aboutsummaryrefslogtreecommitdiffstats
path: root/package/firewall/files
Commit message (Collapse)AuthorAgeFilesLines
* firewall: further tune ICMPv6 default rules according to RFC4890 (#9893)Jo-Philipp Wich2011-08-142-1/+17
| | | | SVN-Revision: 27979
* firewall: prevent redundant rules if multiple ports and multiple icmp types ↵Jo-Philipp Wich2011-07-261-7/+16
| | | | | | are given in a rule block for both icmp and other protocols SVN-Revision: 27792
* firewall: fix serious bug in state var handling (#9746)Jo-Philipp Wich2011-07-201-2/+2
| | | | SVN-Revision: 27711
* firewall: rework state variable handling, use uci_toggle_state() where ↵Jo-Philipp Wich2011-07-151-17/+24
| | | | | | applicable and properly handle duplicates in add and del state helpers (#9152, #9710) SVN-Revision: 27618
* firewall: make sure that -m mac is used with --mac-source, follow up to r27508Jo-Philipp Wich2011-07-071-1/+1
| | | | SVN-Revision: 27519
* firewall: also correct another variable missed in previous commitDaniel Dickinson2011-07-071-1/+1
| | | | SVN-Revision: 27508
* firewall: fix wrong variable names for protocol command line parameter - ↵Daniel Dickinson2011-07-071-2/+2
| | | | | | were missed during r27500 SVN-Revision: 27507
* firewall: - solve scoping issues when multiple values are used, thanks ↵Jo-Philipp Wich2011-07-063-29/+25
| | | | | | Daniel Dickinson - ignore src_port/dest_port for proto icmp rules, ignore icmp_type for non-icmp rules - properly handle icmp when proto is given in numerical form (1, 58) - support negated icmp types SVN-Revision: 27500
* firewall: fix udp rules for tcpudp proto rules using src_port and dest_port ↵Daniel Dickinson2011-07-061-0/+7
| | | | | | after modification by the parsing of the tcp rule SVN-Revision: 27469
* firewall: fix port range quirk in previous commitJo-Philipp Wich2011-07-011-2/+2
| | | | SVN-Revision: 27335
* firewall: properly handle negated ports in nat reflectionJo-Philipp Wich2011-07-011-4/+12
| | | | SVN-Revision: 27334
* firewall: refine default ICMPv6 rules to better conform with RFC4890, do not ↵Jo-Philipp Wich2011-06-301-13/+2
| | | | | | forward link local ICMP message types, allow parameter problem SVN-Revision: 27321
* firewall: restore local port relocation ability from r26617Jo-Philipp Wich2011-06-301-3/+3
| | | | SVN-Revision: 27318
* firewall: - allow multiple ports, protocols, macs, icmp types per rule - ↵Jo-Philipp Wich2011-06-305-73/+219
| | | | | | implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
* firewall: ensure that fw_get_subnet4() sets an empty value if no (valid) ↵Jo-Philipp Wich2011-06-161-0/+1
| | | | | | IPv4 addr was found SVN-Revision: 27198
* firewall: allow symbolic names of interfaces and aliases in masq_src and ↵Jo-Philipp Wich2011-06-162-2/+27
| | | | | | masq_dest SVN-Revision: 27196
* firewall: explictely mention network in default configuration, makes it less ↵Jo-Philipp Wich2011-05-201-0/+2
| | | | | | confusing SVN-Revision: 26961
* firewall: revert accidential committed changes from r26805Jo-Philipp Wich2011-05-021-39/+11
| | | | SVN-Revision: 26806
* firewall: provide examples of ssh port relocation on firewall and IPsec ↵Jo-Philipp Wich2011-05-022-11/+61
| | | | | | | | | | | | | passthrough Two examples of potentially useful configurations (commented out, of course): (a) map the ssh service running on the firewall to 22001 externally, without modifying the configuration of the daemon itself. this allows port 22 on the WAN side to then be port-forwarded to a LAN-based machine if desired, or if not, simply obscures the port from external attack. (b) allow IPsec/ESP and ISAKMP (UDP-based key exchange) to happen by default. useful for most modern VPN clients you might have on your WAN. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com> SVN-Revision: 26805
* firewall: prevent excessive uci state data aggregation (#9152)Jo-Philipp Wich2011-04-201-0/+2
| | | | SVN-Revision: 26740
* firewall: allow local redirection of portsJo-Philipp Wich2011-04-121-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow a redirect like: config redirect option src 'wan' option dest 'lan' option src_dport '22001' option dest_port '22' option proto 'tcp' note the absence of the "dest_ip" field, meaning to terminate the connection on the firewall itself. This patch makes three changes: (1) moves the conntrack module into the conntrack package (but not any of the conntrack_* helpers). (2) fixes a bug where the wrong table is used when the "dest_ip" field is absent. (3) accepts incoming connections on the destination port on the input_ZONE table, but only for DNATted connections. In the above example, ssh -p 22 root@myrouter would fail from the outside, but: ssh -p 22001 root@myrouter would succeed. This is handy if: (1) you want to avoid ssh probes on your router, or (2) you want to redirect incoming connections on port 22 to some machine inside your firewall, but still want to allow firewall access from outside. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com> SVN-Revision: 26617
