| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | firewall: revert processing order of redirects and rules, ensures that rules ↵ | Jo-Philipp Wich | 2012-03-18 | 1 | -1/+1 |
| | | | | | | | can be used to filter before redirects are reached SVN-Revision: 31014 | ||||
| * | firewall: fix fw__uci_state_del() procedure (#11132) | Jo-Philipp Wich | 2012-03-13 | 1 | -1/+1 |
| | | | | | SVN-Revision: 30938 | ||||
| * | firewall: allow ICMPv6 type 129 (echo reply) - this fixes basic ICMPv6 in ↵ | Jo-Philipp Wich | 2012-02-25 | 1 | -1/+1 |
| | | | | | | | case no connection tracking is used SVN-Revision: 30727 | ||||
| * | firewall: bail out if uci is used in firewall include files | Jo-Philipp Wich | 2012-02-23 | 1 | -1/+1 |
| | | | | | SVN-Revision: 30694 | ||||
| * | iptables: make it possible to dynamically configure built-in statically ↵ | Felix Fietkau | 2012-02-22 | 1 | -1/+1 |
| | | | | | | | linked extensions, fold -mod-conntrack and -mod-nat into the default package. saves about 8k on an ar71xx default squashfs SVN-Revision: 30676 | ||||
| * | firewall: don't filter IPv4 ICMP types (#10928) | Jo-Philipp Wich | 2012-02-07 | 1 | -1/+1 |
| | | | | | SVN-Revision: 30363 | ||||
| * | firewall: add support for "local" port forwards which target an internal ↵ | Jo-Philipp Wich | 2012-01-08 | 1 | -2/+2 |
| | | | | | | | address on the router itself SVN-Revision: 29687 | ||||
| * | firewall: - introduce per-section "option enabled" which defaults to "1" - ↵ | Jo-Philipp Wich | 2011-12-20 | 1 | -1/+1 |
| | | | | | | | useful to disable rules or zones without having to delete them - annotate default traffic rules with names - bump version SVN-Revision: 29577 | ||||
| * | firewall: add DHCPv6 default rule (#10381) | Jo-Philipp Wich | 2011-11-09 | 1 | -1/+1 |
| | | | | | SVN-Revision: 28874 | ||||
| * | firewall: relocate TCPMSS rules into mangle table, add code to selectively ↵ | Jo-Philipp Wich | 2011-10-29 | 1 | -1/+1 |
| | | | | | | | clear them out again SVN-Revision: 28669 | ||||
| * | firewall: do not produce 0.0.0.0/0 if a symbolic masq_src or masq_dest is ↵ | Jo-Philipp Wich | 2011-10-27 | 1 | -1/+1 |
| | | | | | | | given but does not resolve to an ip SVN-Revision: 28628 | ||||
| * | firewall: prevent ip6tables -t nat rules (#10265) | Jo-Philipp Wich | 2011-10-23 | 1 | -1/+1 |
| | | | | | SVN-Revision: 28535 | ||||
| * | firewall: fix another instance of unquoted "*" | Jo-Philipp Wich | 2011-10-22 | 1 | -1/+1 |
| | | | | | SVN-Revision: 28529 | ||||
| * | firewall: fix possible expansion of "*" when rules with "option src *" are ↵ | Jo-Philipp Wich | 2011-10-22 | 1 | -1/+1 |
| | | | | | | | processed SVN-Revision: 28527 | ||||
| * | firewall: do not check for module availability, let iptables fail if a ↵ | Jo-Philipp Wich | 2011-10-22 | 1 | -1/+1 |
| | | | | | | | feature is not present (#7610) SVN-Revision: 28525 | ||||
| * | firewall: make ESTABLISHED,RELATED rules match before INVALID, use conntrack ↵ | Jo-Philipp Wich | 2011-09-01 | 1 | -1/+1 |
| | | | | | | | instead of state match (#10038) SVN-Revision: 28148 | ||||
| * | firewall: further tune ICMPv6 default rules according to RFC4890 (#9893) | Jo-Philipp Wich | 2011-08-14 | 1 | -1/+1 |
| | | | | | SVN-Revision: 27979 | ||||
| * | firewall: prevent redundant rules if multiple ports and multiple icmp types ↵ | Jo-Philipp Wich | 2011-07-26 | 1 | -1/+1 |
