html/cgi-bin/firewall.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2013 Alexander Marx <amarx@ipfire.org>                        #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 use strict;
  23 use Sort::Naturally;
  24 use utf8;
  25 use feature 'unicode_strings';
  26
  27 no warnings 'uninitialized';
  28
  29 # enable only the following on debugging purpose
  30 #use warnings;
  31 #use CGI::Carp 'fatalsToBrowser';
  32
  33 require '/var/ipfire/general-functions.pl';
  34 require "${General::swroot}/lang.pl";
  35 require "${General::swroot}/header.pl";
  36 require "${General::swroot}/geoip-functions.pl";
  37 require "/usr/lib/firewall/firewall-lib.pl";
  38
  39 unless (-d "${General::swroot}/firewall")                       { system("mkdir ${General::swroot}/firewall"); }
  40 unless (-e "${General::swroot}/firewall/settings")      { system("touch ${General::swroot}/firewall/settings"); }
  41 unless (-e "${General::swroot}/firewall/config")        { system("touch ${General::swroot}/firewall/config"); }
  42 unless (-e "${General::swroot}/firewall/input")         { system("touch ${General::swroot}/firewall/input"); }
  43 unless (-e "${General::swroot}/firewall/outgoing")      { system("touch ${General::swroot}/firewall/outgoing"); }
  44
  45 my %fwdfwsettings=();
  46 my %selected=() ;
  47 my %defaultNetworks=();
  48 my %netsettings=();
  49 my %customhost=();
  50 my %customgrp=();
  51 my %customgeoipgrp=();
  52 my %customnetworks=();
  53 my %customservice=();
  54 my %customservicegrp=();
  55 my %ccdnet=();
  56 my %customnetwork=();
  57 my %ccdhost=();
  58 my %configfwdfw=();
  59 my %configinputfw=();
  60 my %configoutgoingfw=();
  61 my %ipsecconf=();
  62 my %color=();
  63 my %mainsettings=();
  64 my %checked=();
  65 my %icmptypes=();
  66 my %ovpnsettings=();
  67 my %ipsecsettings=();
  68 my %aliases=();
  69 my %optionsfw=();
  70 my %ifaces=();
  71 my %rulehash=();
  72
  73 my @PROTOCOLS = ("TCP", "UDP", "ICMP", "IGMP", "AH", "ESP", "GRE","IPv6","IPIP");
  74
  75 my $color;
  76 my $confignet           = "${General::swroot}/fwhosts/customnetworks";
  77 my $confighost          = "${General::swroot}/fwhosts/customhosts";
  78 my $configgrp           = "${General::swroot}/fwhosts/customgroups";
  79 my $configgeoipgrp      = "${General::swroot}/fwhosts/customgeoipgrp";
  80 my $configsrv           = "${General::swroot}/fwhosts/customservices";
  81 my $configsrvgrp        = "${General::swroot}/fwhosts/customservicegrp";
  82 my $configccdnet        = "${General::swroot}/ovpn/ccd.conf";
  83 my $configccdhost       = "${General::swroot}/ovpn/ovpnconfig";
  84 my $configipsec         = "${General::swroot}/vpn/config";
  85 my $configipsecrw       = "${General::swroot}/vpn/settings";
  86 my $configfwdfw         = "${General::swroot}/firewall/config";
  87 my $configinput         = "${General::swroot}/firewall/input";
  88 my $configoutgoing      = "${General::swroot}/firewall/outgoing";
  89 my $configovpn          = "${General::swroot}/ovpn/settings";
  90 my $fwoptions           = "${General::swroot}/optionsfw/settings";
  91 my $ifacesettings       = "${General::swroot}/ethernet/settings";
  92 my $errormessage='';
  93 my $hint='';
  94 my $ipgrp="${General::swroot}/outgoing/groups";
  95 my $tdcolor='';
  96 my $checkorange='';
  97 my @protocols;
  98 &General::readhash("${General::swroot}/firewall/settings", \%fwdfwsettings);
  99 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
 100 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
 101 &General::readhash($fwoptions, \%optionsfw);
 102 &General::readhash($ifacesettings, \%ifaces);
 103 &General::readhash("$configovpn", \%ovpnsettings);
 104 &General::readhash("$configipsecrw", \%ipsecsettings);
 105 &General::readhasharray("$configipsec", \%ipsecconf);
 106 &Header::showhttpheaders();
 107 &Header::getcgihash(\%fwdfwsettings);
 108 &Header::openpage($Lang::tr{'firewall rules'}, 1, '');
 109 &Header::openbigbox('100%', 'center',$errormessage);
 110 #### JAVA SCRIPT ####
 111 print<<END;
 112 <script>
 113         var PROTOCOLS_WITH_PORTS = ["TCP", "UDP"];
 114
 115         var update_protocol = function() {
 116                 var protocol = \$("#protocol").val();
 117
 118                 if (protocol === undefined)
 119                         return;
 120
 121                 // Check if a template is/should be used.
 122                 if (protocol === "template") {
 123                         \$("#PROTOCOL_TEMPLATE").show();
 124                 } else {
 125                         \$("#PROTOCOL_TEMPLATE").hide();
 126                 }
 127
 128                 // Check if we are dealing with a protocol, that knows ports.
 129                 if (\$.inArray(protocol, PROTOCOLS_WITH_PORTS) >= 0) {
 130                         \$("#PROTOCOL_PORTS").show();
 131                 } else {
 132                         \$("#PROTOCOL_PORTS").hide();
 133                 }
 134
 135                 // Handle ICMP.
 136                 if (protocol === "ICMP") {
 137                         \$("#PROTOCOL_ICMP_TYPES").show();
 138                 } else {
 139                         \$("#PROTOCOL_ICMP_TYPES").hide();
 140                 }
 141         };
 142
 143         \$(document).ready(function() {
 144                 \$("#protocol").change(update_protocol);
 145                 update_protocol();
 146
 147                 // Show/Hide elements when NAT checkbox is checked.
 148                 if (\$("#USE_NAT").attr("checked")) {
 149                         \$("#actions").hide();
 150                 } else {
 151                         \$(".NAT").hide();
 152                 }
 153
 154                 // Show NAT area when "use nat" checkbox is clicked
 155                 \$("#USE_NAT").change(function() {
 156                         \$(".NAT").toggle();
 157                         \$("#actions").toggle();
 158                 });
 159
 160                 // Time constraints
 161                 if(!\$("#USE_TIME_CONSTRAINTS").attr("checked")) {
 162                         \$("#TIME_CONSTRAINTS").hide();
 163                 }
 164                 \$("#USE_TIME_CONSTRAINTS").change(function() {
 165                         \$("#TIME_CONSTRAINTS").toggle();
 166                 });
 167
 168                 // Limit concurrent connections per ip
 169                 if(!\$("#USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP").attr("checked")) {
 170                         \$("#LIMIT_CON").hide();
 171                 }
 172                 \$("#USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP").change(function() {
 173                         \$("#LIMIT_CON").toggle();
 174                 });
 175
 176                 // Rate-limit new connections
 177                 if(!\$("#USE_RATELIMIT").attr("checked")) {
 178                         \$("#RATELIMIT").hide();
 179                 }
 180                 \$("#USE_RATELIMIT").change(function() {
 181                         \$("#RATELIMIT").toggle();
 182                 });
 183
 184                 // Automatically select radio buttons when corresponding
 185                 // dropdown menu changes.
 186                 \$("select").change(function() {
 187                         var id = \$(this).attr("name");
 188                         \$('#' + id).prop("checked", true);
 189                 });
 190         });
 191 </script>
 192 END
 193
 194 ####  ACTION  #####
 195
 196 if ($fwdfwsettings{'ACTION'} eq 'saverule')
 197 {
 198         &General::readhasharray("$configfwdfw", \%configfwdfw);
 199         &General::readhasharray("$configinput", \%configinputfw);
 200         &General::readhasharray("$configoutgoing", \%configoutgoingfw);
 201         my $maxkey;
 202         #Set Variables according to the JQuery code in protocol section
 203         if ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP')
 204         {
 205                 if ($fwdfwsettings{'SRC_PORT'} ne '')
 206                 {
 207                         $fwdfwsettings{'USE_SRC_PORT'} = 'ON';
 208                 }
 209                 if ($fwdfwsettings{'TGT_PORT'} ne '')
 210                 {
 211                         $fwdfwsettings{'USESRV'} = 'ON';
 212                         $fwdfwsettings{'grp3'} = 'TGT_PORT';
 213                 }
 214         }
 215         if ($fwdfwsettings{'PROT'} eq 'template')
 216         {
 217                 $fwdfwsettings{'USESRV'} = 'ON';
 218         }
 219         $errormessage=&checksource;
 220         if(!$errormessage){&checktarget;}
 221         if(!$errormessage){&checkrule;}
 222
 223         #check if manual ip (source) is orange network
 224         if ($fwdfwsettings{'grp1'} eq 'src_addr'){
 225                 my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
 226                 if ( &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
 227                         $checkorange='on';
 228                 }
 229         }
 230         #check useless rules
 231         if(     ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'ORANGE' || $checkorange eq 'on') && $fwdfwsettings{'grp2'} eq 'ipfire'){
 232                 $errormessage.=$Lang::tr{'fwdfw useless rule'}."<br>";
 233         }
 234         #check if we try to break rules
 235         if(     $fwdfwsettings{'grp1'} eq 'ipfire_src' && $fwdfwsettings{'grp2'} eq 'ipfire'){
 236                 $errormessage=$Lang::tr{'fwdfw err same'};
 237         }
 238         # INPUT part
 239         if ($fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ORANGE'){
 240                 $fwdfwsettings{'config'}=$configinput;
 241                 $fwdfwsettings{'chain'} = 'INPUTFW';
 242                 $maxkey=&General::findhasharraykey(\%configinputfw);
 243                 %rulehash=%configinputfw;
 244         }elsif ($fwdfwsettings{'grp1'} eq 'ipfire_src' ){
 245         # OUTGOING PART
 246                 $fwdfwsettings{'config'}=$configoutgoing;
 247                 $fwdfwsettings{'chain'} = 'OUTGOINGFW';
 248                 $maxkey=&General::findhasharraykey(\%configoutgoingfw);
 249                 %rulehash=%configoutgoingfw;
 250         }else {
 251         # FORWARD PART
 252                 $fwdfwsettings{'config'}=$configfwdfw;
 253                 $fwdfwsettings{'chain'} = 'FORWARDFW';
 254                 $maxkey=&General::findhasharraykey(\%configfwdfw);
 255                 %rulehash=%configfwdfw;
 256         }
 257         #check if we have an identical rule already
 258         if($fwdfwsettings{'oldrulenumber'} eq $fwdfwsettings{'rulepos'}){
 259                 foreach my $key (sort keys %rulehash){
 260                         if (   "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'ruleremark'},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'},$fwdfwsettings{'LIMIT_CON_CON'},$fwdfwsettings{'concon'},$fwdfwsettings{'RATE_LIMIT'},$fwdfwsettings{'ratecon'},$fwdfwsettings{'RATETIME'}"
 261                                 eq "$rulehash{$key}[0],$rulehash{$key}[2],$rulehash{$key}[3],$rulehash{$key}[4],$rulehash{$key}[5],$rulehash{$key}[6],$rulehash{$key}[7],$rulehash{$key}[8],$rulehash{$key}[9],$rulehash{$key}[10],$rulehash{$key}[11],$rulehash{$key}[12],$rulehash{$key}[13],$rulehash{$key}[14],$rulehash{$key}[15],$rulehash{$key}[16],$rulehash{$key}[17],$rulehash{$key}[18],$rulehash{$key}[19],$rulehash{$key}[20],$rulehash{$key}[21],$rulehash{$key}[22],$rulehash{$key}[23],$rulehash{$key}[24],$rulehash{$key}[25],$rulehash{$key}[26],$rulehash{$key}[27],$rulehash{$key}[28],$rulehash{$key}[29],$rulehash{$key}[30],$rulehash{$key}[31],$rulehash{$key}[32],$rulehash{$key}[33],$rulehash{$key}[34],$rulehash{$key}[35],$rulehash{$key}[36]"){
 262                                         $errormessage.=$Lang::tr{'fwdfw err ruleexists'};
 263                                         if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){
 264                                                 $errormessage=$Lang::tr{'fwdfw err remark'}."<br>";
 265                                         }
 266                                         if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && &validremark($fwdfwsettings{'ruleremark'})){
 267                                                 $errormessage='';
 268                                         }
 269                                         if ($fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'}){
 270                                                 $fwdfwsettings{'nosave'} = 'on';
 271                                         }
 272                         }
 273                 }
 274         }
 275         #check Rulepos on new Rule
 276         if($fwdfwsettings{'rulepos'} > 0 && !$fwdfwsettings{'oldrulenumber'}){
 277                 $fwdfwsettings{'oldrulenumber'}=$maxkey;
 278                 foreach my $key (sort keys %rulehash){
 279                         if (   "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'},$fwdfwsettings{'LIMIT_CON_CON'},$fwdfwsettings{'concon'},$fwdfwsettings{'RATE_LIMIT'},$fwdfwsettings{'ratecon'},$fwdfwsettings{'RATETIME'}"
 280                                 eq "$rulehash{$key}[0],$rulehash{$key}[2],$rulehash{$key}[3],$rulehash{$key}[4],$rulehash{$key}[5],$rulehash{$key}[6],$rulehash{$key}[7],$rulehash{$key}[8],$rulehash{$key}[9],$rulehash{$key}[10],$rulehash{$key}[11],$rulehash{$key}[12],$rulehash{$key}[13],$rulehash{$key}[14],$rulehash{$key}[15],$rulehash{$key}[18],$rulehash{$key}[19],$rulehash{$key}[20],$rulehash{$key}[21],$rulehash{$key}[22],$rulehash{$key}[23],$rulehash{$key}[24],$rulehash{$key}[25],$rulehash{$key}[26],$rulehash{$key}[27],$rulehash{$key}[28],$rulehash{$key}[29],$rulehash{$key}[30],$rulehash{$key}[31],$rulehash{$key}[32],$rulehash{$key}[33],$rulehash{$key}[34],$rulehash{$key}[35],$rulehash{$key}[36]"){
 281                                         $errormessage.=$Lang::tr{'fwdfw err ruleexists'};
 282                         }
 283                 }
 284         }
 285         #check if we just close a rule
 286         if( $fwdfwsettings{'oldgrp1a'} eq  $fwdfwsettings{'grp1'} && $fwdfwsettings{'oldgrp1b'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'oldgrp2a'} eq  $fwdfwsettings{'grp2'} && $fwdfwsettings{'oldgrp2b'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} &&  $fwdfwsettings{'oldgrp3a'} eq $fwdfwsettings{'grp3'} && $fwdfwsettings{'oldgrp3b'} eq  $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'oldruletype'} eq $fwdfwsettings{'chain'}){
 287                 if($fwdfwsettings{'nosave'} eq 'on' && $fwdfwsettings{'updatefwrule'} eq 'on'){
 288                         $fwdfwsettings{'nosave2'} = 'on';
 289                         $errormessage='';
 290                 }
 291         }
 292         #check max concurrent connections per ip address
 293         if ($fwdfwsettings{'LIMIT_CON_CON'} eq 'ON'){
 294                 if (!($fwdfwsettings{'concon'} =~ /^(\d+)$/)) {
 295                         $errormessage.=$Lang::tr{'fwdfw err concon'};
 296                 }
 297         }else{
 298                 $fwdfwsettings{'concon'}='';
 299         }
 300         #check ratelimit value
 301         if ($fwdfwsettings{'RATE_LIMIT'} eq 'ON'){
 302                 if (!($fwdfwsettings{'ratecon'} =~ /^(\d+)$/)) {
 303                         $errormessage.=$Lang::tr{'fwdfw err ratecon'};
 304                 }
 305         }else{
 306                 $fwdfwsettings{'ratecon'}='';
 307         }
 308         #increase counters
 309         if (!$errormessage){
 310                 if ($fwdfwsettings{'nosave2'} ne 'on'){
 311                         &saverule(\%rulehash,$fwdfwsettings{'config'});
 312                 }
 313         }
 314         if ($errormessage){
 315                 &newrule;
 316         }else{
 317                 if($fwdfwsettings{'nosave2'} ne 'on'){
 318                         &General::firewall_config_changed();
 319                 }
 320                 &base;
 321         }
 322 }
 323 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw newrule'})
 324 {
 325         &newrule;
 326 }
 327 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw toggle'})
 328 {
 329         my %togglehash=();
 330         &General::readhasharray($fwdfwsettings{'config'}, \%togglehash);
 331         foreach my $key (sort keys %togglehash){
 332                 if ($key eq $fwdfwsettings{'key'}){
 333                         if ($togglehash{$key}[2] eq 'ON'){$togglehash{$key}[2]='';}else{$togglehash{$key}[2]='ON';}
 334                 }
 335         }
 336         &General::writehasharray($fwdfwsettings{'config'}, \%togglehash);
 337         &General::firewall_config_changed();
 338         &base;
 339 }
 340 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw togglelog'})
 341 {
 342         my %togglehash=();
 343         &General::readhasharray($fwdfwsettings{'config'}, \%togglehash);
 344         foreach my $key (sort keys %togglehash){
 345                 if ($key eq $fwdfwsettings{'key'}){
 346                         if ($togglehash{$key}[17] eq 'ON'){$togglehash{$key}[17]='';}else{$togglehash{$key}[17]='ON';}
 347                 }
 348         }
 349         &General::writehasharray($fwdfwsettings{'config'}, \%togglehash);
 350         &General::firewall_config_changed();
 351         &base;
 352 }
 353 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw reread'})
 354 {
 355         &General::firewall_reload();
 356         &base;
 357 }
 358 if ($fwdfwsettings{'ACTION'} eq 'editrule')
 359 {
 360         $fwdfwsettings{'updatefwrule'}='on';
 361         &newrule;
 362 }
 363 if ($fwdfwsettings{'ACTION'} eq 'deleterule')
 364 {
 365         &deleterule;
 366 }
 367 if ($fwdfwsettings{'ACTION'} eq 'moveup')
 368 {
 369         &pos_up;
 370         &base;
 371 }
 372 if ($fwdfwsettings{'ACTION'} eq 'movedown')
 373 {
 374         &pos_down;
 375         &base;
 376 }
 377 if ($fwdfwsettings{'ACTION'} eq 'copyrule')
 378 {
 379         $fwdfwsettings{'copyfwrule'}='on';
 380         &newrule;
 381 }
 382 if ($fwdfwsettings{'ACTION'} eq '' or $fwdfwsettings{'ACTION'} eq 'reset')
 383 {
 384         &base;
 385 }
 386 ###  Functions  ####
 387 sub addrule
 388 {
 389         &error;
 390
 391         &Header::openbox('100%', 'left', "");
 392         print <<END;
 393                 <form method="POST" action="">
 394                         <table border='0' width="100%">
 395                                 <tr>
 396                                         <td align='center'>
 397                                                 <input type='submit' name='ACTION' value='$Lang::tr{'fwdfw newrule'}'>
 398 END
 399
 400         if (&General::firewall_needs_reload()) {
 401                 print <<END;
 402                         <input type='submit' name='ACTION' value='$Lang::tr{'fwdfw reread'}' style='font-weight: bold; color: green;'>
 403 END
 404         }
 405
 406         print <<END;
 407                                         </td>
 408                                 </tr>
 409                         </table>
 410                 </form>
 411
 412                 <br>
 413 END
 414
 415         &Header::closebox();
 416         &viewtablerule;
 417 }
 418 sub base
 419 {
 420         &hint;
 421         &addrule;
 422 }
 423 sub changerule
 424 {
 425         my $oldchain=shift;
 426         $fwdfwsettings{'updatefwrule'}='';
 427         $fwdfwsettings{'config'}=$oldchain;
 428         $fwdfwsettings{'nobase'}='on';
 429         &deleterule;
 430 }
 431 sub checksource
 432 {
 433         my ($ip,$subnet);
 434         #check ip-address if manual
 435         if ($fwdfwsettings{'src_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'src_addr'} ne ''){
 436                 #check if ip with subnet
 437                 if ($fwdfwsettings{'src_addr'} =~ /^(.*?)\/(.*?)$/) {
 438                         ($ip,$subnet)=split (/\//,$fwdfwsettings{'src_addr'});
 439                         $subnet = &General::iporsubtocidr($subnet);
 440                         $fwdfwsettings{'isip'}='on';
