html/cgi-bin/firewall.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2013 Alexander Marx <amarx@ipfire.org>                        #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 use strict;
  23 use Sort::Naturally;
  24 use utf8;
  25 use feature 'unicode_strings';
  26
  27 no warnings 'uninitialized';
  28
  29 # enable only the following on debugging purpose
  30 #use warnings;
  31 #use CGI::Carp 'fatalsToBrowser';
  32
  33 require '/var/ipfire/general-functions.pl';
  34 require '/var/ipfire/network-functions.pl';
  35 require "${General::swroot}/lang.pl";
  36 require "${General::swroot}/header.pl";
  37 require "${General::swroot}/geoip-functions.pl";
  38 require "/usr/lib/firewall/firewall-lib.pl";
  39
  40 unless (-d "${General::swroot}/firewall")                       { system("mkdir ${General::swroot}/firewall"); }
  41 unless (-e "${General::swroot}/firewall/settings")      { system("touch ${General::swroot}/firewall/settings"); }
  42 unless (-e "${General::swroot}/firewall/config")        { system("touch ${General::swroot}/firewall/config"); }
  43 unless (-e "${General::swroot}/firewall/input")         { system("touch ${General::swroot}/firewall/input"); }
  44 unless (-e "${General::swroot}/firewall/outgoing")      { system("touch ${General::swroot}/firewall/outgoing"); }
  45
  46 my %fwdfwsettings=();
  47 my %selected=() ;
  48 my %defaultNetworks=();
  49 my %netsettings=();
  50 my %customhost=();
  51 my %customgrp=();
  52 my %customgeoipgrp=();
  53 my %customnetworks=();
  54 my %customservice=();
  55 my %customservicegrp=();
  56 my %ccdnet=();
  57 my %customnetwork=();
  58 my %ccdhost=();
  59 my %configfwdfw=();
  60 my %configinputfw=();
  61 my %configoutgoingfw=();
  62 my %ipsecconf=();
  63 my %color=();
  64 my %mainsettings=();
  65 my %checked=();
  66 my %icmptypes=();
  67 my %ovpnsettings=();
  68 my %ipsecsettings=();
  69 my %aliases=();
  70 my %optionsfw=();
  71 my %ifaces=();
  72 my %rulehash=();
  73
  74 my @PROTOCOLS = ("TCP", "UDP", "ICMP", "IGMP", "AH", "ESP", "GRE","IPv6","IPIP");
  75
  76 my $color;
  77 my $confignet           = "${General::swroot}/fwhosts/customnetworks";
  78 my $confighost          = "${General::swroot}/fwhosts/customhosts";
  79 my $configgrp           = "${General::swroot}/fwhosts/customgroups";
  80 my $configgeoipgrp      = "${General::swroot}/fwhosts/customgeoipgrp";
  81 my $configsrv           = "${General::swroot}/fwhosts/customservices";
  82 my $configsrvgrp        = "${General::swroot}/fwhosts/customservicegrp";
  83 my $configccdnet        = "${General::swroot}/ovpn/ccd.conf";
  84 my $configccdhost       = "${General::swroot}/ovpn/ovpnconfig";
  85 my $configipsec         = "${General::swroot}/vpn/config";
  86 my $configipsecrw       = "${General::swroot}/vpn/settings";
  87 my $configfwdfw         = "${General::swroot}/firewall/config";
  88 my $configinput         = "${General::swroot}/firewall/input";
  89 my $configoutgoing      = "${General::swroot}/firewall/outgoing";
  90 my $configovpn          = "${General::swroot}/ovpn/settings";
  91 my $fwoptions           = "${General::swroot}/optionsfw/settings";
  92 my $ifacesettings       = "${General::swroot}/ethernet/settings";
  93 my $errormessage='';
  94 my $hint='';
  95 my $ipgrp="${General::swroot}/outgoing/groups";
  96 my $tdcolor='';
  97 my $checkorange='';
  98 my @protocols;
  99 &General::readhash("${General::swroot}/firewall/settings", \%fwdfwsettings);
 100 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
 101 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
 102 &General::readhash($fwoptions, \%optionsfw);
 103 &General::readhash($ifacesettings, \%ifaces);
 104 &General::readhash("$configovpn", \%ovpnsettings);
 105 &General::readhash("$configipsecrw", \%ipsecsettings);
 106 &General::readhasharray("$configipsec", \%ipsecconf);
 107 &Header::showhttpheaders();
 108 &Header::getcgihash(\%fwdfwsettings);
 109 &Header::openpage($Lang::tr{'firewall rules'}, 1, '');
 110 &Header::openbigbox('100%', 'center',$errormessage);
 111 #### JAVA SCRIPT ####
 112 print<<END;
 113 <script>
 114         var PROTOCOLS_WITH_PORTS = ["TCP", "UDP"];
 115
 116         var update_protocol = function() {
 117                 var protocol = \$("#protocol").val();
 118
 119                 if (protocol === undefined)
 120                         return;
 121
 122                 // Check if a template is/should be used.
