ext_if_arr[@]} ; do
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -o $_dev -m mac --mac-source $_mac -j ACCEPT
+         fi
+      done 
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Already established connections
+# ---
+
+echononl "\tAccept already established connections.."
+
+$ipt -A INPUT -p ALL -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+$ipt -A OUTPUT -p ALL -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+if $kernel_activate_forwarding ; then
+   $ipt -A FORWARD -p ALL -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+fi
+
+echo_done
+
+
+# ---
+# - Permit all traffic through VPN lines
+# ---
+echononl "\tPermit all traffic through VPN lines.."
+for _vpn_if in ${vpn_if_arr[@]} ; do
+   $ipt -A INPUT -i $_vpn_if -m conntrack --ctstate NEW -j ACCEPT
+   if $kernel_activate_forwarding ; then
+      for _local_dev in ${local_if_arr[@]} ; do
+         $ipt -A FORWARD -i $_vpn_if -o $_local_dev -m conntrack --ctstate NEW -j ACCEPT
+      done
+   fi
+done
+echo_done
+
+
+
+# ---
+# - Telefon Systems
+# ---
+
+echononl "\tAllow all Traffic between Telefon Systems"
+if [[ ${#tele_sys_ip_arr[@]} -gt 1 ]] && $allow_between_tele_systems && ! $permit_between_local_networks ; then
+   for _ip_1 in ${tele_sys_ip_arr[@]} ; do
+      for _ip_2 in ${tele_sys_ip_arr[@]} ; do
+         #[[ "$_ip_1" = "$_ip_2" ]] && continue
+         $ipt -A FORWARD -s $_ip_1 -d $_ip_2 -p ALL -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Telefon Systems to remote SIP-Server
+# ---
+
+echononl "\tTelefon System to remote SIP-Server"
+if [[ ${#tele_sys_ip_arr[@]} -gt 0 ]] ; then
+   if [ -z "$tele_sys_remote_sip_server_port" -o -z "$tele_sys_local_sip_server_port" ] ; then
+      echo_failed
+      warn "Local or remote SIP Port not given"!
+   else
+      for _ip in ${tele_sys_ip_arr[@]} ; do
+         $ipt -A FORWARD -p udp -s $_ip --sport $tele_sys_local_sip_server_port \
+            --dport $tele_sys_remote_sip_server_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+   fi
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - All request from local networks to the internet
+# ---
+
+echononl "\tPermit all traffic from local networks to the internet.."
+if $permit_local_net_to_inet ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p ALL -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -o $_dev -p ALL -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Networks not firewalled through extern interfaces
+# ---
+
+echononl "\tAllow these local networks any access to the internet"
+if [[ ${#any_access_to_inet_network_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding \
+      && ! $permit_local_net_to_inet ; then
+
+   for _net in ${any_access_to_inet_network_arr[@]}; do
+      for _dev in ${ext_if_arr[@]} ; do
+         $ipt -A FORWARD -o $_dev -p ALL -s $_net -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+echononl "\tAllow these local networks any access from the internet"
+if [[ ${#any_access_from_inet_network_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   _found=false
+   for _net in ${any_access_from_inet_network_arr[@]}; do
+      for _dev in ${ext_if_arr[@]} ; do
+
+         # - Traffic recieved on natted interfaces will be ommitted!
+         # -
+         if containsElement "$_dev" "${nat_device_arr[@]}" ; then
+            continue
+         else
+            _found=true
+         fi
+
+         $ipt -A FORWARD -i $_dev -p ALL -d $_net -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+   if $_found ; then
+      echo_done
+   else
+      echo_skipped
+   fi
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Allow local services from given extern networks
+# ---
+
+echononl "\tAllow local services from given extern networks"
+if [[ ${#allow_ext_net_to_local_service_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   _found=false
+   for _val in "${allow_ext_net_to_local_service_arr[@]}" ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      for _dev in ${ext_if_arr[@]} ; do
+
+         if containsElement "${_val_arr[1]}" "${gateway_ipv4_address_arr[@]}" ; then
+            $ipt -A INPUT -i $_dev -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
+         fi
+
+         # - Traffic recieved on natted interfaces will be ommitted!
+         # -
+         if containsElement "$_dev" "${nat_device_arr[@]}" ; then
+            continue
+         else
+            _found=true
+         fi
+
+         $ipt -A FORWARD -i $_dev -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
+
+      done
+
+   done
+
+   if $_found ; then
+      echo_done
+   else
+      echo_skipped
+   fi
+   
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Allow all traffic from extern address/network to local address/network
+# ---
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+echononl "\tAllow all traffic from extern to local network/address"
+
+if [[ ${#allow_ext_net_to_local_net_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   _found=false
+   for _val in ${allow_ext_net_to_local_net_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      for _dev in ${ext_if_arr[@]} ; do
+
+         # - Traffic recieved on natted interfaces will be ommitted!
+         # -
+         if containsElement "$_dev" "${nat_device_arr[@]}" ; then
+            continue
+         else
+            _found=true
+         fi
+
+         $ipt -A FORWARD -p ALL -i $_dev -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+
+      done
+   done
+
+   if $_found ; then
+      echo_done
+   else
+      echo_skipped
+   fi
+
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Block all extern traffic to (given) local network
+# ---
+
+echononl "\tBlock all extern traffic to (given) local network"
+if [[ ${#block_all_ext_to_local_net_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   _found=false
+   for _net in ${block_all_ext_to_local_net_arr[@]} ; do
+      for _dev in ${ext_if_arr[@]} ; do
+
+         # - Traffic recieved on natted interfaces will be ommitted!
+         # -
+         if containsElement "$_dev" "${nat_device_arr[@]}" ; then
+            continue
+         else
+            _found=true
+         fi
+
+         $ipt -A FORWARD -p ALL -i $_dev -d $_net -m conntrack --ctstate NEW -j DROP
+
+      done
+   done
+
+   if $_found ; then
+      echo_done
+   else
+      echo_skipped
+   fi
+
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Allow local services from given local networks
+# ---
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+echononl "\tAllow local services from given local networks"
+if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   for _val in "${allow_local_net_to_local_service_arr[@]}" ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      $ipt -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $local_alias_interfaces ; then
+         if [[ "${_val_arr[3]}" = "tcp" ]]; then
+            $ipt -A FORWARD -p tcp -d ${_val_arr[1]} --dport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -p tcp -s ${_val_arr[1]} --sport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
+         fi
+      fi
+   done
+   
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Allow all traffic from local network to local ip-address
+# ---
+
+echononl "\tAllow all traffic from local network to local ip-address"
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   for _val in ${allow_local_net_to_local_ip_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      $ipt -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+   echo_ok
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Allow all traffic from local ip-address to local network
+# ---
+
+echononl "\tAllow all traffic from local ip-address to local network"
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+if [[ ${#allow_local_ip_to_local_net_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   for _val in ${allow_local_ip_to_local_net_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      $ipt -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+   echo_ok
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Allow all traffic from (one) local network to (another) local network
+# ---
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+echononl "\tAllow all traffic from local network to (another) local network"
+
+if [[ ${#allow_local_net_to_local_net_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   for _val in ${allow_local_net_to_local_net_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      $ipt -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+   echo_ok
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Allow local ip address from given local interface
+# ---
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+echononl "\tAllow local ip address from given local interface"
+
+if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   for _val in ${allow_local_if_to_local_ip_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      $ipt -A FORWARD -p ALL -i ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -i ${_val_arr[0]} -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -o ${_val_arr[0]} -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+   echo_ok
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Separate local networks
+# ---
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+echononl "\tSeparate local networks.."
+
+if [[ ${#separate_local_network_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _net in ${separate_local_network_arr[@]}; do
+      for _dev in ${local_if_arr[@]} ; do
+         $ipt -A FORWARD -o $_dev -p all -s $_net -j DROP
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Separate local interfaces
+# ---
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+echononl "\tSeparate local interfaces.."
+
+if [[ ${#separate_local_if_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _dev_1 in ${separate_local_if_arr[@]}; do
+      for _dev_2 in ${local_if_arr[@]} ; do
+         [[ "$_dev_1" = "$_dev_2" ]] && continue
+         $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -p all -j DROP
+         $ipt -A FORWARD -i $_dev_2 -o $_dev_1 -p all -j DROP
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Permit all traffic between local networks
+# ---
+
+echononl "\tPermit all traffic between local networks.."
+if $kernel_activate_forwarding ; then
+   if $permit_between_local_networks ; then
+      for _dev_1 in ${local_if_arr[@]} ; do
+         for _dev_2 in ${local_if_arr[@]} ; do
+
+            # - Notice:
+            # - In case of routing multiple netwoks on the same interface or 
+            # - using alias interfaces like eth0:0, you need a rule with
+            # - incomming- and outgoing interface are equal!
+            # -
+            # - So DON'T add statement like this:
+            # -    [[ "$_dev_2" = "$_dev_1" ]] && continue
+            # -
+            $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -p ALL -m conntrack --ctstate NEW -j ACCEPT
+
+            # - Note:
+            # - If (local) alias interfaces like eth1:0 in use, youe need a further
+            # - special rule.
+            # -
+            if [[ "$_dev_2" = "$_dev_1" ]] && $local_alias_interfaces ; then
+               $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -p tcp --tcp-flag ACK ACK -j ACCEPT
+            fi
+
+         done
+      done
+      echo_done
+   else
+      echo_skipped
+   fi
+else
+   echo_skipped
+fi
+
+
+
+# -------------
+# --- Services
+# -------------
+
+echo
+if $terminal ; then
+   echo -e "\t\033[37m\033[1mAdd Rules for Services..\033[m"
+else
+   echo "Add Rules for Services.."
+fi
+
+
+# ---
+# - IPv6 over IPv4 (Tunnel Provider SixXS)
+# ---
+
+echononl "\t\tIPv6 Tunnel SixXS"
+if $local_sixxs_service ; then
+   if [ -n "$tic_server" -a -n "$six_pop_server" ]; then
+      # TIC (tunnel information & control) packages, from/to tic.sixxs.net
+      $ipt -A OUTPUT -p tcp -d $tic_server --dport 3874 -m conntrack --ctstate NEW -j ACCEPT
+
+      # heartbeat packets (outgoing only)
+      $ipt -A OUTPUT -p udp -d $six_pop_server --dport 3740 -m conntrack --ctstate NEW -j ACCEPT
+
+      # 6over4 tunnel packets
+      $ipt -A OUTPUT -p 41 -d $six_pop_server -j ACCEPT
+      $ipt -A INPUT -p 41 -d $six_pop_server -j ACCEPT
+
+      echo_done
+   else
+      echo_skipped
+   fi
+else
+   echo_skipped
+fi
+
+
+# ---
+# - DHCP
+# ---
+
+echononl "\t\tLocal DHCP Client"
+
+if [[ ${#dhcp_client_interfaces_arr[@]} -gt 0 ]] ; then
+   for _dev in ${dhcp_client_interfaces_arr[@]} ; do
+      $ip6t -A OUTPUT -o $_dev -p udp -m udp -d 255.255.255.255 --dport 67 -j ACCEPT
+      $ip6t -A INPUT -i $_dev -p udp -m udp --dport 68 -j ACCEPT
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+echononl "\t\tDHCP"
+
+if $local_dhcp_service ; then
+   # - Allow requests from intern networks
+   for _dev in ${local_if_arr[@]} ; do
+      # - in
+      $ipt -A INPUT -p udp -i $_dev -s 0/0 --sport 68 -d 255.255.255.255 --dport 67 -j ACCEPT
+      # - out
+      $ipt -A OUTPUT -p udp -o $_dev --sport 67 -d 0/0 --dport 68 -j ACCEPT
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - DHCP Failover
+# ---
+
+echononl "\t\tDHCP Failover Server"
+if $local_dhcp_service && [[ ${#dhcp_failover_server_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${dhcp_failover_server_ip_arr[@]} ; do
+      $ipt -A INPUT -p tcp --dport $dhcp_failover_port -s $_ip -m conntrack --ctstate NEW -j ACCEPT
+      $ipt -A OUTPUT -p tcp -d $_ip --dport $dhcp_failover_port -m conntrack --ctstate NEW -j ACCEPT
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - DNS out only
+# ---
+
+echononl "\t\tDNS out only"
+
+# - Nameservers on the INET must be reachable for the local recursiv nameserver
+# - but also for all others
+# -
+for _dev in ${ext_if_arr[@]} ; do
+   # - out from local and virtual mashine(s)
+   $ipt -A OUTPUT -o $_dev -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+   $ipt -A OUTPUT -o $_dev -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+
+   # - Only useful (needed) if kernel forwarding is activated (kernel_activate_forwarding=true)
+   if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+      # - forward from virtual mashine(s)
+      $ipt -A FORWARD -o $_dev -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+      $ipt -A FORWARD -o $_dev -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+   fi
+done
+
+echo_done
+
+
+# ---
+# - DNS Service Gateway
+# ---
+
+echononl "\t\tDNS Service Gateway"
+
+# - Local Nameservice
+# -
+if $local_dns_service ; then
+
+   # dns requests 
+   #
+   # Note:
+   #    If the total size of the DNS record is larger than 512 bytes, 
+   #    it will be sent over TCP, not UDP.
+   #
+
+   # - Allow requests from local networks
+   # -
+   for _dev in ${local_if_arr[@]} ; do
+      # - in
+      $ipt -A INPUT -i $_dev -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+      $ipt -A INPUT -i $_dev -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+   done
+
+   # - Zonetransfere (uses tcp/53)
+   # 
+   for _ip in ${dns_server_ips[@]} ; do
+      # - out
+      # -
+      # - local master (here) gets request for a zone from slave ($_ip)
+      $ipt -A INPUT -p tcp -s $_ip --sport $unprivports --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+
+      # - in
+      # -
+      # - local slave (here) requests zone from master ($_ip)
+      $ipt -A OUTPUT -p tcp --sport $unprivports -d $_ip --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+   done
+
+   echo_done
+else 
+   echo_skipped
+fi
+
+
+# ---
+# - DNS Services at local Network
+# ---
+
+echononl "\t\tDNS Service local Network"
+
+# - Make nameservers at the local network area rechable for all
+# -
+if [[ ${#dns_server_ip_arr[@]} -gt 0 ]] ; then
+
+   # dns requests 
+   #
+   # Note:
+   #    If the total size of the DNS record is larger than 512 bytes, 
+   #    it will be sent over TCP, not UDP.
+   #
+
+   for _ip in ${dns_server_ip_arr[@]} ; do
+      $ipt -A OUTPUT -p udp -d $_ip --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+      $ipt -A OUTPUT -p tcp -d $_ip --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p udp -d $_ip --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - SSH out only
+# ---
+
+echononl "\t\tSSH out only"
+
+if $allow_ssh_request_out && ! $permit_local_net_to_inet ; then
+   # - Provide SSH to everywhere (also LAN)
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_ssh_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_ssh_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+   for _dev in ${local_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_ssh_port -m conntrack --ctstate NEW -j ACCEPT
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - SSH Service Gateway
+# ---
+
+echononl "\t\tSSH Service Gateway (also from WAN)"
+
+if $local_ssh_service ; then
+   # - Provides SSH in from everywhere
+   for _port in ${ssh_port_arr[@]} ; do
+      $ipt -A INPUT -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - SSH Services only local Network
+# ---
+
+echononl "\t\tSSH Services only local Network"
+
+if [[ ${#ssh_server_only_local_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${ssh_server_only_local_ip_arr[@]} ; do
+      for _port in ${ssh_port_arr[@]} ; do
+
+         $ipt -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+
+         if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+            for _dev in ${local_if_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p tcp -d $_ip -dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+         fi
+
+         # - Note:
+         # - If (local) alias interfaces like eth1:0 in use, youe need a further
+         # - special rule.
+         # -
+         if $kernel_activate_forwarding && $local_alias_interfaces ; then
+            $ipt -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
+         fi
+
+      done
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - SSH Services DMZ
+# ---
+
+echononl "\t\tSSH Services DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#ssh_server_dmz_arr[@]} -gt 0 ]] ; then
+   for _ip in "${!ssh_server_dmz_arr[@]}"; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${ssh_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      for _port in ${ssh_port_arr[@]} ; do
+
+         $ipt -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+
+         if $kernel_activate_forwarding ; then
+
+            # - Nat if interface is on a dsl line
+            # -
+            if containsElement "${ssh_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+               $ipt -t nat -A PREROUTING -i ${ssh_server_dmz_arr[$_ip]} -p tcp --dport $_port -j DNAT --to $_ip:$_port
+            fi
+            $ipt -A FORWARD -i ${ssh_server_dmz_arr[$_ip]} -p tcp --dport $_port -d $_ip -m conntrack --ctstate NEW -j ACCEPT
+         fi
+
+         # - From intern
+         if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+            for _dev in ${local_if_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p tcp -d $_ip -m multiport --dports $_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+         fi
+
+         # - Rule is needed if (local) interface aliases in use (like eth0:1)
+         # -
+         if $kernel_activate_forwarding && $local_alias_interfaces ; then
+            for _port in ${ssh_port_arr[@]} ; do
+               $ipt -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
+               $ipt -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
+            done
+         fi
+
+      done
+
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - SSH Service between local Netwotks
+# ---
+
+echononl "\t\tSSH Service between local Netwotks"
+if $allow_ssh_between_local_nets ; then
+   if $kernel_activate_forwarding ; then
+      for _dev_1 in ${local_if_arr[@]} ; do
+
+         for _port in ${ssh_port_arr[@]} ; do
+            $ipt -A OUTPUT -o $_dev_1 -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+
+         for _dev_2 in ${local_if_arr[@]} ; do
+
+            if ! $permit_between_local_networks ; then
+               # - Notice:
+               # - In case of routing multiple netwoks on the same interface or 
+               # - using alias interfaces like eth0:0, you need a rule with
+               # - incomming- and outgoing interface are equal!
+               # -
+               # - So DON'T add statement like this:
+               # -    [[ "$_dev_2" = "$_dev_1" ]] && continue
+               # -
+               for _port in ${ssh_port_arr[@]} ; do
+                  $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+               done
+            fi
+
+            # - Note:
+            # - If (local) alias interfaces like eth1:0 in use, youe need a further
+            # - special rule.
+            # -
+            if [[ "$_dev_2" = "$_dev_1" ]] && $local_alias_interfaces ; then
+               for _port in ${ssh_port_arr[@]} ; do
+                  $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -p tcp --sport $_port --tcp-flag ACK ACK -j ACCEPT
+                  $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -p tcp --dport $_port --tcp-flag ACK ACK -j ACCEPT
+               done
+            fi
+         done
+      done
+   fi
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Cisco kompartibles VPN (FRITZ!Box)
+# ---
+
+echononl "\t\tCisco VPN Service (FRITZ\!Box) only out"
+
+if $allow_cisco_vpn_out && [[ ${#cisco_vpn_out_port_arr[@]} -gt 0 ]]; then
+   for _dev in ${ext_if_arr[@]} ; do
+      for _port in ${cisco_vpn_out_port_arr[@]} ; do
+         $ipt -A OUTPUT -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+            $ipt -A FORWARD -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         fi
+      done
+   done
+
+   for _vpn_if in ${vpn_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_vpn_if -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -o $_vpn_if -p $cisco_vpn_out_protocol -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - VPN Service only out
+# ---
+
+echononl "\t\tVPN Service only out"
+
+if $allow_vpn_out && [[ ${#vpn_out_port_arr[@]} -gt 0 ]]; then
+   for _dev in ${ext_if_arr[@]} ; do
+      for _port in ${vpn_out_port_arr[@]} ; do
+         $ipt -A OUTPUT -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+            $ipt -A FORWARD -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         fi
+      done
+   done
+
+   for _vpn_if in ${vpn_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_vpn_if -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -o $_vpn_if -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - VPN Service Gateway
+# ---
+
+echononl "\t\tVPN Service Gateway"
+
+if $local_vpn_service ; then
+
+   # - Cconnection establishment
+   # -
+   for _port in ${vpn_gw_port_arr[@]} ; do
+      $ipt -A INPUT -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+   done
+   echo_done
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - VPN Service DMZ
+# ---
+
+echononl "\t\tVPN Service DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#vpn_server_dmz_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _ip in ${!vpn_server_dmz_arr[@]} ; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${vpn_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      for _port in ${vpn_local_net_port_arr[@]} ; do
+         $ipt -A FORWARD -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Nat if interface is on a dsl line
+         # -
+         if containsElement "${vpn_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+            $ipt -t nat -A PREROUTING -i ${vpn_server_dmz_arr[$_ip]} -p udp --dport $_port -j DNAT --to $_ip:$_port
+         fi
+      done
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - HTTP(S) OUT
+# ---
+
+echononl "\t\tHTTP(S) out only"
+
+if $allow_http_request_out && ! $permit_local_net_to_inet ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - HTTP(S) (local) Webserver
+# ---
+
+echononl "\t\tHTTP(S) Services Gateway"
+# - Access to the local Webservice
+if $local_http_service ; then
+   $ipt -A INPUT -p tcp -m multiport --dports $http_ports -m conntrack --ctstate NEW -j ACCEPT
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - HTTP(S) Services only local Network
+# ---
+
+echononl "\t\tHTTP(S) Services only local Network"
+# - Access to the Webservices (LAN)
+if [[ ${#http_server_only_local_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${http_server_only_local_ip_arr[@]} ; do
+      $ipt -A OUTPUT -p tcp -d $_ip -m multiport --dports $http_ports -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip -m multiport --dports $http_ports -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip -m multiport --dports $http_ports --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip -m multiport --sports $http_ports --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - HTTP(S) Services DMZ
+# ---
+
+echononl "\t\tHTTP(S) Services DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#http_server_dmz_arr[@]} -gt 0 ]] ; then
+   http_port_arr=(${http_ports//,/ })  
+   for _ip in "${!http_server_dmz_arr[@]}"; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${http_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      for _port in ${http_port_arr[@]}  ; do
+         $ipt -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         if $kernel_activate_forwarding ; then
+
+            # - Nat if interface is on a dsl line
+            # -
+            if containsElement "${http_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+               $ipt -t nat -A PREROUTING -i ${http_server_dmz_arr[$_ip]} -p tcp --dport $_port -j DNAT --to $_ip:$_port
+            fi
+            $ipt -A FORWARD -i ${http_server_dmz_arr[$_ip]} -p tcp --dport $_port -d $_ip -m conntrack --ctstate NEW -j ACCEPT
+         fi
+      done
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip -m multiport --dports $http_ports -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+      # - Rule is needed if (local) interface aliases in use (like eth0:1)
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip -m multiport --dports $http_ports --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip -m multiport --sports $http_ports --tcp-flag ACK ACK -j ACCEPT
+      fi
+
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - HTTPS Services DMZ (only port 443)
+# ---
+
+echononl "\t\tHTTPS Services DMZ (only port $standard_https_port)"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#http_ssl_server_dmz_arr[@]} -gt 0 ]] ; then
+   for _ip in "${!http_ssl_server_dmz_arr[@]}"; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${http_ssl_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      $ipt -A OUTPUT -p tcp -d $_ip --dport $standard_https_port -m conntrack --ctstate NEW -j ACCEPT
+
+      # - From extern
+      if $kernel_activate_forwarding ; then
+
+         # - Nat if interface is on a dsl line
+         # -
+         if containsElement "${http_ssl_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+            $ipt -t nat -A PREROUTING -i ${http_ssl_server_dmz_arr[$_ip]} -p tcp --syn --dport $standard_https_port -j DNAT --to $_ip:$standard_https_port
+         fi
+         $ipt -A FORWARD -i ${http_ssl_server_dmz_arr[$_ip]} -p tcp --dport $standard_https_port -d $_ip -j ACCEPT
+      fi
+
+      # - From intern
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $standard_https_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+      # - Rule is needed if (local) interface aliases in use (like eth0:1)
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip --dport $standard_https_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport $standard_https_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Mail Service SMTP only out
+# ---
+
+echononl "\t\tMail Services SMTP only out"
+
+if $allow_smtp_request_out && ! $permit_local_net_to_inet ; then
+   # - Provide SMTP out for all to WAN
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -p tcp -o $_dev --dport $standard_smtp_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -p tcp -o $_dev --dport $standard_smtp_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - SMTP (Relay) Service Gateway
+# ---
+
+echononl "\t\tSMTP (Relay) Service Gateway (only on local network)"
+if $local_smtp_service ; then
+   for _dev in ${local_if_arr[@]} ; do
+      $ipt -A INPUT -p tcp -i $_dev --dport $standard_smtp_port -m conntrack --ctstate NEW -j ACCEPT
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+   
+
+
+# ---
+# - Mail User Services smtps/pop(s)/imap(s) only out
+# ---
+
+echononl "\t\tMail Services smtps/pop(s)/imap(s) only out"
+
+if $allow_mail_request_out && ! $permit_local_net_to_inet ; then
+   # - Provide using Mailservices (WAN) from whole LAN
+   # -
+   # - Not needed from local machine. But for testing pupose (i.e. telnet <port>)
+   # -
+   # - 
+   for _dev in ${ext_if_arr[@]} ; do
+      if $provide_mailservice_from_local ; then
+         # - Note!
+         # - this provides access both to LAN and WAN
+         $ipt -A OUTPUT -p tcp -m multiport --dports $standard_mailuser_ports -m conntrack --ctstate NEW -j ACCEPT
+      fi
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         for _dev in ${ext_if_arr[@]} ; do
+            $ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $standard_mailuser_ports -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Mail Service SMTP only local Networks
+# ---
+
+echononl "\t\tMail Service SMTP only local Networks"
+if [[ ${#mail_server_only_local_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${mail_server_only_local_ip_arr[@]} ; do
+      $ipt -A OUTPUT -p tcp -d $_ip --dport $standard_smtp_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $standard_smtp_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip --dport $standard_smtp_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport $standard_smtp_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+
+      echo_done
+   done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Mail Services smtps/pop(s)/imap(s) only local Networks
+# ---
+
+echononl "\t\tMail Services smtps/pop(s)/imap(s) only local Networks"
+
+if [[ ${#mail_server_only_local_ip_arr[@]} -gt 0 ]]; then
+   for _ip in ${mail_server_only_local_ip_arr[@]} ; do
+      $ipt -A OUTPUT -p tcp -d $_ip -m multiport --dports $mail_user_ports -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip -m multiport --dports $mail_user_ports -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip -m multiport --dports $mail_user_ports --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip -m multiport --sports $mail_user_ports --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Mail Server DMZ
+# ---
+
+echononl "\t\tMail Server DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#mail_server_dmz_arr[@]} -gt 0 ]] ; then
+   mail_port_arr=(${mail_user_ports//,/ })  
+   mail_port_arr+=("$mail_smtp_port")
+   for _ip in "${!mail_server_dmz_arr[@]}"; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${mail_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      for _port in ${mail_port_arr[@]}  ; do
+         $ipt -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Nat if interface is on a dsl line
+         # -
+         if containsElement "${mail_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+            $ipt -t nat -A PREROUTING -i ${mail_server_dmz_arr[$_ip]} -p tcp --dport $_port -m conntrack --ctstate NEW -j DNAT --to $_ip:$_port
+         fi
+         $ipt -A FORWARD -i ${mail_server_dmz_arr[$_ip]} -p tcp --dport $_port -d $_ip -m conntrack --ctstate NEW -j ACCEPT
+      done
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip -m multiport --dports $mail_smtp_port,$mail_user_ports -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip -m multiport --dports $mail_smtp_port,$mail_user_ports --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip -m multiport --sports $mail_smtp_port,$mail_user_ports --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - FTP out only
+# ---
+
+echononl "\t\tFTP out only"
+
+if $allow_ftp_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport 21 -m conntrack --ctstate NEW -j ACCEPT
+      $ipt -A OUTPUT -o $_dev -p tcp --sport $unprivports --dport $unprivports -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+            $ipt -A FORWARD -o $_dev -p tcp --dport 21 -m conntrack --ctstate NEW -j ACCEPT
+            $ipt -A FORWARD -o $_dev -p tcp --sport $unprivports --dport $unprivports -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_done
+fi
+
+
+# ---
+# - FTP Service Gateway
+# ---
+
+echononl "\t\tFTP Service Gateway"
+
+if $local_ftp_service ; then
+   $ipt -A INPUT -p tcp  --dport $standard_ftp_port --sport $unprivports -m conntrack --ctstate NEW -j ACCEPT
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - FTP Services only local Network
+# ---
+
+echononl "\t\tFTP Service local Networks"
+if [[ ${#ftp_server_only_local_ip_arr[@]} -gt 0 ]] &&  $kernel_activate_forwarding ; then
+   for _ip in ${ftp_server_only_local_ip_arr[@]} ; do
+      $ipt -A OUTPUT -p tcp -d $_ip --dport 21 --sport $unprivports -m conntrack --ctstate NEW -j ACCEPT
+
+      if ! $permit_between_local_networks ; then
+         $ipt -A FORWARD -p tcp -d $_ip --dport 21 --sport $unprivports -m conntrack --ctstate NEW -j ACCEPT
+      fi
+
+      if $local_alias_interfaces ; then
+         # - Control Port
+         $ipt -A FORWARD -p tcp -d $_ip --dport 21 --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport 21 --tcp-flag ACK ACK -j ACCEPT
+         # - Data Port activ
+         $ipt -A FORWARD -p tcp -d $_ip --dport 20 --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport 20 --tcp-flag ACK ACK -j ACCEPT
+         # - Data Port passiv
+         $ipt -A FORWARD -p tcp -d $_ip --sport $unprivports --dport $unprivports --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - FTP Services DMZ
+# ---
+
+echononl "\t\tFTP Service DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#ftp_server_dmz_arr[@]} -gt 0 ]] && [[ -n $ftp_passive_port_range ]]; then
+   IFS=':' read -a ftp_passive_port_arr <<< "${ftp_passive_port_range}"
+   for _ip in "${!ftp_server_dmz_arr[@]}"; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${ftp_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      $ipt -A OUTPUT -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
+
+      # - From extern
+      if $kernel_activate_forwarding ; then 
+         $ipt -A FORWARD -i ${ftp_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Nat if interface is on a dsl line
+         # -
+         if containsElement "${ftp_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+            $ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport 21 -j DNAT --to $_ip:21
+            $ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport 20 -j DNAT --to $_ip:20
+            $ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport $ftp_passive_port_range -j DNAT --to $_ip:${ftp_passive_port_arr[0]}-${ftp_passive_port_arr[1]}
+         fi
+      fi
+
+      # - From intern
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+      # - Rule is needed if (local) interface aliases in use (like eth0:1)
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+
+         # - Control Port
+         $ipt -A FORWARD -p tcp -d $_ip --dport 21 --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport 21 --tcp-flag ACK ACK -j ACCEPT
+         # - Data Port activ
+         $ipt -A FORWARD -p tcp -d $_ip --dport 20 --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport 20 --tcp-flag ACK ACK -j ACCEPT
+         # - Data Port passiv
+         $ipt -A FORWARD -p tcp -d $_ip --sport $unprivports --dport $ftp_passive_port_range --tcp-flag ACK ACK -j ACCEPT
+
+      fi
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+   
+
+# ---
+# - TFTF Service out only
+# ---
+
+echononl "\t\tTFTF Service out only"
+
+if $allow_tftp_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p udp --dport $standard_tftp_udp_port  -m conntrack --ctstate NEW -j ACCEPT
+   done
+
+   if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+      $ipt -A FORWARD -o $_dev -p udp --dport $standard_tftp_udp_port  -m conntrack --ctstate NEW -j ACCEPT
+   fi
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - TFTP Service Gateway
+# ---
+
+echononl "\t\tTFTF Service Gateway"
+
+if $local_tftp_service ; then
+   $ipt -A INPUT -p udp --dport $tftp_udp_port  -m conntrack --ctstate NEW -j ACCEPT
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Samba Service Gateway (only for local Networks)
+# ---
+
+echononl "\t\tSamba Service Gateway (only for local Networks)"
+
+if $local_samba_service ; then
+   for _dev in ${local_if_arr[@]} ; do
+      for _port in ${samba_udp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+      for _port in ${samba_tcp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Samba Service only between local Networks
+# ---
+
+echononl "\t\tSamba Service only local Networks"
+
+if [[ ${#samba_server_local_ip_arr[@]} -gt 0 ]] ; then
+   for _dev in ${local_if_arr[@]} ; do
+      for _ip in ${samba_server_local_ip_arr[@]} ; do
+         for _port in ${samba_udp_port_arr[@]} ; do
+            $ipt -A OUTPUT -o $_dev -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         for _port in ${samba_tcp_port_arr[@]} ; do
+            $ipt -A OUTPUT -o $_dev -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         if $kernel_activate_forwarding && $allow_samba_between_local_nets && ! $permit_between_local_networks ; then
+
+            for _port in ${samba_udp_port_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+            for _port in ${samba_tcp_port_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+
+            # - Rule is needed if (local) interface aliases in use (like eth0:1)
+            # -
+            if $local_alias_interfaces ; then
+               for _port in ${samba_tcp_port_arr[@]} ; do
+                  $ipt -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
+                  $ipt -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
+               done
+            fi
+         fi
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Samba Service DMZ
+# ---
+
+echononl "\t\tSamba Service DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#samba_server_dmz_arr[@]} -gt 0 ]] ; then
+   for _ip in "${!samba_server_dmz_arr[@]}"; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${samba_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      # - From extern
+      if $kernel_activate_forwarding ; then
+         for _port in ${samba_udp_port_arr[@]} ; do
+            $ipt -A FORWARD -i ${samba_server_dmz_arr[$_ip]} -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+
+            # - Nat if interface is on a dsl line
+            # -
+            if containsElement "${samba_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+               IFS=':' read -a _udp_port_arr <<< ${_port}
+               if [[ -n "${_udp_port_arr[1]}" ]] ; then
+                  $ipt -t nat -A PREROUTING -i ${samba_server_dmz_arr[$_ip]} -p udp --dport $_port -j DNAT --to $_ip:${_udp_port_arr[0]}-${_udp_port_arr[1]}
+               else
+                  $ipt -t nat -A PREROUTING -i ${samba_server_dmz_arr[$_ip]} -p udp --dport $_port -j DNAT --to $_ip:$_port
+               fi
+            fi
+         done
+         for _port in ${samba_tcp_port_arr[@]} ; do
+            $ipt -A FORWARD -i ${samba_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+
+            # - Nat if interface is on a dsl line
+            # -
+            if containsElement "${samba_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+               $ipt -t nat -A PREROUTING -i ${samba_server_dmz_arr[$_ip]} -p tcp --dport $_port -j DNAT --to $_ip:$_port
+            fi
+         done
+      fi
+
+      # - From intern
+      for _dev in ${local_if_arr[@]} ; do
+         for _port in ${samba_udp_port_arr[@]} ; do
+            $ipt -A OUTPUT -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+               $ipt -A FORWARD -i $_dev -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            fi
+         done
+         for _port in ${samba_tcp_port_arr[@]} ; do
+            $ipt -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+               $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            fi
+         done
+
+         # - Rule is needed if (local) interface aliases in use (like eth0:1)
+         # -
+         if $kernel_activate_forwarding && $local_alias_interfaces ; then
+            for _port in ${samba_tcp_port_arr[@]} ; do
+               $ipt -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
+               $ipt -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
+            done
+         fi
+      done
+
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - LDAP and LDAP SSL Service Gateway (only for local Networks)
+# ---
+
+echononl "\t\tLDAP(S) Service Gateway (only for local Networks)"
+
+if $local_ldap_service ; then
+   for _dev in ${local_if_arr[@]} ; do
+      for _port in ${ldap_udp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+      for _port in ${ldap_tcp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - LDAP and LDAP SSL Service only between local Networks
+# ---
+
+echononl "\t\tLDAP(S) Service only local Networks"
+
+if [[ ${#ldap_server_local_ip_arr[@]} -gt 0 ]] ; then
+   for _dev in ${local_if_arr[@]} ; do
+      for _ip in ${ldap_server_local_ip_arr[@]} ; do
+         for _port in ${ldap_udp_port_arr[@]} ; do
+            $ipt -A OUTPUT -o $_dev -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         for _port in ${ldap_tcp_port_arr[@]} ; do
+            $ipt -A OUTPUT -o $_dev -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         if $kernel_activate_forwarding && $allow_ldap_between_local_nets && ! $permit_between_local_networks ; then
+
+            for _port in ${ldap_udp_port_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+            for _port in ${ldap_tcp_port_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+
+            # - Rule is needed if (local) interface aliases in use (like eth0:1)
+            # -
+            if $local_alias_interfaces ; then
+               for _port in ${ldap_tcp_port_arr[@]} ; do
+                  $ipt -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
+                  $ipt -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
+               done
+            fi
+         fi
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - NTP out only
+# ---
+
+echononl "\t\tNTP Service out only"
+
+if $allow_ntp_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - NTP Service Gateway
+# ---
+
+echononl "\t\tNTP Service Gateway"
+if $local_ntp_service ; then
+   if ! $allow_ntp_request_out ; then
+      $ipt -A OUTPUT -o $_dev -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT
+   fi
+   $ipt -A INPUT -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Timeserver (Port 37 NOT NTP!)"
+# ---
+
+echononl "\t\tTimeserver (Port 37 NOT NTP!) out only"
+
+if $allow_timeserver_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_timeserver_port  -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_timeserver_port  -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - PGP Keyserver out only
+# ---
+
+echononl "\t\tPGP Keyserver out only"
+
+if $allow_pgpserver_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_pgp_keyserver_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_pgp_keyserver_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Telnet
+# ---
+
+echononl "\t\tTelnet (only OUT)"
+
+if $allow_telnet_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_telnet_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_telnet_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Whois out only
+# ---
+
+echononl "\t\tWhois out only"
+
+if $allow_whois_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_whois_port  -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_whois_port  -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - CPAN Wait only out
+# ---
+
+# - CPAN::WAIT adds some comands to the CPAN shell() to perform searches on 
+# - a WAIT server. It connects to a WAIT server using a simple protocoll 
+# - resembling NNTP as described in RFC977.
+
+echononl "\t\tCPAN Wait only out"
+
+if $allow_cpan_wait_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_cpan_wait_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_cpan_wait_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - HBCI only out (only forward)
+# ---
+
+echononl "\t\tHBCI only out (only forward)"
+
+if $allow_hbci_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_hbci_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Jabber only out 
+# ---
+
+echononl "\t\tJabber only out"
+
+if $allow_jabber_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_jabber_port -m conntrack --ctstate NEW -j ACCEPT
+      $ipt -A OUTPUT -o $_dev -p udp --dport $standard_jabber_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_jabber_port -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A FORWARD -o $_dev -p udp --dport $standard_jabber_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Silc only out 
+# ---
+
+echononl "\t\tSilc only out"
+
+if $allow_silc_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -p tcp -o $_dev --dport $standard_silc_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_silc_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - IRC (Internet Relay Chat) only out 
+# ---
+
+echononl "\t\tIRC only out"
+
+if $allow_irc_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -p tcp -o $_dev --dport $standard_irc_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_irc_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - MySQL
+# ---
+
+echononl "\t\tMySQL (only OUT)"
+
+if $allow_mysql_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_mysql_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_mysql_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - CUPS only between local Networks (IPP Port 631)
+# ---
+
+echononl "\t\tCUPS/IPP (Port 631) only between local Networks"
+
+if $kernel_activate_forwarding && ! $permit_between_local_networks && $allow_printing_between_local_nets ; then
+   for _local_dev_1 in ${local_if_arr[@]} ; do
+      for _local_dev_2 in ${local_if_arr[@]} ; do
+         if ! $local_alias_interfaces ; then
+            [[ "$_local_dev_1" = "$_local_dev_2" ]] && continue
+         fi
+         $ipt -A FORWARD -i $_local_dev_1 -o $_local_dev_2 -p tcp --dport $standard_cups_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -o $_local_dev_1 -p tcp --dport $standard_cups_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -o $_local_dev_1 -p tcp --sport $standard_cups_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Druck Port 9100 (RAW) only out between local Networks
+# ---
+
+echononl "\t\tRAW Druck Port 9100 only between local Networks"
+
+if $kernel_activate_forwarding && ! $permit_between_local_networks && $allow_printing_between_local_nets ; then
+   for _local_dev_1 in ${local_if_arr[@]} ; do
+      for _local_dev_2 in ${local_if_arr[@]} ; do
+         if ! $local_alias_interfaces ; then
+            [[ "$_local_dev_1" = "$_local_dev_2" ]] && continue
+         fi
+         $ipt -A FORWARD -i $_local_dev_1 -o $_local_dev_2 -p tcp --dport $standard_print_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -o $_local_dev_1 -p tcp --dport $standard_print_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -o $_local_dev_1 -p tcp --sport $standard_print_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Druck LPD (Port 515) only out between local Networks
+# ---
+
+echononl "\t\tDruck LPD (Port 515) only between local Networks"
+
+if $kernel_activate_forwarding && ! $permit_between_local_networks && $allow_printing_between_local_nets ; then
+   for _local_dev_1 in ${local_if_arr[@]} ; do
+      for _local_dev_2 in ${local_if_arr[@]} ; do
+         if ! $local_alias_interfaces ; then
+            [[ "$_local_dev_1" = "$_local_dev_2" ]] && continue
+         fi
+         $ipt -A FORWARD -i $_local_dev_1 -o $_local_dev_2 -p tcp --dport $standard_print_raw_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -o $_local_dev_1 -p tcp --dport $standard_print_raw_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -o $_local_dev_1 -p tcp --sport $standard_print_raw_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Printer
+# ---
+
+echononl "\t\tKnown Printers (Ports: 515/631/9100) only local Networks"
+if [[ ${#printer_ip_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding \
+      && ! $permit_between_local_networks \
+      && ! $allow_printing_between_local_nets ; then 
+   for _ip in ${printer_ip_arr[@]} ; do
+      for _dev in ${local_if_arr[@]} ; do
+         $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $standard_print_port -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $standard_ipp_port -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $standard_print_raw_port -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Note:
+         # - If (local) alias interfaces like eth1:0 in use, youe need a further
+         # - special rule.
+         # -
+         if $local_alias_interfaces ; then
+            $ipt -A FORWARD -o $_dev -p tcp -d $_ip --dport $standard_print_port --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -o $_dev -p tcp -s $_ip --sport $standard_print_port --tcp-flag ACK ACK -j ACCEPT
+
+            $ipt -A FORWARD -o $_dev -p tcp -d $_ip --dport $standard_ipp_port --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -o $_dev -p tcp -s $_ip --sport $standard_ipp_port --tcp-flag ACK ACK -j ACCEPT
+
+            $ipt -A FORWARD -o $_dev -p tcp -d $_ip --dport $standard_print_raw_port --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -o $_dev -p tcp -s $_ip --sport $standard_print_raw_port --tcp-flag ACK ACK -j ACCEPT
+         fi
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Scanner
+# ---
+
+echononl "\t\tBrother Scanner (Port $brscan_port) only between local Networks"
+
+if [[ ${#brother_scanner_ip_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding \
+      && ! $permit_between_local_networks \
+      && $allow_scanning_between_local_nets ; then 
+   for _ip in ${brother_scanner_ip_arr[@]} ; do
+      for _dev in ${local_if_arr[@]} ; do
+         # - UDP
+         $ipt -A FORWARD -i $_dev -p udp -d $_ip --dport $brscan_port -m conntrack --ctstate NEW -j ACCEPT
+         # - TCP
+         $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $brscan_port -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Note:
+         # - If (local) alias interfaces like eth1:0 in use, youe need a further
+         # - special rule.
+         # -
+         if $local_alias_interfaces ; then
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $brscan_port --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -o $_dev -p tcp -s $_ip --sport $brscan_port --tcp-flag ACK ACK -j ACCEPT
+         fi
+      done
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Other local Services
+# ---
+
+echononl "\t\tOther local Services"
+
+if [[ ${#other_service_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _val in ${other_service_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      for _dev in ${local_if_arr[@]} ; do
+         $ipt -A FORWARD -i $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Note:
+         # - If (local) alias interfaces like eth1:0 in use, youe need a further
+         # - special rule.
+         # -
+         if $local_alias_interfaces && [[ "${_val_arr[2]}" = "tcp" ]] ; then
+            $ipt -A FORWARD -i $_dev -p tcp -d ${_val_arr[0]} --dport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -o $_dev -p tcp -s ${_val_arr[0]} --sport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+         fi
+      done
+   done
+   echo_ok
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Rsync only Out Gateway 
+# ---
+
+echononl "\t\tRsync (only OUT) Gateway"
+
+if $local_rsync_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      for _port in ${rsync_port_arr[@]} ; do
+         $ipt -A OUTPUT -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Rsync only Out from given local machines
+# ---
+
+echononl "\t\tRsync Out from given local machines"
+
+if [[ ${#rsync_out_ip_arr[@]} -gt 0 ]] && $kernel_activate_forwarding && ! $permit_local_net_to_inet; then
+   for _port in ${rsync_port_arr[@]} ; do
+      for _ip in ${rsync_out_ip_arr[@]} ; do
+         $ipt -A FORWARD -p tcp -s $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - SNMP Services local Networks
+# ---
+
+echononl "\t\tSNMP Services local Networks"
+
+if [[ ${#snmp_server_ip_arr[@]} -gt 0 ]] && ! $permit_between_local_networks; then
+   for _ip in ${snmp_server_ip_arr[@]} ; do
+      $ipt -A OUTPUT -p udp -d $_ip --dport $snmp_trap_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p udp -s $_ip --dport $snmp_port -m conntrack --ctstate NEW -j ACCEPT
+            $ipt -A FORWARD -i $_dev -p udp -d $_ip --dport $snmp_trap_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - WakeOnLan only out into local Networks
+# ---
+
+echononl "\t\tWakeOnLan only out into local Networks"
+$ipt -A OUTPUT -p udp --dport 9 -j ACCEPT
+echo_done
+
+
+# ---
+# - NFS Service (portmapper, mountd, nfs)
+# ---
+
+if $terminal; then
+   echononl "\t\tNFS Service\t\t\t - \033[37m\033[1mNot yet implemented\033[m -"
+   echo -e "\033[75G[ \033[37mskipped\033[m ]"
+
+   echononl "\t\tVoIP\t\t\t\t - \033[37m\033[1mNot yet implemented\033[m -"
+   echo -e "\033[75G[ \033[37mskipped\033[m ]"
+
+   echononl "\t\tSip\t\t\t\t - \033[37m\033[1mNot yet implemented\033[m -"
+   echo -e "\033[75G[ \033[37mskipped\033[m ]"
+
+   echononl "\t\tSkype\t\t\t\t - \033[37m\033[1mNot yet implemented\033[m -"
+   echo -e "\033[75G[ \033[37mskipped\033[m ]"
+else
+   echo "NFS Service - Not yet implemented"
+   echo "VoIP - Not yet implemented"
+   echo "Sip - Not yet implemented"
+   echo "Skype - Not yet implemented"
+fi
+
+
+# ---
+# - PowerChute Network Shutdown local Network
+# ---
+
+echononl "\t\tPowerChute Network Shutdown local Network"
+
+if [[ ${#pcns_server_ip_arr[@]} -gt 0 ]] && [[ -n "$usv_ip" ]] ; then
+
+   for _ip in ${pcns_server_ip_arr[@]} ; do
+      if containsElement "$_ip" "${gateway_ipv4_address_arr[@]}" ; then