 441                 }
 442                 #check if only ip
 443                 if($fwdfwsettings{'src_addr'}=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/){
 444                         $ip=$fwdfwsettings{'src_addr'};
 445                         $subnet = '32';
 446                         $fwdfwsettings{'isip'}='on';
 447                 }
 448
 449                 if ($fwdfwsettings{'isip'} ne 'on'){
 450                         if (&General::validmac($fwdfwsettings{'src_addr'})){
 451                                 $fwdfwsettings{'ismac'}='on';
 452                         }
 453                 }
 454                 if ($fwdfwsettings{'isip'} eq 'on'){
 455                         ##check if ip is valid
 456                         if (! &General::validip($ip)){
 457                                 $errormessage.=$Lang::tr{'fwdfw err src_addr'}."<br>";
 458                                 return $errormessage;
 459                         }
 460                         #check and form valid IP
 461                         $ip=&General::ip2dec($ip);
 462                         $ip=&General::dec2ip($ip);
 463                         #check if net or broadcast
 464                         $fwdfwsettings{'src_addr'}="$ip/$subnet";
 465                         if(!&General::validipandmask($fwdfwsettings{'src_addr'})){
 466                                 $errormessage.=$Lang::tr{'fwdfw err src_addr'}."<br>";
 467                                 return $errormessage;
 468                         }
 469                 }
 470                 if ($fwdfwsettings{'isip'} ne 'on' && $fwdfwsettings{'ismac'} ne 'on'){
 471                         $errormessage.=$Lang::tr{'fwdfw err src_addr'}."<br>";
 472                         return $errormessage;
 473                 }
 474         }elsif($fwdfwsettings{'src_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'src_addr'} eq ''){
 475                 $fwdfwsettings{'grp1'}='std_net_src';
 476                 $fwdfwsettings{$fwdfwsettings{'grp1'}} = 'ALL';
 477         }
 478
 479         #check empty fields
 480         if ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq ''){ $errormessage.=$Lang::tr{'fwdfw err nosrc'}."<br>";}
 481         if($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP') && $fwdfwsettings{'SRC_PORT'} ne ''){
 482                 my @parts=split(",",$fwdfwsettings{'SRC_PORT'});
 483                 my @values=();
 484                 foreach (@parts){
 485                         chomp($_);
 486                         if ($_ =~ /^(\d+)\-(\d+)$/ || $_ =~ /^(\d+)\:(\d+)$/) {
 487                                 my $check;
 488                                 #change dashes with :
 489                                 $_=~ tr/-/:/;
 490                                 if ($_ eq "*") {
 491                                         push(@values,"1:65535");
 492                                         $check='on';
 493                                 }
 494                                 if ($_ =~ /^(\D)\:(\d+)$/ || $_ =~ /^(\D)\-(\d+)$/) {
 495                                         push(@values,"1:$2");
 496                                         $check='on';
 497                                 }
 498                                 if ($_ =~ /^(\d+)\:(\D)$/ || $_ =~ /^(\d+)\-(\D)$/ ) {
 499                                         push(@values,"$1:65535");
 500                                         $check='on'
 501                                 }
 502                                 $errormessage .= &General::validportrange($_, 'destination');
 503                                 if(!$check){
 504                                         push (@values,$_);
 505                                 }
 506                         }else{
 507                                 if (&General::validport($_)){
 508                                         push (@values,$_);
 509                                 }else{
 510
 511                                 }
 512                         }
 513                 }
 514                 $fwdfwsettings{'SRC_PORT'}=join("|",@values);
 515         }
 516         return $errormessage;
 517 }
 518 sub checktarget
 519 {
 520         my ($ip,$subnet);
 521         &General::readhasharray("$configsrv", \%customservice);
 522         #check DNAT settings (has to be single Host and single Port or portrange)
 523         if ($fwdfwsettings{'USE_NAT'} eq 'ON' && $fwdfwsettings{'nat'} eq 'dnat'){
 524                 if($fwdfwsettings{'grp2'} eq 'tgt_addr' || $fwdfwsettings{'grp2'} eq 'cust_host_tgt' || $fwdfwsettings{'grp2'} eq 'ovpn_host_tgt'){
 525                         #check if manual ip is a single Host (if set)
 526                         if ($fwdfwsettings{'grp2'} eq 'tgt_addr'){
 527                                 my @tmp= split (/\./,$fwdfwsettings{$fwdfwsettings{'grp2'}});
 528                                 my @tmp1= split ("/",$tmp[3]);
 529                                 if (($tmp1[0] eq "0") || ($tmp1[0] eq "255"))
 530                                 {
 531                                         $errormessage=$Lang::tr{'fwdfw dnat error'}."<br>";
 532                                         return $errormessage;
 533                                 }
 534                         }
 535                         #check if Port is a single Port or portrange
 536                         if ($fwdfwsettings{'nat'} eq 'dnat' &&  $fwdfwsettings{'grp3'} eq 'TGT_PORT'){
 537                                 if(($fwdfwsettings{'PROT'} ne 'TCP'|| $fwdfwsettings{'PROT'} ne 'UDP') && $fwdfwsettings{'TGT_PORT'} eq ''){
 538                                         $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 539                                         return $errormessage;
 540                                 }
 541                                 if (($fwdfwsettings{'PROT'} eq 'TCP'|| $fwdfwsettings{'PROT'} eq 'UDP') && $fwdfwsettings{'TGT_PORT'} ne '' && !&check_natport($fwdfwsettings{'TGT_PORT'})){
 542                                         $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 543                                         return $errormessage;
 544                                 }
 545                         }
 546                 }else{
 547                         if ($fwdfwsettings{'grp2'} ne 'ipfire'){
 548                                 $errormessage=$Lang::tr{'fwdfw dnat error'}."<br>";
 549                                 return $errormessage;
 550                         }
 551                 }
 552         }
 553         if ($fwdfwsettings{'tgt_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'tgt_addr'} ne ''){
 554                 #check if ip with subnet
 555                 if ($fwdfwsettings{'tgt_addr'} =~ /^(.*?)\/(.*?)$/) {
 556                         ($ip,$subnet)=split (/\//,$fwdfwsettings{'tgt_addr'});
 557                         $subnet = &General::iporsubtocidr($subnet);
 558                 }
 559                 #check if only ip
 560                 if($fwdfwsettings{'tgt_addr'}=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/){
 561                         $ip=$fwdfwsettings{'tgt_addr'};
 562                         $subnet='32';
 563                 }
 564                 #check if ip is valid
 565                 if (! &General::validip($ip)){
 566                         $errormessage.=$Lang::tr{'fwdfw err tgt_addr'}."<br>";
 567                         return $errormessage;
 568                 }
 569                 #check and form valid IP
 570                 $ip=&General::ip2dec($ip);
 571                 $ip=&General::dec2ip($ip);
 572                 $fwdfwsettings{'tgt_addr'}="$ip/$subnet";
 573                 if(!&General::validipandmask($fwdfwsettings{'tgt_addr'})){
 574                         $errormessage.=$Lang::tr{'fwdfw err tgt_addr'}."<br>";
 575                         return $errormessage;
 576                 }
 577         }elsif($fwdfwsettings{'tgt_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'tgt_addr'} eq ''){
 578                 $fwdfwsettings{'grp2'}='std_net_tgt';
 579                 $fwdfwsettings{$fwdfwsettings{'grp2'}} = 'ALL';
 580         }
 581         #check for mac in targetgroup
 582         if ($fwdfwsettings{'grp2'} eq 'cust_grp_tgt'){
 583                 &General::readhasharray("$configgrp", \%customgrp);
 584                 &General::readhasharray("$confighost", \%customhost);
 585                 foreach my $grpkey (sort keys %customgrp){
 586                         foreach my $hostkey (sort keys %customhost){
 587                                 if ($customgrp{$grpkey}[2] eq $customhost{$hostkey}[0] && $customhost{$hostkey}[1] eq 'mac'){
 588                                         $hint=$Lang::tr{'fwdfw hint mac'};
 589                                         return $hint;
 590                                 }
 591                         }
 592                 }
 593         }
 594         #check empty fields
 595         if ($fwdfwsettings{$fwdfwsettings{'grp2'}} eq ''){ $errormessage.=$Lang::tr{'fwdfw err notgt'}."<br>";}
 596         #check tgt services
 597         if ($fwdfwsettings{'USESRV'} eq 'ON'){
 598                 if ($fwdfwsettings{'grp3'} eq 'cust_srv'){
 599                         $fwdfwsettings{'TGT_PROT'}='';
 600                         $fwdfwsettings{'ICMP_TGT'}='';
 601                         $fwdfwsettings{'TGT_PORT'}='';
 602                 }
 603                 if ($fwdfwsettings{'grp3'} eq 'cust_srvgrp'){
 604                         $fwdfwsettings{'TGT_PROT'}='';
 605                         $fwdfwsettings{'ICMP_TGT'}='';
 606                         $fwdfwsettings{'TGT_PORT'}='';
 607                         #check target service
 608                         if($fwdfwsettings{$fwdfwsettings{'grp3'}} eq ''){
 609                                 $errormessage.=$Lang::tr{'fwdfw err tgt_grp'};
 610                         }
 611                 }
 612                 if ($fwdfwsettings{'grp3'} eq 'TGT_PORT'){
 613                         if ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP'){
 614                                 if ($fwdfwsettings{'TGT_PORT'} ne ''){
 615                                         if ($fwdfwsettings{'TGT_PORT'} =~ "," && $fwdfwsettings{'USE_NAT'} && $fwdfwsettings{'nat'} eq 'dnat') {
 616                                                 $errormessage=$Lang::tr{'fwdfw dnat porterr'}."<br>";
 617                                                 return $errormessage;
 618                                         }
 619                                         my @parts=split(",",$fwdfwsettings{'TGT_PORT'});
 620                                         my @values=();
 621                                         foreach (@parts){
 622                                                 chomp($_);
 623                                                 if ($_ =~ /^(\d+)\-(\d+)$/ || $_ =~ /^(\d+)\:(\d+)$/) {
 624                                                         my $check;
 625                                                         #change dashes with :
 626                                                         $_=~ tr/-/:/;
 627                                                         if ($_ eq "*") {
 628                                                                 push(@values,"1:65535");
 629                                                                 $check='on';
 630                                                         }
 631                                                         if ($_ =~ /^(\D)\:(\d+)$/ || $_ =~ /^(\D)\-(\d+)$/) {
 632                                                                 push(@values,"1:$2");
 633                                                                 $check='on';
 634                                                         }
 635                                                         if ($_ =~ /^(\d+)\:(\D)$/ || $_ =~ /^(\d+)\-(\D)$/) {
 636                                                                 push(@values,"$1:65535");
 637                                                                 $check='on'
 638                                                         }
 639                                                         $errormessage .= &General::validportrange($_, 'destination');
 640                                                         if(!$check){
 641                                                                 push (@values,$_);
 642                                                         }
 643                                                 }else{
 644                                                         if (&General::validport($_)){
 645                                                                 push (@values,$_);
 646                                                         }else{
 647                                                                 $errormessage=$Lang::tr{'fwdfw err tgt_port'};
 648                                                                 return $errormessage;
 649                                                         }
 650                                                 }
 651                                         }
 652                                         $fwdfwsettings{'TGT_PORT'}=join("|",@values);
 653                                 }
 654                         }elsif ($fwdfwsettings{'PROT'} eq 'GRE'){
 655                                         $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 656                                         $fwdfwsettings{'TGT_PORT'} = '';
 657                                         $fwdfwsettings{'ICMP_TGT'} = '';
 658                         }elsif ($fwdfwsettings{'PROT'} eq 'ESP'){
 659                                         $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 660                                         $fwdfwsettings{'TGT_PORT'} = '';
 661                                         $fwdfwsettings{'ICMP_TGT'}='';
 662                         }elsif ($fwdfwsettings{'PROT'} eq 'AH'){
 663                                         $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 664                                         $fwdfwsettings{'TGT_PORT'} = '';
 665                                         $fwdfwsettings{'ICMP_TGT'}='';
 666                         }elsif ($fwdfwsettings{'PROT'} eq 'ICMP'){
 667                                 $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 668                                 $fwdfwsettings{'TGT_PORT'} = '';
 669                         }
 670                 }
 671         }
 672         #check targetport
 673         if ($fwdfwsettings{'USESRV'} ne 'ON'){
 674                 $fwdfwsettings{'grp3'}='';
 675                 $fwdfwsettings{$fwdfwsettings{'grp3'}}='';
 676                 $fwdfwsettings{'ICMP_TGT'}='';
 677         }
 678         #check timeframe
 679         if($fwdfwsettings{'TIME'} eq 'ON'){
 680                 if($fwdfwsettings{'TIME_MON'} eq '' && $fwdfwsettings{'TIME_TUE'} eq '' && $fwdfwsettings{'TIME_WED'} eq '' && $fwdfwsettings{'TIME_THU'} eq '' && $fwdfwsettings{'TIME_FRI'} eq '' && $fwdfwsettings{'TIME_SAT'} eq '' && $fwdfwsettings{'TIME_SUN'} eq ''){
 681                         $errormessage=$Lang::tr{'fwdfw err time'};
 682                         return $errormessage;
 683                 }
 684         }
 685         return $errormessage;
 686 }
 687 sub check_natport
 688 {
 689         my $val=shift;
 690         if($fwdfwsettings{'USE_NAT'} eq 'ON' && $fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){
 691                 if ($fwdfwsettings{'dnatport'} =~ /^(\d+)\-(\d+)$/) {
 692                         $fwdfwsettings{'dnatport'} =~ tr/-/:/;
 693                         if ($fwdfwsettings{'dnatport'} eq "*") {
 694                                 $fwdfwsettings{'dnatport'}="1:65535";
 695                         }
 696                         if ($fwdfwsettings{'dnatport'} =~ /^(\D)\:(\d+)$/) {
 697                                 $fwdfwsettings{'dnatport'} = "1:$2";
 698                         }
 699                         if ($fwdfwsettings{'dnatport'} =~ /^(\d+)\:(\D)$/) {
 700                                 $fwdfwsettings{'dnatport'} ="$1:65535";
 701                         }
 702                 }
 703                 return 1;
 704         }
 705         if ($val =~ "," || $val>65536 || $val<0){
 706                 return 0;
 707         }
 708         return 1;
 709 }
 710 sub checkrule
 711 {
 712         #check valid port for NAT
 713         if($fwdfwsettings{'USE_NAT'} eq 'ON'){
 714                 #RULE_ACTION must be ACCEPT if we use NAT
 715                 $fwdfwsettings{'RULE_ACTION'} = 'ACCEPT';
 716
 717                 #if no dnat or snat selected errormessage
 718                 if ($fwdfwsettings{'nat'} eq ''){
 719                         $errormessage=$Lang::tr{'fwdfw dnat nochoice'};
 720                         return;
 721                 }
 722
 723                 #if using snat, the external port has to be empty
 724                 if ($fwdfwsettings{'nat'} eq 'snat' && $fwdfwsettings{'dnatport'} ne ''){
 725                         $errormessage=$Lang::tr{'fwdfw dnat extport'};
 726                         return;
 727                 }
 728                 #if no dest port is given in nat area, take target host port
 729                 if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'TGT_PORT' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$fwdfwsettings{'TGT_PORT'};}
 730                 if($fwdfwsettings{'TGT_PORT'} eq '' && $fwdfwsettings{'dnatport'} ne '' && ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP')){
 731                         $errormessage=$Lang::tr{'fwdfw dnat porterr2'};
 732                         return;
 733                 }
 734                 #check if port given in nat area is a single valid port or portrange
 735                 if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'TGT_PORT'} ne '' && !&check_natport($fwdfwsettings{'dnatport'})){
 736                         $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 737                 }elsif($fwdfwsettings{'USESRV'} eq 'ON' && $fwdfwsettings{'grp3'} eq 'cust_srv'){
 738                         my $custsrvport;
 739                         #get service Protocol and Port
 740                         foreach my $key (sort keys %customservice){
 741                                 if($fwdfwsettings{$fwdfwsettings{'grp3'}} eq $customservice{$key}[0]){
 742                                         if ($customservice{$key}[2] ne 'TCP' && $customservice{$key}[2] ne 'UDP'){
 743                                                 $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 744                                         }
 745                                         $custsrvport= $customservice{$key}[1];
 746                                 }
 747                         }
 748                         if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$custsrvport;}
 749                 }
 750                 #check if DNAT port is multiple
 751                 if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){
 752                         my @parts=split(",",$fwdfwsettings{'dnatport'});
 753                                         my @values=();
 754                                         foreach (@parts){
 755                                                 chomp($_);
 756                                                 if ($_ =~ /^(\d+)\-(\d+)$/ || $_ =~ /^(\d+)\:(\d+)$/) {
 757                                                         my $check;
 758                                                         #change dashes with :
 759                                                         $_=~ tr/-/:/;
 760                                                         if ($_ eq "*") {
 761                                                                 push(@values,"1:65535");
