iptables+ipmark

#!/usr/bin/perl
require "bg.pl";
use Term::ANSIColor;
use strict;
use warnings;
my $ipt="iptables";
my $ips="ipset";
my $INT_IF="eth2";
my $EXT_IF="ppp0";
my @table=qw/filter nat mangle/;
print "\n\nFlushing all chains, please wait...";
foreach my $i (@table)
{
`$ipt -F -t $i`;
`$ipt -X -t $i`;
`$ipt -Z -t $i`;
}
`$ips -F`;
`$ips -X`;
#`$ipt -P FORWARD DROP`;
print(color("green")," Done.\n", color("reset"));
#User tables
print "Creating users\' chains...";
#Donwload
`$ipt -t mangle -N DOWNLOAD`;
`$ipt -t mangle -N BG_DW`;
`$ipt -t mangle -N INT_DW`;
#Upload
`$ipt -t mangle -N UPLOAD`;
`$ipt -t mangle -N BG_UP`;
print(color("green")," Done.\n", color("reset"));
print "Adding BG zone...";
open(File, "< bg_nets.txt") or die "Could not open bg_nets.txt file for reading: $!\n";
my @bgnets = <File>;
close(File);
`$ips -N BG_NETS nethash`;
foreach my $i (@bgnets)
{
    `$ips -A BG_NETS $i`;
}
print(color("green")," Done.\n", color("reset"));
`$ipt -t mangle -A FORWARD -j MARK --set-mark 1`;
`$ipt -t mangle -A FORWARD -i $EXT_IF -o $INT_IF -j DOWNLOAD`;
#BG
print "Seting and-mask=0xff and or-mask=0x10100 to BG zone...";
`$ipt -t mangle -A DOWNLOAD -m set --set BG_NETS src -j BG_DW`;
`$ipt -t mangle -A BG_DW -d 192.168.0.0/24 -j IPMARK --addr=dst --and-mask=0xff --or-mask=0x10100`;
`$ipt -t mangle -A BG_DW -j RETURN`;
print(color("green")," Done.\n", color("reset"));
#Int.
print "Seting and-mask=0xff and or-mask=0x10200 to Int. zone...";
`$ipt -t mangle -A DOWNLOAD -m mark --mark 1 -j INT_DW`;
`$ipt -t mangle -A INT_DW -d 192.168.0.0/24 -j IPMARK --addr=dst --and-mask=0xff --or-mask=0x10200`;
`$ipt -t mangle -A INT_DW -j RETURN`;
#Accept packets between local nets
`$ipt -A FORWARD -i $INT_IF -o $INT_IF -j ACCEPT`;
`$ips -N FW_192_168_0_0 ipmap --network 192.168.0.0/24`;
`$ipt -A FORWARD -m set --set FW_192_168_0_0 src -j ACCEPT`;
#Accept IP
`$ips -A FW_192_168_0_0 192.168.0.2`;
print(color("green")," Done.\n", color("reset"));

`$ipt -t nat -A POSTROUTING -o ppp0 -j MASQUERADE`;