+         $ipt -A INPUT -p tcp -s $usv_ip --dport $pcns_tcp_port -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A INPUT -p udp -s $usv_ip --dport $pcns_udp_port -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A INPUT -p tcp --dport $pcns_web_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         $ipt -A FORWARD -p tcp -s $usv_ip -d $_ip --dport $pcns_tcp_port -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A FORWARD -p udp -s $usv_ip -d $_ip --dport $pcns_udp_port -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A FORWARD -p tcp -d $_ip --dport $pcns_web_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip --dport $pcns_tcp_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport $pcns_tcp_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -d $_ip --dport $pcns_web_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport $pcns_web_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Ubiquiti Unifi Controler (Accesspoints) Gateway
+# ---
+
+
+echononl "\t\tUbiquiti Unifi Controler (Accesspoints) Gateway"
+if $local_unifi_controller_service ; then
+   for _dev in ${local_if_arr[@]} ; do
+      $ipt -A INPUT -p udp -i $_dev -m multiport --dports $unify_broadcast_udp_ports -m conntrack --ctstate NEW -j ACCEPT
+
+      $ipt -A INPUT -p tcp -i $_dev -m multiport --dports $unify_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
+      $ipt -A INPUT -p udp -i $_dev -m multiport --dports $unify_udp_ports -m conntrack --ctstate NEW -j ACCEPT
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Ubiquiti Unifi Controler (Accesspoints) local Network
+# ---
+
+echononl "\t\tUbiquiti Unifi Controler (Accesspoints) local Network"
+if [[ ${#unify_controller_local_net_ip_arr[@]} -gt 0 ]] \
+   && $kernel_activate_forwarding \
+   && ! $permit_between_local_networks ; then
+
+   for _ip_ctl in ${unify_controller_local_net_ip_arr[@]} ; do
+      for _dev in ${local_if_arr[@]} ; do
+         $ipt -A FORWARD -i $_dev -p udp -d $_ip_ctl  -m multiport --dports $unify_broadcast_udp_ports -m conntrack --ctstate NEW -j ACCEPT
+
+         $ipt -A FORWARD -i $_dev -p tcp -d $_ip_ctl  -m multiport --dports $unify_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A FORWARD -i $_dev -p udp -d $_ip_ctl  -m multiport --dports $unify_udp_ports -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip_ctl -m multiport --dports $unify_tcp_ports --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip_ctl -m multiport --sports $unify_tcp_ports --tcp-flag ACK ACK -j ACCEPT
+      fi
+
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - IPMI Tools (e.g. IPMIView) only out
+# ---
+
+echononl "\t\tIPMI Tools (e.g. IPMIView) only out"
+
+if $allow_ipmi_request_out && ! $permit_local_net_to_inet ; then
+   for _dev in ${ext_if_arr[@]} ; do
+
+      for _port in ${ipmi_udp_port_arr[@]} ; do
+         $ipt -A OUTPUT -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+      for _port in ${ipmi_tcp_port_arr[@]} ; do
+         $ipt -A OUTPUT -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      if $kernel_activate_forwarding ; then
+         
+         for _port in ${ipmi_udp_port_arr[@]} ; do
+            $ipt -A FORWARD -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         for _port in ${ipmi_tcp_port_arr[@]} ; do
+            $ipt -A FORWARD -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - IPMI Tools (e.g. IPMIView) local Networks
+# ---
+
+echononl "\t\tIPMI Tools (e.g. IPMIView) local Networks"
+
+if [[ ${#ipmi_server_ip_arr[@]} -gt 0 ]]; then
+   for _ip in ${ipmi_server_ip_arr[@]} ; do
+
+      for _port in ${ipmi_udp_port_arr[@]} ; do
+         $ipt -A OUTPUT -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+      for _port in ${ipmi_tcp_port_arr[@]} ; do
+         $ipt -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+      
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _port in ${ipmi_udp_port_arr[@]} ; do
+            $ipt -A FORWARD -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         for _port in ${ipmi_tcp_port_arr[@]} ; do
+            $ipt -A FORWARD -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+
+         # - Rule is needed if (local) interface aliases in use (like eth0:1)
+         # -
+         if $local_alias_interfaces ; then
+            for _port in ${ipmi_udp_port_arr[@]} ; do
+               $ipt -A FORWARD -p udp -s $_ip --sport $_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+            for _port in ${ipmi_tcp_port_arr[@]} ; do
+               $ipt -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
+               $ipt -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
+            done
+         fi
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Remote Console (VNC) only out
+# ---
+
+echononl "\t\tRemote Console (VNC) only out"
+
+if $allow_remote_console_request_out && ! $permit_local_net_to_inet ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_remote_console_port -m conntrack --ctstate NEW -j ACCEPT
+
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_remote_console_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Remote Console (VNC) local Networks
+# ---
+
+echononl "\t\tRemote Console (VNC) local Networks"
+
+
+if [[ ${#rm_server_ip_arr[@]} -gt 0 ]]; then
+   for _ip in ${rm_server_ip_arr[@]} ; do
+
+      $ipt -A OUTPUT -p tcp -d $_ip --dport $remote_console_port -m conntrack --ctstate NEW -j ACCEPT
+      
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         $ipt -A FORWARD -p tcp -d $_ip --dport $remote_console_port -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Rule is needed if (local) interface aliases in use (like eth0:1)
+         # -
+         if $local_alias_interfaces ; then
+            $ipt -A FORWARD -p tcp -d $_ip --dport $remote_console_port --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -p tcp -s $_ip --sport $remote_console_port --tcp-flag ACK ACK -j ACCEPT
+         fi
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Remote Console (VNC) DMZ
+# ---
+
+echononl "\t\tRemote Console (VNC) DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#rm_server_dmz_arr[@]} -gt 0 ]] ; then
+   for _ip in ${!rm_server_dmz_arr[@]} ; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${rm_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      # - From Gateway
+      $ipt -A OUTPUT -p tcp -d $_ip --dport $remote_console_port -m conntrack --ctstate NEW -j ACCEPT
+
+      if $kernel_activate_forwarding ; then
+
+         # - From extern
+
+         # - Nat if interface is on a dsl line
+         # -
+         if containsElement "${rm_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+            $ipt -t nat -A PREROUTING -i ${rm_server_dmz_arr[$_ip]} -p tcp --syn --dport $remote_console_port -j DNAT --to $_ip:$remote_console_port
+         fi
+         $ipt -A FORWARD -i ${rm_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport $remote_console_port  -m conntrack --ctstate NEW -j ACCEPT
+
+         # - From intern
+         if ! $permit_between_local_networks ; then
+            for _dev in ${local_if_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $remote_console_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+         fi
+
+         # - Rule is needed if (local) interface aliases in use (like eth0:1)
+         # -
+         if $local_alias_interfaces ; then
+            $ipt -A FORWARD -p tcp -d $_ip --dport $remote_console_port --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -p tcp -s $_ip --sport $remote_console_port --tcp-flag ACK ACK -j ACCEPT
+         fi
+      fi
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Munin Service Gateway
+# ---
+
+echononl "\t\tMunin Service Gateway"
+
+if $local_munin_server ; then
+
+   if $provide_munin_service_to_inet ; then
+      # - Provide Service for local and extern networks
+      # -
+      $ipt -A OUTPUT -p tcp --dport $munin_remote_port -m conntrack --ctstate NEW -j ACCEPT
+   else
+      # - Provide Service only for for local network
+      # -
+      for _dev in ${local_if_arr[@]} ; do
+         $ipt -A OUTPUT -o $_dev -p tcp --dport $munin_remote_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+   fi
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Munin Service local Networks
+# ---
+
+echononl "\t\tMunin Service local Networks"
+if [[ ${#munin_local_server_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${munin_local_server_ip_arr[@]} ; do
+      $ipt -A INPUT -s $_ip -p tcp --dport $munin_local_port -m conntrack --ctstate NEW -j ACCEPT
+
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            if ! $permit_between_local_networks ; then
+               $ipt -A FORWARD -i $_dev -s $_ip -p tcp --dport $munin_local_port -m conntrack --ctstate NEW -j ACCEPT
+            fi
+         done
+      fi
+
+      # - Rule is needed if (local) interface aliases in use (like eth0:1)
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip --sport $munin_local_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --dport $munin_local_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Munin remote Server
+# ---
+
+echononl "\t\tMunin remote Server"
+
+if [[ -n $munin_remote_server ]] && [[ ${#munin_local_client_ip_arr[@]} -gt 0 ]]; then
+
+   for _ip in ${!munin_local_client_ip_arr[@]} ; do
+      if containsElement "$_ip" "${gateway_ipv4_address_arr[@]}" ; then
+         $ipt -A INPUT -i ${munin_local_client_ip_arr[$_ip]} -p tcp -s $munin_remote_server --dport $munin_local_port  -m conntrack --ctstate NEW -j ACCEPT
+      elif $kernel_activate_forwarding ; then
+         $ipt -t nat -A PREROUTING -i ${munin_local_client_ip_arr[$_ip]} -p tcp -s $munin_remote_server --dport $munin_local_port -j DNAT --to $_ip:$munin_local_port
+         $ipt -A FORWARD -i ${munin_local_client_ip_arr[$_ip]} -p tcp -s $munin_remote_server -d $_ip --dport $munin_local_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - XyMon local service
+# ---
+
+echononl "\t\tXyMon Service Gateway"
+
+if $local_xymon_server ; then
+   for _dev in ${local_if_arr[@]} ; do
+      $ipt -A INPUT -i $_dev -p tcp --dport $xymon_port -m conntrack --ctstate NEW -j ACCEPT
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - XyMon Service Intranet
+# ---
+
+echononl "\t\tXyMon Service Intranet"
+
+if [[ ${#xymon_server_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${xymon_server_ip_arr[@]} ; do
+      if $local_xymon_client ; then
+         $ipt -A OUTPUT -p tcp -d $_ip --dport $xymon_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $xymon_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+      # - Rule is needed if (local) interface aliases in use (like eth0:1)
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip --dport $xymon_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport $xymon_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# -------------
+# --- Portforwarding
+# -------------
+
+# ---
+# - Portforwarding TCP
+# ---
+
+echo
+echononl "\tPortforwarding TCP"
+
+if [[ ${#portforward_tcp_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _val in "${portforward_tcp_arr[@]}" ; do
+
+      # - Split value
+      # -
+      IFS=':' read -a _val_arr <<< "${_val}"
+
+      # - DNAT
+      # -
+      $ipt -t nat -A PREROUTING -i ${_val_arr[0]} -p tcp --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j DNAT --to ${_val_arr[2]}:${_val_arr[3]}
+
+      # - Allow Packets
+      # -
+      $ipt -t filter -A FORWARD -i ${_val_arr[0]} -p tcp -d ${_val_arr[2]} --dport ${_val_arr[3]} -m conntrack --ctstate NEW -j ACCEPT
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Portforwarding UDP
+# ---
+
+echononl "\tPortforwarding UDP"
+
+if [[ ${#portforward_udp_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _val in "${portforward_udp_arr[@]}" ; do
+
+      # - Split value
+      # -
+      IFS=':' read -a _val_arr <<< "${_val}"
+
+      # - DNAT
+      # -
+      $ipt -t nat -A PREROUTING -i ${_val_arr[0]} -p udp --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j DNAT --to ${_val_arr[2]}:${_val_arr[3]}
+
+      # - Allow Packets
+      # -
+      $ipt -t filter -A FORWARD -i ${_val_arr[0]} -p udp -d ${_val_arr[2]} --dport ${_val_arr[3]} -m conntrack --ctstate NEW -j ACCEPT
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - UNIX Traceroute
+# ---
+
+echo
+echononl "\tUNIX Traceroute"
+
+#   versendet udp packete im gegensatz zu tracert von windows
+#   der icmp-echo-request pakete versendet
+#   einige implementierungen von traceroute (linux) erm�lichens
+#   die option -I und versenden dann ebenfalls icmp-echo-request pakete
+
+for _dev in ${ext_if_arr[@]} ; do
+   $ipt -A OUTPUT -o $_dev -p udp -m conntrack --ctstate NEW --dport 33434:33530 -j ACCEPT
+   $ipt -A INPUT -i $_dev -p udp -m conntrack --ctstate NEW --dport 33434:33530 -j ACCEPT
+   if $kernel_activate_forwarding ; then
+      $ipt -A FORWARD -o $_dev -p udp -m conntrack --ctstate NEW --dport 33434:33530 -j ACCEPT
+      $ipt -A FORWARD -i $_dev -p udp -m conntrack --ctstate NEW --dport 33434:33530 -j ACCEPT
+   fi
+done
+
+echo_done
+
+
+# -------------
+# --- ICMP Traffic (i.e. ping requests)
+# -------------
+
+echononl "\tPermit all ICMP traffic.."
+if $permit_all_icmp_traffic ; then
+   $ipt -A INPUT -p icmp -j ACCEPT
+   $ipt -A OUTPUT -p icmp -j ACCEPT
+   $ipt -A FORWARD -p icmp -j ACCEPT
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Deny between local networks
+# ---
+
+echo
+echononl "\tDeny all traffic between local networks.."
+if $kernel_activate_forwarding ; then
+   if ! $permit_between_local_networks ; then
+      for _dev_1 in ${local_if_arr[@]} ; do
+         for _dev_2 in ${local_if_arr[@]} ; do
+            if $log_rejected || $log_all ; then
+               $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -j LOG --log-prefix "$log_prefix Rejected local NET: " --log-level $log_level
+            fi
+            $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -p ALL -m conntrack --ctstate NEW -j DROP
+         done
+      done
+      echo_done
+   else
+      echo_skipped
+   fi
+else
+   echo_skipped
+fi
+
+
+# -------------
+# --- Log traffic not matched so far
+# -------------
+echo
+
+echononl "\tLog traffic not matched so far.."
+if $log_rejected || $log_all ; then
+   $ipt -A OUTPUT -j LOG --log-prefix "$log_prefix OUT Rejected: " --log-level $log_level
+   $ipt -A INPUT -j LOG --log-prefix "$log_prefix IN Rejected: " --log-level $log_level
+   $ipt -A FORWARD -j LOG --log-prefix "$log_prefix FORWARD Rejected: " --log-level $log_level
+   #$ipt -A OUTPUT -m limit --limit-burst 5 -j LOG --log-prefix "$log_prefix OUT Rejected: "  --log-level $log_level
+   #$ipt -A INPUT -m limit --limit-burst 5 -j LOG --log-prefix "$log_prefix IN Rejected: " --log-level $log_level
+   #$ipt -A FORWARD -m limit --limit-burst 5 -j LOG --log-prefix "$log_prefix FORWARD Rejected: " --log-level $log_level
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# -------------
+# --- DROP traffic not matched so far
+# -------------
+echononl "\tDROP traffic not matched so far.."
+
+# - drop all other for all interfaces..
+#
+$ipt -A INPUT -j DROP
+$ipt -A OUTPUT -j DROP
+$ipt -A FORWARD -j DROP
+#
+# ---------- Ende: DROP ----------
+
+echo_done
+
+
+# ---
+# - Warning, if no intern (local) interface is configured
+# ---
+
+if [[ ${#local_if_arr[@]} -lt 1 ]] ; then
+   echo ""
+   echo ""
+   if $terminal ; then
+      echo -e "\t\033[33m\033[1m----------\033[m"
+   else
+      echo "----------"
+   fi
+   warn "No local Interface is configured!"
+   if $terminal ; then
+      echo -e "\t\033[33m\033[1m----------\033[m"
+   else
+      echo "----------"
+   fi
+fi
+
+echo
+exit 0
+
diff --git a/GA-Schloss/sbin/netconfig.sh b/GA-Schloss/sbin/netconfig.sh
new file mode 100755
index 0000000..5d64e6f
--- /dev/null
+++ b/GA-Schloss/sbin/netconfig.sh
@@ -0,0 +1,993 @@
+#!/usr/bin/env bash
+
+## -------------------------------------------------------------------
+## --- All Configurations ill be done in /etc/check_net/check_net.conf
+## -------------------------------------------------------------------
+
+## - Load Configuration
+## -
+source /etc/check_net/check_net.conf
+
+
+## ------------------
+## --- Some functions
+## ------------------
+
+## - Check if a given array (parameter 2) contains a given string (parameter 1)
+## -
+fatal(){
+   echo ""
+   echo -e "[ \033[31m\033[1mError\033[m ]: $*"
+   echo ""
+   echo -e "\t\033[31m\033[1mScript is canceled\033[m\033[m"
+   echo ""
+
+   echo "" >> $log_file
+   echo "[ Error ]: $*" >> $log_file
+   echo "" >> $log_file
+   echo "           Script is canceled." >> $log_file
+   echo "" >> $log_file
+
+   exit 1
+}
+containsElement () {
+   local e
+   for e in "${@:2}"; do [[ "$e" == "$1" ]] && return 0; done
+   return 1
+}
+
+usage() {
+   echo 
+   [ -n  "$1" ] && echo -e "[ \033[1;31mError\033[m ] : $1\n"
+
+echo -e "   Usage:"
+echo -e "          \033[1m`basename $0` [OPTIONS] <device1> <device2> ..\033[m"
+echo ""
+echo -e "   This script configures the default route, especially if more than one"
+echo -e "   route to the internet exists. Also the routing tables are managed by this"
+echo -e "   script."
+echo ""
+echo -e "   The Parameter \033[1mdevice list\033[m contains all network devices, which should have"
+echo -e "   a connection to the Internet. Tha can be DSL lines as well as static lines."
+echo -e "   The declaration of the device list is mandatory."
+echo ""
+echo -e "   \033[1mNotice\033[m"
+echo -e "      Declare the device list in the order of your preferred default gatway devices."
+echo ""
+echo -e "   \033[1mNotice\033[m"
+echo -e "      On static line devices \033[1mappend \":<gateway>\033[m. This is very important,"
+echo -e "      otherwise this script will \033[1mNOT work as expected\033[m."
+echo ""
+echo -e "   If this script is invoked with option \033[1m-m\033[m, another script called \033[1m`basename $check_script`\033[m"
+echo -e "   will be triigered to monitor the devices and informs about changes (online/offline"
+echo -e "   status) of the given devices. If the status of a line has changed, this script"
+echo -e "   is reinvoked by the monitoring script \033[1m`basename $check_script`\033[m to reconfigure"
+echo -e "   the routing."
+echo ""
+echo -e "   Options:"
+echo ""
+echo -e "      \033[1m-h\033[m"
+echo -e "         Prints this help\033[m"
+echo ""   
+echo -e "      \033[1m-l <list of online devices>\033[m"
+echo -e "         List of all (internet) devices known as online. Usually, this option will"
+echo -e "         be used by triggering this script from check script \033[1m`basename $check_script`\033[m."
+echo ""   
+echo -e "      \033[1m-m\033[m"
+echo -e "          Activates monitoring of the given network devices."
+echo ""
+echo -e "   Example:"
+echo -e "      - Simply configure routing for devices \"$_INITIAL_DEVICE_LIST\""
+echo -e "            \033[1m`basename $0` $_INITIAL_DEVICE_LIST\033[m"
+echo ""
+echo -e "      - Configure routing for devices \"$_INITIAL_DEVICE_LIST\" and activate monitoring"
+echo -e "            \033[1m`basename $0` -m $_INITIAL_DEVICE_LIST\033[m"
+echo ""
+
+exit 1
+}
+
+if [[ ! -f "$check_script" ]] ; then 
+   fatal "Check script \033[1m$check_script\033[m not found!" 
+fi
+ 
+if [[ "`which sipcalc`" == "" ]]; then
+   fatal "\033[1msipcalc\033[m must be installed to run this script"
+fi
+
+if [[ $EUID -ne 0 ]]; then
+   fatal "This script must be run as root" 1>&2
+fi
+
+## ---
+## --- Configure
+## ---
+
+_monitoring=false
+ONLINE_DEVICE_LIST=
+while getopts hl:m opt ; do
+   case $opt in
+      h) usage
+         ;;
+      l) ONLINE_DEVICE_LIST=$OPTARG
+         ;;
+      m) _monitoring=true
+         ;;
+   esac
+done
+
+shift `expr $OPTIND - 1`
+
+INITIAL_DEVICE_LIST="$@"
+if [[ -z "$INITIAL_DEVICE_LIST" ]]; then
+   INITIAL_DEVICE_LIST=$_INITIAL_DEVICE_LIST
+fi
+
+[[ -z "$INITIAL_DEVICE_LIST" ]] && usage "No device list given"
+
+## - Define (non associative) array
+## -
+declare -a inet_devices_arr
+declare -a dsl_devices_arr
+declare -a static_devices_arr
+declare -a online_devices_arr
+declare -A static_gw_arr
+
+for _device in $INITIAL_DEVICE_LIST ; do
+   if [[ "$_device" =~ : ]]; then
+      static_gateway="${_device##*:}"
+      _device="${_device%:*}"
+      static_gw_arr[$_device]="$static_gateway"
+
+      static_devices_arr+=("$_device")
+
+   else
+      dsl_devices_arr+=("$_device")
+   fi
+   inet_devices_arr+=("$_device")
+done
+
+for _online_device in $ONLINE_DEVICE_LIST ; do
+   online_devices_arr+=("$_online_device")
+done
+
+
+#echo "All Devices:"
+#for _device in "${inet_devices_arr[@]}" ; do
+#   echo -e "\t$_device"
+#done
+#echo "Online Devices:"
+#for _device in "${online_devices_arr[@]}" ; do
+#   echo -e "\t$_device"
+#done
+#
+#for inet_device in "${inet_devices_arr[@]}" ; do
+#   if [ -n "$ONLINE_DEVICE_LIST" ]; then
+#      if ! containsElement "$inet_device" "${online_devices_arr[@]}" ; then
+#         echo "$inet_device is offline"
+#         continue
+#      fi
+#   fi
+#done
+#
+#echo ""
+#exit
+
+
+## - Define associative arrays
+## -
+declare -A default_gw_arr 
+declare -A gw_connection_arr
+
+declare -i number_rt_table=0
+
+
+## ---
+## --- Start
+## ---
+
+#echo "" >> $log_file
+#echo "" >> $log_file
+#echo "#############################" >> $log_file
+#echo "### ---" >> $log_file
+#echo "### --- [ `date +'%Y-%m-%d %H:%M'` ]: Starting Script `basename $0`.." >> $log_file
+#echo "### ---                       Devices all:    $INITIAL_DEVICE_LIST" >> $log_file
+#echo "### ---                       Devices online: $ONLINE_DEVICE_LIST" >> $log_file
+#echo "### ---" >> $log_file
+#echo "### ---" >> $log_file
+#echo "#############################" >> $log_file
+
+echo "" >> $log_file
+echo "`date +'%Y-%m-%d %H:%M:%S'` [ Info  ] Starting Script `basename $0`.." >> $log_file
+echo "                              Devices all:    $INITIAL_DEVICE_LIST" >> $log_file
+echo "                              Devices online: $ONLINE_DEVICE_LIST" >> $log_file
+
+configured=false
+if $_monitoring ; then
+   max_attempts=20
+else
+   max_attempts=1
+fi
+declare -i _try_number=0
+declare -i prio=0
+
+while  ! $configured && [ $_try_number -lt $max_attempts ]  ; do
+
+   let _try_number++
+
+   if [ $_try_number -gt 1 ]; then
+      echo "" >> $log_file
+      echo "# --- sleeping 2 seconds before attempt number $_try_number" >> $log_file
+      sleep 2
+   fi
+
+   number_rt_table=0
+
+   #for inet_device in "${dsl_devices_arr[@]}" ; do
+   for inet_device in "${inet_devices_arr[@]}" ; do
+
+      ## - Create routing table name
+      ## - 
+      if containsElement "$inet_device" "${dsl_devices_arr[@]}" ; then      
+         __name=`echo $inet_device | cut -d '-' -f2`
+         rt_name="dsl_$__name"
+      else
+         __name=`echo $inet_device | cut -d '-' -f1`
+         rt_name="static_$__name"
+      fi
+
+      if ! $_monitoring ; then
+
+         ## - Check if device was reported (from check script) as offline
+         ## -
+         _offline=false
+         if [ -n "$ONLINE_DEVICE_LIST" ]; then
+            if ! containsElement "$inet_device" "${online_devices_arr[@]}" ; then
+               _offline=true
+            fi
+         else
+            _offline=true
+         fi
+
+         ## - Cleanup routing tables
+         ## -
+         if $_offline ; then
+
+            if $LOGGING_CONSOLE ; then
+               echo -e "\n\t[ Error ]: Connection at interface \"$inet_device\" was reported to be down !"
+               echo -e "\t           So device \"$inet_device\" will be excluded from routing."
+            fi
+
+            echo -e "\n\t[ Error ]: Connection at interface \"$inet_device\" was reported to be down !" >> $log_file
+            echo -e "\t           So device \"$inet_device\" will be excluded from routing." >> $log_file
+
+            ## - Delete all existing entries of this routing table
+            ## -
+            echo "" >> $log_file
+            echo "## - Delete all existing entries of routing table \"$rt_name\"" >> $log_file
+            echo "## -" >> $log_file
+            echo "/sbin/ip route flush table $rt_name" >> $log_file
+            /sbin/ip route flush table $rt_name >> $log_file 2>&1
+
+            if /sbin/ip rule | grep $rt_name > /dev/null 2>&1 ; then
+               ## - Delete all rules concerning table $rt_name
+               ## -
+               echo "" >> $log_file
+               echo "## - Delete all rules concerning routing table $rt_name" >> $log_file
+               echo "## -" >> $log_file
+               while read line ; do
+                  direction=`echo $line | awk '{print$2}'`
+                  ip=`echo $line | awk '{print$3}'`
+                  echo "/sbin/ip rule delete $direction $ip table $rt_name"  >> $log_file
+                  /sbin/ip rule delete $direction $ip table $rt_name
+               done < <(/sbin/ip rule | grep $rt_name)
+               echo "" >> $log_file
+            fi # End: if /sbin/ip rule | grep $rt_name > /dev/null 2>&1 
+
+            continue
+
+         fi # End: if $_offline
+      fi # End: if ! $_monitoring ; then
+
+      let number_rt_table="$number_rt_table+100"
+      prio=0
+
+
+      ## - Add new routing table to /etc/iproute2/rt_tables
+      ## - if not yet exists
+      ## -
+      if ! grep $rt_name /etc/iproute2/rt_tables > /dev/null 2>&1 ; then
+
+         echo "" >> $log_file
+         echo "## - Add new routing table to /etc/iproute2/rt_tables" >> $log_file
+         echo "## -" >> $log_file
+         echo "echo \"$number_rt_table $rt_name\" >> /etc/iproute2/rt_tables" >> $log_file
+
+         echo -e "$number_rt_table\t$rt_name" >> /etc/iproute2/rt_tables
+      fi
+
+      ## - Is the device present and has local Address ?
+      ## -
+      local_gw_address="$(ip addr show $inet_device 2> /dev/null | grep inet | awk '{print$2}' | cut -d '/' -f1)"
+      if [ -z $local_gw_address ]; then
+         if $LOGGING_CONSOLE ; then
+            echo -e "\n\t[ Error ]: Connection at interface \"$inet_device\" seems to be down !"
+            echo -e "\t           No local address was found."
+         fi
+
+         echo -e "\n\t[ Error ]: Connection at interface \"$inet_device\" seems to be down !" >> $log_file
+         echo -e "\t           No local address was found." >> $log_file
+
+
+         ## - Cleanup routing tables
+         ## -
+         ## - Delete all existing entries of this routing table
+         ## -
+         echo "" >> $log_file
+         echo "## - Delete all existing entries of this routing table" >> $log_file
+         echo "## -" >> $log_file
+         echo "/sbin/ip route flush table $rt_name" >> $log_file
+         /sbin/ip route flush table $rt_name >> $log_file 2>&1
+
+         if /sbin/ip rule | grep $rt_name > /dev/null 2>&1 ; then
+            ## - Delete all rules concerning table $rt_name
+            ## -
+            echo "" >> $log_file
+            echo "## - Delete all rules concerning routing table $rt_name" >> $log_file
+            echo "## -" >> $log_file
+            while read line ; do
+               direction=`echo $line | awk '{print$2}'`
+               ip=`echo $line | awk '{print$3}'`
+               echo "/sbin/ip rule delete $direction $ip table $rt_name"  >> $log_file
+               /sbin/ip rule delete $direction $ip table $rt_name
+            done < <(/sbin/ip rule | grep $rt_name)
+            echo "" >> $log_file
+         fi
+
+         continue
+      fi # End: if [ -z $local_gw_address ]
+
+      ## - Is the DSL-device known and has remote Address ?
+      ## -
+      if containsElement "$inet_device" "${dsl_devices_arr[@]}" ; then
+         remote_gw_address="$(ip addr show $inet_device 2> /dev/null | grep peer | awk '{print$4}' | cut -d "/" -f1)"
+         remote_gw_net="$remote_gw_address/32"
+      else
+         net_address=`sipcalc $inet_device 2> /dev/null | grep -i -e "^network\s*address\s*-" | awk '{print$4}'`
+         remote_gw_address=${static_gw_arr[$inet_device]}
+         _netmask_bits=`sipcalc $inet_device 2> /dev/null | grep -i -e "Network\s*mask\s*(bits)" | awk '{print$5}'`
+         remote_gw_net="${net_address}/$_netmask_bits"
+      fi
+      if [ -z $remote_gw_address ]; then
+         if $LOGGING_CONSOLE ; then
+            echo -e "\n\t[ Error ]: Connection at interface \"$inet_device\" seems to be down !"
+            echo -e "\t           No remote gateway was found."
+         fi
+
+
+         echo -e "\n\t[ Error ]: Connection at interface \"$inet_device\" seems to be down !" >> $log_file
+         echo -e "\t           No remote gateway was found." >> $log_file
+
+         ## - Cleanup routing tables
+         ## -
+         ## - Delete all existing entries of this routing table
+         ## -
+         echo "" >> $log_file
+         echo "## - Delete all existing entries of this routing table" >> $log_file
+         echo "## -" >> $log_file
+         echo "/sbin/ip route flush table $rt_name" >> $log_file
+         /sbin/ip route flush table $rt_name >> $log_file 2>&1
+
+         if /sbin/ip rule | grep $rt_name > /dev/null 2>&1 ; then
+            ## - Delete all rules concerning table $rt_name
+            ## -
+            echo "" >> $log_file
+            echo "## - Delete all rules concerning routing table $rt_name" >> $log_file
+            echo "## -" >> $log_file
+            while read line ; do
+               direction=`echo $line | awk '{print$2}'`
+               ip=`echo $line | awk '{print$3}'`
+               echo "/sbin/ip rule delete $direction $ip table $rt_name"  >> $log_file
+               /sbin/ip rule delete $direction $ip table $rt_name
+            done < <(/sbin/ip rule | grep $rt_name)
+            echo "" >> $log_file
+         fi
+
+         continue
+      fi
+
+      ## - Device already configured by that script?
+      ## -
+      if [ ${default_gw_arr[$inet_device]+_} ] ; then
+         continue
+      fi
+ 
+
+      # -
+      # - Ready to start configuration for that device
+      # - 
+      echo "" >> $log_file
+      echo "# ---" >> $log_file
+      if containsElement "$inet_device" "${dsl_devices_arr[@]}" ; then
+         echo "# --- Routing Table for (DSL) network device \"$inet_device\" was created" >> $log_file
+      else
+         echo "# --- Routing Table for (static line) network device \"$inet_device\"" >> $log_file
+      fi
+      echo "# ---" >> $log_file
+
+      if $LOGGING_CONSOLE ; then
+         echo
+         echo
+         if containsElement "$inet_device" "${dsl_devices_arr[@]}" ; then
+            echo -e "\t--- DSL Connection at interface $inet_device"
+         else
+            echo -e "\t--- Static Connection at interface $inet_device"
+         fi
+         echo -e "\t---"
+         echo -e "\tRouting Table Name..: $rt_name"
+         echo
+         echo -e "\tInterface...........: $inet_device"
+         echo
+         echo -e "\tLocal GW address....: $local_gw_address"
+         echo -e "\tRemote GW address...: $remote_gw_address"
+         echo -e "\tRemote network......: $remote_gw_net"
+         echo
+      fi
+      echo "# --- Routing Table Name..: $rt_name" >> $log_file
+      echo "# --- " >> $log_file
+      echo "# --- Interface...........: $inet_device" >> $log_file
+      echo "# --- " >> $log_file
+      echo "# --- Local GW address....: $local_gw_address" >> $log_file
+      echo "# --- Remote GW address...: $remote_gw_address" >> $log_file
+      echo "# --- Remote network......: $remote_gw_net" >> $log_file
+      echo "# --- " >> $log_file
+
+      ## - Read routing table from output of "netstat -rn"
+      ## -
+      routing_table_main_arr=()
+      while read  _destination _gateway _genmask _flags _mss _window _irtt _iface; do 
+         if [ "$_destination" = "Destination" -o "$_destination" = "Kernel" \
+            -o "$_destination" = "Ziel" -o "$_destination" = "Kernel-IP-Routentabelle" ]; then 
+               continue 
+         fi  
+         routing_table_main_arr+=("$_destination $_gateway $_genmask $_iface")
+      done < <(netstat -rn)
+
+      ## - First delete all existing entries of this routing table
+      ## -
+      echo "" >> $log_file
+      echo "## - First delete all existing entries of this routing table" >> $log_file
+      echo "## -" >> $log_file
+      echo "/sbin/ip route flush table $rt_name" >> $log_file
+      /sbin/ip route flush table $rt_name >> $log_file 2>&1
+
+
+      ## - Add loopback device to routing table $rt_name
+      ## -
+      echo "" >> $log_file
+      echo "## - Add loopback device to routing table $rt_name " >> $log_file
+      echo "## -" >> $log_file
+      echo "/sbin/ip route add 127.0.0.0/8 dev lo table table $rt_name" >> $log_file
+      /sbin/ip route add 127.0.0.0/8 dev lo table $rt_name >> $log_file 2>&1
+
+
+      ## - Add routing tables of all (local) network interfaces
+      ## -
+      echo "" >> $log_file
+      echo "## - Add routing tables of all (local) network interfaces" >> $log_file
+      echo "## -" >> $log_file
+      for _entry in "${routing_table_main_arr[@]}" ; do
+         dest=`echo $_entry | cut -d " " -f1`
+         gateway=`echo $_entry | cut -d " " -f2`
+         genmask=`echo $_entry | cut -d " " -f3`
+         iface=`echo $_entry | cut -d " " -f4`
+
+         ## - We will set default route later..
+         ## -
+         if  [ "$dest" = "0.0.0.0" ]; then
+            continue
+         fi
+
+         ## - Is this a "ppp"-device ?
+         ## -
+         if [[ "$iface" =~ "ppp" ]]; then
+            continue
+         fi
+
+         if [ "$dest" = "$remote_gw_address" ]; then
+            continue
+         fi
+
+         if [ "$gateway" = "0.0.0.0" ]; then
+            echo "/sbin/ip route add ${dest}/$genmask dev $iface table $rt_name" >> $log_file
+            /sbin/ip route add ${dest}/$genmask dev $iface table $rt_name >> $log_file 2>&1
+         else
+            echo "/sbin/ip route add ${dest}/$genmask via $gateway table $rt_name" >> $log_file
+            /sbin/ip route add ${dest}/$genmask via $gateway table $rt_name >> $log_file 2>&1
+         fi
+      done
+
+      ## - Add this connection to the routing table
+      ## -
+      echo "" >> $log_file
+      echo "## - Add this connection to the routing table $rt_name" >> $log_file
+      echo "## -" >> $log_file
+
+      if $USE_REMOTE_GATEWAY_ADDRESS ; then
+         ## - Remote Network: $remote_gw_net
+         ## -
+         echo "/sbin/ip route add $remote_gw_net dev $inet_device src $local_gw_address table $rt_name" >> $log_file
+         /sbin/ip route add $remote_gw_net dev $inet_device src $local_gw_address table $rt_name >> $log_file 2>&1
+      else
+         ## - Remote Network: 0.0.0.0
+         ## -
+         echo "/sbin/ip route add 0.0.0.0 dev $inet_device src $local_gw_address table $rt_name" >> $log_file
+         /sbin/ip route add 0.0.0.0 dev $inet_device src $local_gw_address table $rt_name >> $log_file 2>&1
+      fi
+
+      if $SET_MULTIPLE_DEFAULT_GW ; then
+         if /sbin/ip route show table main | grep -e "^$remote_gw_address" | grep $inet_device  > /dev/null 2>&1 ; then
+            echo "" >> $log_file
+            echo "## - Delete route via (dsl remote) host $remote_gw_address" >> $log_file
+            echo "## -"
+            echo "/sbin/ip route delete $remote_gw_address dev $inet_device" >> $log_file
+            /sbin/ip route delete $remote_gw_address dev $inet_device >> $log_file 2>&1
+         fi
+
+         echo "" >> $log_file
+         echo "## - Add this connection also to the main routing table" >> $log_file
+         echo "## -" >> $log_file
+         echo "/sbin/ip route add $remote_gw_net dev $inet_device src $local_gw_address" >> $log_file
+         /sbin/ip route add $remote_gw_net dev $inet_device src $local_gw_address >> $log_file 2>&1
+      fi
+
+      ## - Remeber that route in order to add it to the routing table
+      ## - of other connections
+      ## -
+      gw_connection_arr[$inet_device]="$remote_gw_net $local_gw_address" 
+      
+
+      ## - Add the connections associated gateway as default gateway for this
+      ## - routing table
+      ## -
+      echo "" >> $log_file
+      echo "## - Add the connections associated gateway as default gateway for this" >> $log_file
+      echo "## - routing table" >> $log_file
+      echo "## -" >> $log_file
+
+      if $USE_REMOTE_GATEWAY_ADDRESS ; then
+         ## - Default Gatway: $remote_gw_address
+         ## -
+         #echo "/sbin/ip route add default via $remote_gw_address dev $inet_device table $rt_name" >> $log_file
+         #/sbin/ip route add default via $remote_gw_address dev $inet_device table $rt_name >> $log_file 2>&1
+         echo "/sbin/ip route add default via $remote_gw_address table $rt_name" >> $log_file
+         /sbin/ip route add default via $remote_gw_address table $rt_name >> $log_file 2>&1
+      else
+         ## - Default Gatway: 0.0.0.0
+         ## -
+         echo "/sbin/ip route add default via 0.0.0.0 dev $inet_device table $rt_name" >> $log_file
+         /sbin/ip route add default via 0.0.0.0 dev $inet_device table $rt_name >> $log_file 2>&1
+      fi
+
+
+      ## - Make sure that a reply goes out over the same connection as came in
+      ## - 
+      echo "" >> $log_file
+      echo "## - Make sure that a reply goes out over the same connection as came in" >> $log_file
+      echo "## -" >> $log_file
+
+      if ! /sbin/ip rule | grep "from $local_gw_address" > /dev/null 2>&1 ; then
+         let prio="$number_rt_table"
+         echo "/sbin/ip rule add from $local_gw_address table $rt_name prio $prio" >> $log_file
+         /sbin/ip rule add from $local_gw_address table $rt_name prio $prio >> $log_file 2>&1
+         #let prio="10+$prio"
+         #echo "/sbin/ip rule add to $local_gw_address table $rt_name prio $prio" >> $log_file
+         #/sbin/ip rule add to $local_gw_address table $rt_name prio $prio >> $log_file 2>&1
+      else
+         let prio="1010+$number_rt_table"
+         echo -e "#\t[ info ]: Rule already exists.." >> $log_file
+      fi
+
+
+      ## ---
+      ## --- Special Routing (local) IP-Address OUT
+      ## ---
+
+      if [[ ${#rule_local_ip_arr[@]} -gt 0 ]] ; then
+
+         let prio="1000+${number_rt_table}+10"
+
+         for _val in "${rule_local_ip_arr[@]}" ; do
+
+            IFS=':' read -a _val_arr <<< "${_val}"
+
+            if [[ "${_val_arr[0]}" = "$inet_device" ]]; then
+
+               echo "" >> $log_file
+               echo "## - Rule ${prio}: from ${_val_arr[1]} through ${_val_arr[0]}" >> $log_file
+               echo "## -" >> $log_file
+               if ! /sbin/ip rule | grep "from ${_val_arr[1]} " > /dev/null 2>&1 ; then
+                  echo "/sbin/ip rule add from ${_val_arr[1]} table $rt_name prio $prio" >> $log_file
+                  /sbin/ip rule add from ${_val_arr[1]} table $rt_name prio $prio >> $log_file 2>&1
+               else
+                  echo "# Rule already exists" >> $log_file
+               fi
+               prio="10+$prio"
+            fi
+         done
+      fi
+
+
+
+      ## ---
+      ## --- Special Routing (remote) Services
+      ## ---
+
+      if [[ ${#rule_remote_ip_arr[@]} -gt 0 ]] ; then
+
+         let prio="5000+${number_rt_table}+10"
+
+         for _val in "${rule_remote_ip_arr[@]}" ; do
+
+            IFS=':' read -a _val_arr <<< "${_val}"
+
+            if [[ "${_val_arr[0]}" = "$inet_device" ]]; then
+
+               echo "" >> $log_file
+               echo "## - Rule ${prio}: to ${_val_arr[1]} through ${_val_arr[0]}" >> $log_file
+               echo "## -" >> $log_file
+               if ! /sbin/ip rule | grep "to ${_val_arr[1]} " > /dev/null 2>&1 ; then
+                  echo "/sbin/ip rule add to ${_val_arr[1]} table $rt_name prio $prio" >> $log_file
+                  /sbin/ip rule add to ${_val_arr[1]} table $rt_name prio $prio >> $log_file 2>&1
+               else
+                  echo "# Rule already exists" >> $log_file
+               fi
+               prio="10+$prio"
+            fi
+         done
+      fi
+
+
+      ## ---
+      ## --- Special Routing Networks
+      ## ---
+
+      if [[ ${#rule_local_net_arr[@]} -gt 0 ]] ; then
+
+         let prio="10000+${number_rt_table}+10"
+
+         for _val in "${rule_local_net_arr[@]}" ; do
+
+            IFS=':' read -a _val_arr <<< "${_val}"
+
+            if [[ "${_val_arr[0]}" = "$inet_device" ]]; then
+
+               echo "" >> $log_file
+               echo "## - Rule ${prio}: from ${_val_arr[1]} through ${_val_arr[0]}" >> $log_file
+               echo "## -" >> $log_file
+               if ! /sbin/ip rule | grep "from ${_val_arr[1]} " > /dev/null 2>&1 ; then
+                  echo "/sbin/ip rule add from ${_val_arr[1]} table $rt_name prio $prio" >> $log_file
+                  /sbin/ip rule add from ${_val_arr[1]} table $rt_name prio $prio >> $log_file 2>&1
+               else
+                  echo "# Rule already exists" >> $log_file
+               fi
+               prio="10+$prio"
+            fi
+         done
+      fi
+
+
+      ## - Add this connection to the routing tables of other already configured dsl-connections
+      ## -
+      ## - Note:
+      ## -    Connections which will be configured later at this loop will
+      ## -    not have that connection in their routing tables. So you have 
+      ## -    to add missing routes at the end (after that loop has finisched).
+      ## -
+      ## -    _key is eqal to the ppp-device
+      ## -
+      for _key in "${!gw_connection_arr[@]}"; do
+
+         if containsElement "$_key" "${dsl_devices_arr[@]}" ; then      
+            __name=`echo $_key | cut -d '-' -f2`
+            _rt_name="dsl_$__name"
+         else
+            __name=`echo $_key | cut -d '-' -f1`
+            _rt_name="static_$__name"
+         fi
+         if [[ "$_rt_name" == "$rt_name" ]]; then
+            continue
+         fi
+
+         _local_gw_address=`echo ${gw_connection_arr[$_key]} | cut -d " " -f2`
+         _remote_gw_net=`echo ${gw_connection_arr[$_key]} | cut -d " " -f1`
+         echo "" >> $log_file
+         echo "## - Add this connection to the routing table \"$_rt_name\"" >> $log_file
+         echo "## -" >> $log_file
+
+         if $USE_REMOTE_GATEWAY_ADDRESS ; then
+            ## - Remote Network: $_remote_gw_net
+            ## -
+            if ! /sbin/ip route show table $_rt_name | egrep "^$_remote_gw_net\s+dev\s+$_key" >/dev/null 2>&1 ; then
+               _remote_gw=`echo $_remote_gw_net | cut -d "/" -f1`
+               if ! /sbin/ip route show table $_rt_name | egrep "^$_remote_gw\s+dev\s+$_key" >/dev/null 2>&1 ; then
+                  echo "/sbin/ip route add $_remote_gw_net dev $_key src $_local_gw_address table $_rt_name" >> $log_file
+                  /sbin/ip route add $_remote_gw_net dev $_key src $_local_gw_address table $_rt_name >> $log_file 2>&1
+               else
+                  echo -e "#\t[ info ]: Connection through $_key is already part of table $_rt_name" >> $log_file
+               fi
+            fi
+         else
+            ## - Remote Network: 0.0.0.0
+            ## -
+            if ! /sbin/ip route show table $_rt_name | egrep "^0.0.0.0\s+dev\s+$_key" >/dev/null 2>&1 ; then
+               _remote_gw=`echo $_remote_gw_net | cut -d "/" -f1`
+               if ! /sbin/ip route show table $_rt_name | egrep "^0.0.0.0\s+dev\s+$_key" >/dev/null 2>&1 ; then
+                  echo "/sbin/ip route add 0.0.0.0 dev $_key src $_local_gw_address table $_rt_name" >> $log_file
+                  /sbin/ip route add 0.0.0.0 dev $_key src $_local_gw_address table $_rt_name >> $log_file 2>&1
+               else
+                  echo -e "#\t[ info ]: Connection through $_key is already part of table $_rt_name" >> $log_file
+               fi
+            fi
+         fi
+      done 
+
+
+      ## - Add this gateway data to the array concerning all outgoing gatways 
+      ## -
+      #default_gw_arr[$inet_device]="$local_gw_address"
+      default_gw_arr[$inet_device]="$remote_gw_address"
+
+
+      if $SET_MULTIPLE_DEFAULT_GW ; then
+
+         default_gw_arg=""
+         for _key in "${!default_gw_arr[@]}"; do
+
+            if $USE_DEFAULT_GW_ADDRESS ; then
+               ## - Default Gateway: $remote_gw_address
+               ## -
+               default_gw_arg="$default_gw_arg nexthop via ${default_gw_arr[$_key]} dev $_key weight 1"
+            else
+               ## - Default Gateway: 0.0.0.0
+               ## -
+               default_gw_arg="$default_gw_arg nexthop via 0.0.0.0 dev $_key weight 1"
+            fi
+
+         done 
+         if [ -n "$default_gw_arg" ] ; then
+            echo "" >> $log_file
+            echo "## - Add multiple default gateways" >> $log_file
+            echo "## -" >> $log_file
+            echo "/sbin/ip route delete default" >> $log_file
+            /sbin/ip route delete default >> $log_file 2>&1
+            echo "/sbin/ip route add default scope global $default_gw_arg" >> $log_file
+            /sbin/ip route add default scope global $default_gw_arg >> $log_file 2>&1
+         else
+            echo "" >> $log_file
+            echo "## -" >> $log_file
+            echo "## - [ Warning]: No default gateway found!" >> $log_file
+            echo "## -" >> $log_file
+         fi
+
+      fi
+
+
+
+      ## - Notice:
+      ## - It is possible to first make a number of changes and then flush 
+      ## - the cache so that all of the changes will be implemented simultaneously. 
+      ## - This is actually convenient when working on an active router. 
+      ## -
+      echo "" >> $log_file
+      echo "## - Flush table cache" >> $log_file
+      echo "## -" >> $log_file
+      echo "/sbin/ip route flush table cache" >> $log_file
+      /sbin/ip route flush table cache >> $log_file 2>&1
+
+      echo "" >> $log_file
+
+      if [ ${#default_gw_arr[@]} -eq ${#inet_devices_arr[@]} ]; then
+         configured=true
+      fi
+
+   done
+
+done
+
+
+## - Some dsl-connections maybe not known to all routing tables. So add
+## - the missing routes to the appropriate tables..
+## -
+echo "" >> $log_file
+echo "" >> $log_file
+echo "## - Some dsl-connections maybe not known to all routing tables. So add" >> $log_file
+echo "## - the missing routes to the appropriate tables.." >> $log_file
+echo "## -" >> $log_file
+_changed=false
+
+if $USE_REMOTE_GATEWAY_ADDRESS ; then
+   ## - Remote Network: $_remote_gw_net
+   ## -
+   for _key in "${!gw_connection_arr[@]}"; do
+
+      if containsElement "$_key" "${dsl_devices_arr[@]}" ; then      
+         __name=`echo $_key | cut -d '-' -f2`
+         _rt_name="dsl_$__name"
+      else
+         __name=`echo $_key | cut -d '-' -f1`
+         _rt_name="static_$__name"
+      fi
+
+      echo "# Routing Table \"$_rt_name\"" >> $log_file
+      for __key in "${!gw_connection_arr[@]}"; do
+         _local_gw_address=`echo ${gw_connection_arr[$__key]} | cut -d " " -f2`
+         _remote_gw_net=`echo ${gw_connection_arr[$__key]} | cut -d " " -f1`
+         if ! /sbin/ip route show table $_rt_name | egrep "^$_remote_gw_net\s+dev\s+$__key" >/dev/null 2>&1 ; then
+            _remote_gw=`echo $_remote_gw_net | cut -d "/" -f1`
+            if ! /sbin/ip route show table $_rt_name | egrep "^$_remote_gw\s+dev\s+$__key" >/dev/null 2>&1 ; then
+               #echo "/sbin/ip route add $_remote_gw_net dev $_key src $_local_gw_address table $_rt_name" >> $log_file
+               #/sbin/ip route add $_remote_gw_net dev $__key src $_local_gw_address table $_rt_name >> $log_file 2>&1
+               echo "/sbin/ip route add $_remote_gw dev $__key table $_rt_name" >> $log_file
+               /sbin/ip route add $_remote_gw dev $__key table $_rt_name >> $log_file 2>&1
+               _changed=true
+            else
+               echo -e "#\t[ info ]: Connection through $__key is already part of table $_rt_name" >> $log_file
+            fi
+         fi
+      done
+   done
+else
+   ## - Remote Network: 0.0.0.0
+   ## -
+   for _key in "${!gw_connection_arr[@]}"; do
+
+
+      if containsElement "$_key" "${dsl_devices_arr[@]}" ; then      
+         __name=`echo $_key | cut -d '-' -f2`
+         _rt_name="dsl_$__name"
+      else
+         __name=`echo $_key | cut -d '-' -f1`
+         _rt_name="static_$__name"
+      fi
+
+      echo "# Routing Table \"$_rt_name\"" >> $log_file
+      for __key in "${!gw_connection_arr[@]}"; do
+         _local_gw_address=`echo ${gw_connection_arr[$__key]} | cut -d " " -f2`
+         _remote_gw_net=`echo ${gw_connection_arr[$__key]} | cut -d " " -f1`
+         if ! /sbin/ip route show table $_rt_name | egrep "^0.0.0.0\s+dev\s+$__key" >/dev/null 2>&1 ; then
+            _remote_gw=`echo $_remote_gw_net | cut -d "/" -f1`
+            if ! /sbin/ip route show table $_rt_name | egrep "^0.0.0.0\s+dev\s+$__key" >/dev/null 2>&1 ; then
+               echo "/sbin/ip route add 0.0.0.0 dev $_key src $_local_gw_address table $_rt_name" >> $log_file
+               /sbin/ip route add 0.0.0.0 dev $__key src $_local_gw_address table $_rt_name >> $log_file 2>&1
+               _changed=true
+            else
+               echo -e "#\t[ info ]: Connection through $__key is already part of table $_rt_name" >> $log_file
+            fi
+         fi
+      done
+   done
+fi
+
+
+## - If not using multiple default gatways, set the default gateway here
+## -
+if ! $SET_MULTIPLE_DEFAULT_GW ; then
+
+   __set_default_gatway=false
+
+   echo "" >> $log_file
+   echo "" >> $log_file
+   echo "## ---" >> $log_file
+   echo "## --- Add default gateway" >> $log_file
+   echo "## ---" >> $log_file
+
+   ## - Note: the first online device will become default route
+   ## -
+   for _device in "${inet_devices_arr[@]}" ; do
+      ## - Device online ?
+      if [ -n "${default_gw_arr[$_device]}" ]; then
+         echo "/sbin/ip route delete default" >> $log_file
+         /sbin/ip route delete default >> $log_file 2>&1
+         if $USE_REMOTE_GATEWAY_ADDRESS ; then
+            echo "/sbin/ip route add default via ${default_gw_arr[$_device]} dev $_device" >> $log_file
+            /sbin/ip route add default via ${default_gw_arr[$_device]} dev $_device >> $log_file 2>&1
+         else
+            echo "/sbin/ip route add default via 0.0.0.0 dev $_device" >> $log_file
+            /sbin/ip route add default via 0.0.0.0 dev $_device >> $log_file 2>&1
+         fi
+         __set_default_gatway=true
+         _changed=true
+         break
+      else
+         echo "" >> $log_file
+         echo -e "\t[ Warning ]: $_device is OFFLINE ! Trying next.."  >> $log_file
+      fi
+   done
+   if ! $__set_default_gatway ; then
+
+      echo "" >> $log_file
+      echo -e "\t[ Error ]: No connection is online!"  >> $log_file
+      echo -e "\t           Try to set default gateway from an existing static line .."  >> $log_file
+
+      ## - Notice:
+      ## -
+      ## - If no connection is available (the machine is fully offline), the check script will not 
+      ## - recognize, if the static line becomes online. A way to handle this is to let the
+      ## - default gateway active.
+      ## -
+      default_gw_deleted=false
+      for _device in "${inet_devices_arr[@]}" ; do
+         if containsElement "$_device" "${static_devices_arr[@]}" ; then
+
+            ## - Delete old default route
+            ## -
+            if ! $default_gw_deleted ; then
+               echo "" >> $log_file
+               echo "## - Delete existing default gatewy" >> $log_file
+               echo "## - " >> $log_file
+               echo "/sbin/ip route delete default" >> $log_file
+               /sbin/ip route delete default >> $log_file 2>&1
+               default_gw_deleted=true
+            fi
+
+            ## - Set new default route
+            ## -
+
+            echo "" >> $log_file
+            echo "## - Try to set default gateway to ${static_gw_arr[$_device]}.." >> $log_file
+            echo "## - " >> $log_file
+            echo "/sbin/ip route add default via ${static_gw_arr[$_device]} dev $_device" >> $log_file
+            /sbin/ip route add default via ${static_gw_arr[$_device]} dev $_device >> $log_file 2>&1
+
+            if [[ "$?" == 0 ]] ; then
+               __set_default_gatway=true
+               break
+            fi
+         fi
+      done
+
+      if ! $__set_default_gatway ; then
+         echo "" >> $log_file
+         echo -e "\t[ Error ]: No default gateway is set!"  >> $log_file
+      fi
+   fi
+fi
+
+## - Flush the routing tables cache if somethimg has changed
+## -
+if $_changed ; then
+   echo "" >> $log_file
+   echo "" >> $log_file
+   echo "## - Some Routing tables has changed, so flush table cache" >> $log_file
+   echo "## -" >> $log_file
+   echo "/sbin/ip route flush table cache" >> $log_file
+   /sbin/ip route flush table cache >> $log_file 2>&1
+fi
+
+if $_monitoring ; then
+   echo "" >> $log_file
+   echo "" >> $log_file
+   echo "## - Starting monitoring script to check dsl connections.." >> $log_file
+   echo "## -" >> $log_file
+
+   if [[ -z "${!default_gw_arr[@]}" ]] ; then
+      echo "$check_script $INITIAL_DEVICE_LIST &"  >> $log_file 2>&1
+      $check_script $INITIAL_DEVICE_LIST &
+   else
+
+      _LIST=
+      for _device in ${!default_gw_arr[@]} ; do
+         _LIST="$_LIST $_device"
+      done
+      _LIST=`echo "${_LIST}" | sed -e 's/^[ \t]*//'`
+
+      echo "$check_script -l \"$_LIST\" $INITIAL_DEVICE_LIST &"  >> $log_file 2>&1
+      $check_script -l "$_LIST" $INITIAL_DEVICE_LIST &
+   fi
+fi
+
+echo "" >> $log_file
+echo "### -------------------------" >> $log_file
+
+exit 0
diff --git a/GA-Schloss/src/check_net b/GA-Schloss/src/check_net
new file mode 160000
index 0000000..156fe90
--- /dev/null
+++ b/GA-Schloss/src/check_net
@@ -0,0 +1 @@
+Subproject commit 156fe900aff5cb60714ae070ae01a30e04d84bd3
diff --git a/GA-Schloss/src/ipt-gateway b/GA-Schloss/src/ipt-gateway
new file mode 160000
index 0000000..2affc44
--- /dev/null
+++ b/GA-Schloss/src/ipt-gateway
@@ -0,0 +1 @@
+Subproject commit 2affc448c28ff8f96152e418f1e5b8829fb4f13d
diff --git a/GA-Schloss/src/mailsystem b/GA-Schloss/src/mailsystem
new file mode 160000
index 0000000..8b8dbd7
--- /dev/null
+++ b/GA-Schloss/src/mailsystem
@@ -0,0 +1 @@
+Subproject commit 8b8dbd75fc03541e9b1bc732b014e16947357d00
diff --git a/GA-Schloss/src/openvpn b/GA-Schloss/src/openvpn
new file mode 160000
index 0000000..8f2df22
--- /dev/null
+++ b/GA-Schloss/src/openvpn
@@ -0,0 +1 @@
+Subproject commit 8f2df2215b864c298df2dd1816e9538d16e0d2de
diff --git a/NONE-CKUBU/README.txt b/NONE-CKUBU/README.txt
index 2f1b32c..306652d 100644
--- a/NONE-CKUBU/README.txt
+++ b/NONE-CKUBU/README.txt
@@ -1,5 +1,8 @@
 
