1
0
mirror of git://projects.qi-hardware.com/openwrt-xburst.git synced 2024-12-12 07:32:48 +02:00
Commit Graph

15 Commits

Author SHA1 Message Date
jow
864e3ef263 [package] firewall: revert accidential committed changes from r26805
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26806 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-05-02 12:55:36 +00:00
jow
667c11ec82 [PATCH] firewall: provide examples of ssh port relocation on firewall and IPsec passthrough
Two examples of potentially useful configurations (commented out, of course):

(a) map the ssh service running on the firewall to 22001 externally, without modifying the configuration of the daemon itself. this allows port 22 on the WAN side to then be port-forwarded to a 
LAN-based machine if desired, or if not, simply obscures the port from external attack.

(b) allow IPsec/ESP and ISAKMP (UDP-based key exchange) to happen by default. useful for most modern VPN clients you might have on your WAN.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26805 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-05-02 12:54:31 +00:00
jow
8d0ec8922c [package] firewall: prevent excessive uci state data aggregation (#9152)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26740 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-04-20 11:49:09 +00:00
jow
b12a3e34a3 [package] firewall: prevent duplicate values in interface state vars
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26382 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-03-30 20:29:17 +00:00
jow
ba53471109 [package] firewall: fix rule generation for v4 or v6 only zones (#8955)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@25813 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-03-01 18:04:14 +00:00
jow
3d98699ef3 [package] firewall: protect iptables invocations with locks in interface ops, it might run concurrently due to hotplug invocations on network restart
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23090 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-09-19 15:01:47 +00:00
jow
ac32f8a93b [package] firewall: deliver remove hotplug events for all active zones/networks when restarting the firewall
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23062 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-09-14 23:11:12 +00:00
jow
c653713313 [package] firewall:
- simplify masquerade rule setup
	- remove various subshell invocations
	- speedup fw() by not relying on xargs and pipes
	- rework SNAT support - attach to dest zone, use src_dip/src_dport as snat source


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23024 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-09-11 20:04:34 +00:00
jow
291f78f21a [package] firewall:
- handle NAT reflection in firewall hotplug, solves synchronizing issues on boot
	- introduce masq_src and masq_dest options to limit zone masq to specific ip ranges, supports multiple subnets and negation


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22888 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-09-04 15:49:13 +00:00
jow
94c817eadb [package] firewall:
- fix processing of rules with an ip family option
	- append interface rules at the end of internal zone chains, simplifies injecting user or addon rules
	- support simple file logging (option log + option log_limit per zone)


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22847 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-08-31 01:54:08 +00:00
jow
3b07b2b809 [package] firewall:
- support alias ifnames different from parent ifname
	- properly handle multiple subnets per alias (v4+v6)


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21656 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-06-02 00:59:35 +00:00
jow
2c25f7e70c [package] firewall: Initial alias interface support. This allows to define zones covering alias interfaces and associated entries like rules and forwardings.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21653 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-06-01 21:58:48 +00:00
jow
24931686cd [package] firewall:
- fix ip6tables rules when icmp_type option is set
	- add "family" option to zones, forwardings, redirects and rules to selectively apply rules to iptables and/or ip6tables


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21508 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-05-19 21:35:23 +00:00
jow
389232eaac [package] firewall (#7355)
- partially revert r21486, start firewall on init again
	- skip iface hotplug events if base fw is not up yet
	- get ifname and up state with uci_get_state() in iface setup
	  since the values gathered by scan_interfaces() may be outdated
	  when iface coldplugging happens (observed with pptp)
	- ignore up state when bringing down interfaces because ifdown
	  reverts state vars before dispatching the iface event
	- bump package revision


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21502 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-05-19 00:50:14 +00:00
jow
e8be3016c9 [package] firewall:
- replace uci firewall with a modular dual stack implementation	developed by Malte S. Stretz
	- bump version to 2


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21286 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-05-01 18:22:01 +00:00