qi-hardware/openwrt-xburst
1
0
Fork 0
mirror of git://projects.qi-hardware.com/openwrt-xburst.git synced 2024-12-18 13:01:55 +02:00
Code
23,539 Commits 13 Branches 0 Tags 117 MiB
060f822fc2
Commit Graph

134 Commits

Author SHA1 Message Date
jow
e1df4ecd68 [packages] firewall: fix nat reflection after netifd status format change 
- use /lib/functions/network.sh
 - simplify nat reflection code

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@31936 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2012-05-28 03:15:05 +00:00
jow
b8351c325d [package] firewall: rework interface address determination to skip ipv6 addresses 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@31755 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2012-05-16 13:37:49 +00:00
jow
0945d8e239 [package] firewall: fix nat reflection after netifd switch (#11460) 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@31754 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2012-05-16 13:03:54 +00:00
mirko
031a7820e2 [package/firewall] minor change: adjust formatting of firewall.config 
- remove trailing whitespaces (s/\ $//g)
 - replace spaces with tabs between options and values

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@31427 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2012-04-21 19:42:28 +00:00
jow
30c57b2be2 [package] firewall: revert processing order of redirects and rules, ensures that rules can be used to filter before redirects are reached 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@31014 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2012-03-18 23:34:06 +00:00
jow
6523857aba [package] firewall: fix fw__uci_state_del() procedure (#11132) 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@30938 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2012-03-13 21:22:13 +00:00
jow
063d80418e [package] firewall: allow ICMPv6 type 129 (echo reply) - this fixes basic ICMPv6 in case no connection tracking is used 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@30727 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2012-02-25 21:00:23 +00:00
jow
0ccb4cc6a9 [package] firewall: bail out if uci is used in firewall include files 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@30694 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2012-02-23 18:50:47 +00:00
jow
9b433b090a [package] firewall: don't filter IPv4 ICMP types (#10928) 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@30363 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2012-02-07 18:35:48 +00:00
jow
57968b17ca [package] firewall: add support for "local" port forwards which target an internal address on the router itself 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@29687 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2012-01-08 15:29:24 +00:00
jow
15a81dae2a [package] firewall: 
- introduce per-section "option enabled" which defaults to "1" - useful to disable rules or zones without having to delete them
	- annotate default traffic rules with names
	- bump version


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@29577 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-12-20 01:10:15 +00:00
jow
f7ec5e7119 [package] firewall: add DHCPv6 default rule (#10381) 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@28874 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-11-09 11:10:37 +00:00
jow
41db87f4cc [package] firewall: relocate TCPMSS rules into mangle table, add code to selectively clear them out again 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@28669 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-10-29 18:02:45 +00:00
jow
cd1d712a7c [package] firewall: do not produce 0.0.0.0/0 if a symbolic masq_src or masq_dest is given but does not resolve to an ip 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@28628 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-10-27 18:14:55 +00:00
jow
45cb96ebda [package] firewall: prevent ip6tables -t nat rules (#10265) 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@28535 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-10-23 12:25:57 +00:00
jow
0244db9bf2 [package] firewall: fix another instance of unquoted "*" 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@28529 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-10-22 21:38:10 +00:00
jow
6ef496f17a [package] firewall: fix possible expansion of "*" when rules with "option src *" are processed 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@28527 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-10-22 20:11:25 +00:00
jow
570749fed1 [package] firewall: do not check for module availability, let iptables fail if a feature is not present (#7610) 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@28525 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-10-22 19:50:35 +00:00
jow
040047ef04 [package] firewall: make ESTABLISHED,RELATED rules match before INVALID, use conntrack instead of state match (#10038) 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@28148 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-09-01 20:37:22 +00:00
jow
f80fb45dc2 [package] firewall: further tune ICMPv6 default rules according to RFC4890 (#9893) 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27979 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-08-14 00:33:29 +00:00
jow
d572d07324 [package] firewall: prevent redundant rules if multiple ports and multiple icmp types are given in a rule block for both icmp and other protocols 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27792 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-07-26 22:21:39 +00:00
jow
7aabfee408 [package] firewall: fix serious bug in state var handling (#9746) 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27711 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-07-20 15:29:10 +00:00
jow
9b9c4a2430 [package] firewall: rework state variable handling, use uci_toggle_state() where applicable and properly handle duplicates in add and del state helpers (#9152, #9710) 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27618 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-07-15 15:03:57 +00:00
jow
fb73402d37 [package] firewall: make sure that -m mac is used with --mac-source, follow up to r27508 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27519 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-07-07 10:28:31 +00:00
cshore
80866b730c [package] firewall: also correct another variable missed in previous commit 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27508 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-07-07 08:59:40 +00:00
cshore
1dea2290d8 [package] firewall: fix wrong variable names for protocol command line parameter - were missed during r27500 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27507 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-07-07 08:54:29 +00:00
jow
0be37efeae [package] firewall: 
- solve scoping issues when multiple values are used, thanks Daniel Dickinson
	- ignore src_port/dest_port for proto icmp rules, ignore icmp_type for non-icmp rules
	- properly handle icmp when proto is given in numerical form (1, 58)
	- support negated icmp types