 762                                                                 $check='on';
 763                                                         }
 764                                                         if ($_ =~ /^(\D)\:(\d+)$/ || $_ =~ /^(\D)\-(\d+)$/) {
 765                                                                 push(@values,"1:$2");
 766                                                                 $check='on';
 767                                                         }
 768                                                         if ($_ =~ /^(\d+)\:(\D)$/ || $_ =~ /^(\d+)\-(\D)$/) {
 769                                                                 push(@values,"$1:65535");
 770                                                                 $check='on'
 771                                                         }
 772                                                         $errormessage .= &General::validportrange($_, 'destination');
 773                                                         if(!$check){
 774                                                                 push (@values,$_);
 775                                                         }
 776                                                 }else{
 777                                                         if (&General::validport($_)){
 778                                                                 push (@values,$_);
 779                                                         }else{
 780
 781                                                         }
 782                                                 }
 783                                         }
 784                                         $fwdfwsettings{'dnatport'}=join("|",@values);
 785                 }
 786                 #check if a rule with prot tcp or udp and ports is edited and now prot is "all", then delete all ports
 787                 if($fwdfwsettings{'PROT'} eq ''){
 788                         $fwdfwsettings{'dnatport'}='';
 789                 }
 790         }
 791         #check valid remark
 792         if ($fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){
 793                 $errormessage.=$Lang::tr{'fwdfw err remark'}."<br>";
 794         }
 795         #check if source and target identical
 796         if ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ALL' && $fwdfwsettings{'grp2'} ne 'ipfire'){
 797                 $errormessage=$Lang::tr{'fwdfw err same'};
 798                 return $errormessage;
 799         }
 800         #get source and targetip address if possible
 801         my ($sip,$scidr,$tip,$tcidr);
 802         ($sip,$scidr)=&get_ip("src","grp1");
 803         ($tip,$tcidr)=&get_ip("tgt","grp2");
 804         #check same iprange in source and target
 805         if ($sip ne '' && $scidr ne '' && $tip ne '' && $tcidr ne ''){
 806                 my $networkip1=&General::getnetworkip($sip,$scidr);
 807                 my $networkip2=&General::getnetworkip($tip,$tcidr);
 808                 if ($scidr gt $tcidr){
 809                         if ( &General::IpInSubnet($networkip1,$tip,&General::iporsubtodec($tcidr))){
 810                                 $errormessage.=$Lang::tr{'fwdfw err samesub'};
 811                         }
 812                 }elsif($scidr eq $tcidr && $scidr eq '32'){
 813                         my ($sbyte1,$sbyte2,$sbyte3,$sbyte4)=split(/\./,$networkip1);
 814                         my ($tbyte1,$tbyte2,$tbyte3,$tbyte4)=split(/\./,$networkip2);
 815                                 if ($sbyte1 eq $tbyte1 && $sbyte2 eq $tbyte2 && $sbyte3 eq $tbyte3){
 816                                         $hint=$Lang::tr{'fwdfw hint ip1'}."<br>";
 817                                         $hint.=$Lang::tr{'fwdfw hint ip2'}." Source: $networkip1/$scidr Target: $networkip2/$tcidr<br>";
 818                                 }
 819                 }else{
 820                         if ( &General::IpInSubnet($networkip2,$sip,&General::iporsubtodec($scidr)) ){
 821                         $errormessage.=$Lang::tr{'fwdfw err samesub'};
 822                         }
 823                 }
 824         }
 825         #when icmp selected, no source and targetport allowed
 826         if (($fwdfwsettings{'PROT'} ne '' && $fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP' && $fwdfwsettings{'PROT'} ne 'template') && ($fwdfwsettings{'USESRV'} eq 'ON' || $fwdfwsettings{'USE_SRC_PORT'} eq 'ON')){
 827                 $errormessage.=$Lang::tr{'fwdfw err prot_port'};
 828                 return;
 829         }
 830         #change protocol if prot not equal dest single service
 831         if ($fwdfwsettings{'grp3'} eq 'cust_srv'){
 832                 foreach my $key (sort keys %customservice){
 833                         if($customservice{$key}[0] eq $fwdfwsettings{$fwdfwsettings{'grp3'}}){
 834                                 if ($customservice{$key}[2] ne $fwdfwsettings{'PROT'}){
 835                                         $fwdfwsettings{'PROT'} = $customservice{$key}[2];
 836                                         last;
 837                                 }
 838                         }
 839                 }
 840         }
 841         #check source and destination protocol if source manual and dest servicegroup
 842         if ($fwdfwsettings{'grp3'} eq 'cust_srvgrp'){
 843                 $fwdfwsettings{'PROT'} = '';
 844         }
 845         #ATTENTION: $fwdfwsetting{'TGT_PROT'} deprecated since 30.09.2013
 846         $fwdfwsettings{'TGT_PROT'}=''; #Set field empty (deprecated)
 847         #Check ICMP Types
 848         if ($fwdfwsettings{'PROT'} eq 'ICMP'){
 849                 $fwdfwsettings{'USE_SRC_PORT'}='';
 850                 $fwdfwsettings{'SRC_PORT'}='';
 851                 #$fwdfwsettings{'USESRV'}='';
 852                 $fwdfwsettings{'TGT_PORT'}='';
 853                 &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
 854                 foreach my $key (keys %icmptypes){
 855                         if($fwdfwsettings{'ICMP_TYPES'} eq "$icmptypes{$key}[0] ($icmptypes{$key}[1])"){
 856                                 $fwdfwsettings{'ICMP_TYPES'}="$icmptypes{$key}[0]";
 857                         }
 858                 }
 859         }elsif($fwdfwsettings{'PROT'} eq 'GRE'){
 860                 $fwdfwsettings{'USE_SRC_PORT'}='';
 861                 $fwdfwsettings{'SRC_PORT'}='';
 862                 $fwdfwsettings{'ICMP_TYPES'}='';
 863                 $fwdfwsettings{'USESRV'}='';
 864                 $fwdfwsettings{'TGT_PORT'}='';
 865         }elsif($fwdfwsettings{'PROT'} eq 'ESP'){
 866                 $fwdfwsettings{'USE_SRC_PORT'}='';
 867                 $fwdfwsettings{'SRC_PORT'}='';
 868                 $fwdfwsettings{'ICMP_TYPES'}='';
 869                 $fwdfwsettings{'USESRV'}='';
 870                 $fwdfwsettings{'TGT_PORT'}='';
 871         }elsif($fwdfwsettings{'PROT'} eq 'AH'){
 872                 $fwdfwsettings{'USE_SRC_PORT'}='';
 873                 $fwdfwsettings{'SRC_PORT'}='';
 874                 $fwdfwsettings{'ICMP_TYPES'}='';
 875                 $fwdfwsettings{'USESRV'}='';
 876                 $fwdfwsettings{'TGT_PORT'}='';
 877         }elsif($fwdfwsettings{'PROT'} eq 'IGMP'){
 878                 $fwdfwsettings{'USE_SRC_PORT'}='';
 879                 $fwdfwsettings{'SRC_PORT'}='';
 880                 $fwdfwsettings{'ICMP_TYPES'}='';
 881                 $fwdfwsettings{'USESRV'}='';
 882                 $fwdfwsettings{'TGT_PORT'}='';
 883         }elsif($fwdfwsettings{'PROT'} eq 'IPv6'){
 884                 $fwdfwsettings{'USE_SRC_PORT'}='';
 885                 $fwdfwsettings{'SRC_PORT'}='';
 886                 $fwdfwsettings{'ICMP_TYPES'}='';
 887                 $fwdfwsettings{'USESRV'}='';
 888                 $fwdfwsettings{'TGT_PORT'}='';
 889         }elsif($fwdfwsettings{'PROT'} eq 'IPIP'){
 890                 $fwdfwsettings{'USE_SRC_PORT'}='';
 891                 $fwdfwsettings{'SRC_PORT'}='';
 892                 $fwdfwsettings{'ICMP_TYPES'}='';
 893                 $fwdfwsettings{'USESRV'}='';
 894                 $fwdfwsettings{'TGT_PORT'}='';
 895         }elsif($fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP'){
 896                 $fwdfwsettings{'ICMP_TYPES'}='';
 897                 $fwdfwsettings{'SRC_PORT'}='';
 898                 $fwdfwsettings{'TGT_PORT'}='';
 899         }elsif($fwdfwsettings{'PROT'} ne 'ICMP'){
 900                 $fwdfwsettings{'ICMP_TYPES'}='';
 901         }
 902 }
 903 sub checkvpn
 904 {
 905         my $ip=shift;
 906         #Test if manual IP is part of static OpenVPN networks
 907         &General::readhasharray("$configccdnet", \%ccdnet);
 908         foreach my $key (sort keys %ccdnet){
 909                 my ($vpnip,$vpnsubnet) = split ("/",$ccdnet{$key}[1]);
 910                 my $sub=&General::iporsubtodec($vpnsubnet);
 911                 if (&General::IpInSubnet($ip,$vpnip,$sub)){
 912                         return 0;
 913                 }
 914         }
 915         # A Test if manual ip is part of dynamic openvpn subnet is made in getcolor
 916         # because if one creates a custom host with the ip, we need to check the color there!
 917         # It does not make sense to check this here
 918
 919         # Test if manual IP is part of an OpenVPN N2N subnet does also not make sense here
 920         # Is also checked in getcolor
 921
 922         # Test if manual ip is part of an IPsec Network is also checked in getcolor
 923         return 1;
 924 }
 925 sub checkvpncolor
 926 {
 927
 928 }
 929 sub deleterule
 930 {
 931         my %delhash=();
 932         &General::readhasharray($fwdfwsettings{'config'}, \%delhash);
 933         foreach my $key (sort {$a <=> $b} keys %delhash){
 934                 if ($key >= $fwdfwsettings{'key'}) {
 935                         my $next = $key + 1;
 936                         if (exists $delhash{$next}) {
 937                                 foreach my $i (0 .. $#{$delhash{$next}}) {
 938                                         $delhash{$key}[$i] = $delhash{$next}[$i];
 939                                 }
 940                         }
 941                 }
 942         }
 943         # Remove the very last entry.
 944         my $last_key = (sort {$a <=> $b} keys %delhash)[-1];
 945         delete $delhash{$last_key};
 946
 947         &General::writehasharray($fwdfwsettings{'config'}, \%delhash);
 948         &General::firewall_config_changed();
 949
 950         if($fwdfwsettings{'nobase'} ne 'on'){
 951                 &base;
 952         }
 953 }
 954 sub del_double
 955 {
 956         my %all=();
 957         @all{@_}=1;
 958         return (keys %all);
 959 }
 960 sub disable_rule
 961 {
 962         my $key1=shift;
 963         &General::readhasharray("$configfwdfw", \%configfwdfw);
 964         foreach my $key (sort keys %configfwdfw){
 965                         if ($key eq $key1 ){
 966                         if ($configfwdfw{$key}[2] eq 'ON'){$configfwdfw{$key}[2]='';}
 967                 }
 968         }
 969         &General::writehasharray("$configfwdfw", \%configfwdfw);
 970         &General::firewall_config_changed();
 971 }
 972 sub error
 973 {
 974         if ($errormessage) {
 975                 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
 976                 print "<class name='base'>$errormessage\n";
 977                 print "&nbsp;</class>\n";
 978                 &Header::closebox();
 979         }
 980 }
 981 sub fillselect
 982 {
 983         my %hash=%{(shift)};
 984         my $val=shift;
 985         my $key;
 986         foreach my $key (sort { ncmp($hash{$a}[0],$hash{$b}[0]) }  keys %hash){
 987                 if($hash{$key}[0] eq $val){
 988                         print"<option value='$hash{$key}[0]' selected>$hash{$key}[0]</option>";
 989                 }else{
 990                         print"<option value='$hash{$key}[0]'>$hash{$key}[0]</option>";
 991                 }
 992         }
 993 }
 994 sub gen_dd_block
 995 {
 996         my $srctgt = shift;
 997         my $grp=shift;
 998         my $helper='';
 999         my $show='';
1000         $checked{'grp1'}{$fwdfwsettings{'grp1'}}                                = 'CHECKED';
1001         $checked{'grp2'}{$fwdfwsettings{'grp2'}}                                = 'CHECKED';
1002         $checked{'grp3'}{$fwdfwsettings{'grp3'}}                                = 'CHECKED';
1003         $checked{'USE_SRC_PORT'}{$fwdfwsettings{'USE_SRC_PORT'}} = 'CHECKED';
1004         $checked{'USESRV'}{$fwdfwsettings{'USESRV'}}                    = 'CHECKED';
1005         $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}}                    = 'CHECKED';
1006         $checked{'LOG'}{$fwdfwsettings{'LOG'}}                                  = 'CHECKED';
1007         $checked{'TIME'}{$fwdfwsettings{'TIME'}}                                = 'CHECKED';
1008         $checked{'TIME_MON'}{$fwdfwsettings{'TIME_MON'}}                = 'CHECKED';
1009         $checked{'TIME_TUE'}{$fwdfwsettings{'TIME_TUE'}}                = 'CHECKED';
1010         $checked{'TIME_WED'}{$fwdfwsettings{'TIME_WED'}}                = 'CHECKED';
1011         $checked{'TIME_THU'}{$fwdfwsettings{'TIME_THU'}}                = 'CHECKED';
1012         $checked{'TIME_FRI'}{$fwdfwsettings{'TIME_FRI'}}                = 'CHECKED';
1013         $checked{'TIME_SAT'}{$fwdfwsettings{'TIME_SAT'}}                = 'CHECKED';
1014         $checked{'TIME_SUN'}{$fwdfwsettings{'TIME_SUN'}}                = 'CHECKED';
1015         $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}}             = 'selected';
1016         $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}}                 = 'selected';
1017         $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected';
1018         $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected';
1019 print<<END;
1020                 <table width='100%' border='0'>
1021                 <tr><td width='50%' valign='top'>
1022                 <table width='95%' border='0'>
1023                 <tr><td width='1%'><input type='radio' name='$grp' id='std_net_$srctgt' value='std_net_$srctgt' $checked{$grp}{'std_net_'.$srctgt}></td><td>$Lang::tr{'fwhost stdnet'}</td><td align='right'><select name='std_net_$srctgt' style='width:200px;'>
1024 END
1025         foreach my $network (sort keys %defaultNetworks)
1026                 {
1027                         next if($defaultNetworks{$network}{'NAME'} eq "IPFire");
1028                         print "<option value='$defaultNetworks{$network}{'NAME'}'";
1029                         print " selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $defaultNetworks{$network}{'NAME'});
1030                         my $defnet="$defaultNetworks{$network}{'NAME'}_NETADDRESS";
1031                         my $defsub="$defaultNetworks{$network}{'NAME'}_NETMASK";
1032                         my $defsub1=&General::subtocidr($ifaces{$defsub});
1033                         $ifaces{$defnet}='' if ($defaultNetworks{$network}{'NAME'} eq 'RED');
1034                         if ($ifaces{$defnet}){
1035                                 print ">$network ($ifaces{$defnet}/$defsub1)</option>";
1036                         }else{
1037                                 print ">$network</option>";
1038                         }
1039                 }
1040         print"</select></td></tr>";
1041         #custom networks
1042         if (! -z $confignet || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1043                 print"<tr><td><input type='radio' name='$grp' id='cust_net_$srctgt' value='cust_net_$srctgt' $checked{$grp}{'cust_net_'.$srctgt}></td><td>$Lang::tr{'fwhost cust net'}</td><td align='right'><select name='cust_net_$srctgt' style='width:200px;'>";
1044                 &fillselect(\%customnetwork,$fwdfwsettings{$fwdfwsettings{$grp}});
1045                 print"</select></td>";
1046         }
1047         #custom hosts
1048         if (! -z $confighost || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1049                 print"<tr><td><input type='radio' name='$grp' id='cust_host_$srctgt' value='cust_host_$srctgt' $checked{$grp}{'cust_host_'.$srctgt}></td><td>$Lang::tr{'fwhost cust addr'}</td><td align='right'><select name='cust_host_$srctgt' style='width:200px;'>";
1050                 &fillselect(\%customhost,$fwdfwsettings{$fwdfwsettings{$grp}});
1051                 print"</select></td>";
1052         }
1053         #custom groups
1054         if (! -z $configgrp || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1055                 print"<tr><td valign='top'><input type='radio' name='$grp' id='cust_grp_$srctgt' value='cust_grp_$srctgt' $checked{$grp}{'cust_grp_'.$srctgt}></td><td >$Lang::tr{'fwhost cust grp'}</td><td align='right'><select name='cust_grp_$srctgt' style='width:200px;'>";
1056                 foreach my $key (sort { ncmp($customgrp{$a}[0],$customgrp{$b}[0]) } keys %customgrp) {
1057                         if($helper ne $customgrp{$key}[0] && $customgrp{$key}[2] ne 'none'){
1058                                 print"<option ";
1059                                 print "selected='selected' " if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $customgrp{$key}[0]);
1060                                 print ">$customgrp{$key}[0]</option>";
1061                         }
1062                         $helper=$customgrp{$key}[0];
1063                 }
1064                 print"</select></td>";
1065         }
1066         # geoip locations / groups.
1067         my @geoip_locations = &fwlib::get_geoip_locations();
1068
1069         print "<tr>\n";
1070         print "<td valign='top'><input type='radio' name='$grp' id='cust_geoip_$srctgt' value='cust_geoip_$srctgt' $checked{$grp}{'cust_geoip_'.$srctgt}></td>\n";
1071         print "<td>$Lang::tr{'geoip'}</td>\n";
1072         print "<td align='right'><select name='cust_geoip_$srctgt' style='width:200px;'>\n";
1073
1074         # Add GeoIP groups to dropdown.
1075         if (!-z $configgeoipgrp) {
1076                 print "<optgroup label='$Lang::tr{'fwhost cust geoipgroup'}'>\n";
1077                 foreach my $key (sort { ncmp($customgeoipgrp{$a}[0],$customgeoipgrp{$b}[0]) } keys %customgeoipgrp) {
1078                         my $selected;
1079
1080                         # Generate stored value for select detection.
1081                         my $stored = join(':', "group",$customgeoipgrp{$key}[0]);
1082
1083                         # Only show a group once and group with elements.
1084                         if($helper ne $customgeoipgrp{$key}[0] && $customgeoipgrp{$key}[2] ne 'none') {
1085                                 # Mark current entry as selected.
1086                                 if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $stored) {
1087                                         $selected = "selected='selected'";
1088                                 }
1089                                 print"<option $selected value='group:$customgeoipgrp{$key}[0]'>$customgeoipgrp{$key}[0]</option>\n";
1090                         }
1091                         $helper=$customgeoipgrp{$key}[0];
1092                 }
1093                 print "</optgroup>\n";
1094         }
1095
1096         # Add locations.
1097         print "<optgroup label='$Lang::tr{'fwhost cust geoiplocation'}'>\n";
1098         foreach my $location (@geoip_locations) {
1099                 # Get country name.
1100                 my $country_name = &GeoIP::get_full_country_name($location);
1101
1102                 # Mark current entry as selected.
1103                 my $selected;
1104                 if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $location) {
1105                         $selected = "selected='selected'";
1106                 }
1107                 print "<option $selected value='$location'>$location - $country_name</option>\n";
1108         }
1109         print "</optgroup>\n";
1110
1111         # Close GeoIP dropdown.
