html/cgi-bin/firewall.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2013 Alexander Marx <amarx@ipfire.org>                        #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 use strict;
  23 use Sort::Naturally;
  24 use utf8;
  25 use feature 'unicode_strings';
  26 use experimental 'smartmatch';
  27
  28 no warnings 'uninitialized';
  29
  30 # enable only the following on debugging purpose
  31 #use warnings;
  32 #use CGI::Carp 'fatalsToBrowser';
  33
  34 require '/var/ipfire/general-functions.pl';
  35 require '/var/ipfire/network-functions.pl';
  36 require "${General::swroot}/lang.pl";
  37 require "${General::swroot}/header.pl";
  38 require "${General::swroot}/location-functions.pl";
  39 require "/usr/lib/firewall/firewall-lib.pl";
  40
  41 unless (-d "${General::swroot}/firewall")                       { &General::system("mkdir", "${General::swroot}/firewall"); }
  42 unless (-e "${General::swroot}/firewall/settings")      { &General::system("touch", "${General::swroot}/firewall/settings"); }
  43 unless (-e "${General::swroot}/firewall/config")        { &General::system("touch", "${General::swroot}/firewall/config"); }
  44 unless (-e "${General::swroot}/firewall/input")         { &General::system("touch", "${General::swroot}/firewall/input"); }
  45 unless (-e "${General::swroot}/firewall/outgoing")      { &General::system("touch", "${General::swroot}/firewall/outgoing"); }
  46
  47 my %fwdfwsettings=();
  48 my %selected=() ;
  49 my %defaultNetworks=();
  50 my %netsettings=();
  51 my %customhost=();
  52 my %customgrp=();
  53 my %customlocationgrp=();
  54 my %customnetworks=();
  55 my %customservice=();
  56 my %customservicegrp=();
  57 my %ccdnet=();
  58 my %customnetwork=();
  59 my %ccdhost=();
  60 my %configfwdfw=();
  61 my %configinputfw=();
  62 my %configoutgoingfw=();
  63 my %ipsecconf=();
  64 my %color=();
  65 my %mainsettings=();
  66 my %checked=();
  67 my %icmptypes=();
  68 my %ovpnsettings=();
  69 my %ipsecsettings=();
  70 my %aliases=();
  71 my %optionsfw=();
  72 my %ifaces=();
  73 my %rulehash=();
  74
  75 my @PROTOCOLS = ("TCP", "UDP", "ICMP", "IGMP", "AH", "ESP", "GRE","IPv6","IPIP");
  76
  77 my $color;
  78 my $confignet           = "${General::swroot}/fwhosts/customnetworks";
  79 my $confighost          = "${General::swroot}/fwhosts/customhosts";
  80 my $configgrp           = "${General::swroot}/fwhosts/customgroups";
  81 my $configlocationgrp   = "${General::swroot}/fwhosts/customlocationgrp";
  82 my $configsrv           = "${General::swroot}/fwhosts/customservices";
  83 my $configsrvgrp        = "${General::swroot}/fwhosts/customservicegrp";
  84 my $configccdnet        = "${General::swroot}/ovpn/ccd.conf";
  85 my $configccdhost       = "${General::swroot}/ovpn/ovpnconfig";
  86 my $configipsec         = "${General::swroot}/vpn/config";
  87 my $configipsecrw       = "${General::swroot}/vpn/settings";
  88 my $configfwdfw         = "${General::swroot}/firewall/config";
  89 my $configinput         = "${General::swroot}/firewall/input";
  90 my $configoutgoing      = "${General::swroot}/firewall/outgoing";
  91 my $configovpn          = "${General::swroot}/ovpn/settings";
  92 my $fwoptions           = "${General::swroot}/optionsfw/settings";
  93 my $ifacesettings       = "${General::swroot}/ethernet/settings";
  94 my $errormessage='';
  95 my $hint='';
  96 my $ipgrp="${General::swroot}/outgoing/groups";
  97 my $tdcolor='';
  98 my $checkorange='';
  99 my @protocols;
 100 &General::readhash("${General::swroot}/firewall/settings", \%fwdfwsettings);
 101 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
 102 &General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);
 103 &General::readhash($fwoptions, \%optionsfw);
 104 &General::readhash($ifacesettings, \%ifaces);
 105 &General::readhash("$configovpn", \%ovpnsettings);
 106 &General::readhash("$configipsecrw", \%ipsecsettings);
 107 &General::readhasharray("$configipsec", \%ipsecconf);
 108 &Header::showhttpheaders();
 109 &Header::getcgihash(\%fwdfwsettings);
 110 &Header::openpage($Lang::tr{'firewall rules'}, 1, '');
 111 &Header::openbigbox('100%', 'center',$errormessage);
 112 #### JAVA SCRIPT ####
 113 print<<END;
 114 <script>
 115         var PROTOCOLS_WITH_PORTS = ["TCP", "UDP"];
 116
 117         var update_protocol = function() {
 118                 var protocol = \$("#protocol").val();
 119
 120                 if (protocol === undefined)
 121                         return;
 122
 123                 // Check if a template is/should be used.
 124                 if (protocol === "template") {
 125                         \$("#PROTOCOL_TEMPLATE").show();
 126                 } else {
 127                         \$("#PROTOCOL_TEMPLATE").hide();
 128                 }
 129
 130                 // Check if we are dealing with a protocol, that knows ports.
 131                 if (\$.inArray(protocol, PROTOCOLS_WITH_PORTS) >= 0) {
 132                         \$("#PROTOCOL_PORTS").show();
 133                 } else {
 134                         \$("#PROTOCOL_PORTS").hide();
 135                 }
 136
 137                 // Handle ICMP.
 138                 if (protocol === "ICMP") {
 139                         \$("#PROTOCOL_ICMP_TYPES").show();
 140                 } else {
 141                         \$("#PROTOCOL_ICMP_TYPES").hide();
 142                 }
 143         };
 144
 145         \$(document).ready(function() {
 146                 \$("#protocol").change(update_protocol);
 147                 update_protocol();
 148
 149                 // Show/Hide elements when NAT checkbox is checked.
 150                 if (\$("#USE_NAT").attr("checked")) {
 151                         \$("#actions").hide();
 152                 } else {
 153                         \$(".NAT").hide();
 154                 }
 155
 156                 // Show NAT area when "use nat" checkbox is clicked
 157                 \$("#USE_NAT").change(function() {
 158                         \$(".NAT").toggle();
 159                         \$("#actions").toggle();
 160                 });
 161
 162                 // Hide SNAT items when DNAT is selected and vice versa.
 163                 if (\$('input[name=nat]:checked').val() == 'dnat') {
 164                         \$('.snat').hide();
 165                 } else {
 166                         \$('.dnat').hide();
 167                 }
 168
 169                 // Show/Hide elements when SNAT/DNAT get changed.
 170                 \$('input[name=nat]').change(function() {
 171                         \$('.snat').toggle();
 172                         \$('.dnat').toggle();
 173                 });
 174
 175                 // Time constraints
 176                 if(!\$("#USE_TIME_CONSTRAINTS").attr("checked")) {
 177                         \$("#TIME_CONSTRAINTS").hide();
 178                 }
 179                 \$("#USE_TIME_CONSTRAINTS").change(function() {
 180                         \$("#TIME_CONSTRAINTS").toggle();
 181                 });
 182
 183                 // Limit concurrent connections per ip
 184                 if(!\$("#USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP").attr("checked")) {
 185                         \$("#LIMIT_CON").hide();
 186                 }
 187                 \$("#USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP").change(function() {
 188                         \$("#LIMIT_CON").toggle();
 189                 });
 190
 191                 // Rate-limit new connections
 192                 if(!\$("#USE_RATELIMIT").attr("checked")) {
 193                         \$("#RATELIMIT").hide();
 194                 }
 195                 \$("#USE_RATELIMIT").change(function() {
 196                         \$("#RATELIMIT").toggle();
 197                 });
 198
 199                 // Automatically select radio buttons when corresponding
 200                 // dropdown menu changes.
 201                 \$("select").change(function() {
 202                         var id = \$(this).attr("name");
 203                         \$('#' + id).prop("checked", true);
 204                 });
 205         });
 206 </script>
 207 END
 208
 209 ####  ACTION  #####
 210
 211 if ($fwdfwsettings{'ACTION'} eq 'saverule')
 212 {
 213         &General::readhasharray("$configfwdfw", \%configfwdfw);
 214         &General::readhasharray("$configinput", \%configinputfw);
 215         &General::readhasharray("$configoutgoing", \%configoutgoingfw);
 216         my $maxkey;
 217         #Set Variables according to the JQuery code in protocol section
 218         if ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP')
 219         {
 220                 if ($fwdfwsettings{'SRC_PORT'} ne '')
 221                 {
 222                         $fwdfwsettings{'USE_SRC_PORT'} = 'ON';
 223                 }
 224                 if ($fwdfwsettings{'TGT_PORT'} ne '')
 225                 {
 226                         $fwdfwsettings{'USESRV'} = 'ON';
 227                         $fwdfwsettings{'grp3'} = 'TGT_PORT';
 228                 }
 229         }
 230         if ($fwdfwsettings{'PROT'} eq 'template')
 231         {
 232                 $fwdfwsettings{'USESRV'} = 'ON';
 233         }
 234         $errormessage=&checksource;
 235         if(!$errormessage){&checktarget;}
 236         if(!$errormessage){&checkrule;}
 237
 238         #check if manual ip (source) is orange network
 239         if ($fwdfwsettings{'grp1'} eq 'src_addr'){
 240                 my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
 241                 if ( &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
 242                         $checkorange='on';
 243                 }
 244         }
 245         #check if we try to break rules
 246         if(     $fwdfwsettings{'grp1'} eq 'ipfire_src' && $fwdfwsettings{'grp2'} eq 'ipfire'){
 247                 $errormessage=$Lang::tr{'fwdfw err same'};
 248         }
 249         # INPUT part
 250         if ($fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ORANGE'){
 251                 $fwdfwsettings{'config'}=$configinput;
 252                 $fwdfwsettings{'chain'} = 'INPUTFW';
 253                 $maxkey=&General::findhasharraykey(\%configinputfw);
 254                 %rulehash=%configinputfw;
 255         }elsif ($fwdfwsettings{'grp1'} eq 'ipfire_src' ){
 256         # OUTGOING PART
 257                 $fwdfwsettings{'config'}=$configoutgoing;
 258                 $fwdfwsettings{'chain'} = 'OUTGOINGFW';
 259                 $maxkey=&General::findhasharraykey(\%configoutgoingfw);
 260                 %rulehash=%configoutgoingfw;
 261         }else {
 262         # FORWARD PART
 263                 $fwdfwsettings{'config'}=$configfwdfw;
 264                 $fwdfwsettings{'chain'} = 'FORWARDFW';
 265                 $maxkey=&General::findhasharraykey(\%configfwdfw);
 266                 %rulehash=%configfwdfw;
 267         }
 268         #check if we have an identical rule already
 269         if($fwdfwsettings{'oldrulenumber'} eq $fwdfwsettings{'rulepos'}){
 270                 foreach my $key (sort keys %rulehash){
 271                         if (   "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'ruleremark'},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'},$fwdfwsettings{'LIMIT_CON_CON'},$fwdfwsettings{'concon'},$fwdfwsettings{'RATE_LIMIT'},$fwdfwsettings{'ratecon'},$fwdfwsettings{'RATETIME'}"
 272                                 eq "$rulehash{$key}[0],$rulehash{$key}[2],$rulehash{$key}[3],$rulehash{$key}[4],$rulehash{$key}[5],$rulehash{$key}[6],$rulehash{$key}[7],$rulehash{$key}[8],$rulehash{$key}[9],$rulehash{$key}[10],$rulehash{$key}[11],$rulehash{$key}[12],$rulehash{$key}[13],$rulehash{$key}[14],$rulehash{$key}[15],$rulehash{$key}[16],$rulehash{$key}[17],$rulehash{$key}[18],$rulehash{$key}[19],$rulehash{$key}[20],$rulehash{$key}[21],$rulehash{$key}[22],$rulehash{$key}[23],$rulehash{$key}[24],$rulehash{$key}[25],$rulehash{$key}[26],$rulehash{$key}[27],$rulehash{$key}[28],$rulehash{$key}[29],$rulehash{$key}[30],$rulehash{$key}[31],$rulehash{$key}[32],$rulehash{$key}[33],$rulehash{$key}[34],$rulehash{$key}[35],$rulehash{$key}[36]"){
 273                                         $errormessage.=$Lang::tr{'fwdfw err ruleexists'};
 274                                         if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){
 275                                                 $errormessage=$Lang::tr{'fwdfw err remark'}."<br>";
 276                                         }
 277                                         if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && &validremark($fwdfwsettings{'ruleremark'})){
 278                                                 $errormessage='';
 279                                         }
 280                                         if ($fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'}){
 281                                                 $fwdfwsettings{'nosave'} = 'on';
 282                                         }
 283                         }
 284                 }
 285         }
 286         #check Rulepos on new Rule
 287         if($fwdfwsettings{'rulepos'} > 0 && !$fwdfwsettings{'oldrulenumber'}){
 288                 $fwdfwsettings{'oldrulenumber'}=$maxkey;
 289                 foreach my $key (sort keys %rulehash){
 290                         if (   "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'},$fwdfwsettings{'LIMIT_CON_CON'},$fwdfwsettings{'concon'},$fwdfwsettings{'RATE_LIMIT'},$fwdfwsettings{'ratecon'},$fwdfwsettings{'RATETIME'}"
 291                                 eq "$rulehash{$key}[0],$rulehash{$key}[2],$rulehash{$key}[3],$rulehash{$key}[4],$rulehash{$key}[5],$rulehash{$key}[6],$rulehash{$key}[7],$rulehash{$key}[8],$rulehash{$key}[9],$rulehash{$key}[10],$rulehash{$key}[11],$rulehash{$key}[12],$rulehash{$key}[13],$rulehash{$key}[14],$rulehash{$key}[15],$rulehash{$key}[18],$rulehash{$key}[19],$rulehash{$key}[20],$rulehash{$key}[21],$rulehash{$key}[22],$rulehash{$key}[23],$rulehash{$key}[24],$rulehash{$key}[25],$rulehash{$key}[26],$rulehash{$key}[27],$rulehash{$key}[28],$rulehash{$key}[29],$rulehash{$key}[30],$rulehash{$key}[31],$rulehash{$key}[32],$rulehash{$key}[33],$rulehash{$key}[34],$rulehash{$key}[35],$rulehash{$key}[36]"){
 292                                         $errormessage.=$Lang::tr{'fwdfw err ruleexists'};
 293                         }
 294                 }
 295         }
 296         #check if we just close a rule
 297         if( $fwdfwsettings{'oldgrp1a'} eq  $fwdfwsettings{'grp1'} && $fwdfwsettings{'oldgrp1b'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'oldgrp2a'} eq  $fwdfwsettings{'grp2'} && $fwdfwsettings{'oldgrp2b'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} &&  $fwdfwsettings{'oldgrp3a'} eq $fwdfwsettings{'grp3'} && $fwdfwsettings{'oldgrp3b'} eq  $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'oldruletype'} eq $fwdfwsettings{'chain'}){
 298                 if($fwdfwsettings{'nosave'} eq 'on' && $fwdfwsettings{'updatefwrule'} eq 'on'){
 299                         $fwdfwsettings{'nosave2'} = 'on';
 300                         $errormessage='';
 301                 }
 302         }
 303         #check max concurrent connections per ip address
 304         if ($fwdfwsettings{'LIMIT_CON_CON'} eq 'ON'){
 305                 if (!($fwdfwsettings{'concon'} =~ /^(\d+)$/)) {
 306                         $errormessage.=$Lang::tr{'fwdfw err concon'};
 307                 }
 308         }else{
 309                 $fwdfwsettings{'concon'}='';
 310         }
 311         #check ratelimit value
 312         if ($fwdfwsettings{'RATE_LIMIT'} eq 'ON'){
 313                 if (!($fwdfwsettings{'ratecon'} =~ /^(\d+)$/)) {
 314                         $errormessage.=$Lang::tr{'fwdfw err ratecon'};
 315                 }
 316         }else{
 317                 $fwdfwsettings{'ratecon'}='';
 318         }
 319         #increase counters
 320         if (!$errormessage){
 321                 if ($fwdfwsettings{'nosave2'} ne 'on'){
 322                         &saverule(\%rulehash,$fwdfwsettings{'config'});
 323                 }
 324         }
 325         if ($errormessage){
 326                 &newrule;
 327         }else{
 328                 if($fwdfwsettings{'nosave2'} ne 'on'){
 329                         &General::firewall_config_changed();
 330                 }
 331                 &base;
 332         }
 333 }
 334 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw newrule'})
 335 {
 336         &newrule;
 337 }
 338 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw toggle'})
 339 {
 340         my %togglehash=();
 341         &General::readhasharray($fwdfwsettings{'config'}, \%togglehash);
 342         foreach my $key (sort keys %togglehash){
 343                 if ($key eq $fwdfwsettings{'key'}){
 344                         if ($togglehash{$key}[2] eq 'ON'){$togglehash{$key}[2]='';}else{$togglehash{$key}[2]='ON';}
 345                 }
 346         }
 347         &General::writehasharray($fwdfwsettings{'config'}, \%togglehash);
 348         &General::firewall_config_changed();
 349         &base;
 350 }
 351 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw togglelog'})
 352 {
 353         my %togglehash=();
 354         &General::readhasharray($fwdfwsettings{'config'}, \%togglehash);
 355         foreach my $key (sort keys %togglehash){
 356                 if ($key eq $fwdfwsettings{'key'}){
 357                         if ($togglehash{$key}[17] eq 'ON'){$togglehash{$key}[17]='';}else{$togglehash{$key}[17]='ON';}
 358                 }
 359         }
 360         &General::writehasharray($fwdfwsettings{'config'}, \%togglehash);
 361         &General::firewall_config_changed();
 362         &base;
 363 }
 364 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw reread'})
 365 {
 366         &General::firewall_reload();
 367         &base;
 368 }
 369 if ($fwdfwsettings{'ACTION'} eq 'editrule')
 370 {
 371         $fwdfwsettings{'updatefwrule'}='on';
 372         &newrule;
 373 }
 374 if ($fwdfwsettings{'ACTION'} eq 'deleterule')
 375 {
 376         &deleterule;
 377 }
 378 if ($fwdfwsettings{'ACTION'} eq 'moveup')
 379 {
 380         &pos_up;
 381         &base;
 382 }
 383 if ($fwdfwsettings{'ACTION'} eq 'movedown')
 384 {
 385         &pos_down;
 386         &base;
 387 }
 388 if ($fwdfwsettings{'ACTION'} eq 'copyrule')
 389 {
 390         $fwdfwsettings{'copyfwrule'}='on';
 391         &newrule;
 392 }
 393 if ($fwdfwsettings{'ACTION'} eq '' or $fwdfwsettings{'ACTION'} eq 'reset')
 394 {
 395         &base;
 396 }
 397 ###  Functions  ####
 398 sub addrule
 399 {
 400         &error;
 401
 402         &Header::openbox('100%', 'left', "");
 403         print <<END;
 404                 <form method="POST" action="">
 405                         <table border='0' width="100%">
 406                                 <tr>
 407                                         <td align='center'>
 408                                                 <input type='submit' name='ACTION' value='$Lang::tr{'fwdfw newrule'}'>
 409 END
 410
 411         if (&General::firewall_needs_reload()) {
 412                 print <<END;
 413                         <input type='submit' name='ACTION' value='$Lang::tr{'fwdfw reread'}' style='font-weight: bold; color: green;'>
 414 END
 415         }
 416
 417         print <<END;
 418                                         </td>
 419                                 </tr>
 420                         </table>
 421                 </form>
 422
 423                 <br>
 424 END
 425
 426         &Header::closebox();
 427         &viewtablerule;
 428 }
 429 sub base
 430 {
 431         &hint;
 432         &addrule;
 433 }
 434 sub changerule
 435 {
 436         my $oldchain=shift;
 437         $fwdfwsettings{'updatefwrule'}='';
 438         $fwdfwsettings{'config'}=$oldchain;
 439         $fwdfwsettings{'nobase'}='on';
 440         &deleterule;
 441 }
 442 sub checksource
 443 {
 444         my ($ip,$subnet);
 445         #check ip-address if manual
