aboutsummaryrefslogtreecommitdiffstats
path: root/package/firewall
Commit message (Collapse)AuthorAgeFilesLines
* firewall: explictely mention network in default configuration, makes it less ↵Jo-Philipp Wich2011-05-201-0/+2
| | | | | | confusing SVN-Revision: 26961
* firewall: revert accidential committed changes from r26805Jo-Philipp Wich2011-05-021-39/+11
| | | | SVN-Revision: 26806
* firewall: provide examples of ssh port relocation on firewall and IPsec ↵Jo-Philipp Wich2011-05-022-11/+61
| | | | | | | | | | | | | passthrough Two examples of potentially useful configurations (commented out, of course): (a) map the ssh service running on the firewall to 22001 externally, without modifying the configuration of the daemon itself. this allows port 22 on the WAN side to then be port-forwarded to a LAN-based machine if desired, or if not, simply obscures the port from external attack. (b) allow IPsec/ESP and ISAKMP (UDP-based key exchange) to happen by default. useful for most modern VPN clients you might have on your WAN. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com> SVN-Revision: 26805
* firewall: prevent excessive uci state data aggregation (#9152)Jo-Philipp Wich2011-04-202-1/+3
| | | | SVN-Revision: 26740
* firewall: allow local redirection of portsJo-Philipp Wich2011-04-121-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow a redirect like: config redirect option src 'wan' option dest 'lan' option src_dport '22001' option dest_port '22' option proto 'tcp' note the absence of the "dest_ip" field, meaning to terminate the connection on the firewall itself. This patch makes three changes: (1) moves the conntrack module into the conntrack package (but not any of the conntrack_* helpers). (2) fixes a bug where the wrong table is used when the "dest_ip" field is absent. (3) accepts incoming connections on the destination port on the input_ZONE table, but only for DNATted connections. In the above example, ssh -p 22 root@myrouter would fail from the outside, but: ssh -p 22001 root@myrouter would succeed. This is handy if: (1) you want to avoid ssh probes on your router, or (2) you want to redirect incoming connections on port 22 to some machine inside your firewall, but still want to allow firewall access from outside. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com> SVN-Revision: 26617
* firewall: prevent duplicate values in interface state varsJo-Philipp Wich2011-03-302-2/+5
| | | | SVN-Revision: 26382
* Keep firewall.user during sysupgradesTravis Kemen2011-03-202-0/+3
| | | | SVN-Revision: 26241
* firewall: move include sourcing into a subshell, this makes the firewall ↵Jo-Philipp Wich2011-03-022-3/+5
| | | | | | init immune against exit in the include scripts SVN-Revision: 25835
* firewall: fix rule generation for v4 or v6 only zones (#8955)Jo-Philipp Wich2011-03-012-2/+5
| | | | SVN-Revision: 25813
* firewall: fix wrong rule order if multiple protocols are usedJo-Philipp Wich2011-01-272-4/+4
| | | | SVN-Revision: 25179
* firewall: insert SNAT and DNAT rules according to the order of the ↵Jo-Philipp Wich2010-10-083-3/+6
| | | | | | configuration file (#8052) SVN-Revision: 23318
* firewall: mark /etc/firewall.user as conffileJo-Philipp Wich2010-10-051-0/+1
| | | | SVN-Revision: 23231
* firewall: also establish forward rules when setting up nat reflection, back ↵Jo-Philipp Wich2010-10-032-7/+16
| | | | | | out early if reflection is disabled SVN-Revision: 23201
* add maintainer informationJo-Philipp Wich2010-09-301-0/+1
| | | | SVN-Revision: 23159
* firewall: fix chain selection logic, option dest must be ignored for notrack ↵Jo-Philipp Wich2010-09-281-6/+5
| | | | | | targets SVN-Revision: 23143
* firewall: don't setup nat reflection if negations are usedJo-Philipp Wich2010-09-281-0/+3
| | | | SVN-Revision: 23142
* fireall: - support negations for src_ip, dest_ip, src_dip options in rules ↵Jo-Philipp Wich2010-09-285-28/+42
| | | | | | and redirects - add NOTRACK target to rule sections, allows to define fine grained notrack rules SVN-Revision: 23141
* firewall: protect iptables invocations with locks in interface ops, it might ↵Jo-Philipp Wich2010-09-192-1/+5
| | | | | | run concurrently due to hotplug invocations on network restart SVN-Revision: 23090
* firewall: make invalid redirects and duplicate zones non-fatal, print a ↵Jo-Philipp Wich2010-09-164-10/+12
| | | | | | notice and discard them SVN-Revision: 23080
* firewall: run ifdown hotplug events synchronized, fixes a racecondition on ↵Jo-Philipp Wich2010-09-153-10/+8
| | | | | | "ifup iface" when ifdown and ifup events are delivered with a small dealy SVN-Revision: 23064
* firewall: deliver remove hotplug events for all active zones/networks when ↵Jo-Philipp Wich2010-09-143-3/+42
| | | | | | restarting the firewall SVN-Revision: 23062
* firewall: - simplify masquerade rule setup - remove various subshell ↵Jo-Philipp Wich2010-09-117-94/+114
| | | | | | invocations - speedup fw() by not relying on xargs and pipes - rework SNAT support - attach to dest zone, use src_dip/src_dport as snat source SVN-Revision: 23024
* firewall: - fix possible endless loop when the family option is used for ↵Jo-Philipp Wich2010-09-052-4/+6