1112         print "</select></td>\n";
1113
1114         #End left table. start right table (vpn)
1115         print"</tr></table></td><td valign='top'><table width='95%' border='0' align='right'><tr>";
1116         # CCD networks
1117         if( ! -z $configccdnet || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1118                 print"<td width='1%'><input type='radio' name='$grp' id='ovpn_net_$srctgt' value='ovpn_net_$srctgt'  $checked{$grp}{'ovpn_net_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ccdnet'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_net_$srctgt' style='width:200px;'>";
1119                 &fillselect(\%ccdnet,$fwdfwsettings{$fwdfwsettings{$grp}});
1120                 print"</select></td></tr>";
1121         }
1122         #OVPN CCD Hosts
1123         foreach my $key (sort { ncmp($ccdhost{$a}[0],$ccdhost{$b}[0]) } keys %ccdhost){
1124                 if ($ccdhost{$key}[33] ne '' ){
1125                         print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_host_$srctgt' value='ovpn_host_$srctgt' $checked{$grp}{'ovpn_host_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ccdhost'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_host_$srctgt' style='width:200px;'>" if ($show eq '');
1126                         $show='1';
1127                         print "<option value='$ccdhost{$key}[1]'";
1128                         print "selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $ccdhost{$key}[1]);
1129                         print ">$ccdhost{$key}[1]</option>";
1130                 }
1131         }
1132         if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){
1133                 print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_host_$srctgt' value='ovpn_host_$srctgt' $checked{$grp}{'ovpn_host_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ccdhost'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_host_$srctgt' style='width:200px;'></select></td></tr>" ;
1134         }
1135         if ($show eq '1'){$show='';print"</select></td></tr>";}
1136         #OVPN N2N
1137         foreach my $key (sort { ncmp($ccdhost{$a}[1],$ccdhost{$b}[1]) } keys %ccdhost){
1138                 if ($ccdhost{$key}[3] eq 'net'){
1139                         print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_n2n_$srctgt' value='ovpn_n2n_$srctgt' $checked{$grp}{'ovpn_n2n_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ovpn_n2n'}:</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_n2n_$srctgt' style='width:200px;'>" if ($show eq '');
1140                         $show='1';
1141                         print "<option value='$ccdhost{$key}[1]'";
1142                         print "selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $ccdhost{$key}[1]);
1143                         print ">$ccdhost{$key}[1]</option>";
1144                 }
1145         }
1146         if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){
1147                 print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_n2n_$srctgt' value='ovpn_n2n_$srctgt' $checked{$grp}{'ovpn_n2n_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ovpn_n2n'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_n2n_$srctgt' style='width:200px;'></select></td></tr>" ;
1148         }
1149         if ($show eq '1'){$show='';print"</select></td></tr>";}
1150         #IPsec netze
1151         foreach my $key (sort { ncmp($ipsecconf{$a}[1],$ipsecconf{$b}[1]) } keys %ipsecconf) {
1152                 if ($ipsecconf{$key}[3] eq 'net' || ($optionsfw{'SHOWDROPDOWN'} eq 'on' && $ipsecconf{$key}[3] ne 'host')){
1153                         print"<tr><td valign='top'><input type='radio' name='$grp' value='ipsec_net_$srctgt' $checked{$grp}{'ipsec_net_'.$srctgt}></td><td >$Lang::tr{'fwhost ipsec net'}</td><td align='right'><select name='ipsec_net_$srctgt' style='width:200px;'>" if ($show eq '');
1154                         $show='1';
1155                         print "<option ";
1156                         print "selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $ipsecconf{$key}[1]);
1157                         print ">$ipsecconf{$key}[1]</option>";
1158                 }
1159         }
1160         if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){
1161                 print"<tr><td valign='top'><input type='radio' name='$grp' id='ipsec_net_$srctgt' value='ipsec_net_$srctgt' $checked{$grp}{'ipsec_net_'.$srctgt}></td><td >$Lang::tr{'fwhost ipsec net'}</td><td align='right'><select name='ipsec_net_$srctgt' style='width:200px;'><select></td></tr>";
1162         }
1163         if ($show eq '1'){$show='';print"</select></td></tr>";}
1164
1165         print"</table>";
1166         print"</td></tr></table><br>";
1167 }
1168 sub get_ip
1169 {
1170         my $val=shift;
1171         my $grp =shift;
1172         my $a;
1173         my $b;
1174         &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
1175         if ($fwdfwsettings{$grp} ne $Lang::tr{'fwhost any'}){
1176                 if ($fwdfwsettings{$grp} eq $val.'_addr'){
1177                         ($a,$b)   = split (/\//, $fwdfwsettings{$fwdfwsettings{$grp}});
1178                 }elsif($fwdfwsettings{$grp} eq 'std_net_'.$val){
1179                         if ($fwdfwsettings{$fwdfwsettings{$grp}} =~ /Gr/i){
1180                                 $a=$netsettings{'GREEN_NETADDRESS'};
1181                                 $b=&General::iporsubtocidr($netsettings{'GREEN_NETMASK'});
1182                         }elsif($fwdfwsettings{$fwdfwsettings{$grp}} =~ /Ora/i){
1183                                 $a=$netsettings{'ORANGE_NETADDRESS'};
1184                                 $b=&General::iporsubtocidr($netsettings{'ORANGE_NETMASK'});
1185                         }elsif($fwdfwsettings{$fwdfwsettings{$grp}} =~ /Bl/i){
1186                                 $a=$netsettings{'BLUE_NETADDRESS'};
1187                                 $b=&General::iporsubtocidr($netsettings{'BLUE_NETMASK'});
1188                         }elsif($fwdfwsettings{$fwdfwsettings{$grp}} =~ /OpenVPN/i){
1189                                 &General::readhash("$configovpn",\%ovpnsettings);
1190                                 ($a,$b)   = split (/\//, $ovpnsettings{'DOVPN_SUBNET'});
1191                                 $b=&General::iporsubtocidr($b);
1192                         }
1193                 }elsif($fwdfwsettings{$grp} eq 'cust_net_'.$val){
1194                         &General::readhasharray("$confignet", \%customnetwork);
1195                         foreach my $key (keys %customnetwork){
1196                                 if($customnetwork{$key}[0] eq $fwdfwsettings{$fwdfwsettings{$grp}}){
1197                                         $a=$customnetwork{$key}[1];
1198                                         $b=&General::iporsubtocidr($customnetwork{$key}[2]);
1199                                 }
1200                         }
1201                 }elsif($fwdfwsettings{$grp} eq 'cust_host_'.$val){
1202                         &General::readhasharray("$confighost", \%customhost);
1203                         foreach my $key (keys %customhost){
1204                                 if($customhost{$key}[0] eq $fwdfwsettings{$fwdfwsettings{$grp}}){
1205                                         if ($customhost{$key}[1] eq 'ip'){
1206                                                 ($a,$b)=split (/\//,$customhost{$key}[2]);
1207                                                 $b=&General::iporsubtocidr($b);
1208                                         }else{
1209                                                 if ($grp eq 'grp2'){
1210                                                         $errormessage=$Lang::tr{'fwdfw err tgt_mac'};
1211                                                 }
1212                                         }
1213                                 }
1214                         }
1215                 }
1216         }
1217         return $a,$b;
1218 }
1219 sub get_name
1220 {
1221         my $val=shift;
1222         &General::setup_default_networks(\%defaultNetworks);
1223         foreach my $network (sort keys %defaultNetworks)
1224         {
1225                 return "$network" if ($val eq $defaultNetworks{$network}{'NAME'});
1226         }
1227 }
1228 sub getsrcport
1229 {
1230         my %hash=%{(shift)};
1231         my $key=shift;
1232         if($hash{$key}[7] eq 'ON' && $hash{$key}[10]){
1233                 $hash{$key}[10]=~ s/\|/,/g;
1234                 print": $hash{$key}[10]";
1235         }elsif($hash{$key}[7] eq 'ON' && $hash{$key}[8] eq 'ICMP'){
1236                 print": <br>$hash{$key}[9] ";
1237         }
1238 }
1239 sub gettgtport
1240 {
1241         my %hash=%{(shift)};
1242         my $key=shift;
1243         my $service;
1244         my $prot;
1245         if($hash{$key}[11] eq 'ON' && $hash{$key}[12] ne 'ICMP'){
1246                 if($hash{$key}[14] eq 'cust_srv'){
1247                         &General::readhasharray("$configsrv", \%customservice);
1248                         foreach my $i (sort keys %customservice){
1249                                 if($customservice{$i}[0] eq $hash{$key}[15]){
1250                                         $service = $customservice{$i}[0];
1251                                 }
1252                         }
1253                 }elsif($hash{$key}[14] eq 'cust_srvgrp'){
1254                         $service=$hash{$key}[15];
1255                 }elsif($hash{$key}[14] eq 'TGT_PORT'){
1256                         $hash{$key}[15]=~ s/\|/,/g;
1257                         $service=$hash{$key}[15];
1258                 }
1259                 if($service){
1260                         print": $service";
1261                 }
1262         }
1263 }
1264 sub get_serviceports
1265 {
1266         my $type=shift;
1267         my $name=shift;
1268         &General::readhasharray("$configsrv", \%customservice);
1269         &General::readhasharray("$configsrvgrp", \%customservicegrp);
1270         @protocols=();
1271         my @specprot=("IPIP","IPV6","IGMP","GRE","AH","ESP");
1272         if($type eq 'service'){
1273                 foreach my $key (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){
1274                         if ($customservice{$key}[0] eq $name){
1275                                 push (@protocols,$customservice{$key}[2]);
1276                         }
1277                 }
1278         }elsif($type eq 'group'){
1279                 foreach my $key (sort { ncmp($customservicegrp{$a}[0],$customservicegrp{$b}[0]) } keys %customservicegrp){
1280                         if ($customservicegrp{$key}[0] eq $name){
1281                                 if ($customservicegrp{$key}[2] ~~ @specprot){
1282                                         push (@protocols," ".$customservicegrp{$key}[2]);
1283                                 }else{
1284                                         foreach my $key1 (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){
1285                                                 if ($customservice{$key1}[0] eq $customservicegrp{$key}[2]){
1286                                                         if (!grep(/$customservice{$key1}[2]/, @protocols)){
1287                                                                 push (@protocols,$customservice{$key1}[2]);}
1288                                                 }
1289                                         }
1290                                 }
1291                         }
1292                 }
1293         }
1294
1295         # Sort protocols alphabetically.
1296         @protocols = sort(@protocols);
1297
1298         return @protocols;
1299 }
1300 sub getcolor
1301 {
1302         my $nettype=shift;
1303         my $val=shift;
1304         my $hash=shift;
1305         if($optionsfw{'SHOWCOLORS'} eq 'on'){
1306                 # Don't colourise MAC addresses
1307                 if (&General::validmac($val)) {
1308                         $tdcolor = "";
1309                         return;
1310                 }
1311
1312                 #custom Hosts
1313                 if ($nettype eq 'cust_host_src' || $nettype eq 'cust_host_tgt'){
1314                         foreach my $key (sort keys %$hash){
1315                                 if ($$hash{$key}[0] eq $val){
1316                                         $val=$$hash{$key}[2];
1317                                 }
1318                         }
1319                 }
1320                 #standard networks
1321                 if ($val eq 'GREEN'){
1322                         $tdcolor="style='background-color: $Header::colourgreen;color:white;'";
1323                         return;
1324                 }elsif ($val eq 'ORANGE'){
1325                         $tdcolor="style='background-color:  $Header::colourorange;color:white;'";
1326                         return;
1327                 }elsif ($val eq 'BLUE'){
1328                         $tdcolor="style='background-color: $Header::colourblue;color:white;'";
1329                         return;
1330                 }elsif ($val eq 'RED' ||$val eq 'RED1' ){
1331                         $tdcolor="style='background-color: $Header::colourred;color:white;'";
1332                         return;
1333                 }elsif ($val eq 'IPFire' ){
1334                         $tdcolor="style='background-color: $Header::colourred;color:white;'";
1335                         return;
1336                 }elsif ($val eq 'OpenVPN-Dyn' ){
1337                         $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1338                         return;
1339                 }elsif ($val eq 'IPsec RW' ){
1340                         $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1341                         return;
1342                 }elsif($val =~ /^(.*?)\/(.*?)$/){
1343                         my ($sip,$scidr) = split ("/",$val);
1344                         if ( &Header::orange_used() && &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
1345                                 $tdcolor="style='background-color: $Header::colourorange;color:white;'";
1346                                 return;
1347                         }
1348                         if ( &General::IpInSubnet($sip,$netsettings{'GREEN_ADDRESS'},$netsettings{'GREEN_NETMASK'})){
1349                                 $tdcolor="style='background-color: $Header::colourgreen;color:white;'";
1350                                 return;
1351                         }
1352                         if ( &Header::blue_used() && &General::IpInSubnet($sip,$netsettings{'BLUE_ADDRESS'},$netsettings{'BLUE_NETMASK'})){
1353                                 $tdcolor="style='background-color: $Header::colourblue;color:white;'";
1354                                 return;
1355                         }
1356                 }elsif ($val eq 'Default IP'){
1357                         $tdcolor="style='background-color: $Header::colourred;color:white;'";
1358                         return;
1359                 }
1360                 #Check if a manual IP or custom host is part of a VPN
1361                 if ($nettype eq 'src_addr' || $nettype eq 'tgt_addr' || $nettype eq 'cust_host_src' || $nettype eq 'cust_host_tgt'){
1362                         #Check if IP is part of OpenVPN dynamic subnet
1363                         my ($a,$b) = split("/",$ovpnsettings{'DOVPN_SUBNET'});
1364                         my ($c,$d) = split("/",$val);
1365                         if (&General::IpInSubnet($c,$a,$b)){
1366                                 $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1367                                 return;
1368                         }
1369                         #Check if IP is part of OpenVPN static subnet
1370                         foreach my $key (sort keys %ccdnet){
1371                                 my ($a,$b) = split("/",$ccdnet{$key}[1]);
1372                                 $b =&General::iporsubtodec($b);
1373                                 if (&General::IpInSubnet($c,$a,$b)){
1374                                         $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1375                                         return;
1376                                 }
1377                         }
1378                         #Check if IP is part of OpenVPN N2N subnet
1379                         foreach my $key (sort keys %ccdhost){
1380                                 if ($ccdhost{$key}[3] eq 'net'){
1381                                         my ($a,$b) = split("/",$ccdhost{$key}[11]);
1382                                         if (&General::IpInSubnet($c,$a,$b)){
1383                                                 $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1384                                                 return;
1385                                         }
1386                                 }
1387                         }
1388                         #Check if IP is part of IPsec RW network
1389                         if ($ipsecsettings{'RW_NET'} ne ''){
1390                                 my ($a,$b) = split("/",$ipsecsettings{'RW_NET'});
1391                                 $b=&General::iporsubtodec($b);
1392                                 if (&General::IpInSubnet($c,$a,$b)){
1393                                         $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1394                                         return;
1395                                 }
1396                         }
1397                         #Check if IP is part of a IPsec N2N network
1398                         foreach my $key (sort keys %ipsecconf){
1399                                 if ($ipsecconf{$key}[11]){
1400                                         my ($a,$b) = split("/",$ipsecconf{$key}[11]);
1401                                         $b=&General::iporsubtodec($b);
1402                                         if (&General::IpInSubnet($c,$a,$b)){
1403                                                 $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1404                                                 return;
1405                                         }
1406                                 }
1407                         }
1408                 }
1409                 #VPN networks
1410                 if ($nettype eq 'ovpn_n2n_src' || $nettype eq 'ovpn_n2n_tgt' || $nettype eq 'ovpn_net_src' || $nettype eq 'ovpn_net_tgt'|| $nettype eq 'ovpn_host_src' || $nettype eq 'ovpn_host_tgt'){
1411                         $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1412                         return;
1413                 }
1414                 if ($nettype eq 'ipsec_net_src' || $nettype eq 'ipsec_net_tgt'){
1415                         $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1416                         return;
1417                 }
1418                 #ALIASE
1419                 foreach my $alias (sort keys %aliases)
1420                 {
1421                         if ($val eq $alias){
1422                                 $tdcolor="style='background-color:$Header::colourred;color:white;'";
1423                                 return;
1424                         }
1425                 }
1426         }
1427         $tdcolor='';
1428         return;
1429 }
1430 sub hint
1431 {
1432         if ($hint) {
1433                 &Header::openbox('100%', 'left', $Lang::tr{'fwhost hint'});
1434                 print "<class name='base'>$hint\n";
1435                 print "&nbsp;</class>\n";
1436                 &Header::closebox();
1437         }
1438 }
1439 sub newrule
1440 {
1441         &error;
1442         &General::setup_default_networks(\%defaultNetworks);
1443         &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
1444         #read all configfiles
1445         &General::readhasharray("$configccdnet", \%ccdnet);
1446         &General::readhasharray("$confignet", \%customnetwork);
1447         &General::readhasharray("$configccdhost", \%ccdhost);
1448         &General::readhasharray("$confighost", \%customhost);
1449         &General::readhasharray("$configccdhost", \%ccdhost);
1450         &General::readhasharray("$configgrp", \%customgrp);
1451         &General::readhasharray("$configgeoipgrp", \%customgeoipgrp);
1452         &General::readhasharray("$configipsec", \%ipsecconf);
1453         &General::get_aliases(\%aliases);
1454         my %checked=();
1455         my $helper;
1456         my $sum=0;
1457         if($fwdfwsettings{'config'} eq ''){$fwdfwsettings{'config'}=$configfwdfw;}
1458         my $config=$fwdfwsettings{'config'};
1459         my %hash=();
1460         #Get Red IP-ADDRESS
1461         open (CONN1,"/var/ipfire/red/local-ipaddress");
1462         my $redip = <CONN1>;
1463         close(CONN1);
1464         if (! $fwdfwsettings{'RULE_ACTION'} && $fwdfwsettings{'POLICY'} eq 'MODE2'){
1465                 $fwdfwsettings{'RULE_ACTION'}='DROP';
1466         }elsif(! $fwdfwsettings{'RULE_ACTION'} && $fwdfwsettings{'POLICY'} eq 'MODE1'){
1467                 $fwdfwsettings{'RULE_ACTION'}='ACCEPT';
1468         }
1469         $checked{'grp1'}{$fwdfwsettings{'grp1'}}                                = 'CHECKED';
1470         $checked{'grp2'}{$fwdfwsettings{'grp2'}}                                = 'CHECKED';
1471         $checked{'grp3'}{$fwdfwsettings{'grp3'}}                                = 'CHECKED';
1472         $checked{'USE_SRC_PORT'}{$fwdfwsettings{'USE_SRC_PORT'}} = 'CHECKED';
1473         $checked{'USESRV'}{$fwdfwsettings{'USESRV'}}                    = 'CHECKED';
1474         $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}}                    = 'CHECKED';
1475         $checked{'LOG'}{$fwdfwsettings{'LOG'}}                                  = 'CHECKED';
1476         $checked{'TIME'}{$fwdfwsettings{'TIME'}}                                = 'CHECKED';
1477         $checked{'TIME_MON'}{$fwdfwsettings{'TIME_MON'}}                = 'CHECKED';
1478         $checked{'TIME_TUE'}{$fwdfwsettings{'TIME_TUE'}}                = 'CHECKED';
1479         $checked{'TIME_WED'}{$fwdfwsettings{'TIME_WED'}}                = 'CHECKED';
1480         $checked{'TIME_THU'}{$fwdfwsettings{'TIME_THU'}}                = 'CHECKED';
1481         $checked{'TIME_FRI'}{$fwdfwsettings{'TIME_FRI'}}                = 'CHECKED';
1482         $checked{'TIME_SAT'}{$fwdfwsettings{'TIME_SAT'}}                = 'CHECKED';
1483         $checked{'TIME_SUN'}{$fwdfwsettings{'TIME_SUN'}}                = 'CHECKED';
1484         $checked{'USE_NAT'}{$fwdfwsettings{'USE_NAT'}}                  = 'CHECKED';
1485         $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}}             = 'selected';
1486         $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}}                 = 'selected';
1487         $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected';
1488         $selected{'ipfire_src'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected';
1489         #check if update and get values
1490         if($fwdfwsettings{'updatefwrule'} eq 'on' || $fwdfwsettings{'copyfwrule'} eq 'on' && !$errormessage){
1491                 &General::readhasharray("$config", \%hash);
1492                 foreach my $key (sort keys %hash){
1493                         $sum++;
1494                         if ($key eq $fwdfwsettings{'key'}){
1495                                 $fwdfwsettings{'oldrulenumber'}                 = $fwdfwsettings{'key'};
1496                                 $fwdfwsettings{'RULE_ACTION'}                   = $hash{$key}[0];
1497                                 $fwdfwsettings{'chain'}                                 = $hash{$key}[1];
1498                                 $fwdfwsettings{'ACTIVE'}                                = $hash{$key}[2];
1499                                 $fwdfwsettings{'grp1'}                                  = $hash{$key}[3];
1500                                 $fwdfwsettings{$fwdfwsettings{'grp1'}}  = $hash{$key}[4];
1501                                 $fwdfwsettings{'grp2'}                                  = $hash{$key}[5];
1502                                 $fwdfwsettings{$fwdfwsettings{'grp2'}}  = $hash{$key}[6];
1503                                 $fwdfwsettings{'USE_SRC_PORT'}                  = $hash{$key}[7];
1504                                 $fwdfwsettings{'PROT'}                                  = $hash{$key}[8];
1505                             $fwdfwsettings{'ICMP_TYPES'}                        = $hash{$key}[9];
1506                             $fwdfwsettings{'SRC_PORT'}                          = $hash{$key}[10];
1507                             $fwdfwsettings{'USESRV'}                            = $hash{$key}[11];
1508                             $fwdfwsettings{'TGT_PROT'}                          = $hash{$key}[12];
1509                             $fwdfwsettings{'ICMP_TGT'}                          = $hash{$key}[13];
