KumiSystems/openwrtv3
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
18113 commits 1 branch 0 tags 154 MiB
Commit graph

107 commits

Author SHA1 Message Date
Daniel Dickinson
05c45f0f5e firewall: fix udp rules for tcpudp proto rules using src_port and dest_port after modification by the parsing of the tcp rule 
SVN-Revision: 27469
 2011-07-06 06:26:12 +00:00
Jo-Philipp Wich
600a8517ad firewall: fix port range quirk in previous commit 
SVN-Revision: 27335
 2011-07-01 11:50:48 +00:00
Jo-Philipp Wich
df14a48dc9 firewall: properly handle negated ports in nat reflection 
SVN-Revision: 27334
 2011-07-01 11:48:14 +00:00
Jo-Philipp Wich
07abf4a81e firewall: refine default ICMPv6 rules to better conform with RFC4890, do not forward link local ICMP message types, allow parameter problem 
SVN-Revision: 27321
 2011-06-30 12:22:05 +00:00
Jo-Philipp Wich
8f0fb81dfe firewall: restore local port relocation ability from r26617 
SVN-Revision: 27318
 2011-06-30 01:36:09 +00:00
Jo-Philipp Wich
68a1c8e1e3 firewall: - allow multiple ports, protocols, macs, icmp types per rule - implement "limit" and "limit_burst" options for rules - implement "extra" option to rules and redirects for passing arbritary flags to iptables - implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination - validate symbolic icmp-type names against the selected iptables binary - properly handle forwarded ICMPv6 traffic in the default configuration 
SVN-Revision: 27317
 2011-06-30 01:31:23 +00:00
Jo-Philipp Wich
9f37422f2f firewall: ensure that fw_get_subnet4() sets an empty value if no (valid) IPv4 addr was found 
SVN-Revision: 27198
 2011-06-16 22:18:45 +00:00
Jo-Philipp Wich
c014101d73 firewall: allow symbolic names of interfaces and aliases in masq_src and masq_dest 
SVN-Revision: 27196
 2011-06-16 21:54:59 +00:00
Jo-Philipp Wich
f2b7c81d46 firewall: explictely mention network in default configuration, makes it less confusing 
SVN-Revision: 26961
 2011-05-20 13:45:40 +00:00
Jo-Philipp Wich
2e9e4c435f firewall: revert accidential committed changes from r26805 
SVN-Revision: 26806
 2011-05-02 12:55:36 +00:00
Jo-Philipp Wich
ad23dd94b6 firewall: provide examples of ssh port relocation on firewall and IPsec passthrough Two examples of potentially useful configurations (commented out, of course): 
(a) map the ssh service running on the firewall to 22001 externally, without modifying the configuration of the daemon itself. this allows port 22 on the WAN side to then be port-forwarded to a
LAN-based machine if desired, or if not, simply obscures the port from external attack.

(b) allow IPsec/ESP and ISAKMP (UDP-based key exchange) to happen by default. useful for most modern VPN clients you might have on your WAN.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

SVN-Revision: 26805
 2011-05-02 12:54:31 +00:00
Jo-Philipp Wich
2a386cee99 firewall: prevent excessive uci state data aggregation (#9152) 
SVN-Revision: 26740
 2011-04-20 11:49:09 +00:00
Jo-Philipp Wich
a9977eca91 firewall: allow local redirection of ports 
Allow a redirect like:

config redirect
        option src 'wan'
        option dest 'lan'
        option src_dport '22001'
        option dest_port '22'
        option proto 'tcp'

note the absence of the "dest_ip" field, meaning to terminate the connection on the firewall itself.

This patch makes three changes:

(1) moves the conntrack module into the conntrack package (but not any of the conntrack_* helpers).
(2) fixes a bug where the wrong table is used when the "dest_ip" field is absent.
(3) accepts incoming connections on the destination port on the input_ZONE table, but only for DNATted
    connections.