+-------
 Notice:
+-------
+
    You have to change some configuration files becaus the because
    the configuration of network interfaces must not be equal.
 
@@ -21,5 +24,5 @@ Notice:
       interfaces.NONE-CKUBU: see above
       default_isc-dhcp-server.NONE-CKUBU
       ipt-firewall.NONE-CKUBU: LAN device (mostly ) = eth1
-                                second LAN WLAN or what ever (if present) = eth0
+      second LAN WLAN or what ever (if present) = eth0
          
diff --git a/NONE-CKUBU/bin/manage-gw-config b/NONE-CKUBU/bin/manage-gw-config
index 820fdbf..7127fbc 160000
--- a/NONE-CKUBU/bin/manage-gw-config
+++ b/NONE-CKUBU/bin/manage-gw-config
@@ -1 +1 @@
-Subproject commit 820fdbff49e4b1aeaed45134812a2427ed856b98
+Subproject commit 7127fbca446673edb32b63936bb29804f2cc12d0
diff --git a/NONE-CKUBU/src/mailsystem b/NONE-CKUBU/src/mailsystem
index 03b820b..c648e9e 160000
--- a/NONE-CKUBU/src/mailsystem
+++ b/NONE-CKUBU/src/mailsystem
@@ -1 +1 @@
-Subproject commit 03b820b8b869d6be229340a99ed5994dcd0edec9
+Subproject commit c648e9e8493c6e494d6e6dd0c8706e2ec1a38232
diff --git a/WF/README.txt b/WF/README.txt
index 9dc510b..8d84d52 100644
--- a/WF/README.txt
+++ b/WF/README.txt
@@ -1,5 +1,8 @@
 
+-------
 Notice:
+-------
+
    You have to change some configuration files becaus the because
    the configuration of network interfaces must not be equal.
 
@@ -21,5 +24,5 @@ Notice:
       interfaces.WF: see above
       default_isc-dhcp-server.WF
       ipt-firewall.WF: LAN device (mostly ) = eth1
-                                second LAN WLAN or what ever (if present) = eth0
+      second LAN WLAN or what ever (if present) = eth0
          
diff --git a/WF/aiccu.WF b/WF/aiccu.WF
new file mode 100644
index 0000000..5482d8f
--- /dev/null
+++ b/WF/aiccu.WF
@@ -0,0 +1,11 @@
+# This is a configuration file for /etc/init.d/aiccu; it allows you to
+# perform common modifications to the behavior of the aiccu daemon
+# startup without editing the init script (and thus getting prompted
+# by dpkg on upgrades).  We all love dpkg prompts.
+
+# Arguments to pass to aiccu daemon.
+DAEMON_ARGS=""
+
+# Run aiccu at startup ?
+AICCU_ENABLED=Yes
+
diff --git a/WF/aiccu.conf.WF b/WF/aiccu.conf.WF
new file mode 100644
index 0000000..c1c27a7
--- /dev/null
+++ b/WF/aiccu.conf.WF
@@ -0,0 +1,79 @@
+# Under control from debconf, please use 'dpkg-reconfigure aiccu' to reconfigure
+# AICCU Configuration
+
+# Login information (defaults: none)
+username CKM11-SIXXS
+password zLkJIZF0
+
+# Protocol and server to use for setting up the tunnel (defaults: none)
+protocol tic
+server tic.sixxs.net
+
+# Interface names to use (default: aiccu)
+# ipv6_interface is the name of the interface that will be used as a tunnel interface.
+# On *BSD the ipv6_interface should be set to gifX (eg gif0) for proto-41 tunnels
+# or tunX (eg tun0) for AYIYA tunnels.
+ipv6_interface sixxs
+
+# The tunnel_id to use (default: none)
+# (only required when there are multiple tunnels in the list)
+tunnel_id T129038
+
+# Be verbose? (default: false)
+#verbose false
+
+# Daemonize? (default: true)
+# Set to false if you want to see any output
+# When true output goes to syslog
+#
+# WARNING: never run AICCU from DaemonTools or a similar automated
+# 'restart' tool/script. When AICCU does not start, it has a reason
+# not to start which it gives on either the stdout or in the (sys)log
+# file. The TIC server *will* automatically disable accounts which
+# are detected to run in this mode.
+#
+daemonize true
+
+# Automatic Login and Tunnel activation?
+automatic true
+
+# Require TLS?
+# When set to true, if TLS is not supported on the server
+# the TIC transaction will fail.
+# When set to false, it will try a starttls, when that is
+# not supported it will continue.
+# In any case if AICCU is build with TLS support it will
+# try to do a 'starttls' to the TIC server to see if that
+# is supported.
+requiretls false
+
+# PID File
+#pidfile /var/run/aiccu.pid
+
+# Add a default route (default: true)
+#defaultroute true
+
+# Script to run after setting up the interfaces (default: none)
+#setupscript /usr/local/etc/aiccu-subnets.sh
+
+# Make heartbeats (default true)
+# In general you don't want to turn this off
+# Of course only applies to AYIYA and heartbeat tunnels not to static ones
+#makebeats true
+
+# Don't configure anything (default: false)
+#noconfigure true
+
+# Behind NAT (default: false)
+# Notify the user that a NAT-kind network is detected
+#behindnat true
+
+# Local IPv4 Override (default: none)
+# Overrides the IPv4 parameter received from TIC
+# This allows one to configure a NAT into "DMZ" mode and then
+# forwarding the proto-41 packets to an internal host.
+# 
+# This is only needed for static proto-41 tunnels!
+# AYIYA and heartbeat tunnels don't require this.
+#local_ipv4_override
+
diff --git a/WF/bin/admin-stuff b/WF/bin/admin-stuff
index 6c91fc0..414ae04 160000
--- a/WF/bin/admin-stuff
+++ b/WF/bin/admin-stuff
@@ -1 +1 @@
-Subproject commit 6c91fc0987a1d4b55910523e167b3755ab1f6718
+Subproject commit 414ae04eada0ebc45643e82d8742de795e5c5a70
diff --git a/WF/bin/manage-gw-config b/WF/bin/manage-gw-config
index 820fdbf..e0e37c2 160000
--- a/WF/bin/manage-gw-config
+++ b/WF/bin/manage-gw-config
@@ -1 +1 @@
-Subproject commit 820fdbff49e4b1aeaed45134812a2427ed856b98
+Subproject commit e0e37c21b77b5876fb9b5b66204cfcb7eba3cffc
diff --git a/WF/bin/monitoring b/WF/bin/monitoring
index 0611d0a..9a02312 160000
--- a/WF/bin/monitoring
+++ b/WF/bin/monitoring
@@ -1 +1 @@
-Subproject commit 0611d0a2ad1eefa0a9a094887a76bc5bc8532653
+Subproject commit 9a02312bda7beec1b6d6f63d197f2dfd39254680
diff --git a/WF/cron_root.WF b/WF/cron_root.WF
index c6433fa..98ef451 100644
--- a/WF/cron_root.WF
+++ b/WF/cron_root.WF
@@ -22,11 +22,10 @@
 # 
 # For more information see the manual pages of crontab(5) and cron(8)
 # 
+# m h  dom mon dow   command
 PATH=/root/bin/admin-stuff:/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 
-# m h  dom mon dow   command
-
 # check forwarding ( /proc/sys/net/ipv4/ip_forward contains "1" )
 # if not set this entry to "1"
 #
diff --git a/WF/ddclient.conf.WF b/WF/ddclient.conf.WF
new file mode 100644
index 0000000..8a35e9b
--- /dev/null
+++ b/WF/ddclient.conf.WF
@@ -0,0 +1,11 @@
+# Configuration file for ddclient generated by debconf
+#
+# /etc/ddclient.conf
+
+protocol=dyndns2
+use=if, if=ppp0
+server=members.dyndns.org
+login=ckubu
+password='ckubu100'
+mail=argus@oopen.de
+ckubu.homelinux.org
diff --git a/WF/default_isc-dhcp-server.WF b/WF/default_isc-dhcp-server.WF
index face457..1ddea4b 100644
--- a/WF/default_isc-dhcp-server.WF
+++ b/WF/default_isc-dhcp-server.WF
@@ -1,14 +1,21 @@
-# Defaults for dhcp initscript
-# sourced by /etc/init.d/dhcp
+# Defaults for isc-dhcp-server initscript
+# sourced by /etc/init.d/isc-dhcp-server
 # installed at /etc/default/isc-dhcp-server by the maintainer scripts
 
 #
 # This is a POSIX shell fragment
 #
 
+# Path to dhcpd's config file (default: /etc/dhcp/dhcpd.conf).
+#DHCPD_CONF=/etc/dhcp/dhcpd.conf
+
+# Path to dhcpd's PID file (default: /var/run/dhcpd.pid).
+#DHCPD_PID=/var/run/dhcpd.pid
+
+# Additional options to start dhcpd with.
+#	Don't use options -cf or -pf here; use DHCPD_CONF/ DHCPD_PID instead
+#OPTIONS=""
+
 # On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
 #	Separate multiple interfaces with spaces, e.g. "eth0 eth1".
-#INTERFACES=""
-INTERFACESv4="eth1 eth2"
-INTERFACESv6=""
-
+INTERFACESv4="eth1 eth0"
diff --git a/WF/generic.WF b/WF/generic.WF
new file mode 100644
index 0000000..c53773a
--- /dev/null
+++ b/WF/generic.WF
@@ -0,0 +1,3 @@
+root@gw-replacement.local.netz      root_gw-replacement@oopen.de
+cron@gw-replacement.local.netz      cron_gw-replacement@oopen.de
+@gw-replacement.local.netz          other_gw-replacement@oopen.de
diff --git a/WF/generic.db.WF b/WF/generic.db.WF
new file mode 100644
index 0000000..6198ad3
Binary files /dev/null and b/WF/generic.db.WF differ
diff --git a/WF/hostapd.conf.WF b/WF/hostapd.conf.WF
new file mode 100644
index 0000000..1f008d9
--- /dev/null
+++ b/WF/hostapd.conf.WF
@@ -0,0 +1,138 @@
+# if you want to bridge the onboard eth0 and the 
+# wireless (USB) adapter's wlan0, this should work
+interface=wlan0
+bridge=br0
+
+# this is the driver that must be used for ath9k 
+# and other similar chipset devices
+driver=nl80211
+
+# Operation mode (a = IEEE 802.11a, b = IEEE 802.11b, g = IEEE 802.11g,
+# Default: IEEE 802.11b
+# !! Note:
+#    the n-speeds get layered on top of 802.11g, so
+#    use hw_mode=g also for 802.11n
+hw_mode=g
+#hw_mode=a
+
+# ieee80211n: Whether IEEE 802.11n (HT) is enabled
+# 0 = disabled (default)
+# 1 = enabled
+# !! Note: 
+#    You will also need to enable WMM for full HT functionality.
+ieee80211n=1
+wmm_enabled=1
+
+# Channel number (IEEE 802.11)
+# (default: 0, i.e., not set)
+# Please note that some drivers do not use this value from hostapd and the
+# channel will need to be configured separately with iwconfig.
+## - 2.4 Ghz : hw_mode=g (ht_capab=[HT40+].. channel 1-9) 
+## -                     (ht_capab=[HT40-].. channel 5-11(13) )
+## -   5 Ghz : hw_mode=a (ht_capab=[HT40+].. channel 36,44 ) 
+## -                     (ht_capab=[HT40-].. channel 40)
+channel=7
+#channel=44
+
+# these have to be set in agreement w/ channel and 
+# some other values... read hostapd.conf docs
+#
+## - D-LINK DWA-552 (2.4 Ghz)
+## - MicroTIK RouterBOARD R52n-M (Dualband: 2.4 / 5 Ghz)
+## - MicroTIK RouterBOARD R52Hn (Dualband: 2.4 / 5 Ghz)
+## -
+ht_capab=[HT40-][SHORT-GI-40][TX-STBC][RX-STBC1][DSSS_CCK-40]
+## -
+## - SR71-E Hi-Power (802.11a/b/g/n miniPCI-E Module)
+## -
+## -    5 Ghz -->channel 36
+## -
+#ht_capab=[HT40+][SHORT-GI-40][TX-STBC][RX-STBC1][DSSS_CCK-40]
+#ht_capab=[SHORT-GI-40][TX-STBC][RX-STBC1][DSSS_CCK-40]
+## -
+## - D-LINK DWA-556 (PCIe) (2,4 / 5  Ghz)
+## -
+#ht_capab=[HT40+][SHORT-GI-40][DSSS_CCK-40]
+## -
+## - Linksys WMP600N (Dualband: 2.4 / 5 Ghz)
+## -
+#ht_capab=[HT40+][SHORT-GI-20][SHORT-GI-40][TX-STBC][RX-STBC12]
+
+
+#   adjust to fit your location
+country_code=DE
+
+
+# SSID to be used in IEEE 802.11 management frames
+ssid=WLAN-OOPEN
+
+# makes the SSID visible and broadcasted
+ignore_broadcast_ssid=0
+
+# IEEE 802.11 specifies two authentication algorithms. hostapd can be
+# configured to allow both of these or only one. Open system authentication
+# should be used with IEEE 802.1X.
+# Bit fields of allowed authentication algorithms:
+# bit 0 = Open System Authentication
+# bit 1 = Shared Key Authentication (requires WEP)
+#auth_algs=3
+auth_algs=1
+
+# bit0 = WPA
+# bit1 = IEEE 802.11i/RSN (WPA2) (dot11RSNAEnabled)
+wpa=3
+
+# Set of accepted key management algorithms (WPA-PSK, WPA-EAP, or both). The
+# entries are separated with a space. WPA-PSK-SHA256 and WPA-EAP-SHA256 can be
+# added to enable SHA256-based stronger algorithms.
+# (dot11RSNAConfigAuthenticationSuitesTable)
+wpa_key_mgmt=WPA-PSK
+
+# WPA pre-shared keys for WPA-PSK.
+wpa_passphrase=WoAuchImmer
+
+# Set of accepted cipher suites (encryption algorithms) for pairwise keys
+# (unicast packets). This is a space separated list of algorithms:
+# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
+# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
+# Group cipher suite (encryption algorithm for broadcast and multicast frames)
+# is automatically selected based on this configuration. If only CCMP is
+# allowed as the pairwise cipher, group cipher will also be CCMP. Otherwise,
+# TKIP will be used as the group cipher.
+# (dot11RSNAConfigPairwiseCiphersTable)
+# Pairwise cipher for WPA (v1) (default: TKIP)
+wpa_pairwise=TKIP CCMP
+
+# Pairwise cipher for RSN/WPA2 (default: use wpa_pairwise value)
+rsn_pairwise=CCMP
+
+# Time interval for rekeying GTK (broadcast/multicast encryption keys) in
+# seconds. (dot11RSNAConfigGroupRekeyTime)
+wpa_group_rekey=600
+
+# Station MAC address -based authentication
+# Please note that this kind of access control requires a driver that uses
+# hostapd to take care of management frame processing and as such, this can be
+# used with driver=hostap or driver=nl80211, but not with driver=madwifi.
+# 0 = accept unless in deny list
+# 1 = deny unless in accept list
+# 2 = use external RADIUS server (accept/deny lists are searched first)
+macaddr_acl=0
+
+# Interface for separate control program. If this is specified, hostapd
+# will create this directory and a UNIX domain socket for listening to requests
+# from external programs (CLI/GUI, etc.) for status information and
+# configuration. The socket file will be named based on the interface name, so
+# multiple hostapd processes/interfaces can be run at the same time if more
+# than one interface is used.
+# /var/run/hostapd is the recommended directory for sockets and by default,
+# hostapd_cli will use it when trying to connect with hostapd.
+ctrl_interface=/var/run/hostapd
+
+
+#  debugging output - uncomment them to activate; issue  hostapd -d /etc/hostapd/hostapd.conf
+#  to get debugging info in visible/real-time form
+#logger_syslog=-1
+#logger_syslog_level=2
+#logger_stdout=-1
+#logger_stdout_level=2
diff --git a/WF/igmpproxy.conf.WF b/WF/igmpproxy.conf.WF
new file mode 100644
index 0000000..9f6e290
--- /dev/null
+++ b/WF/igmpproxy.conf.WF
@@ -0,0 +1,75 @@
+########################################################
+#
+#   Example configuration file for the IgmpProxy
+#   --------------------------------------------
+#
+#   The configuration file must define one upstream
+#   interface, and one or more downstream interfaces.
+#
+#   If multicast traffic originates outside the
+#   upstream subnet, the "altnet" option can be
+#   used in order to define legal multicast sources.
+#   (Se example...)
+#
+#   The "quickleave" should be used to avoid saturation
+#   of the upstream link. The option should only
+#   be used if it's absolutely nessecary to
+#   accurately imitate just one Client.
+#
+########################################################
+
+##------------------------------------------------------
+## Enable Quickleave mode (Sends Leave instantly)
+##------------------------------------------------------
+quickleave
+
+
+##------------------------------------------------------
+## Configuration for eth0 (Upstream Interface)
+##------------------------------------------------------
+#phyint eth0 upstream  ratelimit 0  threshold 1
+#        altnet 10.0.0.0/8 
+#        altnet 192.168.0.0/24
+##------------------------------------------------------
+## Configuration for ppp0 (Upstream Interface)
+##------------------------------------------------------
+#phyint ppp0 upstream  ratelimit 0  threshold 1
+phyint eth2.8 upstream  ratelimit 0  threshold 1
+        altnet 217.0.119.194/24
+        altnet 193.158.35.0/24;
+        altnet 239.35.100.6/24;
+        altnet 93.230.64.0/19;
+        altnet 192.168.63.0/24;
+        #
+        #altnet 192.168.63.5/32;
+        #altnet 192.168.63.40/32;
+
+
+##------------------------------------------------------
+## Configuration for eth1 (Downstream Interface)
+##------------------------------------------------------
+#phyint br0 downstream  ratelimit 0  threshold 1
+phyint eth1 downstream  ratelimit 0  threshold 1
+        # IP der TV-Box
+        altnet 192.168.63.0/24;
+        #altnet 192.168.63.5/32;
+        #altnet 192.168.63.40/32;
+
+
+##------------------------------------------------------
+## Configuration for eth2 (Disabled Interface)
+##------------------------------------------------------
+#phyint eth2 disabled
+##------------------------------------------------------
+## Configuration for eth2 (Disabled Interface)
+##------------------------------------------------------
+phyint eth0 disabled
+phyint eth2 disabled
+phyint eth2.7 disabled
+phyint eth1:0 disabled
+phyint eth1:wf disabled
+phyint ppp0 disabled
+phyint tun0 disabled
+phyint lo disabled
+
+
diff --git a/WF/interfaces.WF b/WF/interfaces.WF
index 22c5715..2d3ecd3 100644
--- a/WF/interfaces.WF
+++ b/WF/interfaces.WF
@@ -7,22 +7,22 @@ iface lo inet loopback
 
 
 #-----------------------------
-# eth0 - WAN
+# eth2 - WAN
 #-----------------------------
 
-auto eth0
-iface eth0 inet static
+auto eth2
+iface eth2 inet static
    address 192.168.16.254
    network 192.168.16.0
    netmask 255.255.255.0
    broadcast 192.168.16.255
    # VDSL needs vlan
-   post-up vconfig add eth0 7
-   post-down vconfig rem eth0.7
+   post-up vconfig add eth2 7
+   post-down vconfig rem eth2.7
 
 auto dsl-provider
 iface dsl-provider inet ppp
-   pre-up /sbin/ifconfig eth0.7 up # line maintained by pppoeconf
+   pre-up /sbin/ifconfig eth2.7 up # line maintained by pppoeconf
    provider dsl-provider
 
 
@@ -54,13 +54,21 @@ iface eth1:1 inet static
 
 
 #-----------------------------
-# eth2 - WLAN
+# eth0 - WLAN
 #-----------------------------
 
-auto eth2
-iface eth2 inet static
+auto eth0
+iface eth0 inet static
    address 192.168.42.254
    network 192.168.42.0
    netmask 255.255.255.0
    broadcast 192.168.42.255
 