1510                             $fwdfwsettings{'grp3'}                                      = $hash{$key}[14];
1511                             $fwdfwsettings{$fwdfwsettings{'grp3'}}      = $hash{$key}[15];
1512                             $fwdfwsettings{'ruleremark'}                        = $hash{$key}[16];
1513                             $fwdfwsettings{'LOG'}                                       = $hash{$key}[17];
1514                             $fwdfwsettings{'TIME'}                                      = $hash{$key}[18];
1515                                 $fwdfwsettings{'TIME_MON'}                              = $hash{$key}[19];
1516                                 $fwdfwsettings{'TIME_TUE'}                              = $hash{$key}[20];
1517                                 $fwdfwsettings{'TIME_WED'}                              = $hash{$key}[21];
1518                                 $fwdfwsettings{'TIME_THU'}                              = $hash{$key}[22];
1519                                 $fwdfwsettings{'TIME_FRI'}                              = $hash{$key}[23];
1520                                 $fwdfwsettings{'TIME_SAT'}                              = $hash{$key}[24];
1521                                 $fwdfwsettings{'TIME_SUN'}                              = $hash{$key}[25];
1522                                 $fwdfwsettings{'TIME_FROM'}                             = $hash{$key}[26];
1523                                 $fwdfwsettings{'TIME_TO'}                               = $hash{$key}[27];
1524                                 $fwdfwsettings{'USE_NAT'}                               = $hash{$key}[28];
1525                                 $fwdfwsettings{'nat'}                                   = $hash{$key}[31]; #changed order
1526                                 $fwdfwsettings{$fwdfwsettings{'nat'}}   = $hash{$key}[29];
1527                                 $fwdfwsettings{'dnatport'}                              = $hash{$key}[30];
1528                                 $fwdfwsettings{'LIMIT_CON_CON'}                 = $hash{$key}[32];
1529                                 $fwdfwsettings{'concon'}                                = $hash{$key}[33];
1530                                 $fwdfwsettings{'RATE_LIMIT'}                    = $hash{$key}[34];
1531                                 $fwdfwsettings{'ratecon'}                               = $hash{$key}[35];
1532                                 $fwdfwsettings{'RATETIME'}                              = $hash{$key}[36];
1533                                 $checked{'grp1'}{$fwdfwsettings{'grp1'}}                                = 'CHECKED';
1534                                 $checked{'grp2'}{$fwdfwsettings{'grp2'}}                                = 'CHECKED';
1535                                 $checked{'grp3'}{$fwdfwsettings{'grp3'}}                                = 'CHECKED';
1536                                 $checked{'USE_SRC_PORT'}{$fwdfwsettings{'USE_SRC_PORT'}} = 'CHECKED';
1537                                 $checked{'USESRV'}{$fwdfwsettings{'USESRV'}}                    = 'CHECKED';
1538                                 $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}}                    = 'CHECKED';
1539                                 $checked{'LOG'}{$fwdfwsettings{'LOG'}}                                  = 'CHECKED';
1540                                 $checked{'TIME'}{$fwdfwsettings{'TIME'}}                                = 'CHECKED';
1541                                 $checked{'TIME_MON'}{$fwdfwsettings{'TIME_MON'}}                = 'CHECKED';
1542                                 $checked{'TIME_TUE'}{$fwdfwsettings{'TIME_TUE'}}                = 'CHECKED';
1543                                 $checked{'TIME_WED'}{$fwdfwsettings{'TIME_WED'}}                = 'CHECKED';
1544                                 $checked{'TIME_THU'}{$fwdfwsettings{'TIME_THU'}}                = 'CHECKED';
1545                                 $checked{'TIME_FRI'}{$fwdfwsettings{'TIME_FRI'}}                = 'CHECKED';
1546                                 $checked{'TIME_SAT'}{$fwdfwsettings{'TIME_SAT'}}                = 'CHECKED';
1547                                 $checked{'TIME_SUN'}{$fwdfwsettings{'TIME_SUN'}}                = 'CHECKED';
1548                                 $checked{'USE_NAT'}{$fwdfwsettings{'USE_NAT'}}                  = 'CHECKED';
1549                                 $checked{'nat'}{$fwdfwsettings{'nat'}}                                  = 'CHECKED';
1550                                 $checked{'LIMIT_CON_CON'}{$fwdfwsettings{'LIMIT_CON_CON'}}      = 'CHECKED';
1551                                 $checked{'RATE_LIMIT'}{$fwdfwsettings{'RATE_LIMIT'}}    = 'CHECKED';
1552                                 $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}}             = 'selected';
1553                                 $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}}                 = 'selected';
1554                                 $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected';
1555                                 $selected{'ipfire_src'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected';
1556                                 $selected{'dnat'}{$fwdfwsettings{'dnat'}}                               ='selected';
1557                                 $selected{'snat'}{$fwdfwsettings{'snat'}}                               ='selected';
1558                                 $selected{'RATETIME'}{$fwdfwsettings{'RATETIME'}}               ='selected';
1559                         }
1560                 }
1561                 $fwdfwsettings{'oldgrp1a'}=$fwdfwsettings{'grp1'};
1562                 $fwdfwsettings{'oldgrp1b'}=$fwdfwsettings{$fwdfwsettings{'grp1'}};
1563                 $fwdfwsettings{'oldgrp2a'}=$fwdfwsettings{'grp2'};
1564                 $fwdfwsettings{'oldgrp2b'}=$fwdfwsettings{$fwdfwsettings{'grp2'}};
1565                 $fwdfwsettings{'oldgrp3a'}=$fwdfwsettings{'grp3'};
1566                 $fwdfwsettings{'oldgrp3b'}=$fwdfwsettings{$fwdfwsettings{'grp3'}};
1567                 $fwdfwsettings{'oldusesrv'}=$fwdfwsettings{'USESRV'};
1568                 $fwdfwsettings{'oldruleremark'}=$fwdfwsettings{'ruleremark'};
1569                 $fwdfwsettings{'oldnat'}=$fwdfwsettings{'USE_NAT'};
1570                 $fwdfwsettings{'oldruletype'}=$fwdfwsettings{'chain'};
1571                 $fwdfwsettings{'oldconcon'}=$fwdfwsettings{'LIMIT_CON_CON'};
1572                 $fwdfwsettings{'olduseratelimit'}=$fwdfwsettings{'RATE_LIMIT'};
1573                 $fwdfwsettings{'olduseratelimitamount'}=$fwdfwsettings{'ratecon'};
1574                 $fwdfwsettings{'oldratelimittime'}=$fwdfwsettings{'RATETIME'};
1575
1576                 #check if manual ip (source) is orange network
1577                 if ($fwdfwsettings{'grp1'} eq 'src_addr'){
1578                         my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
1579                         if ( &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
1580                                 $fwdfwsettings{'oldorange'} ='on';
1581                         }
1582                 }
1583         }else{
1584                 $fwdfwsettings{'ACTIVE'}='ON';
1585                 $fwdfwsettings{'nat'} = 'dnat';
1586                 $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}} = 'CHECKED';
1587                 $checked{'nat'}{$fwdfwsettings{'nat'}} = 'CHECKED';
1588                 $fwdfwsettings{'oldgrp1a'}=$fwdfwsettings{'grp1'};
1589                 $fwdfwsettings{'oldgrp1b'}=$fwdfwsettings{$fwdfwsettings{'grp1'}};
1590                 $fwdfwsettings{'oldgrp2a'}=$fwdfwsettings{'grp2'};
1591                 $fwdfwsettings{'oldgrp2b'}=$fwdfwsettings{$fwdfwsettings{'grp2'}};
1592                 $fwdfwsettings{'oldgrp3a'}=$fwdfwsettings{'grp3'};
1593                 $fwdfwsettings{'oldgrp3b'}=$fwdfwsettings{$fwdfwsettings{'grp3'}};
1594                 $fwdfwsettings{'oldusesrv'}=$fwdfwsettings{'USESRV'};
1595                 $fwdfwsettings{'oldruleremark'}=$fwdfwsettings{'ruleremark'};
1596                 $fwdfwsettings{'oldnat'}=$fwdfwsettings{'USE_NAT'};
1597                 $fwdfwsettings{'oldconcon'}=$fwdfwsettings{'LIMIT_CON_CON'};
1598                 #check if manual ip (source) is orange network
1599                 if ($fwdfwsettings{'grp1'} eq 'src_addr'){
1600                         my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
1601                         if ( &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
1602                                 $fwdfwsettings{'oldorange'} ='on';
1603                         }
1604                 }
1605         }
1606         # Split manual source and target address and delete the subnet
1607         my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
1608         if ($scidr eq '32'){$fwdfwsettings{$fwdfwsettings{'grp1'}}=$sip;}
1609         my ($dip,$dcidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp2'}});
1610         if ($dcidr eq '32'){$fwdfwsettings{$fwdfwsettings{'grp2'}}=$dip;}
1611         &Header::openbox('100%', 'left', $Lang::tr{'fwdfw source'});
1612         #------SOURCE-------------------------------------------------------
1613         print "<form method='post'>";
1614         print<<END;
1615                 <table width='100%' border='0'>
1616                 <tr><td width='1%'><input type='radio' name='grp1' value='src_addr'  checked></td><td width='60%'>$Lang::tr{'fwdfw sourceip'}<input type='TEXT' name='src_addr' value='$fwdfwsettings{'src_addr'}' size='16' maxlength='18' ></td><td width='1%'><input type='radio' name='grp1' id='ipfire_src' value='ipfire_src'  $checked{'grp1'}{'ipfire_src'}></td><td><b>Firewall</b></td>
1617 END
1618                 print"<td align='right'><select name='ipfire_src' style='width:200px;'>";
1619                 print "<option value='ALL' $selected{'ipfire_src'}{'ALL'}>$Lang::tr{'all'}</option>";
1620                 print "<option value='GREEN' $selected{'ipfire_src'}{'GREEN'}>$Lang::tr{'green'} ($ifaces{'GREEN_ADDRESS'})</option>" if $ifaces{'GREEN_ADDRESS'};
1621                 print "<option value='ORANGE' $selected{'ipfire_src'}{'ORANGE'}>$Lang::tr{'orange'} ($ifaces{'ORANGE_ADDRESS'})</option>" if (&Header::orange_used());
1622                 print "<option value='BLUE' $selected{'ipfire_src'}{'BLUE'}>$Lang::tr{'blue'} ($ifaces{'BLUE_ADDRESS'})</option>" if (&Header::blue_used());
1623                 print "<option value='RED1' $selected{'ipfire_src'}{'RED1'}>$Lang::tr{'red1'} ($redip)" if ($redip);
1624                 if (! -z "${General::swroot}/ethernet/aliases"){
1625                         foreach my $alias (sort keys %aliases)
1626                         {
1627                                 print "<option value='$alias' $selected{'ipfire_src'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1628                         }
1629                 }
1630                 print<<END;
1631                 </select></td></tr>
1632                 <tr><td><br></td></tr>
1633                 </table>
1634 END
1635                 &gen_dd_block('src','grp1');
1636                 &Header::closebox();
1637
1638                 #---SNAT / DNAT ------------------------------------------------
1639                 &Header::openbox('100%', 'left', 'NAT');
1640                 print<<END;
1641                         <label>
1642                                 <input type='checkbox' name='USE_NAT' id='USE_NAT' value="ON" $checked{'USE_NAT'}{'ON'}>
1643                                 $Lang::tr{'fwdfw use nat'}
1644                         </label>
1645                         <div class="NAT">
1646                                 <table width='100%' border='0'>
1647                                         <tr>
1648                                                 <td width='5%'></td>
1649                                                 <td width='40%'>
1650                                                         <label>
1651                                                                 <input type='radio' name='nat'  value='dnat' $checked{'nat'}{'dnat'}>
1652                                                                 $Lang::tr{'fwdfw dnat'}
1653                                                         </label>
1654                                                 </td>
1655 END
1656
1657         print <<END;
1658                                                 <td width='25%' align='right'>$Lang::tr{'dnat address'}:</td>
1659                                                 <td width='30%'>
1660                                                         <select name='dnat' style='width: 100%;'>
1661                                                                 <option value='AUTO' $selected{'dnat'}{'AUTO'}>- $Lang::tr{'automatic'} -</option>
1662                                                                 <option value='Default IP' $selected{'dnat'}{'Default IP'}>$Lang::tr{'red1'} ($redip)</option>
1663 END
1664                 if (%aliases) {
1665                         foreach my $alias (sort keys %aliases) {
1666                                 print "<option value='$alias' $selected{'dnat'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1667                         }
1668                 }
1669                 #DNAT Dropdown
1670                 foreach my $network (sort keys %defaultNetworks)
1671                 {
1672                         if ($defaultNetworks{$network}{'NAME'} eq 'BLUE'||$defaultNetworks{$network}{'NAME'} eq 'GREEN' ||$defaultNetworks{$network}{'NAME'} eq 'ORANGE'){
1673                                 print "<option value='$defaultNetworks{$network}{'NAME'}'";
1674                                 print " selected='selected'" if ($fwdfwsettings{'dnat'} eq $defaultNetworks{$network}{'NAME'});
1675                                 print ">$network ($defaultNetworks{$network}{'NET'})</option>";
1676                         }
1677                 }
1678                 print "</select>";
1679                 print "</tr>";
1680
1681                 #SNAT
1682                 print <<END;
1683                                         <tr>
1684                                                 <td width='5%'></td>
1685                                                 <td width='40%'>
1686                                                         <label>
1687                                                                 <input type='radio' name='nat'  value='snat' $checked{'nat'}{'snat'}>
1688                                                                 $Lang::tr{'fwdfw snat'}
1689                                                         </label>
1690                                                 </td>
1691                                                 <td width='25%' align='right'>$Lang::tr{'snat new source ip address'}:</td>
1692                                                 <td width='30%'>
1693                                                         <select name='snat' style='width: 100%;'>
1694 END
1695
1696                 foreach my $alias (sort keys %aliases) {
1697                         print "<option value='$alias' $selected{'snat'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1698                 }
1699                 # SNAT Dropdown
1700                 foreach my $network (sort keys %defaultNetworks) {
1701                         if ($defaultNetworks{$network}{'NAME'} eq 'BLUE'||$defaultNetworks{$network}{'NAME'} eq 'GREEN' ||$defaultNetworks{$network}{'NAME'} eq 'ORANGE'){
1702                                 print "<option value='$defaultNetworks{$network}{'NAME'}'";
1703                                 print " selected='selected'" if ($fwdfwsettings{'snat'} eq $defaultNetworks{$network}{'NAME'});
1704                                 print ">$network ($defaultNetworks{$network}{'NET'})</option>";
1705                         }
1706                 }
1707                 print <<END;
1708                                                         </select>
1709                                                 </td>
1710                                         </tr>
1711                                 </table>
1712                         </div>
1713 END
1714                 &Header::closebox();
1715
1716                 #---TARGET------------------------------------------------------
1717                 &Header::openbox('100%', 'left', $Lang::tr{'fwdfw target'});
1718                 print<<END;
1719                 <table width='100%' border='0'>
1720                 <tr><td width='1%'><input type='radio' name='grp2' value='tgt_addr'  checked></td><td width='60%' nowrap='nowrap'>$Lang::tr{'fwdfw targetip'}<input type='TEXT' name='tgt_addr' value='$fwdfwsettings{'tgt_addr'}' size='16' maxlength='18'><td width='1%'><input type='radio' name='grp2' id='ipfire' value='ipfire'  $checked{'grp2'}{'ipfire'}></td><td><b>Firewall</b></td>
1721 END
1722                 print"<td align='right'><select name='ipfire' style='width:200px;'>";
1723                 print "<option value='ALL' $selected{'ipfire'}{'ALL'}>$Lang::tr{'all'}</option>";
1724                 print "<option value='GREEN' $selected{'ipfire'}{'GREEN'}>$Lang::tr{'green'} ($ifaces{'GREEN_ADDRESS'})</option>" if $ifaces{'GREEN_ADDRESS'};
1725                 print "<option value='ORANGE' $selected{'ipfire'}{'ORANGE'}>$Lang::tr{'orange'} ($ifaces{'ORANGE_ADDRESS'})</option>" if (&Header::orange_used());
1726                 print "<option value='BLUE' $selected{'ipfire'}{'BLUE'}>$Lang::tr{'blue'} ($ifaces{'BLUE_ADDRESS'})</option>"if (&Header::blue_used());
1727                 print "<option value='RED1' $selected{'ipfire'}{'RED1'}>$Lang::tr{'red1'} ($redip)" if ($redip);
1728                 if (! -z "${General::swroot}/ethernet/aliases"){
1729                         foreach my $alias (sort keys %aliases)
1730                         {
1731                                 print "<option value='$alias' $selected{'ipfire'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1732                         }
1733                 }
1734                 print<<END;
1735                 </select></td></tr>
1736                 <tr><td><br></td></tr></table>
1737 END
1738                 &gen_dd_block('tgt','grp2');
1739                 &Header::closebox;
1740                 #---PROTOCOL------------------------------------------------------
1741                 $fwdfwsettings{'SRC_PORT'} =~ s/\|/,/g;
1742                 $fwdfwsettings{'TGT_PORT'} =~ s/\|/,/g;
1743                 $fwdfwsettings{'dnatport'} =~ tr/|/,/;
1744
1745                 # The dnatport may be empty, if it matches TGT_PORT
1746                 if ($fwdfwsettings{'dnatport'} eq $fwdfwsettings{'TGT_PORT'}) {
1747                         $fwdfwsettings{'dnatport'} = "";
1748                 }
1749
1750                 &Header::openbox('100%', 'left', $Lang::tr{'fwhost prot'});
1751                 #Fix Protocol for JQuery
1752                 if ($fwdfwsettings{'grp3'} eq 'cust_srv' || $fwdfwsettings{'grp3'} eq 'cust_srvgrp'){
1753                         $fwdfwsettings{'PROT'} = 'template';
1754                 }
1755                 print<<END;
1756                         <table width='100%' border='0'>
1757                                 <tr>
1758                                         <td width="25%">
1759                                                 <select name='PROT' id='protocol' style="width: 95px;">
1760 END
1761                 print "<option value=\"\"";
1762                 if ($fwdfwsettings{'PROT'} eq '') {
1763                         print " selected=\"selected\"";
1764                 }
1765                 print ">$Lang::tr{'all'}</option>";
1766
1767                 print "<option value=\"template\"";
1768                 print " selected=\"selected\"" if ($fwdfwsettings{'grp3'} eq 'cust_srv' || $fwdfwsettings{'grp3'} eq 'cust_srvgrp');
1769                 print ">- $Lang::tr{'template'} -</option>";
1770
1771                 foreach (@PROTOCOLS) {
1772                         print"<option value=\"$_\"";
1773                         if ($_ eq $fwdfwsettings{'PROT'}) {
1774                                 print " selected=\"selected\"";
1775                         }
1776                         if($_ eq "IPv6"){
1777                                 print ">$Lang::tr{'fwdfw prot41'}</option>";
1778                         }else{
1779                                 print ">$_</option>";
1780                         }
1781                 }
1782
1783                 print<<END;
1784                                                 </select>
1785                                         </td>
1786                                         <td width="75%">
1787                                                 <table width='100%' border='0' id="PROTOCOL_ICMP_TYPES">
1788                                                         <tr>
1789                                                                 <td width='20%'>$Lang::tr{'fwhost icmptype'}</td>
1790                                                                 <td colspan='2'>
1791                                                                         <select name='ICMP_TYPES' style='min-width:230px;'>
1792 END
1793                 &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
1794                 print"<option value='All ICMP-Types'>$Lang::tr{'fwdfw all icmp'}</option>";
1795                 foreach my $key (sort { ncmp($icmptypes{$a}[0],$icmptypes{$b}[0]) }keys %icmptypes){
1796                         if($fwdfwsettings{'ICMP_TYPES'} eq "$icmptypes{$key}[0]"){
1797                                 print"<option selected>$icmptypes{$key}[0] ($icmptypes{$key}[1])</option>";
1798                         }else{
1799                                 print"<option>$icmptypes{$key}[0] ($icmptypes{$key}[1])</option>";
1800                         }
1801                 }
1802
1803                 print <<END;
1804                                                                         </select>
1805                                                                 </td>
1806                                                         </tr>
1807                                                 </table>
1808
1809                                                 <table width="100%" border="0" id="PROTOCOL_PORTS">
1810                                                         <tr>
1811                                                                 <!-- #SOURCEPORT -->
1812                                                                 <td>
1813                                                                         $Lang::tr{'fwdfw use srcport'}
1814                                                                 </td>
1815                                                                 <td>
1816                                                                         <input type='text' name='SRC_PORT' value='$fwdfwsettings{'SRC_PORT'}' maxlength='20' size='18'>
1817                                                                 </td>
1818                                                                 <td width='10%'>
1819                                                                 </td>
1820
1821                                                                 <!-- #TARGETPORT -->
1822                                                                 <td>
1823                                                                         $Lang::tr{'fwdfw use srv'}
1824                                                                 </td>
1825
1826                                                                 <td>
1827                                                                         <input type='text' name='TGT_PORT' value='$fwdfwsettings{'TGT_PORT'}' maxlength='20' size='18'>
1828                                                                 </td>
1829                                                         </tr>
1830                                                         <tr class="NAT">
1831                                                                 <td colspan='3'></td>
1832                                                                 <td>$Lang::tr{'fwdfw external port nat'}:</td>
1833                                                                 <td>
1834                                                                         <input type='text' name='dnatport' value=\"$fwdfwsettings{'dnatport'}\" maxlength='20' size='18'>
1835                                                                 </td>
1836                                                         </tr>
1837                                                 </table>
1838
1839                                                 <table width="100%" border="0" id="PROTOCOL_TEMPLATE">
1840                                                         <tr>