| | | | | | | | are given in a rule block for both icmp and other protocols SVN-Revision: 27792 | ||||
| * | firewall: fix serious bug in state var handling (#9746) | Jo-Philipp Wich | 2011-07-20 | 1 | -1/+1 |
| | | | | | SVN-Revision: 27711 | ||||
| * | firewall: rework state variable handling, use uci_toggle_state() where ↵ | Jo-Philipp Wich | 2011-07-15 | 1 | -1/+1 |
| | | | | | | | applicable and properly handle duplicates in add and del state helpers (#9152, #9710) SVN-Revision: 27618 | ||||
| * | firewall: make sure that -m mac is used with --mac-source, follow up to r27508 | Jo-Philipp Wich | 2011-07-07 | 1 | -1/+1 |
| | | | | | SVN-Revision: 27519 | ||||
| * | firewall: - solve scoping issues when multiple values are used, thanks ↵ | Jo-Philipp Wich | 2011-07-06 | 1 | -1/+1 |
| | | | | | | | Daniel Dickinson - ignore src_port/dest_port for proto icmp rules, ignore icmp_type for non-icmp rules - properly handle icmp when proto is given in numerical form (1, 58) - support negated icmp types SVN-Revision: 27500 | ||||
| * | firewall: properly handle negated ports in nat reflection | Jo-Philipp Wich | 2011-07-01 | 1 | -1/+1 |
| | | | | | SVN-Revision: 27334 | ||||
| * | firewall: - allow multiple ports, protocols, macs, icmp types per rule - ↵ | Jo-Philipp Wich | 2011-06-30 | 1 | -1/+1 |
| | | | | | | | implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317 | ||||
| * | firewall: allow symbolic names of interfaces and aliases in masq_src and ↵ | Jo-Philipp Wich | 2011-06-16 | 1 | -1/+1 |
| | | | | | | | masq_dest SVN-Revision: 27196 | ||||
| * | firewall: prevent excessive uci state data aggregation (#9152) | Jo-Philipp Wich | 2011-04-20 | 1 | -1/+1 |
| | | | | | SVN-Revision: 26740 | ||||
| * | firewall: prevent duplicate values in interface state vars | Jo-Philipp Wich | 2011-03-30 | 1 | -1/+1 |
| | | | | | SVN-Revision: 26382 | ||||
| * | Keep firewall.user during sysupgrades | Travis Kemen | 2011-03-20 | 1 | -0/+2 |
| | | | | | SVN-Revision: 26241 | ||||
| * | firewall: move include sourcing into a subshell, this makes the firewall ↵ | Jo-Philipp Wich | 2011-03-02 | 1 | -1/+1 |
| | | | | | | | init immune against exit in the include scripts SVN-Revision: 25835 | ||||
| * | firewall: fix rule generation for v4 or v6 only zones (#8955) | Jo-Philipp Wich | 2011-03-01 | 1 | -2/+2 |
| | | | | | SVN-Revision: 25813 | ||||
| * | firewall: fix wrong rule order if multiple protocols are used | Jo-Philipp Wich | 2011-01-27 | 1 | -1/+1 |
| | | | | | SVN-Revision: 25179 | ||||
| * | firewall: insert SNAT and DNAT rules according to the order of the ↵ | Jo-Philipp Wich | 2010-10-08 | 1 | -1/+1 |
| | | | | | | | configuration file (#8052) SVN-Revision: 23318 | ||||
| * | firewall: mark /etc/firewall.user as conffile | Jo-Philipp Wich | 2010-10-05 | 1 | -0/+1 |
| | | | | | SVN-Revision: 23231 | ||||
| * | firewall: also establish forward rules when setting up nat reflection, back ↵ | Jo-Philipp Wich | 2010-10-03 | 1 | -1/+1 |
| | | | | | | | out early if reflection is disabled SVN-Revision: 23201 | ||||
| * | add maintainer information | Jo-Philipp Wich | 2010-09-30 | 1 | -0/+1 |
| | | | | | SVN-Revision: 23159 | ||||
| * | fireall: - support negations for src_ip, dest_ip, src_dip options in rules ↵ | Jo-Philipp Wich | 2010-09-28 | 1 | -1/+1 |
