| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
| |
instead of state match (#10038)
SVN-Revision: 28148
|
|
|
|
| |
SVN-Revision: 27979
|
|
|
|
|
|
| |
are given in a rule block for both icmp and other protocols
SVN-Revision: 27792
|
|
|
|
| |
SVN-Revision: 27711
|
|
|
|
|
|
| |
applicable and properly handle duplicates in add and del state helpers (#9152, #9710)
SVN-Revision: 27618
|
|
|
|
| |
SVN-Revision: 27519
|
|
|
|
| |
SVN-Revision: 27508
|
|
|
|
|
|
| |
were missed during r27500
SVN-Revision: 27507
|
|
|
|
|
|
| |
Daniel Dickinson - ignore src_port/dest_port for proto icmp rules, ignore icmp_type for non-icmp rules - properly handle icmp when proto is given in numerical form (1, 58) - support negated icmp types
SVN-Revision: 27500
|
|
|
|
|
|
| |
after modification by the parsing of the tcp rule
SVN-Revision: 27469
|
|
|
|
| |
SVN-Revision: 27335
|
|
|
|
| |
SVN-Revision: 27334
|
|
|
|
|
|
| |
forward link local ICMP message types, allow parameter problem
SVN-Revision: 27321
|
|
|
|
| |
SVN-Revision: 27318
|
|
|
|
|
|
| |
implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration
SVN-Revision: 27317
|
|
|
|
|
|
| |
IPv4 addr was found
SVN-Revision: 27198
|
|
|
|
|
|
| |
masq_dest
SVN-Revision: 27196
|
|
|
|
|
|
| |
confusing
SVN-Revision: 26961
|
|
|
|
| |
SVN-Revision: 26806
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
passthrough Two examples of potentially useful configurations (commented out, of course):
(a) map the ssh service running on the firewall to 22001 externally, without modifying the configuration of the daemon itself. this allows port 22 on the WAN side to then be port-forwarded to a
LAN-based machine if desired, or if not, simply obscures the port from external attack.
(b) allow IPsec/ESP and ISAKMP (UDP-based key exchange) to happen by default. useful for most modern VPN clients you might have on your WAN.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
SVN-Revision: 26805
|
|
|
|
| |
SVN-Revision: 26740
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Allow a redirect like:
config redirect
option src 'wan'
option dest 'lan'
option src_dport '22001'
option dest_port '22'
option proto 'tcp'
note the absence of the "dest_ip" field, meaning to terminate the connection on the firewall itself.
This patch makes three changes:
(1) moves the conntrack module into the conntrack package (but not any of the conntrack_* helpers).
(2) fixes a bug where the wrong table is used when the "dest_ip" field is absent.
(3) accepts incoming connections on the destination port on the input_ZONE table, but only for DNATted
connections.
In the above example,
ssh -p 22 root@myrouter
would fail from the outside, but:
ssh -p 22001 root@myrouter
would succeed. This is handy if:
(1) you want to avoid ssh probes on your router, or
(2) you want to redirect incoming connections on port 22 to some machine inside your firewall, but
still want to allow firewall access from outside.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
SVN-Revision: 26617
|
|
|
|
| |
SVN-Revision: 26382
|
|
|
|
| |
SVN-Revision: 26241
|
|
|
|
|
|
| |
init immune against exit in the include scripts
SVN-Revision: 25835
|
|
|
|
| |
SVN-Revision: 25813
|
|
|
|
| |
SVN-Revision: 25179
|
|
|
|
|
|
| |
configuration file (#8052)
SVN-Revision: 23318
|
|
|
|
|
|
| |
out early if reflection is disabled
SVN-Revision: 23201
|
|
|
|
|
|
| |
targets
SVN-Revision: 23143
|
|
|
|
| |
SVN-Revision: 23142
|
|
|
|
|
|
| |
and redirects - add NOTRACK target to rule sections, allows to define fine grained notrack rules
SVN-Revision: 23141
|
|
|
|
|
|
| |
run concurrently due to hotplug invocations on network restart
SVN-Revision: 23090
|
|
|
|
|
|
| |
notice and discard them
SVN-Revision: 23080
|
|
|
|
|
|
| |
"ifup iface" when ifdown and ifup events are delivered with a small dealy
SVN-Revision: 23064
|
|
|
|
|
|
| |
restarting the firewall
SVN-Revision: 23062
|
|
|
|
|
|
| |
invocations - speedup fw() by not relying on xargs and pipes - rework SNAT support - attach to dest zone, use src_dip/src_dport as snat source
SVN-Revision: 23024
|
|
|
|
|
|
| |
forwardings - only generate forwarding rules in SNAT redirect sections if src_dip is specified
SVN-Revision: 22938
|
|
|
|
| |
SVN-Revision: 22937
|
|
|
|
| |
SVN-Revision: 22908
|
|
|
|
|
|
| |
issues on boot - introduce masq_src and masq_dest options to limit zone masq to specific ip ranges, supports multiple subnets and negation
SVN-Revision: 22888
|
|
|
|
|
|
| |
interface rules at the end of internal zone chains, simplifies injecting user or addon rules - support simple file logging (option log + option log_limit per zone)
SVN-Revision: 22847
|
|
|
|
| |
SVN-Revision: 22442
|
|
|
|
| |
SVN-Revision: 22441
|
|
|
|
| |
SVN-Revision: 22227
|
|
|
|
| |
SVN-Revision: 22218
|
|
|
|
|
|
| |
consider a zone conntracked if any redirect references it (#7196)
SVN-Revision: 22215
|
|
|
|
|
|
| |
handle multiple subnets per alias (v4+v6)
SVN-Revision: 21656
|
|
|
|
|
|
| |
covering alias interfaces and associated entries like rules and forwardings.
SVN-Revision: 21653
|
|
|
|
|
|
| |
notation v6 improperly detected as v4 address
SVN-Revision: 21642
|