+
+
+auto eth1:rescue
+iface eth1:rescue inet static
+   address 172.16.1.1
+   network 172.16.1.0
+   netmask 255.255.255.0
+   broadcast 172.16.1.255
diff --git a/WF/ipt-firewall.WF b/WF/ipt-firewall.WF
new file mode 100755
index 0000000..ab9a3e3
--- /dev/null
+++ b/WF/ipt-firewall.WF
@@ -0,0 +1,1020 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:          ipt-firewall
+# Required-Start:    $local_fs $remote_fs $syslog $network
+# Required-Stop:     $local_fs $remote_fs $syslog $network
+# Should-Start:
+# Should-Stop:
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: IPv4 Firewall
+### END INIT INFO
+
+ipt="/sbin/iptables"
+
+
+## - local interfaces
+## -
+local_if_1="eth1+"
+wlan_if="eth2+"
+
+vdsl_if="eth0"
+vdsl_modem_ip="192.168.16.250"
+
+## - extern interfaces
+ext_if="ppp+"
+#ext_if="eth0"
+vpn_if="tun+"
+
+
+## - besondere ip's
+drucker_brother_5890_ip="192.168.52.179"
+
+## - usv
+usv_ip=192.168.52.15/32
+
+# unpriviligierte Ports
+unprivports="1024:65535"
+
+loopback="127.0.0.0/8"
+priv_class_a="10.0.0.0/8"
+priv_class_b="172.16.0.0/12"
+priv_class_c="192.168.0.0/16"
+
+#Load module for FTP Connection tracking and NAT
+modprobe ip_conntrack > /dev/null 2>&1
+modprobe ip_nat_ftp > /dev/null 2>&1
+modprobe ip_conntrack_ftp > /dev/null 2>&1
+modprobe iptable_nat > /dev/null 2>&1
+
+## - IP Forwarding aktivieren
+## -
+echo 1 > /proc/sys/net/ipv4/ip_forward
+echo 5 > /proc/sys/net/ipv4/ip_dynaddr
+
+## - Reduce DoS'ing ability by reducing timeouts
+## -
+echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
+echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time
+echo 1 > /proc/sys/net/ipv4/tcp_window_scaling
+echo 0 > /proc/sys/net/ipv4/tcp_sack
+echo 1280 > /proc/sys/net/ipv4/tcp_max_syn_backlog
+
+## - SYN COOKIES
+## -
+echo 1 > /proc/sys/net/ipv4/tcp_syncookies
+
+## - Schutz gegen gefälschte Fehlermeldungen einschalten.
+## -
+echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
+
+## - Ignorieren von broadcast Pings
+## -
+echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
+
+## - NO SOURCE ROUTE
+## -
+## - Sperren von quellbasierendem Paket-Routing
+## -
+for asr in /proc/sys/net/ipv4/conf/*/accept_source_route; do
+   echo 0 > $asr
+done
+
+## - Keine ICMP Umleitungspakete akzeptieren.
+## -
+## - Diese können zur Veränderung der Routing Tables verwendet 
+## - werden, möglicherweise mit einem böswilligen Ziel. 
+## - 
+echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
+
+
+## - ANTISPOOFING
+## -
+## - Reverse Pfadfilterung aktivieren. Dies hilft durch automatisches Ablehnen 
+## - von Quelladressen, die nicht mit dem Netzwerkinterface übereinstimmen, 
+## - sicherzustellen, dass Pakete legitime Quelladressen benutzen. Dies hat
+## - Sicherheitsvorteile, da es IP Spoofing verhindert. Wir müssen es für 
+## - alle net/ipv4/conf/* aktivieren, da sonst die Validierung der Quelle 
+## - nicht voll funktionsfähig ist. 
+## -
+for rp_filter in /proc/sys/net/ipv4/conf/*/rp_filter; do
+   echo 1 > $rp_filter
+done
+
+
+## - NUMBER OF CONNECTIONS TO TRACK
+## -
+echo "65535" > /proc/sys/net/ipv4/netfilter/ip_conntrack_max
+
+
+## - Protokollieren von Paketen die gespoofed sind, quellbasierendes 
+## - Routing verwenden oder Umleitungen sind.
+## -
+#echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
+
+
+while read p; do
+   case $p in
+   -*) $ipt $p;;
+   esac
+done << EOR
+## - default policies
+## -
+-P INPUT ACCEPT
+-P OUTPUT ACCEPT
+#-P FORWARD DROP
+-P FORWARD ACCEPT
+
+## - flush chains
+## -
+-F
+-F INPUT
+-F OUTPUT
+-F FORWARD
+-F -t mangle
+-F -t nat
+-X
+-Z
+
+-t nat -A POSTROUTING -o $ext_if -j MASQUERADE
+#-t nat -A POSTROUTING -o eth0 -j MASQUERADE
+#-t nat -A POSTROUTING -o $wlan_if -j MASQUERADE
+-I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+
+EOR
+
+## - owncloud lokales Netz
+## -
+$ipt -A FORWARD -i $wlan_if -p all -d 192.168.43.10 -j ACCEPT
+$ipt -A FORWARD -i $local_if_1 -p all -d 192.168.43.10 -j ACCEPT
+$ipt -t nat -A PREROUTING -p tcp --syn \
+   --dport 8443 -j DNAT --to 192.168.43.10:443 
+$ipt -t filter -A FORWARD -p tcp --dport 443 -d 192.168.43.10 \
+   -o $local_if_1 -j ACCEPT
+## -
+## - Ende: owncloud lokales Netz
+
+
+
+## - Protection against syn-flooding
+## -
+## - chains to DROP too many SYNs
+## -
+#$ipt -N syn-flood
+#$ipt -A syn-flood -m limit --limit 100/second --limit-burst 150 -j RETURN
+#$ipt -A syn-flood -m limit --limit 1/second --limit-burst 3 -j RETURN
+#$ipt -A syn-flood -j LOG --log-prefix "SYN flood: " --log-level debug
+#$ipt -A syn-flood -j DROP
+
+
+## - drop new packages without syn flag
+## -
+## - first log
+## -
+#$ipt -A INPUT -p tcp ! --syn -m state --state NEW -j  LOG --log-prefix "New but not SYN: " --log-level debug
+#$ipt -A OUTPUT -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New but not SYN: " --log-level debug
+#$ipt -A FORWARD -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New but not SYN: " --log-level debug
+
+$ipt -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
+$ipt -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP
+$ipt -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
+
+
+## - drop invalid packages
+## -
+#$ipt -A INPUT -m state --state INVALID -j LOG --log-prefix "Invalid state: " --log-level debug
+#$ipt -A INPUT -m state --state INVALID -j DROP
+
+
+## - ungewöhnliche Flags verwerfen
+## -
+#$ipt -A INPUT -i eth0 -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j LOG --log-prefix "Invalid flasg: " --log-level debug
+#$ipt -A INPUT -i eth0 -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG --log-prefix "Invalid flasg: " --log-level debug
+#$ipt -A INPUT -i eth0 -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "Invalid flasg: " --log-level debug
+
+$ipt -A INPUT -i eth0 -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
+$ipt -A INPUT -i eth0 -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
+$ipt -A INPUT -i eth0 -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
+
+
+## - private Adressen auf externen interface verwerfen
+## -
+#$ipt -A INPUT -i $ext_if -s $priv_class_a -j LOG --log-prefix "Private address: " --log-level debug
+#$ipt -A INPUT -i $ext_if -s $priv_class_b -j LOG --log-prefix "Private address: " --log-level debug
+#$ipt -A INPUT -i $ext_if -s $priv_class_c -j LOG --log-prefix "Private address: " --log-level debug
+#$ipt -A INPUT -i $ext_if -s $loopback -j LOG --log-prefix "Private address: " --log-level debug
+
+#$ipt -A OUTPUT -o $ext_if -s $priv_class_a -j LOG --log-prefix "Private address: " --log-level debug
+#$ipt -A OUTPUT -o $ext_if -s $priv_class_b -j LOG --log-prefix "Private address: " --log-level debug
+#$ipt -A OUTPUT -o $ext_if -s $priv_class_c -j LOG --log-prefix "Private address: " --log-level debug
+#$ipt -A OUTPUT -o $ext_if -s $loopback -j LOG --log-prefix "Private address: " --log-level debug
+
+$ipt -A INPUT -i $ext_if -s $priv_class_a -j DROP
+$ipt -A INPUT -i $ext_if -s $priv_class_b -j DROP
+#$ipt -A INPUT -i $ext_if -s $priv_class_c -j DROP
+#$ipt -A INPUT -i $ext_if -s $loopback -j DROP
+
+$ipt -A OUTPUT -o $ext_if -s $priv_class_a -j DROP
+$ipt -A OUTPUT -o $ext_if -s $priv_class_b -j DROP
+#$ipt -A OUTPUT -o $ext_if -s $priv_class_c -j DROP
+$ipt -A OUTPUT -o $ext_if -s $loopback -j DROP
+
+
+# - Telekom VDSL - Rules for IPTV 
+# -
+#$ipt -I FORWARD -s 217.0.119.0/24 -d 224.0.0.0/4 -j ACCEPT
+#$ipt -I FORWARD -s 193.158.35.0/24 -d 224.0.0.0/4 -j ACCEPT
+#$ipt -I FORWARD -s 239.35.0.0/16 -d 224.0.0.0/4 -j ACCEPT
+#$ipt -I INPUT -d 224.0.0.0/4 -j ACCEPT
+#$ipt -I FORWARD -d 224.0.0.0/4 -j ACCEPT
+
+#$ipt -I OUTPUT -d 224.0.0.0/4 -j ACCEPT
+
+
+
+
+## - if called stop, then exit here
+## -
+case $1 in
+   sto*) exit 0;;
+esac
+
+echo "Starting firewall iptables (IpV4).."
+
+while read r; do
+   case $r in
+      -*) $ipt $r;;
+   esac
+done << EOR
+
+# ----------  Allnet VDSL2 Client Modem ALL126AS2 -------------
+#
+#  make Allnet VDSL Modem available on LAN
+#     ip-adress: 192.168.16.250
+#
+#  prerequisites:
+#     -  on gateway: ifconfig eth1 192.168.16.254
+#     -  NAT for 192.168.16.0/24
+#
+-t nat -A POSTROUTING -o $vdsl_if -j MASQUERADE
+#
+# -- Allow from local Network
+-A FORWARD -i $local_if_1 -d $vdsl_modem_ip -p ALL -m state --state NEW -j ACCEPT
+#
+# -- Allow from VPN
+-A FORWARD -i $vpn_if -d $vdsl_modem_ip -p ALL -m state --state NEW -j ACCEPT
+#
+# -------  Ende: Allnet VDSL2 Client Modem ALL126AS2 ----------
+
+
+# ---------- 
+#  --- SSH (SVN) von php5.warenform.de -- #
+#-A FORWARD -i eth1 -o eth2 -s 46.4.129.3 -d 192.168.52.35 -j ACCEPT
+#-A FORWARD -i eth2 -o eth1 -s 192.168.52.35 -j ACCEPT
+
+
+#  --- SSH (SVN) vom "junge welt" Server --- #
+#-A FORWARD -i eth1 -o eth2 -s 193.96.188.0/24 -d 192.168.52.35 -j ACCEPT
+#-A FORWARD -i eth2 -o eth1 -s 192.168.52.35 -j ACCEPT
+
+
+# --- SSH (SVN) von nd.warenform.de --- #
+#-A FORWARD -i eth1 -o eth2 -s 46.4.78.56 -d 192.168.52.35 -j ACCEPT
+#-A FORWARD -i eth2 -o eth1 -s 192.168.52.35 -j ACCEPT
+
+
+# ------------- das loopbackdevice -------------
+# alles erlaubt
+#
+-A INPUT -i lo -j ACCEPT
+-A OUTPUT -o lo -j ACCEPT
+#
+# ---------- Ende: das loopbackdevice ----------
+
+
+
+# ---------- alle Anfragen aus dem internen WLAN-Netz nach draussen -------------
+#
+-A FORWARD -i $wlan_if -o $ext_if -p ALL -m state --state NEW -j ACCEPT
+-A FORWARD -i $local_if_1 -o $ext_if -p all -m state --state NEW -j ACCEPT
+#
+# ---------- Ende: alle Anfragen aus den internen Netzen nach draussen ----------
+
+
+
+# ------------- Drucker Brother 5890 -------------
+#
+#
+# ------------- Ende: Drucker Brother 5890 -------------
+
+
+# ------------- zwischen lokalen Netzen -------------
+#
+# Zugriff vom localen Netz ins WLAN-Netz erlauben
+-A FORWARD -i $local_if_1 -o $wlan_if -p ALL -m state --state NEW -j ACCEPT
+#
+#
+# Zugriff vom WLAN-Netz auf Drucker erlauben
+-A FORWARD -i $wlan_if -o $local_if_1 -d $drucker_brother_5890_ip -j ACCEPT
+#
+# Zugriff vom WLAN-Netz ins locale Netz verbieten
+-A FORWARD -i $wlan_if -o $local_if_1 -p ALL -m state --state NEW -j DROP
+#
+# - needed because sometimes i add temporarily other networks to tha interface
+#
+-A FORWARD -i $local_if_1 -o $local_if_1 -p ALL -m state --state NEW -j ACCEPT
+#
+# vollen Zugriff vom router ins  WLAN-Netz
+-A OUTPUT -o $wlan_if -j ACCEPT
+#
+# ---------- Ende: zwischen lokalen Netzen ----------
+
+
+# ------------- betsehende Verbindungen -------------
+# bereits bestehende Verbindungen durchlassen
+#
+# -- rein --
+#
+-A INPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
+#
+# -- raus --
+#
+-A OUTPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
+#
+# foreward
+#
+-A FORWARD -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
+#
+# ---------- Ende betsehende Verbindungen -----------
+
+
+
+# ------------- grundsaetzlich ablehnen -------------
+# neue Anfragen ohne das syn-Flag
+#
+-A INPUT -p tcp ! --syn -m state --state NEW -j DROP
+-A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP
+-A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
+#
+# reinlaufenden windows kram
+#
+-A INPUT -p udp -i $ext_if --dport 137:139 -j DROP
+-A INPUT -p tcp -i $ext_if --dport 137:139 -j DROP
+-A INPUT -p tcp -i $ext_if --dport 445 -j DROP
+#
+-A INPUT -p udp -i $local_if_1 --dport 137:139 -j DROP
+-A INPUT -p tcp -i $local_if_1 --dport 137:139 -j DROP
+-A INPUT -p tcp -i $local_if_1 --dport 445 -j DROP
+#
+-A INPUT -p udp -i $wlan_if --dport 137:139 -j DROP
+-A INPUT -p tcp -i $wlan_if --dport 137:139 -j DROP
+-A INPUT -p tcp -i $wlan_if --dport 445 -j DROP
+#
+# authentication tap ident
+#
+-A INPUT -p tcp -i $ext_if --dport 113 -j REJECT --reject-with tcp-reset
+#
+#
+# Location Service
+#
+-A INPUT -p tcp -i $ext_if --dport 135 -j DROP
+-A INPUT -p udp -i $ext_if --dport 135 -j DROP
+#
+# ---------- Ende: grundsaetzlich ablehnen -------------
+
+
+
+#############################################################
+# ----------------- Konfiguration  VPN   ------------------ #
+
+# -- initial via internet
+#
+-A INPUT -p udp  -i $ext_if --dport 1194 -m state --state NEW -j ACCEPT
+-A INPUT -p udp  -i $ext_if --dport 1195 -m state --state NEW -j ACCEPT
+#
+# -- initial via lan1
+-A INPUT -p udp  -i $local_if_1 --dport 1194 -m state --state NEW -j ACCEPT
+#
+# -- initial via lan2
+-A INPUT -p udp  -i $wlan_if --dport 1194 -m state --state NEW -j ACCEPT
+#
+# ausgehende Anfragen
+#
+-A OUTPUT -o $ext_if -p udp --dport 1194 -m state --state NEW -j ACCEPT
+#
+# forward
+#
+-A FORWARD -o $ext_if -p udp --dport 1194 -m state --state NEW -j ACCEPT
+#
+# -- alles via vpn device zulassen/durchrouten
+#
+-A INPUT -i $vpn_if -j ACCEPT
+-A OUTPUT -o $vpn_if -j ACCEPT
+-A FORWARD -i $vpn_if -j ACCEPT
+-A FORWARD -o $vpn_if -j ACCEPT
+
+# ------------ Ende Konfiguration  VPN -------------------- #
+#############################################################
+
+
+# ------------- PowerChute Shutdown APC -------------
+#
+-A INPUT -p ALL -i $local_if_1 -s 192.168.52.15 -j ACCEPT
+-A OUTPUT -p ALL -o $local_if_1 -d 192.168.52.15 -j ACCEPT
+#
+#-A INPUT -i $local_if_1 -p tcp --dport 3052 -m state --state NEW -j ACCEPT
+#-A INPUT -i $local_if_1 -p udp --dport 3052 -m state --state NEW -j ACCEPT
+#-A INPUT -i $local_if_1 -p tcp --dport 6547 -m state --state NEW -j ACCEPT
+#
+-A OUTPUT -o $local_if_1 -p tcp --dport 80 -m state --state NEW -j ACCEPT
+#
+#
+# ---------- Ende PowerChute Shutdown APC -----------
+
+
+# ------------- DNS  -------------
+#
+# nameserver
+#
+# -- rein --
+#
+-A INPUT -i $local_if_1 -p udp --dport 53 -m state --state NEW -j ACCEPT
+-A INPUT -i $local_if_1 -p tcp --dport 53 -m state --state NEW -j ACCEPT
+-A INPUT -i $wlan_if -p udp --dport 53 -m state --state NEW -j ACCEPT
+-A INPUT -i $wlan_if -p tcp --dport 53 -m state --state NEW -j ACCEPT
+#
+# -- raus --
+#
+-A OUTPUT -o $ext_if -p udp --dport 53 -m state --state NEW -j ACCEPT
+-A OUTPUT -o $ext_if -p tcp --dport 53 -m state --state NEW -j ACCEPT
+#
+# -- forward --
+#
+-A FORWARD -o $ext_if -p udp --dport 53 -m state --state NEW -j ACCEPT
+-A FORWARD -o $ext_if -p tcp --dport 53 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende DNS  -----------
+
+
+# ------------- SSH -------------
+# reingehende Anfragen
+#
+-A INPUT -i $ext_if -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
+-A INPUT -i $local_if_1 -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
+-A INPUT -i $wlan_if -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
+#
+# ausgehende Anfragen
+#
+-A OUTPUT -o $ext_if -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
+-A OUTPUT -o $local_if_1 -p tcp --dport 22 -m state --state NEW -j ACCEPT
+-A OUTPUT -o $wlan_if -p tcp --dport 22 -m state --state NEW -j ACCEPT
+#
+-A FORWARD -o $ext_if -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
+-A FORWARD -o $local_if_1 -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
+-A FORWARD -o $wlan_if -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende SSH ------------
+
+
+# ------------- DHCP -------------
+# reingehende Anfragen
+#
+-A INPUT -p udp  -i $local_if_1 -s 0/0 --sport 68 -d 255.255.255.255 --dport 67 -j ACCEPT
+-A INPUT -p udp  -i $wlan_if -s 0/0 --sport 68 -d 255.255.255.255 --dport 67 -j ACCEPT
+#
+# ausgehende Anfragen
+#
+-A OUTPUT -p udp  -o $local_if_1 --sport 67 -d 0/0 --dport 68 -j ACCEPT
+-A OUTPUT -p udp  -o $wlan_if --sport 67 -d 0/0 --dport 68 -j ACCEPT
+#
+# ---------- Ende DHCP ------------
+   
+
+# ------------- MAIL  -------------
+# rausgehende SMTP-Verbindungen akzeptieren
+#
+-A OUTPUT -p tcp -o $ext_if --dport 25 -m state --state NEW -j ACCEPT
+#
+# ansonsten nur forward
+#
+# smtp
+-A FORWARD -p tcp --syn -o $ext_if --dport 25 -m state --state NEW -j ACCEPT
+-A FORWARD -p tcp --syn -o $ext_if --dport 587 -m state --state NEW -j ACCEPT
+#
+# smtps
+-A FORWARD -p tcp --syn -o $ext_if --dport 465 -m state --state NEW -j ACCEPT
+#
+# pop
+-A FORWARD -p tcp --syn -o $ext_if --dport 110 -m state --state NEW -j ACCEPT
+#
+# pop/ssl
+-A FORWARD -p tcp --syn -o $ext_if --dport 995 -m state --state NEW -j ACCEPT
+#
+# imap
+-A FORWARD -p tcp --syn -o $ext_if --dport 143 -m state --state NEW -j ACCEPT
+#
+# imap/ssl
+-A FORWARD -p tcp --syn -o $ext_if --dport 993 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende MAIL  -----------
+
+
+# ------------- HTTP  -------------
+# rausgehende Verbindungen vom Gateway akzeptieren 
+# ( update clamav/freshclam, dyndns )
+#
+-A OUTPUT -p tcp --syn -o $ext_if --dport 80 -m state --state NEW -j ACCEPT
+#
+# ansonsten nur forward
+#
+-A FORWARD -p tcp --syn -o $ext_if --dport 80 -m state --state NEW -j ACCEPT
+-A FORWARD -p tcp --syn -o $ext_if --dport 443 -m state --state NEW -j ACCEPT
+#
+-A FORWARD -p tcp --syn -o $ext_if --dport 8000:8180 -m state --state NEW -j ACCEPT
+-A FORWARD -p tcp --syn -o $ext_if --dport 8443 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende HTTP  -----------
+
+
+# ------------- FTP  -------------
+#
+# ftp ( lokaler Client remote ftp-Server )
+#
+# (Datenkanal aktiv)
+-A INPUT -i $ext_if -p tcp --sport 20 -m state --state NEW -j ACCEPT
+-A FORWARD -i $ext_if -p tcp --sport 20 -m state --state NEW -j ACCEPT
+#
+# (Datenkanal passiv)
+-A OUTPUT -o $ext_if -p tcp --sport $unprivports --dport $unprivports -m state --state NEW -j ACCEPT
+-A FORWARD -o $ext_if -p tcp --sport $unprivports --dport $unprivports -m state --state NEW -j ACCEPT
+#
+# (Kontrollverbindung)
+-A OUTPUT -o $ext_if -p tcp --dport 21 -m state --state NEW -j ACCEPT
+-A FORWARD -o $ext_if -p tcp --dport 21 -m state --state NEW -j ACCEPT
+#
+# ftp (Server)
+#
+# Datenkanal (aktiver modus)
+#-A OUTPUT -o $ext_if -p tcp --sport 20 -m state --state NEW -j ACCEPT
+#
+# Datenkanal (passiver modus)
+#-A INPUT -i $ext_if -p tcp --dport $unprivports --sport $unprivports -m state --state NEW -j ACCEPT
+#
+# - Kontrollverbindung
+#-A INPUT -i $ext_if -p tcp --dport 21 --sport $unprivports -m state --state NEW  -j ACCEPT
+#
+# ftp-tls ? ( keine Ahnung warum )
+#
+-A OUTPUT -p tcp --sport $unprivports  -o $ext_if -m state --state NEW -j ACCEPT
+-A FORWARD -p tcp --sport $unprivports -i $ext_if -o $ext_if  -m state --state NEW -j ACCEPT
+# 
+# ---------- Ende FTP  -----------
+
+
+
+# ------------- NTP  -------------
+# (network time protokoll)
+#
+# rein
+#
+-A INPUT -i $local_if_1 -p udp --sport 123 -m state --state NEW -j ACCEPT
+-A INPUT -i $wlan_if -p udp --sport 123 -m state --state NEW -j ACCEPT
+#
+# raus
+#
+-A OUTPUT -o $ext_if -p udp --dport 123 -m state --state NEW -j ACCEPT
+#
+# forward
+#
+-A FORWARD -o $ext_if -p udp --dport 123 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende NTP  -----------
+
+
+# ------------- pgpkeyserver -------------
+#
+#
+-A OUTPUT -p tcp -o $ext_if --dport 11371 -m state --state NEW -j ACCEPT
+-A FORWARD -p tcp -o $ext_if --dport 11371 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende pgpkeyserver ------------
+
+
+
+# ------------- ldap / (z.Bsp. einige pgpkeyserver) -------------
+#
+# Forward -- nur Anfragen nach draussen 
+#
+-A FORWARD -p tcp --syn -o $ext_if --dport 389 -m state --state NEW -j ACCEPT
+-A FORWARD -p udp  -o $ext_if --dport 389 -m state --state NEW -j ACCEPT
+-A OUTPUT -p tcp --syn -o $ext_if --dport 389 -m state --state NEW -j ACCEPT
+-A OUTPUT -p udp  -o $ext_if --dport 389 -m state --state NEW -j ACCEPT
+#
+# ldaps LDAP over SSL
+#
+-A FORWARD -p tcp --syn -o $ext_if --dport 636 -m state --state NEW -j ACCEPT
+-A FORWARD -p udp  -o $ext_if --dport 636 -m state --state NEW -j ACCEPT
+-A OUTPUT -p tcp --syn -o $ext_if --dport 636 -m state --state NEW -j ACCEPT
+-A OUTPUT -p udp  -o $ext_if --dport 636 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende ldap ------------
+
+
+
+# ------------- Newsserver nntp -------------
+#
+# Forward -- nur Anfragen nach draussen 
+#
+-A FORWARD -p tcp --syn -o $ext_if --dport 119 -m state --state NEW -j ACCEPT
+-A OUTPUT -p tcp --syn -o $ext_if --dport 119 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende Newsserver nntp ------------
+
+
+# ------------- Whois  -------------
+# nur ausgehende Anfragen und forward
+#
+#
+-A OUTPUT -o $ext_if -p tcp --dport 43 -m state --state NEW -j ACCEPT
+-A FORWARD -o $ext_if -p tcp --dport 43 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende Whois  -----------
+
+
+# ------------- CPAN Wait - Server -------------
+# nur ausgehende Anfragen und forward
+#
+#
+-A OUTPUT -o $ext_if -p tcp --dport 1404 -m state --state NEW -j ACCEPT
+-A FORWARD -o $ext_if -p tcp --dport 1404 -m state --state NEW -j ACCEPT
+#
+# ---------- CPAN Wait - Server  -----------
+
+
+# ------------- CVS  -------------
+# nur ausgehende Anfragen und forward
+#
+-A OUTPUT -o $ext_if -p udp --dport 2401 -m state --state NEW -j ACCEPT
+-A FORWARD -o $ext_if -p udp --dport 2401 -m state --state NEW -j ACCEPT
+-A FORWARD -i $ext_if -p udp --dport 2401 -m state --state NEW -j ACCEPT
+#
+# und weils auch manchmal übers tcp-Prozokoll geht
+#
+-A OUTPUT -o $ext_if -p tcp --dport 2401 -m state --state NEW -j ACCEPT
+-A FORWARD -o $ext_if -p tcp --dport 2401 -m state --state NEW -j ACCEPT
+-A FORWARD -i $ext_if -p tcp --dport 2401 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende CVS  -----------
+
+
+
+# ------------- ICP (icpcon raid-control util) -------------
+#
+# reingehende Anfragen
+#
+#-A INPUT -p tcp --syn -i $ext_if --dport 11798 -m state --state NEW -j ACCEPT
+#
+# rausgehende Anfragen
+#
+#-A OUTPUT -p tcp -o $ext_if --dport 11798 -m state --state NEW -j ACCEPT
+#-A FORWARD -p tcp -o $ext_if --dport 11798 -m state --state NEW -j ACCEPT
+#
+# ---------- ENDE: ICP (icpcon raid-control util) ----------
+
+
+
+
+# ------------- Chat -------------
+# --- silc ---
+#
+# Forward und  Anfragen nach draussen 
+#
+-A FORWARD -p tcp --syn -o $ext_if --dport 706 -m state --state NEW -j ACCEPT
+-A OUTPUT -p tcp --syn -o $ext_if --dport 706 -m state --state NEW -j ACCEPT
+#
+# --- irc ---
+#
+# forward und Anfragen nach draussen 
+#
+-A FORWARD -p tcp --syn -o $ext_if --dport 194 -m state --state NEW -j ACCEPT
+-A FORWARD -p udp -o $ext_if --dport 194 -m state --state NEW -j ACCEPT
+-A OUTPUT -p tcp --syn -o $ext_if --dport 194 -m state --state NEW -j ACCEPT
+-A OUTPUT -p udp -o $ext_if --dport 194 -m state --state NEW -j ACCEPT
+#
+# --- jabber ---
+#
+-A FORWARD -p tcp --syn -o $ext_if --dport 5222 -m state --state NEW -j ACCEPT
+-A FORWARD -p tcp --syn -o $ext_if --dport 5223 -m state --state NEW -j ACCEPT
+
+#
+# ---------- Ende chat ------------
+
+
+# ------------- HBCI -------------
+# hbci - port  3000/tcp 
+#
+-A FORWARD -o $ext_if -p tcp --syn --dport 3000 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende HBCI  -----------
+
+
+# ------------- Hylafax (Port 4559)  -------------
+# reingehende Verbindungen zum Hylafax-Server
+#
+-A INPUT -i $local_if_1 -p tcp --dport 4559 -m state --state NEW -j ACCEPT
+-A INPUT -i $wlan_if -p tcp --dport 4559 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende Hylafax  -----------
+
+
+# ------------- CUPS  -------------
+# (cupssys printer system)
+#
+-A FORWARD -i $local_if_1 -p tcp --dport 631 -m state --state NEW -j ACCEPT
+-A FORWARD -i $wlan_if -p tcp --dport 631 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende CUPS -----------
+
+
+# ------------- Drucken Port 9100  -------------
+#
+-A FORWARD -i $local_if_1 -p tcp --dport 9100 -m state --state NEW -j ACCEPT
+-A FORWARD -i $wlan_if -p tcp --dport 9100 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende Drucken Port 9100 -----------
+
+
+# ---------- SNMP ----------
+#
+#-A FORWARD -i $local_if_1 -p tcp --dport 161 -m state --state NEW -j ACCEPT
+#-A FORWARD -i $wlan_if -p tcp --dport 161 -m state --state NEW -j ACCEPT
+#
+# ---------- SNMP ----------
+
+
+# ------------- VOIP -------------
+#
+# SIP
+#
+# Standard:
+# Port: 5060 / UDP (SIP-Signalisierung)
+# Port: 5004 / UDP (RTP, Sprache)
+# Port: 10000 UDP (STUN)
+#
+# X-Lite:
+# Port 5060 / UDP
+# Port 8000 - 8019 / UDP
+# Port 10000 /UDP
+
+# reingehende Anfragen
+#
+-A INPUT -p tcp --syn -i $ext_if --dport 5060 -j ACCEPT
+-A INPUT -p udp  -i $ext_if --dport 5060 -j ACCEPT
+#
+# ausgehende Anfragen
+#
+-A OUTPUT -p tcp --syn -o $ext_if --dport 5060 -j ACCEPT
+-A OUTPUT -p udp -o $ext_if --dport 5060 -j ACCEPT
+#
+# Forward -- nur Anfragen nach draussen 
+#
+-A FORWARD -p tcp --syn -o $ext_if --dport 5060 -j ACCEPT
+-A FORWARD -p udp -o $ext_if --dport 5060 -j ACCEPT
+-A FORWARD -p udp -i $ext_if --dport 5060 -j ACCEPT
+-A FORWARD -p udp -o $ext_if --dport 5004 -j ACCEPT
+-A FORWARD -p udp -i $ext_if --dport 5004 -j ACCEPT
+-A FORWARD -p tcp --syn -o $ext_if --dport 10000 -j ACCEPT
+-A FORWARD -p udp -o $ext_if --dport 10000 -j ACCEPT
+-A FORWARD -p udp -i $ext_if --dport 10000 -j ACCEPT
+-A FORWARD -p udp -o $ext_if --sport 8000:8019 -j ACCEPT
+-A FORWARD -p udp -i $ext_if --sport 8000:8019 -j ACCEPT
+-A FORWARD -p udp -o $ext_if --sport 32700:32799 -j ACCEPT
+#
+# Skype
+#
+# reingehende Anfragen
+#
+# -A INPUT -p tcp --syn -i $ext_if --dport 54196 -j  ACCEPT
+# -A INPUT -p udp  -i $ext_if --dport 54196 -j ACCEPT
+#
+# ausgehende Anfragen
+#
+#
+# Forward -- Anfragen von draussen 
+#
+# -- Linux
+-A FORWARD -p tcp --syn -i $ext_if --dport 34957 -j ACCEPT
+-A FORWARD -p tcp --syn -o $ext_if --sport 34957 -j ACCEPT
+-A FORWARD -p udp -i $ext_if --dport 34957 -j ACCEPT
+-A FORWARD -p udp  -o $ext_if --sport 34957 -j ACCEPT
+
+
+# -- Windows --
+-A FORWARD -p tcp --syn -i $ext_if --dport 54196 -j ACCEPT
+-A FORWARD -p tcp --syn -o $ext_if --dport 54196 -j ACCEPT
+-A FORWARD -p udp -i $ext_if --dport 54196 -j ACCEPT
+-A FORWARD -p udp -o $ext_if --sport 54196 -j ACCEPT
+#
+# ---------- Ende VOIP ------------
+
+
+
+# ------------- Traceroute  -------------
+#
+# rein
+-A OUTPUT -p udp --dport 33434:33530 -o $local_if_1 -j ACCEPT
+-A OUTPUT -p udp --dport 33434:33530 -o $wlan_if -j ACCEPT
+-A OUTPUT -p udp --dport 33434:33530 -o $ext_if -j ACCEPT
+#
+# raus
+-A INPUT -p udp --dport 33434:33530 -i $local_if_1 -j ACCEPT
+-A INPUT -p udp --dport 33434:33530 -i $wlan_if -j ACCEPT
+# forward
+-A FORWARD -p udp --dport 33434:33530 -o $ext_if -j ACCEPT
+#
+# -------- Ende Traceroute  -------------
+
+
+# ------------ ICMP (u.a. Ping) ------------
+# alle ICMP Pakete zulassen
+#
+-A OUTPUT -o $local_if_1 -p icmp -j ACCEPT
+-A OUTPUT -o $wlan_if -p icmp -j ACCEPT
+-A OUTPUT -o $ext_if -p icmp -j ACCEPT
+-A OUTPUT -o $vdsl_if -p icmp -j ACCEPT
+#
+-A INPUT -i $local_if_1 -p icmp -j ACCEPT
+-A INPUT -i $wlan_if -p icmp -j ACCEPT
+-A INPUT  -i $ext_if -p icmp -j ACCEPT
+-A INPUT  -i $vdsl_if -p icmp -j ACCEPT
+#
+-A FORWARD -p icmp -o $ext_if -j ACCEPT
+-A FORWARD -p icmp -i $local_if_1 -j ACCEPT
+-A FORWARD -p icmp -i $wlan_if -j ACCEPT
+-A FORWARD -p icmp -o $vdsl_if -j ACCEPT
+#
+# ------- Ende Ping ------------
+
+
+
+# ------------- portmapper (mountd und  NFS)  -------------
+#
+# -- portmapper ( udp/tcp port 111 )
+#
+# tcp
+-A INPUT ! -i $ext_if -p tcp --dport 111 -j ACCEPT
+-A FORWARD ! -i $ext_if -p tcp --dport 111 -j ACCEPT
+# udp
+-A INPUT ! -i $ext_if -p udp --dport 111 -j ACCEPT
+-A FORWARD ! -i $ext_if -p udp --dport 111 -j ACCEPT
+#
+# -- mountd  
+#         - normaly a random port number is assigned by
+#           the portmapper, but if you start the  rpc.mountd 
+#           (see the startscript at (/etc/init.d/nfs-kernel with 
+#           option -p 1105 you can use the following rules:
+#
+# tcp
+-A INPUT ! -i $ext_if -p tcp --dport 1105 -j ACCEPT
+-A FORWARD ! -i $ext_if -p tcp --dport 1105 -j ACCEPT
+# udp
+-A INPUT ! -i $ext_if -p udp --dport 1105 -j ACCEPT
+-A FORWARD ! -i $ext_if -p udp --dport 1105 -j ACCEPT
+#
+# -- nfs
+#
+-A INPUT ! -i $ext_if -p udp --dport 2049 -j ACCEPT
+-A FORWARD ! -i $ext_if -p udp --dport 2049 -j ACCEPT
+#
+# NFS depends on ICMP on much of its communication, more detailed:
+# NFS depends on ICMP Packets of type 3
+# 
+-A INPUT ! -i $ext_if -p icmp -m icmp --icmp-type 3 -j ACCEPT
+-A FORWARD ! -i $ext_if -p icmp -m icmp --icmp-type 3 -j ACCEPT
+#
+-A OUTPUT ! -o $ext_if -p icmp -m icmp --icmp-type 3 -j ACCEPT
+-A FORWARD ! -i $ext_if -p icmp -m icmp --icmp-type 3 -j ACCEPT
+#
+# ---------- Ende: portmapper (mountd und  NFS)  -----------
+
+
+# ------------ Portforwarding ------------- #
+# 
+## - Schott ins interne WARENFOM Netz
+# 
+# --- webrick - eingerichtet für vs-bdb-fe.wf.netz:3000 NUR aus  ---
+# --            den Schott netzen                                ---
+#
+#-t nat -A PREROUTING -i $ext_if -p tcp --syn  -s 80.156.4.0/22 \
+#   --dport 80  -j DNAT --to 192.168.52.47:3000 
+#-t filter -A FORWARD -p tcp  -s 80.156.4.0/22 --dport 3000 -d 192.168.52.47 \
+#   -i $ext_if -o $local_if_1 -j ACCEPT
+#-t nat -A PREROUTING -i $ext_if -p tcp --syn  -s 194.175.223.0/23 \
+#   --dport 80  -j DNAT --to 192.168.52.47:3000 
+#-t filter -A FORWARD -p tcp  -s 194.175.223.0/23 --dport 3000 -d 192.168.52.47 \
+#   -i $ext_if -o $local_if_1 -j ACCEPT
+#-t nat -A PREROUTING -i $ext_if -p tcp --syn  -s 213.68.175.0/25 \
+#   --dport 80  -j DNAT --to 192.168.52.47:3000 
+#-t filter -A FORWARD -p tcp  -s 213.68.175.0/25 --dport 3000 -d 192.168.52.47 \
+#   -i $ext_if -o $local_if_1 -j ACCEPT
+# 
+# --- schott-demo.warenform.de:443  ->  vs-bdb-fe.wf.netz:9000   ---
+# --            NUR aus den Schott netzen                        ---
+#
+#-t nat -A PREROUTING -i $ext_if -p tcp --syn  -s 80.156.4.0/22 \
+#   --dport 443  -j DNAT --to 192.168.52.46:9000 
+#-t filter -A FORWARD -p tcp  -s 80.156.4.0/22 --dport 9000 -d 192.168.52.46 \
+#   -i $ext_if -o $local_if_1 -j ACCEPT
+#-t nat -A PREROUTING -i $ext_if -p tcp --syn  -s 194.175.223.0/23 \
+#   --dport 443  -j DNAT --to 192.168.52.46:9000 
+#-t filter -A FORWARD -p tcp  -s 194.175.223.0/23 --dport 9000 -d 192.168.52.46 \
+#   -i $ext_if -o $local_if_1 -j ACCEPT
+#-t nat -A PREROUTING -i $ext_if -p tcp --syn  -s 213.68.175.0/25 \
+#   --dport 443  -j DNAT --to 192.168.52.46:9000 
+#-t filter -A FORWARD -p tcp  -s 213.68.175.0/25 --dport 9000 -d 192.168.52.46 \
+#   -i $ext_if -o $local_if_1 -j ACCEPT
+#
+# --- Etherpad Intranet
+# --
+#
+-t nat -A PREROUTING -i $ext_if -p tcp --syn \
+   --dport 9080 -j DNAT --to 192.168.52.24:9080 
+-t filter -A FORWARD -p tcp --dport 9080 -d 192.168.52.24 \
+   -i $ext_if -o $local_if_1 -j ACCEPT
+#
+-t nat -A PREROUTING -i $ext_if -p tcp --syn \
+   --dport 9443 -j DNAT --to 192.168.52.24:9443 
+-t filter -A FORWARD -p tcp --dport 9443 -d 192.168.52.24 \
+   -i $ext_if -o $local_if_1 -j ACCEPT
+#
+# --- ENDE: Etherpad Intranet
+#
+# 
+# --- HTTP ---
+#
+#-t nat -A PREROUTING -i $ext_if -p tcp --syn \
+#   --dport 8080 -j DNAT --to 192.168.52.25:8080 
+#-t filter -A FORWARD -p tcp --dport 8080 -d 192.168.52.35 \
+#   -i $ext_if -o $local_if_1 -j ACCEPT
+#
+# --- HTTPS ---
+#
+#-t nat -A PREROUTING -i $ext_if -p tcp --syn \
+#   --dport 8443 -j DNAT --to 192.168.42.25:443
+#-t filter -A FORWARD -p tcp --dport 443 -d 192.168.42.35 \
+#   -i $ext_if -o $local_if_1 -j ACCEPT
+#
+#
+# --- PPPTP ( VPN auf den NAS Server wf-nas ) --
+#
+#-t nat -A PREROUTING -i $ext_if -p tcp --syn \
+#   --dport 1723 -j DNAT --to 192.168.52.80:1723
+#-t filter -A FORWARD -p tcp --dport 1723 -d 192.168.52.80 \
+#   -i $ext_if -o $local_if_1 -j ACCEPT
+#
+#
+# --- SSH ( auf devel )
+#
+-t nat -A PREROUTING -i $ext_if -p tcp --dport 9997 -m state --state NEW -j DNAT --to 192.168.52.25:22
+-t filter -A FORWARD -p tcp --dport 22 -d 192.168.52.35 -i $ext_if -o $local_if_1 -m state --state NEW -j ACCEPT
+#
+#
+# --- SSH ( auf repos )
+#
+-t nat -A PREROUTING -i $ext_if -p tcp --dport 9998 -m state --state NEW -j DNAT --to 192.168.52.25:22
+-t filter -A FORWARD -p tcp --dport 22 -d 192.168.52.35 -i $ext_if -o $local_if_1 -m state --state NEW -j ACCEPT
+#
+#
+# --- SSH ( auf den Fileserver anita ) --
+#
+-t nat -A PREROUTING -i $ext_if -p tcp --dport 9999 -m state --state NEW -j DNAT --to 192.168.52.60:22
+-t filter -A FORWARD -p tcp --dport 22 -d 192.168.52.60 -i $ext_if -o $local_if_1 -m state --state NEW -j ACCEPT
+#
+# ---------- Ende Portforwarding ---------- #
+
+
+# ------------- Loggen -------------
+#
+# alles loggen was nicht durchgeht
+#
+#-A OUTPUT -j LOG --log-level debug
+#-A INPUT -j LOG --log-level debug 
+#-A FORWARD -j LOG --log-level debug 
+# -
+#  ------------- Ende Loggen -------------
+
+# -------------  DROP -------------
+# drop all other for all interfaces..
+#
+-A INPUT -j DROP
+-A OUTPUT -j DROP
+-A FORWARD -j DROP
+#
+# ---------- Ende: DROP ----------
+
+
+
+
+EOR
+
+exit 0
diff --git a/WF/ipt-firewall/interfaces_ipv4.conf b/WF/ipt-firewall/interfaces_ipv4.conf
index 710ef1f..47073a9 100644
--- a/WF/ipt-firewall/interfaces_ipv4.conf
+++ b/WF/ipt-firewall/interfaces_ipv4.conf
@@ -15,7 +15,7 @@ ext_ifs_dsl="$ext_if_dsl_1 $ext_if_dsl_2 $ext_if_dsl_3 $ext_if_dsl_4"
 
 # - Extern Interfaces Static Lines
 # -    (blank separated list)
-ext_if_static_1="eth0"
+ext_if_static_1="eth2"
 ext_if_static_2=""
 ext_if_static_3=""
 
@@ -26,8 +26,8 @@ ext_ifs_static="$ext_if_static_1 $ext_if_static_2 $ext_if_static_3"
 vpn_ifs="tun+"
 
 # - Local Interfaces
-local_if_1="eth1"
-local_if_2="eth2"
+local_if_1="eth0"
+local_if_2="eth1"
 local_if_3=""
 local_if_4=""
 local_if_5=""
diff --git a/WF/ipt-firewall/main_ipv4.conf b/WF/ipt-firewall/main_ipv4.conf
index 81fe3a2..387c933 100644
--- a/WF/ipt-firewall/main_ipv4.conf
+++ b/WF/ipt-firewall/main_ipv4.conf
@@ -250,9 +250,14 @@ allow_local_net_to_local_net=""
 # -   allow_local_if_to_local_ip="${local_if_1}:192.168.10.1
 # -                               ${local_if_2}:192.168.10.13"
 # -
+# - 192.168.43.10    Nasrechner (incl Cloud)
+# -
 # - Blank separated list
 # -
-allow_local_if_to_local_ip=""
+allow_local_if_to_local_ip="
+   ${local_if_1}:192.168.43.10
+   ${local_if_2}:192.168.43.10
+"
 
 
 
@@ -1044,8 +1049,10 @@ masquerade_tcp_cons=""
 # -    portforward_tcp="$ext_if_dsl_1:9997:192.168.52.25:22
 # -                     $ext_if_dsl_1:9998:192.168.53.24:22"
 # -
-# - 192.168.52.24:9080  Etherpad
-# - 192.168.52.24:9443  Etherpad
+# - 192.168.52.24:9080  HTTP  Etherpad
+# - 192.168.52.24:9443  HTTPS Etherpad
+# - 192.168.43.10:443   HTTPS Nextcloud
+# - 192.168.52.25:22    SSH   Repository
 # -
 # - Blank separated list
 # -
@@ -1053,6 +1060,7 @@ portforward_tcp="
    $ext_if_dsl_1:9080:192.168.52.24:9080
    $ext_if_dsl_1:9443:192.168.52.24:9443
    $ext_if_dsl_1:8443:192.168.43.10:443
+   $ext_if_dsl_1:9998:192.168.52.25:22
 "
 