 446         if ($fwdfwsettings{'src_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'src_addr'} ne ''){
 447                 #check if ip with subnet
 448                 if ($fwdfwsettings{'src_addr'} =~ /^(.*?)\/(.*?)$/) {
 449                         ($ip,$subnet)=split (/\//,$fwdfwsettings{'src_addr'});
 450                         $subnet = &General::iporsubtocidr($subnet);
 451                         $fwdfwsettings{'isip'}='on';
 452                 }
 453                 #check if only ip
 454                 if($fwdfwsettings{'src_addr'}=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/){
 455                         $ip=$fwdfwsettings{'src_addr'};
 456                         $subnet = '32';
 457                         $fwdfwsettings{'isip'}='on';
 458                 }
 459
 460                 if ($fwdfwsettings{'isip'} ne 'on'){
 461                         if (&General::validmac($fwdfwsettings{'src_addr'})){
 462                                 $fwdfwsettings{'ismac'}='on';
 463                         }
 464                 }
 465                 if ($fwdfwsettings{'isip'} eq 'on'){
 466                         #remove leading zero
 467                         $ip = &Network::ip_remove_zero($ip);
 468
 469                         ##check if ip is valid
 470                         if (! &General::validip($ip)){
 471                                 $errormessage.=$Lang::tr{'fwdfw err src_addr'}."<br>";
 472                                 return $errormessage;
 473                         }
 474                         #check and form valid IP
 475                         $ip=&General::ip2dec($ip);
 476                         $ip=&General::dec2ip($ip);
 477                         #check if net or broadcast
 478                         $fwdfwsettings{'src_addr'}="$ip/$subnet";
 479                         if(!&General::validipandmask($fwdfwsettings{'src_addr'})){
 480                                 $errormessage.=$Lang::tr{'fwdfw err src_addr'}."<br>";
 481                                 return $errormessage;
 482                         }
 483                 }
 484                 if ($fwdfwsettings{'isip'} ne 'on' && $fwdfwsettings{'ismac'} ne 'on'){
 485                         $errormessage.=$Lang::tr{'fwdfw err src_addr'}."<br>";
 486                         return $errormessage;
 487                 }
 488         }elsif($fwdfwsettings{'src_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'src_addr'} eq ''){
 489                 $fwdfwsettings{'grp1'}='std_net_src';
 490                 $fwdfwsettings{$fwdfwsettings{'grp1'}} = 'ALL';
 491         }
 492
 493         #check empty fields
 494         if ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq ''){ $errormessage.=$Lang::tr{'fwdfw err nosrc'}."<br>";}
 495         if($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP') && $fwdfwsettings{'SRC_PORT'} ne ''){
 496                 my @parts=split(",",$fwdfwsettings{'SRC_PORT'});
 497                 my @values=();
 498                 foreach (@parts){
 499                         chomp($_);
 500                         if ($_ =~ /^(\d+)\-(\d+)$/ || $_ =~ /^(\d+)\:(\d+)$/) {
 501                                 my $check;
 502                                 #change dashes with :
 503                                 $_=~ tr/-/:/;
 504                                 if ($_ eq "*") {
 505                                         push(@values,"1:65535");
 506                                         $check='on';
 507                                 }
 508                                 if ($_ =~ /^(\D)\:(\d+)$/ || $_ =~ /^(\D)\-(\d+)$/) {
 509                                         push(@values,"1:$2");
 510                                         $check='on';
 511                                 }
 512                                 if ($_ =~ /^(\d+)\:(\D)$/ || $_ =~ /^(\d+)\-(\D)$/ ) {
 513                                         push(@values,"$1:65535");
 514                                         $check='on'
 515                                 }
 516                                 $errormessage .= &General::validportrange($_, 'destination');
 517                                 if(!$check){
 518                                         push (@values,$_);
 519                                 }
 520                         }else{
 521                                 if (&General::validport($_)){
 522                                         push (@values,$_);
 523                                 }else{
 524
 525                                 }
 526                         }
 527                 }
 528                 $fwdfwsettings{'SRC_PORT'}=join("|",@values);
 529         }
 530         return $errormessage;
 531 }
 532 sub checktarget
 533 {
 534         my ($ip,$subnet);
 535         &General::readhasharray("$configsrv", \%customservice);
 536         #check DNAT settings (has to be single Host and single Port or portrange)
 537         if ($fwdfwsettings{'USE_NAT'} eq 'ON' && $fwdfwsettings{'nat'} eq 'dnat'){
 538                 if($fwdfwsettings{'grp2'} eq 'tgt_addr' || $fwdfwsettings{'grp2'} eq 'cust_host_tgt' || $fwdfwsettings{'grp2'} eq 'ovpn_host_tgt'){
 539                         #check if Port is a single Port or portrange
 540                         if ($fwdfwsettings{'nat'} eq 'dnat' &&  $fwdfwsettings{'grp3'} eq 'TGT_PORT'){
 541                                 if(($fwdfwsettings{'PROT'} ne 'TCP'|| $fwdfwsettings{'PROT'} ne 'UDP') && $fwdfwsettings{'TGT_PORT'} eq ''){
 542                                         $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 543                                         return $errormessage;
 544                                 }
 545                                 if (($fwdfwsettings{'PROT'} eq 'TCP'|| $fwdfwsettings{'PROT'} eq 'UDP') && $fwdfwsettings{'TGT_PORT'} ne '' && !&check_natport($fwdfwsettings{'TGT_PORT'})){
 546                                         $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 547                                         return $errormessage;
 548                                 }
 549                         }
 550                 }else{
 551                         if ($fwdfwsettings{'grp2'} ne 'ipfire'){
 552                                 $errormessage=$Lang::tr{'fwdfw dnat error'}."<br>";
 553                                 return $errormessage;
 554                         }
 555                 }
 556         }
 557         if ($fwdfwsettings{'tgt_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'tgt_addr'} ne ''){
 558                 #check if ip with subnet
 559                 if ($fwdfwsettings{'tgt_addr'} =~ /^(.*?)\/(.*?)$/) {
 560                         ($ip,$subnet)=split (/\//,$fwdfwsettings{'tgt_addr'});
 561                         $subnet = &General::iporsubtocidr($subnet);
 562                 }
 563
 564                 #check if only ip
 565                 if($fwdfwsettings{'tgt_addr'}=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/){
 566                         $ip=$fwdfwsettings{'tgt_addr'};
 567                         $subnet='32';
 568                 }
 569                 #remove leading zero
 570                 $ip = &Network::ip_remove_zero($ip);
 571
 572                 #check if ip is valid
 573                 if (! &General::validip($ip)){
 574                         $errormessage.=$Lang::tr{'fwdfw err tgt_addr'}."<br>";
 575                         return $errormessage;
 576                 }
 577                 #check and form valid IP
 578                 $ip=&General::ip2dec($ip);
 579                 $ip=&General::dec2ip($ip);
 580                 $fwdfwsettings{'tgt_addr'}="$ip/$subnet";
 581                 if(!&General::validipandmask($fwdfwsettings{'tgt_addr'})){
 582                         $errormessage.=$Lang::tr{'fwdfw err tgt_addr'}."<br>";
 583                         return $errormessage;
 584                 }
 585         }elsif($fwdfwsettings{'tgt_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'tgt_addr'} eq ''){
 586                 $fwdfwsettings{'grp2'}='std_net_tgt';
 587                 $fwdfwsettings{$fwdfwsettings{'grp2'}} = 'ALL';
 588         }
 589         #check for mac in targetgroup
 590         if ($fwdfwsettings{'grp2'} eq 'cust_grp_tgt'){
 591                 &General::readhasharray("$configgrp", \%customgrp);
 592                 &General::readhasharray("$confighost", \%customhost);
 593                 foreach my $grpkey (sort keys %customgrp){
 594                         foreach my $hostkey (sort keys %customhost){
 595                                 if ($customgrp{$grpkey}[2] eq $customhost{$hostkey}[0] && $customgrp{$grpkey}[2] eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $customhost{$hostkey}[1] eq 'mac'){
 596                                         $hint=$Lang::tr{'fwdfw hint mac'};
 597                                         return $hint;
 598                                 }
 599                         }
 600                 }
 601         }
 602         #check empty fields
 603         if ($fwdfwsettings{$fwdfwsettings{'grp2'}} eq ''){ $errormessage.=$Lang::tr{'fwdfw err notgt'}."<br>";}
 604         #check tgt services
 605         if ($fwdfwsettings{'USESRV'} eq 'ON'){
 606                 if ($fwdfwsettings{'grp3'} eq 'cust_srv'){
 607                         $fwdfwsettings{'TGT_PROT'}='';
 608                         $fwdfwsettings{'ICMP_TGT'}='';
 609                         $fwdfwsettings{'TGT_PORT'}='';
 610                 }
 611                 if ($fwdfwsettings{'grp3'} eq 'cust_srvgrp'){
 612                         $fwdfwsettings{'TGT_PROT'}='';
 613                         $fwdfwsettings{'ICMP_TGT'}='';
 614                         $fwdfwsettings{'TGT_PORT'}='';
 615                         #check target service
 616                         if($fwdfwsettings{$fwdfwsettings{'grp3'}} eq ''){
 617                                 $errormessage.=$Lang::tr{'fwdfw err tgt_grp'};
 618                         }
 619                 }
 620                 if ($fwdfwsettings{'grp3'} eq 'TGT_PORT'){
 621                         if ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP'){
 622                                 if ($fwdfwsettings{'TGT_PORT'} ne ''){
 623                                         if ($fwdfwsettings{'TGT_PORT'} =~ "," && $fwdfwsettings{'USE_NAT'} && $fwdfwsettings{'nat'} eq 'dnat') {
 624                                                 $errormessage=$Lang::tr{'fwdfw dnat porterr'}."<br>";
 625                                                 return $errormessage;
 626                                         }
 627                                         my @parts=split(",",$fwdfwsettings{'TGT_PORT'});
 628                                         my @values=();
 629                                         foreach (@parts){
 630                                                 chomp($_);
 631                                                 if ($_ =~ /^(\d+)\-(\d+)$/ || $_ =~ /^(\d+)\:(\d+)$/) {
 632                                                         my $check;
 633                                                         #change dashes with :
 634                                                         $_=~ tr/-/:/;
 635                                                         if ($_ eq "*") {
 636                                                                 push(@values,"1:65535");
 637                                                                 $check='on';
 638                                                         }
 639                                                         if ($_ =~ /^(\D)\:(\d+)$/ || $_ =~ /^(\D)\-(\d+)$/) {
 640                                                                 push(@values,"1:$2");
 641                                                                 $check='on';
 642                                                         }
 643                                                         if ($_ =~ /^(\d+)\:(\D)$/ || $_ =~ /^(\d+)\-(\D)$/) {
 644                                                                 push(@values,"$1:65535");
 645                                                                 $check='on'
 646                                                         }
 647                                                         $errormessage .= &General::validportrange($_, 'destination');
 648                                                         if(!$check){
 649                                                                 push (@values,$_);
 650                                                         }
 651                                                 }else{
 652                                                         if (&General::validport($_)){
 653                                                                 push (@values,$_);
 654                                                         }else{
 655                                                                 $errormessage=$Lang::tr{'fwdfw err tgt_port'};
 656                                                                 return $errormessage;
 657                                                         }
 658                                                 }
 659                                         }
 660                                         $fwdfwsettings{'TGT_PORT'}=join("|",@values);
 661                                 }
 662                         }elsif ($fwdfwsettings{'PROT'} eq 'GRE'){
 663                                         $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 664                                         $fwdfwsettings{'TGT_PORT'} = '';
 665                                         $fwdfwsettings{'ICMP_TGT'} = '';
 666                         }elsif ($fwdfwsettings{'PROT'} eq 'ESP'){
 667                                         $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 668                                         $fwdfwsettings{'TGT_PORT'} = '';
 669                                         $fwdfwsettings{'ICMP_TGT'}='';
 670                         }elsif ($fwdfwsettings{'PROT'} eq 'AH'){
 671                                         $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 672                                         $fwdfwsettings{'TGT_PORT'} = '';
 673                                         $fwdfwsettings{'ICMP_TGT'}='';
 674                         }elsif ($fwdfwsettings{'PROT'} eq 'ICMP'){
 675                                 $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 676                                 $fwdfwsettings{'TGT_PORT'} = '';
 677                         }
 678                 }
 679         }
 680         #check targetport
 681         if ($fwdfwsettings{'USESRV'} ne 'ON'){
 682                 $fwdfwsettings{'grp3'}='';
 683                 $fwdfwsettings{$fwdfwsettings{'grp3'}}='';
 684                 $fwdfwsettings{'ICMP_TGT'}='';
 685         }
 686         #check timeframe
 687         if($fwdfwsettings{'TIME'} eq 'ON'){
 688                 if($fwdfwsettings{'TIME_MON'} eq '' && $fwdfwsettings{'TIME_TUE'} eq '' && $fwdfwsettings{'TIME_WED'} eq '' && $fwdfwsettings{'TIME_THU'} eq '' && $fwdfwsettings{'TIME_FRI'} eq '' && $fwdfwsettings{'TIME_SAT'} eq '' && $fwdfwsettings{'TIME_SUN'} eq ''){
 689                         $errormessage=$Lang::tr{'fwdfw err time'};
 690                         return $errormessage;
 691                 }
 692         }
 693         return $errormessage;
 694 }
 695 sub check_natport
 696 {
 697         my $val=shift;
 698         if($fwdfwsettings{'USE_NAT'} eq 'ON' && $fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){
 699                 if ($fwdfwsettings{'dnatport'} =~ /^(\d+)\-(\d+)$/) {
 700                         $fwdfwsettings{'dnatport'} =~ tr/-/:/;
 701                         if ($fwdfwsettings{'dnatport'} eq "*") {
 702                                 $fwdfwsettings{'dnatport'}="1:65535";
 703                         }
 704                         if ($fwdfwsettings{'dnatport'} =~ /^(\D)\:(\d+)$/) {
 705                                 $fwdfwsettings{'dnatport'} = "1:$2";
 706                         }
 707                         if ($fwdfwsettings{'dnatport'} =~ /^(\d+)\:(\D)$/) {
 708                                 $fwdfwsettings{'dnatport'} ="$1:65535";
 709                         }
 710                 }
 711                 return 1;
 712         }
 713         if ($val =~ "," || $val>65536 || $val<0){
 714                 return 0;
 715         }
 716         return 1;
 717 }
 718 sub checkrule
 719 {
 720         #check valid port for NAT
 721         if($fwdfwsettings{'USE_NAT'} eq 'ON'){
 722                 #RULE_ACTION must be ACCEPT if we use NAT
 723                 $fwdfwsettings{'RULE_ACTION'} = 'ACCEPT';
 724
 725                 #if no dnat or snat selected errormessage
 726                 if ($fwdfwsettings{'nat'} eq ''){
 727                         $errormessage=$Lang::tr{'fwdfw dnat nochoice'};
 728                         return;
 729                 }
 730
 731                 #if using snat, the external port has to be empty
 732                 if ($fwdfwsettings{'nat'} eq 'snat' && $fwdfwsettings{'dnatport'} ne ''){
 733                         $errormessage=$Lang::tr{'fwdfw dnat extport'};
 734                         return;
 735                 }
 736                 #if no dest port is given in nat area, take target host port
 737                 if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'TGT_PORT' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$fwdfwsettings{'TGT_PORT'};}
 738                 if($fwdfwsettings{'TGT_PORT'} eq '' && $fwdfwsettings{'dnatport'} ne '' && ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP')){
 739                         $errormessage=$Lang::tr{'fwdfw dnat porterr2'};
 740                         return;
 741                 }
 742                 #check if port given in nat area is a single valid port or portrange
 743                 if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'TGT_PORT'} ne '' && !&check_natport($fwdfwsettings{'dnatport'})){
 744                         $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 745                 }elsif($fwdfwsettings{'USESRV'} eq 'ON' && $fwdfwsettings{'grp3'} eq 'cust_srv'){
 746                         my $custsrvport;
 747                         #get service Protocol and Port
 748                         foreach my $key (sort keys %customservice){
 749                                 if($fwdfwsettings{$fwdfwsettings{'grp3'}} eq $customservice{$key}[0]){
 750                                         if ($customservice{$key}[2] ne 'TCP' && $customservice{$key}[2] ne 'UDP'){
 751                                                 $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 752                                         }
 753                                         $custsrvport= $customservice{$key}[1];
 754                                 }
 755                         }
 756                         if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$custsrvport;}
 757                 }
 758                 #check if DNAT port is multiple
 759                 if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){
 760                         my @parts=split(",",$fwdfwsettings{'dnatport'});
 761                                         my @values=();
 762                                         foreach (@parts){
 763                                                 chomp($_);
 764                                                 if ($_ =~ /^(\d+)\-(\d+)$/ || $_ =~ /^(\d+)\:(\d+)$/) {
 765                                                         my $check;
 766                                                         #change dashes with :
 767                                                         $_=~ tr/-/:/;
 768                                                         if ($_ eq "*") {
 769                                                                 push(@values,"1:65535");
 770                                                                 $check='on';