* firewall: prevent duplicate values in interface state varsJo-Philipp Wich2011-03-301-1/+4
| | | | SVN-Revision: 26382
* Keep firewall.user during sysupgradesTravis Kemen2011-03-201-0/+1
| | | | SVN-Revision: 26241
* firewall: move include sourcing into a subshell, this makes the firewall ↵Jo-Philipp Wich2011-03-021-2/+4
| | | | | | init immune against exit in the include scripts SVN-Revision: 25835
* firewall: fix rule generation for v4 or v6 only zones (#8955)Jo-Philipp Wich2011-03-011-0/+3
| | | | SVN-Revision: 25813
* firewall: fix wrong rule order if multiple protocols are usedJo-Philipp Wich2011-01-271-3/+3
| | | | SVN-Revision: 25179
* firewall: insert SNAT and DNAT rules according to the order of the ↵Jo-Philipp Wich2010-10-082-2/+5
| | | | | | configuration file (#8052) SVN-Revision: 23318
* firewall: also establish forward rules when setting up nat reflection, back ↵Jo-Philipp Wich2010-10-031-6/+15
| | | | | | out early if reflection is disabled SVN-Revision: 23201
* firewall: fix chain selection logic, option dest must be ignored for notrack ↵Jo-Philipp Wich2010-09-281-6/+5
| | | | | | targets SVN-Revision: 23143
* firewall: don't setup nat reflection if negations are usedJo-Philipp Wich2010-09-281-0/+3
| | | | SVN-Revision: 23142
* fireall: - support negations for src_ip, dest_ip, src_dip options in rules ↵Jo-Philipp Wich2010-09-284-27/+41
| | | | | | and redirects - add NOTRACK target to rule sections, allows to define fine grained notrack rules SVN-Revision: 23141
* firewall: protect iptables invocations with locks in interface ops, it might ↵Jo-Philipp Wich2010-09-191-0/+4
| | | | | | run concurrently due to hotplug invocations on network restart SVN-Revision: 23090
* firewall: make invalid redirects and duplicate zones non-fatal, print a ↵Jo-Philipp Wich2010-09-163-9/+11
| | | | | | notice and discard them SVN-Revision: 23080
* firewall: run ifdown hotplug events synchronized, fixes a racecondition on ↵Jo-Philipp Wich2010-09-152-9/+7
| | | | | | "ifup iface" when ifdown and ifup events are delivered with a small dealy SVN-Revision: 23064
* firewall: deliver remove hotplug events for all active zones/networks when ↵Jo-Philipp Wich2010-09-142-2/+41
| | | | | | restarting the firewall SVN-Revision: 23062
* firewall: - simplify masquerade rule setup - remove various subshell ↵Jo-Philipp Wich2010-09-116-93/+113
| | | | | | invocations - speedup fw() by not relying on xargs and pipes - rework SNAT support - attach to dest zone, use src_dip/src_dport as snat source SVN-Revision: 23024
* firewall: - fix possible endless loop when the family option is used for ↵Jo-Philipp Wich2010-09-052-4/+6
| | | | | | forwardings - only generate forwarding rules in SNAT redirect sections if src_dip is specified SVN-Revision: 22938
* firewall: introduce SNAT support for redirect sectionsJo-Philipp Wich2010-09-052-3/+18
| | | | SVN-Revision: 22937
* firewall: add option to disable NAT reflectionJo-Philipp Wich2010-09-041-0/+4
| | | | SVN-Revision: 22908
* firewall: - handle NAT reflection in firewall hotplug, solves synchronizing ↵Jo-Philipp Wich2010-09-043-6/+30
| | | | | | issues on boot - introduce masq_src and masq_dest options to limit zone masq to specific ip ranges, supports multiple subnets and negation SVN-Revision: 22888
* firewall: - fix processing of rules with an ip family option - append ↵Jo-Philipp Wich2010-08-313-41/+62
| | | | | | interface rules at the end of internal zone chains, simplifies injecting user or addon rules - support simple file logging (option log + option log_limit per zone) SVN-Revision: 22847
* firwall: fix nat reflection for zones covering multiple networksJo-Philipp Wich2010-07-311-34/+56
| | | | SVN-Revision: 22442
* firewall: add basic NAT reflection/NAT loopback supportJo-Philipp Wich2010-07-311-0/+79
| | | | SVN-Revision: 22441
* firewall: allow redirecting only destination port (#7197)Jo-Philipp Wich2010-07-161-2/+3
| | | | SVN-Revision: 22227
* firewall: fix another notrack related bugJo-Philipp Wich2010-07-151-1/+1
| | | | SVN-Revision: 22218
* firewall: - notrack support was broken in multiple ways, fix it - also ↵Jo-Philipp Wich2010-07-154-8/+10
| | | | | | consider a zone conntracked if any redirect references it (#7196) SVN-Revision: 22215
* firewall: - support alias ifnames different from parent ifname - properly ↵Jo-Philipp Wich2010-06-021-10/+23
| | | | | | handle multiple subnets per alias (v4+v6) SVN-Revision: 21656
* firewall: Initial alias interface support. This allows to define zones ↵Jo-Philipp Wich2010-06-012-28/+85
| | | | | | covering alias interfaces and associated entries like rules and forwardings. SVN-Revision: 21653
* firewall: change the order of IPv4/IPv6 address detection, fixes mixed ↵Jo-Philipp Wich2010-05-312-2/+2
| | | | | | notation v6 improperly detected as v4 address SVN-Revision: 21642
* firewall: fix support for netranges in redirect and rule sectionsJo-Philipp Wich2010-05-303-7/+7
| | | | SVN-Revision: 21640
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-07 07:19:45 +0000