summaryrefslogtreecommitdiffstats
path: root/package/firewall/files
Commit message (Collapse)AuthorAgeFilesLines
* [package] firewall: prevent redundant rules if multiple ports and multiple ↵jow2011-07-261-7/+16
| | | | | | icmp types are given in a rule block for both icmp and other protocols git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27792 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: fix serious bug in state var handling (#9746)jow2011-07-201-2/+2
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27711 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: rework state variable handling, use uci_toggle_state() ↵jow2011-07-151-17/+24
| | | | | | where applicable and properly handle duplicates in add and del state helpers (#9152, #9710) git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27618 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: make sure that -m mac is used with --mac-source, follow ↵jow2011-07-071-1/+1
| | | | | | up to r27508 git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27519 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: also correct another variable missed in previous commitcshore2011-07-071-1/+1
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27508 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: fix wrong variable names for protocol command line ↵cshore2011-07-071-2/+2
| | | | | | parameter - were missed during r27500 git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27507 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall:jow2011-07-063-29/+25
| | | | | | | | | | - solve scoping issues when multiple values are used, thanks Daniel Dickinson - ignore src_port/dest_port for proto icmp rules, ignore icmp_type for non-icmp rules - properly handle icmp when proto is given in numerical form (1, 58) - support negated icmp types git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27500 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: fix udp rules for tcpudp proto rules using src_port and ↵cshore2011-07-061-0/+7
| | | | | | dest_port after modification by the parsing of the tcp rule git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27469 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: fix port range quirk in previous commitjow2011-07-011-2/+2
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27335 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: properly handle negated ports in nat reflectionjow2011-07-011-4/+12
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27334 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: refine default ICMPv6 rules to better conform with ↵jow2011-06-301-13/+2
| | | | | | RFC4890, do not forward link local ICMP message types, allow parameter problem git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27321 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: restore local port relocation ability from r26617jow2011-06-301-3/+3
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27318 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall:jow2011-06-305-73/+219
| | | | | | | | | | | | | - allow multiple ports, protocols, macs, icmp types per rule - implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27317 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: ensure that fw_get_subnet4() sets an empty value if no ↵jow2011-06-161-0/+1
| | | | | | (valid) IPv4 addr was found git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27198 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: allow symbolic names of interfaces and aliases in ↵jow2011-06-162-2/+27
| | | | | | masq_src and masq_dest git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27196 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: explictely mention network in default configuration, ↵jow2011-05-201-0/+2
| | | | | | makes it less confusing git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26961 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: revert accidential committed changes from r26805jow2011-05-021-39/+11
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26806 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [PATCH] firewall: provide examples of ssh port relocation on firewall and ↵jow2011-05-022-11/+61
| | | | | | | | | | | | | | | | IPsec passthrough Two examples of potentially useful configurations (commented out, of course): (a) map the ssh service running on the firewall to 22001 externally, without modifying the configuration of the daemon itself. this allows port 22 on the WAN side to then be port-forwarded to a LAN-based machine if desired, or if not, simply obscures the port from external attack. (b) allow IPsec/ESP and ISAKMP (UDP-based key exchange) to happen by default. useful for most modern VPN clients you might have on your WAN. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26805 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: prevent excessive uci state data aggregation (#9152)jow2011-04-201-0/+2
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26740 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: allow local redirection of portsjow2011-04-121-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow a redirect like: config redirect option src 'wan' option dest 'lan' option src_dport '22001' option dest_port '22' option proto 'tcp' note the absence of the "dest_ip" field, meaning to terminate the connection on the firewall itself. This patch makes three changes: (1) moves the conntrack module into the conntrack package (but not any of the conntrack_* helpers). (2) fixes a bug where the wrong table is used when the "dest_ip" field is absent. (3) accepts incoming connections on the destination port on the input_ZONE table, but only for DNATted connections. In the above example, ssh -p 22 root@myrouter would fail from the outside, but: ssh -p 22001 root@myrouter would succeed. This is handy if: (1) you want to avoid ssh probes on your router, or (2) you want to redirect incoming connections on port 22 to some machine inside your firewall, but still want to allow firewall access from outside. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26617 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: prevent duplicate values in interface state varsjow2011-03-301-1/+4
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26382 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Keep firewall.user during sysupgradesthepeople2011-03-201-0/+1
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26241 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: move include sourcing into a subshell, this makes the ↵jow2011-03-021-2/+4
| | | | | | firewall init immune against exit in the include scripts git-svn-id: svn://svn.openwrt.org/openwrt/trunk@25835 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: fix rule generation for v4 or v6 only zones (#8955)jow2011-03-011-0/+3