 123                 if (protocol === "template") {
 124                         \$("#PROTOCOL_TEMPLATE").show();
 125                 } else {
 126                         \$("#PROTOCOL_TEMPLATE").hide();
 127                 }
 128
 129                 // Check if we are dealing with a protocol, that knows ports.
 130                 if (\$.inArray(protocol, PROTOCOLS_WITH_PORTS) >= 0) {
 131                         \$("#PROTOCOL_PORTS").show();
 132                 } else {
 133                         \$("#PROTOCOL_PORTS").hide();
 134                 }
 135
 136                 // Handle ICMP.
 137                 if (protocol === "ICMP") {
 138                         \$("#PROTOCOL_ICMP_TYPES").show();
 139                 } else {
 140                         \$("#PROTOCOL_ICMP_TYPES").hide();
 141                 }
 142         };
 143
 144         \$(document).ready(function() {
 145                 \$("#protocol").change(update_protocol);
 146                 update_protocol();
 147
 148                 // Show/Hide elements when NAT checkbox is checked.
 149                 if (\$("#USE_NAT").attr("checked")) {
 150                         \$("#actions").hide();
 151                 } else {
 152                         \$(".NAT").hide();
 153                 }
 154
 155                 // Show NAT area when "use nat" checkbox is clicked
 156                 \$("#USE_NAT").change(function() {
 157                         \$(".NAT").toggle();
 158                         \$("#actions").toggle();
 159                 });
 160
 161                 // Hide SNAT items when DNAT is selected and vice versa.
 162                 if (\$('input[name=nat]:checked').val() == 'dnat') {
 163                         \$('.snat').hide();
 164                 } else {
 165                         \$('.dnat').hide();
 166                 }
 167
 168                 // Show/Hide elements when SNAT/DNAT get changed.
 169                 \$('input[name=nat]').change(function() {
 170                         \$('.snat').toggle();
 171                         \$('.dnat').toggle();
 172                 });
 173
 174                 // Time constraints
 175                 if(!\$("#USE_TIME_CONSTRAINTS").attr("checked")) {
 176                         \$("#TIME_CONSTRAINTS").hide();
 177                 }
 178                 \$("#USE_TIME_CONSTRAINTS").change(function() {
 179                         \$("#TIME_CONSTRAINTS").toggle();
 180                 });
 181
 182                 // Limit concurrent connections per ip
 183                 if(!\$("#USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP").attr("checked")) {
 184                         \$("#LIMIT_CON").hide();
 185                 }
 186                 \$("#USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP").change(function() {
 187                         \$("#LIMIT_CON").toggle();
 188                 });
 189
 190                 // Rate-limit new connections
 191                 if(!\$("#USE_RATELIMIT").attr("checked")) {
 192                         \$("#RATELIMIT").hide();
 193                 }
 194                 \$("#USE_RATELIMIT").change(function() {
 195                         \$("#RATELIMIT").toggle();
 196                 });
 197
 198                 // Automatically select radio buttons when corresponding
 199                 // dropdown menu changes.
