eupolicy.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
This Mastodon server is a friendly and respectful discussion space for people working in areas related to EU policy. When you request to create an account, please tell us something about you.

Server stats:

201
active users

#iptables

0 posts0 participants0 posts today
Gonçalo Ribeiro<p>Next, I had the theory that maybe the game was checking the source IP address of the packet to see it if matched the expected player's address based on the DirectPlay protocol phase.</p><p>So I added the following <a href="https://infosec.exchange/tags/iptables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables</span></a> rule such that any traffic coming from the host towards Sarah's VM (192.168.1.242) would appear as if had come from James' VM (192.168.1.243).</p><p><code>iptables -t nat -A POSTROUTING -p udp -s &lt;my ip&gt; -d 192.168.1.242 -j SNAT --to-source 192.168.1.243</code></p><p>In the packet captures I could see that the source IP changed as intended and Sarah's game responded to these messages, but no trains were produced.</p><p><a href="https://infosec.exchange/tags/games" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>games</span></a> <a href="https://infosec.exchange/tags/pcgaming" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pcgaming</span></a> <a href="https://infosec.exchange/tags/trains" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>trains</span></a> <a href="https://infosec.exchange/tags/LEGO" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LEGO</span></a></p>
uvok cheetah<p>...<br>For some reason, <a href="https://woof.tech/tags/iptables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables</span></a> logging doesn't appear in /var/log/syslog nor /var/log/kern.log nor journalctl.<br>What am I missing?</p><p>(Debian, rsyslog is installed, the log rule definitely is hit, the rule line looks like </p><p>-A FORWARD -j LOG --log-prefix "Dropped Packet: "</p><p>edit: does it matter that I'm running this in a Linux network namespace?</p><p>edit2: Uhh, yeah. <a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=2851940ffee313e0ff12540a8e11a8c54dea9c65" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">git.kernel.org/pub/scm/linux/k</span><span class="invisible">ernel/git/torvalds/linux.git/commit?id=2851940ffee313e0ff12540a8e11a8c54dea9c65</span></a> <br>Apparently it's disabled by defait</p><p><a href="https://woof.tech/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>linux</span></a></p>
uvok cheetah<p>I did a mistake with my <a href="https://woof.tech/tags/dn42" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>dn42</span></a> network namespace <a href="https://woof.tech/tags/iptables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables</span></a> setup! I made some crucial mistakes with the rules!</p><p>This should be better:</p><p>```<br>-A FORWARD -s fd00::/8 -d fd00::/8 -j ACCEPT<br>-A FORWARD -i eth0 -d fd00::/8 -j ACCEPT<br>-A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT<br>```</p>
GNU/Linux.ch<p>iptables-Regeln erstellen und dauerhaft speichern (Iptables Teil 2)</p><p>In diesem Artikel erkläre ich, wie man eigene Firewall-Regeln mit iptables erstellt und dauerhaft speichert. Mit dabei: eine Einführung in die wichtigsten Begriffe wie INPUT, OUTPUT, DROP und conntrack. </p><p><a href="https://social.anoxinon.de/tags/iptables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables</span></a> <a href="https://social.anoxinon.de/tags/iptables_persistent" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables_persistent</span></a> <a href="https://social.anoxinon.de/tags/Firewall" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Firewall</span></a> <a href="https://social.anoxinon.de/tags/Netzwerksicherheit" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Netzwerksicherheit</span></a> <a href="https://social.anoxinon.de/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> <a href="https://social.anoxinon.de/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a></p><p><a href="https://gnulinux.ch/iptables-regeln-erstellen-und-dauerhaft-speichern-iptables-teil-2" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">gnulinux.ch/iptables-regeln-er</span><span class="invisible">stellen-und-dauerhaft-speichern-iptables-teil-2</span></a></p>
GNU/Linux.ch<p>Was ist iptables-persistent? Und wie unterscheidet es sich von UFW? (Iptables Teil 1)</p><p>Wer mit der Linux-Firewall iptables arbeitet, trifft früher oder später auf das Paket iptables-persistent. Was ist das genau – und worin unterscheidet es sich von der einfacheren Alternative UFW? </p><p><a href="https://social.anoxinon.de/tags/iptables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables</span></a> <a href="https://social.anoxinon.de/tags/Firewall" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Firewall</span></a> <a href="https://social.anoxinon.de/tags/Ufw" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Ufw</span></a> <a href="https://social.anoxinon.de/tags/Netzwerksicherheit" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Netzwerksicherheit</span></a> <a href="https://social.anoxinon.de/tags/iptables_persiste" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables_persiste</span></a> <a href="https://social.anoxinon.de/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a></p><p><a href="https://gnulinux.ch/was-ist-iptables-persistent-und-wie-unterscheidet-es-sich-von-ufw" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">gnulinux.ch/was-ist-iptables-p</span><span class="invisible">ersistent-und-wie-unterscheidet-es-sich-von-ufw</span></a></p>