 
diff --git a/WF/isc-dhcp6-server.WF b/WF/isc-dhcp6-server.WF
new file mode 100755
index 0000000..071e1f8
--- /dev/null
+++ b/WF/isc-dhcp6-server.WF
@@ -0,0 +1,116 @@
+#!/bin/sh
+#
+#
+
+### BEGIN INIT INFO
+# Provides:          isc-dhcp6-server
+# Required-Start:    $remote_fs $network $syslog
+# Required-Stop:     $remote_fs $network $syslog
+# Should-Start:      $local_fs slapd $named
+# Should-Stop:       $local_fs slapd
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: DHCPv6 server
+# Description:       Dynamic Host Configuration Protocol Server
+### END INIT INFO
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+OPTIONS="-6"
+
+test -f /usr/sbin/dhcpd || exit 0
+
+DHCPD_DEFAULT="${DHCPD_DEFAULT:-/etc/default/isc-dhcp6-server}"
+
+# It is not safe to start if we don't have a default configuration...
+if [ ! -f "$DHCPD_DEFAULT" ]; then
+	echo "$DHCPD_DEFAULT does not exist! - Aborting..."
+	if [ "$DHCPD_DEFAULT" = "/etc/default/isc-dhcp-server" ]; then
+		echo "Run 'dpkg-reconfigure isc-dhcp-server' to fix the problem."
+	fi
+	exit 0
+fi
+
+. /lib/lsb/init-functions
+
+# Read init script configuration
+[ -f "$DHCPD_DEFAULT" ] && . "$DHCPD_DEFAULT"
+
+NAME=dhcpd6
+DESC="ISC DHCPv6 server"
+# fallback to default config file
+DHCPD_CONF=${DHCPD_CONF:-/etc/dhcp/dhcpd6.conf}
+# try to read pid file name from config file, with fallback to /var/run/dhcpd.pid
+if [ -z "$DHCPD_PID" ]; then
+	DHCPD_PID=$(sed -n -e 's/^[ \t]*pid-file-name[ \t]*"(.*)"[ \t]*;.*$/\1/p' < "$DHCPD_CONF" 2>/dev/null | head -n 1)
+fi
+DHCPD_PID="${DHCPD_PID:-/var/run/dhcpd6.pid}"
+
+test_config()
+{
+	if ! /usr/sbin/dhcpd -t $OPTIONS -q -cf "$DHCPD_CONF" > /dev/null 2>&1; then
+		echo "dhcpd self-test failed. Please fix $DHCPD_CONF."
+		echo "The error was: "
+		/usr/sbin/dhcpd -t $OPTIONS -cf "$DHCPD_CONF"
+		exit 1
+	fi
+}
+
+# single arg is -v for messages, -q for none
+check_status()
+{
+    if [ ! -r "$DHCPD_PID" ]; then
+	test "$1" != -v || echo "$NAME is not running."
+	return 3
+    fi
+    if read pid < "$DHCPD_PID" && ps -p "$pid" > /dev/null 2>&1; then
+	test "$1" != -v || echo "$NAME is running."
+	return 0
+    else
+	test "$1" != -v || echo "$NAME is not running but $DHCPD_PID exists."
+	return 1
+    fi
+}
+
+case "$1" in
+	start)
+		test_config
+		log_daemon_msg "Starting $DESC" "$NAME"
+		start-stop-daemon --start --quiet --pidfile "$DHCPD_PID" \
+			--exec /usr/sbin/dhcpd -- \
+			-q $OPTIONS -cf "$DHCPD_CONF" -pf "$DHCPD_PID" $INTERFACES
+		sleep 2
+
+		if check_status -q; then
+			log_end_msg 0
+		else
+			log_failure_msg "check syslog for diagnostics."
+			log_end_msg 1
+			exit 1
+		fi
+		;;
+	stop)
+		log_daemon_msg "Stopping $DESC" "$NAME"
+		start-stop-daemon --stop --quiet --pidfile "$DHCPD_PID"
+		log_end_msg $?
+		rm -f "$DHCPD_PID"
+		;;
+	restart | force-reload)
+		test_config
+		$0 stop
+		sleep 2
+		$0 start
+		if [ "$?" != "0" ]; then
+			exit 1
+		fi
+		;;
+	status)
+		echo -n "Status of $DESC: "
+		check_status -v
+		exit "$?"
+		;;
+	*)
+		echo "Usage: $0 {start|stop|restart|force-reload|status}"
+		exit 1 
+esac
+
+exit 0
diff --git a/WF/peers/dsl-provider b/WF/peers/dsl-provider
index da73d6b..3879f50 100644
--- a/WF/peers/dsl-provider
+++ b/WF/peers/dsl-provider
@@ -20,7 +20,7 @@ mtu 1456
 #persist
 #maxfail 0
 #holdoff 20
-plugin rp-pppoe.so eth0.7
+plugin rp-pppoe.so eth2.7
 ##user "0025591824365511139967620001@t-online.de"
 #user "feste-ip4/7TB02K2HZ4Q3@t-online-com.de"
 user "0029713004945511268028220001@t-online.de"
diff --git a/WF/radvd.conf.WF b/WF/radvd.conf.WF
new file mode 100644
index 0000000..8eea1dd
--- /dev/null
+++ b/WF/radvd.conf.WF
@@ -0,0 +1,29 @@
+interface eth1
+{
+   AdvManagedFlag on;
+   AdvSendAdvert on;
+   AdvLinkMTU 1280;
+   #AdvOtherConfigFlag on;
+
+   #prefix 2001:6f8:107e:63::/64
+   #{
+   #   AdvOnLink on;
+   #   AdvAutonomous on;
+   #   AdvRouterAddr on;
+   #};
+};
+
+interface br0
+{
+   AdvManagedFlag on;
+   AdvSendAdvert on;
+   AdvLinkMTU 1280;
+   #AdvOtherConfigFlag on;
+
+   #prefix 2001:6f8:107e:64::/64
+   #{
+   #   AdvOnLink on;
+   #   AdvAutonomous on;
+   #   AdvRouterAddr on;
+   #};
+};
diff --git a/WF/sbin/disk-action b/WF/sbin/disk-action
new file mode 100755
index 0000000..079f1e7
--- /dev/null
+++ b/WF/sbin/disk-action
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+BASENAME="${0##*/}"
+ACTION="$1"
+MOUNT_POINT="$2"
+
+transmission_try_start() {
+    . /etc/default/transmission-daemon
+    if [ $(expr "${BASE_DIR}/" : "${MOUNT_POINT}/") -gt 0 ]; then
+	sed -r 's/^ENABLE_DAEMON=.*$/ENABLE_DAEMON=1/' < /etc/default/transmission-daemon > /tmp/.transmission-daemon.$$
+	cat /tmp/.transmission-daemon.$$ > /etc/default/transmission-daemon
+	rm  /tmp/.transmission-daemon.$$
+	if [ "$(pidof transmission-daemon)" != "" ]; then
+	    killall -9 transmission-daemon 2>&1 >/dev/null
+	    sleep 1
+	fi
+	xMASK=$(umask); umask 0000
+	[ ! -d "${BASE_DIR}"     ] && mkdir -p "${BASE_DIR}"
+	[ ! -d "${CONFIG_DIR}"   ] && mkdir -p "${CONFIG_DIR}"
+	[ ! -d "${DOWNLOAD_DIR}" ] && mkdir -p "${DOWNLOAD_DIR}"
+	[ ! -d "${WATCH_DIR}"    ] && mkdir -p "${WATCH_DIR}"
+	[ ! -f "${CONFIG_DIR}/settings.json" ] && cp "/var/lib/transmission/settings.json.template" "${CONFIG_DIR}/settings.json" 
+	umask ${xMASK}
+	/etc/init.d/transmission-daemon start 2>&1 >/dev/null
+    fi
+}
+
+transmission_try_stop() {
+    . /etc/default/transmission-daemon
+    if [ $(expr "${BASE_DIR}/" : "${MOUNT_POINT}/") -gt 0 ]; then
+	sed -r 's/^ENABLE_DAEMON=.*$/ENABLE_DAEMON=0/' < /etc/default/transmission-daemon > /tmp/.transmission-daemon.$$
+	cat /tmp/.transmission-daemon.$$ > /etc/default/transmission-daemon
+	rm  /tmp/.transmission-daemon.$$
+	if [ "$(pidof transmission-daemon)" != "" ]; then
+	    killall -9 transmission-daemon 2>&1 >/dev/null
+	fi
+    fi
+}
+
+logger -t $BASENAME "$@ --> BEGIN"
+
+case "$1" in
+    add)
+	transmission_try_start
+    ;;
+    remove)
+	transmission_try_stop
+    ;;
+    *)
+	echo "Use: $0 (add|remove) /mount/point"
+esac
+
+logger -t $BASENAME "$@ --> END"
diff --git a/WF/sbin/ipt-firewall-gateway.ALT b/WF/sbin/ipt-firewall-gateway.ALT
new file mode 100755
index 0000000..429d815
--- /dev/null
+++ b/WF/sbin/ipt-firewall-gateway.ALT
@@ -0,0 +1,3713 @@
+#!/usr/bin/env bash
+
+### BEGIN INIT INFO
+# Provides:          ipt-firewall
+# Required-Start:    $local_fs $remote_fs $syslog $network $time
+# Required-Stop:     $local_fs $remote_fs $syslog $network
+# Should-Start:
+# Should-Stop:
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: IPv4 Firewall
+### END INIT INFO
+
+
+# -------------
+# - Settings
+# -------------
+
+ipt_conf_dir="/etc/ipt-firewall"
+
+inc_functions_file="${ipt_conf_dir}/include_functions.conf"
+
+load_modules_file=${ipt_conf_dir}/load_modules_ipv4.conf
+
+conf_logging=${ipt_conf_dir}/logging_ipv4.conf
+conf_interfaces=${ipt_conf_dir}/interfaces_ipv4.conf
+conf_default_ports=${ipt_conf_dir}/default_ports.conf
+conf_main=${ipt_conf_dir}/main_ipv4.conf
+conf_post_declarations=${ipt_conf_dir}/post_decalrations.conf
+
+# -------------
+# - Some checks and preloads..
+# -------------
+
+ipt=$(which iptables)
+
+if [[ -z "$ipt" ]] ; then
+   echo ""
+   echo -e "\tiptables was not found on this server!"
+   echo
+   echo -e "\tFirewall Script was stopped!"
+   echo
+   exit 1
+fi
+
+if [[ ! -f "$inc_functions_file" ]] ; then
+   echo ""
+   echo -e "\tMissing include file '$inc_functions_file'"
+   echo
+   echo -e "\tFirewall Script was stopped!"
+   echo
+   exit 1
+else
+   source $inc_functions_file
+fi
+
+if [[ ! -f "$load_modules_file" ]]; then
+   warn "No modules for loading configured. Missing file '$load_modules_file'!"
+else
+
+   while read -r module ; do
+      if ! lsmod | grep -q -E "^$module\s+" ; then
+         /sbin/modprobe  $module > /dev/null 2>&1
+         if [[ "$?" != "0" ]]; then
+            warn "Loading module '$module' failed!"
+         fi
+      fi
+   done < <(sed -ne 's/^[[:space:]]*\([^#].*\)[[:space:]]*/\1/p' $load_modules_file)
+
+fi
+
+if [[ ! -f "$conf_logging" ]]; then
+   fatal "Missing configuration for logging - file '$conf_logging'"
+else
+   source $conf_logging
+fi
+
+if [[ ! -f "$conf_default_ports" ]]; then
+   fatal "Missing configuration for default_ports - file '$conf_default_ports'"
+else
+   source $conf_default_ports
+fi
+
+if [[ ! -f "$conf_interfaces" ]]; then
+   fatal "Missing interface configurations  - file '$conf_interfaces'"
+else
+   source $conf_interfaces
+fi
+
+if [[ ! -f "$conf_main" ]]; then
+   fatal "Missing main configurations  - file '$conf_main'"
+else
+   source $conf_main
+fi
+
+if [[ ! -f "$conf_post_declarations" ]]; then
+   fatal "Missing post declarations  - file '$conf_post_declarations'"
+else
+   source $conf_post_declarations
+fi
+
+
+echo
+if $terminal ; then
+   echo -e "\033[37m\033[1m\tStarting firewall iptables (IpV4)..\033[m"
+else
+   echo "Starting firewall iptables (IpV4).."
+fi
+echo
+
+
+# -------------
+# --- Activate IP Forwarding
+# -------------
+
+## - IP Forwarding aktivieren/deaktivieren. 
+## -
+## - Dieses benötigen wir lediglich bei einem Rechner in mehreren Netzen. 
+## - Es ist anzuraten, diese Einstellung vor allen anderen vorzunehmen, 
+## - weil hiermit auch andere (de)aktiviert werden.
+## -
+if $kernel_activate_forwarding ; then
+   echo 1 > /proc/sys/net/ipv4/ip_forward
+   echononl "\tActivate Forwarding.."
+   echo_done
+else
+   echo 0 > /proc/sys/net/ipv4/ip_forward
+   echononl "\t\033[33m\033[1mDisable Forwarding.."
+   echo_done
+fi
+
+if $kernel_support_dynaddr ; then
+   echononl "\tActivate kernel support for dynamic addresses.."
+   if [[ -n $dynaddr_flag ]] && [[ $dynaddr_flag =~ ^-?[0-9]+$ ]]; then
+      echo $dynaddr_flag > /proc/sys/net/ipv4/ip_dynaddr
+      echo_done
+   else
+      echo_failed
+   fi
+else
+   echo 0 > /proc/sys/net/ipv4/ip_dynaddr
+   echononl "\t\033[33m\033[1mDisable Forwarding..\033[m"
+   echo_done
+fi
+
+# -------------
+# --- Adjust Kernel Parameters (Security/Tuning)
+# -------------
+
+echononl "\tAdjust Kernel Parameters (Security/Tuning).."
+
+if $adjust_kernel_parameters ; then
+   ## - Reduce DoS'ing ability by reducing timeouts
+   ## -
+   if $kernel_reduce_timeouts ; then
+      echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
+      echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time
+      echo 1 > /proc/sys/net/ipv4/tcp_window_scaling
+      echo 0 > /proc/sys/net/ipv4/tcp_sack
+   fi
+
+   ## - SYN COOKIES
+   ## -
+   if  $kernel_tcp_syncookies ; then
+      echo 1 > /proc/sys/net/ipv4/tcp_syncookies
+      echo 2048 > /proc/sys/net/ipv4/tcp_max_syn_backlog
+      echo 3 > /proc/sys/net/ipv4/tcp_synack_retries
+   fi
+
+   ## - Protection against ICMP bogus error responses
+   ## -
+   if $kernel_protect_against_icmp_bogus_messages ; then
+      echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
+   fi
+
+   ## - Ignore Broadcast Pings
+   ## - 
+   if $kernel_ignore_broadcast_ping ; then
+      echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
+   fi
+
+   ## - Deactivate Source Routed Packets
+   ## - 
+   if $kernel_deactivate_source_route ; then
+      for asr in /proc/sys/net/ipv4/conf/*/accept_source_route ; do
+         echo 0 > $asr
+      done
+   fi
+
+   ## - Deactivate sending ICMP redirects
+   ## -
+   if ! $telekom_internet_tv ; then
+      if $kernel_dont_accept_redirects ; then
+         for rp_filter in /proc/sys/net/ipv4/conf/*/rp_filter ; do
+            echo 1 > $rp_filter
+         done
+      else
+         for rp_filter in /proc/sys/net/ipv4/conf/*/rp_filter ; do
+            echo 0 > $rp_filter
+         done
+      fi
+   fi
+
+   ## - Logging of spoofed (source routed" and "redirect") packets
+   ## -
+   if $kernel_log_martians ; then
+      echo "0" > /proc/sys/net/ipv4/conf/all/log_martians
+   fi
+
+   echo_done # Adjust Kernel Parameters (Security/Tuning)
+else
+   echo_skipped
+fi
+
+
+# -------------
+# --- Set default policies / Flush Rules
+# -------------
+
+echo
+echononl "\tFlushing firewall iptable (IPv4).."
+
+# - default policies
+# -
+$ipt -P INPUT ACCEPT
+$ipt -P OUTPUT ACCEPT
+$ipt -P FORWARD ACCEPT
+
+## - flush chains
+## -
+$ipt -F
+$ipt -F INPUT
+$ipt -F OUTPUT
+$ipt -F FORWARD
+$ipt -F -t mangle
+$ipt -F -t nat
+$ipt -F -t raw
+$ipt -X
+$ipt -Z
+
+$ipt -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+
+unset natted_interface_arr
+declare -a natted_interface_arr
+
+for _dev in ${nat_device_arr[@]} ; do
+   $ipt -t nat -A POSTROUTING -o $_dev -j MASQUERADE
+   natted_interface_arr+=("$_dev")
+done
+
+if [[ ${#nat_network_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _val in "${nat_network_arr[@]}" ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+
+      # - Prevent natting on an interface already natted
+      # -
+      if containsElement "${_val_arr[1]}" "${nat_device_arr[@]}" ; then
+         continue
+      fi
+
+      $ipt -t nat -A POSTROUTING -o ${_val_arr[1]} -d ${_val_arr[0]} -j MASQUERADE
+   done
+fi
+
+if $telekom_internet_tv ; then
+   $ipt -t nat -A POSTROUTING -o $tv_extern_if -j MASQUERADE
+fi
+
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+if [[ ${#masquerade_tcp_con_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _val in "${masquerade_tcp_con_arr[@]}" ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${_val_arr[3]}" ]] ; then
+         no_if_for_ip_arr+=("${_val_arr[1]}")
+         continue
+      fi
+      $ipt -t nat -A POSTROUTING -o ${_val_arr[3]} -p tcp -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -j MASQUERADE
+   done
+fi
+
+#echo_done # Flushing firewall iptable (IPv4)..
+if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+   echo_warning
+   for _ip in ${no_if_for_ip_arr[@]} ; do
+      warn "Masquerading for ip '$_ip' was omitted - No idestination interface present!"
+   done
+else
+   echo_done
+fi
+echo
+
+
+# -------------
+# - Log given IP Addresses
+# -------------
+
+echononl "\tLog given IP Addresses"
+if [[ ${#log_ip_arr[@]} -gt 0 ]]; then
+   for _ip in ${log_ip_arr[@]} ; do
+      $ipt -A INPUT -s $_ip -j LOG --log-prefix "IPv4: $_ip IN: " --log-level $log_level
+      $ipt -A OUTPUT -d $_ip -j LOG --log-prefix "IPv4: $_ip OUT: " --log-level $log_level
+      $ipt -A FORWARD -s $_ip -j LOG --log-prefix "IPv4: $_ip FORWARD FROM: " --log-level $log_level
+      $ipt -A FORWARD -d $_ip -j LOG --log-prefix "IPv4: $_ip FORWARD TO: " --log-level $log_level
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# -------------
+# --- Stopping firewall if only flushing was requested (parameter flush)
+# -------------
+
+case $1 in
+   flush)
+      warn No firewall rules are active!
+      exit 0;;
+esac
+
+
+# ---
+# - Stop here, if no extern interface is configured
+# ---
+
+if [[ ${#ext_if_arr[@]} -lt 1 ]] ; then
+   fatal "No extern Interface is configured!"
+fi
+
+
+
+# -------------
+# --- Traffic Shaping
+# -------------
+
+echo ""
+if $terminal ; then
+   echononl "\033[37m\033[1m\tStarting outbound shaping...\033[m"
+else
+   echo -n "Starting outbound shaping"
+fi
+
+if $TRAFFIC_SHAPING  && [[ -n "$TC_DEV" ]] ; then
+
+   tc=$(which tc)
+
+   if [[ -z "$tc" ]]; then
+      echo_skipped
+      warn "'tc'-programm not found. Outbound shaping was ommitted!"
+   else
+
+      ## - Löschen aller Klassen für $TC_DEV und der Filterregeln
+      ## -
+      $tc qdisc del dev $TC_DEV root 2> /dev/null > /dev/null
+      $ipt -t mangle -D POSTROUTING -o $TC_DEV -j MYSHAPER-OUT 2> /dev/null > /dev/null
+      $ipt -t mangle -F MYSHAPER-OUT 
+      $ipt -t mangle -X MYSHAPER-OUT
+
+
+      # add HTB root qdisc
+      $tc qdisc add dev $TC_DEV root handle 1:0 htb default 26
+
+      # add main rate limit class(es)
+      $tc class add dev $TC_DEV parent 1: classid 1:1 htb rate ${LIMIT_UP}kbit 
+
+      # create fair-share-classes, descending priority 
+      $tc class add dev $TC_DEV parent 1:1 classid 1:20 htb rate ${LIMIT_CLASS}kbit ceil ${LIMIT_UP}kbit prio 0
+      $tc class add dev $TC_DEV parent 1:1 classid 1:21 htb rate ${LIMIT_CLASS}kbit ceil ${LIMIT_UP}kbit prio 1
+      $tc class add dev $TC_DEV parent 1:1 classid 1:22 htb rate ${LIMIT_CLASS}kbit ceil ${LIMIT_UP}kbit prio 2
+      $tc class add dev $TC_DEV parent 1:1 classid 1:23 htb rate ${LIMIT_CLASS}kbit ceil ${LIMIT_UP}kbit prio 3
+      $tc class add dev $TC_DEV parent 1:1 classid 1:24 htb rate ${LIMIT_CLASS}kbit ceil ${LIMIT_UP}kbit prio 4
+      $tc class add dev $TC_DEV parent 1:1 classid 1:25 htb rate ${LIMIT_CLASS}kbit ceil ${LIMIT_UP}kbit prio 5
+      $tc class add dev $TC_DEV parent 1:1 classid 1:26 htb rate ${LIMIT_CLASS}kbit ceil ${LIMIT_UP}kbit prio 6
+
+
+      # attach qdisc to leaf classes 
+      #
+      #    here we at SFQ to each priority class.  SFQ insures that
+      #    within each class connections will be treated (almost) fairly.
+      $tc qdisc add dev $TC_DEV parent 1:20 handle 20: sfq perturb 10
+      $tc qdisc add dev $TC_DEV parent 1:21 handle 21: sfq perturb 10
+      $tc qdisc add dev $TC_DEV parent 1:22 handle 22: sfq perturb 10
+      $tc qdisc add dev $TC_DEV parent 1:23 handle 23: sfq perturb 10
+      $tc qdisc add dev $TC_DEV parent 1:24 handle 24: sfq perturb 10
+      $tc qdisc add dev $TC_DEV parent 1:25 handle 25: sfq perturb 10
+      $tc qdisc add dev $TC_DEV parent 1:26 handle 26: sfq perturb 10
+
+
+      # filter traffic into classes by fwmark
+      #
+      #    here we direct traffic into priority class according to
+      #    the fwmark set on the packet (we set fwmark with iptables
+      #    later).  Note that above we've set the default priority
+      #    class to 1:26 so unmarked packets (or packets marked with
+      #    unfamiliar IDs) will be defaulted to the lowest priority
+      #    class.
+      $tc filter add dev $TC_DEV parent 1:0 prio 0 protocol ip handle 20 fw flowid 1:20
+      $tc filter add dev $TC_DEV parent 1:0 prio 0 protocol ip handle 21 fw flowid 1:21
+      $tc filter add dev $TC_DEV parent 1:0 prio 0 protocol ip handle 22 fw flowid 1:22
+      $tc filter add dev $TC_DEV parent 1:0 prio 0 protocol ip handle 23 fw flowid 1:23
+      $tc filter add dev $TC_DEV parent 1:0 prio 0 protocol ip handle 24 fw flowid 1:24
+      $tc filter add dev $TC_DEV parent 1:0 prio 0 protocol ip handle 25 fw flowid 1:25
+      $tc filter add dev $TC_DEV parent 1:0 prio 0 protocol ip handle 26 fw flowid 1:26
+
+
+      # add MYSHAPER-OUT chain to the mangle table in iptables
+      #
+      #    this sets up the table we'll use
+      #    to filter and mark packets.
+      $ipt -t mangle -N MYSHAPER-OUT
+      $ipt -t mangle -I POSTROUTING -o $TC_DEV -j MYSHAPER-OUT
+
+
+      # add fwmark entries to classify different types of traffic
+      #
+      #    Set fwmark from 20-26 according to
+      #    desired class. 20 is highest prio.
+
+      # mark 20 - high prio 0
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j MARK --set-mark 20
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j RETURN
+      $ipt -t mangle -A MYSHAPER-OUT -p icmp -j MARK --set-mark 20
+      $ipt -t mangle -A MYSHAPER-OUT -p icmp -j RETURN
+
+      # mark 21 - high prio 1 
+      #    - DNS Service
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --dport 53 -j MARK --set-mark 21
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --dport 53 -j RETURN
+
+      # mark 22 - high prio 2
+      #    - VoIP SIP (sip ports, rtp ports, stun ports(3478))
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --sport ${RTP_PORTS_START}:${RTP_PORTS_END} -j MARK --set-mark 22
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --sport ${RTP_PORTS_START}:${RTP_PORTS_END} -j RETURN
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --dport ${SIP_PORT_REMOTE} -j MARK --set-mark 22
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --dport ${SIP_PORT_REMOTE} -j RETURN
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --sport ${SIP_PORT_LOCAL} -j MARK --set-mark 22
+      $ipt -t mangle -A MYSHAPER-OUT -p udp --sport ${SIP_PORT_LOCAL} -j RETURN
+      $ipt -t mangle -A MYSHAPER-OUT -p udp -m multiport --dport ${STUN_PORTS} -j MARK --set-mark 22
+      $ipt -t mangle -A MYSHAPER-OUT -p udp -m multiport --dport ${STUN_PORTS} -j RETURN
+
+      # mark 23 - prio 3
+      #    - OpenVPN
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m multiport --sport 1094,1095 -j MARK --set-mark 23 
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m multiport --sport 1094,1095 -j RETURN
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp --dport 22 -j MARK --set-mark 23
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp --dport 22 -j RETURN
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp --sport 22 -j MARK --set-mark 23 
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp --sport 22 -j RETURN
+
+      # mark 24 - prio 4
+      #    - WWW
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m multiport --dport 80,443 -j MARK --set-mark 24
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m multiport --dport 80,443 -j RETURN
+
+
+      # mark 25 - prio 5
+      #    - Mailtraffic
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m multiport --dport 587,110,995,143,993 -j MARK --set-mark 25
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m multiport --dport 587,110,995,143,993 -j RETURN
+
+
+      # Remaining packets are marked according to TOS
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m tos --tos Minimize-Delay -m mark --mark 0 -j MARK --set-mark 22
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m tos --tos Maximize-Throughput -m mark --mark 0 -j MARK --set-mark 22
+      $ipt -t mangle -A MYSHAPER-OUT -p tcp -m tos --tos Minimize-Cost -m mark --mark 0 -j MARK --set-mark 25
+      # redundant- mark any unmarked packets as 26 (low prio)
+      $ipt -t mangle -A MYSHAPER-OUT -m mark --mark 0 -j MARK --set-mark 26
+
+      echo_done
+   fi
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Provide (Telekom) IP TV
+# ---
+
+echo
+echononl "\tProvide (Telekom) Internet TV"
+
+if $telekom_internet_tv && [[ -n "$tv_local_if" ]] ; then
+
+   # - Telekom VDSL - Rules for IPTV 
+   # -
+   $ipt -A INPUT -i $tv_local_if -p igmp -s $tv_ip -j ACCEPT
+   #$ipt -A INPUT -i $tv_local_if -p igmp -j DROP
+
+   $ipt -A FORWARD -s $tv_ip -j ACCEPT
+   $ipt -A FORWARD -d $tv_ip -j ACCEPT
+
+   $ipt -A FORWARD -i $tv_ip -j ACCEPT
+   $ipt -A FORWARD -o $tv_ip -j ACCEPT
+
+
+   # - Forward all networks defined defind by igmpproxy
+   # - (see: phyint eth2.8 upstream  ratelimit 0  threshold 1)
+   #
+   #$ipt -A FORWARD -s 217.0.119.0/24 -d 224.0.0.0/4 -j ACCEPT
+   #$ipt -A FORWARD -s 193.158.35.0/24 -d 224.0.0.0/4 -j ACCEPT
+   #$ipt -A FORWARD -s 239.35.100.6/24 -d 224.0.0.0/4 -j ACCEPT
+   #$ipt -A FORWARD -s 93.230.64.0/19 -d 224.0.0.0/4 -j ACCEPT
+   $ipt -A FORWARD -d 224.0.0.0/4 -j ACCEPT
+   $ipt -A FORWARD -s 224.0.0.0/4 -j ACCEPT
+
+   $ipt -A OUTPUT -d 224.0.0.0/4 -j ACCEPT
+   $ipt -A INPUT -d 224.0.0.0/4 -j ACCEPT
+
+   $ipt -A INPUT -i $tv_extern_if -d 224.0.0.0/4 -j ACCEPT
+   $ipt -A INPUT -i $tv_local_if -d 224.0.0.0/4 -j ACCEPT
+   $ipt -A OUTPUT -o $tv_extern_if -d 224.0.0.0/4 -j ACCEPT
+   $ipt -A OUTPUT -o $tv_local_if -d 224.0.0.0/4 -j ACCEPT
+
+   #$ipt -A FORWARD -d 224.0.0.0/4 -j ACCEPT
+   $ipt -A FORWARD -i $tv_local_if -o $tv_extern_if -j ACCEPT
+   $ipt -A FORWARD -i $tv_extern_if -d 224.0.0.0/4 -j ACCEPT
+   
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# -------------
+# --- Pass through Devices Interfaces (not firewalled)
+# -------------
+
+if [[ ${#unprotected_if_arr[@]} -gt 0 ]]; then
+   echononl "\tPass through Devices (not firewalled)"
+   for _dev in ${unprotected_if_arr[@]} ; do
+      if $log_unprotected || $log_all ; then
+         $ipt -A INPUT -i $_dev -j LOG --log-prefix "$log_prefix Not firewalled ${_dev}: " --log-level $log_level
+         $ipt -A OUTPUT -o $_dev -j LOG --log-prefix "$log_prefix Not firewalled ${_dev}: " --log-level $log_level
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -i $_dev -j LOG --log-prefix "$log_prefix Not firewalled ${_dev}: " --log-level $log_level
+            $ipt -A FORWARD -o $_dev -j LOG --log-prefix "$log_prefix Not firewalled ${_dev}: " --log-level $log_level
+         fi
+      fi
+      $ipt -A INPUT -i $_dev -j ACCEPT
+      $ipt -A OUTPUT -o $_dev -j ACCEPT
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -i $_dev -j ACCEPT
+         $ipt -A FORWARD -o $_dev -j ACCEPT
+      fi
+   done
+   echo_done
+fi
+
+
+
+# -------------
+# --- Block IPs / Networks / Interfaces
+# -------------
+echononl "\tBlock IPs / Networks / Interfaces.."
+
+
+# ---
+# - Block IPs
+# ---
+
+for _ip in $blocked_ips ; do
+   for _dev in ${ext_if_arr[@]} ; do
+      if $log_blocked_ip || $log_all ; then
+         $ipt -A INPUT -i $_dev -s $_ip -j LOG --log-prefix "$log_prefix Blocked ${_ip}: " --log-level $log_level
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -i $_dev -s $_ip -j LOG --log-prefix "$log_prefix Blocked ${_ip}: " --log-level $log_level
+         fi
+      fi
+      $ipt -A INPUT -i $_dev -s $_ip -j DROP
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -i $_dev -s $_ip -j DROP
+      fi
+   done
+done
+
+
+# ---
+# - Block Interfaces
+# ---
+
+for _if in ${blocked_if_arr[@]} ; do
+   if $log_blocked_if || $log_all ; then
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -i $_if -j LOG --log-prefix "$log_prefix Blocked IF ${_if}: " --log-level $log_level
+         $ipt -A FORWARD -o $_if -j LOG --log-prefix "$log_prefix Blocked IF ${_if}: " --log-level $log_level
+      fi
+      $ipt -A INPUT -i $_if -j LOG --log-prefix "$log_prefix Blocked IF ${_if}: " --log-level $log_level
+      $ipt -A OUTPUT -o $_if -j LOG --log-prefix "$log_prefix Blocked IF ${_if}: " --log-level $log_level
+   fi
+   if $kernel_activate_forwarding ; then
+      $ipt -A FORWARD -i $_if -j DROP
+      $ipt -A FORWARD -o $_if -j DROP
+   fi
+   $ipt -A INPUT -i $_if -j DROP
+   $ipt -A OUTPUT -o $_if -j DROP
+done
+
+echo_done # Block IPs / Networks / Interfaces..
+
+
+# ---
+# - Allow Forwarding certain private Addresses
+# ---
+
+echononl "\tAllow forwarding (private) IPs / IP-Ranges.."
+if [[ ${#forward_private_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${forward_private_ip_arr[@]}; do
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -d $_ip -j ACCEPT
+         $ipt -A FORWARD -s $_ip -j ACCEPT
+         echo_done
+      else
+         echo_skipped
+      fi
+   done
+else
+   echo_skipped
+fi
+
+
+# -------------
+# --- Protections against several attacks / unwanted packages
+# -------------
+echo
+echononl "\tProtections against several attacks / unwanted packages.."
+
+if $protect_against_several_attacks ; then
+
+   # ---
+   # - Protection against syn-flooding
+   # ---
+
+   $ipt -N syn-flood
+   $ipt -A syn-flood -m limit --limit 1/second --limit-burst 3 -j RETURN
+   if $log_syn_flood || $log_all ; then
+      $ipt -A syn-flood -j LOG --log-prefix "$log_prefix SYN flood: " --log-level $log_level
+   fi
+   $ipt -A syn-flood -j DROP
+
+
+   # ---
+   # - Drop Fragments
+   # ---
+
+   # I have to say that fragments scare me more than anything.
+   # Sending lots of non-first fragments was what allowed Jolt2  to effectively "drown"
+   # Firewall-1. Fragments can be overlapped, and the subsequent interpretation of such
+   # fragments is very OS-dependent (see this paper for details).
+   # I am not going to trust any fragments.
+   # Log fragments just to see if we get any, and deny them too
+
+   for _dev in ${ext_if_arr[@]} ; do
+      if $log_fragments || $log_all ; then
+         $ipt -A INPUT -i $_dev -f -j LOG --log-prefix "$log_prefix IPTABLES FRAGMENTS: " --log-level $log_level
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -i $_dev -f -j LOG --log-prefix "$log_prefix IPTABLES FRAGMENTS: " --log-level $log_level
+         fi
+      fi
+      $ipt -A INPUT -i $_dev -f -j DROP
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -i $_dev -f -j DROP
+      fi
+   done
+
+
+   # ---
+   # - drop new packages without syn flag
+   # ---
+
+   #if $log_new_not_sync || $log_all  ; then
+   #   $ipt -A INPUT -p tcp ! --syn -m conntrack --ctstate NEW -j  LOG --log-prefix "$log_prefix New but not SYN: " --log-level $log_level
+   #   $ipt -A OUTPUT -p tcp ! --syn -m conntrack --ctstate NEW -j LOG --log-prefix "$log_prefix New but not SYN: " --log-level $log_level
+   #   if $kernel_activate_forwarding ; then
+   #      $ipt -A FORWARD -p tcp ! --syn -m conntrack --ctstate NEW -j LOG --log-prefix "$log_prefix New but not SYN: " --log-level $log_level
+   #   fi
+   #fi
+   #$ipt -A INPUT -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
+   #$ipt -A OUTPUT -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
+   #if $kernel_activate_forwarding ; then
+   #   $ipt -A FORWARD -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
+   #fi
+
+
+   # ---
+   # - drop invalid packages
+   # ---
+
+   #if $log_invalid_state || $log_all  ; then
+   #   $ipt -A INPUT -m conntrack --ctstate INVALID -j LOG --log-prefix "$log_prefix Invalid state: " --log-level $log_level
+   #   if $kernel_activate_forwarding ; then
+   #      $ipt -A FORWARD -m conntrack --ctstate INVALID -j LOG --log-prefix "$log_prefix Invalid state: " --log-level $log_level
+   #   fi
+   #fi
+   #$ipt -A INPUT -m conntrack --ctstate INVALID -j DROP
+   #if $kernel_activate_forwarding ; then
+   #   $ipt -A FORWARD -m conntrack --ctstate INVALID -j DROP
+   #fi
+
+
+   # ---
+   # - ungewöhnliche Flags verwerfen
+   # ---
+
+   for _dev in ${ext_if_arr[@]} ; do
+      if $log_invalid_flags || $log_all ; then
+         $ipt -A INPUT -i $_dev -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j LOG --log-prefix "$log_prefix Invalid flags: " --log-level $log_level
+         $ipt -A INPUT -i $_dev -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG --log-prefix "$log_prefix Invalid flags: " --log-level $log_level
+         $ipt -A INPUT -i $_dev -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "$log_prefix Invalid flags: " --log-level $log_level
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -i $_dev -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j LOG --log-prefix "$log_prefix Invalid flags: " --log-level $log_level
+            $ipt -A FORWARD -i $_dev -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG --log-prefix "$log_prefix Invalid flags: " --log-level $log_level
+            $ipt -A FORWARD -i $_dev -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "$log_prefix Invalid flags: " --log-level $log_level
+         fi
+      fi
+      $ipt -A INPUT -i $_dev -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
+      $ipt -A INPUT -i $_dev -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
+      $ipt -A INPUT -i $_dev -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -i $_dev -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
+         $ipt -A FORWARD -i $_dev -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
+         $ipt -A FORWARD -i $_dev -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
+      fi
+   done
+
+
+   # ---
+   # - Refuse private addresses on extern interfaces
+   # ---
+
+   # Refuse packets claiming to be from a 
+   #   Class A private network
+   #   Class B private network
+   #   Class C private network
+   #   loopback interface
+   #   Class D multicast address
+   #   Class E reserved IP address
+   #   broadcast address
+   for _dev in ${dsl_device_arr[@]} ; do
+      if $log_spoofed || $log_all ; then
+         $ipt -A INPUT -i $_dev -s $priv_class_a -j LOG --log-prefix "$log_prefix Class A private net: " --log-level $log_level
+         $ipt -A INPUT -i $_dev -s $priv_class_b -j LOG --log-prefix "$log_prefix Class B private net: " --log-level $log_level
+         $ipt -A INPUT -i $_dev -s $priv_class_c -j LOG --log-prefix "$log_prefix Class C private net: " --log-level $log_level
+         $ipt -A INPUT -i $_dev -s $loopback -j LOG --log-prefix "$log_prefix From Loopback: " --log-level $log_level
+         $ipt -A INPUT -i $_dev -s $class_d_multicast -j LOG --log-prefix "$log_prefix Class D Multicast: " --log-level $log_level
+         $ipt -A INPUT -i $_dev -s $class_e_reserved -j LOG --log-prefix "$log_prefix Class E reserved: " --log-level $log_level
+         #$ipt -A INPUT -i $_dev -d $broadcast_addr -j LOG --log-prefix "$log_prefix Broadcast Address: " --log-level $log_level
+         #
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -i $_dev -s $priv_class_a -j LOG --log-prefix "$log_prefix Class A private net: " --log-level $log_level
+            $ipt -A FORWARD -i $_dev -s $priv_class_b -j LOG --log-prefix "$log_prefix Class B private net: " --log-level $log_level
+            $ipt -A FORWARD -i $_dev -s $priv_class_c -j LOG --log-prefix "$log_prefix Class C private net: " --log-level $log_level
+            $ipt -A FORWARD -i $_dev -s $loopback -j LOG --log-prefix "$log_prefix From Loopback: " --log-level $log_level
+            $ipt -A FORWARD -i $_dev -s $class_d_multicast -j LOG --log-prefix "$log_prefix Class D Multicast: " --log-level $log_level
+            $ipt -A FORWARD -i $_dev -s $class_e_reserved -j LOG --log-prefix "$log_prefix Class E reserved: " --log-level $log_level
+            #$ipt -A FORWARD -i $_dev -d $broadcast_addr -j LOG --log-prefix "$log_prefix Broadcast Address: " --log-level $log_level
+         fi
+      fi
+      # Refuse packets claiming to be from a Class A private network.
+      $ipt -A INPUT -i $_dev -s $priv_class_a -j DROP
+      # Refuse packets claiming to be from a Class B private network.
+      $ipt -A INPUT -i $_dev -s $priv_class_b -j DROP
+      # Retfuse packets claiming to be from a Class C private network.
+      $ipt -A INPUT -i $_dev -s $priv_class_c -j DROP
+      # Refuse packets claiming to be from loopback interface.
+      $ipt -A INPUT -i $_dev -s $loopback -j DROP
+      # Refuse Class D multicast addresses. Multicast is illegal as a source address.
+      $ipt -A INPUT -i $_dev -s $class_d_multicast -j DROP
+      # Refuse Class E reserved IP addresses.
+      $ipt -A INPUT -i $_dev -s $class_e_reserved -j DROP
+      # Refuse broadcast address packets.
+      #$ipt -A INPUT -i $_dev -d $broadcast_addr -j DROP
+      if $kernel_activate_forwarding ; then
+         # Refuse packets claiming to be from a Class A private network.
+         $ipt -A FORWARD -i $_dev -s $priv_class_a -j DROP
+         # Refuse packets claiming to be from a Class B private network.
+         $ipt -A FORWARD -i $_dev -s $priv_class_b -j DROP
+         # Refuse packets claiming to be from a Class C private network.
+         $ipt -A FORWARD -i $_dev -s $priv_class_c -j DROP
+         # Refuse packets claiming to be from loopback interface.
+         $ipt -A FORWARD -i $_dev -s $loopback -j DROP
+         # Refuse Class D multicast addresses. Multicast is illegal as a source address.
+         $ipt -A FORWARD -i $_dev -s $class_d_multicast -j DROP
+         # Refuse Class E reserved IP addresses.
+         $ipt -A FORWARD -i $_dev -s $class_e_reserved -j DROP
+         # Refuse broadcast address packets.
+         #$ipt -A FORWARD -i $_dev -d $broadcast_addr -j DROP
+      fi
+   done
+
+
+   # ---
+   # - Refuse packets claiming to be to the loopback interface.
+   # ---
+
+   # Refusing packets claiming to be to the loopback interface protects against
+   # source quench, whereby a machine can be told to slow itself down by an icmp source
+   # quench to the loopback.
+   for _dev in ${ext_if_arr[@]} ; do
+      if $log_to_lo || $log_all ; then
+         $ipt -A INPUT -i $_dev -d $loopback -j LOG --log-prefix "$log_prefix To Loopback: " --log-level $log_level
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -i $_dev -d $loopback -j LOG --log-prefix "$log_prefix To Loopback: " --log-level $log_level
+         fi
+      fi
+      $ipt -A INPUT -i $_dev -d $loopback -j DROP
+      if $kernel_activate_forwarding  ; then
+         $ipt -A FORWARD -i $_dev -d $loopback -j DROP
+      fi
+   done
+
+
+   # ---
+   # - Don't allow spoofing from that server
+   # ---
+
+   for _dev in ${dsl_device_arr[@]} ; do
+      if $log_spoofed_out || $log_all ; then
+         $ipt -A OUTPUT -o $_dev -s $priv_class_a -j LOG --log-prefix "$log_prefix out Class A: " --log-level $log_level
+         $ipt -A OUTPUT -o $_dev -s $priv_class_b -j LOG --log-prefix "$log_prefix out Class B: " --log-level $log_level
+         $ipt -A OUTPUT -o $_dev -s $priv_class_c -j LOG --log-prefix "$log_prefix out Class C: " --log-level $log_level
+         $ipt -A OUTPUT -o $_dev -s $loopback -j LOG --log-prefix "$log_prefix out Loopback: " --log-level $log_level
+      fi
+      $ipt -A OUTPUT -o $_dev -s $priv_class_a -j DROP
+      $ipt -A OUTPUT -o $_dev -s $priv_class_b -j DROP
+      $ipt -A OUTPUT -o $_dev -s $priv_class_c -j DROP
+      $ipt -A OUTPUT -o $_dev -s $loopback -j DROP
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# -------------
+# --- Log VoIP Traffic (local telephone systems ( ${tel_sys_ip_arr[@]})
+# -------------
+
+if $log_voip || $log_all ; then
+   for _ip in ${tel_sys_ip_arr[@]} ; do
+      $ipt -A FORWARD -d $_ip -j LOG --log-prefix "$log_prefix [VoIP] " --log-level $log_level
+   done
+fi
+#for _PORT in ${VOIP_PORTS} ; do
+#   $ipt -A FORWARD -p udp --sport $_PORT -j LOG --log-prefix "$log_prefix [VoIP] " --log-level $log_level
+#done
+
+
+# -------------
+# ------------- Stopping firewall here if requested (parameter stop)
+# -------------
+
+
+case $1 in
+   sto*)
+      echo
+      if $terminal ; then
+         echo -e "\t\033[37m\033[1mStop was requested. No more firewall rules..\033[m"
+      else
+         echo "Stop was requested. No more firewall rules.."
+      fi
+      echo
+      exit 0;;
+esac
+
+
+echo
+
+
+# -------------
+# --- iPerf
+# -------------
+
+# iPerf is a tool for active measurements of the maximum achievable bandwidth on IP networks. 
+# It supports tuning of various parameters related to timing, buffers and protocols (TCP, UDP, 
+# SCTP with IPv4 and IPv6). For each test it reports the bandwidth, loss, and other parameters.
+
+echononl "\tCreate \"iPerf\" rules.."
+if $create_iperf_rules ; then
+   $ipt -A INPUT -p tcp --dport 5001 -j ACCEPT
+   $ipt -A INPUT -p tcp --sport 5001 -j ACCEPT
+   #
+   $ipt -A OUTPUT -p tcp --dport 5001 -j ACCEPT
+   $ipt -A OUTPUT -p tcp --sport 5001 -j ACCEPT
+   if $kernel_activate_forwarding ; then
+      $ipt -A FORWARD -p tcp --dport 5001 -j ACCEPT
+      $ipt -A FORWARD -p tcp --sport 5001 -j ACCEPT
+   fi
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Drop packets not wanted on gateway
+# ---
+
+echononl "\tDrop packets not wanted on gateway"
+
+for _dev in ${local_if_arr[@]} ; do
+   if $log_not_wanted || $log_all ; then
+      if $not_wanted_ident ; then
+         $ipt -A INPUT -i $_dev -p tcp --dport $standard_ident_port -j LOG --log-prefix "$log_prefix not wanted: " --log-level $log_level
+      fi
+      for _port in ${not_wanted_on_gw_tcp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p tcp --dport $_port -j LOG --log-prefix "$log_prefix not wanted: " --log-level $log_level
+      done
+      for _port in ${not_wanted_on_gw_udp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p udp --dport $_port -j LOG --log-prefix "$log_prefix not wanted: " --log-level $log_level
+      done
+   fi
+   if $not_wanted_ident ; then
+      $ipt -A INPUT -i $_dev -p tcp --dport $standard_ident_port -j REJECT --reject-with tcp-reset 
+   fi
+   for _port in ${not_wanted_on_gw_tcp_port_arr[@]} ; do
+      $ipt -A INPUT -i $_dev -p tcp --dport $_port -j DROP
+   done
+   for _port in ${not_wanted_on_gw_udp_port_arr[@]} ; do
+      $ipt -A INPUT -i $_dev -p udp --dport $_port -j DROP
+   done
+done
+
+echo_done
+
+
+# -------------
+# --- Generally prohibited from WAN
+# -------------
+
+echononl "\tGenerally prohibited from WAN"
+
+for _dev in ${ext_if_arr[@]} ; do
+   if $log_prohibited || $log_all ; then
+      if $block_ident ; then
+         $ipt -A INPUT -p tcp -i $_dev --dport $standard_ident_port -j LOG --log-prefix "$log_prefix gen. prohibited: " --log-level $log_level
+      fi
+      for _port in ${block_tcp_port_arr[@]} ; do
+         $ipt -A INPUT -p tcp -i $_dev --dport $_port -j LOG --log-prefix "$log_prefix gen. prohibited: " --log-level $log_level
+      done
+      for _port in ${block_udp_port_arr[@]} ; do
+         $ipt -A INPUT -p udp -i $_dev --dport $_port -j LOG --log-prefix "$log_prefix gen. prohibited: " --log-level $log_level
+      done
+      if $kernel_activate_forwarding ; then
+         if $block_ident ; then
+            $ipt -A FORWARD -p tcp -i $_dev --dport $standard_ident_port -j LOG --log-prefix "$log_prefix gen. prohibited: " --log-level $log_level
+         fi
+         for _port in ${block_tcp_port_arr[@]} ; do
+            $ipt -A FORWARD -p tcp -i $_dev --dport $_port -j LOG --log-prefix "$log_prefix gen. prohibited: " --log-level $log_level
+         done
+         for _port in ${block_udp_port_arr[@]} ; do
+            $ipt -A FORWARD -p udp -i $_dev --dport $_port -j LOG --log-prefix "$log_prefix gen. prohibited: " --log-level $log_level
+         done
+      fi
+   fi
+   if $block_ident ; then
+       $ipt -A INPUT -p tcp -i $_dev --dport $standard_ident_port -j REJECT --reject-with tcp-reset
+   fi
+   for _port in ${block_tcp_port_arr[@]} ; do
+      $ipt -A INPUT -p tcp -i $_dev --dport $_port -j DROP
+   done
+   for _port in ${block_udp_port_arr[@]} ; do
+      $ipt -A INPUT -p udp -i $_dev --dport $_port -j DROP
+   done
+   if $kernel_activate_forwarding ; then
+      if $block_ident ; then
+         $ipt -A FORWARD -p tcp -i $_dev --dport $standard_ident_port -j REJECT --reject-with tcp-reset
+      fi
+      for _port in ${block_tcp_port_arr[@]} ; do
+         $ipt -A FORWARD -p tcp -i $_dev --dport $_port -j DROP
+      done
+      for _port in ${block_udp_port_arr[@]} ; do
+         $ipt -A FORWARD -p udp -i $_dev --dport $_port -j DROP
+      done
+   fi
+done
+
+echo_done
+echo
+
+
+# -------------
+# --- Traffic generally allowed
+# -------------
+
+echononl "\tLoopback device generally allowed.."
+
+# ---
+# - Loopback device
+# ---
+
+$ipt -A INPUT -i lo -j ACCEPT
+$ipt -A OUTPUT -o lo -j ACCEPT
+
+echo_done
+
+
+# ---
+# - Allow all Traffic from source mac-address
+# ---
+
+echononl "\tAllow all Traffic from MAC Source-Address"
+
+if [[ ${#allow_all_mac_src_address_arr[@]} -gt 0 ]] ; then
+   for _mac in ${allow_all_mac_src_address_arr[@]} ; do
+      for _dev in ${local_if_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -m mac --mac-source $_mac -j ACCEPT
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -i $_dev -m mac --mac-source $_mac -j ACCEPT
+         fi
+      done 
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Allow local Traffic from source mac-address
+# ---
+
+echononl "\tAllow local Traffic from MAC Source-Address"
+
+
+if [[ ${#allow_local_mac_src_address_arr[@]} -gt 0 ]] ; then
+   for _mac in ${allow_local_mac_src_address_arr[@]} ; do
+      for _dev in ${local_if_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -m mac --mac-source $_mac -j ACCEPT