 200                 \$("select").change(function() {
 201                         var id = \$(this).attr("name");
 202                         \$('#' + id).prop("checked", true);
 203                 });
 204         });
 205 </script>
 206 END
 207
 208 ####  ACTION  #####
 209
 210 if ($fwdfwsettings{'ACTION'} eq 'saverule')
 211 {
 212         &General::readhasharray("$configfwdfw", \%configfwdfw);
 213         &General::readhasharray("$configinput", \%configinputfw);
 214         &General::readhasharray("$configoutgoing", \%configoutgoingfw);
 215         my $maxkey;
 216         #Set Variables according to the JQuery code in protocol section
 217         if ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP')
 218         {
 219                 if ($fwdfwsettings{'SRC_PORT'} ne '')
 220                 {
 221                         $fwdfwsettings{'USE_SRC_PORT'} = 'ON';
 222                 }
 223                 if ($fwdfwsettings{'TGT_PORT'} ne '')
 224                 {
 225                         $fwdfwsettings{'USESRV'} = 'ON';
 226                         $fwdfwsettings{'grp3'} = 'TGT_PORT';
 227                 }
 228         }
 229         if ($fwdfwsettings{'PROT'} eq 'template')
 230         {
 231                 $fwdfwsettings{'USESRV'} = 'ON';
 232         }
 233         $errormessage=&checksource;
 234         if(!$errormessage){&checktarget;}
 235         if(!$errormessage){&checkrule;}
 236
 237         #check if manual ip (source) is orange network
 238         if ($fwdfwsettings{'grp1'} eq 'src_addr'){
 239                 my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
 240                 if ( &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
 241                         $checkorange='on';
 242                 }
 243         }
 244         #check useless rules
 245         if(     ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'ORANGE' || $checkorange eq 'on') && $fwdfwsettings{'grp2'} eq 'ipfire'){
 246                 $errormessage.=$Lang::tr{'fwdfw useless rule'}."<br>";
 247         }
 248         #check if we try to break rules
 249         if(     $fwdfwsettings{'grp1'} eq 'ipfire_src' && $fwdfwsettings{'grp2'} eq 'ipfire'){
 250                 $errormessage=$Lang::tr{'fwdfw err same'};
 251         }
 252         # INPUT part
 253         if ($fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ORANGE'){
 254                 $fwdfwsettings{'config'}=$configinput;
 255                 $fwdfwsettings{'chain'} = 'INPUTFW';
 256                 $maxkey=&General::findhasharraykey(\%configinputfw);
 257                 %rulehash=%configinputfw;
 258         }elsif ($fwdfwsettings{'grp1'} eq 'ipfire_src' ){
 259         # OUTGOING PART
 260                 $fwdfwsettings{'config'}=$configoutgoing;
 261                 $fwdfwsettings{'chain'} = 'OUTGOINGFW';
 262                 $maxkey=&General::findhasharraykey(\%configoutgoingfw);
 263                 %rulehash=%configoutgoingfw;
 264         }else {
 265         # FORWARD PART
 266                 $fwdfwsettings{'config'}=$configfwdfw;
 267                 $fwdfwsettings{'chain'} = 'FORWARDFW';
 268                 $maxkey=&General::findhasharraykey(\%configfwdfw);
 269                 %rulehash=%configfwdfw;
 270         }
 271         #check if we have an identical rule already
 272         if($fwdfwsettings{'oldrulenumber'} eq $fwdfwsettings{'rulepos'}){
 273                 foreach my $key (sort keys %rulehash){
 274                         if (   "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'ruleremark'},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'},$fwdfwsettings{'LIMIT_CON_CON'},$fwdfwsettings{'concon'},$fwdfwsettings{'RATE_LIMIT'},$fwdfwsettings{'ratecon'},$fwdfwsettings{'RATETIME'}"
