aboutsummaryrefslogtreecommitdiffstats
path: root/package/firewall/files/lib
Commit message (Collapse)AuthorAgeFilesLines
* firewall: make sure that -m mac is used with --mac-source, follow up to r27508Jo-Philipp Wich2011-07-071-1/+1
| | | | SVN-Revision: 27519
* firewall: also correct another variable missed in previous commitDaniel Dickinson2011-07-071-1/+1
| | | | SVN-Revision: 27508
* firewall: fix wrong variable names for protocol command line parameter - ↵Daniel Dickinson2011-07-071-2/+2
| | | | | | were missed during r27500 SVN-Revision: 27507
* firewall: - solve scoping issues when multiple values are used, thanks ↵Jo-Philipp Wich2011-07-063-29/+25
| | | | | | Daniel Dickinson - ignore src_port/dest_port for proto icmp rules, ignore icmp_type for non-icmp rules - properly handle icmp when proto is given in numerical form (1, 58) - support negated icmp types SVN-Revision: 27500
* firewall: fix udp rules for tcpudp proto rules using src_port and dest_port ↵Daniel Dickinson2011-07-061-0/+7
| | | | | | after modification by the parsing of the tcp rule SVN-Revision: 27469
* firewall: restore local port relocation ability from r26617Jo-Philipp Wich2011-06-301-3/+3
| | | | SVN-Revision: 27318
* firewall: - allow multiple ports, protocols, macs, icmp types per rule - ↵Jo-Philipp Wich2011-06-303-56/+174
| | | | | | implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration SVN-Revision: 27317
* firewall: ensure that fw_get_subnet4() sets an empty value if no (valid) ↵Jo-Philipp Wich2011-06-161-0/+1
| | | | | | IPv4 addr was found SVN-Revision: 27198
* firewall: allow symbolic names of interfaces and aliases in masq_src and ↵Jo-Philipp Wich2011-06-162-2/+27
| | | | | | masq_dest SVN-Revision: 27196
* firewall: revert accidential committed changes from r26805Jo-Philipp Wich2011-05-021-39/+11
| | | | SVN-Revision: 26806
* firewall: provide examples of ssh port relocation on firewall and IPsec ↵Jo-Philipp Wich2011-05-021-11/+39
| | | | | | | | | | | | | passthrough Two examples of potentially useful configurations (commented out, of course): (a) map the ssh service running on the firewall to 22001 externally, without modifying the configuration of the daemon itself. this allows port 22 on the WAN side to then be port-forwarded to a LAN-based machine if desired, or if not, simply obscures the port from external attack. (b) allow IPsec/ESP and ISAKMP (UDP-based key exchange) to happen by default. useful for most modern VPN clients you might have on your WAN. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com> SVN-Revision: 26805
* firewall: prevent excessive uci state data aggregation (#9152)Jo-Philipp Wich2011-04-201-0/+2
| | | | SVN-Revision: 26740
* firewall: allow local redirection of portsJo-Philipp Wich2011-04-121-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow a redirect like: config redirect option src 'wan' option dest 'lan' option src_dport '22001' option dest_port '22' option proto 'tcp' note the absence of the "dest_ip" field, meaning to terminate the connection on the firewall itself. This patch makes three changes: (1) moves the conntrack module into the conntrack package (but not any of the conntrack_* helpers). (2) fixes a bug where the wrong table is used when the "dest_ip" field is absent. (3) accepts incoming connections on the destination port on the input_ZONE table, but only for DNATted connections. In the above example, ssh -p 22 root@myrouter would fail from the outside, but: ssh -p 22001 root@myrouter would succeed. This is handy if: (1) you want to avoid ssh probes on your router, or (2) you want to redirect incoming connections on port 22 to some machine inside your firewall, but still want to allow firewall access from outside. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com> SVN-Revision: 26617
* firewall: prevent duplicate values in interface state varsJo-Philipp Wich2011-03-301-1/+4
| | | | SVN-Revision: 26382
* firewall: move include sourcing into a subshell, this makes the firewall ↵Jo-Philipp Wich2011-03-021-2/+4
| | | | | | init immune against exit in the include scripts SVN-Revision: 25835
* firewall: fix rule generation for v4 or v6 only zones (#8955)Jo-Philipp Wich2011-03-011-0/+3
| | | | SVN-Revision: 25813
* firewall: fix wrong rule order if multiple protocols are usedJo-Philipp Wich2011-01-271-3/+3
| | | | SVN-Revision: 25179
* firewall: insert SNAT and DNAT rules according to the order of the ↵Jo-Philipp Wich2010-10-082-2/+5
| | | | | | configuration file (#8052) SVN-Revision: 23318
* firewall: fix chain selection logic, option dest must be ignored for notrack ↵Jo-Philipp Wich2010-09-281-6/+5
| | | | | | targets SVN-Revision: 23143
* fireall: - support negations for src_ip, dest_ip, src_dip options in rules ↵Jo-Philipp Wich2010-09-284-27/+41
| | | | | | and redirects - add NOTRACK target to rule sections, allows to define fine grained notrack rules SVN-Revision: 23141
* firewall: protect iptables invocations with locks in interface ops, it might ↵Jo-Philipp Wich2010-09-191-0/+4
| | | | | | run concurrently due to hotplug invocations on network restart SVN-Revision: 23090
* firewall: make invalid redirects and duplicate zones non-fatal, print a ↵Jo-Philipp Wich2010-09-163-9/+11
| | | | | | notice and discard them SVN-Revision: 23080