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27500 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-07-06 22:10:46 +00:00
cshore
c56955241e [package] firewall: fix udp rules for tcpudp proto rules using src_port and dest_port after modification by the parsing of the tcp rule 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27469 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-07-06 06:26:12 +00:00
jow
8a804d8a62 [package] firewall: fix port range quirk in previous commit 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27335 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-07-01 11:50:48 +00:00
jow
9179216cd8 [package] firewall: properly handle negated ports in nat reflection 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27334 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-07-01 11:48:14 +00:00
jow
86a3fe1a88 [package] firewall: refine default ICMPv6 rules to better conform with RFC4890, do not forward link local ICMP message types, allow parameter problem 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27321 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-06-30 12:22:05 +00:00
jow
e21fd93d0f [package] firewall: restore local port relocation ability from r26617 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27318 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-06-30 01:36:09 +00:00
jow
87281df903 [package] firewall: 
- allow multiple ports, protocols, macs, icmp types per rule
	- implement "limit" and "limit_burst" options for rules
	- implement "extra" option to rules and redirects for passing arbritary flags to iptables
	- implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options
	- allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination
	- validate symbolic icmp-type names against the selected iptables binary
	- properly handle forwarded ICMPv6 traffic in the default configuration


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27317 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-06-30 01:31:23 +00:00
jow
982ba349b6 [package] firewall: ensure that fw_get_subnet4() sets an empty value if no (valid) IPv4 addr was found 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27198 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-06-16 22:18:45 +00:00
jow
f19aa29f12 [package] firewall: allow symbolic names of interfaces and aliases in masq_src and masq_dest 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27196 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-06-16 21:54:59 +00:00
jow
4eff224df3 [package] firewall: explictely mention network in default configuration, makes it less confusing 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26961 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-05-20 13:45:40 +00:00
jow
864e3ef263 [package] firewall: revert accidential committed changes from r26805 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26806 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-05-02 12:55:36 +00:00
jow
667c11ec82 [PATCH] firewall: provide examples of ssh port relocation on firewall and IPsec passthrough 
Two examples of potentially useful configurations (commented out, of course):

(a) map the ssh service running on the firewall to 22001 externally, without modifying the configuration of the daemon itself. this allows port 22 on the WAN side to then be port-forwarded to a 
LAN-based machine if desired, or if not, simply obscures the port from external attack.

(b) allow IPsec/ESP and ISAKMP (UDP-based key exchange) to happen by default. useful for most modern VPN clients you might have on your WAN.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26805 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-05-02 12:54:31 +00:00
jow
8d0ec8922c [package] firewall: prevent excessive uci state data aggregation (#9152) 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26740 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-04-20 11:49:09 +00:00
jow
0874d00715 firewall: allow local redirection of ports 
Allow a redirect like:

config redirect
        option src 'wan'
        option dest 'lan'
        option src_dport '22001'
        option dest_port '22'
        option proto 'tcp'

note the absence of the "dest_ip" field, meaning to terminate the connection on the firewall itself.

This patch makes three changes:

(1) moves the conntrack module into the conntrack package (but not any of the conntrack_* helpers).
(2) fixes a bug where the wrong table is used when the "dest_ip" field is absent.
(3) accepts incoming connections on the destination port on the input_ZONE table, but only for DNATted
    connections.

In the above example,

ssh -p 22 root@myrouter

would fail from the outside, but:

ssh -p 22001 root@myrouter

would succeed.  This is handy if:

(1) you want to avoid ssh probes on your router, or
(2) you want to redirect incoming connections on port 22 to some machine inside your firewall, but
    still want to allow firewall access from outside.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26617 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-04-12 20:03:59 +00:00
jow
b12a3e34a3 [package] firewall: prevent duplicate values in interface state vars 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26382 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-03-30 20:29:17 +00:00
thepeople
d531cb04e9 Keep firewall.user during sysupgrades 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26241 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-03-20 00:57:47 +00:00
jow
a4666fa483 [package] firewall: move include sourcing into a subshell, this makes the firewall init immune against exit in the include scripts 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@25835 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-03-02 19:20:29 +00:00
jow
ba53471109 [package] firewall: fix rule generation for v4 or v6 only zones (#8955) 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@25813 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-03-01 18:04:14 +00:00
jow
8abaf1c3f4 [package] firewall: fix wrong rule order if multiple protocols are used 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@25179 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2011-01-27 22:19:53 +00:00
jow
b757185a71 [package] firewall: insert SNAT and DNAT rules according to the order of the configuration file (#8052) 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23318 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2010-10-08 12:11:55 +00:00
jow
b592e5c373 [package] firewall: also establish forward rules when setting up nat reflection, back out early if reflection is disabled 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23201 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2010-10-03 18:11:59 +00:00
jow
43c3b75619 [package] firewall: fix chain selection logic, option dest must be ignored for notrack targets 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23143 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2010-09-28 11:38:31 +00:00
jow
889cf1f8c3 [package] firewall: don't setup nat reflection if negations are used 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23142 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2010-09-28 11:11:11 +00:00
jow
1efeaa35d1 [package] fireall: 
- support negations for src_ip, dest_ip, src_dip options in rules and redirects
	- add NOTRACK target to rule sections, allows to define fine grained notrack rules


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23141 3c298f89-4303-0410-b956-a3cf2f4a3e73
 2010-09-28 10:42:56 +00:00