 275                                 eq "$rulehash{$key}[0],$rulehash{$key}[2],$rulehash{$key}[3],$rulehash{$key}[4],$rulehash{$key}[5],$rulehash{$key}[6],$rulehash{$key}[7],$rulehash{$key}[8],$rulehash{$key}[9],$rulehash{$key}[10],$rulehash{$key}[11],$rulehash{$key}[12],$rulehash{$key}[13],$rulehash{$key}[14],$rulehash{$key}[15],$rulehash{$key}[16],$rulehash{$key}[17],$rulehash{$key}[18],$rulehash{$key}[19],$rulehash{$key}[20],$rulehash{$key}[21],$rulehash{$key}[22],$rulehash{$key}[23],$rulehash{$key}[24],$rulehash{$key}[25],$rulehash{$key}[26],$rulehash{$key}[27],$rulehash{$key}[28],$rulehash{$key}[29],$rulehash{$key}[30],$rulehash{$key}[31],$rulehash{$key}[32],$rulehash{$key}[33],$rulehash{$key}[34],$rulehash{$key}[35],$rulehash{$key}[36]"){
 276                                         $errormessage.=$Lang::tr{'fwdfw err ruleexists'};
 277                                         if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){
 278                                                 $errormessage=$Lang::tr{'fwdfw err remark'}."<br>";
 279                                         }
 280                                         if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && &validremark($fwdfwsettings{'ruleremark'})){
 281                                                 $errormessage='';
 282                                         }
 283                                         if ($fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'}){
 284                                                 $fwdfwsettings{'nosave'} = 'on';
 285                                         }
 286                         }
 287                 }
 288         }
 289         #check Rulepos on new Rule
 290         if($fwdfwsettings{'rulepos'} > 0 && !$fwdfwsettings{'oldrulenumber'}){
 291                 $fwdfwsettings{'oldrulenumber'}=$maxkey;
 292                 foreach my $key (sort keys %rulehash){
 293                         if (   "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'},$fwdfwsettings{'LIMIT_CON_CON'},$fwdfwsettings{'concon'},$fwdfwsettings{'RATE_LIMIT'},$fwdfwsettings{'ratecon'},$fwdfwsettings{'RATETIME'}"
 294                                 eq "$rulehash{$key}[0],$rulehash{$key}[2],$rulehash{$key}[3],$rulehash{$key}[4],$rulehash{$key}[5],$rulehash{$key}[6],$rulehash{$key}[7],$rulehash{$key}[8],$rulehash{$key}[9],$rulehash{$key}[10],$rulehash{$key}[11],$rulehash{$key}[12],$rulehash{$key}[13],$rulehash{$key}[14],$rulehash{$key}[15],$rulehash{$key}[18],$rulehash{$key}[19],$rulehash{$key}[20],$rulehash{$key}[21],$rulehash{$key}[22],$rulehash{$key}[23],$rulehash{$key}[24],$rulehash{$key}[25],$rulehash{$key}[26],$rulehash{$key}[27],$rulehash{$key}[28],$rulehash{$key}[29],$rulehash{$key}[30],$rulehash{$key}[31],$rulehash{$key}[32],$rulehash{$key}[33],$rulehash{$key}[34],$rulehash{$key}[35],$rulehash{$key}[36]"){
 295                                         $errormessage.=$Lang::tr{'fwdfw err ruleexists'};
 296                         }
 297                 }
 298         }
 299         #check if we just close a rule
 300         if( $fwdfwsettings{'oldgrp1a'} eq  $fwdfwsettings{'grp1'} && $fwdfwsettings{'oldgrp1b'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'oldgrp2a'} eq  $fwdfwsettings{'grp2'} && $fwdfwsettings{'oldgrp2b'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} &&  $fwdfwsettings{'oldgrp3a'} eq $fwdfwsettings{'grp3'} && $fwdfwsettings{'oldgrp3b'} eq  $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'oldruletype'} eq $fwdfwsettings{'chain'}){
 301                 if($fwdfwsettings{'nosave'} eq 'on' && $fwdfwsettings{'updatefwrule'} eq 'on'){
 302                         $fwdfwsettings{'nosave2'} = 'on';
 303                         $errormessage='';
 304                 }
 305         }
 306         #check max concurrent connections per ip address
 307         if ($fwdfwsettings{'LIMIT_CON_CON'} eq 'ON'){
 308                 if (!($fwdfwsettings{'concon'} =~ /^(\d+)$/)) {
 309                         $errormessage.=$Lang::tr{'fwdfw err concon'};
 310                 }
 311         }else{
 312                 $fwdfwsettings{'concon'}='';
 313         }
 314         #check ratelimit value
 315         if ($fwdfwsettings{'RATE_LIMIT'} eq 'ON'){
 316                 if (!($fwdfwsettings{'ratecon'} =~ /^(\d+)$/)) {