* firewall: run ifdown hotplug events synchronized, fixes a racecondition on ↵Jo-Philipp Wich2010-09-151-8/+6
| | | | | | "ifup iface" when ifdown and ifup events are delivered with a small dealy SVN-Revision: 23064
* firewall: deliver remove hotplug events for all active zones/networks when ↵Jo-Philipp Wich2010-09-142-2/+41
| | | | | | restarting the firewall SVN-Revision: 23062
* firewall: - simplify masquerade rule setup - remove various subshell ↵Jo-Philipp Wich2010-09-116-93/+113
| | | | | | invocations - speedup fw() by not relying on xargs and pipes - rework SNAT support - attach to dest zone, use src_dip/src_dport as snat source SVN-Revision: 23024
* firewall: - fix possible endless loop when the family option is used for ↵Jo-Philipp Wich2010-09-052-4/+6
| | | | | | forwardings - only generate forwarding rules in SNAT redirect sections if src_dip is specified SVN-Revision: 22938
* firewall: introduce SNAT support for redirect sectionsJo-Philipp Wich2010-09-051-2/+14
| | | | SVN-Revision: 22937
* firewall: - handle NAT reflection in firewall hotplug, solves synchronizing ↵Jo-Philipp Wich2010-09-042-5/+29
| | | | | | issues on boot - introduce masq_src and masq_dest options to limit zone masq to specific ip ranges, supports multiple subnets and negation SVN-Revision: 22888
* firewall: - fix processing of rules with an ip family option - append ↵Jo-Philipp Wich2010-08-313-41/+62
| | | | | | interface rules at the end of internal zone chains, simplifies injecting user or addon rules - support simple file logging (option log + option log_limit per zone) SVN-Revision: 22847
* firewall: allow redirecting only destination port (#7197)Jo-Philipp Wich2010-07-161-2/+3
| | | | SVN-Revision: 22227
* firewall: fix another notrack related bugJo-Philipp Wich2010-07-151-1/+1
| | | | SVN-Revision: 22218
* firewall: - notrack support was broken in multiple ways, fix it - also ↵Jo-Philipp Wich2010-07-154-8/+10
| | | | | | consider a zone conntracked if any redirect references it (#7196) SVN-Revision: 22215
* firewall: - support alias ifnames different from parent ifname - properly ↵Jo-Philipp Wich2010-06-021-10/+23
| | | | | | handle multiple subnets per alias (v4+v6) SVN-Revision: 21656
* firewall: Initial alias interface support. This allows to define zones ↵Jo-Philipp Wich2010-06-012-28/+85
| | | | | | covering alias interfaces and associated entries like rules and forwardings. SVN-Revision: 21653
* firewall: change the order of IPv4/IPv6 address detection, fixes mixed ↵Jo-Philipp Wich2010-05-312-2/+2
| | | | | | notation v6 improperly detected as v4 address SVN-Revision: 21642
* firewall: fix support for netranges in redirect and rule sectionsJo-Philipp Wich2010-05-303-7/+7
| | | | SVN-Revision: 21640
* firewall: count rules per chain and family, fix wrong order of ip6tables ↵Jo-Philipp Wich2010-05-221-4/+4
| | | | | | rules when ipv4 only or dual family rules are defined SVN-Revision: 21533
* firewall: - fix ip6tables rules when icmp_type option is set - add "family" ↵Jo-Philipp Wich2010-05-196-40/+104
| | | | | | option to zones, forwardings, redirects and rules to selectively apply rules to iptables and/or ip6tables SVN-Revision: 21508
* firewall: implement disable_ipv6 uci optionJo-Philipp Wich2010-05-192-5/+11
| | | | SVN-Revision: 21503
* firewall (#7355) - partially revert r21486, start firewall on init again - ↵Jo-Philipp Wich2010-05-192-12/+5
| | | | | | skip iface hotplug events if base fw is not up yet - get ifname and up state with uci_get_state() in iface setup since the values gathered by scan_interfaces() may be outdated when iface coldplugging happens (observed with pptp) - ignore up state when bringing down interfaces because ifdown reverts state vars before dispatching the iface event - bump package revision SVN-Revision: 21502
* firewall: fix a possible deadlock when the firewall config has syntax errors ↵Jo-Philipp Wich2010-05-181-2/+4
| | | | | | during restart SVN-Revision: 21501
* firewall: use uci_get_state() wrapperJo-Philipp Wich2010-05-171-1/+1
| | | | SVN-Revision: 21493
* firewall: properly clear hooks in fw_stop() to prevent extensions from being ↵Jo-Philipp Wich2010-05-171-1/+8
| | | | | | called twice after fw_restart() SVN-Revision: 21488
* firewall: - defer firewall start until the first interface is brought up by ↵Jo-Philipp Wich2010-05-171-3/+6
| | | | | | hotplug, fixes race conditions on slow devices - create a file lock during firewall start and wait for it in hotplug events, prevents race conditions between start and addif - start firewall actions in background from hotplug handler since the firewall itself fires further hotplug events which results in a deadlock if not forked off - get loaded state direcly from the uci binary since updated value is not recognized by config_get after uci_set_state - bump package revision to r2 SVN-Revision: 21486
* firewall: properly unset position for delete command, fixes rule removal in ↵Jo-Philipp Wich2010-05-051-2/+2
| | | | | | ifdown SVN-Revision: 21378
* firewall: - replace uci firewall with a modular dual stack implementation ↵Jo-Philipp Wich2010-05-019-0/+931
developed by Malte S. Stretz - bump version to 2 SVN-Revision: 21286
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-26 20:10:41 +0000