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -o $_dev -m mac --mac-source $_mac -j ACCEPT
+         fi
+      done 
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Allow remote Traffic from source mac-address
+# ---
+
+echononl "\tAllow remote Traffic from MAC Source-Address"
+
+
+if [[ ${#allow_remote_mac_src_address_arr[@]} -gt 0 ]] ; then
+   for _mac in ${allow_remote_mac_src_address_arr[@]} ; do
+      for _dev in ${ext_if_arr[@]} ; do
+         if $kernel_activate_forwarding ; then
+            $ipt -A FORWARD -o $_dev -m mac --mac-source $_mac -j ACCEPT
+         fi
+      done 
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Already established connections
+# ---
+
+echononl "\tAccept already established connections.."
+
+$ipt -A INPUT -p ALL -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+$ipt -A OUTPUT -p ALL -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+if $kernel_activate_forwarding ; then
+   $ipt -A FORWARD -p ALL -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+fi
+
+echo_done
+
+
+# ---
+# - Permit all traffic through VPN lines
+# ---
+echononl "\tPermit all traffic through VPN lines.."
+for _vpn_if in ${vpn_if_arr[@]} ; do
+   $ipt -A INPUT -i $_vpn_if -m conntrack --ctstate NEW -j ACCEPT
+   if $kernel_activate_forwarding ; then
+      for _local_dev in ${local_if_arr[@]} ; do
+         $ipt -A FORWARD -i $_vpn_if -o $_local_dev -m conntrack --ctstate NEW -j ACCEPT
+      done
+   fi
+done
+echo_done
+
+
+
+# ---
+# - Telefon Systems
+# ---
+
+echononl "\tAllow all Traffic between Telefon Systems"
+if [[ ${#tele_sys_ip_arr[@]} -gt 1 ]] && $allow_between_tele_systems && ! $permit_between_local_networks ; then
+   for _ip_1 in ${tele_sys_ip_arr[@]} ; do
+      for _ip_2 in ${tele_sys_ip_arr[@]} ; do
+         #[[ "$_ip_1" = "$_ip_2" ]] && continue
+         $ipt -A FORWARD -s $_ip_1 -d $_ip_2 -p ALL -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Telefon Systems to remote SIP-Server
+# ---
+
+echononl "\tTelefon System to remote SIP-Server"
+if [[ ${#tele_sys_ip_arr[@]} -gt 0 ]] ; then
+   if [ -z "$tele_sys_remote_sip_server_port" -o -z "$tele_sys_local_sip_server_port" ] ; then
+      echo_failed
+      warn "Local or remote SIP Port not given"!
+   else
+      for _ip in ${tele_sys_ip_arr[@]} ; do
+         $ipt -A FORWARD -p udp -s $_ip --sport $tele_sys_local_sip_server_port \
+            --dport $tele_sys_remote_sip_server_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+   fi
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - All request from local networks to the internet
+# ---
+
+echononl "\tPermit all traffic from local networks to the internet.."
+if $permit_local_net_to_inet ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p ALL -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -o $_dev -p ALL -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Networks not firewalled through extern interfaces
+# ---
+
+echononl "\tAllow these local networks any access to the internet"
+if [[ ${#any_access_to_inet_network_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   for _net in ${any_access_to_inet_network_arr[@]}; do
+      for _dev in ${ext_if_arr[@]} ; do
+         $ipt -A FORWARD -o $_dev -p ALL -s $_net -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Allow local services from given local networks
+# ---
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+echononl "\tAllow local services from given local networks"
+if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   for _val in "${allow_local_net_to_local_service_arr[@]}" ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      $ipt -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $local_alias_interfaces ; then
+         if [[ "${_val_arr[3]}" = "tcp" ]]; then
+            $ipt -A FORWARD -p tcp -d ${_val_arr[1]} --dport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -p tcp -s ${_val_arr[1]} --sport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
+         fi
+      fi
+   done
+   
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Allow all traffic from local network to local ip-address
+# ---
+
+echononl "\tAllow all traffic from local network to local ip-address"
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   for _val in ${allow_local_net_to_local_ip_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      $ipt -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+   echo_ok
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Allow all traffic from local ip-address to local network
+# ---
+
+echononl "\tAllow all traffic from local ip-address to local network"
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+if [[ ${#allow_local_ip_to_local_net_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   for _val in ${allow_local_ip_to_local_net_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      $ipt -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+   echo_ok
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Allow all traffic from (one) local network to (another) local network
+# ---
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+echononl "\tAllow all traffic from local network to (another) local network"
+
+if [[ ${#allow_local_net_to_local_net_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   for _val in ${allow_local_net_to_local_net_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      $ipt -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+   echo_ok
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Allow local ip address from given local interface
+# ---
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+echononl "\tAllow local ip address from given local interface"
+
+if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   for _val in ${allow_local_if_to_local_ip_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      $ipt -A FORWARD -p ALL -i ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -i ${_val_arr[0]} -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -o ${_val_arr[0]} -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+   echo_ok
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Separate local networks
+# ---
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+echononl "\tSeparate local networks.."
+
+if [[ ${#separate_local_network_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _net in ${separate_local_network_arr[@]}; do
+      for _dev in ${local_if_arr[@]} ; do
+         $ipt -A FORWARD -o $_dev -p all -s $_net -j DROP
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Separate local interfaces
+# ---
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+echononl "\tSeparate local interfaces.."
+
+if [[ ${#separate_local_if_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _dev_1 in ${separate_local_if_arr[@]}; do
+      for _dev_2 in ${local_if_arr[@]} ; do
+         [[ "$_dev_1" = "$_dev_2" ]] && continue
+         $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -p all -j DROP
+         $ipt -A FORWARD -i $_dev_2 -o $_dev_1 -p all -j DROP
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Permit all traffic between local networks
+# ---
+
+echononl "\tPermit all traffic between local networks.."
+if $kernel_activate_forwarding ; then
+   if $permit_between_local_networks ; then
+      for _dev_1 in ${local_if_arr[@]} ; do
+         for _dev_2 in ${local_if_arr[@]} ; do
+
+            # - Notice:
+            # - In case of routing multiple netwoks on the same interface or 
+            # - using alias interfaces like eth0:0, you need a rule with
+            # - incomming- and outgoing interface are equal!
+            # -
+            # - So DON'T add statement like this:
+            # -    [[ "$_dev_2" = "$_dev_1" ]] && continue
+            # -
+            $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -p ALL -m conntrack --ctstate NEW -j ACCEPT
+
+            # - Note:
+            # - If (local) alias interfaces like eth1:0 in use, youe need a further
+            # - special rule.
+            # -
+            if [[ "$_dev_2" = "$_dev_1" ]] && $local_alias_interfaces ; then
+               $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -p tcp --tcp-flag ACK ACK -j ACCEPT
+            fi
+
+         done
+      done
+      echo_done
+   else
+      echo_skipped
+   fi
+else
+   echo_skipped
+fi
+
+
+
+# -------------
+# --- Services
+# -------------
+
+echo
+if $terminal ; then
+   echo -e "\t\033[37m\033[1mAdd Rules for Services..\033[m"
+else
+   echo "Add Rules for Services.."
+fi
+
+
+# ---
+# - IPv6 over IPv4 (Tunnel Provider SixXS)
+# ---
+
+echononl "\t\tIPv6 Tunnel SixXS"
+if $local_sixxs_service ; then
+   if [ -n "$tic_server" -a -n "$six_pop_server" ]; then
+      # TIC (tunnel information & control) packages, from/to tic.sixxs.net
+      $ipt -A OUTPUT -p tcp -d $tic_server --dport 3874 -m conntrack --ctstate NEW -j ACCEPT
+
+      # heartbeat packets (outgoing only)
+      $ipt -A OUTPUT -p udp -d $six_pop_server --dport 3740 -m conntrack --ctstate NEW -j ACCEPT
+
+      # 6over4 tunnel packets
+      $ipt -A OUTPUT -p 41 -d $six_pop_server -j ACCEPT
+      $ipt -A INPUT -p 41 -d $six_pop_server -j ACCEPT
+
+      echo_done
+   else
+      echo_skipped
+   fi
+else
+   echo_skipped
+fi
+
+
+# ---
+# - DHCP
+# ---
+
+echononl "\t\tDHCP"
+
+if $local_dhcp_service ; then
+   # - Allow requests from intern networks
+   for _dev in ${local_if_arr[@]} ; do
+      # - in
+      $ipt -A INPUT -p udp -i $_dev -s 0/0 --sport 68 -d 255.255.255.255 --dport 67 -j ACCEPT
+      # - out
+      $ipt -A OUTPUT -p udp -o $_dev --sport 67 -d 0/0 --dport 68 -j ACCEPT
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - DHCP Failover
+# ---
+
+echononl "\t\tDHCP Failover Server"
+if $local_dhcp_service && [[ ${#dhcp_failover_server_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${dhcp_failover_server_ip_arr[@]} ; do
+      $ipt -A INPUT -p tcp --dport $dhcp_failover_port -s $_ip -m conntrack --ctstate NEW -j ACCEPT
+      $ipt -A OUTPUT -p tcp -d $_ip --dport $dhcp_failover_port -m conntrack --ctstate NEW -j ACCEPT
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - DNS out only
+# ---
+
+echononl "\t\tDNS out only"
+
+# - Nameservers on the INET must be reachable for the local recursiv nameserver
+# - but also for all others
+# -
+for _dev in ${ext_if_arr[@]} ; do
+   # - out from local and virtual mashine(s)
+   $ipt -A OUTPUT -o $_dev -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+   #$ipt -A OUTPUT -o $_dev -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+
+   # - Only useful (needed) if kernel forwarding is activated (kernel_activate_forwarding=true)
+   if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+      # - forward from virtual mashine(s)
+      $ipt -A FORWARD -o $_dev -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+      #$ipt -A FORWARD -o $_dev -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+   fi
+done
+
+echo_done
+
+
+# ---
+# - DNS Service Gateway
+# ---
+
+echononl "\t\tDNS Service Gateway"
+
+# - Local Nameservice
+# -
+if $local_dns_service ; then
+
+   # - Allow requests from local networks
+   # -
+   for _dev in ${local_if_arr[@]} ; do
+      # - in
+      $ipt -A INPUT -i $_dev -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+   done
+
+   # - Zonetransfere (uses tcp/53)
+   # 
+   for _ip in ${dns_server_ips[@]} ; do
+      # - out
+      # -
+      # - local master (here) gets request for a zone from slave ($_ip)
+      $ipt -A INPUT -p tcp -s $_ip --sport $unprivports --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+
+      # - in
+      # -
+      # - local slave (here) requests zone from master ($_ip)
+      $ipt -A OUTPUT -p tcp --sport $unprivports -d $_ip --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+   done
+
+   echo_done
+else 
+   echo_skipped
+fi
+
+
+# ---
+# - DNS Services at local Network
+# ---
+
+echononl "\t\tDNS Service local Network"
+
+# - Make nameservers at the local network area rechable for all
+# -
+if [[ ${#dns_server_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${dns_server_ip_arr[@]} ; do
+      $ipt -A OUTPUT -p udp -d $_ip --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p udp -d $_ip --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - SSH out only
+# ---
+
+echononl "\t\tSSH out only"
+
+if $allow_ssh_request_out && ! $permit_local_net_to_inet ; then
+   # - Provide SSH to everywhere (also LAN)
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_ssh_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_ssh_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+   for _dev in ${local_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_ssh_port -m conntrack --ctstate NEW -j ACCEPT
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - SSH Service Gateway
+# ---
+
+echononl "\t\tSSH Service Gateway (also from WAN)"
+
+if $local_ssh_service ; then
+   # - Provides SSH in from everywhere
+   for _port in ${ssh_port_arr[@]} ; do
+      $ipt -A INPUT -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - SSH Services only local Network
+# ---
+
+echononl "\t\tSSH Services only local Network"
+
+if [[ ${#ssh_server_only_local_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${ssh_server_only_local_ip_arr[@]} ; do
+      for _port in ${ssh_port_arr[@]} ; do
+
+         $ipt -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+
+         if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+            for _dev in ${local_if_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p tcp -d $_ip -dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+         fi
+
+         # - Note:
+         # - If (local) alias interfaces like eth1:0 in use, youe need a further
+         # - special rule.
+         # -
+         if $kernel_activate_forwarding && $local_alias_interfaces ; then
+            $ipt -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
+         fi
+
+      done
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - SSH Services DMZ
+# ---
+
+echononl "\t\tSSH Services DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#ssh_server_dmz_arr[@]} -gt 0 ]] ; then
+   for _ip in "${!ssh_server_dmz_arr[@]}"; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${ssh_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      for _port in ${ssh_port_arr[@]} ; do
+
+         $ipt -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+
+         if $kernel_activate_forwarding ; then
+
+            # - Nat if interface is on a dsl line
+            # -
+            if containsElement "${ssh_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+               $ipt -t nat -A PREROUTING -i ${ssh_server_dmz_arr[$_ip]} -p tcp --dport $_port -j DNAT --to $_ip:$_port
+            fi
+            $ipt -A FORWARD -i ${ssh_server_dmz_arr[$_ip]} -p tcp --dport $_port -d $_ip -m conntrack --ctstate NEW -j ACCEPT
+         fi
+
+         # - From intern
+         if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+            for _dev in ${local_if_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p tcp -d $_ip -m multiport --dports $_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+         fi
+
+         # - Rule is needed if (local) interface aliases in use (like eth0:1)
+         # -
+         if $kernel_activate_forwarding && $local_alias_interfaces ; then
+            for _port in ${ssh_port_arr[@]} ; do
+               $ipt -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
+               $ipt -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
+            done
+         fi
+
+      done
+
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - SSH Service between local Netwotks
+# ---
+
+echononl "\t\tSSH Service between local Netwotks"
+if $allow_ssh_between_local_nets ; then
+   if $kernel_activate_forwarding ; then
+      for _dev_1 in ${local_if_arr[@]} ; do
+
+         for _port in ${ssh_port_arr[@]} ; do
+            $ipt -A OUTPUT -o $_dev_1 -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+
+         for _dev_2 in ${local_if_arr[@]} ; do
+
+            if ! $permit_between_local_networks ; then
+               # - Notice:
+               # - In case of routing multiple netwoks on the same interface or 
+               # - using alias interfaces like eth0:0, you need a rule with
+               # - incomming- and outgoing interface are equal!
+               # -
+               # - So DON'T add statement like this:
+               # -    [[ "$_dev_2" = "$_dev_1" ]] && continue
+               # -
+               for _port in ${ssh_port_arr[@]} ; do
+                  $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+               done
+            fi
+
+            # - Note:
+            # - If (local) alias interfaces like eth1:0 in use, youe need a further
+            # - special rule.
+            # -
+            if [[ "$_dev_2" = "$_dev_1" ]] && $local_alias_interfaces ; then
+               for _port in ${ssh_port_arr[@]} ; do
+                  $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -p tcp --sport $_port --tcp-flag ACK ACK -j ACCEPT
+                  $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -p tcp --dport $_port --tcp-flag ACK ACK -j ACCEPT
+               done
+            fi
+         done
+      done
+   fi
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - VPN Service only out
+# ---
+
+echononl "\t\tVPN Service only out"
+
+if $allow_vpn_out && [[ ${#vpn_out_port_arr[@]} -gt 0 ]]; then
+   for _dev in ${ext_if_arr[@]} ; do
+      for _port in ${vpn_out_port_arr[@]} ; do
+         $ipt -A OUTPUT -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+            $ipt -A FORWARD -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         fi
+      done
+   done
+
+   for _vpn_if in ${vpn_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_vpn_if -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -o $_vpn_if -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - VPN Service Gateway
+# ---
+
+echononl "\t\tVPN Service Gateway"
+
+if $local_vpn_service ; then
+
+   # - Cconnection establishment
+   # -
+   for _port in ${vpn_gw_port_arr[@]} ; do
+      $ipt -A INPUT -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+   done
+   echo_done
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - VPN Service DMZ
+# ---
+
+echononl "\t\tVPN Service DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#vpn_server_dmz_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _ip in ${!vpn_server_dmz_arr[@]} ; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${vpn_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      for _port in ${vpn_local_net_port_arr[@]} ; do
+         $ipt -A FORWARD -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Nat if interface is on a dsl line
+         # -
+         if containsElement "${vpn_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+            $ipt -t nat -A PREROUTING -i ${vpn_server_dmz_arr[$_ip]} -p udp --dport $_port -j DNAT --to $_ip:$_port
+         fi
+      done
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - HTTP(S) OUT
+# ---
+
+echononl "\t\tHTTP(S) out only"
+
+if $allow_http_request_out && ! $permit_local_net_to_inet ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - HTTP(S) (local) Webserver
+# ---
+
+echononl "\t\tHTTP(S) Services Gateway"
+# - Access to the local Webservice
+if $local_http_service ; then
+   $ipt -A INPUT -p tcp -m multiport --dports $http_ports -m conntrack --ctstate NEW -j ACCEPT
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - HTTP(S) Services only local Network
+# ---
+
+echononl "\t\tHTTP(S) Services only local Network"
+# - Access to the Webservices (LAN)
+if [[ ${#http_server_only_local_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${http_server_only_local_ip_arr[@]} ; do
+      $ipt -A OUTPUT -p tcp -d $_ip -m multiport --dports $http_ports -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip -m multiport --dports $http_ports -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip -m multiport --dports $http_ports --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip -m multiport --sports $http_ports --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - HTTP(S) Services DMZ
+# ---
+
+echononl "\t\tHTTP(S) Services DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#http_server_dmz_arr[@]} -gt 0 ]] ; then
+   http_port_arr=(${http_ports//,/ })  
+   for _ip in "${!http_server_dmz_arr[@]}"; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${http_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      for _port in ${http_port_arr[@]}  ; do
+         $ipt -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         if $kernel_activate_forwarding ; then
+
+            # - Nat if interface is on a dsl line
+            # -
+            if containsElement "${http_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+               $ipt -t nat -A PREROUTING -i ${http_server_dmz_arr[$_ip]} -p tcp --dport $_port -j DNAT --to $_ip:$_port
+            fi
+            $ipt -A FORWARD -i ${http_server_dmz_arr[$_ip]} -p tcp --dport $_port -d $_ip -m conntrack --ctstate NEW -j ACCEPT
+         fi
+      done
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip -m multiport --dports $http_ports -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+      # - Rule is needed if (local) interface aliases in use (like eth0:1)
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip -m multiport --dports $http_ports --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip -m multiport --sports $http_ports --tcp-flag ACK ACK -j ACCEPT
+      fi
+
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - HTTPS Services DMZ (only port 443)
+# ---
+
+echononl "\t\tHTTPS Services DMZ (only port $standard_https_port)"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#http_ssl_server_dmz_arr[@]} -gt 0 ]] ; then
+   for _ip in "${!http_ssl_server_dmz_arr[@]}"; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${http_ssl_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      $ipt -A OUTPUT -p tcp -d $_ip --dport $standard_https_port -m conntrack --ctstate NEW -j ACCEPT
+
+      # - From extern
+      if $kernel_activate_forwarding ; then
+
+         # - Nat if interface is on a dsl line
+         # -
+         if containsElement "${http_ssl_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+            $ipt -t nat -A PREROUTING -i ${http_ssl_server_dmz_arr[$_ip]} -p tcp --syn --dport $standard_https_port -j DNAT --to $_ip:$standard_https_port
+         fi
+         $ipt -A FORWARD -i ${http_ssl_server_dmz_arr[$_ip]} -p tcp --dport $standard_https_port -d $_ip -j ACCEPT
+      fi
+
+      # - From intern
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $standard_https_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+      # - Rule is needed if (local) interface aliases in use (like eth0:1)
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip --dport $standard_https_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport $standard_https_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Mail Service SMTP only out
+# ---
+
+echononl "\t\tMail Services SMTP only out"
+
+if $allow_smtp_request_out && ! $permit_local_net_to_inet ; then
+   # - Provide SMTP out for all to WAN
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -p tcp -o $_dev --dport $standard_smtp_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -p tcp -o $_dev --dport $standard_smtp_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Mail User Services smtps/pop(s)/imap(s) only out
+# ---
+
+echononl "\t\tMail Services smtps/pop(s)/imap(s) only out"
+
+if $allow_mail_request_out && ! $permit_local_net_to_inet ; then
+   # - Provide using Mailservices (WAN) from whole LAN
+   # -
+   # - Not needed from local machine. But for testing pupose (i.e. telnet <port>)
+   # -
+   # - 
+   for _dev in ${ext_if_arr[@]} ; do
+      if $provide_mailservice_from_local ; then
+         # - Note!
+         # - this provides access both to LAN and WAN
+         $ipt -A OUTPUT -p tcp -m multiport --dports $standard_mailuser_ports -m conntrack --ctstate NEW -j ACCEPT
+      fi
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         for _dev in ${ext_if_arr[@]} ; do
+            $ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $standard_mailuser_ports -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Mail Service SMTP only local Networks
+# ---
+
+echononl "\t\tMail Service SMTP only local Networks"
+if [[ ${#mail_server_only_local_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${mail_server_only_local_ip_arr[@]} ; do
+      $ipt -A OUTPUT -p tcp -d $_ip --dport $standard_smtp_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $standard_smtp_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip --dport $standard_smtp_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport $standard_smtp_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+
+      echo_done
+   done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Mail Services smtps/pop(s)/imap(s) only local Networks
+# ---
+
+echononl "\t\tMail Services smtps/pop(s)/imap(s) only local Networks"
+
+if [[ ${#mail_server_only_local_ip_arr[@]} -gt 0 ]]; then
+   for _ip in ${mail_server_only_local_ip_arr[@]} ; do
+      $ipt -A OUTPUT -p tcp -d $_ip -m multiport --dports $mail_user_ports -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip -m multiport --dports $mail_user_ports -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip -m multiport --dports $mail_user_ports --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip -m multiport --sports $mail_user_ports --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Mail Server DMZ
+# ---
+
+echononl "\t\tMail Server DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#mail_server_dmz_arr[@]} -gt 0 ]] ; then
+   mail_port_arr=(${mail_user_ports//,/ })  
+   mail_port_arr+=("$mail_smtp_port")
+   for _ip in "${!mail_server_dmz_arr[@]}"; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${mail_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      for _port in ${mail_port_arr[@]}  ; do
+         $ipt -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Nat if interface is on a dsl line
+         # -
+         if containsElement "${mail_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+            $ipt -t nat -A PREROUTING -i ${mail_server_dmz_arr[$_ip]} -p tcp --dport $_port -m conntrack --ctstate NEW -j DNAT --to $_ip:$_port
+         fi
+         $ipt -A FORWARD -i ${mail_server_dmz_arr[$_ip]} -p tcp --dport $_port -d $_ip -m conntrack --ctstate NEW -j ACCEPT
+      done
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip -m multiport --dports $mail_smtp_port,$mail_user_ports -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip -m multiport --dports $mail_smtp_port,$mail_user_ports --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip -m multiport --sports $mail_smtp_port,$mail_user_ports --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - FTP out only
+# ---
+
+echononl "\t\tFTP out only"
+
+if $allow_ftp_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport 21 -m conntrack --ctstate NEW -j ACCEPT
+      $ipt -A OUTPUT -o $_dev -p tcp --sport $unprivports --dport $unprivports -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+            $ipt -A FORWARD -o $_dev -p tcp --dport 21 -m conntrack --ctstate NEW -j ACCEPT
+            $ipt -A FORWARD -o $_dev -p tcp --sport $unprivports --dport $unprivports -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_done
+fi
+
+
+# ---
+# - FTP Service Gateway
+# ---
+
+echononl "\t\tFTP Service Gateway"
+
+if $local_ftp_service ; then
+   $ipt -A INPUT -p tcp  --dport $standard_ftp_port --sport $unprivports -m conntrack --ctstate NEW -j ACCEPT
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - FTP Services only local Network
+# ---
+
+echononl "\t\tFTP Service local Networks"
+if [[ ${#ftp_server_only_local_ip_arr[@]} -gt 0 ]] &&  $kernel_activate_forwarding ; then
+   for _ip in ${ftp_server_only_local_ip_arr[@]} ; do
+      $ipt -A OUTPUT -p tcp -d $_ip --dport 21 --sport $unprivports -m conntrack --ctstate NEW -j ACCEPT
+
+      if ! $permit_between_local_networks ; then
+         $ipt -A FORWARD -p tcp -d $_ip --dport 21 --sport $unprivports -m conntrack --ctstate NEW -j ACCEPT
+      fi
+
+      if $local_alias_interfaces ; then
+         # - Control Port
+         $ipt -A FORWARD -p tcp -d $_ip --dport 21 --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport 21 --tcp-flag ACK ACK -j ACCEPT
+         # - Data Port activ
+         $ipt -A FORWARD -p tcp -d $_ip --dport 20 --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport 20 --tcp-flag ACK ACK -j ACCEPT
+         # - Data Port passiv
+         $ipt -A FORWARD -p tcp -d $_ip --sport $unprivports --dport $unprivports --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - FTP Services DMZ
+# ---
+
+echononl "\t\tFTP Service DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#ftp_server_dmz_arr[@]} -gt 0 ]] && [[ -n $ftp_passive_port_range ]]; then
+   IFS=':' read -a ftp_passive_port_arr <<< "${ftp_passive_port_range}"
+   for _ip in "${!ftp_server_dmz_arr[@]}"; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${ftp_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      $ipt -A OUTPUT -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
+
+      # - From extern
+      if $kernel_activate_forwarding ; then 
+         $ipt -A FORWARD -i ${ftp_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Nat if interface is on a dsl line
+         # -
+         if containsElement "${ftp_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+            $ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport 21 -j DNAT --to $_ip:21
+            $ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport 20 -j DNAT --to $_ip:20
+            $ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport $ftp_passive_port_range -j DNAT --to $_ip:${ftp_passive_port_arr[0]}-${ftp_passive_port_arr[1]}
+         fi
+      fi
+
+      # - From intern
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+      # - Rule is needed if (local) interface aliases in use (like eth0:1)
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+
+         # - Control Port
+         $ipt -A FORWARD -p tcp -d $_ip --dport 21 --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport 21 --tcp-flag ACK ACK -j ACCEPT
+         # - Data Port activ
+         $ipt -A FORWARD -p tcp -d $_ip --dport 20 --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport 20 --tcp-flag ACK ACK -j ACCEPT
+         # - Data Port passiv
+         $ipt -A FORWARD -p tcp -d $_ip --sport $unprivports --dport $ftp_passive_port_range --tcp-flag ACK ACK -j ACCEPT
+
+      fi
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+   
+
+# ---
+# - TFTF Service out only
+# ---
+
+echononl "\t\tTFTF Service out only"
+
+if $allow_tftp_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p udp --dport $standard_tftp_udp_port  -m conntrack --ctstate NEW -j ACCEPT
+   done
+
+   if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+      $ipt -A FORWARD -o $_dev -p udp --dport $standard_tftp_udp_port  -m conntrack --ctstate NEW -j ACCEPT
+   fi
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - TFTP Service Gateway
+# ---
+
+echononl "\t\tTFTF Service Gateway"
+
+if $local_tftp_service ; then
+   $ipt -A INPUT -p udp --dport $tftp_udp_port  -m conntrack --ctstate NEW -j ACCEPT
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Samba Service Gateway (only for local Networks)
+# ---
+
+echononl "\t\tSamba Service Gateway (only for local Networks)"
+
+if $local_samba_service ; then
+   for _dev in ${local_if_arr[@]} ; do
+      for _port in ${samba_udp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+      for _port in ${samba_tcp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Samba Service only between local Networks
+# ---
+
+echononl "\t\tSamba Service only local Networks"
+
+if [[ ${#samba_server_local_ip_arr[@]} -gt 0 ]] ; then
+   for _dev in ${local_if_arr[@]} ; do
+      for _ip in ${samba_server_local_ip_arr[@]} ; do
+         for _port in ${samba_udp_port_arr[@]} ; do
+            $ipt -A OUTPUT -o $_dev -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         for _port in ${samba_tcp_port_arr[@]} ; do
+            $ipt -A OUTPUT -o $_dev -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         if $kernel_activate_forwarding && $allow_samba_between_local_nets && ! $permit_between_local_networks ; then
+
+            for _port in ${samba_udp_port_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+            for _port in ${samba_tcp_port_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+
+            # - Rule is needed if (local) interface aliases in use (like eth0:1)
+            # -
+            if $local_alias_interfaces ; then
+               for _port in ${samba_tcp_port_arr[@]} ; do
+                  $ipt -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
+                  $ipt -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
+               done
+            fi
+         fi
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Samba Service DMZ
+# ---
+
+echononl "\t\tSamba Service DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#samba_server_dmz_arr[@]} -gt 0 ]] ; then
+   for _ip in "${!samba_server_dmz_arr[@]}"; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${samba_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      # - From extern
+      if $kernel_activate_forwarding ; then
+         for _port in ${samba_udp_port_arr[@]} ; do
+            $ipt -A FORWARD -i ${samba_server_dmz_arr[$_ip]} -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+
+            # - Nat if interface is on a dsl line
+            # -
+            if containsElement "${samba_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+               IFS=':' read -a _udp_port_arr <<< ${_port}
+               if [[ -n "${_udp_port_arr[1]}" ]] ; then
+                  $ipt -t nat -A PREROUTING -i ${samba_server_dmz_arr[$_ip]} -p udp --dport $_port -j DNAT --to $_ip:${_udp_port_arr[0]}-${_udp_port_arr[1]}
+               else
+                  $ipt -t nat -A PREROUTING -i ${samba_server_dmz_arr[$_ip]} -p udp --dport $_port -j DNAT --to $_ip:$_port
+               fi
+            fi
+         done
+         for _port in ${samba_tcp_port_arr[@]} ; do
+            $ipt -A FORWARD -i ${samba_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+
+            # - Nat if interface is on a dsl line
+            # -
+            if containsElement "${samba_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+               $ipt -t nat -A PREROUTING -i ${samba_server_dmz_arr[$_ip]} -p tcp --dport $_port -j DNAT --to $_ip:$_port
+            fi
+         done
+      fi
+
+      # - From intern
+      for _dev in ${local_if_arr[@]} ; do
+         for _port in ${samba_udp_port_arr[@]} ; do
+            $ipt -A OUTPUT -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+               $ipt -A FORWARD -i $_dev -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            fi
+         done
+         for _port in ${samba_tcp_port_arr[@]} ; do
+            $ipt -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+               $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            fi
+         done
+
+         # - Rule is needed if (local) interface aliases in use (like eth0:1)
+         # -
+         if $kernel_activate_forwarding && $local_alias_interfaces ; then
+            for _port in ${samba_tcp_port_arr[@]} ; do
+               $ipt -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
+               $ipt -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
+            done
+         fi
+      done
+
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - LDAP and LDAP SSL Service Gateway (only for local Networks)
+# ---
+
+echononl "\t\tLDAP(S) Service Gateway (only for local Networks)"
+
+if $local_ldap_service ; then
+   for _dev in ${local_if_arr[@]} ; do
+      for _port in ${ldap_udp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+      for _port in ${ldap_tcp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - LDAP and LDAP SSL Service only between local Networks
+# ---
+
+echononl "\t\tLDAP(S) Service only local Networks"
+
+if [[ ${#ldap_server_local_ip_arr[@]} -gt 0 ]] ; then
+   for _dev in ${local_if_arr[@]} ; do
+      for _ip in ${ldap_server_local_ip_arr[@]} ; do
+         for _port in ${ldap_udp_port_arr[@]} ; do
+            $ipt -A OUTPUT -o $_dev -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         for _port in ${ldap_tcp_port_arr[@]} ; do
+            $ipt -A OUTPUT -o $_dev -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         if $kernel_activate_forwarding && $allow_ldap_between_local_nets && ! $permit_between_local_networks ; then
+
+            for _port in ${ldap_udp_port_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+            for _port in ${ldap_tcp_port_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+
+            # - Rule is needed if (local) interface aliases in use (like eth0:1)
+            # -
+            if $local_alias_interfaces ; then
+               for _port in ${ldap_tcp_port_arr[@]} ; do
+                  $ipt -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
+                  $ipt -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
+               done
+            fi
+         fi
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - NTP out only
+# ---
+
+echononl "\t\tNTP Service out only"
+
+if $allow_ntp_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - NTP Service Gateway
+# ---
+
+echononl "\t\tNTP Service Gateway"
+if $local_ntp_service ; then
+   if ! $allow_ntp_request_out ; then
+      $ipt -A OUTPUT -o $_dev -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT
+   fi
+   $ipt -A INPUT -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Timeserver (Port 37 NOT NTP!)"
+# ---
+
+echononl "\t\tTimeserver (Port 37 NOT NTP!) out only"
+
+if $allow_timeserver_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_timeserver_port  -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_timeserver_port  -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - PGP Keyserver out only
+# ---
+
+echononl "\t\tPGP Keyserver out only"
+
+if $allow_pgpserver_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_pgp_keyserver_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_pgp_keyserver_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Telnet
+# ---
+
+echononl "\t\tTelnet (only OUT)"
+
+if $allow_telnet_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_telnet_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_telnet_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Whois out only
+# ---
+
+echononl "\t\tWhois out only"
+
+if $allow_whois_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_whois_port  -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_whois_port  -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - CPAN Wait only out
+# ---
+
+# - CPAN::WAIT adds some comands to the CPAN shell() to perform searches on 
+# - a WAIT server. It connects to a WAIT server using a simple protocoll 
+# - resembling NNTP as described in RFC977.
+
+echononl "\t\tCPAN Wait only out"
+
+if $allow_cpan_wait_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_cpan_wait_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_cpan_wait_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - HBCI only out (only forward)
+# ---
+
+echononl "\t\tHBCI only out (only forward)"
+
+if $allow_hbci_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_hbci_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Jabber only out 
+# ---
+
+echononl "\t\tJabber only out"
+
+if $allow_jabber_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_jabber_port -m conntrack --ctstate NEW -j ACCEPT
+      $ipt -A OUTPUT -o $_dev -p udp --dport $standard_jabber_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_jabber_port -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A FORWARD -o $_dev -p udp --dport $standard_jabber_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Silc only out 
+# ---
+
+echononl "\t\tSilc only out"
+
+if $allow_silc_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -p tcp -o $_dev --dport $standard_silc_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_silc_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - IRC (Internet Relay Chat) only out 
+# ---
+
+echononl "\t\tIRC only out"
+
+if $allow_irc_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -p tcp -o $_dev --dport $standard_irc_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_irc_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - MySQL
+# ---
+
+echononl "\t\tMySQL (only OUT)"
+
+if $allow_mysql_request_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_mysql_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_mysql_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - CUPS only between local Networks (IPP Port 631)
+# ---
+
+echononl "\t\tCUPS/IPP (Port 631) only between local Networks"
+
+if $kernel_activate_forwarding && ! $permit_between_local_networks && $allow_printing_between_local_nets ; then
+   for _local_dev_1 in ${local_if_arr[@]} ; do
+      for _local_dev_2 in ${local_if_arr[@]} ; do
+         if ! $local_alias_interfaces ; then
+            [[ "$_local_dev_1" = "$_local_dev_2" ]] && continue
+         fi
+         $ipt -A FORWARD -i $_local_dev_1 -o $_local_dev_2 -p tcp --dport $standard_cups_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -o $_local_dev_1 -p tcp --dport $standard_cups_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -o $_local_dev_1 -p tcp --sport $standard_cups_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Druck Port 9100 (RAW) only out between local Networks
+# ---
+
+echononl "\t\tRAW Druck Port 9100 only between local Networks"
+
+if $kernel_activate_forwarding && ! $permit_between_local_networks && $allow_printing_between_local_nets ; then
+   for _local_dev_1 in ${local_if_arr[@]} ; do
+      for _local_dev_2 in ${local_if_arr[@]} ; do
+         if ! $local_alias_interfaces ; then
+            [[ "$_local_dev_1" = "$_local_dev_2" ]] && continue
+         fi
+         $ipt -A FORWARD -i $_local_dev_1 -o $_local_dev_2 -p tcp --dport $standard_print_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -o $_local_dev_1 -p tcp --dport $standard_print_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -o $_local_dev_1 -p tcp --sport $standard_print_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Druck LPD (Port 515) only out between local Networks
+# ---
+
+echononl "\t\tDruck LPD (Port 515) only between local Networks"
+
+if $kernel_activate_forwarding && ! $permit_between_local_networks && $allow_printing_between_local_nets ; then
+   for _local_dev_1 in ${local_if_arr[@]} ; do
+      for _local_dev_2 in ${local_if_arr[@]} ; do