 317                         $errormessage.=$Lang::tr{'fwdfw err ratecon'};
 318                 }
 319         }else{
 320                 $fwdfwsettings{'ratecon'}='';
 321         }
 322         #increase counters
 323         if (!$errormessage){
 324                 if ($fwdfwsettings{'nosave2'} ne 'on'){
 325                         &saverule(\%rulehash,$fwdfwsettings{'config'});
 326                 }
 327         }
 328         if ($errormessage){
 329                 &newrule;
 330         }else{
 331                 if($fwdfwsettings{'nosave2'} ne 'on'){
 332                         &General::firewall_config_changed();
 333                 }
 334                 &base;
 335         }
 336 }
 337 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw newrule'})
 338 {
 339         &newrule;
 340 }
 341 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw toggle'})
 342 {
 343         my %togglehash=();
 344         &General::readhasharray($fwdfwsettings{'config'}, \%togglehash);
 345         foreach my $key (sort keys %togglehash){
 346                 if ($key eq $fwdfwsettings{'key'}){
 347                         if ($togglehash{$key}[2] eq 'ON'){$togglehash{$key}[2]='';}else{$togglehash{$key}[2]='ON';}
 348                 }
 349         }
 350         &General::writehasharray($fwdfwsettings{'config'}, \%togglehash);
 351         &General::firewall_config_changed();
 352         &base;
 353 }
 354 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw togglelog'})
 355 {
 356         my %togglehash=();
 357         &General::readhasharray($fwdfwsettings{'config'}, \%togglehash);
 358         foreach my $key (sort keys %togglehash){
 359                 if ($key eq $fwdfwsettings{'key'}){
 360                         if ($togglehash{$key}[17] eq 'ON'){$togglehash{$key}[17]='';}else{$togglehash{$key}[17]='ON';}
 361                 }
 362         }
 363         &General::writehasharray($fwdfwsettings{'config'}, \%togglehash);
 364         &General::firewall_config_changed();
 365         &base;
 366 }
 367 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw reread'})
 368 {
 369         &General::firewall_reload();
 370         &base;
 371 }
 372 if ($fwdfwsettings{'ACTION'} eq 'editrule')
 373 {
 374         $fwdfwsettings{'updatefwrule'}='on';
 375         &newrule;
 376 }
 377 if ($fwdfwsettings{'ACTION'} eq 'deleterule')
 378 {
 379         &deleterule;
 380 }
 381 if ($fwdfwsettings{'ACTION'} eq 'moveup')
 382 {
 383         &pos_up;
 384         &base;
 385 }
 386 if ($fwdfwsettings{'ACTION'} eq 'movedown')
 387 {
 388         &pos_down;
 389         &base;
 390 }
 391 if ($fwdfwsettings{'ACTION'} eq 'copyrule')
 392 {
 393         $fwdfwsettings{'copyfwrule'}='on';
 394         &newrule;
 395 }
 396 if ($fwdfwsettings{'ACTION'} eq '' or $fwdfwsettings{'ACTION'} eq 'reset')
 397 {
 398         &base;
 399 }
 400 ###  Functions  ####
 401 sub addrule
 402 {
 403         &error;
 404
 405         &Header::openbox('100%', 'left', "");
 406         print <<END;
 407                 <form method="POST" action="">
 408                         <table border='0' width="100%">
 409                                 <tr>
 410                                         <td align='center'>
 411                                                 <input type='submit' name='ACTION' value='$Lang::tr{'fwdfw newrule'}'>
 412 END
 413
 414         if (&General::firewall_needs_reload()) {
 415                 print <<END;
 416                         <input type='submit' name='ACTION' value='$Lang::tr{'fwdfw reread'}' style='font-weight: bold; color: green;'>
 417 END
 418         }
 419
 420         print <<END;
 421                                         </td>
 422                                 </tr>
 423                         </table>
 424                 </form>
 425
 426                 <br>
 427 END
 428
 429         &Header::closebox();
 430         &viewtablerule;
 431 }
 432 sub base
 433 {
 434         &hint;
 435         &addrule;
 436 }
 437 sub changerule
 438 {
