Jo-Philipp Wich
a9977eca91
firewall: allow local redirection of ports
...
Allow a redirect like:
config redirect
option src 'wan'
option dest 'lan'
option src_dport '22001'
option dest_port '22'
option proto 'tcp'
note the absence of the "dest_ip" field, meaning to terminate the connection on the firewall itself.
This patch makes three changes:
(1) moves the conntrack module into the conntrack package (but not any of the conntrack_* helpers).
(2) fixes a bug where the wrong table is used when the "dest_ip" field is absent.
(3) accepts incoming connections on the destination port on the input_ZONE table, but only for DNATted
connections.
In the above example,
ssh -p 22 root@myrouter
would fail from the outside, but:
ssh -p 22001 root@myrouter
would succeed. This is handy if:
(1) you want to avoid ssh probes on your router, or
(2) you want to redirect incoming connections on port 22 to some machine inside your firewall, but
still want to allow firewall access from outside.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
SVN-Revision: 26617
14 years ago
Jo-Philipp Wich
af82471525
firewall: prevent duplicate values in interface state vars
...
SVN-Revision: 26382
14 years ago
Travis Kemen
a2cd7b2883
Keep firewall.user during sysupgrades
...
SVN-Revision: 26241
14 years ago
Jo-Philipp Wich
13333a6742
firewall: move include sourcing into a subshell, this makes the firewall init immune against exit in the include scripts
...
SVN-Revision: 25835
14 years ago
Jo-Philipp Wich
1ca64678bb
firewall: fix rule generation for v4 or v6 only zones ( #8955 )
...
SVN-Revision: 25813
14 years ago
Jo-Philipp Wich
04b20727d8
firewall: fix wrong rule order if multiple protocols are used
...
SVN-Revision: 25179
14 years ago
Jo-Philipp Wich
a43f5b5038
firewall: insert SNAT and DNAT rules according to the order of the configuration file ( #8052 )
...
SVN-Revision: 23318
14 years ago
Jo-Philipp Wich
7bf84dc4f8
firewall: also establish forward rules when setting up nat reflection, back out early if reflection is disabled
...
SVN-Revision: 23201
14 years ago
Jo-Philipp Wich
1a0d7a3612
firewall: fix chain selection logic, option dest must be ignored for notrack targets
...
SVN-Revision: 23143
14 years ago
Jo-Philipp Wich
a1a31f1831
firewall: don't setup nat reflection if negations are used
...
SVN-Revision: 23142
14 years ago
Jo-Philipp Wich
6a335579b8
fireall: - support negations for src_ip, dest_ip, src_dip options in rules and redirects - add NOTRACK target to rule sections, allows to define fine grained notrack rules
...
SVN-Revision: 23141
14 years ago
Jo-Philipp Wich
b07620df31
firewall: protect iptables invocations with locks in interface ops, it might run concurrently due to hotplug invocations on network restart
...
SVN-Revision: 23090
14 years ago
Jo-Philipp Wich
f90328f26e
firewall: make invalid redirects and duplicate zones non-fatal, print a notice and discard them
...
SVN-Revision: 23080
14 years ago
Jo-Philipp Wich
7557011cb1
firewall: run ifdown hotplug events synchronized, fixes a racecondition on "ifup iface" when ifdown and ifup events are delivered with a small dealy
...
SVN-Revision: 23064
14 years ago
Jo-Philipp Wich
1fe50da4bb
firewall: deliver remove hotplug events for all active zones/networks when restarting the firewall
...
SVN-Revision: 23062
14 years ago
Jo-Philipp Wich
f3dd8278bb
firewall: - simplify masquerade rule setup - remove various subshell invocations - speedup fw() by not relying on xargs and pipes - rework SNAT support - attach to dest zone, use src_dip/src_dport as snat source
...
SVN-Revision: 23024
14 years ago
Jo-Philipp Wich
5ab58aa39c
firewall: - fix possible endless loop when the family option is used for forwardings - only generate forwarding rules in SNAT redirect sections if src_dip is specified
...
SVN-Revision: 22938
14 years ago
Jo-Philipp Wich
eb79296cc1
firewall: introduce SNAT support for redirect sections
...
SVN-Revision: 22937
14 years ago
Jo-Philipp Wich
f4ee14e1c3
firewall: add option to disable NAT reflection
...
SVN-Revision: 22908
14 years ago
Jo-Philipp Wich
ca5bf9e291
firewall: - handle NAT reflection in firewall hotplug, solves synchronizing issues on boot - introduce masq_src and masq_dest options to limit zone masq to specific ip ranges, supports multiple subnets and negation
...
SVN-Revision: 22888
14 years ago
Jo-Philipp Wich
ee4dd61b10
firewall: - fix processing of rules with an ip family option - append interface rules at the end of internal zone chains, simplifies injecting user or addon rules - support simple file logging (option log + option log_limit per zone)
...
SVN-Revision: 22847
14 years ago
Jo-Philipp Wich
5b365822f3
firwall: fix nat reflection for zones covering multiple networks
...
SVN-Revision: 22442
14 years ago
Jo-Philipp Wich
d68e09200e
firewall: add basic NAT reflection/NAT loopback support
...
SVN-Revision: 22441
14 years ago
Jo-Philipp Wich
e62a9791ee
firewall: allow redirecting only destination port ( #7197 )
...