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@25813 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: fix wrong rule order if multiple protocols are usedjow2011-01-271-3/+3
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@25179 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: insert SNAT and DNAT rules according to the order of the ↵jow2010-10-082-2/+5
| | | | | | configuration file (#8052) git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23318 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: also establish forward rules when setting up nat ↵jow2010-10-031-6/+15
| | | | | | reflection, back out early if reflection is disabled git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23201 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: fix chain selection logic, option dest must be ignored ↵jow2010-09-281-6/+5
| | | | | | for notrack targets git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23143 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: don't setup nat reflection if negations are usedjow2010-09-281-0/+3
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23142 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] fireall:jow2010-09-284-27/+41
| | | | | | | | - support negations for src_ip, dest_ip, src_dip options in rules and redirects - add NOTRACK target to rule sections, allows to define fine grained notrack rules git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23141 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: protect iptables invocations with locks in interface ↵jow2010-09-191-0/+4
| | | | | | ops, it might run concurrently due to hotplug invocations on network restart git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23090 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: make invalid redirects and duplicate zones non-fatal, ↵jow2010-09-163-9/+11
| | | | | | print a notice and discard them git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23080 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: run ifdown hotplug events synchronized, fixes a ↵jow2010-09-152-9/+7
| | | | | | racecondition on "ifup iface" when ifdown and ifup events are delivered with a small dealy git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23064 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: deliver remove hotplug events for all active ↵jow2010-09-142-2/+41
| | | | | | zones/networks when restarting the firewall git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23062 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall:jow2010-09-116-93/+113
| | | | | | | | | | - simplify masquerade rule setup - remove various subshell invocations - speedup fw() by not relying on xargs and pipes - rework SNAT support - attach to dest zone, use src_dip/src_dport as snat source git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23024 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall:jow2010-09-052-4/+6
| | | | | | | | - fix possible endless loop when the family option is used for forwardings - only generate forwarding rules in SNAT redirect sections if src_dip is specified git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22938 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: introduce SNAT support for redirect sectionsjow2010-09-052-3/+18
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22937 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: add option to disable NAT reflectionjow2010-09-041-0/+4
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22908 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall:jow2010-09-043-6/+30
| | | | | | | | - handle NAT reflection in firewall hotplug, solves synchronizing issues on boot - introduce masq_src and masq_dest options to limit zone masq to specific ip ranges, supports multiple subnets and negation git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22888 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall:jow2010-08-313-41/+62
| | | | | | | | | - fix processing of rules with an ip family option - append interface rules at the end of internal zone chains, simplifies injecting user or addon rules - support simple file logging (option log + option log_limit per zone) git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22847 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firwall: fix nat reflection for zones covering multiple networksjow2010-07-311-34/+56
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22442 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: add basic NAT reflection/NAT loopback supportjow2010-07-311-0/+79
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22441 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: allow redirecting only destination port (#7197)jow2010-07-161-2/+3
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22227 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: fix another notrack related bugjow2010-07-151-1/+1
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22218 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall:jow2010-07-154-8/+10
| | | | | | | | - notrack support was broken in multiple ways, fix it - also consider a zone conntracked if any redirect references it (#7196) git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22215 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall:jow2010-06-021-10/+23
| | | | | | | | - support alias ifnames different from parent ifname - properly handle multiple subnets per alias (v4+v6) git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21656 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: Initial alias interface support. This allows to define ↵jow2010-06-012-28/+85
| | | | | | zones covering alias interfaces and associated entries like rules and forwardings. git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21653 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: change the order of IPv4/IPv6 address detection, fixes ↵jow2010-05-312-2/+2
| | | | | | mixed notation v6 improperly detected as v4 address git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21642 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: fix support for netranges in redirect and rule sectionsjow2010-05-303-7/+7
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21640 3c298f89-4303-0410-b956-a3cf2f4a3e73
* [package] firewall: count rules per chain and family, fix wrong order of ↵jow2010-05-221-4/+4
| | | | | | ip6tables rules when ipv4 only or dual family rules are defined git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21533 3c298f89-4303-0410-b956-a3cf2f4a3e73
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-01 02:28:35 +0000