+         if ! $local_alias_interfaces ; then
+            [[ "$_local_dev_1" = "$_local_dev_2" ]] && continue
+         fi
+         $ipt -A FORWARD -i $_local_dev_1 -o $_local_dev_2 -p tcp --dport $standard_print_raw_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      if $local_alias_interfaces ; then
+         $ipt -A FORWARD -o $_local_dev_1 -p tcp --dport $standard_print_raw_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -o $_local_dev_1 -p tcp --sport $standard_print_raw_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Printer
+# ---
+
+echononl "\t\tKnown Printers (Ports: 515/631/9100) only local Networks"
+if [[ ${#printer_ip_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding \
+      && ! $permit_between_local_networks \
+      && ! $allow_printing_between_local_nets ; then 
+   for _ip in ${printer_ip_arr[@]} ; do
+      for _dev in ${local_if_arr[@]} ; do
+         $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $standard_print_port -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $standard_ipp_port -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $standard_print_raw_port -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Note:
+         # - If (local) alias interfaces like eth1:0 in use, youe need a further
+         # - special rule.
+         # -
+         if $local_alias_interfaces ; then
+            $ipt -A FORWARD -o $_dev -p tcp -d $_ip --dport $standard_print_port --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -o $_dev -p tcp -s $_ip --sport $standard_print_port --tcp-flag ACK ACK -j ACCEPT
+
+            $ipt -A FORWARD -o $_dev -p tcp -d $_ip --dport $standard_ipp_port --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -o $_dev -p tcp -s $_ip --sport $standard_ipp_port --tcp-flag ACK ACK -j ACCEPT
+
+            $ipt -A FORWARD -o $_dev -p tcp -d $_ip --dport $standard_print_raw_port --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -o $_dev -p tcp -s $_ip --sport $standard_print_raw_port --tcp-flag ACK ACK -j ACCEPT
+         fi
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Scanner
+# ---
+
+echononl "\t\tBrother Scanner (Port $brscan_port) only between local Networks"
+
+if [[ ${#brother_scanner_ip_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding \
+      && ! $permit_between_local_networks \
+      && $allow_scanning_between_local_nets ; then 
+   for _ip in ${brother_scanner_ip_arr[@]} ; do
+      for _dev in ${local_if_arr[@]} ; do
+         # - UDP
+         $ipt -A FORWARD -i $_dev -p udp -d $_ip --dport $brscan_port -m conntrack --ctstate NEW -j ACCEPT
+         # - TCP
+         $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $brscan_port -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Note:
+         # - If (local) alias interfaces like eth1:0 in use, youe need a further
+         # - special rule.
+         # -
+         if $local_alias_interfaces ; then
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $brscan_port --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -o $_dev -p tcp -s $_ip --sport $brscan_port --tcp-flag ACK ACK -j ACCEPT
+         fi
+      done
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Other local Services
+# ---
+
+echononl "\t\tOther local Services"
+
+if [[ ${#other_service_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _val in ${other_service_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      for _dev in ${local_if_arr[@]} ; do
+         $ipt -A FORWARD -i $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Note:
+         # - If (local) alias interfaces like eth1:0 in use, youe need a further
+         # - special rule.
+         # -
+         if $local_alias_interfaces && [[ "${_val_arr[2]}" = "tcp" ]] ; then
+            $ipt -A FORWARD -i $_dev -p tcp -d ${_val_arr[0]} --dport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -o $_dev -p tcp -s ${_val_arr[0]} --sport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
+         fi
+      done
+   done
+   echo_ok
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Rsync only Out Gateway 
+# ---
+
+echononl "\t\tRsync (only OUT) Gateway"
+
+if $local_rsync_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      for _port in ${rsync_port_arr[@]} ; do
+         $ipt -A OUTPUT -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Rsync only Out from given local machines
+# ---
+
+echononl "\t\tRsync Out from given local machines"
+
+if [[ ${#rsync_out_ip_arr[@]} -gt 0 ]] && $kernel_activate_forwarding && ! $permit_local_net_to_inet; then
+   for _port in ${rsync_port_arr[@]} ; do
+      for _ip in ${rsync_out_ip_arr[@]} ; do
+         $ipt -A FORWARD -p tcp -s $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - SNMP Services local Networks
+# ---
+
+echononl "\t\tSNMP Services local Networks"
+
+if [[ ${#snmp_server_ip_arr[@]} -gt 0 ]] && ! $permit_between_local_networks; then
+   for _ip in ${snmp_server_ip_arr[@]} ; do
+      $ipt -A OUTPUT -p udp -d $_ip --dport $snmp_trap_port -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p udp -s $_ip --dport $snmp_port -m conntrack --ctstate NEW -j ACCEPT
+            $ipt -A FORWARD -i $_dev -p udp -d $_ip --dport $snmp_trap_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - WakeOnLan only out into local Networks
+# ---
+
+echononl "\t\tWakeOnLan only out into local Networks"
+$ipt -A OUTPUT -p udp --dport 9 -j ACCEPT
+echo_done
+
+
+# ---
+# - NFS Service (portmapper, mountd, nfs)
+# ---
+
+if $terminal; then
+   echononl "\t\tNFS Service\t\t\t - \033[37m\033[1mNot yet implemented\033[m -"
+   echo -e "\033[75G[ \033[37mskipped\033[m ]"
+
+   echononl "\t\tVoIP\t\t\t\t - \033[37m\033[1mNot yet implemented\033[m -"
+   echo -e "\033[75G[ \033[37mskipped\033[m ]"
+
+   echononl "\t\tSip\t\t\t\t - \033[37m\033[1mNot yet implemented\033[m -"
+   echo -e "\033[75G[ \033[37mskipped\033[m ]"
+
+   echononl "\t\tSkype\t\t\t\t - \033[37m\033[1mNot yet implemented\033[m -"
+   echo -e "\033[75G[ \033[37mskipped\033[m ]"
+else
+   echo "NFS Service - Not yet implemented"
+   echo "VoIP - Not yet implemented"
+   echo "Sip - Not yet implemented"
+   echo "Skype - Not yet implemented"
+fi
+
+
+# ---
+# - PowerChute Network Shutdown local Network
+# ---
+
+echononl "\t\tPowerChute Network Shutdown local Network"
+
+if [[ ${#pcns_server_ip_arr[@]} -gt 0 ]] && [[ -n "$usv_ip" ]] ; then
+
+   for _ip in ${pcns_server_ip_arr[@]} ; do
+      if containsElement "$_ip" "${gateway_ipv4_address_arr[@]}" ; then
+         $ipt -A INPUT -p tcp -s $usv_ip --dport $pcns_tcp_port -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A INPUT -p udp -s $usv_ip --dport $pcns_udp_port -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A INPUT -p tcp --dport $pcns_web_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         $ipt -A FORWARD -p tcp -s $usv_ip -d $_ip --dport $pcns_tcp_port -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A FORWARD -p udp -s $usv_ip -d $_ip --dport $pcns_udp_port -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A FORWARD -p tcp -d $_ip --dport $pcns_web_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip --dport $pcns_tcp_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport $pcns_tcp_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -d $_ip --dport $pcns_web_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport $pcns_web_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Ubiquiti Unifi Accesspoints
+# ---
+
+echononl "\t\tUbiquiti Unifi Accesspoints"
+if [[ ${#unifi_controller_gateway_ip_arr[@]} -gt 0 ]] || [[ ${#unify_controller_local_net_ip_arr[@]} -gt 0 ]] ; then
+      if [[ ${#unifi_controller_gateway_ip_arr[@]} -gt 0 ]] ; then
+
+         for _ip_ctl in ${unifi_controller_gateway_ip_arr[@]} ; do
+            for _dev in ${local_if_arr[@]} ; do
+               $ipt -A INPUT -i $_dev -p tcp -d $_ip_ctl -m multiport --dports $unify_controller_ports -m conntrack --ctstate NEW -j ACCEPT
+               if $provide_hotspot ; then
+                  $ipt -A INPUT -i $_dev -p tcp -d $_ip_ctl -m multiport --dports $hotspot_ports -m conntrack --ctstate NEW -j ACCEPT
+               fi
+            done
+
+         done
+      fi
+
+      if [[ ${#unify_controller_local_net_ip_arr[@]} -gt 0 ]] ; then
+         for _ip_ctl in ${unify_controller_local_net_ip_arr[@]} ; do
+            for _dev in ${local_if_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p tcp -d $_ip_ctl  -m multiport --dports $unify_controller_ports -m conntrack --ctstate NEW -j ACCEPT
+               if $provide_hotspot ; then
+                  $ipt -A FORWARD -i $_dev -p tcp -d $_ip_ctl -m multiport --dports $hotspot_ports -m conntrack --ctstate NEW -j ACCEPT
+               fi
+            done
+
+            # - Note:
+            # - If (local) alias interfaces like eth1:0 in use, youe need a further
+            # - special rule.
+            # -
+            if $kernel_activate_forwarding && $local_alias_interfaces ; then
+               $ipt -A FORWARD -p tcp -d $_ip_ctl -m multiport --dports $unify_controller_ports --tcp-flag ACK ACK -j ACCEPT
+               $ipt -A FORWARD -p tcp -s $_ip_ctl -m multiport --sports $unify_controller_ports --tcp-flag ACK ACK -j ACCEPT
+               if $provide_hotspot ; then
+                  $ipt -A FORWARD -p tcp -d $_ip_ctl -m multiport --dports $hotspot_ports --tcp-flag ACK ACK -j ACCEPT
+                  $ipt -A FORWARD -p tcp -s $_ip_ctl -m multiport --sports $hotspot_ports --tcp-flag ACK ACK -j ACCEPT
+               fi
+            fi
+
+         done
+      fi
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - IPMI Tools (e.g. IPMIView) only out
+# ---
+
+echononl "\t\tIPMI Tools (e.g. IPMIView) only out"
+
+if $allow_ipmi_request_out && ! $permit_local_net_to_inet ; then
+   for _dev in ${ext_if_arr[@]} ; do
+
+      for _port in ${ipmi_udp_port_arr[@]} ; do
+         $ipt -A OUTPUT -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+      for _port in ${ipmi_tcp_port_arr[@]} ; do
+         $ipt -A OUTPUT -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      if $kernel_activate_forwarding ; then
+         
+         for _port in ${ipmi_udp_port_arr[@]} ; do
+            $ipt -A FORWARD -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         for _port in ${ipmi_tcp_port_arr[@]} ; do
+            $ipt -A FORWARD -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - IPMI Tools (e.g. IPMIView) local Networks
+# ---
+
+echononl "\t\tIPMI Tools (e.g. IPMIView) local Networks"
+
+if [[ ${#ipmi_server_ip_arr[@]} -gt 0 ]]; then
+   for _ip in ${ipmi_server_ip_arr[@]} ; do
+
+      for _port in ${ipmi_udp_port_arr[@]} ; do
+         $ipt -A OUTPUT -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+      for _port in ${ipmi_tcp_port_arr[@]} ; do
+         $ipt -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+      
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _port in ${ipmi_udp_port_arr[@]} ; do
+            $ipt -A FORWARD -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         for _port in ${ipmi_tcp_port_arr[@]} ; do
+            $ipt -A FORWARD -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+
+         # - Rule is needed if (local) interface aliases in use (like eth0:1)
+         # -
+         if $local_alias_interfaces ; then
+            for _port in ${ipmi_udp_port_arr[@]} ; do
+               $ipt -A FORWARD -p udp -s $_ip --sport $_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+            for _port in ${ipmi_tcp_port_arr[@]} ; do
+               $ipt -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
+               $ipt -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
+            done
+         fi
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Remote Console (VNC) only out
+# ---
+
+echononl "\t\tRemote Console (VNC) only out"
+
+if $allow_remote_console_request_out && ! $permit_local_net_to_inet ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_dev -p tcp --dport $standard_remote_console_port -m conntrack --ctstate NEW -j ACCEPT
+
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -o $_dev -p tcp --dport $standard_remote_console_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Remote Console (VNC) local Networks
+# ---
+
+echononl "\t\tRemote Console (VNC) local Networks"
+
+
+if [[ ${#rm_server_ip_arr[@]} -gt 0 ]]; then
+   for _ip in ${rm_server_ip_arr[@]} ; do
+
+      $ipt -A OUTPUT -p tcp -d $_ip --dport $remote_console_port -m conntrack --ctstate NEW -j ACCEPT
+      
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         $ipt -A FORWARD -p tcp -d $_ip --dport $remote_console_port -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Rule is needed if (local) interface aliases in use (like eth0:1)
+         # -
+         if $local_alias_interfaces ; then
+            $ipt -A FORWARD -p tcp -d $_ip --dport $remote_console_port --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -p tcp -s $_ip --sport $remote_console_port --tcp-flag ACK ACK -j ACCEPT
+         fi
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Remote Console (VNC) DMZ
+# ---
+
+echononl "\t\tRemote Console (VNC) DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#rm_server_dmz_arr[@]} -gt 0 ]] ; then
+   for _ip in ${!rm_server_dmz_arr[@]} ; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${rm_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      # - From Gateway
+      $ipt -A OUTPUT -p tcp -d $_ip --dport $remote_console_port -m conntrack --ctstate NEW -j ACCEPT
+
+      if $kernel_activate_forwarding ; then
+
+         # - From extern
+
+         # - Nat if interface is on a dsl line
+         # -
+         if containsElement "${rm_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+            $ipt -t nat -A PREROUTING -i ${rm_server_dmz_arr[$_ip]} -p tcp --syn --dport $remote_console_port -j DNAT --to $_ip:$remote_console_port
+         fi
+         $ipt -A FORWARD -i ${rm_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport $remote_console_port  -m conntrack --ctstate NEW -j ACCEPT
+
+         # - From intern
+         if ! $permit_between_local_networks ; then
+            for _dev in ${local_if_arr[@]} ; do
+               $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $remote_console_port -m conntrack --ctstate NEW -j ACCEPT
+            done
+         fi
+
+         # - Rule is needed if (local) interface aliases in use (like eth0:1)
+         # -
+         if $local_alias_interfaces ; then
+            $ipt -A FORWARD -p tcp -d $_ip --dport $remote_console_port --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -p tcp -s $_ip --sport $remote_console_port --tcp-flag ACK ACK -j ACCEPT
+         fi
+      fi
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Munin Service Gateway
+# ---
+
+echononl "\t\tMunin Service Gateway"
+
+if $local_munin_server ; then
+
+   if $provide_munin_service_to_inet ; then
+      # - Provide Service for local and extern networks
+      # -
+      $ipt -A OUTPUT -p tcp --dport $munin_remote_port -m conntrack --ctstate NEW -j ACCEPT
+   else
+      # - Provide Service only for for local network
+      # -
+      for _dev in ${local_if_arr[@]} ; do
+         $ipt -A OUTPUT -o $_dev -p tcp --dport $munin_remote_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+   fi
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Munin Service local Networks
+# ---
+
+echononl "\t\tMunin Service local Networks"
+if [[ ${#munin_local_server_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${munin_local_server_ip_arr[@]} ; do
+      $ipt -A INPUT -s $_ip -p tcp --dport $munin_local_port -m conntrack --ctstate NEW -j ACCEPT
+
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            if ! $permit_between_local_networks ; then
+               $ipt -A FORWARD -i $_dev -s $_ip -p tcp --dport $munin_local_port -m conntrack --ctstate NEW -j ACCEPT
+            fi
+         done
+      fi
+
+      # - Rule is needed if (local) interface aliases in use (like eth0:1)
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip --sport $munin_local_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --dport $munin_local_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Munin remote Server
+# ---
+
+echononl "\t\tMunin remote Server"
+
+if [[ -n $munin_remote_server ]] && [[ ${#munin_local_client_ip_arr[@]} -gt 0 ]]; then
+
+   for _ip in ${!munin_local_client_ip_arr[@]} ; do
+      if containsElement "$_ip" "${gateway_ipv4_address_arr[@]}" ; then
+         $ipt -A INPUT -i ${munin_local_client_ip_arr[$_ip]} -p tcp -s $munin_remote_server --dport $munin_local_port  -m conntrack --ctstate NEW -j ACCEPT
+      elif $kernel_activate_forwarding ; then
+         $ipt -t nat -A PREROUTING -i ${munin_local_client_ip_arr[$_ip]} -p tcp -s $munin_remote_server --dport $munin_local_port -j DNAT --to $_ip:$munin_local_port
+         $ipt -A FORWARD -i ${munin_local_client_ip_arr[$_ip]} -p tcp -s $munin_remote_server -d $_ip --dport $munin_local_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - XyMon local service
+# ---
+
+echononl "\t\tXyMon Service Gateway"
+
+if $local_xymon_server ; then
+   for _dev in ${local_if_arr[@]} ; do
+      $ipt -A INPUT -i $_dev -p tcp --dport $xymon_port -m conntrack --ctstate NEW -j ACCEPT
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - XyMon Service Intranet
+# ---
+
+echononl "\t\tXyMon Service Intranet"
+
+if [[ ${#xymon_server_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${xymon_server_ip_arr[@]} ; do
+      if $local_xymon_client ; then
+         $ipt -A OUTPUT -p tcp -d $_ip --dport $xymon_port -m conntrack --ctstate NEW -j ACCEPT
+      fi
+      if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
+         for _dev in ${local_if_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $xymon_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+      # - Rule is needed if (local) interface aliases in use (like eth0:1)
+      # -
+      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+         $ipt -A FORWARD -p tcp -d $_ip --dport $xymon_port --tcp-flag ACK ACK -j ACCEPT
+         $ipt -A FORWARD -p tcp -s $_ip --sport $xymon_port --tcp-flag ACK ACK -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# -------------
+# --- Portforwarding
+# -------------
+
+# ---
+# - Portforwarding TCP
+# ---
+
+echo
+echononl "\tPortforwarding TCP"
+
+if [[ ${#portforward_tcp_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _val in "${portforward_tcp_arr[@]}" ; do
+
+      # - Split value
+      # -
+      IFS=':' read -a _val_arr <<< "${_val}"
+
+      # - DNAT
+      # -
+      $ipt -t nat -A PREROUTING -i ${_val_arr[0]} -p tcp --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j DNAT --to ${_val_arr[2]}:${_val_arr[3]}
+
+      # - Allow Packets
+      # -
+      $ipt -t filter -A FORWARD -i ${_val_arr[0]} -p tcp -d ${_val_arr[2]} --dport ${_val_arr[3]} -m conntrack --ctstate NEW -j ACCEPT
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Portforwarding UDP
+# ---
+
+echononl "\tPortforwarding UDP"
+
+if [[ ${#portforward_udp_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _val in "${portforward_udp_arr[@]}" ; do
+
+      # - Split value
+      # -
+      IFS=':' read -a _val_arr <<< "${_val}"
+
+      # - DNAT
+      # -
+      $ipt -t nat -A PREROUTING -i ${_val_arr[0]} -p udp --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j DNAT --to ${_val_arr[2]}:${_val_arr[3]}
+
+      # - Allow Packets
+      # -
+      $ipt -t filter -A FORWARD -i ${_val_arr[0]} -p udp -d ${_val_arr[2]} --dport ${_val_arr[3]} -m conntrack --ctstate NEW -j ACCEPT
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - UNIX Traceroute
+# ---
+
+echo
+echononl "\tUNIX Traceroute"
+
+#   versendet udp packete im gegensatz zu tracert von windows
+#   der icmp-echo-request pakete versendet
+#   einige implementierungen von traceroute (linux) erm�lichens
+#   die option -I und versenden dann ebenfalls icmp-echo-request pakete
+
+for _dev in ${ext_if_arr[@]} ; do
+   $ipt -A OUTPUT -o $_dev -p udp -m conntrack --ctstate NEW --dport 33434:33530 -j ACCEPT
+   $ipt -A INPUT -i $_dev -p udp -m conntrack --ctstate NEW --dport 33434:33530 -j ACCEPT
+   if $kernel_activate_forwarding ; then
+      $ipt -A FORWARD -o $_dev -p udp -m conntrack --ctstate NEW --dport 33434:33530 -j ACCEPT
+      $ipt -A FORWARD -i $_dev -p udp -m conntrack --ctstate NEW --dport 33434:33530 -j ACCEPT
+   fi
+done
+
+echo_done
+
+
+# -------------
+# --- ICMP Traffic (i.e. ping requests)
+# -------------
+
+echononl "\tPermit all ICMP traffic.."
+if $permit_all_icmp_traffic ; then
+   $ipt -A INPUT -p icmp -j ACCEPT
+   $ipt -A OUTPUT -p icmp -j ACCEPT
+   $ipt -A FORWARD -p icmp -j ACCEPT
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Deny between local networks
+# ---
+
+echo
+echononl "\tDeny all traffic between local networks.."
+if $kernel_activate_forwarding ; then
+   if ! $permit_between_local_networks ; then
+      for _dev_1 in ${local_if_arr[@]} ; do
+         for _dev_2 in ${local_if_arr[@]} ; do
+            if $log_rejected || $log_all ; then
+               $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -j LOG --log-prefix "$log_prefix Rejected local NET: " --log-level $log_level
+            fi
+            $ipt -A FORWARD -i $_dev_1 -o $_dev_2 -p ALL -m conntrack --ctstate NEW -j DROP
+         done
+      done
+      echo_done
+   else
+      echo_skipped
+   fi
+else
+   echo_skipped
+fi
+
+
+# -------------
+# --- Log traffic not matched so far
+# -------------
+echo
+
+echononl "\tLog traffic not matched so far.."
+if $log_rejected || $log_all ; then
+   $ipt -A OUTPUT -j LOG --log-prefix "$log_prefix OUT Rejected: " --log-level $log_level
+   $ipt -A INPUT -j LOG --log-prefix "$log_prefix IN Rejected: " --log-level $log_level
+   $ipt -A FORWARD -j LOG --log-prefix "$log_prefix FORWARD Rejected: " --log-level $log_level
+   #$ipt -A OUTPUT -m limit --limit-burst 5 -j LOG --log-prefix "$log_prefix OUT Rejected: "  --log-level $log_level
+   #$ipt -A INPUT -m limit --limit-burst 5 -j LOG --log-prefix "$log_prefix IN Rejected: " --log-level $log_level
+   #$ipt -A FORWARD -m limit --limit-burst 5 -j LOG --log-prefix "$log_prefix FORWARD Rejected: " --log-level $log_level
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
+# -------------
+# --- DROP traffic not matched so far
+# -------------
+echononl "\tDROP traffic not matched so far.."
+
+# - drop all other for all interfaces..
+#
+$ipt -A INPUT -j DROP
+$ipt -A OUTPUT -j DROP
+$ipt -A FORWARD -j DROP
+#
+# ---------- Ende: DROP ----------
+
+echo_done
+
+
+# ---
+# - Warning, if no intern (local) interface is configured
+# ---
+
+if [[ ${#local_if_arr[@]} -lt 1 ]] ; then
+   echo ""
+   echo ""
+   if $terminal ; then
+      echo -e "\t\033[33m\033[1m----------\033[m"
+   else
+      echo "----------"
+   fi
+   warn "No local Interface is configured!"
+   if $terminal ; then
+      echo -e "\t\033[33m\033[1m----------\033[m"
+   else
+      echo "----------"
+   fi
+fi
+
+echo
+exit 0
+
diff --git a/WF/sbin/rebind b/WF/sbin/rebind
new file mode 100755
index 0000000..0661cae
--- /dev/null
+++ b/WF/sbin/rebind
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+case "$1" in
+	on)
+		set -x
+		mount --bind /proc    /ro/proc
+		mount --bind /sys     /ro/sys
+		mount --bind /dev     /ro/dev
+		mount --bind /dev/pts /ro/dev/pts
+	;;
+	off)
+		set -x
+		umount /ro/dev/pts
+		umount /ro/dev
+		umount /ro/sys
+		umount /ro/proc
+	;;
+	*)
+		echo "Use: $0 (on|off)"
+esac
diff --git a/WF/sbin/synctime b/WF/sbin/synctime
new file mode 100755
index 0000000..b623feb
--- /dev/null
+++ b/WF/sbin/synctime
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+NOW=$(date +%s)
+INTERVAL=$[ 8 * 60 * 60 ]  # 8 hs
+CONTROL=/tmp/.lastSyncTime
+
+sync_time() {
+    ntpdate-debian -s  || exit 1
+    hwclock --systohc  || exit 1
+    touch ${CONTROL}
+}
+
+[ ! -f ${CONTROL} ] && sync_time && exit 0
+
+SYNCRONIZED=$(stat -c %Y ${CONTROL})
+SECONDS=$[ ${NOW} - ${SYNCRONIZED} ]
+
+[ ${SECONDS} -gt ${INTERVAL} ] && sync_time && exit 0
+[ ${SECONDS} -lt 0           ] && sync_time && exit 0
+
+exit 0
diff --git a/WF/sbin/tmpsize b/WF/sbin/tmpsize
new file mode 100755
index 0000000..40cfab3
--- /dev/null
+++ b/WF/sbin/tmpsize
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+mount -t tmpfs | cut -d' ' -f3 | \
+while read MOUNT_POINT; do
+    mount -o remount,size=30M ${MOUNT_POINT}
+done
diff --git a/WF/sbin/usb-leds-on-off b/WF/sbin/usb-leds-on-off
new file mode 100755
index 0000000..0deba49
--- /dev/null
+++ b/WF/sbin/usb-leds-on-off
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+[ -e "/sys/class/leds/alix:${2}/brightness"  ] && {
+	/bin/echo ${1} > "/sys/class/leds/alix:${2}/brightness"
+}
diff --git a/WF/src/APC/PowerChute/Linux_x64/install.sh b/WF/src/APC/PowerChute/Linux_x64/install.sh
deleted file mode 100755
index b4196e6..0000000
--- a/WF/src/APC/PowerChute/Linux_x64/install.sh
+++ /dev/null
@@ -1,1687 +0,0 @@
-#!/bin/sh
-######################################################################
-# 
-# PowerChute Network Shutdown v.3.1.0
-# Copyright (c) 1999-2013 Schneider Electric, All Rights Reserved. 
-#
-# History:
-#   16Oct2007 Initial revision
-#   12Dec2008 Supported VIMA
-#   16thMay2013 changed the bundled JRE to 1.7
-#
-######################################################################
-
-
-######################################################################
-# Global Constants
-######################################################################
-PCNS_TAR="pcns310.tar"
-PCNS_ZIP="$PCNS_TAR.gz"
-JRE_VERSION="jre1.7.0_45"
-JRE_TGZ_FILE="jre-7u45"
-JRE_REQUIRED_MAJOR=1
-JRE_REQUIRED_MINOR=7
-JRE_REQUIRED_MINI=0
-JRE_REQUIRED_MICRO=0
-LINUX="Linux"
-SOLARIS="Solaris"
-HPUX="HP-UX"
-AIX="AIX"
-VIMA="VIMA"
-UNKNOWN="UNKNOWN"
-XENSERVER="XenServer"
-x86_64="x86_64"
-GROUP1="group1"
-GROUP2="group2"
-GROUP3="group3"
-ARCH="x64"
-
-TRUE=0
-FALSE=1
-STR_YES="YES"
-YES=0
-NO=1
-QUIT=2
-INVALID=99
-# PCNS-1512: Make sure we have /sbin on the path
-PATH=/sbin:$PATH
-
-######################################################################
-# Exit Codes
-######################################################################
-EXIT_SUCCESS=0
-EXIT_USAGE=1
-EXIT_NOT_ROOT_USER=4
-EXIT_UNSUPPORTED_OS=5
-EXIT_UPGRADE_NOT_SUPPORTED=6
-EXIT_USER_ABORT=7
-EXIT_CONFLICT_PCPLUS=8
-EXIT_CONFLICT_PCBE=9
-EXIT_CONFLICT_PCS=10
-EXIT_CONFLICT_VMWARE=11
-EXIT_INVALID_INSTALL_DIR=12
-EXIT_INVALID_JAVA_VERSION=13
-EXIT_INVALID_LOCALE=14
-EXIT_ZIPFILE_MISSING=15
-EXIT_SILENT_CONFIG_MISSING=16
-EXIT_EULA_NOT_ACCEPTED=17
-EXIT_SILENT_INSTALL_JAVA_DIR=20
-
-######################################################################
-# Global Variables
-######################################################################
-UPDATE_INSTALL=$FALSE
-OS=$UNKNOWN
-SILENT_MODE=$FALSE
-
-SRC_DIR=""
-INSTALL_DIR=""
-APP_DIR=""
-JAVA_DIR=""
-ACCEPT_EULA="NO"
-REGISTER_NMC="NO"
-STARTUP=""
-PCBE_STARTUP=""
-PCS_STARTUP=""
-OLD_INSTALL_DIR=""
-JRE_FILE=""
-SPARC=$FALSE
-TR="tr"
-
-######################################################################
-#  Functions
-######################################################################
-
-# trap keyboard interrupt on the following:
-# 1 SIGHUP
-# 2 SIGINT
-# 3 SIGQUIT
-# 6 SIGABRT
-trap control_c 1 2 3 6
-
-control_c()
-# run if user hits control-c
-{
-  echo -en "\n*** User Abort Detected! Exiting ***\n"
-  Echo "Aborting with error code-$EXIT_USER_ABORT"
-  CancelAll $EXIT_USER_ABORT
-}
-
-# Waits for user key press.
-Pause() {
-    OLDCONFIG=`stty -g`
-    stty -icanon -echo min 1 time 0
-    dd count=1 2>/dev/null
-    stty $OLDCONFIG
-}
-
-Echo() {
-    string="$1"
-    echo "$string"
-#    if [ $SILENT_MODE = $TRUE ]; then
-#        echo "$string" >> pcns_install.log
-#    fi
-}
-
-PrintUsage() {
-    Echo "Usage:"
-    Echo "  $0 [-f <config file>] : Silent install with configuration file."
-    Echo "  $0 [-h|-H] : Print help."
-    exit $EXIT_USAGE
-}
-
-IsYN() {
-    rval=$INVALID
-    query_string="$1"
-    loop=$TRUE
-    while [ $loop -eq $TRUE ]
-    do
-        Echo ""
-        Echo "$query_string "
-        read ynq
-        case "$ynq" in
-        [Yy]*)
-            rval=$YES
-            loop=$FALSE
-            ;;
-        [Nn]*)
-            rval=$NO
-            loop=$FALSE
-            ;;
-        *)
-            Echo "Invalid response."
-            ;;
-        esac
-    done
-    return $rval
-}
-
-SetSilentConfig() {
-    # Check parameter
-    cnt=`grep '^INSTALL_DIR=' $SILENT_CONFIG | wc -l`
-    if [ $cnt -gt 1 ]; then
-	    Echo "Aborting with error code-$EXIT_INVALID_INSTALL_DIR"
-        Echo "Error: Too many INSTALL_DIR in $SILENT_CONFIG"
-        exit $EXIT_INVALID_INSTALL_DIR
-    fi
-    cnt=`grep '^JAVA_DIR=' $SILENT_CONFIG | wc -l`
-    if [ $cnt -gt 1 ]; then
-	    Echo "Aborting with error code-$EXIT_SILENT_INSTALL_JAVA_DIR"
-        Echo "Error: Too many JAVA_DIR in $SILENT_CONFIG"
-        exit $EXIT_SILENT_INSTALL_JAVA_DIR
-    fi
-
-    # Get values from config file
-    INSTALL_DIR=`grep '^INSTALL_DIR=' $SILENT_CONFIG | sed s/INSTALL_DIR=//`
-    JAVA_DIR=`grep '^JAVA_DIR=' $SILENT_CONFIG | sed s/JAVA_DIR=//`
-    ACCEPT_EULA=`grep '^ACCEPT_EULA=' $SILENT_CONFIG | sed s/ACCEPT_EULA=// | sed 's/[^a-zA-Z]*//g' | $TR "[:lower:]" "[:upper:]" `
-    REGISTER_NMC=`grep '^REGISTER_WITH_NMC=' $SILENT_CONFIG | sed s/REGISTER_WITH_NMC=// | $TR "[:lower:]" "[:upper:]" `
-
-    # Verify INSTALL_DIR
-    if [ -n "$INSTALL_DIR" ]; then
-        # Collapse multiple slashes on the path
-        INSTALL_DIR=`echo $INSTALL_DIR | tr -s /`
-    
-        # Remove trailing slash (if any)
-        buf=`echo $INSTALL_DIR | grep '/$' `
-        if [ -n "$buf" ]; then
-            INSTALL_DIR=`echo $INSTALL_DIR | sed 's/\/*$//'`
-        fi
-        
-        # Ensure leading slash
-        buf=`echo $INSTALL_DIR | grep '^/' ` 
-        if [ -z "$buf" ]; then
-		    Echo "Aborting with error code-$EXIT_INVALID_INSTALL_DIR"
-            Echo "Error: INSTALL_DIR must start with '/'"
-            exit $EXIT_INVALID_INSTALL_DIR
-        fi
-        
-        # Ensure no white space on path
-        buf=`echo $INSTALL_DIR | grep ' ' ` 
-        if [ -n "$buf" ]; then
-		    Echo "Aborting with error code-$EXIT_INVALID_INSTALL_DIR"
-            Echo "Error: INSTALL_DIR must not contain white space."
-            exit $EXIT_INVALID_INSTALL_DIR
-        fi
-        
-        # Ensure no backslashes on path
-        buf=`echo $INSTALL_DIR | grep '\\\' ` 
-        if [ -n "$buf" ]; then
-		    Echo "Aborting with error code-$EXIT_INVALID_INSTALL_DIR"
-            Echo "Error: INSTALL_DIR must not contain back slash '\\'"
-            exit $EXIT_INVALID_INSTALL_DIR
-        fi
-        
-        Echo "INSTALL_DIR=$INSTALL_DIR"
-    else
-        buf=`grep '^INSTALL_DIR=' $SILENT_CONFIG`
-        buf2=`grep '^#INSTALL_DIR=' $SILENT_CONFIG`
-        if [ -n "$buf" -o -n "$buf2" ]; then
-            Echo "INSTALL_DIR is not specified."
-            Echo "PCNS will be installed to the default directory \"/opt/APC/PowerChute\""
-            Echo ""
-        else
-		    Echo "Aborting with error code-$EXIT_INVALID_INSTALL_DIR"
-            Echo "Error: INSTALL_DIR is not configured"
-            exit $EXIT_INVALID_INSTALL_DIR
-        fi
-    fi
-    # Verify JAVA_DIR
-    if [ -n "$JAVA_DIR" ]; then
-
-        #must have / at the end, so add it    
-        buf=`echo $JAVA_DIR | grep '/$' ` 
-        if [ -z "$buf" ]; then
-           JAVA_DIR="$JAVA_DIR/bin/"
-        fi
-
-        # Add"/bin" at the end of JAVA_DIR if needed.
-        # This allows it to be backward compatible with previous versions, 
-        # which did not have the bin
-        
-        buf=`echo $JAVA_DIR | grep '/bin/$' ` 
-        if [ -z "$buf" ]; then
-               JAVA_DIR="$JAVA_DIR/bin/"
-        fi
-        buf=`echo $JAVA_DIR | grep '^/' ` 
-        if [ -z "$buf" ]; then
-            Echo "Error: JAVA_DIR must start with /"
-			Echo "Aborting with error code-$EXIT_SILENT_INSTALL_JAVA_DIR"
-            exit $EXIT_SILENT_INSTALL_JAVA_DIR
-        fi
-        
-        buf=`echo $JAVA_DIR | grep ' ' ` 
-        if [ -n "$buf" ]; then
-            Echo "Error: JAVA_DIR must not contain white space \" \""
-			Echo "Aborting with error code-$EXIT_SILENT_INSTALL_JAVA_DIR"
-            exit $EXIT_SILENT_INSTALL_JAVA_DIR
-        fi
-        
-        buf=`echo $JAVA_DIR | grep '\\\' ` 
-        if [ -n "$buf" ]; then
-            Echo "Error: JAVA_DIR must not contain back slash \"\\\""
-			Echo "Aborting with error code-$EXIT_SILENT_INSTALL_JAVA_DIR"
-            exit $EXIT_SILENT_INSTALL_JAVA_DIR
-        fi
-        if [ ! -d "$JAVA_DIR" ]; then
-            Echo "Error: Invalid JAVA_DIR. $JAVA_DIR does not exist."
-			Echo "Aborting with error code-$EXIT_SILENT_INSTALL_JAVA_DIR"
-            exit $EXIT_SILENT_INSTALL_JAVA_DIR
-        fi
-        Echo "JAVA_DIR=$JAVA_DIR"
-    fi
-}
-
-IsSilentMode() {
-    Echo "IsSilentMode"
-}
-
-IsRootUser() {
-    ROOT="root"
-    case "$OS" in    
-    $SOLARIS)
-        id | grep root > /dev/null 2>&1
-        if [ $? -eq 0 ]; then
-            USER=$ROOT
-        fi
-        ;;
-    *)
-        USER=`id -nu`
-        ;;
-    esac
-    
-    if [ $USER != $ROOT ]; then
-        Echo "Error: $0 must be run with root privileges!"
-		Echo "Aborting with error code-$EXIT_NOT_ROOT_USER"
-        exit $EXIT_NOT_ROOT_USER
-    fi
-}
-
-CheckOS() {
-    OS=`uname | grep -i Linux`
-    if [ ! -z "$OS" ]; then
-        # We're a Linux derivative, decide which one.
-        if [ -f /etc/vima-release ] || [ -f /etc/vma-release ]; then
-            OS=$VIMA
-        else 
-            grep XenServer /etc/redhat-release > /dev/null 2>&1
-            if [ $? -eq 0 ]; then
-                OS=$XENSERVER
-            else
-                OS=$LINUX
-            fi
-        fi
-    else
-        OS=`uname | grep -i HP-UX`
-        if [ ! -z "$OS" ] 
-        then
-            OS=$HPUX
-        else
-            OS=`uname | grep -i AIX`
-            if [ ! -z "$OS" ] 
-            then
-                OS=$AIX
-            else
-                OS=`uname | grep -i SOLARIS`
-                if [ ! -z "$OS" ]
-                then
-                    OS=$SOLARIS
-                    isSparc
-                    SPARC=$?
-                else 
-                    OS=`uname | grep -i SUNOS`
-                    if [ ! -z "$OS" ]
-                    then
-                        OS=$SOLARIS
-                        isSparc
-                        SPARC=$?                        
-                    else
-					    Echo "Aborting with error code-$EXIT_UNSUPPORTED_OS"
-                        Echo "Error: Unknown OS."
-                        exit $EXIT_UNSUPPORTED_OS
-                    fi
-                fi
-            fi
-        fi
-    fi
-    Echo "OS=$OS"
-    Echo ""
-}
-
-isSparc() {
-    rval=$FALSE
-    tmp=`uname -a | grep -i SPARC`
-    if [ ! -z "$tmp" ] 
-    then
-        rval=$TRUE
-    fi
-    return $rval
-}                        
-
-Initialize() {
-    Echo "Initializing ..."
-    case "$OS" in
-    $VIMA)
-        Echo "This version of PowerChute Network Shutdown does not support VMWare ESX or ESXi."
-	Echo "Please consult www.apc.com for the required version of PowerChute Network Shutdown."
-	    Echo "Aborting with error code-$EXIT_UNSUPPORTED_OS"
-        CancelAll $EXIT_UNSUPPORTED_OS
-        ;;
-    $XENSERVER)
-        STARTUP=/etc/rc.d/init.d/PowerChute
-        PCBE_STARTUP=/etc/rc.d/init.d/PBEAgent
-        PCS_STARTUP=/etc/rc.d/init.d/pcs
-        ;;
-    $LINUX)
-        if [ -f /etc/SuSE-release ]; then
-            STARTUP=/etc/init.d/PowerChute
-        elif [ -f /etc/vmware-release ] ; then
-	    Echo "This version of PowerChute Network Shutdown does not support VMWare ESX or ESXi."
-	    Echo "Please consult www.apc.com for the required version of PowerChute Network Shutdown."
-		Echo "Aborting with error code-$EXIT_UNSUPPORTED_OS"
-            CancelAll $EXIT_UNSUPPORTED_OS
-        elif [ -d /etc/rc.d/init.d ]; then
-            STARTUP=/etc/rc.d/init.d/PowerChute
-	    else
-            STARTUP=/etc/init.d/PowerChute
-        fi
-        PCBE_STARTUP=/etc/rc.d/init.d/PBEAgent
-        PCS_STARTUP=/etc/rc.d/init.d/pcs
-        ;;
-    $SOLARIS)
-        STARTUP=/etc/rc2.d/S99PowerChute
-        PCBE_STARTUP=/etc/rc2.d/S99PBEAgent
-        TR=/usr/xpg4/bin/tr
-        ;;
-    $HPUX)
-        STARTUP=/sbin/init.d/pcns
-        ;;
-    $AIX)
-        STARTUP=/etc/rc.APCpcns
-        ;;
-    esac
-}
-
-IsPCNSInstalled() {
-    upgrade=$FALSE    
-    version="Unknown"
-    if [ -f "$STARTUP" ]; then
-        grep 'PowerChute Network Shutdown, v2.2.4' $STARTUP 1>/dev/null 2>/dev/null
-        if [ $? = 0 ]; then
-            Echo "Found PowerChute Network Shutdown v2.2.4."
-            version="2.2.4"
-            upgrade=$FALSE
-        fi
-        
-        grep 'PowerChute Network Shutdown, v2.2.5' $STARTUP 1>/dev/null 2>/dev/null
-        if [ $? = 0 ]; then
-            Echo "Found PowerChute Network Shutdown v2.2.5."
-            version="2.2.5"
-            upgrade=$FALSE
-        fi
-        
-        grep 'PowerChute Network Shutdown, v2.2.6' $STARTUP 1>/dev/null 2>/dev/null
-        if [ $? = 0 ]; then
-            Echo "Found PowerChute Network Shutdown v2.2.6."
-            version="2.2.6"
-            upgrade=$FALSE
-        fi
-        
-        grep 'PowerChute Network Shutdown, v2.2.7' $STARTUP 1>/dev/null 2>/dev/null
-        if [ $? = 0 ]; then
-            Echo "Found PowerChute Network Shutdown v2.2.7."
-            version="2.2.7"
-            upgrade=$FALSE
-        fi
-        
-		grep 'PowerChute Network Shutdown, v3.0.0' $STARTUP 1>/dev/null 2>/dev/null
-        if [ $? = 0 ]; then
-            Echo "Found PowerChute Network Shutdown v3.0.0"
-            version="3.0.0"
-            upgrade=$TRUE
-        fi
-		
-        grep 'PowerChute Network Shutdown, v3.0.1' $STARTUP 1>/dev/null 2>/dev/null
-        if [ $? = 0 ]; then
-            Echo "Found PowerChute Network Shutdown v3.0.1"
-            version="3.0.1"
-            upgrade=$TRUE
-        fi
-        
-        grep 'PowerChute Network Shutdown, v3.1.0' $STARTUP 1>/dev/null 2>/dev/null
-        if [ $? = 0 ]; then
-            Echo "Found PowerChute Network Shutdown v3.1.0"
-            version="3.1.0"
-            upgrade=$TRUE
-        fi
-        
-        if [ $upgrade = $FALSE ]; then
-            Echo "PowerChute Network Shutdown is already installed. Upgrade is not supported for this version."
-            Echo "Please uninstall existing PCNS to continue with installation of PCNS v.3.1.0"
-            Echo "Installation cancelled."
-			Echo "Aborting with error code-$EXIT_UPGRADE_NOT_SUPPORTED"
-            Echo ""
-            exit $EXIT_UPGRADE_NOT_SUPPORTED
-        fi
-        
-        result=$FALSE
-        while [ $result = $FALSE ]
-        do
-            prev_install_dir=`grep '^INSTALL_PATH='  $STARTUP | sed s/INSTALL_PATH=\"// | sed s/\"//`
-            if [ -d "$prev_install_dir/$GROUP2" ]; then
-                Echo "Previous version of PowerChute Network Shutdown is installed."
-                Echo "Update install does not support multiple instances."
-                Echo "Please uninstall PCNS and run this install program again."
-				Echo "Aborting with error code-$EXIT_UPGRADE_NOT_SUPPORTED"
-                Echo "Installation cancelled."
-                Echo ""
-                exit $EXIT_UPGRADE_NOT_SUPPORTED
-            fi
-            if [ $SILENT_MODE = $TRUE ]; then
-                if [ $version = "3.1.0" ]; then
-					Echo "Current version of PowerChute Network Shutdown is installed."
-				else
-					Echo "Previous version of PowerChute Network Shutdown is installed."
-				fi
-                Echo "Start update installation."
-                val=$YES
-            else
-                if [ $version = "3.1.0" ]; then
-					Echo "Current version of PowerChute Network Shutdown is installed."
-				else
-					Echo "Previous version of PowerChute Network Shutdown is installed."
-				fi
-                IsYN "Do you want to update it [Yes|No]?"
-                val=$?
-            fi
-            case $val in
-            $YES)
-                Echo "Update selected for existing version of PowerChute Network Shutdown."
-                UPDATE_INSTALL=$TRUE
-                result=$TRUE
-                ;;
-            $NO)
-                Echo "Installation cancelled."
-				Echo "Aborting with error code-$EXIT_USER_ABORT"
-                Echo ""
-                exit $EXIT_USER_ABORT
-                ;;
-            *)
-                Echo "Invalid response."
-                ;;
-            esac
-        done
-    fi
-}
-
-IsPCPlusInstalled() {
-    if [ -d "/etc/apc_repository" ]; then
-        Echo "PowerChute Plus is installed. Please uninstall PowerChute Plus."
-		Echo "Aborting with error code-$EXIT_CONFLICT_PCPLUS."
-        exit $EXIT_CONFLICT_PCPLUS
-    fi
-}
-
-IsPCBEInstalled() {
-    if [ -n "$PCBE_STARTUP" -a -f "$PCBE_STARTUP" ]
-    then
-	    Echo "Aborting with error code-$EXIT_CONFLICT_PCBE."
-        Echo "PowerChute Business Edition Agent is installed. Please uninstall PCBE Agent."
-        exit $EXIT_CONFLICT_PCBE
-    fi
-}
-
-IsPCSInstalled() {
-    if [ -n "$PCS_STARTUP" -a -f "$PCS_STARTUP" ]
-    then
-        Echo "PowerChute Server is installed. Please uninstall PowerChute Server."
-		Echo "Aborting with error code-$EXIT_CONFLICT_PCS."
-        exit $EXIT_CONFLICT_PCS
-    fi
-}
-
-checkForVMWare() {
-    lang='ja_'
-    if env | grep ^LANG=$lang &>/dev/null;
-    then
-       if [ -e /usr/bin/vmware ]
-       then
-           # VMware detected!
-           
-           # Check for VMware Server
-           if /usr/bin/vmware -v | grep Server &> /dev/null
-           then
-                Echo "VMware Server has been detected on your system. This version of PowerChute Network Shutdown does not support VMware. Please uninstall VMware Server, or consult www.apc.com for the required version of PowerChute Network Shutdown."
-				Echo "Aborting with error code-$EXIT_CONFLICT_VMWARE."
-                exit $EXIT_CONFLICT_VMWARE
-           fi
-           
-           # Check for VMware Workstation
-           if /usr/bin/vmware -v | grep Workstation &> /dev/null
-           then
-                Echo "VMware Workstation has been detected on your system. This version of PowerChute Network Shutdown does not support VMware. Please uninstall VMware Workstation, or consult www.apc.com for the required version of PowerChute Network Shutdown."
-				Echo "Aborting with error code-$EXIT_CONFLICT_VMWARE."
-                exit $EXIT_CONFLICT_VMWARE
-           fi
-       fi
-       
-       # Check for VMware-Player
-       if [ -e /usr/bin/vmplayer ]
-       then
-           # VMware Player detected.
-            Echo "VMware Player has been detected on your system. This version of PowerChute Network Shutdown does not support VMware. Please uninstall VMware Player, or consult www.apc.com for the required version of PowerChute Network Shutdown."