1841                                                                 <td>
1842                                                                         <input type='radio' name='grp3' id='cust_srv' value='cust_srv' checked>
1843                                                                         $Lang::tr{'fwhost cust service'}
1844                                                                 </td>
1845                                                                 <td>
1846                                                                         <select name='cust_srv' style='min-width: 230px;'>
1847 END
1848
1849                 &General::readhasharray("$configsrv", \%customservice);
1850                 foreach my $key (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){
1851                         print"<option ";
1852                         print"selected='selected'" if ($fwdfwsettings{$fwdfwsettings{'grp3'}} eq $customservice{$key}[0]);
1853                         print"value='$customservice{$key}[0]'>$customservice{$key}[0]</option>";
1854                 }
1855
1856                 print <<END;
1857                                                                         </select>
1858                                                                 </td>
1859                                                         </tr>
1860                                                         <tr>
1861                                                                 <td>
1862                                                                         <input type='radio' name='grp3' id='cust_srvgrp' value='cust_srvgrp' $checked{'grp3'}{'cust_srvgrp'}>
1863                                                                         $Lang::tr{'fwhost cust srvgrp'}
1864                                                                 </td>
1865                                                                 <td>
1866                                                                         <select name='cust_srvgrp' style='min-width:230px;'>
1867 END
1868
1869                 &General::readhasharray("$configsrvgrp", \%customservicegrp);
1870                 my $helper;
1871                 foreach my $key (sort { ncmp($customservicegrp{$a}[0],$customservicegrp{$b}[0]) } keys %customservicegrp){
1872                         if ($helper ne $customservicegrp{$key}[0] && $customservicegrp{$key}[2] ne 'none'){
1873                                 print"<option ";
1874                                 print"selected='selected'" if ($fwdfwsettings{$fwdfwsettings{'grp3'}} eq $customservicegrp{$key}[0]);
1875                                 print">$customservicegrp{$key}[0]</option>";
1876                         }
1877                         $helper=$customservicegrp{$key}[0];
1878                 }
1879
1880                 print<<END;
1881                                                                         </select>
1882                                                                 </td>
1883                                                         </tr>
1884                                                 </table>
1885                                         </td>
1886                                 </tr>
1887                         </table>
1888 END
1889
1890                 &Header::closebox;
1891                 $checked{"RULE_ACTION"}{$fwdfwsettings{'RULE_ACTION'}}  = 'CHECKED';
1892                 print <<END;
1893                         <center>
1894                                 <table width="80%" class='tbl' id='actions'>
1895                                         <tr>
1896                                                 <td width="33%" align="center" bgcolor="$color{'color17'}">
1897                                                         &nbsp;<br>&nbsp;
1898                                                 </td>
1899                                                 <td width="33%" align="center" bgcolor="$color{'color25'}">
1900                                                         &nbsp;<br>&nbsp;
1901                                                 </td>
1902                                                 <td width="33%" align="center" bgcolor="$color{'color16'}">
1903                                                         &nbsp;<br>&nbsp;
1904                                                 </td>
1905                                         </tr>
1906                                         <tr>
1907                                                 <td width="33%" align="center">
1908                                                         <label>
1909                                                                 <input type="radio" name="RULE_ACTION" value="ACCEPT" $checked{"RULE_ACTION"}{"ACCEPT"}>
1910                                                                 <strong>$Lang::tr{'fwdfw ACCEPT'}</strong>
1911                                                         </label>
1912                                                 </td>
1913                                                 <td width="33%" align="center">
1914                                                         <label>
1915                                                                 <input type="radio" name="RULE_ACTION" value="DROP" $checked{"RULE_ACTION"}{"DROP"}>
1916                                                                 <strong>$Lang::tr{'fwdfw DROP'}</strong>
1917                                                         </label>
1918                                                 </td>
1919                                                 <td width="33%" align="center">
1920                                                         <label>
1921                                                                 <input type="radio" name="RULE_ACTION" value="REJECT" $checked{"RULE_ACTION"}{"REJECT"}>
1922                                                                 <strong>$Lang::tr{'fwdfw REJECT'}</strong>
1923                                                         </label>
1924                                                 </td>
1925                                         </tr>
1926                                 </table>
1927                         </center>
1928
1929                         <br>
1930 END
1931                 #---Activate/logging/remark-------------------------------------
1932                 &Header::openbox('100%', 'left', $Lang::tr{'fwdfw additional'});
1933                 print<<END;
1934                 <table width='100%' border='0'>
1935 END
1936                 print"<tr><td width='12%'>$Lang::tr{'remark'}:</td><td width='88%' align='left'><input type='text' name='ruleremark' maxlength='255' value='$fwdfwsettings{'ruleremark'}' style='width:99%;'></td></tr>";
1937                 if($fwdfwsettings{'updatefwrule'} eq 'on' || $fwdfwsettings{'copyfwrule'} eq 'on'){
1938                         print "<tr><td width='12%'>$Lang::tr{'fwdfw rulepos'}:</td><td><select name='rulepos' >";
1939                         for (my $count =1; $count <= $sum; $count++){
1940                                 print"<option value='$count' ";
1941                                 print"selected='selected'" if($fwdfwsettings{'oldrulenumber'} eq $count);
1942                                 print">$count</option>";
1943                         }
1944                         print"</select></td></tr>";
1945                 }else{
1946                         print "<tr><td width='12%'>$Lang::tr{'fwdfw rulepos'}:</td><td><input type='text' name='rulepos' size='2'></td></tr>";
1947                 }
1948
1949                 print<<END;
1950                 </table>
1951                 <table width='100%'>
1952                         <tr>
1953 END
1954
1955                 if ($fwdfwsettings{'updatefwrule'} eq 'on') {
1956                         print <<END;
1957                                 <td>
1958                                         <input type='checkbox' name='ACTIVE' value="ON" $checked{'ACTIVE'}{'ON'}>
1959                                 </td>
1960                                 <td>$Lang::tr{'fwdfw rule activate'}</td>
1961 END
1962                 } else {
1963                         print <<END;
1964                                 <td colspan="2">
1965                                         <input type="hidden" name="ACTIVE" value="ON">
1966                                 </td>
1967 END
1968                 }
1969
1970                 print <<END;
1971                         </tr>
1972                         <tr>
1973                                 <td>
1974                                         <input type='checkbox' name='LOG' value='ON' $checked{'LOG'}{'ON'}>
1975                                 </td>
1976                                 <td>$Lang::tr{'fwdfw log rule'}</td>
1977                         </tr>
1978                         <tr>
1979                                 <td width='1%'>
1980                                         <input type='checkbox' name='TIME' id="USE_TIME_CONSTRAINTS" value='ON' $checked{'TIME'}{'ON'}>
1981                                 </td>
1982                                 <td>$Lang::tr{'fwdfw timeframe'}</td>
1983                         </tr>
1984                         <tr id="TIME_CONSTRAINTS">
1985                                 <td colspan="2">
1986                                         <table width="66%" border="0">
1987                                                 <tr>
1988                                                         <td width="8em">&nbsp;</td>
1989                                                         <td align="center">$Lang::tr{'advproxy monday'}</td>
1990                                                         <td align="center">$Lang::tr{'advproxy tuesday'}</td>
1991                                                         <td align="center">$Lang::tr{'advproxy wednesday'}</td>
1992                                                         <td align="center">$Lang::tr{'advproxy thursday'}</td>
1993                                                         <td align="center">$Lang::tr{'advproxy friday'}</td>
1994                                                         <td align="center">$Lang::tr{'advproxy saturday'}</td>
1995                                                         <td align="center">$Lang::tr{'advproxy sunday'}</td>
1996                                                         <td>&nbsp;</td>
1997                                                 </tr>
1998                                                 <tr>
1999                                                         <td width="8em">&nbsp;</td>
2000                                                         <td align="center"><input type='checkbox' name='TIME_MON' value='on' $checked{'TIME_MON'}{'on'} ></td>
2001                                                         <td align="center"><input type='checkbox' name='TIME_TUE' value='on' $checked{'TIME_TUE'}{'on'} ></td>
2002                                                         <td align="center"><input type='checkbox' name='TIME_WED' value='on' $checked{'TIME_WED'}{'on'} ></td>
2003                                                         <td align="center"><input type='checkbox' name='TIME_THU' value='on' $checked{'TIME_THU'}{'on'} ></td>
2004                                                         <td align="center"><input type='checkbox' name='TIME_FRI' value='on' $checked{'TIME_FRI'}{'on'} ></td>
2005                                                         <td align="center"><input type='checkbox' name='TIME_SAT' value='on' $checked{'TIME_SAT'}{'on'} ></td>
2006                                                         <td align="center"><input type='checkbox' name='TIME_SUN' value='on' $checked{'TIME_SUN'}{'on'} ></td>
2007                                                         <td>
2008                                                                 <select name='TIME_FROM'>
2009 END
2010                 for (my $i=0;$i<=23;$i++) {
2011                         $i = sprintf("%02s",$i);
2012                         for (my $j=0;$j<=45;$j+=15) {
2013                                 $j = sprintf("%02s",$j);
2014                                 my $time = $i.":".$j;
2015                                 print "<option $selected{'TIME_FROM'}{$time}>$i:$j</option>\n";
2016                         }
2017                 }
2018                 print<<END;
2019                                                                 </select> &dash;
2020                                                                 <select name='TIME_TO'>
2021 END
2022                 for (my $i=0;$i<=23;$i++) {
2023                         $i = sprintf("%02s",$i);
2024                         for (my $j=0;$j<=45;$j+=15) {
2025                                 $j = sprintf("%02s",$j);
2026                                 my $time = $i.":".$j;
2027                                 print "<option $selected{'TIME_TO'}{$time}>$i:$j</option>\n";
2028                         }
2029                 }
2030                 print<<END;
2031                                                                 </select>
2032                                                         </td>
2033                                                 </tr>
2034                                         </table>
2035                                 </td>
2036                         </tr>
2037                         <tr>
2038                                 <td width='1%'>
2039                                         <input type='checkbox' name='LIMIT_CON_CON' id="USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP" value='ON' $checked{'LIMIT_CON_CON'}{'ON'}>
2040                                 </td>
2041                                 <td>$Lang::tr{'fwdfw limitconcon'}</td>
2042                         </tr>
2043                         <tr id="LIMIT_CON">
2044                                 <td colspan='2'>
2045                                         <table width='66%' border='0'>
2046                                                 <tr>
2047                                                         <td width="20em">&nbsp;</td>
2048                                                         <td>$Lang::tr{'fwdfw maxconcon'}: <input type='text' name='concon' size='2' value="$fwdfwsettings{'concon'}"></td>
2049                                                 </tr>
2050                                         </table>
2051                                 </td>
2052                         </tr>
2053                         <tr>
2054                                 <td width='1%'>
2055                                         <input type='checkbox' name='RATE_LIMIT' id="USE_RATELIMIT" value='ON' $checked{'RATE_LIMIT'}{'ON'}>
2056                                 </td>
2057                                 <td>$Lang::tr{'fwdfw ratelimit'}</td>
2058                         </tr>
2059                         <tr id="RATELIMIT">
2060                                 <td colspan='2'>
2061                                         <table width='66%' border='0'>
2062                                                 <tr>
2063                                                         <td width="20em">&nbsp;</td>
2064                                                         <td>$Lang::tr{'fwdfw numcon'}: <input type='text' name='ratecon' size='2' value="$fwdfwsettings{'ratecon'}"> /
2065                                                                 <select name='RATETIME' style='width:100px;'>
2066                                                                         <option value='second' $selected{'RATETIME'}{'second'}>$Lang::tr{'age second'}</option>
2067                                                                         <option value='minute' $selected{'RATETIME'}{'minute'}>$Lang::tr{'minute'}</option>
2068                                                                         <option value='hour' $selected{'RATETIME'}{'hour'}>$Lang::tr{'hour'}</option>
2069                                                                 </select>
2070                                                         </td>
2071                                                 </tr>
2072                                         </table>
2073                                 </td>
2074                         </tr>
2075                 </table>
2076                 <br>
2077 END
2078
2079                 #---ACTION------------------------------------------------------
2080                 if($fwdfwsettings{'updatefwrule'} ne 'on'){
2081                         print<<END;
2082                         <table border='0' width='100%'>
2083                         <tr><td align='right'><input type='submit' value='$Lang::tr{'add'}' style='min-width:100px;' />
2084                         <input type='hidden' name='config' value='$config' >
2085                         <input type='hidden' name='ACTION' value='saverule' ></form>
2086                         <form method='post' style='display:inline;'><input type='submit' value='$Lang::tr{'fwhost back'}' style='min-width:100px;'><input type='hidden' name='ACTION' value='reset'></form></td></tr>
2087                         </table>
2088                         <br>
2089 END
2090                 }else{
2091                         print<<END;
2092                         <table border='0' width='100%'>
2093                         <tr><td align='right'><input type='submit' value='$Lang::tr{'fwdfw change'}' style='min-width:100px;' /><input type='hidden' name='updatefwrule' value='$fwdfwsettings{'updatefwrule'}'><input type='hidden' name='key' value='$fwdfwsettings{'key'}'>
2094                         <input type='hidden' name='oldgrp1a' value='$fwdfwsettings{'oldgrp1a'}' />
2095                         <input type='hidden' name='oldgrp1b' value='$fwdfwsettings{'oldgrp1b'}' />
2096                         <input type='hidden' name='oldgrp2a' value='$fwdfwsettings{'oldgrp2a'}' />
2097                         <input type='hidden' name='oldgrp2b' value='$fwdfwsettings{'oldgrp2b'}' />
2098                         <input type='hidden' name='oldgrp3a' value='$fwdfwsettings{'oldgrp3a'}' />
2099                         <input type='hidden' name='oldgrp3b' value='$fwdfwsettings{'oldgrp3b'}' />
2100                         <input type='hidden' name='oldusesrv' value='$fwdfwsettings{'oldusesrv'}' />
2101                         <input type='hidden' name='oldrulenumber' value='$fwdfwsettings{'oldrulenumber'}' />
2102                         <input type='hidden' name='rulenumber' value='$fwdfwsettings{'rulepos'}' />
2103                         <input type='hidden' name='oldruleremark' value='$fwdfwsettings{'oldruleremark'}' />
2104                         <input type='hidden' name='oldorange' value='$fwdfwsettings{'oldorange'}' />
2105                         <input type='hidden' name='oldnat' value='$fwdfwsettings{'oldnat'}' />
2106                         <input type='hidden' name='oldruletype' value='$fwdfwsettings{'oldruletype'}' />
2107                         <input type='hidden' name='oldconcon' value='$fwdfwsettings{'oldconcon'}' />
2108                         <input type='hidden' name='ACTION' value='saverule' ></form><form method='post' style='display:inline'><input type='submit' value='$Lang::tr{'fwhost back'}' style='min-width:100px;'><input type='hidden' name='ACTION' value'reset'></td></td>
2109                         </table></form>
2110 END
2111                 }
2112                 &Header::closebox();
2113 }
2114 sub pos_up
2115 {
2116         my %uphash=();
2117         my %tmp=();
2118         &General::readhasharray($fwdfwsettings{'config'}, \%uphash);
2119         foreach my $key (sort keys %uphash){
2120                 if ($key eq $fwdfwsettings{'key'}) {
2121                         my $last = $key -1;
2122                         if (exists $uphash{$last}){
2123                                 #save rule last
2124                                 foreach my $y (0 .. $#{$uphash{$last}}) {
2125                                                 $tmp{0}[$y] = $uphash{$last}[$y];
2126                                 }
2127                                 #copy active rule to last
2128                                 foreach my $i (0 .. $#{$uphash{$last}}) {
2129                                         $uphash{$last}[$i] = $uphash{$key}[$i];
2130                                 }
2131                                 #copy saved rule to actual position
2132                                 foreach my $x (0 .. $#{$tmp{0}}) {
2133                                                 $uphash{$key}[$x] = $tmp{0}[$x];
2134                                 }
2135                         }
2136                 }
2137         }
2138         &General::writehasharray($fwdfwsettings{'config'}, \%uphash);
2139         &General::firewall_config_changed();
2140 }
2141 sub pos_down
2142 {
2143         my %downhash=();
2144         my %tmp=();
2145         &General::readhasharray($fwdfwsettings{'config'}, \%downhash);
2146         foreach my $key (sort keys %downhash){
2147                 if ($key eq $fwdfwsettings{'key'}) {
2148                         my $next = $key + 1;
2149                         if (exists $downhash{$next}){
2150                                 #save rule next
2151                                 foreach my $y (0 .. $#{$downhash{$next}}) {
2152                                                 $tmp{0}[$y] = $downhash{$next}[$y];
2153                                 }
2154                                 #copy active rule to next
2155                                 foreach my $i (0 .. $#{$downhash{$next}}) {
2156                                         $downhash{$next}[$i] = $downhash{$key}[$i];
2157                                 }
2158                                 #copy saved rule to actual position
2159                                 foreach my $x (0 .. $#{$tmp{0}}) {
2160                                                 $downhash{$key}[$x] = $tmp{0}[$x];
2161                                 }
2162                         }
2163                 }
2164         }
2165         &General::writehasharray($fwdfwsettings{'config'}, \%downhash);
2166         &General::firewall_config_changed();
2167 }
2168 sub saverule
2169 {
2170         my $hash=shift;
2171         my $config=shift;
2172         &General::readhasharray("$config", $hash);
2173         if (!$errormessage){
2174                 ################################################################
2175                 #check if we change an INPUT rule to a OUTGOING
2176                 if($fwdfwsettings{'oldruletype'} eq 'INPUTFW'  && $fwdfwsettings{'chain'} eq 'OUTGOINGFW'  ){
2177                         &changerule($configinput);
2178                         #print"1";
2179                 }
2180                 #check if we change an INPUT rule to a FORWARD
2181                 elsif($fwdfwsettings{'oldruletype'} eq 'INPUTFW'  && $fwdfwsettings{'chain'} eq 'FORWARDFW'  ){
2182                         &changerule($configinput);
2183                         #print"2";
2184                 }
2185                 ################################################################
2186                 #check if we change an OUTGOING rule to an INPUT
2187                 elsif($fwdfwsettings{'oldruletype'} eq 'OUTGOINGFW'  && $fwdfwsettings{'chain'} eq 'INPUTFW'  ){
2188                         &changerule($configoutgoing);
2189                         #print"3";
2190                 }
2191                 #check if we change an OUTGOING rule to a FORWARD
2192                 elsif($fwdfwsettings{'oldruletype'} eq 'OUTGOINGFW'  && $fwdfwsettings{'chain'} eq 'FORWARDFW'  ){
2193                         &changerule($configoutgoing);
2194                         #print"4";
2195                 }
2196                 ################################################################
2197                 #check if we change a FORWARD rule to an INPUT
2198                 elsif($fwdfwsettings{'oldruletype'} eq 'FORWARDFW'  && $fwdfwsettings{'chain'} eq 'INPUTFW'){
2199                         &changerule($configfwdfw);
2200                         #print"5";
2201                 }
2202                 #check if we change a FORWARD rule to an OUTGOING
2203                 elsif($fwdfwsettings{'oldruletype'} eq 'FORWARDFW'  && $fwdfwsettings{'chain'} eq 'OUTGOINGFW'){
2204                         &changerule($configfwdfw);
2205                         #print"6";
2206                 }
2207                 $fwdfwsettings{'ruleremark'}=~ s/,/;/g;
2208                 utf8::decode($fwdfwsettings{'ruleremark'});
2209                 $fwdfwsettings{'ruleremark'}=&Header::escape($fwdfwsettings{'ruleremark'});
2210                 if ($fwdfwsettings{'updatefwrule'} ne 'on'){
2211                         my $key = &General::findhasharraykey ($hash);