albi always there<p>konec <a href="https://f.cz/tags/IPTables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IPTables</span></a> je v dohlednu, částecně už i na dosah<br>za poslední rok jsem investoval čas a z předchozích <a href="https://f.cz/tags/UFW" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>UFW</span></a> a mrtvého <a href="https://f.cz/tags/Shorewall" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Shorewall</span></a> přeskočil <a href="https://f.cz/tags/FirewallD" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FirewallD</span></a> rovnou do nahatých <a href="https://f.cz/tags/NFTables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NFTables</span></a></p><p>- UFW využívá na pozadí iptables automaticky překládané do nftables, což je paskvil, který může vyhovovat závislákům na prehistorických iptables souborech "na které se nešahá", ale progresivnějšímu uživateli dost svazuje ruce<br>- navíc je nutné mít namemorovanou jejich speciální syntaxi a hlavně skladbu argumentů, takže většinou zadám validní příkaz na asi 4. pokus</p><p>- FirewallD si samozřejmě taky vymyslel vlastní příkazovou syntaxi, ale zároveň zapleveluje nftables nepoužívanými chainy, přijít k cizímu stroji a udělat nějakou drobnou úpravu v pravidlech je skoro na nobelovku</p><p>- NFtables jsou za mě nejpřehlednější a nejspolehlivější (největší kontrola), navíc umožňujou mít totální kontrolu nad firewallem a poslat k šípku snahy Dockeru o nadvládu<br>- navíc jsou velmi jednoduché a snadno pochopitelné</p>
Edd<p>I've spent the last two days at $DayJob bashing my head against a problem. Finally got a solution engineered and deployed last night and it's working.</p><p>Woke up suddenly at about 4am this morning realizing that I massively over engineered it, and I could have solved the problem with about 3 <a href="https://mastodon.eddmil.es/tags/IPTables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IPTables</span></a> rules instead.</p><p>Why can't my brain think of these things before I deploy my overly elaborate contraptions?</p>
europlus :autisminf:<p><a href="https://social.europlus.zone/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> <a href="https://social.europlus.zone/tags/SysAdmins" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SysAdmins</span></a> <a href="https://social.europlus.zone/tags/NetworkAdmins" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NetworkAdmins</span></a></p><p>Ubuntu 24.04 system with a publicly-routable external IP address.</p><p>For a given incoming UDP port (&lt;1024, call it port x, I can’t change this), I want to forward that to localhost (or the ens3 interface) on another port (&gt;1024, port y) so I can invoke QEMU as non-root and forward port y to the emulated system’s port x via slirp.</p><p>Is this doable?</p><p>I’ve tried heaps of nat prerouted examples, but haven’t yet gotten anything to stick.</p><p>Boosts appreciated!</p><p><a href="https://social.europlus.zone/tags/IPTables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IPTables</span></a></p>
MOULE :RainbowLogo:<p>Since <a href="https://mastodon.moule.world/tags/Tumblr" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Tumblr</span></a> (owned by <a href="https://mastodon.moule.world/tags/MattMullenweg" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MattMullenweg</span></a>'s <a href="https://mastodon.moule.world/tags/Automattic" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Automattic</span></a>) renewed plans to join the <a href="https://mastodon.moule.world/tags/Fediverse" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Fediverse</span></a>, I suggest blocking them (as I have) for the same reason as <a href="https://mastodon.moule.world/tags/Threads" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Threads</span></a>: queerphobia and corporate tracking.</p><p>Just like the anti-Meta <a href="https://mastodon.moule.world/tags/FediPact" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FediPact</span></a> (<a href="https://FediPact.online" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">FediPact.online</span><span class="invisible"></span></a>), there's now an anti-Automattic <a href="https://mastodon.moule.world/tags/FediPact2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FediPact2</span></a>: <a href="https://FediPact2.online" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">FediPact2.online</span><span class="invisible"></span></a></p><p>Like I did with Meta, I wrote <a href="https://mastodon.moule.world/tags/iptables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables</span></a> commands your <a href="https://mastodon.moule.world/tags/FediAdmin" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FediAdmin</span></a> can use to drop all traffic to and from Automattic's IP addresses: <a href="https://pastebin.com/e5UKJCKU" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">pastebin.com/e5UKJCKU</span><span class="invisible"></span></a> (source: AS2635)</p>