 771                                                         }
 772                                                         if ($_ =~ /^(\D)\:(\d+)$/ || $_ =~ /^(\D)\-(\d+)$/) {
 773                                                                 push(@values,"1:$2");
 774                                                                 $check='on';
 775                                                         }
 776                                                         if ($_ =~ /^(\d+)\:(\D)$/ || $_ =~ /^(\d+)\-(\D)$/) {
 777                                                                 push(@values,"$1:65535");
 778                                                                 $check='on'
 779                                                         }
 780                                                         $errormessage .= &General::validportrange($_, 'destination');
 781                                                         if(!$check){
 782                                                                 push (@values,$_);
 783                                                         }
 784                                                 }else{
 785                                                         if (&General::validport($_)){
 786                                                                 push (@values,$_);
 787                                                         }else{
 788
 789                                                         }
 790                                                 }
 791                                         }
 792                                         $fwdfwsettings{'dnatport'}=join("|",@values);
 793                 }
 794                 #check if a rule with prot tcp or udp and ports is edited and now prot is "all", then delete all ports
 795                 if($fwdfwsettings{'PROT'} eq ''){
 796                         $fwdfwsettings{'dnatport'}='';
 797                 }
 798         }
 799         #check valid remark
 800         if ($fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){
 801                 $errormessage.=$Lang::tr{'fwdfw err remark'}."<br>";
 802         }
 803         #check if source and target identical
 804         if ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ALL' && $fwdfwsettings{'grp2'} ne 'ipfire'){
 805                 $errormessage=$Lang::tr{'fwdfw err same'};
 806                 return $errormessage;
 807         }
 808         #get source and targetip address if possible
 809         my ($sip,$scidr,$tip,$tcidr);
 810         ($sip,$scidr)=&get_ip("src","grp1");
 811         ($tip,$tcidr)=&get_ip("tgt","grp2");
 812         #check same iprange in source and target
 813         if ($sip ne '' && $scidr ne '' && $tip ne '' && $tcidr ne ''){
 814                 my $networkip1=&General::getnetworkip($sip,$scidr);
 815                 my $networkip2=&General::getnetworkip($tip,$tcidr);
 816                 if ($scidr gt $tcidr){
 817                         if ( &General::IpInSubnet($networkip1,$tip,&General::iporsubtodec($tcidr))){
 818                                 $errormessage.=$Lang::tr{'fwdfw err samesub'};
 819                         }
 820                 }elsif($scidr eq $tcidr && $scidr eq '32'){
 821                         my ($sbyte1,$sbyte2,$sbyte3,$sbyte4)=split(/\./,$networkip1);
 822                         my ($tbyte1,$tbyte2,$tbyte3,$tbyte4)=split(/\./,$networkip2);
 823                                 if ($sbyte1 eq $tbyte1 && $sbyte2 eq $tbyte2 && $sbyte3 eq $tbyte3){
 824                                         $hint=$Lang::tr{'fwdfw hint ip1'}."<br>";
 825                                         $hint.=$Lang::tr{'fwdfw hint ip2'}." Source: $networkip1/$scidr Target: $networkip2/$tcidr<br>";
 826                                 }
 827                 }else{
 828                         if ( &General::IpInSubnet($networkip2,$sip,&General::iporsubtodec($scidr)) ){
 829                         $errormessage.=$Lang::tr{'fwdfw err samesub'};
 830                         }
 831                 }
 832         }
 833         #when icmp selected, no source and targetport allowed
 834         if (($fwdfwsettings{'PROT'} ne '' && $fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP' && $fwdfwsettings{'PROT'} ne 'template') && ($fwdfwsettings{'USESRV'} eq 'ON' || $fwdfwsettings{'USE_SRC_PORT'} eq 'ON')){
 835                 $errormessage.=$Lang::tr{'fwdfw err prot_port'};
 836                 return;
 837         }
 838         #change protocol if prot not equal dest single service
 839         if ($fwdfwsettings{'grp3'} eq 'cust_srv'){
 840                 foreach my $key (sort keys %customservice){
 841                         if($customservice{$key}[0] eq $fwdfwsettings{$fwdfwsettings{'grp3'}}){
 842                                 if ($customservice{$key}[2] ne $fwdfwsettings{'PROT'}){
 843                                         $fwdfwsettings{'PROT'} = $customservice{$key}[2];
 844                                         last;
 845                                 }
 846                         }
 847                 }
 848         }
 849         #check source and destination protocol if source manual and dest servicegroup
 850         if ($fwdfwsettings{'grp3'} eq 'cust_srvgrp'){
 851                 $fwdfwsettings{'PROT'} = '';
 852         }
 853         #ATTENTION: $fwdfwsetting{'TGT_PROT'} deprecated since 30.09.2013
 854         $fwdfwsettings{'TGT_PROT'}=''; #Set field empty (deprecated)
 855         #Check ICMP Types
 856         if ($fwdfwsettings{'PROT'} eq 'ICMP'){
 857                 $fwdfwsettings{'USE_SRC_PORT'}='';
 858                 $fwdfwsettings{'SRC_PORT'}='';
 859                 #$fwdfwsettings{'USESRV'}='';
 860                 $fwdfwsettings{'TGT_PORT'}='';
 861                 &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
 862                 foreach my $key (keys %icmptypes){
 863                         if($fwdfwsettings{'ICMP_TYPES'} eq "$icmptypes{$key}[0] ($icmptypes{$key}[1])"){
 864                                 $fwdfwsettings{'ICMP_TYPES'}="$icmptypes{$key}[0]";
 865                         }
 866                 }
 867         }elsif($fwdfwsettings{'PROT'} eq 'GRE'){
 868                 $fwdfwsettings{'USE_SRC_PORT'}='';
 869                 $fwdfwsettings{'SRC_PORT'}='';
 870                 $fwdfwsettings{'ICMP_TYPES'}='';
 871                 $fwdfwsettings{'USESRV'}='';
 872                 $fwdfwsettings{'TGT_PORT'}='';
 873         }elsif($fwdfwsettings{'PROT'} eq 'ESP'){
 874                 $fwdfwsettings{'USE_SRC_PORT'}='';
 875                 $fwdfwsettings{'SRC_PORT'}='';
 876                 $fwdfwsettings{'ICMP_TYPES'}='';
 877                 $fwdfwsettings{'USESRV'}='';
 878                 $fwdfwsettings{'TGT_PORT'}='';
 879         }elsif($fwdfwsettings{'PROT'} eq 'AH'){
 880                 $fwdfwsettings{'USE_SRC_PORT'}='';
 881                 $fwdfwsettings{'SRC_PORT'}='';
 882                 $fwdfwsettings{'ICMP_TYPES'}='';
 883                 $fwdfwsettings{'USESRV'}='';
 884                 $fwdfwsettings{'TGT_PORT'}='';
 885         }elsif($fwdfwsettings{'PROT'} eq 'IGMP'){
 886                 $fwdfwsettings{'USE_SRC_PORT'}='';
 887                 $fwdfwsettings{'SRC_PORT'}='';
 888                 $fwdfwsettings{'ICMP_TYPES'}='';
 889                 $fwdfwsettings{'USESRV'}='';
 890                 $fwdfwsettings{'TGT_PORT'}='';
 891         }elsif($fwdfwsettings{'PROT'} eq 'IPv6'){
 892                 $fwdfwsettings{'USE_SRC_PORT'}='';
 893                 $fwdfwsettings{'SRC_PORT'}='';
 894                 $fwdfwsettings{'ICMP_TYPES'}='';
 895                 $fwdfwsettings{'USESRV'}='';
 896                 $fwdfwsettings{'TGT_PORT'}='';
 897         }elsif($fwdfwsettings{'PROT'} eq 'IPIP'){
 898                 $fwdfwsettings{'USE_SRC_PORT'}='';
 899                 $fwdfwsettings{'SRC_PORT'}='';
 900                 $fwdfwsettings{'ICMP_TYPES'}='';
 901                 $fwdfwsettings{'USESRV'}='';
 902                 $fwdfwsettings{'TGT_PORT'}='';
 903         }elsif($fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP'){
 904                 $fwdfwsettings{'ICMP_TYPES'}='';
 905                 $fwdfwsettings{'SRC_PORT'}='';
 906                 $fwdfwsettings{'TGT_PORT'}='';
 907         }elsif($fwdfwsettings{'PROT'} ne 'ICMP'){
 908                 $fwdfwsettings{'ICMP_TYPES'}='';
 909         }
 910 }
 911 sub checkvpn
 912 {
 913         my $ip=shift;
 914         #Test if manual IP is part of static OpenVPN networks
 915         &General::readhasharray("$configccdnet", \%ccdnet);
 916         foreach my $key (sort keys %ccdnet){
 917                 my ($vpnip,$vpnsubnet) = split ("/",$ccdnet{$key}[1]);
 918                 my $sub=&General::iporsubtodec($vpnsubnet);
 919                 if (&General::IpInSubnet($ip,$vpnip,$sub)){
 920                         return 0;
 921                 }
 922         }
 923         # A Test if manual ip is part of dynamic openvpn subnet is made in getcolor
 924         # because if one creates a custom host with the ip, we need to check the color there!
 925         # It does not make sense to check this here
 926
 927         # Test if manual IP is part of an OpenVPN N2N subnet does also not make sense here
 928         # Is also checked in getcolor
 929
 930         # Test if manual ip is part of an IPsec Network is also checked in getcolor
 931         return 1;
 932 }
 933 sub checkvpncolor
 934 {
 935
 936 }
 937 sub deleterule
 938 {
 939         my %delhash=();
 940         &General::readhasharray($fwdfwsettings{'config'}, \%delhash);
 941         foreach my $key (sort {$a <=> $b} keys %delhash){
 942                 if ($key >= $fwdfwsettings{'key'}) {
 943                         my $next = $key + 1;
 944                         if (exists $delhash{$next}) {
 945                                 foreach my $i (0 .. $#{$delhash{$next}}) {
 946                                         $delhash{$key}[$i] = $delhash{$next}[$i];
 947                                 }
 948                         }
 949                 }
 950         }
 951         # Remove the very last entry.
 952         my $last_key = (sort {$a <=> $b} keys %delhash)[-1];
 953         delete $delhash{$last_key};
 954
 955         &General::writehasharray($fwdfwsettings{'config'}, \%delhash);
 956         &General::firewall_config_changed();
 957
 958         if($fwdfwsettings{'nobase'} ne 'on'){
 959                 &base;
 960         }
 961 }
 962 sub del_double
 963 {
 964         my %all=();
 965         @all{@_}=1;
 966         return (keys %all);
 967 }
 968 sub disable_rule
 969 {
 970         my $key1=shift;
 971         &General::readhasharray("$configfwdfw", \%configfwdfw);
 972         foreach my $key (sort keys %configfwdfw){
 973                         if ($key eq $key1 ){
 974                         if ($configfwdfw{$key}[2] eq 'ON'){$configfwdfw{$key}[2]='';}
 975                 }
 976         }
 977         &General::writehasharray("$configfwdfw", \%configfwdfw);
 978         &General::firewall_config_changed();
 979 }
 980 sub error
 981 {
 982         if ($errormessage) {
 983                 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
 984                 print "<class name='base'>$errormessage\n";
 985                 print "&nbsp;</class>\n";
 986                 &Header::closebox();
 987         }
 988 }
 989 sub fillselect
 990 {
 991         my %hash=%{(shift)};
 992         my $val=shift;
 993         my $key;
 994         foreach my $key (sort { ncmp($hash{$a}[0],$hash{$b}[0]) }  keys %hash){
 995                 if($hash{$key}[0] eq $val){
 996                         print"<option value='$hash{$key}[0]' selected>$hash{$key}[0]</option>";
 997                 }else{
 998                         print"<option value='$hash{$key}[0]'>$hash{$key}[0]</option>";
 999                 }
1000         }
1001 }
1002 sub gen_dd_block
1003 {
1004         my $srctgt = shift;
1005         my $grp=shift;
1006         my $helper='';
1007         my $show='';
1008
1009         my %checked = ();
1010         my %selected = ();
1011
1012         $checked{'grp1'}{$fwdfwsettings{'grp1'}}                                = 'CHECKED';
1013         $checked{'grp2'}{$fwdfwsettings{'grp2'}}                                = 'CHECKED';
1014         $checked{'grp3'}{$fwdfwsettings{'grp3'}}                                = 'CHECKED';
1015         $checked{'USE_SRC_PORT'}{$fwdfwsettings{'USE_SRC_PORT'}} = 'CHECKED';
1016         $checked{'USESRV'}{$fwdfwsettings{'USESRV'}}                    = 'CHECKED';
1017         $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}}                    = 'CHECKED';
1018         $checked{'LOG'}{$fwdfwsettings{'LOG'}}                                  = 'CHECKED';
1019         $checked{'TIME'}{$fwdfwsettings{'TIME'}}                                = 'CHECKED';
1020         $checked{'TIME_MON'}{$fwdfwsettings{'TIME_MON'}}                = 'CHECKED';
1021         $checked{'TIME_TUE'}{$fwdfwsettings{'TIME_TUE'}}                = 'CHECKED';
1022         $checked{'TIME_WED'}{$fwdfwsettings{'TIME_WED'}}                = 'CHECKED';
1023         $checked{'TIME_THU'}{$fwdfwsettings{'TIME_THU'}}                = 'CHECKED';
1024         $checked{'TIME_FRI'}{$fwdfwsettings{'TIME_FRI'}}                = 'CHECKED';
1025         $checked{'TIME_SAT'}{$fwdfwsettings{'TIME_SAT'}}                = 'CHECKED';
1026         $checked{'TIME_SUN'}{$fwdfwsettings{'TIME_SUN'}}                = 'CHECKED';
1027         $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}}             = 'selected';
1028         $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}}                 = 'selected';
1029 print<<END;
1030                 <table width='100%' border='0'>
1031                 <tr><td width='50%' valign='top'>
1032                 <table width='95%' border='0'>
1033                 <tr><td width='1%'><input type='radio' name='$grp' id='std_net_$srctgt' value='std_net_$srctgt' $checked{$grp}{'std_net_'.$srctgt}></td><td>$Lang::tr{'fwhost stdnet'}</td><td align='right'><select name='std_net_$srctgt' style='width:200px;'>
1034 END
1035         foreach my $network (sort keys %defaultNetworks)
1036                 {
1037                         next if($defaultNetworks{$network}{'NAME'} eq "IPFire");
1038                         print "<option value='$defaultNetworks{$network}{'NAME'}'";
1039
1040                         # Check if the the key handles a standard network.
1041                         if ( grep(/std_net_/, $fwdfwsettings{$grp}) ) {
1042                                 print " selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $defaultNetworks{$network}{'NAME'});
1043                         }
1044
1045                         my $defnet="$defaultNetworks{$network}{'NAME'}_NETADDRESS";
1046                         my $defsub="$defaultNetworks{$network}{'NAME'}_NETMASK";
1047                         my $defsub1=&General::subtocidr($ifaces{$defsub});
1048                         $ifaces{$defnet}='' if ($defaultNetworks{$network}{'NAME'} eq 'RED');
1049                         if ($ifaces{$defnet}){
1050                                 print ">$network ($ifaces{$defnet}/$defsub1)</option>";
1051                         }else{
1052                                 print ">$network</option>";
1053                         }
1054                 }
1055         print"</select></td></tr>";
1056         #custom networks
1057         if (! -z $confignet || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1058                 print"<tr><td><input type='radio' name='$grp' id='cust_net_$srctgt' value='cust_net_$srctgt' $checked{$grp}{'cust_net_'.$srctgt}></td><td>$Lang::tr{'fwhost cust net'}</td><td align='right'><select name='cust_net_$srctgt' style='width:200px;'>";
1059                 &fillselect(\%customnetwork,$fwdfwsettings{$fwdfwsettings{$grp}});
1060                 print"</select></td>";
1061         }
1062         #custom hosts
1063         if (! -z $confighost || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1064                 print"<tr><td><input type='radio' name='$grp' id='cust_host_$srctgt' value='cust_host_$srctgt' $checked{$grp}{'cust_host_'.$srctgt}></td><td>$Lang::tr{'fwhost cust addr'}</td><td align='right'><select name='cust_host_$srctgt' style='width:200px;'>";
1065                 &fillselect(\%customhost,$fwdfwsettings{$fwdfwsettings{$grp}});
1066                 print"</select></td>";
1067         }
1068         #custom groups
1069         if (! -z $configgrp || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1070                 print"<tr><td valign='top'><input type='radio' name='$grp' id='cust_grp_$srctgt' value='cust_grp_$srctgt' $checked{$grp}{'cust_grp_'.$srctgt}></td><td >$Lang::tr{'fwhost cust grp'}</td><td align='right'><select name='cust_grp_$srctgt' style='width:200px;'>";
1071                 foreach my $key (sort { ncmp($customgrp{$a}[0],$customgrp{$b}[0]) } keys %customgrp) {
1072                         if($helper ne $customgrp{$key}[0] && $customgrp{$key}[2] ne 'none'){
1073                                 print"<option ";
1074                                 print "selected='selected' " if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $customgrp{$key}[0]);
1075                                 print ">$customgrp{$key}[0]</option>";
1076                         }
1077                         $helper=$customgrp{$key}[0];
1078                 }
1079                 print"</select></td>";
1080         }
1081         # Locations / groups.
1082         my @locations = &fwlib::get_locations();
1083
1084         print "<tr>\n";
1085         print "<td valign='top'><input type='radio' name='$grp' id='cust_location_$srctgt' value='cust_location_$srctgt' $checked{$grp}{'cust_location_'.$srctgt}></td>\n";
1086         print "<td>$Lang::tr{'location'}</td>\n";
1087         print "<td align='right'><select name='cust_location_$srctgt' style='width:200px;'>\n";
1088
1089         # Add Location groups to dropdown.
1090         if (!-z $configlocationgrp) {
1091                 print "<optgroup label='$Lang::tr{'fwhost cust locationgroup'}'>\n";
1092                 foreach my $key (sort { ncmp($customlocationgrp{$a}[0],$customlocationgrp{$b}[0]) } keys %customlocationgrp) {
1093                         my $selected;
1094
1095                         # Generate stored value for select detection.
1096                         my $stored = join(':', "group",$customlocationgrp{$key}[0]);
1097
1098                         # Only show a group once and group with elements.
1099                         if($helper ne $customlocationgrp{$key}[0] && $customlocationgrp{$key}[2] ne 'none') {
1100                                 # Mark current entry as selected.
1101                                 if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $stored) {
1102                                         $selected = "selected='selected'";
1103                                 }
1104                                 print"<option $selected value='group:$customlocationgrp{$key}[0]'>$customlocationgrp{$key}[0]</option>\n";
1105                         }
1106                         $helper=$customlocationgrp{$key}[0];
1107                 }
1108                 print "</optgroup>\n";
1109         }
1110
1111         # Add locations.
1112         print "<optgroup label='$Lang::tr{'fwhost cust location'}'>\n";
1113         foreach my $location (@locations) {
1114                 # Get country name.
1115                 my $country_name = &Location::Functions::get_full_country_name($location);
1116
1117                 # Mark current entry as selected.
1118                 my $selected;
1119                 if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $location) {
1120                         $selected = "selected='selected'";
1121                 }
1122                 print "<option $selected value='$location'>$location - $country_name</option>\n";
1123         }
1124         print "</optgroup>\n";
1125
1126         # Close Locations dropdown.