-			Echo "Aborting with error code-$EXIT_CONFLICT_VMWARE."
-            exit $EXIT_CONFLICT_VMWARE
-       fi
-
-     fi
-}
-
-checkForXenServer() {
-    grep XenServer /etc/redhat-release > /dev/null 2>&1
-    if [ $? -eq 0 ]; then
-        Echo "Xen Server has been detected on your system."
-        Echo "This version of PowerChute Network Shutdown does not support Xen Server."
-        Echo "Please consult www.apc.com for the required version of PowerChute Network Shutdown."
-		Echo "Aborting with error code-$EXIT_CONFLICT_VMWARE."
-        exit $EXIT_CONFLICT_VMWARE
-    fi
-}
-
-InitUpdate() {
-    if [ $UPDATE_INSTALL = $TRUE ]; then
-        # Get PCNS Path
-        OLD_INSTALL_DIR=`grep '^INSTALL_PATH='  $STARTUP | sed s/INSTALL_PATH=\"// | sed s/\"//`
-        Echo "PowerChute Network Shutdown previously installed at:$OLD_INSTALL_DIR" 
-        # Stop daemon
-        case "$OS" in
-        $VIMA)
-            /etc/rc.d/init.d/PowerChute stop
-            ;;
-        $XENSERVER)
-            /etc/rc.d/init.d/PowerChute stop
-            ;;
-        $LINUX)
-            if [ -f /etc/SuSE-release ]; then
-            	if [ -f /etc/init.d/PowerChute ]; then
-                	/etc/init.d/PowerChute stop
-                fi
-            else
-            	if [ -f /etc/rc.d/init.d/PowerChute ]; then
-                	/etc/rc.d/init.d/PowerChute stop
-               	fi
-               	if [ -f /etc/init.d/PowerChute ]; then
-                	/etc/init.d/PowerChute stop
-                fi
-            fi
-            ;;
-        $SOLARIS)
-            /etc/rc2.d/S99PowerChute stop
-            ;;
-        $HPUX)
-            /sbin/init.d/pcns stop
-            ;;
-        $AIX)
-            /etc/rc.APCpcns stop
-            ;;
-        esac
-    fi
-}
-
-BackupOldPCNS() {
-    if [ $UPDATE_INSTALL = $TRUE ]; then
-        # Install dir is same as old PCNS
-        if [ "$INSTALL_DIR/PowerChute" = "$OLD_INSTALL_DIR" ]; then
-            backup_dir="$INSTALL_DIR/PowerChute_update_backup"
-            rm -rf $backup_dir
-            mv $OLD_INSTALL_DIR $backup_dir
-            mkdir -p $OLD_INSTALL_DIR
-            OLD_INSTALL_DIR=$backup_dir
-            Echo "Backup old PCNS directory to $OLD_INSTALL_DIR"
-        fi
-    fi
-}
-
-UninstallOldPCNS() {
-    if [ $UPDATE_INSTALL = $TRUE ]; then
-        # remove all files
-        rm -rf $OLD_INSTALL_DIR
-    fi
-}
-
-CopyUpdateFiles() {
-    if [ $UPDATE_INSTALL = $TRUE ]; then
-        Echo "Copying update files ..."
-        if [ -d "$OLD_INSTALL_DIR/$GROUP1" ]; then
-            # PCNS 222
-            backup_dir="$OLD_INSTALL_DIR/$GROUP1"
-        else
-            backup_dir="$OLD_INSTALL_DIR"
-        fi
-        cp "$backup_dir/m11.cfg" "$APP_DIR/$GROUP1/" 1>/dev/null 2>/dev/null
-        cp "$backup_dir/EventLog.txt" "$APP_DIR/$GROUP1/" 1>/dev/null 2>/dev/null
-        
-        # Convert m11.cfg to INI
-        oldDir=$PWD
-        cd $APP_DIR/$GROUP1
-        m11Path="$backup_dir/m11.cfg"
-        #merge pcnsconfig.ini files.
-        oldIniPath="$backup_dir/pcnsconfig.ini"
-        
-        javaParams="-Xms32m -Xmx64m -cp .:comp/pcns.jar:lib/m11.jar:lib/commons-codec-1.4.jar:lib/commons-collections-3.2.1.jar:lib/commons-configuration-1.6.jar:lib/commons-lang-2.5.jar:lib/commons-logging-1.1.1.jar:lib/log4j-1.2.16.jar:lib/bcprov-jdk16-146.jar:lib/json_simple-1.1.jar:lib/jasypt-1.9.0.jar -Dm11Path=$m11Path -DoldIniPath=$oldIniPath -DapplicationDirectory=$APP_DIR -Dgroup=1 com.apcc.pcns.m11converter.M11Converter"
-        #Echo ${JAVA_DIR}java  $javaParams
-        ${JAVA_DIR}java  $javaParams 1>/dev/null 2>/dev/null
-        cd $oldDir
-    fi
-}
-
-SetInstallDir() {
-    if [ $SILENT_MODE = $TRUE ]; then
-        if [ -z "$INSTALL_DIR" ]; then
-            INSTALL_DIR="/opt/APC"
-        fi
-    elif [ $UPDATE_INSTALL = $TRUE ]; then
-        # Use the old location
-        INSTALL_DIR=`dirname $OLD_INSTALL_DIR`
-    else
-        res=$FALSE
-        while [ $res = $FALSE ]
-        do
-            Echo ""
-            Echo "Please enter the installation directory or press enter to install to the default directory (/opt/APC/PowerChute):"
-            read val
-            if [ -z "$val" ]; then
-                INSTALL_DIR="/opt/APC"    
-            else
-                INSTALL_DIR=$val    
-                # Verify install path
-                if [ -n "$INSTALL_DIR" ]; then
-                    buf=`echo $INSTALL_DIR | grep '^/' ` 
-                    if [ -z "$buf" ]; then
-                        Echo "Installation directory must start with \"/\""
-						Echo "Aborting with error code-$EXIT_INVALID_INSTALL_DIR"
-                        exit $EXIT_INVALID_INSTALL_DIR
-                    fi
-                    buf=`echo $INSTALL_DIR | grep ' ' ` 
-                    if [ -n "$buf" ]; then
-                        Echo "Installation directory must not contain white space \" \""
-						Echo "Aborting with error code-$EXIT_INVALID_INSTALL_DIR"
-                        exit $EXIT_INVALID_INSTALL_DIR
-                    fi
-                    buf=`echo $INSTALL_DIR | grep '\\\' ` 
-                    if [ -n "$buf" ]; then
-                        Echo "Installation directory must not contain back slash \"\\\""
-						Echo "Aborting with error code-$EXIT_INVALID_INSTALL_DIR"
-                        exit $EXIT_INVALID_INSTALL_DIR
-                    fi
-                fi
-            fi
-
-            IsYN "Are you sure you want to install PCNS to $INSTALL_DIR/PowerChute [Yes|No]?"
-            val=$?
-            case $val in
-            $YES)
-                if [ -d "$INSTALL_DIR/PowerChute" ]; then
-                    IsYN "$INSTALL_DIR/PowerChute already exists. Do you want to use it [Yes|No]?"
-                    val=$?
-                    case $val in
-                    $YES)
-                        BackupOldPCNS
-                        res=$TRUE
-                        ;;
-                    $NO)
-#                        Echo "Please enter the installation directory:"
-#                        read INSTALL_DIR
-                        ;;
-                    *)
-                        Echo "Invalid response."
-                        ;;
-                    esac
-                else
-                    res=$TRUE
-                fi
-                ;;
-            $NO)
-#                Echo "Please enter the installation directory (Example:/opt/APC):"
-#                read INSTALL_DIR
-                ;;
-            *)
-                Echo "Invalid response."
-                ;;
-            esac
-        done
-    fi
-
-    if [ ! -d "$INSTALL_DIR" ]; then
-        Echo "Creating $INSTALL_DIR directory ..."
-        mkdir -p "$INSTALL_DIR"
-        if [ ! $? = 0 ]; then
-            Echo "Failed to create directory $INSTALL_DIR."
-				Echo "Aborting with error code-$EXIT_INVALID_INSTALL_DIR"
-            exit $EXIT_INVALID_INSTALL_DIR
-        fi
-    fi
-    Echo "PCNS will be installed to $INSTALL_DIR/PowerChute"
-}
-
-CheckBundledJava() {
-    rval=$FALSE
-    case "$OS" in
-    $VIMA)
-        JRE_FILE=$JRE_TGZ_FILE"-linux-x64.tar.gz"
-        ;;
-    $LINUX)
-		if [ "$ARCH" = "x64" ]; then
-			JRE_FILE=$JRE_TGZ_FILE"-linux-x64.tar.gz"
-		else
-			JRE_FILE=$JRE_TGZ_FILE"-linux-i586.tar.gz"
-		fi
-        ;;
-    $SOLARIS)
-        if [ $SPARC = $TRUE ]; then
-            JRE_FILE=$JRE_TGZ_FILE"-solaris-sparc.tar.gz"            
-        else
-            JRE_FILE=$JRE_TGZ_FILE"-solaris-i586.tar.gz"
-        fi
-        ;;
-    $XENSERVER)
-        JRE_FILE=$JRE_TGZ_FILE"-linux-i586.tar.gz"
-        ;;
-    $HPUX)
-        ;;
-    $AIX)
-        ;;
-    esac
-    if [ -f "$SRC_DIR/$JRE_FILE" ]; then
-        rval=$TRUE
-    fi
-    return $rval
-}
-
-AskJavaPath() {
-    CheckBundledJava
-    bundled=$?
-    res=$FALSE
-    while [ $res = $FALSE ]
-    do
-        Echo ""
-        if [ $bundled = $TRUE ];then
-            Echo "Please enter java directory if you want to use your system java (example:/usr/local/bin/jre/$JRE_VERSION) or press enter to install the bundled Java:"
-        else
-            Echo "JRE is not bundled. Please enter your java directory (example:/usr/local/bin/jre/$JRE_VERSION):"
-        fi
-        
-        read str
-                
-        if [ $bundled = $TRUE -a -z "$str" ]; then
-            #the empty string is ok, means use the path JRE
-            JAVA_DIR=""
-            res=$TRUE
-        else
-            JAVA_DIR=$str
-            res=$FALSE
-        fi
-        
-        if [ $res = $FALSE -a -n "$JAVA_DIR" ]; then
-            #Fix it as needed
-            
-            #must have / at the end, so add it    
-            buf=`echo $JAVA_DIR | grep '/$' ` 
-            if [ -z "$buf" ]; then
-                  JAVA_DIR="${JAVA_DIR}/"
-            fi
-        
-            # Add/bin at the end of JAVA_DIR if needed
-            # This allows it to be backward compatible
-            # with previous versions, which did not have 
-            # the bin
-            buf=`echo $JAVA_DIR | grep '/bin/$' ` 
-            if [ -z "$buf" ]; then
-                   JAVA_DIR="$JAVA_DIR/bin/"
-            fi
-            
-            buf=`echo $JAVA_DIR | grep ' ' ` 
-            if [ -n "$buf" ]; then
-                Echo "Java directory must not contain white space \" \""
-            else
-                buf=`echo $JAVA_DIR | grep '^/' ` 
-                if [ -z "$buf" ]; then
-                    Echo "Java directory must start with /"
-                else
-                    buf=`echo $JAVA_DIR | grep '\\\' ` 
-                    if [ -n "$buf" ]; then
-                        Echo "Java directory must not contain back slash \"\\\""
-                    elif [ ! -d $JAVA_DIR ]; then
-                        Echo "Invalid path: $JAVA_DIR"
-                    else                                      
-                        #Check the java version before confirming, no point in 
-                        #asking them if they want it is we can't accept it anyway.
-                         CheckJavaVersion
-                         res=$?                        
-                    fi
-                fi
-            fi            
-         fi 
-    done
-}
-
-InstallBundledJava() {
-    CheckBundledJava
-    if [ $? = $FALSE ]; then
-        Echo "No private JRE is bundled for this OS.  Please install and specify a JRE"
-		Echo "Aborting with error code-$EXIT_INVALID_JAVA_VERSION."
-        CancelAll $EXIT_INVALID_JAVA_VERSION
-    fi 
-    
-    # Copy jre file
-	APP_JRE_DIR=$APP_DIR/$JRE_VERSION
-	JAVA_DIR="$APP_DIR/$JRE_VERSION/bin/"
-
-    Echo "Copying jre to $APP_DIR ..."
-    mkdir -p $APP_DIR
-    cp "$SRC_DIR/$JRE_FILE" "$APP_DIR/jre.tar.gz"
-    if [ ! $? -eq 0 ]; then
-        Echo "Failed to copy jre file."
-        CancelAll
-    fi
-    cd $APP_DIR
-    chmod 700 jre.tar.gz
-
-    # Extract Java
-    Echo "Extracting jre to $APP_DIR/jre ..."
-    gunzip jre.tar.gz
-    tar -xf jre.tar
-    if [ ! $? -eq 0 ]; then
-        Echo "Failed to extract jre file."
-        CancelAll
-    fi
-    rm -rf jre.tar
-	chmod -R 0755 $APP_JRE_DIR
-    
-    # Regenerating the Shared Archive
-    if [ ! $OS = "$VIMA" ]; then
-        $JAVA_DIR/java -Xshare:dump 1>/dev/null 2>/dev/null
-    fi
-    cd $APP_DIR
-}
-
-CheckJavaVersion() {
-    Echo "Checking version of Java ..."
-    rval=$FALSE
-
-    # Show JRE Version
-    ${JAVA_DIR}java -version >/dev/null 2>&1
-    if [ ! $? -eq 0 ]; then 
-        Echo 
-        Echo "Java not found at ${JAVA_DIR}."
-    else
-        VERSION=`${JAVA_DIR}java -version 2>&1 | head -n 1 | cut -d\" -f 2 | sed s/_/\./g`
-        Echo "Detected Java Version: $VERSION"
-
-        MAJOR=`echo $VERSION | cut -d\. -f 1`
-        MINOR=`echo $VERSION | cut -d\. -f 2`
-        MINI=`echo $VERSION | cut -d\. -f 3`
-        MICRO=`echo $VERSION | cut -d\. -f 4`
-
-        if [ -z "$MICRO" ]; then
-            MICRO=0
-        fi
-        
-        case "$OS" in
-        $HPUX)
-            JRE_REQUIRED_MICRO=08
-            ;;
-        *) 
-            JRE_REQUIRED_MICRO=0
-            ;;
-        esac
-        
-        if [ $VERSION ]; then
-            if [ \( $MAJOR -gt $JRE_REQUIRED_MAJOR \) -o \( $MAJOR -eq $JRE_REQUIRED_MAJOR -a $MINOR -gt $JRE_REQUIRED_MINOR \) -o \( $MAJOR -eq $JRE_REQUIRED_MAJOR -a $MINOR -eq $JRE_REQUIRED_MINOR -a $MINI -gt $JRE_REQUIRED_MINI \) -o \( $MAJOR -eq $JRE_REQUIRED_MAJOR -a $MINOR -eq $JRE_REQUIRED_MINOR -a $MINI -eq $JRE_REQUIRED_MINI -a $MICRO -ge $JRE_REQUIRED_MICRO \) ]; then
-                Echo "Acceptable version"
-                rval=$TRUE
-            else
-                Echo "Wrong version of Java.  Minimum Java version required is $JRE_REQUIRED_MAJOR.$JRE_REQUIRED_MINOR.$JRE_REQUIRED_MINI.$JRE_REQUIRED_MICRO "
-                Echo "Java can be downloaded from www.java.com"
-            fi
-        else
-            Echo 
-            Echo "Java not found at $JAVA_DIR"
-        fi
-    fi
-    return $rval
-}
-CheckOSArch(){
-tmp=`uname -a | grep -i x86_64`
-if [ ! -z "$tmp" ]; then
-#it is a 64 bit OS
-   if [ "$ARCH" = "x32" ]; then
-     echo "64 bit OS detected.  This installer is for 32 bit OS. Please download the 64 bit installer for this OS"
-	 CancelAll
-   fi  
-else
-#It is a 32 bit OS
-   if [ "$ARCH" = "x64" ]; then
-     echo "32 bit OS detected.  This installer is for 64 bit OS. Please download the 32 bit installer for this OS"
-	 CancelAll
-   fi  
-fi
-
-}
-
-SetupJava() {
-    if [ $SILENT_MODE = $TRUE ]; then
-        if [ -z "$JAVA_DIR" ]; then
-            InstallBundledJava
-            res=$TRUE
-        else
-            CheckJavaVersion
-            res=$?
-            
-            if [ $res -eq $FALSE ]; then
-                # invalid java path
-				Echo "Aborting with error code-$EXIT_INVALID_JAVA_VERSION."
-                CancelAll $EXIT_INVALID_JAVA_VERSION
-            fi
-        fi        
-    else
-        AskJavaPath
-        if [ -z "$JAVA_DIR" ]; then
-            InstallBundledJava
-        fi
-    fi
-
-    # Show JRE Version
-    Echo ""
-    $JAVA_DIR/java -version
-    if [ ! $? -eq 0 ]; then 
-        Echo "" 
-		CheckOSArch
-        Echo "Invalid jre path."
-		CancelAll
-    fi
-    Echo ""
-    # Create java path config file
-    Echo "JAVA_DIR=$JAVA_DIR"
-    Echo ""
-    cd "$SRC_DIR"
-}
-
-SetupM11Cfg() {
-   Echo "Setup the m11.cfg file"
-   filename="$GROUP_DIR/m11.cfg"
-   setting1="host.ApplicationDirectory=$GROUP_DIR"
-   setting2="host.ComponentDirectory=$GROUP_DIR/comp"
-   setting3="Notifier.NotifierExe=$GROUP_DIR/bin/notifier"
-
-    #echo "DEBUG: $setting1"
-    #echo "DEBUG: $setting2"
-    #echo "DEBUG: $setting3"
-    
-    PARAMS=" -cp .:$GROUP_DIR/comp/pcns.jar:$GROUP_DIR/lib/m11.jar com.apcc.pcns.m11cfgInit.M11cfgInit $filename $setting1 $setting2 $setting3"
-    #echo "DEBUG: ${JAVA_DIR}java $PARAMS"
-   #Note:JAVA_DIR has the \ on the end
-   ${JAVA_DIR}java $PARAMS 1>/dev/null 2>/dev/null
-   
-}
-
-SetupCommandFiles() {
-    case "$OS" in
-    $VIMA)
-        cp VIMA/notifier.sh notifier
-        cp VIMA/shutdown.sh shutdown
-        cp VIMA/shutdownhost.pl shutdownhost.pl
-        chmod 744 shutdownhost.pl
-        ;;
-    $XENSERVER)
-        cp Linux/notifier.sh notifier
-        cp Linux/shutdown.sh shutdown
-        ;;        
-    $LINUX)
-        cp Linux/notifier.sh notifier
-        cp Linux/shutdown.sh shutdown
-        ;;
-    $SOLARIS)
-        cp Solaris/notifier.sh notifier
-        cp Solaris/shutdown.sh shutdown
-        ;;
-    $HPUX)
-        cp Hpux/notifier.sh notifier
-        cp Hpux/shutdown.sh shutdown
-        ;;
-    $AIX)
-        cp Aix/notifier.sh notifier
-        cp Aix/shutdown.sh shutdown
-        ;;
-    esac    
-    chmod 744 notifier
-    chmod 744 shutdown
-    rm -rf Linux Solaris Hpux Aix VIMA ESX XenServer
-    cd "$APP_DIR"
-}
-
-SetupAllCommandFiles() {
-    cd "$APP_DIR"
-    if [ -d $GROUP1 ]; then
-        cd ./$GROUP1/bin
-        SetupCommandFiles
-    else
-        cd ./bin
-        SetupCommandFiles
-    fi
-    cd "$APP_DIR"
-}
-
-ConfigureStartup() {
-    APP_DIR_QUOTED=\"$APP_DIR\"
-    group_dir_quoted=\"$GROUP_DIR\"
-
-    # Update scripts
-    if [ $OS = "$HPUX" ]; then
-        sed -e "s:nohup:/bin/nohup:g" powerchute.sh > powerchute.sh.tmp$$
-        mv -f powerchute.sh.tmp$$ powerchute.sh
-    fi
-    sed -e "s:GSUB_INSTALL_PATH:$APP_DIR_QUOTED:g" startup.sh > startup.sh.tmp$$
-    sed -e "s:GSUB_INSTALL_PATH:$group_dir_quoted:g" powerchute.sh > powerchute.sh.tmp$$
-    mv -f startup.sh.tmp$$ startup.sh
-    cp powerchute.sh.tmp$$ $GROUP_DIR/powerchute.sh
-    chmod 744 $GROUP_DIR/powerchute.sh
-    rm -f *.tmp$$
-
-    echo $JAVA_DIR > ${GROUP_DIR}/java.cfg
-}
-
-ConfigureAllStartup() {
-    Echo "Configuring startup files ..."
-    cd "$APP_DIR"
-    
-    if [ -d $GROUP1 ]; then
-        GROUP_DIR="$APP_DIR/$GROUP1"
-        ConfigureStartup
-        rm -f powerchute.sh*
-    else
-        GROUP_DIR=$APP_DIR
-        ConfigureStartup
-    fi
-    Echo "Startup script=$STARTUP"
-
-    cp startup.sh $STARTUP
-    chmod 0544 $STARTUP
-    rm -f startup.sh
-}
-
-UninstallOldStartupLink() {
-    if [ $UPDATE_INSTALL = $TRUE ]; then
-        if [ $OS = "$LINUX" -o $OS = "$VIMA" -o $OS = "$XENSERVER" ]; then
-            Echo "Deleting Linux symbolic link ..."
-       	 if [ -d /etc/rc0.d ]; then
-            rm -f /etc/rc0.d/K99PowerChute
-            rm -f /etc/rc1.d/K99PowerChute
-            rm -f /etc/rc2.d/K99PowerChute
-            rm -f /etc/rc3.d/K99PowerChute
-            rm -f /etc/rc4.d/K99PowerChute
-            rm -f /etc/rc5.d/K99PowerChute
-            rm -f /etc/rc6.d/K99PowerChute
-         else
-            rm -f /etc/rc.d/rc0.d/*99PowerChute
-            rm -f /etc/rc.d/rc1.d/*99PowerChute
-            rm -f /etc/rc.d/rc2.d/*99PowerChute
-            rm -f /etc/rc.d/rc3.d/*99PowerChute
-            rm -f /etc/rc.d/rc4.d/*99PowerChute
-            rm -f /etc/rc.d/rc5.d/*99PowerChute
-            rm -f /etc/rc.d/rc6.d/*99PowerChute
-         fi
- 	fi
-    fi
-}
-
-ConfigureStartupLink() {
-     if [ $OS = "$LINUX" -o $OS = "$VIMA" -o $OS = "$XENSERVER" ]; then
-        Echo "Updating Linux symbolic link ..."
-        if [ -f /etc/SuSE-release ]; then
-	    insserv PowerChute 1>/dev/null 2>/dev/null
-        elif [ -f /sbin/chkconfig ]; then
-            chkconfig --add PowerChute
-            chkconfig PowerChute on
-        elif [ -d /etc/rc0.d ]; then
-        	if [ ! -L /etc/rc0.d/K99PowerChute ]; then
-            	ln -s /etc/init.d/PowerChute /etc/rc0.d/K99PowerChute
-            fi
-            if [ ! -L /etc/rc1.d/K99PowerChute ]; then
-            	ln -s /etc/init.d/PowerChute /etc/rc1.d/K99PowerChute
-            fi
-            if [ ! -L /etc/rc2.d/S99PowerChute ]; then
-            	ln -s /etc/init.d/PowerChute /etc/rc2.d/S99PowerChute
-            fi
-            if [ ! -L /etc/rc3.d/S99PowerChute ]; then
-            	ln -s /etc/init.d/PowerChute /etc/rc3.d/S99PowerChute
-            fi
-            if [ ! -L /etc/rc4.d/S99PowerChute ]; then
-            	ln -s /etc/init.d/PowerChute /etc/rc4.d/S99PowerChute
-			fi
-			if [ ! -L /etc/rc5.d/S99PowerChute ]; then            	
-            	ln -s /etc/init.d/PowerChute /etc/rc5.d/S99PowerChute
-            fi
-            if [ ! -L /etc/rc6.d/K99PowerChute ]; then
-            	ln -s /etc/init.d/PowerChute /etc/rc6.d/K99PowerChute
-            fi
-        else
-        	if [ ! -L /etc/rc.d/rc0.d/K99PowerChute ]; then
-            	ln -s /etc/rc.d/init.d/PowerChute /etc/rc.d/rc0.d/K99PowerChute
-			fi
-			if [ ! -L /etc/rc.d/rc1.d/K99PowerChute ]; then
-            	ln -s /etc/rc.d/init.d/PowerChute /etc/rc.d/rc1.d/K99PowerChute
-            fi
-            if [ ! -L /etc/rc.d/rc2.d/S99PowerChute ]; then
-            	ln -s /etc/rc.d/init.d/PowerChute /etc/rc.d/rc2.d/S99PowerChute
-            fi
-            if [ ! -L /etc/rc.d/rc3.d/S99PowerChute ]; then
-            	ln -s /etc/rc.d/init.d/PowerChute /etc/rc.d/rc3.d/S99PowerChute
-            fi
-            if [ ! -L /etc/rc.d/rc4.d/S99PowerChute ]; then
-            	ln -s /etc/rc.d/init.d/PowerChute /etc/rc.d/rc4.d/S99PowerChute
-            fi
-            if [ ! -L /etc/rc.d/rc5.d/S99PowerChute ]; then
-            	ln -s /etc/rc.d/init.d/PowerChute /etc/rc.d/rc5.d/S99PowerChute
-            fi
-            if [ ! -L /etc/rc.d/rc6.d/K99PowerChute ]; then
-            	ln -s /etc/rc.d/init.d/PowerChute /etc/rc.d/rc6.d/K99PowerChute
-            fi
-        fi
-    else
-        case "$OS" in
-        $SOLARIS)
-            cp $STARTUP /etc/rc0.d/K99PowerChute
-            ;;
-        $HPUX)
-            Echo "Updating HP-UX symbolic link ..."
-            ln -s $STARTUP /sbin/rc1.d/K990pcns
-            ln -s $STARTUP /sbin/rc2.d/S990pcns
-            ;;
-        $AIX)
-            Echo "Updating AIX inittab ..."
-            mkitab "PCNS:2:wait:$STARTUP start #PowerChute Network Shutdown" >/dev/null 2>&1
-            ;;
-        esac
-    fi
-}
-
-ConfigureUninstall() {
-    Echo "Configuring uninstall script ..."
-    cd "$APP_DIR"
-    APP_DIR_QUOTED=\"$APP_DIR\"
-    sed -e "s:GSUB_INSTALL_PATH:$APP_DIR_QUOTED:g" uninstall > uninstall.tmp$$
-    mv -f uninstall.tmp$$ uninstall
-    chmod 0544 uninstall 
-}
-
-ConfigureOwner() {
-    chown -R root "$APP_DIR"
-    if [ $OS = "$AIX" ]; then
-        chgrp -R system $APP_DIR
-    else
-        chgrp -R root $APP_DIR
-    fi
-}
-
-RemoveStartup() {
-  if [ $OS = "$LINUX" -o $OS = "$VIMA" -o $OS = "$XENSERVER" ]; then
-    if [ -f $STARTUP ]; then
-        if [ -f /sbin/chkconfig ]; then
-            chkconfig PowerChute off
-            chkconfig --del PowerChute
-        else
-            rm -f /etc/rc.d/rc1.d/K99PowerChute
-            rm -f /etc/rc.d/rc2.d/S99PowerChute
-            rm -f /etc/rc.d/rc3.d/S99PowerChute
-            rm -f /etc/rc.d/rc4.d/S99PowerChute
-            rm -f /etc/rc.d/rc5.d/S99PowerChute
-            rm -f /etc/rc.d/rc6.d/K99PowerChute
-        fi
-        rm -f $STARTUP
-    fi
-  else
-    case "$OS" in
-    $SOLARIS)
-        rm -f /etc/rc2.d/S99PowerChute
-        rm -f /etc/rc0.d/K99PowerChute
-        ;;
-    $HPUX)
-        if [ -f /sbin/init.d/pcns ]; then
-            rm -f /sbin/rc1.d/K990pcns
-            rm -f /sbin/rc2.d/S990pcns
-            rm -f /sbin/init.d/pcns
-        fi
-        ;;
-    $AIX)
-        if [ -f /etc/rc.APCpcns ]; then
-            rmitab PCNS
-            rm -f /etc/rc.APCpcns
-        fi
-        ;;
-    esac
-  fi
-}
-
-CancelAll() {
-    cd "$SRC_DIR"
-    if [ -n "$INSTALL_DIR" ]; then
-        if [ -d "$INSTALL_DIR/PowerChute" ]; then
-             # Fix for PCNS-2463. Perform install rollback if update installation aborts due to some error and rollback to previous configuration 
-        	RollBackInstall
-        else
-            rm -f "$INSTALL_DIR/$PCNS_TAR*"
-        fi
-    fi
-    Echo ""
-    Echo "Installation cancelled."
-    Echo ""
-    exit $1
-}
-
-RollBackInstall() {
-	if [ $UPDATE_INSTALL = $TRUE ]; then
-    	if [ -d "$INSTALL_DIR/PowerChute_update_backup" ]; then
-    		echo "Performing Install Rollback"
-            rm -rf "$INSTALL_DIR/PowerChute"
-            mv "$INSTALL_DIR/PowerChute_update_backup/" "$INSTALL_DIR/PowerChute"
-            Echo "Startup script=$STARTUP"
-            $STARTUP start
-      	else
-            rm -rf "$INSTALL_DIR/PowerChute"
-            RemoveStartup
-      	fi
- 	else
-    	rm -rf "$INSTALL_DIR/PowerChute"
-    	RemoveStartup
- 	fi 
-}
-
-ConfigureFirewall(){
-    if [ -f /usr/sbin/esxcfg-firewall ]; then
-        esxcfg-firewall -o 80,tcp,out,"APC PowerChute Port 80"
-        esxcfg-firewall -o 3052,tcp,out,"APC PowerChute Port 3052"
-        esxcfg-firewall -o 3052,tcp,in,"APC PowerChute Port 3052"
-        esxcfg-firewall -o 3052,udp,out,"APC PowerChute Port 3052"
-        esxcfg-firewall -o 3052,udp,in,"APC PowerChute Port 3052"
-        esxcfg-firewall -o 6547,tcp,in,"APC PowerChute Port 6547"
-    else
-        if [ -f /sbin/iptables ] || [ -f /usr/sbin/iptables ]; then
-            iptables -I OUTPUT -p tcp --sport 80 -j ACCEPT
-            iptables -I OUTPUT -p tcp --sport 3052 -j ACCEPT
-            iptables -I INPUT -p tcp --dport 3052 -j ACCEPT
-            iptables -I OUTPUT -p udp --sport 3052 -j ACCEPT
-            iptables -I INPUT -p udp --dport 3052 -j ACCEPT
-            iptables -I INPUT -p tcp --dport 6547 -j ACCEPT
-            
-            service iptables save
-        fi
-		
-		if [ -f /sbin/ip6tables ] || [ -f /usr/sbin/ip6tables ]; then
-            ip6tables -I OUTPUT -p tcp --sport 80 -j ACCEPT
-            ip6tables -I OUTPUT -p tcp --sport 3052 -j ACCEPT
-            ip6tables -I INPUT -p tcp --dport 3052 -j ACCEPT
-            ip6tables -I OUTPUT -p udp --sport 3052 -j ACCEPT
-            ip6tables -I INPUT -p udp --dport 3052 -j ACCEPT
-            ip6tables -I INPUT -p tcp --dport 6547 -j ACCEPT
-            
-            service ip6tables save
-        fi
-               
-   fi
-}
-
-DisplayEULA(){
-    
-    # Default to english license
-    EULA="apclicense.txt"
-
-    Echo "$LANG" | grep -i 'ja_JP.utf-*8'
-    if [ $? -eq 0 ]; then
-       EULA="apclicense.txt.ja_UTF8"
-    fi
-
-    Echo "$LANG" | grep -i 'ja_JP.IBM-*943'
-    if [ $? -eq 0 ]; then
-       EULA="apclicense.txt.ja_ANSI"
-    fi
-
-    Echo "$LANG" | grep -i 'eucJP'
-    if [ $? -eq 0 ]; then
-        EULA="apclicense.txt.ja_EUC"
-    fi 
-    
-    # Extract EULA
-    cp $PCNS_ZIP backup.tar.gz
-    gunzip $PCNS_ZIP
-    tar -xof $PCNS_TAR > /dev/null 2>&1
-        
-    # Display EULA
-    printf "\nPress any key to display End User License Agreement\n"
-    Pause
-    more "PowerChute/group1/$EULA"
-    
-    # Remove file, now that we've read it.
-    rm -rf PowerChute > /dev/null 2>&1
-    rm -rf $PCNS_TAR > /dev/null 2>&1
-    mv backup.tar.gz $PCNS_ZIP > /dev/null 2>&1
-    
-    agreed=
-    while [ -z "$agreed" ]
-    do
-        printf "\nDo you agree to the above license terms? [yes or no]\n"
-        read reply leftover
-        case $reply in
-            [yY] | [yY][eE][sS])
-                agreed=1
-                ;;
-            [nN] | [nN][oO])
-                printf "If you don't agree to the license you can't install this software\n"
-				printf "Aborting with error code-$EXIT_USER_ABORT\n"
-                exit $EXIT_USER_ABORT
-                ;;
-            *)
-                printf "Please enter \"yes\" or \"no\"."
-                ;;
-        esac
-     done
-}
-
-AddESXiTargetServer() {
-
-    if [ -f /etc/vima-release ] || [ -f /etc/vma-release ]; then
-        echo " "
-        echo "In order for PCNS to shutdown the ESXi host, it must be added as a target server."
-        
-        # validIP:
-        # 0 - IP is valid
-        # 1 - IP is invalid
-        # 2 - User is skipping this
-        
-        validIP=1
-                
-        while [ $validIP -eq 1 ]
-        do
-            echo "Please enter ESXi host IP (XXX.XXX.XXX.XXX) or (q) to skip:"
-            read esxihostip
-        
-            case $esxihostip in
-                [qQ])
-                    validIP=2
-                    printf "\nSkipping configuration of ESXi Host Shutdown.\n"
-                    ;;
-            esac
-            
-            
-            if [ $validIP -ne 2 ]; then
-                #
-                # Validate IP
-                #
-                valid_ip $esxihostip
-                if [ $? -ne 0 ]; then
-                    # invalid ip
-                    printf "\nInvalid IP entered.\n"
-                    validIP=1
-                else
-                    validIP=0
-                fi                
-            fi            
-        done
-        
-        if [ $validIP -eq 0 ]; then
-            echo "Please enter ESXi host username:"
-            read esxihostuser
-        
-            echo "Please enter ESXi host password:"
-            OLDCONFIG=`stty -g`
-            stty -icanon -echo min 1 time 0
-            read esxihostpwd
-            stty $OLDCONFIG
-        
-            echo "Adding target server..."
-            
-            vifp addserver $esxihostip --username $esxihostuser --password $esxihostpwd
-            vifp listservers | grep $esxihostip
-            if [ $? -eq 0 ]; then
-                    echo "Successfully added ESXi host to target server list."                    
-                    echo ""
-            else
-                    echo "Failed to add ESXi host."
-                    echo "To add the host manually please run - sudo vifp addserver <ipaddress>"
-                    echo ""
-            fi        
-        fi        
-    fi
-}
-
-valid_ip()
-{
-    ERROR=0
-    oldIFS=$IFS
-    IFS=.
-    set -f
-    set -- $1
-    if [ $# -eq 4 ]; then
-        for seg
-        do
-            case $seg in
-                ""|*[!0-9]*) ERROR=1;break ;; ## Segment empty or non-numeric char
-                *) [ $seg -gt 255 ] && ERROR=2 ;;
-            esac
-        done
-    else
-        ERROR=3 ## Not 4 segments
-    fi
-    IFS=$oldIFS
-    set +f
-    return $ERROR
-}
-
-CheckLocale(){
-    Echo "$LANG" | grep -i 'ja*'
-    if [ $? -eq 0 ]; then   
-        # Abort, can't install english on Japanese OS.
-        printf "\nThis version of PowerChute Network Shutdown does not support the Japanese language. Please consult www.apc.com for the required version of PowerChute Network Shutdown.\n"
-		Echo "Aborting with error code-$EXIT_INVALID_LOCALE"
-        exit $EXIT_INVALID_LOCALE
-    fi    
-}
-
-ApplySilentConfig(){
-    if [ "$SILENT_MODE" = "$TRUE" ]; then
-        Echo "Applying Configuration ..."
-        
-        # Register with NMC
-        oldDir=$PWD
-        cd $APP_DIR/$GROUP1
-
-        upgrade="false"
-        if [ "$UPDATE_INSTALL" = "$TRUE" ]; then
-            upgrade="true"
-        fi                
-        
-        javaParams="-Xms32m -Xmx64m -cp .:comp/pcns.jar:lib/m11.jar:lib/commons-codec-1.4.jar:lib/commons-collections-3.2.1.jar:lib/commons-configuration-1.6.jar:lib/commons-lang-2.5.jar:lib/commons-logging-1.1.1.jar:lib/log4j-1.2.16.jar:lib/bcprov-jdk16-146.jar:lib/json_simple-1.1.jar -DsilentConfig=$SILENT_CONFIG -DsourceDir=\"$SRC_DIR\" -DapplicationDirectory=\"$APP_DIR\" -Dgroup=1 -Dupgrade=$upgrade com.apcc.pcns.silentconfig.SilentConfig"
-        echo ${JAVA_DIR}java  $javaParams 2>/dev/null > $APP_DIR/$GROUP1/run.sh
-        chmod +x $APP_DIR/$GROUP1/run.sh
-		$APP_DIR/$GROUP1/run.sh
-		
-        code=$?
-		rm -f $APP_DIR/$GROUP1/run.sh
-        if [ $code -ne 0 ]; then
-            Echo "Error applying configuration.  Error code is: $code"
-            CancelAll $code
-        fi
-        
-        Echo "Configuration complete."
-        cd $oldDir    
-    fi
-}
-
-
-InstallHelp() {
-    # Copy Standard Help files
-    HELP_DIR="$INSTALL_DIR/PowerChute/group1/comp/http/html/Help"
-    mv $HELP_DIR/Standard/* $HELP_DIR/.
-    rmdir $HELP_DIR/Standard 1>/dev/null 2>/dev/null
-    rm -rf $HELP_DIR/VMware/* 1>/dev/null 2>/dev/null
-    rmdir $HELP_DIR/VMware 1>/dev/null 2>/dev/null
-}
-
-InstallComplete(){
-    NODE_NAME=`uname -n`
-    Echo ""
-    Echo "Installation has completed."
-    Echo "PowerChute Network Shutdown can be accessed through your browser at https://<your_server_ip_address>:6547"
-
-    if [ $UPDATE_INSTALL = $FALSE ]; then    
-        Echo "Please complete the configuration wizard so that PowerChute Network Shutdown can protect your server."
-    fi
-    
-    Echo ""
-}
-
-######################################################################
-# Main routine
-######################################################################
-SRC_DIR=`pwd`
-
-# Check zipped install file
-if [ ! -f $PCNS_ZIP ]; then
-    Echo "Can\'t find $PCNS_ZIP"
-	Echo "Aborting with error code-$EXIT_ZIPFILE_MISSING\n"
-    exit $EXIT_ZIPFILE_MISSING
-fi
-
-# Print Banner
-Echo "------------------------------------------------------------------"
-Echo "     PowerChute Network Shutdown 3.1.0 for Linux"
-Echo "     Copyright (c) 1999-2013 Schneider Electric."
-Echo "     All Rights Reserved."
-Echo "------------------------------------------------------------------"
-Echo ""
-
-# Check OS type
-CheckOS
-
-# Check root account
-IsRootUser
-
-# Check Locale Compatibility
-CheckLocale
-
-# Check the OS architecture
-CheckOSArch
-
-# Initialize
-Initialize
-
-# Check silent install
-if [ -z "$1" ]; then
-    SILENT_MODE=$FALSE
-elif [ "$1" = "-f" ]; then 
-    if [ -r "$2" ]; then
-        SILENT_MODE=$TRUE
-        SILENT_CONFIG=$2
-        Echo "Silent mode input from $SILENT_CONFIG"
-        Echo ""
-        SetSilentConfig
-    else
-	    Echo "Aborting with error code-$EXIT_SILENT_CONFIG_MISSING"
-        Echo "Error: Invalid file $2"
-        exit $EXIT_SILENT_CONFIG_MISSING
-    fi
-else
-    PrintUsage
-fi
-
-# Show EULA
-if [ $SILENT_MODE = $TRUE ]; then
-   if [ "$ACCEPT_EULA" = "$STR_YES" ];  then
-        Echo "EULA has been accepted"
-   else
-        Echo "Aborting with error code-$EXIT_EULA_NOT_ACCEPTED"
-        Echo "Error: EULA must be accepted by setting ACCEPT_EULA=$STR_YES in config file"
-        exit $EXIT_EULA_NOT_ACCEPTED
-   fi
-else
-   DisplayEULA
-fi
-
-# Check installed applications
-IsPCPlusInstalled
-IsPCBEInstalled
-IsPCSInstalled
-IsPCNSInstalled
-
-InitUpdate
-
-# Set Install dir
-SetInstallDir
-BackupOldPCNS
-
-APP_DIR="$INSTALL_DIR/PowerChute"
-
-#Check the dependent packages to install java in 64 bit arch
-
-# Setup java
-SetupJava
-
-# Copy tar file to install dir
-Echo "Copying the installation files ..."
-cp "$PCNS_ZIP" "$INSTALL_DIR"
-cd "$INSTALL_DIR"
-
-# Extract PCNS files
-Echo "Extracting PCNS files ..."
-gunzip $PCNS_ZIP
-tar -xf $PCNS_TAR > /dev/null 2>&1
-if [ ! $? = 0 ]
-then
-    Echo "Failed to extract files"
-fi
-rm -rf $PCNS_TAR
-
-
-cd "$APP_DIR"
-Echo "PCNS is extracted to $APP_DIR"
-
-# Setup script files
-SetupAllCommandFiles
-
-# Configure startup script
-ConfigureAllStartup 
-UninstallOldStartupLink
-ConfigureStartupLink
-
-# Fix for PCNS-2453. Multiple entries in 'iptables' on installing PCNS over existing install
-if [ $OS = $VIMA ] || [ $OS = $LINUX ]; then
-service iptables status 1>/dev/null 2>/dev/null
-OUT=$?
-if [ $OUT -eq 0 ] && [ $UPDATE_INSTALL = $FALSE ]; then
-   ConfigureFirewall
-fi
-else
-ConfigureFirewall
-fi
-
-# Configure uninstall script
-ConfigureUninstall
-ConfigureOwner
-
-# For Update install
-CopyUpdateFiles
-
-#Install Help
-InstallHelp
-
-# Start the Service
-SetupM11Cfg
-ApplySilentConfig
-# Fix for PCNS-2463. Delete the back up PowerChute folder once the update is done successfully.
-UninstallOldPCNS
-$STARTUP start
-
-InstallComplete
-
-cd "$SRC_DIR"
-exit $EXIT_SUCCESS
diff --git a/WF/src/APC/PowerChute/Linux_x64/jre-7u45-linux-x64.tar.gz b/WF/src/APC/PowerChute/Linux_x64/jre-7u45-linux-x64.tar.gz
deleted file mode 100755
index 7d24ba3..0000000
Binary files a/WF/src/APC/PowerChute/Linux_x64/jre-7u45-linux-x64.tar.gz and /dev/null differ
diff --git a/WF/src/APC/PowerChute/Linux_x64/pcns310.tar.gz b/WF/src/APC/PowerChute/Linux_x64/pcns310.tar.gz
deleted file mode 100755
index dcf1f1f..0000000
Binary files a/WF/src/APC/PowerChute/Linux_x64/pcns310.tar.gz and /dev/null differ
diff --git a/WF/src/APC/PowerChute/Linux_x64/silentInstall.sample b/WF/src/APC/PowerChute/Linux_x64/silentInstall.sample
deleted file mode 100755
index cd97ec4..0000000
--- a/WF/src/APC/PowerChute/Linux_x64/silentInstall.sample
+++ /dev/null
@@ -1,181 +0,0 @@
-# APC PowerChute Network Shutdown (PCNS) Silent Installer
-# 
-# This file contains parameters used by the PCNS silent
-# install option to support mass installation.
-#
-# Do not enclose values in quotes
-#
-# -------------------------------------------------------------------
-# Accept the EULA.
-#
-# This must be changed to YES to accept the EULA.  This is not case
-# sensitive.
-
-ACCEPT_EULA=NO
-#ACCEPT_EULA=YES
-
-# -------------------------------------------------------------------
-# The directory in which to install PCNS:
-# The default value /opt/APC is used if commented out or specified 
-# null value as "INSTALL_DIR="
-#
-# Values specified here are case sensitive.
-# -------------------------------------------------------------------
-
-INSTALL_DIR=/opt/APC
-
-# -------------------------------------------------------------------
-# The directory in which java is installed:
-# A PowerChute only private Java Runtime is used if commented out or
-# specified null value as "JAVA_DIR="
-#
-# PowerChute only private Java Runtime is NOT available on some 
-# Operating Systems.  See PowerChute Documentation for more details.
-#
-# This directory must specify a Java Runtime version 1.7.0 or later.
-#
-# Values specified here are case sensitive. 
-# -------------------------------------------------------------------
-
-JAVA_DIR=/usr/java/latest
-
-# -------------------------------------------------------------------
-# The silent install can register this host's IP address with the 
-# management card. If you are installing PCNS on more than 50 hosts
-# for one management card, consult the PCNS Installation Guide. Valid
-# values for this parameter are "no" or "yes".
-#
-# Values specified here are not case sensitive.
-# -------------------------------------------------------------------
-
-REGISTER_WITH_NMC=YES
-
-# -------------------------------------------------------------------
-# Uncomment and edit the following to specify the installation 
-# configuration.  The installation mode can have one of the 
-# following values:
-#
-# 'single': Register with a single NMC card.
-# 'redundant': Register with several NMC cards in a redundant  
-#	configuration.
-# 'parallel': Register with several NMC cards in a parallel 
-#	configuration.
-#
-# Values specified here are not case sensitive.
-# -------------------------------------------------------------------
-
-# MODE=single
-
-# -------------------------------------------------------------------
-# Fill in the below fields with the correct network configuration. Ensure
-# all the NMCs and servers are in the same network configuration.
-#
-# Valid values for NETWORKCONFIG are 'IPv4' and 'IPv6'
-#
-# Valid values for IPV6NETWORKCONFIG are 'Unicast' and 'Multicast'. This
-# parameter need not specified if the network configuration is IPv4
-# -------------------------------------------------------------------
-
-NETWORKCONFIG=IPv4
-#IPV6NETWORKCONFIG= 
-
-# -------------------------------------------------------------------
-# Uncomment and edit the following to specify the UPS Network 
-# Management cards to register with.
-# -------------------------------------------------------------------
-
-# IP_1=000.000.000.000
-# IP_2=000.000.000.000
-# IP_3=000.000.000.000
-# IP_4=000.000.000.000
-# IP_5=000.000.000.000
-# IP_6=000.000.000.000
-# IP_7=000.000.000.000
-# IP_8=000.000.000.000
-# IP_9=000.000.000.000
-
-# -------------------------------------------------------------------
-# Uncomment and edit the following to specify the UPS Outlet Group 
-# for each UPS NMC.  The value given is the outlet number.
-# -------------------------------------------------------------------
-
-# IP_1_Outlet=0
-# IP_2_Outlet=0
-# IP_3_Outlet=0
-# IP_4_Outlet=0
-# IP_5_Outlet=0
-# IP_6_Outlet=0
-# IP_7_Outlet=0
-# IP_8_Outlet=0
-# IP_9_Outlet=0
-
-# -------------------------------------------------------------------
-# This value specifies the UPS Network Management Port to use for
-# registration.  Valid values are 80, 443, and 5000 to 32768.
-# -------------------------------------------------------------------
-
-PORT=80
-
-# -------------------------------------------------------------------
-# This value specifies the protocol to use when registering with the
-# UPS Network Management Card.  Valid values are 'http' or 'https'.
-#
-# Values specified here are not case sensitive.
-# -------------------------------------------------------------------
-
-PROTOCOL=http
-
-# -------------------------------------------------------------------
-# When using the https protocol, SSL certificates are used to secure the 
-# connection.  By default the NMC uses a self signed certificate, 
-# which needs to be accepted.
-#
-# ACCEPTCERTS=YES 
-# Certificates which are self signed, or have some other issue, will
-# be automatically accepted (Recommended)
-#
-# ACCEPTCERTS=NO
-# Connection will only be established if the NMC has been configured
-# with a valid certificate.
-#
-# Values specified here are not case sensitive.
-# -------------------------------------------------------------------
-
-#ACCEPTCERTS=YES
-
-# -------------------------------------------------------------------
-# Fill in the below fields with the correct security information.
-# The Administrator User Name and Authentication Phrase must match
-# the settings of the Management Card in your UPS.
-#
-# Values specified here are case sensitive.
-# -------------------------------------------------------------------
-
-USERNAME=
-PASSWORD=
-AUTHENTICATION_PHRASE=
-
-# -------------------------------------------------------------------
-# Uncomment and edit the following only if you have more than one
-# network card installed locally. The below fields should specify
-# which local IP address to register with the UPS Network Management
-# Card. 
-# 
-# This field will be read if the network configuration is IPv4
-# -------------------------------------------------------------------
-
-#LOCAL_IP_ADDRESS=000.000.000.000
-
-# -------------------------------------------------------------------
-# The below fields should specify unicast/multicast address to register 
-# with the UPS Network Management Card. 
-# 
-# This field will be read if the network configuration is IPv6.
-#
-# Both Unicast and Multicast address are required if the IPV6NETWORKCONFIG
-# is 'Multicast'. If IPV6NETWORKCONFIG is 'Unicast' only Unicast address
-# is required.
-# -------------------------------------------------------------------
-
-#UNICAST_ADDRESS=
-#MULTICAST_ADDRESS=
\ No newline at end of file
diff --git a/WF/src/APC/PowerChute/pcns310Linux-x86-64.tar.gz b/WF/src/APC/PowerChute/pcns310Linux-x86-64.tar.gz
deleted file mode 100644
index aa2b380..0000000
Binary files a/WF/src/APC/PowerChute/pcns310Linux-x86-64.tar.gz and /dev/null differ
diff --git a/WF/src/ipt-gateway b/WF/src/ipt-gateway
deleted file mode 160000
index de0ebb6..0000000
--- a/WF/src/ipt-gateway
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit de0ebb616266e09c1ded3ae277b5b184093f9cc5
diff --git a/WF/src/mailsystem b/WF/src/mailsystem
deleted file mode 160000
index 03b820b..0000000
--- a/WF/src/mailsystem
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 03b820b8b869d6be229340a99ed5994dcd0edec9
diff --git a/WF/src/openvpn b/WF/src/openvpn
deleted file mode 160000
index ebff5a5..0000000
--- a/WF/src/openvpn
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit ebff5a557b537bcb8192d94f733c4df86594258d