summaryrefslogtreecommitdiffstats
path: root/package/firewall
Commit message (Collapse)AuthorAgeFilesLines
* firewall: - introduce per-section "option enabled" which defaults to "1" - ↵Jo-Philipp Wich2011-12-203-2/+11
| | | | | | useful to disable rules or zones without having to delete them - annotate default traffic rules with names - bump version SVN-Revision: 29577
* firewall: add DHCPv6 default rule (#10381)Jo-Philipp Wich2011-11-092-1/+13
| | | | SVN-Revision: 28874
* firewall: relocate TCPMSS rules into mangle table, add code to selectively ↵Jo-Philipp Wich2011-10-294-7/+21
| | | | | | clear them out again SVN-Revision: 28669
* firewall: do not produce 0.0.0.0/0 if a symbolic masq_src or masq_dest is ↵Jo-Philipp Wich2011-10-273-4/+7
| | | | | | given but does not resolve to an ip SVN-Revision: 28628
* firewall: prevent ip6tables -t nat rules (#10265)Jo-Philipp Wich2011-10-232-2/+3
| | | | SVN-Revision: 28535
* firewall: fix another instance of unquoted "*"Jo-Philipp Wich2011-10-222-2/+2
| | | | SVN-Revision: 28529
* firewall: fix possible expansion of "*" when rules with "option src *" are ↵Jo-Philipp Wich2011-10-222-6/+11
| | | | | | processed SVN-Revision: 28527
* firewall: do not check for module availability, let iptables fail if a ↵Jo-Philipp Wich2011-10-222-16/+2
| | | | | | feature is not present (#7610) SVN-Revision: 28525
* firewall: make ESTABLISHED,RELATED rules match before INVALID, use conntrack ↵Jo-Philipp Wich2011-09-012-9/+9
| | | | | | instead of state match (#10038) SVN-Revision: 28148
* firewall: further tune ICMPv6 default rules according to RFC4890 (#9893)Jo-Philipp Wich2011-08-143-2/+18
| | | | SVN-Revision: 27979
* firewall: prevent redundant rules if multiple ports and multiple icmp types ↵Jo-Philipp Wich2011-07-262-8/+17
| | | | | | are given in a rule block for both icmp and other protocols SVN-Revision: 27792
* firewall: fix serious bug in state var handling (#9746)Jo-Philipp Wich2011-07-202-3/+3
| | | | SVN-Revision: 27711
* firewall: rework state variable handling, use uci_toggle_state() where ↵Jo-Philipp Wich2011-07-152-18/+25
| | | | | | applicable and properly handle duplicates in add and del state helpers (#9152, #9710) SVN-Revision: 27618
* firewall: make sure that -m mac is used with --mac-source, follow up to r27508Jo-Philipp Wich2011-07-072-2/+2
| | | | SVN-Revision: 27519
* firewall: also correct another variable missed in previous commitDaniel Dickinson2011-07-071-1/+1
| | | | SVN-Revision: 27508
* firewall: fix wrong variable names for protocol command line parameter - ↵Daniel Dickinson2011-07-071-2/+2
| | | | | | were missed during r27500 SVN-Revision: 27507
* firewall: - solve scoping issues when multiple values are used, thanks ↵Jo-Philipp Wich2011-07-064-30/+26
| | | | | | Daniel Dickinson - ignore src_port/dest_port for proto icmp rules, ignore icmp_type for non-icmp rules - properly handle icmp when proto is given in numerical form (1, 58) - support negated icmp types SVN-Revision: 27500
* firewall: fix udp rules for tcpudp proto rules using src_port and dest_port ↵Daniel Dickinson2011-07-061-0/+7
| | | | | | after modification by the parsing of the tcp rule SVN-Revision: 27469
* firewall: fix port range quirk in previous commitJo-Philipp Wich2011-07-011-2/+2
| | | | SVN-Revision: 27335
* firewall: properly handle negated ports in nat reflectionJo-Philipp Wich2011-07-012-5/+13
| | | | SVN-Revision: 27334
* firewall: refine default ICMPv6 rules to better conform with RFC4890, do not ↵Jo-Philipp Wich2011-06-301-13/+2
| | | | | | forward link local ICMP message types, allow parameter problem SVN-Revision: 27321
* firewall: restore local port relocation ability from r26617Jo-Philipp Wich2011-06-301-3/+3
| | | | SVN-Revision: 27318
* firewall: - allow multiple ports, protocols, macs, icmp types per rule - ↵Jo-Philipp Wich2011-06-306-74/+220
| | | | | | implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
* firewall: ensure that fw_get_subnet4() sets an empty value if no (valid) ↵Jo-Philipp Wich2011-06-161-0/+1
| | | | | | IPv4 addr was found SVN-Revision: 27198
* firewall: allow symbolic names of interfaces and aliases in masq_src and ↵Jo-Philipp Wich2011-06-163-3/+28
| | | | | | masq_dest SVN-Revision: 27196
* firewall: explictely mention network in default configuration, makes it less ↵Jo-Philipp Wich2011-05-201-0/+2
| | | | | | confusing SVN-Revision: 26961
* firewall: revert accidential committed changes from r26805Jo-Philipp Wich2011-05-021-39/+11
| | | | SVN-Revision: 26806
* firewall: provide examples of ssh port relocation on firewall and IPsec ↵Jo-Philipp Wich2011-05-022-11/+61