1127         print "</select></td>\n";
1128
1129         #End left table. start right table (vpn)
1130         print"</tr></table></td><td valign='top'><table width='95%' border='0' align='right'><tr>";
1131         # CCD networks
1132         if( ! -z $configccdnet || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1133                 print"<td width='1%'><input type='radio' name='$grp' id='ovpn_net_$srctgt' value='ovpn_net_$srctgt'  $checked{$grp}{'ovpn_net_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ccdnet'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_net_$srctgt' style='width:200px;'>";
1134                 &fillselect(\%ccdnet,$fwdfwsettings{$fwdfwsettings{$grp}});
1135                 print"</select></td></tr>";
1136         }
1137         #OVPN CCD Hosts
1138         foreach my $key (sort { ncmp($ccdhost{$a}[0],$ccdhost{$b}[0]) } keys %ccdhost){
1139                 if ($ccdhost{$key}[33] ne '' ){
1140                         print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_host_$srctgt' value='ovpn_host_$srctgt' $checked{$grp}{'ovpn_host_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ccdhost'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_host_$srctgt' style='width:200px;'>" if ($show eq '');
1141                         $show='1';
1142                         print "<option value='$ccdhost{$key}[1]'";
1143                         print "selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $ccdhost{$key}[1]);
1144                         print ">$ccdhost{$key}[1]</option>";
1145                 }
1146         }
1147         if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){
1148                 print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_host_$srctgt' value='ovpn_host_$srctgt' $checked{$grp}{'ovpn_host_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ccdhost'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_host_$srctgt' style='width:200px;'></select></td></tr>" ;
1149         }
1150         if ($show eq '1'){$show='';print"</select></td></tr>";}
1151         #OVPN N2N
1152         foreach my $key (sort { ncmp($ccdhost{$a}[1],$ccdhost{$b}[1]) } keys %ccdhost){
1153                 if ($ccdhost{$key}[3] eq 'net'){
1154                         print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_n2n_$srctgt' value='ovpn_n2n_$srctgt' $checked{$grp}{'ovpn_n2n_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ovpn_n2n'}:</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_n2n_$srctgt' style='width:200px;'>" if ($show eq '');
1155                         $show='1';
1156                         print "<option value='$ccdhost{$key}[1]'";
1157                         print "selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $ccdhost{$key}[1]);
1158                         print ">$ccdhost{$key}[1]</option>";
1159                 }
1160         }
1161         if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){
1162                 print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_n2n_$srctgt' value='ovpn_n2n_$srctgt' $checked{$grp}{'ovpn_n2n_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ovpn_n2n'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_n2n_$srctgt' style='width:200px;'></select></td></tr>" ;
1163         }
1164         if ($show eq '1'){$show='';print"</select></td></tr>";}
1165         #IPsec netze
1166         foreach my $key (sort { ncmp($ipsecconf{$a}[1],$ipsecconf{$b}[1]) } keys %ipsecconf) {
1167                 if ($ipsecconf{$key}[3] eq 'net' || ($optionsfw{'SHOWDROPDOWN'} eq 'on' && $ipsecconf{$key}[3] ne 'host')){
1168                         print"<tr><td valign='top'><input type='radio' name='$grp' id='ipsec_net_$srctgt' value='ipsec_net_$srctgt' $checked{$grp}{'ipsec_net_'.$srctgt}></td><td >$Lang::tr{'fwhost ipsec net'}</td><td align='right'><select name='ipsec_net_$srctgt' style='width:200px;'>" if ($show eq '');
1169                         $show='1';
1170
1171                         #Check if we have more than one REMOTE subnet in config
1172                         my @arr1 = split /\|/, $ipsecconf{$key}[11];
1173                         my $cnt1 += @arr1;
1174
1175                         print "<option ";
1176                         print "value=$ipsecconf{$key}[1]";
1177                         print " selected " if ($fwdfwsettings{$fwdfwsettings{$grp}} eq "$ipsecconf{$key}[1]");
1178                         print ">$ipsecconf{$key}[1] ";
1179                         print "($Lang::tr{'fwdfw all subnets'})" if $cnt1 > 1; #If this Conenction has more than one subnet, print one option for all subnets
1180                         print "</option>";
1181
1182                         if ($cnt1 > 1){
1183                                 foreach my $val (@arr1){
1184                                         #normalize subnet to cidr notation
1185                                         my ($val1,$val2) = split /\//, $val;
1186                                         my $val3 = &General::iporsubtocidr($val2);
1187                                         print "<option ";
1188                                         print "value='$ipsecconf{$key}[1]|$val1/$val3'";
1189                                         print "selected " if ($fwdfwsettings{$fwdfwsettings{$grp}} eq "$ipsecconf{$key}[1]|$val1/$val3");
1190                                         print ">$ipsecconf{$key}[1] ($val1/$val3)</option>";
1191                                 }
1192                         }
1193                 }
1194         }
1195         if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){
1196                 print"<tr><td valign='top'><input type='radio' name='$grp' id='ipsec_net_$srctgt' value='ipsec_net_$srctgt' $checked{$grp}{'ipsec_net_'.$srctgt}></td><td >$Lang::tr{'fwhost ipsec net'}</td><td align='right'><select name='ipsec_net_$srctgt' style='width:200px;'><select></td></tr>";
1197         }
1198         if ($show eq '1'){$show='';print"</select></td></tr>";}
1199
1200         print"</table>";
1201         print"</td></tr></table><br>";
1202 }
1203 sub get_ip
1204 {
1205         my $val=shift;
1206         my $grp =shift;
1207         my $a;
1208         my $b;
1209         &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
1210         if ($fwdfwsettings{$grp} ne $Lang::tr{'fwhost any'}){
1211                 if ($fwdfwsettings{$grp} eq $val.'_addr'){
1212                         ($a,$b)   = split (/\//, $fwdfwsettings{$fwdfwsettings{$grp}});
1213                 }elsif($fwdfwsettings{$grp} eq 'std_net_'.$val){
1214                         if ($fwdfwsettings{$fwdfwsettings{$grp}} =~ /Gr/i){
1215                                 $a=$netsettings{'GREEN_NETADDRESS'};
1216                                 $b=&General::iporsubtocidr($netsettings{'GREEN_NETMASK'});
1217                         }elsif($fwdfwsettings{$fwdfwsettings{$grp}} =~ /Ora/i){
1218                                 $a=$netsettings{'ORANGE_NETADDRESS'};
1219                                 $b=&General::iporsubtocidr($netsettings{'ORANGE_NETMASK'});
1220                         }elsif($fwdfwsettings{$fwdfwsettings{$grp}} =~ /Bl/i){
1221                                 $a=$netsettings{'BLUE_NETADDRESS'};
1222                                 $b=&General::iporsubtocidr($netsettings{'BLUE_NETMASK'});
1223                         }elsif($fwdfwsettings{$fwdfwsettings{$grp}} =~ /OpenVPN/i){
1224                                 &General::readhash("$configovpn",\%ovpnsettings);
1225                                 ($a,$b)   = split (/\//, $ovpnsettings{'DOVPN_SUBNET'});
1226                                 $b=&General::iporsubtocidr($b);
1227                         }
1228                 }elsif($fwdfwsettings{$grp} eq 'cust_net_'.$val){
1229                         &General::readhasharray("$confignet", \%customnetwork);
1230                         foreach my $key (keys %customnetwork){
1231                                 if($customnetwork{$key}[0] eq $fwdfwsettings{$fwdfwsettings{$grp}}){
1232                                         $a=$customnetwork{$key}[1];
1233                                         $b=&General::iporsubtocidr($customnetwork{$key}[2]);
1234                                 }
1235                         }
1236                 }elsif($fwdfwsettings{$grp} eq 'cust_host_'.$val){
1237                         &General::readhasharray("$confighost", \%customhost);
1238                         foreach my $key (keys %customhost){
1239                                 if($customhost{$key}[0] eq $fwdfwsettings{$fwdfwsettings{$grp}}){
1240                                         if ($customhost{$key}[1] eq 'ip'){
1241                                                 ($a,$b)=split (/\//,$customhost{$key}[2]);
1242                                                 $b=&General::iporsubtocidr($b);
1243                                         }else{
1244                                                 if ($grp eq 'grp2'){
1245                                                         $errormessage=$Lang::tr{'fwdfw err tgt_mac'};
1246                                                 }
1247                                         }
1248                                 }
1249                         }
1250                 }
1251         }
1252         return $a,$b;
1253 }
1254 sub get_name
1255 {
1256         my $val=shift;
1257         &General::setup_default_networks(\%defaultNetworks);
1258         foreach my $network (sort keys %defaultNetworks)
1259         {
1260                 return "$network" if ($val eq $defaultNetworks{$network}{'NAME'});
1261         }
1262 }
1263 sub getsrcport
1264 {
1265         my %hash=%{(shift)};
1266         my $key=shift;
1267         if($hash{$key}[7] eq 'ON' && $hash{$key}[10]){
1268                 $hash{$key}[10]=~ s/\|/,/g;
1269                 print": $hash{$key}[10]";
1270         }elsif($hash{$key}[7] eq 'ON' && $hash{$key}[8] eq 'ICMP'){
1271                 print": <br>$hash{$key}[9] ";
1272         }
1273 }
1274 sub gettgtport
1275 {
1276         my %hash=%{(shift)};
1277         my $key=shift;
1278         my $service;
1279         my $prot;
1280         if($hash{$key}[11] eq 'ON' && $hash{$key}[12] ne 'ICMP'){
1281                 if($hash{$key}[14] eq 'cust_srv'){
1282                         &General::readhasharray("$configsrv", \%customservice);
1283                         foreach my $i (sort keys %customservice){
1284                                 if($customservice{$i}[0] eq $hash{$key}[15]){
1285                                         $service = $customservice{$i}[0];
1286                                 }
1287                         }
1288                 }elsif($hash{$key}[14] eq 'cust_srvgrp'){
1289                         $service=$hash{$key}[15];
1290                 }elsif($hash{$key}[14] eq 'TGT_PORT'){
1291                         $hash{$key}[15]=~ s/\|/,/g;
1292                         $service=$hash{$key}[15];
1293                 }
1294                 if($service){
1295                         print": $service";
1296                 }
1297         }
1298 }
1299 sub get_serviceports
1300 {
1301         my $type=shift;
1302         my $name=shift;
1303         &General::readhasharray("$configsrv", \%customservice);
1304         &General::readhasharray("$configsrvgrp", \%customservicegrp);
1305         @protocols=();
1306         my @specprot=("IPIP","IPV6","IGMP","GRE","AH","ESP");
1307         if($type eq 'service'){
1308                 foreach my $key (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){
1309                         if ($customservice{$key}[0] eq $name){
1310                                 push (@protocols,$customservice{$key}[2]);
1311                         }
1312                 }
1313         }elsif($type eq 'group'){
1314                 foreach my $key (sort { ncmp($customservicegrp{$a}[0],$customservicegrp{$b}[0]) } keys %customservicegrp){
1315                         if ($customservicegrp{$key}[0] eq $name){
1316                                 if ($customservicegrp{$key}[2] ~~ @specprot){
1317                                         push (@protocols," ".$customservicegrp{$key}[2]);
1318                                 }else{
1319                                         foreach my $key1 (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){
1320                                                 if ($customservice{$key1}[0] eq $customservicegrp{$key}[2]){
1321                                                         if (!grep(/$customservice{$key1}[2]/, @protocols)){
1322                                                                 push (@protocols,$customservice{$key1}[2]);}
1323                                                 }
1324                                         }
1325                                 }
1326                         }
1327                 }
1328         }
1329
1330         # Sort protocols alphabetically.
1331         @protocols = sort(@protocols);
1332
1333         return @protocols;
1334 }
1335 sub getcolor
1336 {
1337         my $nettype=shift;
1338         my $val=shift;
1339         my $hash=shift;
1340         if($optionsfw{'SHOWCOLORS'} eq 'on'){
1341                 # Don't colourise MAC addresses
1342                 if (&General::validmac($val)) {
1343                         $tdcolor = "";
1344                         return;
1345                 }
1346
1347                 #custom Hosts
1348                 if ($nettype eq 'cust_host_src' || $nettype eq 'cust_host_tgt'){
1349                         foreach my $key (sort keys %$hash){
1350                                 if ($$hash{$key}[0] eq $val){
1351                                         $val=$$hash{$key}[2];
1352                                 }
1353                         }
1354                 }
1355                 #standard networks
1356                 if ($val eq 'GREEN'){
1357                         $tdcolor="style='background-color: $Header::colourgreen;color:white;'";
1358                         return;
1359                 }elsif ($val eq 'ORANGE'){
1360                         $tdcolor="style='background-color:  $Header::colourorange;color:white;'";
1361                         return;
1362                 }elsif ($val eq 'BLUE'){
1363                         $tdcolor="style='background-color: $Header::colourblue;color:white;'";
1364                         return;
1365                 }elsif ($val eq 'RED' ||$val eq 'RED1' ){
1366                         $tdcolor="style='background-color: $Header::colourred;color:white;'";
1367                         return;
1368                 }elsif ($val eq 'IPFire' ){
1369                         $tdcolor="style='background-color: $Header::colourred;color:white;'";
1370                         return;
1371                 }elsif ($val eq 'OpenVPN-Dyn' ){
1372                         $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1373                         return;
1374                 }elsif ($val eq 'IPsec RW' ){
1375                         $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1376                         return;
1377                 }elsif($val =~ /^(.*?)\/(.*?)$/){
1378                         my ($sip,$scidr) = split ("/",$val);
1379                         if ( &Header::orange_used() && &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
1380                                 $tdcolor="style='background-color: $Header::colourorange;color:white;'";
1381                                 return;
1382                         }
1383                         if ( &General::IpInSubnet($sip,$netsettings{'GREEN_ADDRESS'},$netsettings{'GREEN_NETMASK'})){
1384                                 $tdcolor="style='background-color: $Header::colourgreen;color:white;'";
1385                                 return;
1386                         }
1387                         if ( &Header::blue_used() && &General::IpInSubnet($sip,$netsettings{'BLUE_ADDRESS'},$netsettings{'BLUE_NETMASK'})){
1388                                 $tdcolor="style='background-color: $Header::colourblue;color:white;'";
1389                                 return;
1390                         }
1391                 }elsif ($val eq 'Default IP'){
1392                         $tdcolor="style='background-color: $Header::colourred;color:white;'";
1393                         return;
1394                 }
1395                 #Check if a manual IP or custom host is part of a VPN
1396                 if ($nettype eq 'src_addr' || $nettype eq 'tgt_addr' || $nettype eq 'cust_host_src' || $nettype eq 'cust_host_tgt'){
1397                         #Check if IP is part of OpenVPN dynamic subnet
1398                         my ($a,$b) = split("/",$ovpnsettings{'DOVPN_SUBNET'});
1399                         my ($c,$d) = split("/",$val);
1400                         if (&General::IpInSubnet($c,$a,$b)){
1401                                 $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1402                                 return;
1403                         }
1404                         #Check if IP is part of OpenVPN static subnet
1405                         foreach my $key (sort keys %ccdnet){
1406                                 my ($a,$b) = split("/",$ccdnet{$key}[1]);
1407                                 $b =&General::iporsubtodec($b);
1408                                 if (&General::IpInSubnet($c,$a,$b)){
1409                                         $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1410                                         return;
1411                                 }
1412                         }
1413                         #Check if IP is part of OpenVPN N2N subnet
1414                         foreach my $key (sort keys %ccdhost){
1415                                 if ($ccdhost{$key}[3] eq 'net'){
1416                                         my ($a,$b) = split("/",$ccdhost{$key}[11]);
1417                                         if (&General::IpInSubnet($c,$a,$b)){
1418                                                 $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1419                                                 return;
1420                                         }
1421                                 }
1422                         }
1423                         #Check if IP is part of IPsec RW network
1424                         if ($ipsecsettings{'RW_NET'} ne ''){
1425                                 my ($a,$b) = split("/",$ipsecsettings{'RW_NET'});
1426                                 $b=&General::iporsubtodec($b);
1427                                 if (&General::IpInSubnet($c,$a,$b)){
1428                                         $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1429                                         return;
1430                                 }
1431                         }
1432                         #Check if IP is part of a IPsec N2N network
1433                         foreach my $key (sort keys %ipsecconf){
1434                                 if ($ipsecconf{$key}[11]){
1435                                         my ($a,$b) = split("/",$ipsecconf{$key}[11]);
1436                                         $b=&General::iporsubtodec($b);
1437                                         if (&General::IpInSubnet($c,$a,$b)){
1438                                                 $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1439                                                 return;
1440                                         }
1441                                 }
1442                         }
1443                 }
1444                 #VPN networks
1445                 if ($nettype eq 'ovpn_n2n_src' || $nettype eq 'ovpn_n2n_tgt' || $nettype eq 'ovpn_net_src' || $nettype eq 'ovpn_net_tgt'|| $nettype eq 'ovpn_host_src' || $nettype eq 'ovpn_host_tgt'){
1446                         $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1447                         return;
1448                 }
1449                 if ($nettype eq 'ipsec_net_src' || $nettype eq 'ipsec_net_tgt'){
1450                         $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1451                         return;
1452                 }
1453                 #ALIASE
1454                 foreach my $alias (sort keys %aliases)
1455                 {
1456                         if ($val eq $alias){
1457                                 $tdcolor="style='background-color:$Header::colourred;color:white;'";
1458                                 return;
1459                         }
1460                 }
1461         }
1462         $tdcolor='';
1463         return;
1464 }
1465 sub hint
1466 {
1467         if ($hint) {
1468                 &Header::openbox('100%', 'left', $Lang::tr{'fwhost hint'});
1469                 print "<class name='base'>$hint\n";
1470                 print "&nbsp;</class>\n";
1471                 &Header::closebox();
1472         }
1473 }
1474 sub newrule
1475 {
1476         &error;
1477         &General::setup_default_networks(\%defaultNetworks);
1478         &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
1479         #read all configfiles
1480         &General::readhasharray("$configccdnet", \%ccdnet);
1481         &General::readhasharray("$confignet", \%customnetwork);
1482         &General::readhasharray("$configccdhost", \%ccdhost);
1483         &General::readhasharray("$confighost", \%customhost);
1484         &General::readhasharray("$configccdhost", \%ccdhost);
1485         &General::readhasharray("$configgrp", \%customgrp);
1486         &General::readhasharray("$configlocationgrp", \%customlocationgrp);
1487         &General::readhasharray("$configipsec", \%ipsecconf);
1488         &General::get_aliases(\%aliases);
1489
1490         my %checked = ();
1491         my %selected = ();
1492
1493         my $helper;
1494         my $sum=0;
1495         if($fwdfwsettings{'config'} eq ''){$fwdfwsettings{'config'}=$configfwdfw;}
1496         my $config=$fwdfwsettings{'config'};
1497         my %hash=();
1498         #Get Red IP-ADDRESS
1499         open (CONN1,"/var/ipfire/red/local-ipaddress");
1500         my $redip = <CONN1>;
1501         close(CONN1);
1502         if (! $fwdfwsettings{'RULE_ACTION'} && $fwdfwsettings{'POLICY'} eq 'MODE2'){
1503                 $fwdfwsettings{'RULE_ACTION'}='DROP';
1504         }elsif(! $fwdfwsettings{'RULE_ACTION'} && $fwdfwsettings{'POLICY'} eq 'MODE1'){
1505                 $fwdfwsettings{'RULE_ACTION'}='ACCEPT';
1506         }
1507         $checked{'grp1'}{$fwdfwsettings{'grp1'}}                                = 'CHECKED';
1508         $checked{'grp2'}{$fwdfwsettings{'grp2'}}                                = 'CHECKED';
1509         $checked{'grp3'}{$fwdfwsettings{'grp3'}}                                = 'CHECKED';
1510         $checked{'USE_SRC_PORT'}{$fwdfwsettings{'USE_SRC_PORT'}} = 'CHECKED';
1511         $checked{'USESRV'}{$fwdfwsettings{'USESRV'}}                    = 'CHECKED';
1512         $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}}                    = 'CHECKED';
1513         $checked{'LOG'}{$fwdfwsettings{'LOG'}}                                  = 'CHECKED';
1514         $checked{'TIME'}{$fwdfwsettings{'TIME'}}                                = 'CHECKED';
1515         $checked{'TIME_MON'}{$fwdfwsettings{'TIME_MON'}}                = 'CHECKED';
1516         $checked{'TIME_TUE'}{$fwdfwsettings{'TIME_TUE'}}                = 'CHECKED';
1517         $checked{'TIME_WED'}{$fwdfwsettings{'TIME_WED'}}                = 'CHECKED';
1518         $checked{'TIME_THU'}{$fwdfwsettings{'TIME_THU'}}                = 'CHECKED';
1519         $checked{'TIME_FRI'}{$fwdfwsettings{'TIME_FRI'}}                = 'CHECKED';
1520         $checked{'TIME_SAT'}{$fwdfwsettings{'TIME_SAT'}}                = 'CHECKED';
1521         $checked{'TIME_SUN'}{$fwdfwsettings{'TIME_SUN'}}                = 'CHECKED';
1522         $checked{'USE_NAT'}{$fwdfwsettings{'USE_NAT'}}                  = 'CHECKED';
1523         $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}}             = 'selected';
1524         $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}}                 = 'selected';
1525         $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} = 'selected' if ($fwdfwsettings{'grp2'} eq "ipfire");
1526         $selected{'ipfire_src'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} = 'selected' if ($fwdfwsettings{'grp1'} eq "ipfire_src");
1527         #check if update and get values
1528         if($fwdfwsettings{'updatefwrule'} eq 'on' || $fwdfwsettings{'copyfwrule'} eq 'on' && !$errormessage){
1529                 &General::readhasharray("$config", \%hash);
1530                 foreach my $key (sort keys %hash){
1531                         $sum++;
1532                         if ($key eq $fwdfwsettings{'key'}){
1533                                 $fwdfwsettings{'oldrulenumber'}                 = $fwdfwsettings{'key'};
1534                                 $fwdfwsettings{'RULE_ACTION'}                   = $hash{$key}[0];
1535                                 $fwdfwsettings{'chain'}                                 = $hash{$key}[1];
1536                                 $fwdfwsettings{'ACTIVE'}                                = $hash{$key}[2];
1537                                 $fwdfwsettings{'grp1'}                                  = $hash{$key}[3];
1538                                 $fwdfwsettings{$fwdfwsettings{'grp1'}}  = $hash{$key}[4];
1539                                 $fwdfwsettings{'grp2'}                                  = $hash{$key}[5];
1540                                 $fwdfwsettings{$fwdfwsettings{'grp2'}}  = $hash{$key}[6];
1541                                 $fwdfwsettings{'USE_SRC_PORT'}                  = $hash{$key}[7];
1542                                 $fwdfwsettings{'PROT'}                                  = $hash{$key}[8];
1543                             $fwdfwsettings{'ICMP_TYPES'}                        = $hash{$key}[9];
1544                             $fwdfwsettings{'SRC_PORT'}                          = $hash{$key}[10];
1545                             $fwdfwsettings{'USESRV'}                            = $hash{$key}[11];
1546                             $fwdfwsettings{'TGT_PROT'}                          = $hash{$key}[12];
1547                             $fwdfwsettings{'ICMP_TGT'}                          = $hash{$key}[13];
1548                             $fwdfwsettings{'grp3'}                                      = $hash{$key}[14];
1549                             $fwdfwsettings{$fwdfwsettings{'grp3'}}      = $hash{$key}[15];
1550                             $fwdfwsettings{'ruleremark'}                        = $hash{$key}[16];
1551                             $fwdfwsettings{'LOG'}                                       = $hash{$key}[17];
1552                             $fwdfwsettings{'TIME'}                                      = $hash{$key}[18];
1553                                 $fwdfwsettings{'TIME_MON'}                              = $hash{$key}[19];
1554                                 $fwdfwsettings{'TIME_TUE'}                              = $hash{$key}[20];
1555                                 $fwdfwsettings{'TIME_WED'}                              = $hash{$key}[21];
1556                                 $fwdfwsettings{'TIME_THU'}                              = $hash{$key}[22];
1557                                 $fwdfwsettings{'TIME_FRI'}                              = $hash{$key}[23];
1558                                 $fwdfwsettings{'TIME_SAT'}                              = $hash{$key}[24];
1559                                 $fwdfwsettings{'TIME_SUN'}                              = $hash{$key}[25];
1560                                 $fwdfwsettings{'TIME_FROM'}                             = $hash{$key}[26];
1561                                 $fwdfwsettings{'TIME_TO'}                               = $hash{$key}[27];
1562                                 $fwdfwsettings{'USE_NAT'}                               = $hash{$key}[28];
1563                                 $fwdfwsettings{'nat'}                                   = $hash{$key}[31]; #changed order
1564                                 $fwdfwsettings{$fwdfwsettings{'nat'}}   = $hash{$key}[29];
1565                                 #Fix BUG 12479
1566                                 #When copying a DNAT Rule, the sourceport has to be empty at this point.