Dan Oachs<p>I was finally forced to switch from <a href="https://ipv6.social/tags/iptables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables</span></a> to <a href="https://ipv6.social/tags/nftables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>nftables</span></a> on a new <a href="https://ipv6.social/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>linux</span></a> campus firewall setup.</p><p>I really should have made the switch years ago. Nftables is SO MUCH nicer! Having sets and variables has really simplified the configuration a ton.</p><p>I was happy with iptables for a really long time and so familiar with it, that I guess I was afraid of something new, but learning nftables has been fun and a lot easier than I expected for some reason.</p>
Lamp<p>How come host can't use its own port forwarding? -A PREROUTING -d [public-ip] [port matching] -j DNAT [to linux container] So I want any connection from anywhere to be forwarded. But it doesn't apply to connections from same host. It just connects to itself as usual. <a href="https://bsky.app/search?q=%23iptables" rel="nofollow noopener" target="_blank">#iptables</a> <a href="https://bsky.app/search?q=%23linux" rel="nofollow noopener" target="_blank">#linux</a></p>
Adam ♿<p>Can anyone tell me what this <a href="https://aus.social/tags/IPTables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IPTables</span></a> entry related to <a href="https://aus.social/tags/DNS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DNS</span></a> is?</p><p><a href="https://aus.social/tags/Asus" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Asus</span></a> has "helpfully" added this to my parents' router.</p><p>Chain OUTPUT (policy ACCEPT)<br>target prot opt source destination<br>OUTPUT_DNS udp -- anywhere anywhere udp dpt:domain u32 "0x0&gt;&gt;0x16&amp;0x3c@0x8&gt;&gt;0xf&amp;0x1=0x0"<br>OUTPUT_DNS tcp -- anywhere anywhere tcp dpt:domain u32 "0x0&gt;&gt;0x16&amp;0x3c@0xc&gt;&gt;0x1a&amp;0x3c@0x8&gt;&gt;0xf&amp;0x1=0x0"</p><p><a href="https://aus.social/tags/AskFedi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AskFedi</span></a></p>
DrScriptt<p><a href="https://oldbytes.space/tags/iptables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables</span></a>' <a href="https://oldbytes.space/tags/NETMAP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NETMAP</span></a> is functionally for IPv4 what network prefix translation (NPT) is for IPv6.</p>
DrScriptt<p><a href="https://oldbytes.space/tags/iptables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables</span></a>' <a href="https://oldbytes.space/tags/NETMAP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NETMAP</span></a> target can alter the source IP range exclusive or the destination IP range.</p><p>Which it does is dependent on where you use the NETMAP target.</p><p>If you use the NETMAP target in the PREROUTING chain of the mangle table, it alters the destination ip range.</p><p>If you use the NETMAP target in the POSTROUTING chain of the mangle table, it alters the source IP range.</p>
DrScriptt<p>It has been zero days since <a href="https://oldbytes.space/tags/iptables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables</span></a> solved a problem I shouldn't have to solve. Specifically the <a href="https://oldbytes.space/tags/NETMAP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NETMAP</span></a> target.</p><p>iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -d 198.51.100.0/24 -i eth1 -j MARK --set-xmark 0xdeadbeef/0xffffffff</p><p>iptables -t nat -A PREROUTING -s 192.0.2.0/24 -d 198.51.100.0/24 -i eth1 -m mark --mark 0xdeadbeef -j NETMAP --to 192.0.2.0/24</p><p>iptables -t nat -A POSTROUTING -s 192.0.2.0/24 -d 192.0.2.0/24 -o eth1 -m mark --mark 0xdeadbeef -j NETMAP --to 198.51.100.0/24</p>
sebsauvage<p>🐧 <a href="https://framapiaf.org/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> <a href="https://framapiaf.org/tags/r%C3%A9seau" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>réseau</span></a> <a href="https://framapiaf.org/tags/iptables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables</span></a> <br>Quelqu'un s'est déjà amusé à autoriser juste un pays avec un ipset ?</p>
adingbatponder<p><span class="h-card" translate="no"><a href="https://hdev.im/@farcaller" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>farcaller</span></a></span> Ok. Nice. The result of <br>ss -tunlp<br> is in the image... looks clean to me.. but I am no expert... and my <a href="https://fosstodon.org/tags/iptables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables</span></a> also... if there is anything odd I would be happy to know about it.</p>