| | | | | | | | | | | | | passthrough Two examples of potentially useful configurations (commented out, of course): (a) map the ssh service running on the firewall to 22001 externally, without modifying the configuration of the daemon itself. this allows port 22 on the WAN side to then be port-forwarded to a LAN-based machine if desired, or if not, simply obscures the port from external attack. (b) allow IPsec/ESP and ISAKMP (UDP-based key exchange) to happen by default. useful for most modern VPN clients you might have on your WAN. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com> SVN-Revision: 26805
* firewall: prevent excessive uci state data aggregation (#9152)Jo-Philipp Wich2011-04-202-1/+3
| | | | SVN-Revision: 26740
* firewall: allow local redirection of portsJo-Philipp Wich2011-04-121-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow a redirect like: config redirect option src 'wan' option dest 'lan' option src_dport '22001' option dest_port '22' option proto 'tcp' note the absence of the "dest_ip" field, meaning to terminate the connection on the firewall itself. This patch makes three changes: (1) moves the conntrack module into the conntrack package (but not any of the conntrack_* helpers). (2) fixes a bug where the wrong table is used when the "dest_ip" field is absent. (3) accepts incoming connections on the destination port on the input_ZONE table, but only for DNATted connections. In the above example, ssh -p 22 root@myrouter would fail from the outside, but: ssh -p 22001 root@myrouter would succeed. This is handy if: (1) you want to avoid ssh probes on your router, or (2) you want to redirect incoming connections on port 22 to some machine inside your firewall, but still want to allow firewall access from outside. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com> SVN-Revision: 26617
* firewall: prevent duplicate values in interface state varsJo-Philipp Wich2011-03-302-2/+5
| | | | SVN-Revision: 26382
* Keep firewall.user during sysupgradesTravis Kemen2011-03-202-0/+3
| | | | SVN-Revision: 26241
* firewall: move include sourcing into a subshell, this makes the firewall ↵Jo-Philipp Wich2011-03-022-3/+5
| | | | | | init immune against exit in the include scripts SVN-Revision: 25835
* firewall: fix rule generation for v4 or v6 only zones (#8955)Jo-Philipp Wich2011-03-012-2/+5
| | | | SVN-Revision: 25813
* firewall: fix wrong rule order if multiple protocols are usedJo-Philipp Wich2011-01-272-4/+4
| | | | SVN-Revision: 25179
* firewall: insert SNAT and DNAT rules according to the order of the ↵Jo-Philipp Wich2010-10-083-3/+6
| | | | | | configuration file (#8052) SVN-Revision: 23318
* firewall: mark /etc/firewall.user as conffileJo-Philipp Wich2010-10-051-0/+1
| | | | SVN-Revision: 23231
* firewall: also establish forward rules when setting up nat reflection, back ↵Jo-Philipp Wich2010-10-032-7/+16
| | | | | | out early if reflection is disabled SVN-Revision: 23201
* add maintainer informationJo-Philipp Wich2010-09-301-0/+1
| | | | SVN-Revision: 23159
* firewall: fix chain selection logic, option dest must be ignored for notrack ↵Jo-Philipp Wich2010-09-281-6/+5
| | | | | | targets SVN-Revision: 23143
* firewall: don't setup nat reflection if negations are usedJo-Philipp Wich2010-09-281-0/+3
| | | | SVN-Revision: 23142
* fireall: - support negations for src_ip, dest_ip, src_dip options in rules ↵Jo-Philipp Wich2010-09-285-28/+42
| | | | | | and redirects - add NOTRACK target to rule sections, allows to define fine grained notrack rules SVN-Revision: 23141
* firewall: protect iptables invocations with locks in interface ops, it might ↵Jo-Philipp Wich2010-09-192-1/+5
| | | | | | run concurrently due to hotplug invocations on network restart SVN-Revision: 23090
* firewall: make invalid redirects and duplicate zones non-fatal, print a ↵Jo-Philipp Wich2010-09-164-10/+12
| | | | | | notice and discard them SVN-Revision: 23080
* firewall: run ifdown hotplug events synchronized, fixes a racecondition on ↵Jo-Philipp Wich2010-09-153-10/+8
| | | | | | "ifup iface" when ifdown and ifup events are delivered with a small dealy SVN-Revision: 23064
* firewall: deliver remove hotplug events for all active zones/networks when ↵Jo-Philipp Wich2010-09-143-3/+42
| | | | | | restarting the firewall SVN-Revision: 23062
* firewall: - simplify masquerade rule setup - remove various subshell ↵Jo-Philipp Wich2010-09-117-94/+114
| | | | | | invocations - speedup fw() by not relying on xargs and pipes - rework SNAT support - attach to dest zone, use src_dip/src_dport as snat source SVN-Revision: 23024
* firewall: - fix possible endless loop when the family option is used for ↵Jo-Philipp Wich2010-09-052-4/+6
| | | | | | forwardings - only generate forwarding rules in SNAT redirect sections if src_dip is specified SVN-Revision: 22938
* firewall: introduce SNAT support for redirect sectionsJo-Philipp Wich2010-09-053-4/+19
| | | | SVN-Revision: 22937
* firewall: add option to disable NAT reflectionJo-Philipp Wich2010-09-041-0/+4
| | | | SVN-Revision: 22908
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-30 20:16:17 +0000