1567                                 if($hash{$key}[14] eq 'cust_srv' and $hash{$key}[31] eq 'dnat'){
1568                                         $hash{$key}[30] = '';
1569                                 }
1570                                 $fwdfwsettings{'dnatport'}                              = $hash{$key}[30];
1571                                 $fwdfwsettings{'LIMIT_CON_CON'}                 = $hash{$key}[32];
1572                                 $fwdfwsettings{'concon'}                                = $hash{$key}[33];
1573                                 $fwdfwsettings{'RATE_LIMIT'}                    = $hash{$key}[34];
1574                                 $fwdfwsettings{'ratecon'}                               = $hash{$key}[35];
1575                                 $fwdfwsettings{'RATETIME'}                              = $hash{$key}[36];
1576                                 $checked{'grp1'}{$fwdfwsettings{'grp1'}}                                = 'CHECKED';
1577                                 $checked{'grp2'}{$fwdfwsettings{'grp2'}}                                = 'CHECKED';
1578                                 $checked{'grp3'}{$fwdfwsettings{'grp3'}}                                = 'CHECKED';
1579                                 $checked{'USE_SRC_PORT'}{$fwdfwsettings{'USE_SRC_PORT'}} = 'CHECKED';
1580                                 $checked{'USESRV'}{$fwdfwsettings{'USESRV'}}                    = 'CHECKED';
1581                                 $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}}                    = 'CHECKED';
1582                                 $checked{'LOG'}{$fwdfwsettings{'LOG'}}                                  = 'CHECKED';
1583                                 $checked{'TIME'}{$fwdfwsettings{'TIME'}}                                = 'CHECKED';
1584                                 $checked{'TIME_MON'}{$fwdfwsettings{'TIME_MON'}}                = 'CHECKED';
1585                                 $checked{'TIME_TUE'}{$fwdfwsettings{'TIME_TUE'}}                = 'CHECKED';
1586                                 $checked{'TIME_WED'}{$fwdfwsettings{'TIME_WED'}}                = 'CHECKED';
1587                                 $checked{'TIME_THU'}{$fwdfwsettings{'TIME_THU'}}                = 'CHECKED';
1588                                 $checked{'TIME_FRI'}{$fwdfwsettings{'TIME_FRI'}}                = 'CHECKED';
1589                                 $checked{'TIME_SAT'}{$fwdfwsettings{'TIME_SAT'}}                = 'CHECKED';
1590                                 $checked{'TIME_SUN'}{$fwdfwsettings{'TIME_SUN'}}                = 'CHECKED';
1591                                 $checked{'USE_NAT'}{$fwdfwsettings{'USE_NAT'}}                  = 'CHECKED';
1592                                 $checked{'nat'}{$fwdfwsettings{'nat'}}                                  = 'CHECKED';
1593                                 $checked{'LIMIT_CON_CON'}{$fwdfwsettings{'LIMIT_CON_CON'}}      = 'CHECKED';
1594                                 $checked{'RATE_LIMIT'}{$fwdfwsettings{'RATE_LIMIT'}}    = 'CHECKED';
1595                                 $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}}             = 'selected';
1596                                 $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}}                 = 'selected';
1597                                 $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} = 'selected' if ($fwdfwsettings{'grp2'} eq "ipfire");
1598                                 $selected{'ipfire_src'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} = 'selected' if ($fwdfwsettings{'grp1'} eq "ipfire_src");
1599                                 $selected{'dnat'}{$fwdfwsettings{'dnat'}}                               ='selected';
1600                                 $selected{'snat'}{$fwdfwsettings{'snat'}}                               ='selected';
1601                                 $selected{'RATETIME'}{$fwdfwsettings{'RATETIME'}}               ='selected';
1602                         }
1603                 }
1604                 $fwdfwsettings{'oldgrp1a'}=$fwdfwsettings{'grp1'};
1605                 $fwdfwsettings{'oldgrp1b'}=$fwdfwsettings{$fwdfwsettings{'grp1'}};
1606                 $fwdfwsettings{'oldgrp2a'}=$fwdfwsettings{'grp2'};
1607                 $fwdfwsettings{'oldgrp2b'}=$fwdfwsettings{$fwdfwsettings{'grp2'}};
1608                 $fwdfwsettings{'oldgrp3a'}=$fwdfwsettings{'grp3'};
1609                 $fwdfwsettings{'oldgrp3b'}=$fwdfwsettings{$fwdfwsettings{'grp3'}};
1610                 $fwdfwsettings{'oldusesrv'}=$fwdfwsettings{'USESRV'};
1611                 $fwdfwsettings{'oldruleremark'}=$fwdfwsettings{'ruleremark'};
1612                 $fwdfwsettings{'oldnat'}=$fwdfwsettings{'USE_NAT'};
1613                 $fwdfwsettings{'oldruletype'}=$fwdfwsettings{'chain'};
1614                 $fwdfwsettings{'oldconcon'}=$fwdfwsettings{'LIMIT_CON_CON'};
1615                 $fwdfwsettings{'olduseratelimit'}=$fwdfwsettings{'RATE_LIMIT'};
1616                 $fwdfwsettings{'olduseratelimitamount'}=$fwdfwsettings{'ratecon'};
1617                 $fwdfwsettings{'oldratelimittime'}=$fwdfwsettings{'RATETIME'};
1618
1619                 #check if manual ip (source) is orange network
1620                 if ($fwdfwsettings{'grp1'} eq 'src_addr'){
1621                         my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
1622                         if ( &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
1623                                 $fwdfwsettings{'oldorange'} ='on';
1624                         }
1625                 }
1626         }else{
1627                 $fwdfwsettings{'ACTIVE'}='ON';
1628                 $fwdfwsettings{'nat'} = 'dnat';
1629                 $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}} = 'CHECKED';
1630                 $checked{'nat'}{$fwdfwsettings{'nat'}} = 'CHECKED';
1631                 $fwdfwsettings{'oldgrp1a'}=$fwdfwsettings{'grp1'};
1632                 $fwdfwsettings{'oldgrp1b'}=$fwdfwsettings{$fwdfwsettings{'grp1'}};
1633                 $fwdfwsettings{'oldgrp2a'}=$fwdfwsettings{'grp2'};
1634                 $fwdfwsettings{'oldgrp2b'}=$fwdfwsettings{$fwdfwsettings{'grp2'}};
1635                 $fwdfwsettings{'oldgrp3a'}=$fwdfwsettings{'grp3'};
1636                 $fwdfwsettings{'oldgrp3b'}=$fwdfwsettings{$fwdfwsettings{'grp3'}};
1637                 $fwdfwsettings{'oldusesrv'}=$fwdfwsettings{'USESRV'};
1638                 $fwdfwsettings{'oldruleremark'}=$fwdfwsettings{'ruleremark'};
1639                 $fwdfwsettings{'oldnat'}=$fwdfwsettings{'USE_NAT'};
1640                 $fwdfwsettings{'oldconcon'}=$fwdfwsettings{'LIMIT_CON_CON'};
1641                 #check if manual ip (source) is orange network
1642                 if ($fwdfwsettings{'grp1'} eq 'src_addr'){
1643                         my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
1644                         if ( &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
1645                                 $fwdfwsettings{'oldorange'} ='on';
1646                         }
1647                 }
1648         }
1649         # Split manual source and target address and delete the subnet
1650         my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
1651         if ($scidr eq '32'){$fwdfwsettings{$fwdfwsettings{'grp1'}}=$sip;}
1652         my ($dip,$dcidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp2'}});
1653         if ($dcidr eq '32'){$fwdfwsettings{$fwdfwsettings{'grp2'}}=$dip;}
1654         &Header::openbox('100%', 'left', $Lang::tr{'fwdfw source'});
1655         #------SOURCE-------------------------------------------------------
1656         print "<form method='post'>";
1657         print<<END;
1658                 <table width='100%' border='0'>
1659                 <tr><td width='1%'><input type='radio' name='grp1' value='src_addr'  checked></td><td width='60%'>$Lang::tr{'fwdfw sourceip'}<input type='TEXT' name='src_addr' value='$fwdfwsettings{'src_addr'}' size='16' maxlength='18' ></td><td width='1%'><input type='radio' name='grp1' id='ipfire_src' value='ipfire_src'  $checked{'grp1'}{'ipfire_src'}></td><td><b>Firewall</b></td>
1660 END
1661                 print"<td align='right'><select name='ipfire_src' style='width:200px;'>";
1662                 print "<option value='ALL' $selected{'ipfire_src'}{'ALL'}>$Lang::tr{'all'}</option>";
1663                 print "<option value='GREEN' $selected{'ipfire_src'}{'GREEN'}>$Lang::tr{'green'} ($ifaces{'GREEN_ADDRESS'})</option>" if $ifaces{'GREEN_ADDRESS'};
1664                 print "<option value='ORANGE' $selected{'ipfire_src'}{'ORANGE'}>$Lang::tr{'orange'} ($ifaces{'ORANGE_ADDRESS'})</option>" if (&Header::orange_used());
1665                 print "<option value='BLUE' $selected{'ipfire_src'}{'BLUE'}>$Lang::tr{'blue'} ($ifaces{'BLUE_ADDRESS'})</option>" if (&Header::blue_used());
1666                 print "<option value='RED1' $selected{'ipfire_src'}{'RED1'}>$Lang::tr{'red1'} ($redip)" if ($redip);
1667                 if (! -z "${General::swroot}/ethernet/aliases"){
1668                         foreach my $alias (sort keys %aliases)
1669                         {
1670                                 print "<option value='$alias' $selected{'ipfire_src'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1671                         }
1672                 }
1673                 print<<END;
1674                 </select></td></tr>
1675                 <tr><td><br></td></tr>
1676                 </table>
1677 END
1678                 &gen_dd_block('src','grp1');
1679                 &Header::closebox();
1680
1681                 #---SNAT / DNAT ------------------------------------------------
1682                 &Header::openbox('100%', 'left', 'NAT');
1683                 print<<END;
1684                         <label>
1685                                 <input type='checkbox' name='USE_NAT' id='USE_NAT' value="ON" $checked{'USE_NAT'}{'ON'}>
1686                                 $Lang::tr{'fwdfw use nat'}
1687                         </label>
1688                         <div class="NAT">
1689                                 <table class='fw-nat' width='100%' border='0'>
1690                                         <tr>
1691                                                 <td width='5%'></td>
1692                                                 <td width='40%'>
1693                                                         <label>
1694                                                                 <input type='radio' name='nat'  value='dnat' $checked{'nat'}{'dnat'}>
1695                                                                 $Lang::tr{'fwdfw dnat'}
1696                                                         </label>
1697                                                 </td>
1698 END
1699
1700         print <<END;
1701                                                 <td width='25%' align='right'><span class='dnat'>$Lang::tr{'dnat address'}:</span></td>
1702                                                 <td width='30%'>
1703                                                         <select name='dnat' class='dnat' style='width: 100%;'>
1704                                                                 <option value='AUTO' $selected{'dnat'}{'AUTO'}>- $Lang::tr{'automatic'} -</option>
1705                                                                 <option value='Default IP' $selected{'dnat'}{'Default IP'}>$Lang::tr{'red1'} ($redip)</option>
1706 END
1707                 if (%aliases) {
1708                         foreach my $alias (sort keys %aliases) {
1709                                 print "<option value='$alias' $selected{'dnat'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1710                         }
1711                 }
1712                 #DNAT Dropdown
1713                 foreach my $network (sort keys %defaultNetworks)
1714                 {
1715                         if ($defaultNetworks{$network}{'NAME'} eq 'BLUE'||$defaultNetworks{$network}{'NAME'} eq 'GREEN' ||$defaultNetworks{$network}{'NAME'} eq 'ORANGE'){
1716                                 print "<option value='$defaultNetworks{$network}{'NAME'}'";
1717                                 print " selected='selected'" if ($fwdfwsettings{'dnat'} eq $defaultNetworks{$network}{'NAME'});
1718                                 print ">$network ($defaultNetworks{$network}{'NET'})</option>";
1719                         }
1720                 }
1721                 print "</select>";
1722                 print "</tr>";
1723
1724                 #SNAT
1725                 print <<END;
1726                                         <tr>
1727                                                 <td width='5%'></td>
1728                                                 <td width='40%'>
1729                                                         <label>
1730                                                                 <input type='radio' name='nat'  value='snat' $checked{'nat'}{'snat'}>
1731                                                                 $Lang::tr{'fwdfw snat'}
1732                                                         </label>
1733                                                 </td>
1734                                                 <td width='25%' align='right'><span class='snat'>$Lang::tr{'snat new source ip address'}:</span></td>
1735                                                 <td width='30%'>
1736                                                         <select name='snat' class='snat' style='width: 100%;'>
1737                                                                 <option value='RED' $selected{'snat'}{'RED'}>$Lang::tr{'red1'} ($redip)</option>
1738 END
1739
1740                 foreach my $alias (sort keys %aliases) {
1741                         print "<option value='$alias' $selected{'snat'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1742                 }
1743                 # SNAT Dropdown
1744                 foreach my $network (sort keys %defaultNetworks) {
1745                         if ($defaultNetworks{$network}{'NAME'} eq 'BLUE'||$defaultNetworks{$network}{'NAME'} eq 'GREEN' ||$defaultNetworks{$network}{'NAME'} eq 'ORANGE'){
1746                                 print "<option value='$defaultNetworks{$network}{'NAME'}'";
1747                                 print " selected='selected'" if ($fwdfwsettings{'snat'} eq $defaultNetworks{$network}{'NAME'});
1748                                 print ">$network ($defaultNetworks{$network}{'NET'})</option>";
1749                         }
1750                 }
1751                 print <<END;
1752                                                         </select>
1753                                                 </td>
1754                                         </tr>
1755                                 </table>
1756                         </div>
1757 END
1758                 &Header::closebox();
1759
1760                 #---TARGET------------------------------------------------------
1761                 &Header::openbox('100%', 'left', $Lang::tr{'fwdfw target'});
1762                 print<<END;
1763                 <table width='100%' border='0'>
1764                 <tr><td width='1%'><input type='radio' name='grp2' value='tgt_addr'  checked></td><td width='60%' nowrap='nowrap'>$Lang::tr{'fwdfw targetip'}<input type='TEXT' name='tgt_addr' value='$fwdfwsettings{'tgt_addr'}' size='16' maxlength='18'><td width='1%'><input type='radio' name='grp2' id='ipfire' value='ipfire'  $checked{'grp2'}{'ipfire'}></td><td><b>Firewall</b></td>
1765 END
1766                 print"<td align='right'><select name='ipfire' style='width:200px;'>";
1767                 print "<option value='ALL' $selected{'ipfire'}{'ALL'}>$Lang::tr{'all'}</option>";
1768                 print "<option value='GREEN' $selected{'ipfire'}{'GREEN'}>$Lang::tr{'green'} ($ifaces{'GREEN_ADDRESS'})</option>" if $ifaces{'GREEN_ADDRESS'};
1769                 print "<option value='ORANGE' $selected{'ipfire'}{'ORANGE'}>$Lang::tr{'orange'} ($ifaces{'ORANGE_ADDRESS'})</option>" if (&Header::orange_used());
1770                 print "<option value='BLUE' $selected{'ipfire'}{'BLUE'}>$Lang::tr{'blue'} ($ifaces{'BLUE_ADDRESS'})</option>"if (&Header::blue_used());
1771                 print "<option value='RED1' $selected{'ipfire'}{'RED1'}>$Lang::tr{'red1'} ($redip)" if ($redip);
1772                 if (! -z "${General::swroot}/ethernet/aliases"){
1773                         foreach my $alias (sort keys %aliases)
1774                         {
1775                                 print "<option value='$alias' $selected{'ipfire'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1776                         }
1777                 }
1778                 print<<END;
1779                 </select></td></tr>
1780                 <tr><td><br></td></tr></table>
1781 END
1782                 &gen_dd_block('tgt','grp2');
1783                 &Header::closebox;
1784                 #---PROTOCOL------------------------------------------------------
1785                 $fwdfwsettings{'SRC_PORT'} =~ s/\|/,/g;
1786                 $fwdfwsettings{'TGT_PORT'} =~ s/\|/,/g;
1787                 $fwdfwsettings{'dnatport'} =~ tr/|/,/;
1788
1789                 # The dnatport may be empty, if it matches TGT_PORT
1790                 if ($fwdfwsettings{'dnatport'} eq $fwdfwsettings{'TGT_PORT'}) {
1791                         $fwdfwsettings{'dnatport'} = "";
1792                 }
1793
1794                 &Header::openbox('100%', 'left', $Lang::tr{'fwhost prot'});
1795                 #Fix Protocol for JQuery
1796                 if ($fwdfwsettings{'grp3'} eq 'cust_srv' || $fwdfwsettings{'grp3'} eq 'cust_srvgrp'){
1797                         $fwdfwsettings{'PROT'} = 'template';
1798                 }
1799                 print<<END;
1800                         <table width='100%' border='0'>
1801                                 <tr>
1802                                         <td width="25%">
1803                                                 <select name='PROT' id='protocol' style="width: 95px;">
1804 END
1805                 print "<option value=\"\"";
1806                 if ($fwdfwsettings{'PROT'} eq '') {
1807                         print " selected=\"selected\"";
1808                 }
1809                 print ">$Lang::tr{'all'}</option>";
1810
1811                 print "<option value=\"template\"";
1812                 print " selected=\"selected\"" if ($fwdfwsettings{'grp3'} eq 'cust_srv' || $fwdfwsettings{'grp3'} eq 'cust_srvgrp');
1813                 print ">- $Lang::tr{'template'} -</option>";
1814
1815                 foreach (@PROTOCOLS) {
1816                         print"<option value=\"$_\"";
1817                         if ($_ eq $fwdfwsettings{'PROT'}) {
1818                                 print " selected=\"selected\"";
1819                         }
1820                         if($_ eq "IPv6"){
1821                                 print ">$Lang::tr{'fwdfw prot41'}</option>";
1822                         }else{
1823                                 print ">$_</option>";
1824                         }
1825                 }
1826
1827                 print<<END;
1828                                                 </select>
1829                                         </td>
1830                                         <td width="75%">
1831                                                 <table width='100%' border='0' id="PROTOCOL_ICMP_TYPES">
1832                                                         <tr>
1833                                                                 <td width='20%'>$Lang::tr{'fwhost icmptype'}</td>
1834                                                                 <td colspan='2'>
1835                                                                         <select name='ICMP_TYPES' style='min-width:230px;'>
1836 END
1837                 &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
1838                 print"<option value='All ICMP-Types'>$Lang::tr{'fwdfw all icmp'}</option>";
1839                 foreach my $key (sort { ncmp($icmptypes{$a}[0],$icmptypes{$b}[0]) }keys %icmptypes){
1840                         if($fwdfwsettings{'ICMP_TYPES'} eq "$icmptypes{$key}[0]"){
1841                                 print"<option selected>$icmptypes{$key}[0] ($icmptypes{$key}[1])</option>";
1842                         }else{
1843                                 print"<option>$icmptypes{$key}[0] ($icmptypes{$key}[1])</option>";
1844                         }
1845                 }
1846
1847                 print <<END;
1848                                                                         </select>
1849                                                                 </td>
1850                                                         </tr>
1851                                                 </table>
1852
1853                                                 <table width="100%" border="0" id="PROTOCOL_PORTS">
1854                                                         <tr>
1855                                                                 <!-- #SOURCEPORT -->
1856                                                                 <td>
1857                                                                         $Lang::tr{'fwdfw use srcport'}
1858                                                                 </td>
1859                                                                 <td>
1860                                                                         <input type='text' name='SRC_PORT' value='$fwdfwsettings{'SRC_PORT'}' maxlength='20' size='18'>
1861                                                                 </td>
1862                                                                 <td width='10%'>
1863                                                                 </td>
1864
1865                                                                 <!-- #TARGETPORT -->
1866                                                                 <td>
1867                                                                         $Lang::tr{'fwdfw use srv'}
1868                                                                 </td>
1869
1870                                                                 <td>
1871                                                                         <input type='text' name='TGT_PORT' value='$fwdfwsettings{'TGT_PORT'}' maxlength='20' size='18'>
1872                                                                 </td>
1873                                                         </tr>
1874                                                         <tr class="NAT">
1875                                                                 <td colspan='3'></td>
1876                                                                 <td>$Lang::tr{'fwdfw external port nat'}:</td>
1877                                                                 <td>
1878                                                                         <input type='text' name='dnatport' value=\"$fwdfwsettings{'dnatport'}\" maxlength='20' size='18'>
1879                                                                 </td>
1880                                                         </tr>
1881                                                 </table>
1882
1883                                                 <table width="100%" border="0" id="PROTOCOL_TEMPLATE">
1884                                                         <tr>
1885                                                                 <td>
1886                                                                         <input type='radio' name='grp3' id='cust_srv' value='cust_srv' checked>
1887                                                                         $Lang::tr{'fwhost cust service'}
1888                                                                 </td>
1889                                                                 <td>
1890                                                                         <select name='cust_srv' style='min-width: 230px;'>
1891 END
1892
1893                 &General::readhasharray("$configsrv", \%customservice);
1894                 foreach my $key (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){
1895                         print"<option ";
1896                         print"selected='selected'" if ($fwdfwsettings{$fwdfwsettings{'grp3'}} eq $customservice{$key}[0]);
