aboutsummaryrefslogtreecommitdiffstats
path: root/package/firewall/files/lib/core_redirect.sh
Commit message (Collapse)AuthorAgeFilesLines
* packages: sort network related packages into package/network/Felix Fietkau2012-10-101-130/+0
| | | | SVN-Revision: 33688
* firewall: add support for "local" port forwards which target an internal ↵Jo-Philipp Wich2012-01-081-2/+13
| | | | | | address on the router itself SVN-Revision: 29687
* firewall: make sure that -m mac is used with --mac-source, follow up to r27508Jo-Philipp Wich2011-07-071-1/+1
| | | | SVN-Revision: 27519
* firewall: also correct another variable missed in previous commitDaniel Dickinson2011-07-071-1/+1
| | | | SVN-Revision: 27508
* firewall: fix wrong variable names for protocol command line parameter - ↵Daniel Dickinson2011-07-071-2/+2
| | | | | | were missed during r27500 SVN-Revision: 27507
* firewall: - solve scoping issues when multiple values are used, thanks ↵Jo-Philipp Wich2011-07-061-5/+5
| | | | | | Daniel Dickinson - ignore src_port/dest_port for proto icmp rules, ignore icmp_type for non-icmp rules - properly handle icmp when proto is given in numerical form (1, 58) - support negated icmp types SVN-Revision: 27500
* firewall: restore local port relocation ability from r26617Jo-Philipp Wich2011-06-301-3/+3
| | | | SVN-Revision: 27318
* firewall: - allow multiple ports, protocols, macs, icmp types per rule - ↵Jo-Philipp Wich2011-06-301-25/+31
| | | | | | implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
* firewall: allow local redirection of portsJo-Philipp Wich2011-04-121-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow a redirect like: config redirect option src 'wan' option dest 'lan' option src_dport '22001' option dest_port '22' option proto 'tcp' note the absence of the "dest_ip" field, meaning to terminate the connection on the firewall itself. This patch makes three changes: (1) moves the conntrack module into the conntrack package (but not any of the conntrack_* helpers). (2) fixes a bug where the wrong table is used when the "dest_ip" field is absent. (3) accepts incoming connections on the destination port on the input_ZONE table, but only for DNATted connections. In the above example, ssh -p 22 root@myrouter would fail from the outside, but: ssh -p 22001 root@myrouter would succeed. This is handy if: (1) you want to avoid ssh probes on your router, or (2) you want to redirect incoming connections on port 22 to some machine inside your firewall, but still want to allow firewall access from outside. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com> SVN-Revision: 26617
* firewall: insert SNAT and DNAT rules according to the order of the ↵Jo-Philipp Wich2010-10-081-1/+4
| | | | | | configuration file (#8052) SVN-Revision: 23318
* fireall: - support negations for src_ip, dest_ip, src_dip options in rules ↵Jo-Philipp Wich2010-09-281-8/+10
| | | | | | and redirects - add NOTRACK target to rule sections, allows to define fine grained notrack rules SVN-Revision: 23141
* firewall: make invalid redirects and duplicate zones non-fatal, print a ↵Jo-Philipp Wich2010-09-161-3/+6
| | | | | | notice and discard them SVN-Revision: 23080
* firewall: - simplify masquerade rule setup - remove various subshell ↵Jo-Philipp Wich2010-09-111-30/+54
| | | | | | invocations - speedup fw() by not relying on xargs and pipes - rework SNAT support - attach to dest zone, use src_dip/src_dport as snat source SVN-Revision: 23024
* firewall: - fix possible endless loop when the family option is used for ↵Jo-Philipp Wich2010-09-051-3/+5
| | | | | | forwardings - only generate forwarding rules in SNAT redirect sections if src_dip is specified SVN-Revision: 22938
* firewall: introduce SNAT support for redirect sectionsJo-Philipp Wich2010-09-051-2/+14
| | | | SVN-Revision: 22937
* firewall: allow redirecting only destination port (#7197)Jo-Philipp Wich2010-07-161-2/+3
| | | | SVN-Revision: 22227
* firewall: - notrack support was broken in multiple ways, fix it - also ↵Jo-Philipp Wich2010-07-151-0/+3
| | | | | | consider a zone conntracked if any redirect references it (#7196) SVN-Revision: 22215
* firewall: fix support for netranges in redirect and rule sectionsJo-Philipp Wich2010-05-301-3/+3
| | | | SVN-Revision: 21640
* firewall: - fix ip6tables rules when icmp_type option is set - add "family" ↵Jo-Philipp Wich2010-05-191-2/+5
| | | | | | option to zones, forwardings, redirects and rules to selectively apply rules to iptables and/or ip6tables SVN-Revision: 21508
* firewall: - replace uci firewall with a modular dual stack implementation ↵Jo-Philipp Wich2010-05-011-0/+61
developed by Malte S. Stretz - bump version to 2 SVN-Revision: 21286
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-15 07:39:41 +0000