1
0
mirror of git://projects.qi-hardware.com/openwrt-xburst.git synced 2024-12-12 00:37:09 +02:00
Commit Graph

14 Commits

Author SHA1 Message Date
jow
d572d07324 [package] firewall: prevent redundant rules if multiple ports and multiple icmp types are given in a rule block for both icmp and other protocols
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27792 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-07-26 22:21:39 +00:00
jow
0be37efeae [package] firewall:
- solve scoping issues when multiple values are used, thanks Daniel Dickinson
	- ignore src_port/dest_port for proto icmp rules, ignore icmp_type for non-icmp rules
	- properly handle icmp when proto is given in numerical form (1, 58)
	- support negated icmp types


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27500 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-07-06 22:10:46 +00:00
cshore
c56955241e [package] firewall: fix udp rules for tcpudp proto rules using src_port and dest_port after modification by the parsing of the tcp rule
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27469 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-07-06 06:26:12 +00:00
jow
87281df903 [package] firewall:
- allow multiple ports, protocols, macs, icmp types per rule
	- implement "limit" and "limit_burst" options for rules
	- implement "extra" option to rules and redirects for passing arbritary flags to iptables
	- implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options
	- allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination
	- validate symbolic icmp-type names against the selected iptables binary
	- properly handle forwarded ICMPv6 traffic in the default configuration


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27317 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-06-30 01:31:23 +00:00
jow
8abaf1c3f4 [package] firewall: fix wrong rule order if multiple protocols are used
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@25179 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-01-27 22:19:53 +00:00
jow
b757185a71 [package] firewall: insert SNAT and DNAT rules according to the order of the configuration file (#8052)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23318 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-10-08 12:11:55 +00:00
jow
43c3b75619 [package] firewall: fix chain selection logic, option dest must be ignored for notrack targets
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23143 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-09-28 11:38:31 +00:00
jow
1efeaa35d1 [package] fireall:
- support negations for src_ip, dest_ip, src_dip options in rules and redirects
	- add NOTRACK target to rule sections, allows to define fine grained notrack rules


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23141 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-09-28 10:42:56 +00:00
jow
c653713313 [package] firewall:
- simplify masquerade rule setup
	- remove various subshell invocations
	- speedup fw() by not relying on xargs and pipes
	- rework SNAT support - attach to dest zone, use src_dip/src_dport as snat source


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23024 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-09-11 20:04:34 +00:00
jow
2c25f7e70c [package] firewall: Initial alias interface support. This allows to define zones covering alias interfaces and associated entries like rules and forwardings.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21653 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-06-01 21:58:48 +00:00
jow
90b818e4a5 [package] firewall: fix support for netranges in redirect and rule sections
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21640 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-05-30 23:49:47 +00:00
jow
81279ca0f1 [package] firewall: count rules per chain and family, fix wrong order of ip6tables rules when ipv4 only or dual family rules are defined
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21533 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-05-22 02:01:19 +00:00
jow
24931686cd [package] firewall:
- fix ip6tables rules when icmp_type option is set
	- add "family" option to zones, forwardings, redirects and rules to selectively apply rules to iptables and/or ip6tables


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21508 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-05-19 21:35:23 +00:00
jow
e8be3016c9 [package] firewall:
- replace uci firewall with a modular dual stack implementation	developed by Malte S. Stretz
	- bump version to 2


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21286 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-05-01 18:22:01 +00:00