| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
| |
- fixes reload when firewall is not running already
- fixes crash when ipsets are supported but undeclared
- fixes handling of per zone user chains on reload
SVN-Revision: 36689
|
|
|
|
|
|
|
| |
- fixes segfault in flush command if ipset support is not available
- fixes internal rule generation if custom chains are enabled
SVN-Revision: 36686
|
|
|
|
| |
SVN-Revision: 36684
|
|
|
|
|
|
|
| |
* use libiptc and libxtables directly to manage ruleset, iptables-restore is unreliable and prone to race conditions
* make ipset integration more reliable
SVN-Revision: 36681
|
|
|
|
|
|
|
|
| |
option to set routing table for protocol routes * Enabled for IPv6 for source-based filtering, disabled for IPv4
Based on a patch by Kristian Evensen. Thank You.
SVN-Revision: 36653
|
|
|
|
|
|
| |
(DS-Lite) * Use source-based routing for IPv6 to allow multi-wan * Various smaller tunnel setup improvements
SVN-Revision: 36627
|
|
|
|
| |
SVN-Revision: 36626
|
|
|
|
| |
SVN-Revision: 36624
|
|
|
|
| |
SVN-Revision: 36623
|
|
|
|
| |
SVN-Revision: 36622
|
|
|
|
|
|
|
| |
- assume "tcp+udp" if no protcol is specified in rules or redirects (#13422, #13386)
- add support for fwmark matches and mark setting targets
SVN-Revision: 36521
|
|
|
|
| |
SVN-Revision: 36463
|
|
|
|
|
|
| |
removing the ifname option
SVN-Revision: 36424
|
|
|
|
|
|
| |
This fixes working behind another router which gives out ULAs.
SVN-Revision: 36416
|
|
|
|
| |
SVN-Revision: 36383
|
|
|
|
|
|
| |
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 36336
|
|
|
|
|
|
| |
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 36294
|
|
|
|
|
|
| |
Signed-off-by: John Crispin <blogic@openwrt.org>
SVN-Revision: 36284
|
|
|
|
|
|
| |
Signed-off-by: John Crispin <blogic@openwrt.org>
SVN-Revision: 36282
|
|
|
|
| |
SVN-Revision: 36281
|
|
|
|
| |
SVN-Revision: 36280
|
|
|
|
|
|
| |
prefixes * Fix route sorting order (nbd) * Add support for ip rules (jow) * Implement support for route / route6 table attribute (jow)
SVN-Revision: 36196
|
|
|
|
|
|
| |
assigned subprefixes * Add preliminary support for RFC 6603 prefix exclusion
SVN-Revision: 36193
|
|
|
|
|
|
|
| |
* fixes parsing of src/dest '*'
* fixes parsing of proto 'all'
SVN-Revision: 36111
|
|
|
|
|
|
| |
* fixes port remapping rules (#13217)
SVN-Revision: 36100
|
|
|
|
|
|
| |
In some cases IPv6 DNS-servers were not added correctly.
SVN-Revision: 36095
|
|
|
|
|
|
| |
* fixes reload handling of zones and ipsets that are still running but already deleted from the config
SVN-Revision: 36092
|
|
|
|
|
|
|
| |
- support network names in per-zone 'masq_src', 'masq_dest' and 'subnet' options (#13197)
- do not allow src_mac option for SNAT rules
SVN-Revision: 36090
|
|
|
|
|
|
|
| |
* Introduce "option reload" for includes to specify whether includes should be processed on reload (e.g. when tapping into internal chains)
* Allow "network" and "device" commands while firewall is running (to make them usable in includes)
SVN-Revision: 36009
|
|
|
|
|
|
|
|
|
|
| |
* Adds support for emitting hotplug events when creating and clearing zones (fixes miniupnpd)
* Make NAT reflection direction configurable
* Map init script stop action to flush
* Map init script reload action to reload
* Respect init script disabled state in hotplug handler
SVN-Revision: 35998
|
|
|
|
|
|
|
|
|
|
| |
* Fixes compilation against eglibc
* Fixes tracking logic when selectively restarting IPv4 or IPv6 firewall
* Fixes tracking logic for user chains by differentiating between reloads and restarts
* Introduces per-zone user chains {input,output,forwarding,prerouting,postrouting}_$zone_rule
* Supports legacy "tcpudp" protocol notation again
SVN-Revision: 35969
|
|
|
|
|
|
| |
This reverts commit 89969fa333c90fdb217b7289272f3427add107de.
SVN-Revision: 35904
|
|
|
|
|
|
|
| |
- introduce per-zone user chains
- support legacy "tcpudp" protocol notation
SVN-Revision: 35903
|
|
|
|
| |
SVN-Revision: 35889
|
|
|
|
| |
SVN-Revision: 35845
|
|
|
|
|
|
| |
reload
SVN-Revision: 35820
|
|
|
|
| |
SVN-Revision: 35745
|
|
|
|
| |
SVN-Revision: 35744
|
|
|
|
|
|
| |
certain conditions.
SVN-Revision: 35743
|
|
|
|
|
|
|
|
|
| |
- all uci rules are boxed in custom chains now, so a firewall stop leaves user rules intact
- properly handle selective ipv4 or ipv6 only firewall start/stop/restart actions
- support ip ranges (e.g. option src_ip '!192.168.1.1-192.168.1.100' -> -m iprange ! --src-range 192.168.1.1-192.168.1.100')
- support time options (e.g. option weekdays 'Mon Tue Sat' -> -m time --weekdays 1,2,6')
SVN-Revision: 35738
|
|
|
|
| |
SVN-Revision: 35643
|
|
|
|
|
|
|
|
|
|
|
|
| |
- reduce mssfix related log spam (#10681)
- separate src and dest terminal chains (#11453, #12945)
- disable per-zone custom chains by default, they're rarely used
Additionally introduce options "device", "subnet", "extra", "extra_src" and "extra_dest"
to allow defining zones not related to uci interfaces, e.g. to match "ppp+" or any tcp
traffic to and from a specific port.
SVN-Revision: 35484
|
|
|
|
|
|
| |
support for temporary addresses and routes * Added support for offlink addresses * Improved status-output for assigned prefixes
SVN-Revision: 35420
|
|
|
|
|
|
|
| |
fixes DNS servers on reload (#12910)
fixes ubus object race on reload or down/up (#12612)
SVN-Revision: 35383
|
|
|
|
| |
SVN-Revision: 35377
|
|
|
|
| |
SVN-Revision: 35369
|
|
|
|
|
|
| |
interfaces
SVN-Revision: 35362
|
|
|
|
| |
SVN-Revision: 35348
|
|
|
|
| |
SVN-Revision: 35347
|
|
|
|
| |
SVN-Revision: 35346
|