SVN-Revision: 22227
14 years ago
Jo-Philipp Wich
d6d1dd47d3
firewall: fix another notrack related bug
...
SVN-Revision: 22218
14 years ago
Jo-Philipp Wich
f8fa598bf4
firewall: - notrack support was broken in multiple ways, fix it - also consider a zone conntracked if any redirect references it ( #7196 )
...
SVN-Revision: 22215
14 years ago
Jo-Philipp Wich
48c357ec01
firewall: - support alias ifnames different from parent ifname - properly handle multiple subnets per alias (v4+v6)
...
SVN-Revision: 21656
14 years ago
Jo-Philipp Wich
07b571a239
firewall: Initial alias interface support. This allows to define zones covering alias interfaces and associated entries like rules and forwardings.
...
SVN-Revision: 21653
14 years ago
Jo-Philipp Wich
a756114e59
firewall: change the order of IPv4/IPv6 address detection, fixes mixed notation v6 improperly detected as v4 address
...
SVN-Revision: 21642
14 years ago
Jo-Philipp Wich
e25fbfccdf
firewall: fix support for netranges in redirect and rule sections
...
SVN-Revision: 21640
14 years ago
Jo-Philipp Wich
409edb1b8e
firewall: count rules per chain and family, fix wrong order of ip6tables rules when ipv4 only or dual family rules are defined
...
SVN-Revision: 21533
14 years ago
Jo-Philipp Wich
cc84e0672b
firewall: don't apply default udp/68 rule to ip6tables
...
SVN-Revision: 21509
14 years ago
Jo-Philipp Wich
40ad9defcc
firewall: - fix ip6tables rules when icmp_type option is set - add "family" option to zones, forwardings, redirects and rules to selectively apply rules to iptables and/or ip6tables
...
SVN-Revision: 21508
14 years ago
Jo-Philipp Wich
3875f85110
firewall: add commented disable_ipv6 option to default config
...
SVN-Revision: 21505
14 years ago
Jo-Philipp Wich
3ffd27f905
firewall: implement disable_ipv6 uci option
...
SVN-Revision: 21503
14 years ago
Jo-Philipp Wich
c6fdffd932
firewall ( #7355 ) - partially revert r21486, start firewall on init again - skip iface hotplug events if base fw is not up yet - get ifname and up state with uci_get_state() in iface setup since the values gathered by scan_interfaces() may be outdated when iface coldplugging happens (observed with pptp) - ignore up state when bringing down interfaces because ifdown reverts state vars before dispatching the iface event - bump package revision
...
SVN-Revision: 21502
14 years ago
Jo-Philipp Wich
91519d51e9
firewall: fix a possible deadlock when the firewall config has syntax errors during restart
...
SVN-Revision: 21501
14 years ago
Jo-Philipp Wich
28e92939d1
firewall: use uci_get_state() wrapper
...
SVN-Revision: 21493
14 years ago
Jo-Philipp Wich
18a79362e9
firewall: properly clear hooks in fw_stop() to prevent extensions from being called twice after fw_restart()
...
SVN-Revision: 21488
14 years ago
Jo-Philipp Wich
de15765a37
firewall: - defer firewall start until the first interface is brought up by hotplug, fixes race conditions on slow devices - create a file lock during firewall start and wait for it in hotplug events, prevents race conditions between start and addif - start firewall actions in background from hotplug handler since the firewall itself fires further hotplug events which results in a deadlock if not forked off - get loaded state direcly from the uci binary since updated value is not recognized by config_get after uci_set_state - bump package revision to r2
...
SVN-Revision: 21486
14 years ago
Jo-Philipp Wich
e796062a4b
firewall: properly unset position for delete command, fixes rule removal in ifdown
...
SVN-Revision: 21378
14 years ago
Jo-Philipp Wich
3c2149a759
firewall: fix bug in iface hotplug handler
...
SVN-Revision: 21360
14 years ago
Jo-Philipp Wich
c284cb51c0
firewall: - replace uci firewall with a modular dual stack implementation developed by Malte S. Stretz - bump version to 2
...
SVN-Revision: 21286
15 years ago
Travis Kemen
431808b5bf
allow ping
...
SVN-Revision: 20261
15 years ago
Jo-Philipp Wich
f96ecd026d
firewall: insert rules at the beginning of chains again while maintaining non reversed order, fixes wrong ordering introduced by r18015
...
SVN-Revision: 19946
15 years ago
Jo-Philipp Wich
25a5fab34c
firewall: fix bad number error in fw_redirect() ( #6704 )
...
SVN-Revision: 19765
15 years ago
Travis Kemen
9f3a73d9e2
Add destination ip of the wan adapter useful if you have multiple ip addresses.
...
SVN-Revision: 19574
15 years ago
Jo-Philipp Wich
6eae630652
firewall: fix a race condition preventing interfaces from being added to the firewall on boot
...
SVN-Revision: 19232
15 years ago
Felix Fietkau
10f627db5c
firewall: fix fallout from r18716 ( fixes #6338 )
...
SVN-Revision: 18733
15 years ago
Felix Fietkau
74cbcc9ee5
firewall: get rid of recursive shell script inclusion to improve hush compatibility
...
SVN-Revision: 18716
15 years ago