Krafter<p>Anyone know how to get samba working on <a href="https://fosstodon.org/tags/postmarketOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>postmarketOS</span></a>?</p><p>I followed the Alpine Wiki guide (<a href="https://wiki.alpinelinux.org/wiki/Setting_up_a_Samba_server" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">wiki.alpinelinux.org/wiki/Sett</span><span class="invisible">ing_up_a_Samba_server</span></a>), and opened some ports (<a href="https://www.cyberciti.biz/faq/what-ports-need-to-be-open-for-samba-to-communicate-with-other-windowslinux-systems/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">cyberciti.biz/faq/what-ports-n</span><span class="invisible">eed-to-be-open-for-samba-to-communicate-with-other-windowslinux-systems/</span></a>) but I still can't connect to it (it just says "timed out" when trying to retrieve the share list).</p><p>Any ideas?<br><a href="https://fosstodon.org/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> <a href="https://fosstodon.org/tags/Samba" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Samba</span></a> <a href="https://fosstodon.org/tags/Networking" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Networking</span></a> <a href="https://fosstodon.org/tags/IPTables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IPTables</span></a> <a href="https://fosstodon.org/tags/NFTables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NFTables</span></a> <a href="https://fosstodon.org/tags/postmarketOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>postmarketOS</span></a> <a href="https://fosstodon.org/tags/OnePlus6" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OnePlus6</span></a></p>
Lars Marowsky-Brée 😷<p>Ah, obviously. <a href="https://mastodon.online/tags/docker" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>docker</span></a> only gets along with <a href="https://mastodon.online/tags/firewalld" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>firewalld</span></a> if the latter is using the iptables backend (not the higher performing nftables default).<br>The <a href="https://mastodon.online/tags/iptables" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iptables</span></a> backend is depreciated and slated for removal.</p><p>And of course there's no error message if configured "incorrectly", just random breakage that one then gets to debug!</p><p>I hate computers. I wish I was good enough at something else.</p><p><a href="https://mastodon.online/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a></p>
Asta [AMP]<p><span>I have some networking questions but am totally out of my depth on this as I don't even know the terms to look for.<br><br>I have an ISP provided fiber box that acts as a router and WIFI endpoint and a separate </span><a href="https://fire.asta.lgbt/tags/opnsense" rel="nofollow noopener" target="_blank">#opnsense</a><span> machine I'd like to continue using as my </span><a href="https://fire.asta.lgbt/tags/router" rel="nofollow noopener" target="_blank">#router</a><span>/</span><a href="https://fire.asta.lgbt/tags/firewall" rel="nofollow noopener" target="_blank">#firewall</a><span>/</span><a href="https://fire.asta.lgbt/tags/DHCP" rel="nofollow noopener" target="_blank">#DHCP</a><span> server. It was previously configured for a cable modem so I'd plug the modem into the port I'd designated as WAN and everything would route properly.<br><br>I would like a similar setup: the ISP box handles the fiber (and maybe the WiFi if it can be done, but I do have a separate wifi AP) and the opnsense box handles everything else. I can disable DHCP on the ISP box no problem and enable it on my opnsense box and plug it into the WAN port, but then I'm totally unsure of what I'm even trying to do, routing/iptables/LAN wise in order to route traffic appropriately to the LAN portion of the network.<br><br>I suspect I absolutely cannot use the WIFI on the ISP box, which, again, is fine; it'd be nice but I imagine that would introduce a level of complexity no one is here for (clients would be connecting to what is currently designated as the WAN? I'd probably need some VLAN stuff </span><i><span>maybe</span></i><span> if it's even doable?)<br><br>Anyone have any idea what the appropriate terms are to even search for?<br><br></span><a href="https://fire.asta.lgbt/tags/opnsense" rel="nofollow noopener" target="_blank">#opnsense</a><span> </span><a href="https://fire.asta.lgbt/tags/routing" rel="nofollow noopener" target="_blank">#routing</a><span> </span><a href="https://fire.asta.lgbt/tags/homeNetworking" rel="nofollow noopener" target="_blank">#homeNetworking</a><span> </span><a href="https://fire.asta.lgbt/tags/homeNetwork" rel="nofollow noopener" target="_blank">#homeNetwork</a><span> </span><a href="https://fire.asta.lgbt/tags/LAN" rel="nofollow noopener" target="_blank">#LAN</a><span> </span><a href="https://fire.asta.lgbt/tags/WAN" rel="nofollow noopener" target="_blank">#WAN</a><span> </span><a href="https://fire.asta.lgbt/tags/fiberInternet" rel="nofollow noopener" target="_blank">#fiberInternet</a><span> </span><a href="https://fire.asta.lgbt/tags/internet" rel="nofollow noopener" target="_blank">#internet</a><span> </span><a href="https://fire.asta.lgbt/tags/networking" rel="nofollow noopener" target="_blank">#networking</a><span> </span><a href="https://fire.asta.lgbt/tags/firewall" rel="nofollow noopener" target="_blank">#firewall</a><span> </span><a href="https://fire.asta.lgbt/tags/firewalls" rel="nofollow noopener" target="_blank">#firewalls</a><span> </span><a href="https://fire.asta.lgbt/tags/pfsense" rel="nofollow noopener" target="_blank">#pfsense</a><span> </span><a href="https://fire.asta.lgbt/tags/iptables" rel="nofollow noopener" target="_blank">#iptables</a><span> </span><a href="https://fire.asta.lgbt/tags/wifi" rel="nofollow noopener" target="_blank">#wifi</a></p>