In the above example,

ssh -p 22 root@myrouter

would fail from the outside, but:

ssh -p 22001 root@myrouter

would succeed.  This is handy if:

(1) you want to avoid ssh probes on your router, or
(2) you want to redirect incoming connections on port 22 to some machine inside your firewall, but
    still want to allow firewall access from outside.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

SVN-Revision: 26617
 2011-04-12 20:03:59 +00:00
Jo-Philipp Wich
af82471525 firewall: prevent duplicate values in interface state vars 
SVN-Revision: 26382
 2011-03-30 20:29:17 +00:00
Travis Kemen
a2cd7b2883 Keep firewall.user during sysupgrades 
SVN-Revision: 26241
 2011-03-20 00:57:47 +00:00
Jo-Philipp Wich
13333a6742 firewall: move include sourcing into a subshell, this makes the firewall init immune against exit in the include scripts 
SVN-Revision: 25835
 2011-03-02 19:20:29 +00:00
Jo-Philipp Wich
1ca64678bb firewall: fix rule generation for v4 or v6 only zones (#8955) 
SVN-Revision: 25813
 2011-03-01 18:04:14 +00:00
Jo-Philipp Wich
04b20727d8 firewall: fix wrong rule order if multiple protocols are used 
SVN-Revision: 25179
 2011-01-27 22:19:53 +00:00
Jo-Philipp Wich
a43f5b5038 firewall: insert SNAT and DNAT rules according to the order of the configuration file (#8052) 
SVN-Revision: 23318
 2010-10-08 12:11:55 +00:00
Jo-Philipp Wich
7bf84dc4f8 firewall: also establish forward rules when setting up nat reflection, back out early if reflection is disabled 
SVN-Revision: 23201
 2010-10-03 18:11:59 +00:00
Jo-Philipp Wich
1a0d7a3612 firewall: fix chain selection logic, option dest must be ignored for notrack targets 
SVN-Revision: 23143
 2010-09-28 11:38:31 +00:00
Jo-Philipp Wich
a1a31f1831 firewall: don't setup nat reflection if negations are used 
SVN-Revision: 23142
 2010-09-28 11:11:11 +00:00
Jo-Philipp Wich
6a335579b8 fireall: - support negations for src_ip, dest_ip, src_dip options in rules and redirects - add NOTRACK target to rule sections, allows to define fine grained notrack rules 
SVN-Revision: 23141
 2010-09-28 10:42:56 +00:00
Jo-Philipp Wich
b07620df31 firewall: protect iptables invocations with locks in interface ops, it might run concurrently due to hotplug invocations on network restart 
SVN-Revision: 23090
 2010-09-19 15:01:47 +00:00
Jo-Philipp Wich
f90328f26e firewall: make invalid redirects and duplicate zones non-fatal, print a notice and discard them 
SVN-Revision: 23080
 2010-09-16 11:47:35 +00:00
Jo-Philipp Wich
7557011cb1 firewall: run ifdown hotplug events synchronized, fixes a racecondition on "ifup iface" when ifdown and ifup events are delivered with a small dealy 
SVN-Revision: 23064
 2010-09-15 01:53:36 +00:00
Jo-Philipp Wich
1fe50da4bb firewall: deliver remove hotplug events for all active zones/networks when restarting the firewall 
SVN-Revision: 23062
 2010-09-14 23:11:12 +00:00
Jo-Philipp Wich
f3dd8278bb firewall: - simplify masquerade rule setup - remove various subshell invocations - speedup fw() by not relying on xargs and pipes - rework SNAT support - attach to dest zone, use src_dip/src_dport as snat source 
SVN-Revision: 23024
 2010-09-11 20:04:34 +00:00
Jo-Philipp Wich
5ab58aa39c firewall: - fix possible endless loop when the family option is used for forwardings - only generate forwarding rules in SNAT redirect sections if src_dip is specified 
SVN-Revision: 22938
 2010-09-05 20:17:23 +00:00
Jo-Philipp Wich
eb79296cc1 firewall: introduce SNAT support for redirect sections 
SVN-Revision: 22937
 2010-09-05 19:03:17 +00:00
Jo-Philipp Wich
f4ee14e1c3 firewall: add option to disable NAT reflection 
SVN-Revision: 22908
 2010-09-04 17:49:14 +00:00
Jo-Philipp Wich