1897                         print"value='$customservice{$key}[0]'>$customservice{$key}[0]</option>";
1898                 }
1899
1900                 print <<END;
1901                                                                         </select>
1902                                                                 </td>
1903                                                         </tr>
1904                                                         <tr>
1905                                                                 <td>
1906                                                                         <input type='radio' name='grp3' id='cust_srvgrp' value='cust_srvgrp' $checked{'grp3'}{'cust_srvgrp'}>
1907                                                                         $Lang::tr{'fwhost cust srvgrp'}
1908                                                                 </td>
1909                                                                 <td>
1910                                                                         <select name='cust_srvgrp' style='min-width:230px;'>
1911 END
1912
1913                 &General::readhasharray("$configsrvgrp", \%customservicegrp);
1914                 my $helper;
1915                 foreach my $key (sort { ncmp($customservicegrp{$a}[0],$customservicegrp{$b}[0]) } keys %customservicegrp){
1916                         if ($helper ne $customservicegrp{$key}[0] && $customservicegrp{$key}[2] ne 'none'){
1917                                 print"<option ";
1918                                 print"selected='selected'" if ($fwdfwsettings{$fwdfwsettings{'grp3'}} eq $customservicegrp{$key}[0]);
1919                                 print">$customservicegrp{$key}[0]</option>";
1920                         }
1921                         $helper=$customservicegrp{$key}[0];
1922                 }
1923
1924                 print<<END;
1925                                                                         </select>
1926                                                                 </td>
1927                                                         </tr>
1928                                                 </table>
1929                                         </td>
1930                                 </tr>
1931                         </table>
1932 END
1933
1934                 &Header::closebox;
1935                 $checked{"RULE_ACTION"}{$fwdfwsettings{'RULE_ACTION'}}  = 'CHECKED';
1936                 print <<END;
1937                         <center>
1938                                 <table width="80%" class='tbl' id='actions'>
1939                                         <tr>
1940                                                 <td width="33%" align="center" bgcolor="$color{'color17'}">
1941                                                         &nbsp;<br>&nbsp;
1942                                                 </td>
1943                                                 <td width="33%" align="center" bgcolor="$color{'color25'}">
1944                                                         &nbsp;<br>&nbsp;
1945                                                 </td>
1946                                                 <td width="33%" align="center" bgcolor="$color{'color16'}">
1947                                                         &nbsp;<br>&nbsp;
1948                                                 </td>
1949                                         </tr>
1950                                         <tr>
1951                                                 <td width="33%" align="center">
1952                                                         <label>
1953                                                                 <input type="radio" name="RULE_ACTION" value="ACCEPT" $checked{"RULE_ACTION"}{"ACCEPT"}>
1954                                                                 <strong>$Lang::tr{'fwdfw ACCEPT'}</strong>
1955                                                         </label>
1956                                                 </td>
1957                                                 <td width="33%" align="center">
1958                                                         <label>
1959                                                                 <input type="radio" name="RULE_ACTION" value="DROP" $checked{"RULE_ACTION"}{"DROP"}>
1960                                                                 <strong>$Lang::tr{'fwdfw DROP'}</strong>
1961                                                         </label>
1962                                                 </td>
1963                                                 <td width="33%" align="center">
1964                                                         <label>
1965                                                                 <input type="radio" name="RULE_ACTION" value="REJECT" $checked{"RULE_ACTION"}{"REJECT"}>
1966                                                                 <strong>$Lang::tr{'fwdfw REJECT'}</strong>
1967                                                         </label>
1968                                                 </td>
1969                                         </tr>
1970                                 </table>
1971                         </center>
1972
1973                         <br>
1974 END
1975                 #---Activate/logging/remark-------------------------------------
1976                 &Header::openbox('100%', 'left', $Lang::tr{'fwdfw additional'});
1977                 print<<END;
1978                 <table width='100%' border='0'>
1979 END
1980                 print"<tr><td width='12%'>$Lang::tr{'remark'}:</td><td width='88%' align='left'><input type='text' name='ruleremark' maxlength='255' value='$fwdfwsettings{'ruleremark'}' style='width:99%;'></td></tr>";
1981                 if($fwdfwsettings{'updatefwrule'} eq 'on' || $fwdfwsettings{'copyfwrule'} eq 'on'){
1982                         print "<tr><td width='12%'>$Lang::tr{'fwdfw rulepos'}:</td><td><select name='rulepos' >";
1983                         for (my $count =1; $count <= $sum; $count++){
1984                                 print"<option value='$count' ";
1985                                 print"selected='selected'" if($fwdfwsettings{'oldrulenumber'} eq $count);
1986                                 print">$count</option>";
1987                         }
1988                         print"</select></td></tr>";
1989                 }else{
1990                         print "<tr><td width='12%'>$Lang::tr{'fwdfw rulepos'}:</td><td><input type='text' name='rulepos' size='2'></td></tr>";
1991                 }
1992
1993                 print<<END;
1994                 </table>
1995                 <table width='100%'>
1996                         <tr>
1997 END
1998
1999                 if ($fwdfwsettings{'updatefwrule'} eq 'on') {
2000                         print <<END;
2001                                 <td>
2002                                         <input type='checkbox' name='ACTIVE' value="ON" $checked{'ACTIVE'}{'ON'}>
2003                                 </td>
2004                                 <td>$Lang::tr{'fwdfw rule activate'}</td>
2005 END
2006                 } else {
2007                         print <<END;
2008                                 <td colspan="2">
2009                                         <input type="hidden" name="ACTIVE" value="ON">
2010                                 </td>
2011 END
2012                 }
2013
2014                 print <<END;
2015                         </tr>
2016                         <tr>
2017                                 <td>
2018                                         <input type='checkbox' name='LOG' value='ON' $checked{'LOG'}{'ON'}>
2019                                 </td>
2020                                 <td>$Lang::tr{'fwdfw log rule'}</td>
2021                         </tr>
2022                         <tr>
2023                                 <td width='1%'>
2024                                         <input type='checkbox' name='TIME' id="USE_TIME_CONSTRAINTS" value='ON' $checked{'TIME'}{'ON'}>
2025                                 </td>
2026                                 <td>$Lang::tr{'fwdfw timeframe'}</td>
2027                         </tr>
2028                         <tr id="TIME_CONSTRAINTS">
2029                                 <td colspan="2">
2030                                         <table width="66%" border="0">
2031                                                 <tr>
2032                                                         <td width="8em">&nbsp;</td>
2033                                                         <td align="center">$Lang::tr{'advproxy monday'}</td>
2034                                                         <td align="center">$Lang::tr{'advproxy tuesday'}</td>
2035                                                         <td align="center">$Lang::tr{'advproxy wednesday'}</td>
2036                                                         <td align="center">$Lang::tr{'advproxy thursday'}</td>
2037                                                         <td align="center">$Lang::tr{'advproxy friday'}</td>
2038                                                         <td align="center">$Lang::tr{'advproxy saturday'}</td>
2039                                                         <td align="center">$Lang::tr{'advproxy sunday'}</td>
2040                                                         <td>&nbsp;</td>
2041                                                 </tr>
2042                                                 <tr>
2043                                                         <td width="8em">&nbsp;</td>
2044                                                         <td align="center"><input type='checkbox' name='TIME_MON' value='on' $checked{'TIME_MON'}{'on'} ></td>
2045                                                         <td align="center"><input type='checkbox' name='TIME_TUE' value='on' $checked{'TIME_TUE'}{'on'} ></td>
2046                                                         <td align="center"><input type='checkbox' name='TIME_WED' value='on' $checked{'TIME_WED'}{'on'} ></td>
2047                                                         <td align="center"><input type='checkbox' name='TIME_THU' value='on' $checked{'TIME_THU'}{'on'} ></td>
2048                                                         <td align="center"><input type='checkbox' name='TIME_FRI' value='on' $checked{'TIME_FRI'}{'on'} ></td>
2049                                                         <td align="center"><input type='checkbox' name='TIME_SAT' value='on' $checked{'TIME_SAT'}{'on'} ></td>
2050                                                         <td align="center"><input type='checkbox' name='TIME_SUN' value='on' $checked{'TIME_SUN'}{'on'} ></td>
2051                                                         <td>
2052                                                                 <select name='TIME_FROM'>
2053 END
2054                 for (my $i=0;$i<=23;$i++) {
2055                         $i = sprintf("%02s",$i);
2056                         for (my $j=0;$j<=45;$j+=15) {
2057                                 $j = sprintf("%02s",$j);
2058                                 my $time = $i.":".$j;
2059                                 print "<option $selected{'TIME_FROM'}{$time}>$i:$j</option>\n";
2060                         }
2061                 }
2062                 print<<END;
2063                                                                 </select> &dash;
2064                                                                 <select name='TIME_TO'>
2065 END
2066                 for (my $i=0;$i<=23;$i++) {
2067                         $i = sprintf("%02s",$i);
2068                         for (my $j=0;$j<=45;$j+=15) {
2069                                 $j = sprintf("%02s",$j);
2070                                 my $time = $i.":".$j;
2071                                 print "<option $selected{'TIME_TO'}{$time}>$i:$j</option>\n";
2072                         }
2073                 }
2074                 print<<END;
2075                                                                 </select>
2076                                                         </td>
2077                                                 </tr>
2078                                         </table>
2079                                 </td>
2080                         </tr>
2081                         <tr>
2082                                 <td width='1%'>
2083                                         <input type='checkbox' name='LIMIT_CON_CON' id="USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP" value='ON' $checked{'LIMIT_CON_CON'}{'ON'}>
2084                                 </td>
2085                                 <td>$Lang::tr{'fwdfw limitconcon'}</td>
2086                         </tr>
2087                         <tr id="LIMIT_CON">
2088                                 <td colspan='2'>
2089                                         <table width='66%' border='0'>
2090                                                 <tr>
2091                                                         <td width="20em">&nbsp;</td>
2092                                                         <td>$Lang::tr{'fwdfw maxconcon'}: <input type='text' name='concon' size='2' value="$fwdfwsettings{'concon'}"></td>
2093                                                 </tr>
2094                                         </table>
2095                                 </td>
2096                         </tr>
2097                         <tr>
2098                                 <td width='1%'>
2099                                         <input type='checkbox' name='RATE_LIMIT' id="USE_RATELIMIT" value='ON' $checked{'RATE_LIMIT'}{'ON'}>
2100                                 </td>
2101                                 <td>$Lang::tr{'fwdfw ratelimit'}</td>
2102                         </tr>
2103                         <tr id="RATELIMIT">
2104                                 <td colspan='2'>
2105                                         <table width='66%' border='0'>
2106                                                 <tr>
2107                                                         <td width="20em">&nbsp;</td>
2108                                                         <td>$Lang::tr{'fwdfw numcon'}: <input type='text' name='ratecon' size='2' value="$fwdfwsettings{'ratecon'}"> /
2109                                                                 <select name='RATETIME' style='width:100px;'>
2110                                                                         <option value='second' $selected{'RATETIME'}{'second'}>$Lang::tr{'age second'}</option>
2111                                                                         <option value='minute' $selected{'RATETIME'}{'minute'}>$Lang::tr{'minute'}</option>
2112                                                                         <option value='hour' $selected{'RATETIME'}{'hour'}>$Lang::tr{'hour'}</option>
2113                                                                 </select>
2114                                                         </td>
2115                                                 </tr>
2116                                         </table>
2117                                 </td>
2118                         </tr>
2119                 </table>
2120                 <br>
2121 END
2122
2123                 #---ACTION------------------------------------------------------
2124                 if($fwdfwsettings{'updatefwrule'} ne 'on'){
2125                         print<<END;
2126                         <table border='0' width='100%'>
2127                         <tr><td align='right'><input type='submit' value='$Lang::tr{'add'}' style='min-width:100px;' />
2128                         <input type='hidden' name='config' value='$config' >
2129                         <input type='hidden' name='ACTION' value='saverule' ></form>
2130                         <form method='post' style='display:inline;'><input type='submit' value='$Lang::tr{'fwhost back'}' style='min-width:100px;'><input type='hidden' name='ACTION' value='reset'></form></td></tr>
2131                         </table>
2132                         <br>
2133 END
2134                 }else{
2135                         print<<END;
2136                         <table border='0' width='100%'>
2137                         <tr><td align='right'><input type='submit' value='$Lang::tr{'fwdfw change'}' style='min-width:100px;' /><input type='hidden' name='updatefwrule' value='$fwdfwsettings{'updatefwrule'}'><input type='hidden' name='key' value='$fwdfwsettings{'key'}'>
2138                         <input type='hidden' name='oldgrp1a' value='$fwdfwsettings{'oldgrp1a'}' />
2139                         <input type='hidden' name='oldgrp1b' value='$fwdfwsettings{'oldgrp1b'}' />
2140                         <input type='hidden' name='oldgrp2a' value='$fwdfwsettings{'oldgrp2a'}' />
2141                         <input type='hidden' name='oldgrp2b' value='$fwdfwsettings{'oldgrp2b'}' />
2142                         <input type='hidden' name='oldgrp3a' value='$fwdfwsettings{'oldgrp3a'}' />
2143                         <input type='hidden' name='oldgrp3b' value='$fwdfwsettings{'oldgrp3b'}' />
2144                         <input type='hidden' name='oldusesrv' value='$fwdfwsettings{'oldusesrv'}' />
2145                         <input type='hidden' name='oldrulenumber' value='$fwdfwsettings{'oldrulenumber'}' />
2146                         <input type='hidden' name='rulenumber' value='$fwdfwsettings{'rulepos'}' />
2147                         <input type='hidden' name='oldruleremark' value='$fwdfwsettings{'oldruleremark'}' />
2148                         <input type='hidden' name='oldorange' value='$fwdfwsettings{'oldorange'}' />
2149                         <input type='hidden' name='oldnat' value='$fwdfwsettings{'oldnat'}' />
2150                         <input type='hidden' name='oldruletype' value='$fwdfwsettings{'oldruletype'}' />
2151                         <input type='hidden' name='oldconcon' value='$fwdfwsettings{'oldconcon'}' />
2152                         <input type='hidden' name='ACTION' value='saverule' ></form><form method='post' style='display:inline'><input type='submit' value='$Lang::tr{'fwhost back'}' style='min-width:100px;'><input type='hidden' name='ACTION' value'reset'></td></td>
2153                         </table></form>
2154 END
2155                 }
2156                 &Header::closebox();
2157 }
2158 sub pos_up
2159 {
2160         my %uphash=();
2161         my %tmp=();
2162         &General::readhasharray($fwdfwsettings{'config'}, \%uphash);
2163         foreach my $key (sort keys %uphash){
2164                 if ($key eq $fwdfwsettings{'key'}) {
2165                         my $last = $key -1;
2166                         if (exists $uphash{$last}){
2167                                 #save rule last
2168                                 foreach my $y (0 .. $#{$uphash{$last}}) {
2169                                                 $tmp{0}[$y] = $uphash{$last}[$y];
2170                                 }
2171                                 #copy active rule to last
2172                                 foreach my $i (0 .. $#{$uphash{$last}}) {
2173                                         $uphash{$last}[$i] = $uphash{$key}[$i];
2174                                 }
2175                                 #copy saved rule to actual position
2176                                 foreach my $x (0 .. $#{$tmp{0}}) {
2177                                                 $uphash{$key}[$x] = $tmp{0}[$x];
2178                                 }
2179                         }
2180                 }
2181         }
2182         &General::writehasharray($fwdfwsettings{'config'}, \%uphash);
2183         &General::firewall_config_changed();
2184 }
2185 sub pos_down
2186 {
2187         my %downhash=();
2188         my %tmp=();
2189         &General::readhasharray($fwdfwsettings{'config'}, \%downhash);
2190         foreach my $key (sort keys %downhash){
2191                 if ($key eq $fwdfwsettings{'key'}) {
2192                         my $next = $key + 1;
2193                         if (exists $downhash{$next}){
2194                                 #save rule next
2195                                 foreach my $y (0 .. $#{$downhash{$next}}) {
2196                                                 $tmp{0}[$y] = $downhash{$next}[$y];
2197                                 }
2198                                 #copy active rule to next
2199                                 foreach my $i (0 .. $#{$downhash{$next}}) {
2200                                         $downhash{$next}[$i] = $downhash{$key}[$i];
2201                                 }
2202                                 #copy saved rule to actual position
2203                                 foreach my $x (0 .. $#{$tmp{0}}) {
2204                                                 $downhash{$key}[$x] = $tmp{0}[$x];
2205                                 }
2206                         }
2207                 }
2208         }
2209         &General::writehasharray($fwdfwsettings{'config'}, \%downhash);
2210         &General::firewall_config_changed();
2211 }
2212 sub saverule
2213 {
2214         my $hash=shift;
2215         my $config=shift;
2216         &General::readhasharray("$config", $hash);
2217         if (!$errormessage){
2218                 ################################################################
2219                 #check if we change an INPUT rule to a OUTGOING
2220                 if($fwdfwsettings{'oldruletype'} eq 'INPUTFW'  && $fwdfwsettings{'chain'} eq 'OUTGOINGFW'  ){
2221                         &changerule($configinput);
2222                         #print"1";
2223                 }
2224                 #check if we change an INPUT rule to a FORWARD
2225                 elsif($fwdfwsettings{'oldruletype'} eq 'INPUTFW'  && $fwdfwsettings{'chain'} eq 'FORWARDFW'  ){
2226                         &changerule($configinput);
2227                         #print"2";
2228                 }
2229                 ################################################################
2230                 #check if we change an OUTGOING rule to an INPUT
2231                 elsif($fwdfwsettings{'oldruletype'} eq 'OUTGOINGFW'  && $fwdfwsettings{'chain'} eq 'INPUTFW'  ){
2232                         &changerule($configoutgoing);
2233                         #print"3";
2234                 }
2235                 #check if we change an OUTGOING rule to a FORWARD
2236                 elsif($fwdfwsettings{'oldruletype'} eq 'OUTGOINGFW'  && $fwdfwsettings{'chain'} eq 'FORWARDFW'  ){
2237                         &changerule($configoutgoing);
2238                         #print"4";
2239                 }
2240                 ################################################################
2241                 #check if we change a FORWARD rule to an INPUT
2242                 elsif($fwdfwsettings{'oldruletype'} eq 'FORWARDFW'  && $fwdfwsettings{'chain'} eq 'INPUTFW'){
2243                         &changerule($configfwdfw);
2244                         #print"5";
2245                 }
2246                 #check if we change a FORWARD rule to an OUTGOING
2247                 elsif($fwdfwsettings{'oldruletype'} eq 'FORWARDFW'  && $fwdfwsettings{'chain'} eq 'OUTGOINGFW'){
2248                         &changerule($configfwdfw);
2249                         #print"6";
2250                 }
2251                 $fwdfwsettings{'ruleremark'}=~ s/,/;/g;
2252                 utf8::decode($fwdfwsettings{'ruleremark'});
2253                 $fwdfwsettings{'ruleremark'}=&Header::escape($fwdfwsettings{'ruleremark'});
2254                 if ($fwdfwsettings{'updatefwrule'} ne 'on'){
2255                         my $key = &General::findhasharraykey ($hash);
2256                         $$hash{$key}[0]  = $fwdfwsettings{'RULE_ACTION'};
2257                         $$hash{$key}[1]  = $fwdfwsettings{'chain'};
2258                         $$hash{$key}[2]  = $fwdfwsettings{'ACTIVE'};
2259                         $$hash{$key}[3]  = $fwdfwsettings{'grp1'};
2260                         $$hash{$key}[4]  = $fwdfwsettings{$fwdfwsettings{'grp1'}};
2261                         $$hash{$key}[5]  = $fwdfwsettings{'grp2'};
2262                         $$hash{$key}[6]  = $fwdfwsettings{$fwdfwsettings{'grp2'}};
2263                         $$hash{$key}[7]  = $fwdfwsettings{'USE_SRC_PORT'};
2264                         $$hash{$key}[8]  = $fwdfwsettings{'PROT'};