| | | | | | | | and redirects - add NOTRACK target to rule sections, allows to define fine grained notrack rules SVN-Revision: 23141 | ||||
| * | firewall: protect iptables invocations with locks in interface ops, it might ↵ | Jo-Philipp Wich | 2010-09-19 | 1 | -1/+1 |
| | | | | | | | run concurrently due to hotplug invocations on network restart SVN-Revision: 23090 | ||||
| * | firewall: make invalid redirects and duplicate zones non-fatal, print a ↵ | Jo-Philipp Wich | 2010-09-16 | 1 | -1/+1 |
| | | | | | | | notice and discard them SVN-Revision: 23080 | ||||
| * | firewall: run ifdown hotplug events synchronized, fixes a racecondition on ↵ | Jo-Philipp Wich | 2010-09-15 | 1 | -1/+1 |
| | | | | | | | "ifup iface" when ifdown and ifup events are delivered with a small dealy SVN-Revision: 23064 | ||||
| * | firewall: deliver remove hotplug events for all active zones/networks when ↵ | Jo-Philipp Wich | 2010-09-14 | 1 | -1/+1 |
| | | | | | | | restarting the firewall SVN-Revision: 23062 | ||||
| * | firewall: - simplify masquerade rule setup - remove various subshell ↵ | Jo-Philipp Wich | 2010-09-11 | 1 | -1/+1 |
| | | | | | | | invocations - speedup fw() by not relying on xargs and pipes - rework SNAT support - attach to dest zone, use src_dip/src_dport as snat source SVN-Revision: 23024 | ||||
| * | firewall: introduce SNAT support for redirect sections | Jo-Philipp Wich | 2010-09-05 | 1 | -1/+1 |
| | | | | | SVN-Revision: 22937 | ||||
| * | firewall: clean up description (#7875) | Jo-Philipp Wich | 2010-09-04 | 1 | -1/+1 |
| | | | | | SVN-Revision: 22905 | ||||
| * | firewall: - handle NAT reflection in firewall hotplug, solves synchronizing ↵ | Jo-Philipp Wich | 2010-09-04 | 1 | -2/+3 |
| | | | | | | | issues on boot - introduce masq_src and masq_dest options to limit zone masq to specific ip ranges, supports multiple subnets and negation SVN-Revision: 22888 | ||||
| * | firewall: - fix processing of rules with an ip family option - append ↵ | Jo-Philipp Wich | 2010-08-31 | 1 | -1/+1 |
| | | | | | | | interface rules at the end of internal zone chains, simplifies injecting user or addon rules - support simple file logging (option log + option log_limit per zone) SVN-Revision: 22847 | ||||
| * | firewall: add basic NAT reflection/NAT loopback support | Jo-Philipp Wich | 2010-07-31 | 1 | -1/+2 |
| | | | | | SVN-Revision: 22441 | ||||
| * | firewall: allow redirecting only destination port (#7197) | Jo-Philipp Wich | 2010-07-16 | 1 | -1/+1 |
| | | | | | SVN-Revision: 22227 | ||||
| * | firewall: - notrack support was broken in multiple ways, fix it - also ↵ | Jo-Philipp Wich | 2010-07-15 | 1 | -1/+1 |
| | | | | | | | consider a zone conntracked if any redirect references it (#7196) SVN-Revision: 22215 | ||||
| * | firewall: Initial alias interface support. This allows to define zones ↵ | Jo-Philipp Wich | 2010-06-01 | 1 | -1/+1 |
| | | | | | | | covering alias interfaces and associated entries like rules and forwardings. SVN-Revision: 21653 | ||||
| * | firewall: fix support for netranges in redirect and rule sections | Jo-Philipp Wich | 2010-05-30 | 1 | -1/+1 |
| | | | | | SVN-Revision: 21640 | ||||
 |
index : openwrt/upstream | |
| upstream openwrt | James |
| aboutsummaryrefslogtreecommitdiffstats |