2212                         $$hash{$key}[0]  = $fwdfwsettings{'RULE_ACTION'};
2213                         $$hash{$key}[1]  = $fwdfwsettings{'chain'};
2214                         $$hash{$key}[2]  = $fwdfwsettings{'ACTIVE'};
2215                         $$hash{$key}[3]  = $fwdfwsettings{'grp1'};
2216                         $$hash{$key}[4]  = $fwdfwsettings{$fwdfwsettings{'grp1'}};
2217                         $$hash{$key}[5]  = $fwdfwsettings{'grp2'};
2218                         $$hash{$key}[6]  = $fwdfwsettings{$fwdfwsettings{'grp2'}};
2219                         $$hash{$key}[7]  = $fwdfwsettings{'USE_SRC_PORT'};
2220                         $$hash{$key}[8]  = $fwdfwsettings{'PROT'};
2221                         $$hash{$key}[9]  = $fwdfwsettings{'ICMP_TYPES'};
2222                         $$hash{$key}[10] = $fwdfwsettings{'SRC_PORT'};
2223                         $$hash{$key}[11] = $fwdfwsettings{'USESRV'};
2224                         $$hash{$key}[12] = $fwdfwsettings{'TGT_PROT'};
2225                         $$hash{$key}[13] = $fwdfwsettings{'ICMP_TGT'};
2226                         $$hash{$key}[14] = $fwdfwsettings{'grp3'};
2227                         $$hash{$key}[15] = $fwdfwsettings{$fwdfwsettings{'grp3'}};
2228                         $$hash{$key}[16] = $fwdfwsettings{'ruleremark'};
2229                         $$hash{$key}[17] = $fwdfwsettings{'LOG'};
2230                         $$hash{$key}[18] = $fwdfwsettings{'TIME'};
2231                         $$hash{$key}[19] = $fwdfwsettings{'TIME_MON'};
2232                         $$hash{$key}[20] = $fwdfwsettings{'TIME_TUE'};
2233                         $$hash{$key}[21] = $fwdfwsettings{'TIME_WED'};
2234                         $$hash{$key}[22] = $fwdfwsettings{'TIME_THU'};
2235                         $$hash{$key}[23] = $fwdfwsettings{'TIME_FRI'};
2236                         $$hash{$key}[24] = $fwdfwsettings{'TIME_SAT'};
2237                         $$hash{$key}[25] = $fwdfwsettings{'TIME_SUN'};
2238                         $$hash{$key}[26] = $fwdfwsettings{'TIME_FROM'};
2239                         $$hash{$key}[27] = $fwdfwsettings{'TIME_TO'};
2240                         $$hash{$key}[28] = $fwdfwsettings{'USE_NAT'};
2241                         $$hash{$key}[29] = $fwdfwsettings{$fwdfwsettings{'nat'}};
2242                         $$hash{$key}[30] = $fwdfwsettings{'dnatport'};
2243                         $$hash{$key}[31] = $fwdfwsettings{'nat'};
2244                         $$hash{$key}[32] = $fwdfwsettings{'LIMIT_CON_CON'};
2245                         $$hash{$key}[33] = $fwdfwsettings{'concon'};
2246                         $$hash{$key}[34] = $fwdfwsettings{'RATE_LIMIT'};
2247                         $$hash{$key}[35] = $fwdfwsettings{'ratecon'};
2248                         $$hash{$key}[36] = $fwdfwsettings{'RATETIME'};
2249                         &General::writehasharray("$config", $hash);
2250                 }else{
2251                         foreach my $key (sort {$a <=> $b} keys %$hash){
2252                                 if($key eq $fwdfwsettings{'key'}){
2253                                         $$hash{$key}[0]  = $fwdfwsettings{'RULE_ACTION'};
2254                                         $$hash{$key}[1]  = $fwdfwsettings{'chain'};
2255                                         $$hash{$key}[2]  = $fwdfwsettings{'ACTIVE'};
2256                                         $$hash{$key}[3]  = $fwdfwsettings{'grp1'};
2257                                         $$hash{$key}[4]  = $fwdfwsettings{$fwdfwsettings{'grp1'}};
2258                                         $$hash{$key}[5]  = $fwdfwsettings{'grp2'};
2259                                         $$hash{$key}[6]  = $fwdfwsettings{$fwdfwsettings{'grp2'}};
2260                                         $$hash{$key}[7]  = $fwdfwsettings{'USE_SRC_PORT'};
2261                                         $$hash{$key}[8]  = $fwdfwsettings{'PROT'};
2262                                         $$hash{$key}[9]  = $fwdfwsettings{'ICMP_TYPES'};
2263                                         $$hash{$key}[10] = $fwdfwsettings{'SRC_PORT'};
2264                                         $$hash{$key}[11] = $fwdfwsettings{'USESRV'};
2265                                         $$hash{$key}[12] = $fwdfwsettings{'TGT_PROT'};
2266                                         $$hash{$key}[13] = $fwdfwsettings{'ICMP_TGT'};
2267                                         $$hash{$key}[14] = $fwdfwsettings{'grp3'};
2268                                         $$hash{$key}[15] = $fwdfwsettings{$fwdfwsettings{'grp3'}};
2269                                         $$hash{$key}[16] = $fwdfwsettings{'ruleremark'};
2270                                         $$hash{$key}[17] = $fwdfwsettings{'LOG'};
2271                                         $$hash{$key}[18] = $fwdfwsettings{'TIME'};
2272                                         $$hash{$key}[19] = $fwdfwsettings{'TIME_MON'};
2273                                         $$hash{$key}[20] = $fwdfwsettings{'TIME_TUE'};
2274                                         $$hash{$key}[21] = $fwdfwsettings{'TIME_WED'};
2275                                         $$hash{$key}[22] = $fwdfwsettings{'TIME_THU'};
2276                                         $$hash{$key}[23] = $fwdfwsettings{'TIME_FRI'};
2277                                         $$hash{$key}[24] = $fwdfwsettings{'TIME_SAT'};
2278                                         $$hash{$key}[25] = $fwdfwsettings{'TIME_SUN'};
2279                                         $$hash{$key}[26] = $fwdfwsettings{'TIME_FROM'};
2280                                         $$hash{$key}[27] = $fwdfwsettings{'TIME_TO'};
2281                                         $$hash{$key}[28] = $fwdfwsettings{'USE_NAT'};
2282                                         $$hash{$key}[29] = $fwdfwsettings{$fwdfwsettings{'nat'}};
2283                                         $$hash{$key}[30] = $fwdfwsettings{'dnatport'};
2284                                         $$hash{$key}[31] = $fwdfwsettings{'nat'};
2285                                         $$hash{$key}[32] = $fwdfwsettings{'LIMIT_CON_CON'};
2286                                         $$hash{$key}[33] = $fwdfwsettings{'concon'};
2287                                         $$hash{$key}[34] = $fwdfwsettings{'RATE_LIMIT'};
2288                                         $$hash{$key}[35] = $fwdfwsettings{'ratecon'};
2289                                         $$hash{$key}[36] = $fwdfwsettings{'RATETIME'};
2290                                         last;
2291                                 }
2292                         }
2293                 }
2294                 &General::writehasharray("$config", $hash);
2295                 if($fwdfwsettings{'oldrulenumber'} > $fwdfwsettings{'rulepos'}){
2296                         my %tmp=();
2297                         my $val=$fwdfwsettings{'oldrulenumber'}-$fwdfwsettings{'rulepos'};
2298                         for (my $z=0;$z<$val;$z++){
2299                                 foreach my $key (sort {$a <=> $b} keys %$hash){
2300                                         if ($key eq $fwdfwsettings{'oldrulenumber'}) {
2301                                                 my $last = $key -1;
2302                                                 if (exists $$hash{$last}){
2303                                                         #save rule last
2304                                                         foreach my $y (0 .. $#{$$hash{$last}}) {
2305                                                                 $tmp{0}[$y] = $$hash{$last}[$y];
2306                                                         }
2307                                                         #copy active rule to last
2308                                                         foreach my $i (0 .. $#{$$hash{$last}}) {
2309                                                                 $$hash{$last}[$i] = $$hash{$key}[$i];
2310                                                         }
2311                                                         #copy saved rule to actual position
2312                                                         foreach my $x (0 .. $#{$tmp{0}}) {
2313                                                                 $$hash{$key}[$x] = $tmp{0}[$x];
2314                                                         }
2315                                                 }
2316                                         }
2317                                 }
2318                                 $fwdfwsettings{'oldrulenumber'}--;
2319                         }
2320                         &General::writehasharray("$config", $hash);
2321                         &General::firewall_config_changed();
2322                 }elsif($fwdfwsettings{'rulepos'} > $fwdfwsettings{'oldrulenumber'}){
2323                         my %tmp=();
2324                         my $val=$fwdfwsettings{'rulepos'}-$fwdfwsettings{'oldrulenumber'};
2325                                 for (my $z=0;$z<$val;$z++){
2326                                         foreach my $key (sort {$a <=> $b} keys %$hash){
2327                                         if ($key eq $fwdfwsettings{'oldrulenumber'}) {
2328                                                 my $next = $key + 1;
2329                                                 if (exists $$hash{$next}){
2330                                                         #save rule next
2331                                                         foreach my $y (0 .. $#{$$hash{$next}}) {
2332                                                                 $tmp{0}[$y] = $$hash{$next}[$y];
2333                                                         }
2334                                                         #copy active rule to next
2335                                                         foreach my $i (0 .. $#{$$hash{$next}}) {
2336                                                                 $$hash{$next}[$i] = $$hash{$key}[$i];
2337                                                         }
2338                                                         #copy saved rule to actual position
2339                                                         foreach my $x (0 .. $#{$tmp{0}}) {
2340                                                                 $$hash{$key}[$x] = $tmp{0}[$x];
2341                                                         }
2342                                                 }
2343                                         }
2344                                 }
2345                                 $fwdfwsettings{'oldrulenumber'}++;
2346                         }
2347                         &General::writehasharray("$config", $hash);
2348                         &General::firewall_config_changed();
2349                 }
2350         }
2351 }
2352 sub validremark
2353 {
2354         # Checks a hostname against RFC1035
2355         my $remark = $_[0];
2356
2357         # Try to decode $remark into UTF-8. If this doesn't work,
2358         # we assume that the string it not sane.
2359         if (!utf8::decode($remark)) {
2360                 return 0;
2361         }
2362
2363         # Check if the string only contains of printable characters.
2364         if ($remark =~ /^[[:print:]]*$/) {
2365                 return 1;
2366         }
2367         return 0;
2368 }
2369 sub viewtablerule
2370 {
2371         &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
2372
2373         &viewtablenew(\%configfwdfw, $configfwdfw, $Lang::tr{'firewall rules'});
2374         &viewtablenew(\%configinputfw, $configinput, $Lang::tr{'incoming firewall access'});
2375         &viewtablenew(\%configoutgoingfw, $configoutgoing, $Lang::tr{'outgoing firewall access'});
2376 }
2377 sub viewtablenew
2378 {
2379         my $hash=shift;
2380         my $config=shift;
2381         my $title=shift;
2382         my $go='';
2383
2384         my $show_box = (! -z $config) || ($optionsfw{'SHOWTABLES'} eq 'on');
2385         return if (!$show_box);
2386
2387         &General::get_aliases(\%aliases);
2388         &General::readhasharray("$confighost", \%customhost);
2389         &General::readhasharray("$config", $hash);
2390         &General::readhasharray("$configccdnet", \%ccdnet);
2391         &General::readhasharray("$configccdhost", \%ccdhost);
2392         &General::readhasharray("$configgrp", \%customgrp);
2393         &General::readhasharray("$configsrvgrp", \%customservicegrp);
2394
2395         &Header::openbox('100%', 'left', $title);
2396         print "<table width='100%' cellspacing='0' class='tbl'>";
2397
2398         if (! -z $config) {
2399                 my $count=0;
2400                 my ($gif,$log);
2401                 my $ruletype;
2402                 my $rulecolor;
2403                 my $tooltip;
2404                 my @tmpsrc=();
2405                 my @tmptgt=();
2406                 my $coloryellow='';
2407
2408                 print <<END;
2409                                 <tr>
2410                                         <th align='right' width='3%'>
2411                                                 #
2412                                         </th>
2413                                         <th width='2%'></th>
2414                                         <th align='center'>
2415                                                 <b>$Lang::tr{'protocol'}</b>
2416                                         </th>
2417                                         <th align='center' width='30%'>
2418                                                 <b>$Lang::tr{'fwdfw source'}</b>
2419                                         </th>
2420                                         <th align='center'>
2421                                                 <b>$Lang::tr{'fwdfw log'}</b>
2422                                         </th>
2423                                         <th align='center' width='30%'>
2424                                                 <b>$Lang::tr{'fwdfw target'}</b>
2425                                         </th>
2426                                         <th align='center' colspan='6' width='18%'>
2427                                                 <b>$Lang::tr{'fwdfw action'}</b>
2428                                         </th>
2429                                 </tr>
2430 END
2431
2432                 foreach my $key (sort  {$a <=> $b} keys %$hash){
2433                         $tdcolor='';
2434                         @tmpsrc=();
2435                         @tmptgt=();
2436                         #check if vpn hosts/nets have been deleted
2437                         if($$hash{$key}[3] =~ /ipsec/i || $$hash{$key}[3] =~ /ovpn/i){
2438                                 push (@tmpsrc,$$hash{$key}[4]);
2439                         }
2440                         if($$hash{$key}[5] =~ /ipsec/i || $$hash{$key}[5] =~ /ovpn/i){
2441                                 push (@tmptgt,$$hash{$key}[6]);
2442                         }
2443                         foreach my $host (@tmpsrc){
2444                                 if($$hash{$key}[3] eq  'ipsec_net_src'){
2445                                         if(&fwlib::get_ipsec_net_ip($host,11) eq ''){
2446                                                 $coloryellow='on';
2447                                         }
2448                                 }elsif($$hash{$key}[3] eq  'ovpn_net_src'){
2449                                         if(&fwlib::get_ovpn_net_ip($host,1) eq ''){
2450                                                 $coloryellow='on';
2451                                         }
2452                                 }elsif($$hash{$key}[3] eq  'ovpn_n2n_src'){
2453                                         if(&fwlib::get_ovpn_n2n_ip($host,27) eq ''){
2454                                                 $coloryellow='on';
2455                                         }
2456                                 }elsif($$hash{$key}[3] eq  'ovpn_host_src'){
2457                                         if(&fwlib::get_ovpn_host_ip($host,33) eq ''){
2458                                                 $coloryellow='on';
2459                                         }
2460                                 }
2461                         }
2462                         foreach my $host (@tmptgt){
2463                                 if($$hash{$key}[5] eq 'ipsec_net_tgt'){
2464                                         if(&fwlib::get_ipsec_net_ip($host,11) eq ''){
2465                                                 $coloryellow='on';
2466                                         }
2467                                 }elsif($$hash{$key}[5] eq 'ovpn_net_tgt'){
2468                                         if(&fwlib::get_ovpn_net_ip($host,1) eq ''){
2469                                                 $coloryellow='on';
2470                                         }
2471                                 }elsif($$hash{$key}[5] eq 'ovpn_n2n_tgt'){
2472                                         if(&fwlib::get_ovpn_n2n_ip($host,27) eq ''){
2473                                                 $coloryellow='on';
2474                                         }
2475                                 }elsif($$hash{$key}[5] eq 'ovpn_host_tgt'){
2476                                         if(&fwlib::get_ovpn_host_ip($host,33) eq ''){
2477                                                 $coloryellow='on';
2478                                         }
2479                                 }
2480                         }
2481                         #check if networkgroups or servicegroups are empty
2482                         foreach my $netgroup (sort keys %customgrp){
2483                                 if(($$hash{$key}[4] eq $customgrp{$netgroup}[0] || $$hash{$key}[6] eq $customgrp{$netgroup}[0]) && $customgrp{$netgroup}[2] eq 'none'){
2484                                         $coloryellow='on';
2485                                 }
2486                         }
2487                         foreach my $srvgroup (sort keys %customservicegrp){
2488                                 if($$hash{$key}[15] eq $customservicegrp{$srvgroup}[0] && $customservicegrp{$srvgroup}[2] eq 'none'){
2489                                         $coloryellow='on';
2490                                 }
2491                         }
2492                         $$hash{'ACTIVE'}=$$hash{$key}[2];
2493                         $count++;
2494                         if($coloryellow eq 'on'){
2495                                 $color="$color{'color14'}";
2496                                 $coloryellow='';
2497                         }elsif($coloryellow eq ''){
2498                                 if ($count % 2){
2499                                         $color="$color{'color22'}";
2500                                 }
2501                                 else{
2502                                         $color="$color{'color20'}";
2503                                 }
2504                         }
2505                         print<<END;
2506                                 <tr bgcolor='$color'>
2507                                         <td align='right' width='3%'>
2508                                                 <b>$key&nbsp;</b>
2509                                         </td>
2510 END
2511
2512                         #RULETYPE (A,R,D)
2513                         if ($$hash{$key}[0] eq 'ACCEPT'){
2514                                 $ruletype='A';
2515                                 $tooltip='ACCEPT';
2516                                 $rulecolor=$color{'color17'};
2517                         }elsif($$hash{$key}[0] eq 'DROP'){
2518                                 $ruletype='D';
2519                                 $tooltip='DROP';
2520                                 $rulecolor=$color{'color25'};
2521                         }elsif($$hash{$key}[0] eq 'REJECT'){
2522                                 $ruletype='R';
2523                                 $tooltip='REJECT';
2524                                 $rulecolor=$color{'color16'};
2525                         }
2526
2527                         print <<END;
2528                                         <td bgcolor='$rulecolor' align='center' width='2%'>
2529                                                 <span title='$tooltip'>&nbsp;&nbsp;</span>
2530                                         </td>
2531 END
2532
2533                         #Get Protocol
2534                         my $prot;
2535                         if ($$hash{$key}[8]){
2536                                 if ($$hash{$key}[8] eq "IPv6"){
2537                                         push (@protocols,$Lang::tr{'fwdfw prot41 short'})
2538                                 }else{
2539                                         push (@protocols,$$hash{$key}[8]);
2540                                 }
2541                         }elsif($$hash{$key}[14] eq 'cust_srv'){
2542                                 &get_serviceports("service",$$hash{$key}[15]);
2543                         }elsif($$hash{$key}[14] eq 'cust_srvgrp'){
2544                                 &get_serviceports("group",$$hash{$key}[15]);
2545                         }else{
2546                                 push (@protocols,$Lang::tr{'all'});
2547                         }
2548
2549                         my $protz=join(", ",@protocols);
2550                         if($protz eq 'ICMP' && $$hash{$key}[9] ne 'All ICMP-Types' && $$hash{$key}[14] ne 'cust_srvgrp'){
2551                                 &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
2552                                 foreach my $keyicmp (sort { ncmp($icmptypes{$a}[0],$icmptypes{$b}[0]) }keys %icmptypes){
2553                                         if($$hash{$key}[9] eq "$icmptypes{$keyicmp}[0]"){
2554                                                 print "<td align='center'><span title='$icmptypes{$keyicmp}[0]'><b>$protz ($icmptypes{$keyicmp}[1])</b></span></td>";
2555                                                 last;
2556                                         }
2557                                 }
2558                         }elsif($#protocols gt '3'){
2559                                 print"<td align='center'><span title='$protz'>$Lang::tr{'fwdfw many'}</span></td>";
2560                         }else{
2561                                 print"<td align='center'>$protz</td>";
2562                         }
2563                         @protocols=();
2564                         #SOURCE
2565                         my $ipfireiface;
2566                         &getcolor($$hash{$key}[3],$$hash{$key}[4],\%customhost);
2567                         print"<td align='center' width='30%' $tdcolor>";
2568                         if ($$hash{$key}[3] eq 'ipfire_src'){
2569                                 $ipfireiface=$Lang::tr{'fwdfw iface'};
2570                         }
2571                         if ($$hash{$key}[3] eq 'std_net_src'){
2572                                 print &get_name($$hash{$key}[4]);
2573                         }elsif ($$hash{$key}[3] eq 'src_addr'){
2574                                 my ($split1,$split2) = split("/",$$hash{$key}[4]);
2575                                 if ($split2 eq '32'){
2576                                         print $split1;
2577                                 }else{
2578                                         print $$hash{$key}[4];
2579                                 }
2580                         }elsif ($$hash{$key}[3] eq 'cust_geoip_src') {
2581                                 my ($split1,$split2) = split(":", $$hash{$key}[4]);
2582                                 if ($split2) {
2583                                         print "$split2\n";
2584                                 }else{
2585                                         print "$Lang::tr{'geoip'}: $$hash{$key}[4]\n";
2586                                 }
2587                         }elsif ($$hash{$key}[4] eq 'RED1'){
2588                                 print "$ipfireiface $Lang::tr{'fwdfw red'}";
2589                         }elsif ($$hash{$key}[4] eq 'ALL'){
2590                                 print "$ipfireiface $Lang::tr{'all'}";
2591                         }else{
2592                                 if ($$hash{$key}[4] eq 'GREEN' || $$hash{$key}[4] eq 'ORANGE' || $$hash{$key}[4] eq 'BLUE' || $$hash{$key}[4] eq 'RED'){
2593                                         print "$ipfireiface $Lang::tr{lc($$hash{$key}[4])}";
2594                                 }else{
2595                                         print "$ipfireiface $$hash{$key}[4]";
2596                                 }
2597                         }
2598                         $tdcolor='';
2599                         #SOURCEPORT
2600                         &getsrcport(\%$hash,$key);
2601                         #Is this a SNAT rule?