ca5bf9e291 firewall: - handle NAT reflection in firewall hotplug, solves synchronizing issues on boot - introduce masq_src and masq_dest options to limit zone masq to specific ip ranges, supports multiple subnets and negation 
SVN-Revision: 22888
 2010-09-04 15:49:13 +00:00
Jo-Philipp Wich
ee4dd61b10 firewall: - fix processing of rules with an ip family option - append interface rules at the end of internal zone chains, simplifies injecting user or addon rules - support simple file logging (option log + option log_limit per zone) 
SVN-Revision: 22847
 2010-08-31 01:54:08 +00:00
Jo-Philipp Wich
5b365822f3 firwall: fix nat reflection for zones covering multiple networks 
SVN-Revision: 22442
 2010-07-31 13:25:56 +00:00
Jo-Philipp Wich
d68e09200e firewall: add basic NAT reflection/NAT loopback support 
SVN-Revision: 22441
 2010-07-31 13:06:14 +00:00
Jo-Philipp Wich
e62a9791ee firewall: allow redirecting only destination port (#7197) 
SVN-Revision: 22227
 2010-07-16 06:03:15 +00:00
Jo-Philipp Wich
d6d1dd47d3 firewall: fix another notrack related bug 
SVN-Revision: 22218
 2010-07-15 23:24:01 +00:00
Jo-Philipp Wich
f8fa598bf4 firewall: - notrack support was broken in multiple ways, fix it - also consider a zone conntracked if any redirect references it (#7196) 
SVN-Revision: 22215
 2010-07-15 22:01:48 +00:00
Jo-Philipp Wich
48c357ec01 firewall: - support alias ifnames different from parent ifname - properly handle multiple subnets per alias (v4+v6) 
SVN-Revision: 21656
 2010-06-02 00:59:35 +00:00
Jo-Philipp Wich
07b571a239 firewall: Initial alias interface support. This allows to define zones covering alias interfaces and associated entries like rules and forwardings. 
SVN-Revision: 21653
 2010-06-01 21:58:48 +00:00
Jo-Philipp Wich
a756114e59 firewall: change the order of IPv4/IPv6 address detection, fixes mixed notation v6 improperly detected as v4 address 
SVN-Revision: 21642
 2010-05-31 01:34:47 +00:00
Jo-Philipp Wich
e25fbfccdf firewall: fix support for netranges in redirect and rule sections 
SVN-Revision: 21640
 2010-05-30 23:49:47 +00:00
Jo-Philipp Wich
409edb1b8e firewall: count rules per chain and family, fix wrong order of ip6tables rules when ipv4 only or dual family rules are defined 
SVN-Revision: 21533
 2010-05-22 02:01:19 +00:00
Jo-Philipp Wich
cc84e0672b firewall: don't apply default udp/68 rule to ip6tables 
SVN-Revision: 21509
 2010-05-19 21:37:12 +00:00
Jo-Philipp Wich
40ad9defcc firewall: - fix ip6tables rules when icmp_type option is set - add "family" option to zones, forwardings, redirects and rules to selectively apply rules to iptables and/or ip6tables 
SVN-Revision: 21508
 2010-05-19 21:35:23 +00:00
Jo-Philipp Wich
3875f85110 firewall: add commented disable_ipv6 option to default config 
SVN-Revision: 21505
 2010-05-19 09:49:21 +00:00
Jo-Philipp Wich
3ffd27f905 firewall: implement disable_ipv6 uci option 
SVN-Revision: 21503
 2010-05-19 01:55:46 +00:00
Jo-Philipp Wich
c6fdffd932 firewall (#7355) - partially revert r21486, start firewall on init again - skip iface hotplug events if base fw is not up yet - get ifname and up state with uci_get_state() in iface setup since the values gathered by scan_interfaces() may be outdated when iface coldplugging happens (observed with pptp) - ignore up state when bringing down interfaces because ifdown reverts state vars before dispatching the iface event - bump package revision 
SVN-Revision: 21502
 2010-05-19 00:50:14 +00:00
Jo-Philipp Wich
91519d51e9 firewall: fix a possible deadlock when the firewall config has syntax errors during restart 
SVN-Revision: 21501
 2010-05-18 20:15:47 +00:00
Jo-Philipp Wich
28e92939d1 firewall: use uci_get_state() wrapper 
SVN-Revision: 21493
 2010-05-17 19:38:13 +00:00