2265                         $$hash{$key}[9]  = $fwdfwsettings{'ICMP_TYPES'};
2266                         $$hash{$key}[10] = $fwdfwsettings{'SRC_PORT'};
2267                         $$hash{$key}[11] = $fwdfwsettings{'USESRV'};
2268                         $$hash{$key}[12] = $fwdfwsettings{'TGT_PROT'};
2269                         $$hash{$key}[13] = $fwdfwsettings{'ICMP_TGT'};
2270                         $$hash{$key}[14] = $fwdfwsettings{'grp3'};
2271                         $$hash{$key}[15] = $fwdfwsettings{$fwdfwsettings{'grp3'}};
2272                         $$hash{$key}[16] = $fwdfwsettings{'ruleremark'};
2273                         $$hash{$key}[17] = $fwdfwsettings{'LOG'};
2274                         $$hash{$key}[18] = $fwdfwsettings{'TIME'};
2275                         $$hash{$key}[19] = $fwdfwsettings{'TIME_MON'};
2276                         $$hash{$key}[20] = $fwdfwsettings{'TIME_TUE'};
2277                         $$hash{$key}[21] = $fwdfwsettings{'TIME_WED'};
2278                         $$hash{$key}[22] = $fwdfwsettings{'TIME_THU'};
2279                         $$hash{$key}[23] = $fwdfwsettings{'TIME_FRI'};
2280                         $$hash{$key}[24] = $fwdfwsettings{'TIME_SAT'};
2281                         $$hash{$key}[25] = $fwdfwsettings{'TIME_SUN'};
2282                         $$hash{$key}[26] = $fwdfwsettings{'TIME_FROM'};
2283                         $$hash{$key}[27] = $fwdfwsettings{'TIME_TO'};
2284                         $$hash{$key}[28] = $fwdfwsettings{'USE_NAT'};
2285                         $$hash{$key}[29] = $fwdfwsettings{$fwdfwsettings{'nat'}};
2286                         $$hash{$key}[30] = $fwdfwsettings{'dnatport'};
2287                         $$hash{$key}[31] = $fwdfwsettings{'nat'};
2288                         $$hash{$key}[32] = $fwdfwsettings{'LIMIT_CON_CON'};
2289                         $$hash{$key}[33] = $fwdfwsettings{'concon'};
2290                         $$hash{$key}[34] = $fwdfwsettings{'RATE_LIMIT'};
2291                         $$hash{$key}[35] = $fwdfwsettings{'ratecon'};
2292                         $$hash{$key}[36] = $fwdfwsettings{'RATETIME'};
2293                         &General::writehasharray("$config", $hash);
2294                 }else{
2295                         foreach my $key (sort {$a <=> $b} keys %$hash){
2296                                 if($key eq $fwdfwsettings{'key'}){
2297                                         $$hash{$key}[0]  = $fwdfwsettings{'RULE_ACTION'};
2298                                         $$hash{$key}[1]  = $fwdfwsettings{'chain'};
2299                                         $$hash{$key}[2]  = $fwdfwsettings{'ACTIVE'};
2300                                         $$hash{$key}[3]  = $fwdfwsettings{'grp1'};
2301                                         $$hash{$key}[4]  = $fwdfwsettings{$fwdfwsettings{'grp1'}};
2302                                         $$hash{$key}[5]  = $fwdfwsettings{'grp2'};
2303                                         $$hash{$key}[6]  = $fwdfwsettings{$fwdfwsettings{'grp2'}};
2304                                         $$hash{$key}[7]  = $fwdfwsettings{'USE_SRC_PORT'};
2305                                         $$hash{$key}[8]  = $fwdfwsettings{'PROT'};
2306                                         $$hash{$key}[9]  = $fwdfwsettings{'ICMP_TYPES'};
2307                                         $$hash{$key}[10] = $fwdfwsettings{'SRC_PORT'};
2308                                         $$hash{$key}[11] = $fwdfwsettings{'USESRV'};
2309                                         $$hash{$key}[12] = $fwdfwsettings{'TGT_PROT'};
2310                                         $$hash{$key}[13] = $fwdfwsettings{'ICMP_TGT'};
2311                                         $$hash{$key}[14] = $fwdfwsettings{'grp3'};
2312                                         $$hash{$key}[15] = $fwdfwsettings{$fwdfwsettings{'grp3'}};
2313                                         $$hash{$key}[16] = $fwdfwsettings{'ruleremark'};
2314                                         $$hash{$key}[17] = $fwdfwsettings{'LOG'};
2315                                         $$hash{$key}[18] = $fwdfwsettings{'TIME'};
2316                                         $$hash{$key}[19] = $fwdfwsettings{'TIME_MON'};
2317                                         $$hash{$key}[20] = $fwdfwsettings{'TIME_TUE'};
2318                                         $$hash{$key}[21] = $fwdfwsettings{'TIME_WED'};
2319                                         $$hash{$key}[22] = $fwdfwsettings{'TIME_THU'};
2320                                         $$hash{$key}[23] = $fwdfwsettings{'TIME_FRI'};
2321                                         $$hash{$key}[24] = $fwdfwsettings{'TIME_SAT'};
2322                                         $$hash{$key}[25] = $fwdfwsettings{'TIME_SUN'};
2323                                         $$hash{$key}[26] = $fwdfwsettings{'TIME_FROM'};
2324                                         $$hash{$key}[27] = $fwdfwsettings{'TIME_TO'};
2325                                         $$hash{$key}[28] = $fwdfwsettings{'USE_NAT'};
2326                                         $$hash{$key}[29] = $fwdfwsettings{$fwdfwsettings{'nat'}};
2327                                         $$hash{$key}[30] = $fwdfwsettings{'dnatport'};
2328                                         $$hash{$key}[31] = $fwdfwsettings{'nat'};
2329                                         $$hash{$key}[32] = $fwdfwsettings{'LIMIT_CON_CON'};
2330                                         $$hash{$key}[33] = $fwdfwsettings{'concon'};
2331                                         $$hash{$key}[34] = $fwdfwsettings{'RATE_LIMIT'};
2332                                         $$hash{$key}[35] = $fwdfwsettings{'ratecon'};
2333                                         $$hash{$key}[36] = $fwdfwsettings{'RATETIME'};
2334                                         last;
2335                                 }
2336                         }
2337                 }
2338                 &General::writehasharray("$config", $hash);
2339                 if($fwdfwsettings{'oldrulenumber'} > $fwdfwsettings{'rulepos'}){
2340                         my %tmp=();
2341                         my $val=$fwdfwsettings{'oldrulenumber'}-$fwdfwsettings{'rulepos'};
2342                         for (my $z=0;$z<$val;$z++){
2343                                 foreach my $key (sort {$a <=> $b} keys %$hash){
2344                                         if ($key eq $fwdfwsettings{'oldrulenumber'}) {
2345                                                 my $last = $key -1;
2346                                                 if (exists $$hash{$last}){
2347                                                         #save rule last
2348                                                         foreach my $y (0 .. $#{$$hash{$last}}) {
2349                                                                 $tmp{0}[$y] = $$hash{$last}[$y];
2350                                                         }
2351                                                         #copy active rule to last
2352                                                         foreach my $i (0 .. $#{$$hash{$last}}) {
2353                                                                 $$hash{$last}[$i] = $$hash{$key}[$i];
2354                                                         }
2355                                                         #copy saved rule to actual position
2356                                                         foreach my $x (0 .. $#{$tmp{0}}) {
2357                                                                 $$hash{$key}[$x] = $tmp{0}[$x];
2358                                                         }
2359                                                 }
2360                                         }
2361                                 }
2362                                 $fwdfwsettings{'oldrulenumber'}--;
2363                         }
2364                         &General::writehasharray("$config", $hash);
2365                         &General::firewall_config_changed();
2366                 }elsif($fwdfwsettings{'rulepos'} > $fwdfwsettings{'oldrulenumber'}){
2367                         my %tmp=();
2368                         my $val=$fwdfwsettings{'rulepos'}-$fwdfwsettings{'oldrulenumber'};
2369                                 for (my $z=0;$z<$val;$z++){
2370                                         foreach my $key (sort {$a <=> $b} keys %$hash){
2371                                         if ($key eq $fwdfwsettings{'oldrulenumber'}) {
2372                                                 my $next = $key + 1;
2373                                                 if (exists $$hash{$next}){
2374                                                         #save rule next
2375                                                         foreach my $y (0 .. $#{$$hash{$next}}) {
2376                                                                 $tmp{0}[$y] = $$hash{$next}[$y];
2377                                                         }
2378                                                         #copy active rule to next
2379                                                         foreach my $i (0 .. $#{$$hash{$next}}) {
2380                                                                 $$hash{$next}[$i] = $$hash{$key}[$i];
2381                                                         }
2382                                                         #copy saved rule to actual position
2383                                                         foreach my $x (0 .. $#{$tmp{0}}) {
2384                                                                 $$hash{$key}[$x] = $tmp{0}[$x];
2385                                                         }
2386                                                 }
2387                                         }
2388                                 }
2389                                 $fwdfwsettings{'oldrulenumber'}++;
2390                         }
2391                         &General::writehasharray("$config", $hash);
2392                         &General::firewall_config_changed();
2393                 }
2394         }
2395 }
2396 sub validremark
2397 {
2398         # Checks a hostname against RFC1035
2399         my $remark = $_[0];
2400
2401         # Try to decode $remark into UTF-8. If this doesn't work,
2402         # we assume that the string it not sane.
2403         if (!utf8::decode($remark)) {
2404                 return 0;
2405         }
2406
2407         # Check if the string only contains of printable characters.
2408         if ($remark =~ /^[[:print:]]*$/) {
2409                 return 1;
2410         }
2411         return 0;
2412 }
2413 sub viewtablerule
2414 {
2415         &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
2416
2417         &viewtablenew(\%configfwdfw, $configfwdfw, $Lang::tr{'firewall rules'});
2418         &viewtablenew(\%configinputfw, $configinput, $Lang::tr{'incoming firewall access'});
2419         &viewtablenew(\%configoutgoingfw, $configoutgoing, $Lang::tr{'outgoing firewall access'});
2420 }
2421 sub viewtablenew
2422 {
2423         my $hash=shift;
2424         my $config=shift;
2425         my $title=shift;
2426         my $go='';
2427
2428         my $show_box = (! -z $config) || ($optionsfw{'SHOWTABLES'} eq 'on');
2429         return if (!$show_box);
2430
2431         &General::get_aliases(\%aliases);
2432         &General::readhasharray("$confighost", \%customhost);
2433         &General::readhasharray("$config", $hash);
2434         &General::readhasharray("$configccdnet", \%ccdnet);
2435         &General::readhasharray("$configccdhost", \%ccdhost);
2436         &General::readhasharray("$configgrp", \%customgrp);
2437         &General::readhasharray("$configsrvgrp", \%customservicegrp);
2438
2439         &Header::openbox('100%', 'left', $title);
2440         print "<table width='100%' cellspacing='0' class='tbl'>";
2441
2442         if (! -z $config) {
2443                 my $count=0;
2444                 my ($gif,$log);
2445                 my $ruletype;
2446                 my $rulecolor;
2447                 my $tooltip;
2448                 my @tmpsrc=();
2449                 my @tmptgt=();
2450                 my $coloryellow='';
2451
2452                 print <<END;
2453                                 <tr>
2454                                         <th align='right' width='3%'>
2455                                                 #
2456                                         </th>
2457                                         <th width='2%'></th>
2458                                         <th align='center'>
2459                                                 <b>$Lang::tr{'protocol'}</b>
2460                                         </th>
2461                                         <th align='center' width='30%'>
2462                                                 <b>$Lang::tr{'fwdfw source'}</b>
2463                                         </th>
2464                                         <th align='center'>
2465                                                 <b>$Lang::tr{'fwdfw log'}</b>
2466                                         </th>
2467                                         <th align='center' width='30%'>
2468                                                 <b>$Lang::tr{'fwdfw target'}</b>
2469                                         </th>
2470                                         <th align='center' colspan='6' width='18%'>
2471                                                 <b>$Lang::tr{'fwdfw action'}</b>
2472                                         </th>
2473                                 </tr>
2474 END
2475
2476                 foreach my $key (sort  {$a <=> $b} keys %$hash){
2477                         $tdcolor='';
2478                         @tmpsrc=();
2479                         @tmptgt=();
2480                         #check if vpn hosts/nets have been deleted
2481                         if($$hash{$key}[3] =~ /ipsec/i || $$hash{$key}[3] =~ /ovpn/i){
2482                                 push (@tmpsrc,$$hash{$key}[4]);
2483                         }
2484                         if($$hash{$key}[5] =~ /ipsec/i || $$hash{$key}[5] =~ /ovpn/i){
2485                                 push (@tmptgt,$$hash{$key}[6]);
2486                         }
2487                         foreach my $host (@tmpsrc){
2488                                 if($$hash{$key}[3] eq  'ipsec_net_src'){
2489                                         if(&fwlib::get_ipsec_net_ip($host,11) eq ''){
2490                                                 $coloryellow='on';
2491                                         }
2492                                 }elsif($$hash{$key}[3] eq  'ovpn_net_src'){
2493                                         if(&fwlib::get_ovpn_net_ip($host,1) eq ''){
2494                                                 $coloryellow='on';
2495                                         }
2496                                 }elsif($$hash{$key}[3] eq  'ovpn_n2n_src'){
2497                                         if(&fwlib::get_ovpn_n2n_ip($host,27) eq ''){
2498                                                 $coloryellow='on';
2499                                         }
2500                                 }elsif($$hash{$key}[3] eq  'ovpn_host_src'){
2501                                         if(&fwlib::get_ovpn_host_ip($host,33) eq ''){
2502                                                 $coloryellow='on';
2503                                         }
2504                                 }
2505                         }
2506                         foreach my $host (@tmptgt){
2507                                 if($$hash{$key}[5] eq 'ipsec_net_tgt'){
2508                                         if(&fwlib::get_ipsec_net_ip($host,11) eq ''){
2509                                                 $coloryellow='on';
2510                                         }
2511                                 }elsif($$hash{$key}[5] eq 'ovpn_net_tgt'){
2512                                         if(&fwlib::get_ovpn_net_ip($host,1) eq ''){
2513                                                 $coloryellow='on';
2514                                         }
2515                                 }elsif($$hash{$key}[5] eq 'ovpn_n2n_tgt'){
2516                                         if(&fwlib::get_ovpn_n2n_ip($host,27) eq ''){
2517                                                 $coloryellow='on';
2518                                         }
2519                                 }elsif($$hash{$key}[5] eq 'ovpn_host_tgt'){
2520                                         if(&fwlib::get_ovpn_host_ip($host,33) eq ''){
2521                                                 $coloryellow='on';
2522                                         }
2523                                 }
2524                         }
2525                         #check if networkgroups or servicegroups are empty
2526                         foreach my $netgroup (sort keys %customgrp){
2527                                 if(($$hash{$key}[4] eq $customgrp{$netgroup}[0] || $$hash{$key}[6] eq $customgrp{$netgroup}[0]) && $customgrp{$netgroup}[2] eq 'none'){
2528                                         $coloryellow='on';
2529                                 }
2530                         }
2531                         foreach my $srvgroup (sort keys %customservicegrp){
2532                                 if($$hash{$key}[15] eq $customservicegrp{$srvgroup}[0] && $customservicegrp{$srvgroup}[2] eq 'none'){
2533                                         $coloryellow='on';
2534                                 }
2535                         }
2536                         $$hash{'ACTIVE'}=$$hash{$key}[2];
2537                         $count++;
2538                         if($coloryellow eq 'on'){
2539                                 $color="$color{'color14'}";
2540                                 $coloryellow='';
2541                         }elsif($coloryellow eq ''){
2542                                 if ($count % 2){
2543                                         $color="$color{'color22'}";
2544                                 }
2545                                 else{
2546                                         $color="$color{'color20'}";
2547                                 }
2548                         }
2549                         print<<END;
2550                                 <tr bgcolor='$color'>
2551                                         <td align='right' width='3%'>
2552                                                 <b>$key&nbsp;</b>
2553                                         </td>
2554 END
2555
2556                         #RULETYPE (A,R,D)
2557                         if ($$hash{$key}[0] eq 'ACCEPT'){
2558                                 $ruletype='A';
2559                                 $tooltip='ACCEPT';
2560                                 $rulecolor=$color{'color17'};
2561                         }elsif($$hash{$key}[0] eq 'DROP'){
2562                                 $ruletype='D';
2563                                 $tooltip='DROP';
2564                                 $rulecolor=$color{'color25'};
2565                         }elsif($$hash{$key}[0] eq 'REJECT'){
2566                                 $ruletype='R';
2567                                 $tooltip='REJECT';
2568                                 $rulecolor=$color{'color16'};
2569                         }
2570
2571                         print <<END;
2572                                         <td bgcolor='$rulecolor' align='center' width='2%'>
2573                                                 <span title='$tooltip'>&nbsp;&nbsp;</span>
2574                                         </td>
2575 END
2576
2577                         #Get Protocol
2578                         my $prot;
2579                         if ($$hash{$key}[8]){
2580                                 if ($$hash{$key}[8] eq "IPv6"){
2581                                         push (@protocols,$Lang::tr{'fwdfw prot41 short'})
2582                                 }else{
2583                                         push (@protocols,$$hash{$key}[8]);
2584                                 }
2585                         }elsif($$hash{$key}[14] eq 'cust_srv'){
2586                                 &get_serviceports("service",$$hash{$key}[15]);
2587                         }elsif($$hash{$key}[14] eq 'cust_srvgrp'){
2588                                 &get_serviceports("group",$$hash{$key}[15]);
2589                         }else{
2590                                 push (@protocols,$Lang::tr{'all'});
2591                         }
2592
2593                         my $protz=join(", ",@protocols);
2594                         if($protz eq 'ICMP' && $$hash{$key}[9] ne 'All ICMP-Types' && $$hash{$key}[14] ne 'cust_srvgrp'){
2595                                 &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
2596                                 foreach my $keyicmp (sort { ncmp($icmptypes{$a}[0],$icmptypes{$b}[0]) }keys %icmptypes){
2597                                         if($$hash{$key}[9] eq "$icmptypes{$keyicmp}[0]"){
2598                                                 print "<td align='center'><span title='$icmptypes{$keyicmp}[0]'><b>$protz ($icmptypes{$keyicmp}[1])</b></span></td>";
2599                                                 last;
2600                                         }
2601                                 }
2602                         }elsif($#protocols gt '3'){
2603                                 print"<td align='center'><span title='$protz'>$Lang::tr{'fwdfw many'}</span></td>";
2604                         }else{
2605                                 print"<td align='center'>$protz</td>";
2606                         }
2607                         @protocols=();
2608                         #SOURCE
2609                         my $ipfireiface;
2610                         &getcolor($$hash{$key}[3],$$hash{$key}[4],\%customhost);
2611                         # Check SRC Host and replace "|" with space
2612                         if ($$hash{$key}[4] =~ /\|/){
2613                                 $$hash{$key}[4] =~ s/\|/ (/g;
2614                                 $$hash{$key}[4] = $$hash{$key}[4].")";
2615                         }
2616                         print"<td align='center' width='30%' $tdcolor>";
2617                         if ($$hash{$key}[3] eq 'ipfire_src'){
2618                                 $ipfireiface=$Lang::tr{'fwdfw iface'};
2619                         }
2620                         if ($$hash{$key}[3] eq 'std_net_src'){
2621                                 print &get_name($$hash{$key}[4]);
2622                         }elsif ($$hash{$key}[3] eq 'src_addr'){
2623                                 my ($split1,$split2) = split("/",$$hash{$key}[4]);
2624                                 if ($split2 eq '32'){
2625                                         print $split1;
2626                                 }else{
2627                                         print $$hash{$key}[4];
2628                                 }
2629                         }elsif ($$hash{$key}[3] eq 'cust_location_src') {
2630                                 my ($split1,$split2) = split(":", $$hash{$key}[4]);
2631                                 if ($split2) {
2632                                         print "$split2\n";
2633                                 }else{
2634                                         print "$Lang::tr{'location'}: $$hash{$key}[4]\n";
2635                                 }
2636                         }elsif ($$hash{$key}[4] eq 'RED1'){
2637                                 print "$ipfireiface $Lang::tr{'fwdfw red'}";
2638                         }elsif ($$hash{$key}[4] eq 'ALL'){
2639                                 print "$ipfireiface $Lang::tr{'all'}";
2640                         }else{
2641                                 if ($$hash{$key}[4] eq 'GREEN' || $$hash{$key}[4] eq 'ORANGE' || $$hash{$key}[4] eq 'BLUE' || $$hash{$key}[4] eq 'RED'){
2642                                         print "$ipfireiface $Lang::tr{lc($$hash{$key}[4])}";
2643                                 }else{
2644                                         print "$ipfireiface $$hash{$key}[4]";
2645                                 }
2646                         }
2647                         $tdcolor='';
2648                         #SOURCEPORT
2649                         &getsrcport(\%$hash,$key);
2650                         #Is this a SNAT rule?