2602                         if ($$hash{$key}[31] eq 'snat' && $$hash{$key}[28] eq 'ON'){
2603                                 my $net=&get_name($$hash{$key}[29]);
2604                                 if ( ! $net){ $net=$$hash{$key}[29];}
2605                                         print"<br>->$net";
2606                                 if ($$hash{$key}[30] ne ''){
2607                                         print": $$hash{$key}[30]";
2608                                 }
2609                         }
2610                         if ($$hash{$key}[17] eq 'ON'){
2611                                 $log="/images/on.gif";
2612                         }else{
2613                                 $log="/images/off.gif";
2614                         }
2615                         #LOGGING
2616                         print<<END;
2617                                         </td>
2618                                         <td align='center'>
2619                                                 <form method='POST' action=''>
2620                                                         <input type='image' img src='$log' alt='$Lang::tr{'click to disable'}' title='$Lang::tr{'fwdfw togglelog'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;'/>
2621                                                         <input type='hidden' name='key' value='$key' />
2622                                                         <input type='hidden' name='config' value='$config' />
2623                                                         <input type='hidden' name='ACTION' value='$Lang::tr{'fwdfw togglelog'}' />
2624                                                 </form>
2625                                         </td>
2626 END
2627                         #TARGET
2628                         &getcolor($$hash{$key}[5],$$hash{$key}[6],\%customhost);
2629                         print<<END;
2630                                         <td align='center' $tdcolor>
2631 END
2632                         #Is this a DNAT rule?
2633                         my $natstring;
2634                         if ($$hash{$key}[31] eq 'dnat' && $$hash{$key}[28] eq 'ON'){
2635                                 if ($$hash{$key}[29] eq 'Default IP'){$$hash{$key}[29]=$Lang::tr{'red1'};}
2636                                 if ($$hash{$key}[29] eq 'AUTO'){
2637                                         my @src_addresses=&fwlib::get_addresses(\%$hash,$key,'src');
2638                                         my @nat_ifaces;
2639                                         foreach my $val (@src_addresses){
2640                                                 push (@nat_ifaces,&fwlib::get_nat_address($$hash{$key}[29],$val));
2641                                         }
2642                                         @nat_ifaces=&del_double(@nat_ifaces);
2643                                         $natstring = "";
2644                                 }else{
2645                                         $natstring = "($$hash{$key}[29])";
2646                                 }
2647                                 print "$Lang::tr{'firewall'} $natstring";
2648                                 if($$hash{$key}[30] ne ''){
2649                                         $$hash{$key}[30]=~ tr/|/,/;
2650                                         print": $$hash{$key}[30]";
2651                                 }
2652                                 print"<br>-&gt;";
2653                         }
2654                         if ($$hash{$key}[5] eq 'std_net_tgt' || $$hash{$key}[5] eq 'ipfire'){
2655                                 if ($$hash{$key}[6] eq 'RED1'){
2656                                         print "$Lang::tr{'red1'}";
2657                                 }elsif ($$hash{$key}[6] eq 'GREEN' || $$hash{$key}[6] eq 'ORANGE' || $$hash{$key}[6] eq 'BLUE'|| $$hash{$key}[6] eq 'ALL' || $$hash{$key}[6] eq 'RED')
2658                                 {
2659                                         print &get_name($$hash{$key}[6]);
2660                                 }else{
2661                                         print $$hash{$key}[6];
2662                                 }
2663                         }elsif ($$hash{$key}[5] eq 'cust_geoip_tgt') {
2664                                 my ($split1,$split2) = split(":", $$hash{$key}[6]);
2665                                 if ($split2) {
2666                                         print "$split2\n";
2667                                 }else{
2668                                         print "$Lang::tr{'geoip'}: $$hash{$key}[6]\n";
2669                                 }
2670                         }elsif ($$hash{$key}[5] eq 'tgt_addr'){
2671                                 my ($split1,$split2) = split("/",$$hash{$key}[6]);
2672                                 if ($split2 eq '32'){
2673                                         print $split1;
2674                                 }else{
2675                                         print $$hash{$key}[6];
2676                                 }
2677                         }else{
2678                                 print "$$hash{$key}[6]";
2679                         }
2680                         $tdcolor='';
2681                         #TARGETPORT
2682                         &gettgtport(\%$hash,$key);
2683                         print"</td>";
2684                         #RULE ACTIVE
2685                         if($$hash{$key}[2] eq 'ON'){
2686                                 $gif="/images/on.gif"
2687                         }else{
2688                                 $gif="/images/off.gif"
2689                         }
2690                         print<<END;
2691                                 <td width='3%' align='center'>
2692                                         <form method='POST' action=''>
2693                                                 <input type='image' img src='$gif' alt='$Lang::tr{'click to disable'}' title='$Lang::tr{'fwdfw toggle'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;' />
2694                                                 <input type='hidden' name='key' value='$key' />
2695                                                 <input type='hidden' name='config' value='$config' />
2696                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'fwdfw toggle'}' />
2697                                         </form>
2698                                 </td>
2699                                 <td width='3%' align='center'>
2700                                         <form method='POST' action=''>
2701                                                 <input type='image' img src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'fwdfw edit'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'  />
2702                                                 <input type='hidden' name='key' value='$key' />
2703                                                 <input type='hidden' name='config' value='$config' />
2704                                                 <input type='hidden' name='ACTION' value='editrule' />
2705                                         </form>
2706                                 </td>
2707                                 <td width='3%' align='center'>
2708                                         <form method='POST' action=''>
2709                                                 <input type='image' img src='/images/addblue.gif' alt='$Lang::tr{'fwdfw copy'}' title='$Lang::tr{'fwdfw copy'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;' />
2710                                                 <input type='hidden' name='key' value='$key' />
2711                                                 <input type='hidden' name='config' value='$config' />
2712                                                 <input type='hidden' name='ACTION' value='copyrule' />
2713                                         </form>
2714                                 </td>
2715                                 <td width='3%' align='center'>
2716                                         <form method='POST' action=''>
2717                                                 <input type='image' img src='/images/delete.gif' alt='$Lang::tr{'delete'}' title='$Lang::tr{'fwdfw delete'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'   />
2718                                                 <input type='hidden' name='key' value='$key' />
2719                                                 <input type='hidden' name='config' value='$config' />
2720                                                 <input type='hidden' name='ACTION' value='deleterule' />
2721                                         </form>
2722                                 </td>
2723 END
2724                         if (exists $$hash{$key-1}){
2725                                 print<<END;
2726                                         <td width='3%' align='center'>
2727                                                 <form method='POST' action=''>
2728                                                         <input type='image' img src='/images/up.gif' alt='$Lang::tr{'fwdfw moveup'}' title='$Lang::tr{'fwdfw moveup'}'  style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'  />
2729                                                         <input type='hidden' name='key' value='$key' />
2730                                                         <input type='hidden' name='config' value='$config' />
2731                                                         <input type='hidden' name='ACTION' value='moveup' />
2732                                                 </form>
2733                                         </td>
2734 END
2735                         }else{
2736                                 print"<td width='3%'></td>";
2737                         }
2738
2739                         if (exists $$hash{$key+1}){
2740                                 print<<END;
2741                                         <td width='3%' align='center'>
2742                                                 <form method='POST' action=''>
2743                                                         <input type='image' img src='/images/down.gif' alt='$Lang::tr{'fwdfw movedown'}' title='$Lang::tr{'fwdfw movedown'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'  />
2744                                                         <input type='hidden' name='key' value='$key' />
2745                                                         <input type='hidden' name='config' value='$config' />
2746                                                         <input type='hidden' name='ACTION' value='movedown' />
2747                                                 </form>
2748                                         </td>
2749                                 </tr>
2750 END
2751                         }else{
2752                                 print"<td width='3%'></td></tr>";
2753                         }
2754                         #REMARK
2755                         if ($optionsfw{'SHOWREMARK'} eq 'on' && $$hash{$key}[16] ne ''){
2756                                 print <<END;
2757                                         <tr bgcolor='$color'>
2758                                                 <td>&nbsp;</td>
2759                                                 <td bgcolor='$rulecolor'></td>
2760                                                 <td colspan='10'>
2761                                                         &nbsp; <em>$$hash{$key}[16]</em>
2762                                                 </td>
2763                                         </tr>
2764 END
2765                         }
2766
2767                         if ($$hash{$key}[18] eq 'ON'){
2768                                 #TIMEFRAME
2769                                 if ($$hash{$key}[18] eq 'ON'){
2770                                         my @days=();
2771                                         if($$hash{$key}[19] ne ''){push (@days,$Lang::tr{'fwdfw wd_mon'});}
2772                                         if($$hash{$key}[20] ne ''){push (@days,$Lang::tr{'fwdfw wd_tue'});}
2773                                         if($$hash{$key}[21] ne ''){push (@days,$Lang::tr{'fwdfw wd_wed'});}
2774                                         if($$hash{$key}[22] ne ''){push (@days,$Lang::tr{'fwdfw wd_thu'});}
2775                                         if($$hash{$key}[23] ne ''){push (@days,$Lang::tr{'fwdfw wd_fri'});}
2776                                         if($$hash{$key}[24] ne ''){push (@days,$Lang::tr{'fwdfw wd_sat'});}
2777                                         if($$hash{$key}[25] ne ''){push (@days,$Lang::tr{'fwdfw wd_sun'});}
2778                                         my $weekdays=join(",",@days);
2779                                         if (@days){
2780                                                 print"<tr bgcolor='$color'>";
2781                                                 print"<td>&nbsp;</td><td bgcolor='$rulecolor'></td><td align='left' colspan='10'>&nbsp; $weekdays &nbsp; $$hash{$key}[26] - $$hash{$key}[27]</td></tr>";
2782                                         }
2783                                 }
2784                         }
2785                         print"<tr bgcolor='FFFFFF'><td colspan='13' height='1'></td></tr>";
2786                 }
2787         } elsif ($optionsfw{'SHOWTABLES'} eq 'on') {
2788                 print <<END;
2789                         <tr>
2790                                 <td colspan='7' height='30' bgcolor=$color{'color22'} align='center'>$Lang::tr{'fwhost empty'}</td>
2791                         </tr>
2792 END
2793         }
2794
2795         #SHOW FINAL RULE
2796         my $policy = 'fwdfw ' . $fwdfwsettings{'POLICY'};
2797         my $colour = "bgcolor='green'";
2798         if ($fwdfwsettings{'POLICY'} eq 'MODE1') {
2799                 $colour = "bgcolor='darkred'";
2800         }
2801
2802         my $message;
2803         if (($config eq '/var/ipfire/firewall/config') && ($fwdfwsettings{'POLICY'} ne 'MODE1')) {
2804                 print <<END;
2805                         <tr>
2806                                 <td colspan='13'>&nbsp;</td>
2807                         </tr>
2808                         <tr>
2809                                 <td colspan='13' style="padding-left:0px;padding-right:0px">
2810                                         <table width="100%" border='1' rules="cols" cellspacing='0'>
2811 END
2812
2813                 # GREEN
2814                 print <<END;
2815                         <tr>
2816                                 <td align='center'>
2817                                         <font color="$Header::colourgreen">$Lang::tr{'green'}</font>
2818                                 </td>
2819                                 <td align='center'>
2820                                         <font color="$Header::colourred">$Lang::tr{'red'}</font>
2821                                         ($Lang::tr{'fwdfw pol allow'})
2822                                 </td>
2823 END
2824
2825                 if (&Header::orange_used()) {
2826                         print <<END;
2827                                 <td align='center'>
2828                                         <font color="$Header::colourorange">$Lang::tr{'orange'}</font>
2829                                         ($Lang::tr{'fwdfw pol allow'})
2830                                 </td>
2831 END
2832                 }
2833
2834                 if (&Header::blue_used()) {
2835                         print <<END;
2836                                 <td align='center'>
2837                                         <font color="$Header::colourblue">$Lang::tr{'blue'}</font>
2838                                         ($Lang::tr{'fwdfw pol allow'})
2839                                 </td>
2840 END
2841                 }
2842
2843                 print"</tr>";
2844
2845                 # ORANGE
2846                 if (&Header::orange_used()) {
2847                         print <<END;
2848                                 <tr>
2849                                         <td align='center' width='20%'>
2850                                                 <font color="$Header::colourorange">$Lang::tr{'orange'}</font>
2851                                         </td>
2852                                         <td align='center'>
2853                                                 <font color="$Header::colourred">$Lang::tr{'red'}</font>
2854                                                 ($Lang::tr{'fwdfw pol allow'})
2855                                         </td>
2856                                         <td align='center'>
2857                                                 <font color="$Header::colourgreen">$Lang::tr{'green'}</font>
2858                                                 ($Lang::tr{'fwdfw pol block'})
2859                                         </td>
2860 END
2861
2862                         if (&Header::blue_used()) {
2863                                 print <<END;
2864                                         <td align='center'>
2865                                                 <font color="$Header::colourblue">$Lang::tr{'blue'}</font>
2866                                                 ($Lang::tr{'fwdfw pol block'})
2867                                         </td>
2868 END
2869                         }
2870
2871                         print"</tr>";
2872                 }
2873
2874                 if (&Header::blue_used()) {
2875                         print <<END;
2876                                 <tr>
2877                                         <td align='center'>
2878                                                 <font color="$Header::colourblue">$Lang::tr{'blue'}</font>
2879                                         </td>
2880                                         <td align='center'>
2881                                                 <font color="$Header::colourred">$Lang::tr{'red'}</font>
2882                                                 ($Lang::tr{'fwdfw pol allow'})
2883                                         </td>
2884 END
2885
2886                         if (&Header::orange_used()) {
2887                                 print <<END;
2888                                         <td align='center'>
2889                                                 <font color="$Header::colourorange">$Lang::tr{'orange'}</font>
2890                                                 ($Lang::tr{'fwdfw pol block'})
2891                                         </td>
2892 END
2893                         }
2894
2895                         print <<END;
2896                                         <td align='center'>
2897                                                 <font color="$Header::colourgreen">$Lang::tr{'green'}</font>
2898                                                 ($Lang::tr{'fwdfw pol block'})
2899                                         </td>
2900                                 </tr>
2901 END
2902                 }
2903
2904                 print <<END;
2905                                         </table>
2906                                 </td>
2907                         </tr>
2908 END
2909
2910                 $message = $Lang::tr{'fwdfw pol allow'};
2911
2912         } elsif ($config eq '/var/ipfire/firewall/outgoing' && ($fwdfwsettings{'POLICY1'} ne 'MODE1')) {
2913                 $message = $Lang::tr{'fwdfw pol allow'};
2914                 $colour = "bgcolor='green'";
2915         } else {
2916                 $message = $Lang::tr{'fwdfw pol block'};
2917                 $colour = "bgcolor='darkred'";
2918         }
2919
2920         if ($message) {
2921                 print <<END;
2922                         <tr>
2923                                 <td $colour align='center' colspan='13'>
2924                                         <font color='#FFFFFF'>$Lang::tr{'policy'}: $message</font>
2925                                 </td>
2926                         </tr>
2927 END
2928         }
2929
2930         print "</table>";
2931         print "<br>";
2932
2933         &Header::closebox();
2934 }
2935
2936 &Header::closebigbox();
2937 &Header::closepage();