 439         my $oldchain=shift;
 440         $fwdfwsettings{'updatefwrule'}='';
 441         $fwdfwsettings{'config'}=$oldchain;
 442         $fwdfwsettings{'nobase'}='on';
 443         &deleterule;
 444 }
 445 sub checksource
 446 {
 447         my ($ip,$subnet);
 448         #check ip-address if manual
 449         if ($fwdfwsettings{'src_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'src_addr'} ne ''){
 450                 #check if ip with subnet
 451                 if ($fwdfwsettings{'src_addr'} =~ /^(.*?)\/(.*?)$/) {
 452                         ($ip,$subnet)=split (/\//,$fwdfwsettings{'src_addr'});
 453                         $subnet = &General::iporsubtocidr($subnet);
 454                         $fwdfwsettings{'isip'}='on';
 455                 }
 456                 #check if only ip
 457                 if($fwdfwsettings{'src_addr'}=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/){
 458                         $ip=$fwdfwsettings{'src_addr'};
 459                         $subnet = '32';
 460                         $fwdfwsettings{'isip'}='on';
 461                 }
 462
 463                 if ($fwdfwsettings{'isip'} ne 'on'){
 464                         if (&General::validmac($fwdfwsettings{'src_addr'})){
 465                                 $fwdfwsettings{'ismac'}='on';
 466                         }
 467                 }
 468                 if ($fwdfwsettings{'isip'} eq 'on'){
 469                         #remove leading zero
 470                         $ip = &Network::ip_remove_zero($ip);
 471
 472                         ##check if ip is valid
 473                         if (! &General::validip($ip)){
 474                                 $errormessage.=$Lang::tr{'fwdfw err src_addr'}."<br>";
 475                                 return $errormessage;
 476                         }
 477                         #check and form valid IP
 478                         $ip=&General::ip2dec($ip);
 479                         $ip=&General::dec2ip($ip);
 480                         #check if net or broadcast
 481                         $fwdfwsettings{'src_addr'}="$ip/$subnet";
 482                         if(!&General::validipandmask($fwdfwsettings{'src_addr'})){
 483                                 $errormessage.=$Lang::tr{'fwdfw err src_addr'}."<br>";
 484                                 return $errormessage;
 485                         }
 486                 }
 487                 if ($fwdfwsettings{'isip'} ne 'on' && $fwdfwsettings{'ismac'} ne 'on'){
 488                         $errormessage.=$Lang::tr{'fwdfw err src_addr'}."<br>";
 489                         return $errormessage;
 490                 }
 491         }elsif($fwdfwsettings{'src_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'src_addr'} eq ''){
 492                 $fwdfwsettings{'grp1'}='std_net_src';
 493                 $fwdfwsettings{$fwdfwsettings{'grp1'}} = 'ALL';
 494         }
 495
 496         #check empty fields
 497         if ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq ''){ $errormessage.=$Lang::tr{'fwdfw err nosrc'}."<br>";}
 498         if($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP') && $fwdfwsettings{'SRC_PORT'} ne ''){
 499                 my @parts=split(",",$fwdfwsettings{'SRC_PORT'});
 500                 my @values=();
 501                 foreach (@parts){
 502                         chomp($_);
 503                         if ($_ =~ /^(\d+)\-(\d+)$/ || $_ =~ /^(\d+)\:(\d+)$/) {
 504                                 my $check;
 505                                 #change dashes with :
 506                                 $_=~ tr/-/:/;
 507                                 if ($_ eq "*") {
 508                                         push(@values,"1:65535");
 509                                         $check='on';
 510                                 }
 511                                 if ($_ =~ /^(\D)\:(\d+)$/ || $_ =~ /^(\D)\-(\d+)$/) {
 512                                         push(@values,"1:$2");