| | | | | | forwardings - only generate forwarding rules in SNAT redirect sections if src_dip is specified SVN-Revision: 22938
* firewall: introduce SNAT support for redirect sectionsJo-Philipp Wich2010-09-053-4/+19
| | | | SVN-Revision: 22937
* firewall: add option to disable NAT reflectionJo-Philipp Wich2010-09-041-0/+4
| | | | SVN-Revision: 22908
* firewall: clean up description (#7875)Jo-Philipp Wich2010-09-041-1/+1
| | | | SVN-Revision: 22905
* firewall: - handle NAT reflection in firewall hotplug, solves synchronizing ↵Jo-Philipp Wich2010-09-044-8/+33
| | | | | | issues on boot - introduce masq_src and masq_dest options to limit zone masq to specific ip ranges, supports multiple subnets and negation SVN-Revision: 22888
* firewall: - fix processing of rules with an ip family option - append ↵Jo-Philipp Wich2010-08-314-42/+63
| | | | | | interface rules at the end of internal zone chains, simplifies injecting user or addon rules - support simple file logging (option log + option log_limit per zone) SVN-Revision: 22847
* firwall: fix nat reflection for zones covering multiple networksJo-Philipp Wich2010-07-311-34/+56
| | | | SVN-Revision: 22442
* firewall: add basic NAT reflection/NAT loopback supportJo-Philipp Wich2010-07-312-1/+81
| | | | SVN-Revision: 22441
* firewall: allow redirecting only destination port (#7197)Jo-Philipp Wich2010-07-162-3/+4
| | | | SVN-Revision: 22227
* firewall: fix another notrack related bugJo-Philipp Wich2010-07-151-1/+1
| | | | SVN-Revision: 22218
* firewall: - notrack support was broken in multiple ways, fix it - also ↵Jo-Philipp Wich2010-07-155-9/+11
| | | | | | consider a zone conntracked if any redirect references it (#7196) SVN-Revision: 22215
* firewall: - support alias ifnames different from parent ifname - properly ↵Jo-Philipp Wich2010-06-021-10/+23
| | | | | | handle multiple subnets per alias (v4+v6) SVN-Revision: 21656
* firewall: Initial alias interface support. This allows to define zones ↵Jo-Philipp Wich2010-06-013-29/+86
| | | | | | covering alias interfaces and associated entries like rules and forwardings. SVN-Revision: 21653
* firewall: change the order of IPv4/IPv6 address detection, fixes mixed ↵Jo-Philipp Wich2010-05-312-2/+2
| | | | | | notation v6 improperly detected as v4 address SVN-Revision: 21642
* firewall: fix support for netranges in redirect and rule sectionsJo-Philipp Wich2010-05-304-8/+8
| | | | SVN-Revision: 21640
* firewall: count rules per chain and family, fix wrong order of ip6tables ↵Jo-Philipp Wich2010-05-221-4/+4
| | | | | | rules when ipv4 only or dual family rules are defined SVN-Revision: 21533
* firewall: don't apply default udp/68 rule to ip6tablesJo-Philipp Wich2010-05-191-0/+1
| | | | SVN-Revision: 21509
* firewall: - fix ip6tables rules when icmp_type option is set - add "family" ↵Jo-Philipp Wich2010-05-197-41/+105
| | | | | | option to zones, forwardings, redirects and rules to selectively apply rules to iptables and/or ip6tables SVN-Revision: 21508
* firewall: add commented disable_ipv6 option to default configJo-Philipp Wich2010-05-191-0/+2
| | | | SVN-Revision: 21505
* firewall: implement disable_ipv6 uci optionJo-Philipp Wich2010-05-192-5/+11
| | | | SVN-Revision: 21503
* firewall (#7355) - partially revert r21486, start firewall on init again - ↵Jo-Philipp Wich2010-05-195-27/+12
| | | | | | skip iface hotplug events if base fw is not up yet - get ifname and up state with uci_get_state() in iface setup since the values gathered by scan_interfaces() may be outdated when iface coldplugging happens (observed with pptp) - ignore up state when bringing down interfaces because ifdown reverts state vars before dispatching the iface event - bump package revision SVN-Revision: 21502
* firewall: fix a possible deadlock when the firewall config has syntax errors ↵Jo-Philipp Wich2010-05-181-2/+4
| | | | | | during restart SVN-Revision: 21501
* firewall: use uci_get_state() wrapperJo-Philipp Wich2010-05-171-1/+1
| | | | SVN-Revision: 21493
* firewall: properly clear hooks in fw_stop() to prevent extensions from being ↵Jo-Philipp Wich2010-05-171-1/+8
| | | | | | called twice after fw_restart() SVN-Revision: 21488
* firewall: - defer firewall start until the first interface is brought up by ↵Jo-Philipp Wich2010-05-174-7/+21
| | | | | | hotplug, fixes race conditions on slow devices - create a file lock during firewall start and wait for it in hotplug events, prevents race conditions between start and addif - start firewall actions in background from hotplug handler since the firewall itself fires further hotplug events which results in a deadlock if not forked off - get loaded state direcly from the uci binary since updated value is not recognized by config_get after uci_set_state - bump package revision to r2 SVN-Revision: 21486
* firewall: properly unset position for delete command, fixes rule removal in ↵Jo-Philipp Wich2010-05-051-2/+2
| | | | | | ifdown SVN-Revision: 21378
* firewall: fix bug in iface hotplug handlerJo-Philipp Wich2010-05-051-1/+1
| | | | SVN-Revision: 21360
* firewall: - replace uci firewall with a modular dual stack implementation ↵Jo-Philipp Wich2010-05-0115-544/+1023
| | | | | | developed by Malte S. Stretz - bump version to 2 SVN-Revision: 21286
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-13 21:52:10 +0000