2651                         if ($$hash{$key}[31] eq 'snat' && $$hash{$key}[28] eq 'ON'){
2652                                 my $net=&get_name($$hash{$key}[29]);
2653                                 if ( ! $net){ $net=$$hash{$key}[29];}
2654                                         print"<br>->$net";
2655                                 if ($$hash{$key}[30] ne ''){
2656                                         print": $$hash{$key}[30]";
2657                                 }
2658                         }
2659                         if ($$hash{$key}[17] eq 'ON'){
2660                                 $log="/images/on.gif";
2661                         }else{
2662                                 $log="/images/off.gif";
2663                         }
2664                         #LOGGING
2665                         print<<END;
2666                                         </td>
2667                                         <td align='center'>
2668                                                 <form method='POST' action=''>
2669                                                         <input type='image' img src='$log' alt='$Lang::tr{'click to disable'}' title='$Lang::tr{'fwdfw togglelog'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;'/>
2670                                                         <input type='hidden' name='key' value='$key' />
2671                                                         <input type='hidden' name='config' value='$config' />
2672                                                         <input type='hidden' name='ACTION' value='$Lang::tr{'fwdfw togglelog'}' />
2673                                                 </form>
2674                                         </td>
2675 END
2676                         #TARGET
2677                         &getcolor($$hash{$key}[5],$$hash{$key}[6],\%customhost);
2678                         print<<END;
2679                                         <td align='center' $tdcolor>
2680 END
2681                         # Check TGT Host and replace "|" with space
2682                         if ($$hash{$key}[6] =~ /\|/){
2683                                 $$hash{$key}[6] =~ s/\|/ (/g;
2684                                 $$hash{$key}[6] = $$hash{$key}[6].")";
2685                         }
2686                         #Is this a DNAT rule?
2687                         my $natstring;
2688                         if ($$hash{$key}[31] eq 'dnat' && $$hash{$key}[28] eq 'ON'){
2689                                 if ($$hash{$key}[29] eq 'Default IP'){$$hash{$key}[29]=$Lang::tr{'red1'};}
2690                                 if ($$hash{$key}[29] eq 'AUTO'){
2691                                         my @src_addresses=&fwlib::get_addresses(\%$hash,$key,'src');
2692                                         my @nat_ifaces;
2693                                         foreach my $val (@src_addresses){
2694                                                 push (@nat_ifaces,&fwlib::get_nat_address($$hash{$key}[29],$val));
2695                                         }
2696                                         @nat_ifaces=&del_double(@nat_ifaces);
2697                                         $natstring = "";
2698                                 }else{
2699                                         $natstring = "($$hash{$key}[29])";
2700                                 }
2701                                 print "$Lang::tr{'firewall'} $natstring";
2702                                 if($$hash{$key}[30] ne ''){
2703                                         $$hash{$key}[30]=~ tr/|/,/;
2704                                         print": $$hash{$key}[30]";
2705                                 }
2706                                 print"<br>-&gt;";
2707                         }
2708                         if ($$hash{$key}[5] eq 'std_net_tgt' || $$hash{$key}[5] eq 'ipfire'){
2709                                 if ($$hash{$key}[6] eq 'RED1'){
2710                                         print "$Lang::tr{'red1'}";
2711                                 }elsif ($$hash{$key}[6] eq 'GREEN' || $$hash{$key}[6] eq 'ORANGE' || $$hash{$key}[6] eq 'BLUE'|| $$hash{$key}[6] eq 'ALL' || $$hash{$key}[6] eq 'RED')
2712                                 {
2713                                         print &get_name($$hash{$key}[6]);
2714                                 }else{
2715                                         print $$hash{$key}[6];
2716                                 }
2717                         }elsif ($$hash{$key}[5] eq 'cust_location_tgt') {
2718                                 my ($split1,$split2) = split(":", $$hash{$key}[6]);
2719                                 if ($split2) {
2720                                         print "$split2\n";
2721                                 }else{
2722                                         print "$Lang::tr{'location'}: $$hash{$key}[6]\n";
2723                                 }
2724                         }elsif ($$hash{$key}[5] eq 'tgt_addr'){
2725                                 my ($split1,$split2) = split("/",$$hash{$key}[6]);
2726                                 if ($split2 eq '32'){
2727                                         print $split1;
2728                                 }else{
2729                                         print $$hash{$key}[6];
2730                                 }
2731                         }else{
2732                                 print "$$hash{$key}[6]";
2733                         }
2734                         $tdcolor='';
2735                         #TARGETPORT
2736                         &gettgtport(\%$hash,$key);
2737                         print"</td>";
2738                         #RULE ACTIVE
2739                         if($$hash{$key}[2] eq 'ON'){
2740                                 $gif="/images/on.gif"
2741                         }else{
2742                                 $gif="/images/off.gif"
2743                         }
2744                         print<<END;
2745                                 <td width='3%' align='center'>
2746                                         <form method='POST' action=''>
2747                                                 <input type='image' img src='$gif' alt='$Lang::tr{'click to disable'}' title='$Lang::tr{'fwdfw toggle'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;' />
2748                                                 <input type='hidden' name='key' value='$key' />
2749                                                 <input type='hidden' name='config' value='$config' />
2750                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'fwdfw toggle'}' />
2751                                         </form>
2752                                 </td>
2753                                 <td width='3%' align='center'>
2754                                         <form method='POST' action=''>
2755                                                 <input type='image' img src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'fwdfw edit'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'  />
2756                                                 <input type='hidden' name='key' value='$key' />
2757                                                 <input type='hidden' name='config' value='$config' />
2758                                                 <input type='hidden' name='ACTION' value='editrule' />
2759                                         </form>
2760                                 </td>
2761                                 <td width='3%' align='center'>
2762                                         <form method='POST' action=''>
2763                                                 <input type='image' img src='/images/addblue.gif' alt='$Lang::tr{'fwdfw copy'}' title='$Lang::tr{'fwdfw copy'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;' />
2764                                                 <input type='hidden' name='key' value='$key' />
2765                                                 <input type='hidden' name='config' value='$config' />
2766                                                 <input type='hidden' name='ACTION' value='copyrule' />
2767                                         </form>
2768                                 </td>
2769                                 <td width='3%' align='center'>
2770                                         <form method='POST' action=''>
2771                                                 <input type='image' img src='/images/delete.gif' alt='$Lang::tr{'delete'}' title='$Lang::tr{'fwdfw delete'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'   />
2772                                                 <input type='hidden' name='key' value='$key' />
2773                                                 <input type='hidden' name='config' value='$config' />
2774                                                 <input type='hidden' name='ACTION' value='deleterule' />
2775                                         </form>
2776                                 </td>
2777 END
2778                         if (exists $$hash{$key-1}){
2779                                 print<<END;
2780                                         <td width='3%' align='center'>
2781                                                 <form method='POST' action=''>
2782                                                         <input type='image' img src='/images/up.gif' alt='$Lang::tr{'fwdfw moveup'}' title='$Lang::tr{'fwdfw moveup'}'  style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'  />
2783                                                         <input type='hidden' name='key' value='$key' />
2784                                                         <input type='hidden' name='config' value='$config' />
2785                                                         <input type='hidden' name='ACTION' value='moveup' />
2786                                                 </form>
2787                                         </td>
2788 END
2789                         }else{
2790                                 print"<td width='3%'></td>";
2791                         }
2792
2793                         if (exists $$hash{$key+1}){
2794                                 print<<END;
2795                                         <td width='3%' align='center'>
2796                                                 <form method='POST' action=''>
2797                                                         <input type='image' img src='/images/down.gif' alt='$Lang::tr{'fwdfw movedown'}' title='$Lang::tr{'fwdfw movedown'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'  />
2798                                                         <input type='hidden' name='key' value='$key' />
2799                                                         <input type='hidden' name='config' value='$config' />
2800                                                         <input type='hidden' name='ACTION' value='movedown' />
2801                                                 </form>
2802                                         </td>
2803                                 </tr>
2804 END
2805                         }else{
2806                                 print"<td width='3%'></td></tr>";
2807                         }
2808                         #REMARK
2809                         if ($optionsfw{'SHOWREMARK'} eq 'on' && $$hash{$key}[16] ne ''){
2810                                 print <<END;
2811                                         <tr bgcolor='$color'>
2812                                                 <td>&nbsp;</td>
2813                                                 <td bgcolor='$rulecolor'></td>
2814                                                 <td colspan='10'>
2815                                                         &nbsp; <em>$$hash{$key}[16]</em>
2816                                                 </td>
2817                                         </tr>
2818 END
2819                         }
2820
2821                         if ($$hash{$key}[18] eq 'ON'){
2822                                 #TIMEFRAME
2823                                 if ($$hash{$key}[18] eq 'ON'){
2824                                         my @days=();
2825                                         if($$hash{$key}[19] ne ''){push (@days,$Lang::tr{'fwdfw wd_mon'});}
2826                                         if($$hash{$key}[20] ne ''){push (@days,$Lang::tr{'fwdfw wd_tue'});}
2827                                         if($$hash{$key}[21] ne ''){push (@days,$Lang::tr{'fwdfw wd_wed'});}
2828                                         if($$hash{$key}[22] ne ''){push (@days,$Lang::tr{'fwdfw wd_thu'});}
2829                                         if($$hash{$key}[23] ne ''){push (@days,$Lang::tr{'fwdfw wd_fri'});}
2830                                         if($$hash{$key}[24] ne ''){push (@days,$Lang::tr{'fwdfw wd_sat'});}
2831                                         if($$hash{$key}[25] ne ''){push (@days,$Lang::tr{'fwdfw wd_sun'});}
2832                                         my $weekdays=join(",",@days);
2833                                         if (@days){
2834                                                 print"<tr bgcolor='$color'>";
2835                                                 print"<td>&nbsp;</td><td bgcolor='$rulecolor'></td><td align='left' colspan='10'>&nbsp; $weekdays &nbsp; $$hash{$key}[26] - $$hash{$key}[27]</td></tr>";
2836                                         }
2837                                 }
2838                         }
2839                         print"<tr bgcolor='FFFFFF'><td colspan='13' height='1'></td></tr>";
2840                 }
2841         } elsif ($optionsfw{'SHOWTABLES'} eq 'on') {
2842                 print <<END;
2843                         <tr>
2844                                 <td colspan='7' height='30' bgcolor=$color{'color22'} align='center'>$Lang::tr{'fwhost empty'}</td>
2845                         </tr>
2846 END
2847         }
2848
2849         #SHOW FINAL RULE
2850         my $policy = 'fwdfw ' . $fwdfwsettings{'POLICY'};
2851         my $colour = "bgcolor='green'";
2852         if ($fwdfwsettings{'POLICY'} eq 'MODE1') {
2853                 $colour = "bgcolor='darkred'";
2854         }
2855
2856         my $message;
2857         if (($config eq '/var/ipfire/firewall/config') && ($fwdfwsettings{'POLICY'} ne 'MODE1')) {
2858                 print <<END;
2859                         <tr>
2860                                 <td colspan='13'>&nbsp;</td>
2861                         </tr>
2862                         <tr>
2863                                 <td colspan='13' style="padding-left:0px;padding-right:0px">
2864                                         <table width="100%" border='1' rules="cols" cellspacing='0'>
2865 END
2866
2867                 # GREEN
2868                 print <<END;
2869                         <tr>
2870                                 <td align='center'>
2871                                         <font color="$Header::colourgreen">$Lang::tr{'green'}</font>
2872                                 </td>
2873                                 <td align='center'>
2874                                         <font color="$Header::colourred">$Lang::tr{'red'}</font>
2875                                         ($Lang::tr{'fwdfw pol allow'})
2876                                 </td>
2877 END
2878
2879                 if (&Header::orange_used()) {
2880                         print <<END;
2881                                 <td align='center'>
2882                                         <font color="$Header::colourorange">$Lang::tr{'orange'}</font>
2883                                         ($Lang::tr{'fwdfw pol allow'})
2884                                 </td>
2885 END
2886                 }
2887
2888                 if (&Header::blue_used()) {
2889                         print <<END;
2890                                 <td align='center'>
2891                                         <font color="$Header::colourblue">$Lang::tr{'blue'}</font>
2892                                         ($Lang::tr{'fwdfw pol allow'})
2893                                 </td>
2894 END
2895                 }
2896
2897                 print"</tr>";
2898
2899                 # ORANGE
2900                 if (&Header::orange_used()) {
2901                         print <<END;
2902                                 <tr>
2903                                         <td align='center' width='20%'>
2904                                                 <font color="$Header::colourorange">$Lang::tr{'orange'}</font>
2905                                         </td>
2906                                         <td align='center'>
2907                                                 <font color="$Header::colourred">$Lang::tr{'red'}</font>
2908                                                 ($Lang::tr{'fwdfw pol allow'})
2909                                         </td>
2910                                         <td align='center'>
2911                                                 <font color="$Header::colourgreen">$Lang::tr{'green'}</font>
2912                                                 ($Lang::tr{'fwdfw pol block'})
2913                                         </td>
2914 END
2915
2916                         if (&Header::blue_used()) {
2917                                 print <<END;
2918                                         <td align='center'>
2919                                                 <font color="$Header::colourblue">$Lang::tr{'blue'}</font>
2920                                                 ($Lang::tr{'fwdfw pol block'})
2921                                         </td>
2922 END
2923                         }
2924
2925                         print"</tr>";
2926                 }
2927
2928                 if (&Header::blue_used()) {
2929                         print <<END;
2930                                 <tr>
2931                                         <td align='center'>
2932                                                 <font color="$Header::colourblue">$Lang::tr{'blue'}</font>
2933                                         </td>
2934                                         <td align='center'>
2935                                                 <font color="$Header::colourred">$Lang::tr{'red'}</font>
2936                                                 ($Lang::tr{'fwdfw pol allow'})
2937                                         </td>
2938 END
2939
2940                         if (&Header::orange_used()) {
2941                                 print <<END;
2942                                         <td align='center'>
2943                                                 <font color="$Header::colourorange">$Lang::tr{'orange'}</font>
2944                                                 ($Lang::tr{'fwdfw pol block'})
2945                                         </td>
2946 END
2947                         }
2948
2949                         print <<END;
2950                                         <td align='center'>
2951                                                 <font color="$Header::colourgreen">$Lang::tr{'green'}</font>
2952                                                 ($Lang::tr{'fwdfw pol block'})
2953                                         </td>
2954                                 </tr>
2955 END
2956                 }
2957
2958                 print <<END;
2959                                         </table>
2960                                 </td>
2961                         </tr>
2962 END
2963
2964                 $message = $Lang::tr{'fwdfw pol allow'};
2965
2966         } elsif ($config eq '/var/ipfire/firewall/outgoing' && ($fwdfwsettings{'POLICY1'} ne 'MODE1')) {
2967                 $message = $Lang::tr{'fwdfw pol allow'};
2968                 $colour = "bgcolor='green'";
2969         } else {
2970                 $message = $Lang::tr{'fwdfw pol block'};
2971                 $colour = "bgcolor='darkred'";
2972         }
2973
2974         if ($message) {
2975                 print <<END;
2976                         <tr>
2977                                 <td $colour align='center' colspan='13'>
2978                                         <font color='#FFFFFF'>$Lang::tr{'policy'}: $message</font>
2979                                 </td>
2980                         </tr>
2981 END
2982         }
2983
2984         print "</table>";
2985         print "<br>";
2986
2987         &Header::closebox();
2988 }
2989
2990 &Header::closebigbox();
2991 &Header::closepage();