 513                                         $check='on';
 514                                 }
 515                                 if ($_ =~ /^(\d+)\:(\D)$/ || $_ =~ /^(\d+)\-(\D)$/ ) {
 516                                         push(@values,"$1:65535");
 517                                         $check='on'
 518                                 }
 519                                 $errormessage .= &General::validportrange($_, 'destination');
 520                                 if(!$check){
 521                                         push (@values,$_);
 522                                 }
 523                         }else{
 524                                 if (&General::validport($_)){
 525                                         push (@values,$_);
 526                                 }else{
 527
 528                                 }
 529                         }
 530                 }
 531                 $fwdfwsettings{'SRC_PORT'}=join("|",@values);
 532         }
 533         return $errormessage;
 534 }
 535 sub checktarget
 536 {
 537         my ($ip,$subnet);
 538         &General::readhasharray("$configsrv", \%customservice);
 539         #check DNAT settings (has to be single Host and single Port or portrange)
 540         if ($fwdfwsettings{'USE_NAT'} eq 'ON' && $fwdfwsettings{'nat'} eq 'dnat'){
 541                 if($fwdfwsettings{'grp2'} eq 'tgt_addr' || $fwdfwsettings{'grp2'} eq 'cust_host_tgt' || $fwdfwsettings{'grp2'} eq 'ovpn_host_tgt'){
 542                         #check if Port is a single Port or portrange
 543                         if ($fwdfwsettings{'nat'} eq 'dnat' &&  $fwdfwsettings{'grp3'} eq 'TGT_PORT'){
 544                                 if(($fwdfwsettings{'PROT'} ne 'TCP'|| $fwdfwsettings{'PROT'} ne 'UDP') && $fwdfwsettings{'TGT_PORT'} eq ''){
 545                                         $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 546                                         return $errormessage;
 547                                 }
 548                                 if (($fwdfwsettings{'PROT'} eq 'TCP'|| $fwdfwsettings{'PROT'} eq 'UDP') && $fwdfwsettings{'TGT_PORT'} ne '' && !&check_natport($fwdfwsettings{'TGT_PORT'})){
 549                                         $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 550                                         return $errormessage;
 551                                 }
 552                         }
 553                 }else{
 554                         if ($fwdfwsettings{'grp2'} ne 'ipfire'){
 555                                 $errormessage=$Lang::tr{'fwdfw dnat error'}."<br>";
 556                                 return $errormessage;
 557                         }
 558                 }
 559         }
 560         if ($fwdfwsettings{'tgt_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'tgt_addr'} ne ''){
 561                 #check if ip with subnet
 562                 if ($fwdfwsettings{'tgt_addr'} =~ /^(.*?)\/(.*?)$/) {
 563                         ($ip,$subnet)=split (/\//,$fwdfwsettings{'tgt_addr'});
 564                         $subnet = &General::iporsubtocidr($subnet);
 565                 }
 566
 567                 #check if only ip
 568                 if($fwdfwsettings{'tgt_addr'}=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/){
 569                         $ip=$fwdfwsettings{'tgt_addr'};
 570                         $subnet='32';
 571                 }
 572                 #remove leading zero
 573                 $ip = &Network::ip_remove_zero($ip);
 574
 575                 #check if ip is valid
 576                 if (! &General::validip($ip)){
 577                         $errormessage.=$Lang::tr{'fwdfw err tgt_addr'}."<br>";
 578                         return $errormessage;
 579                 }
 580                 #check and form valid IP
 581                 $ip=&General::ip2dec($ip);
 582                 $ip=&General::dec2ip($ip);
 583                 $fwdfwsettings{'tgt_addr'}="$ip/$subnet";
 584                 if(!&General::validipandmask($fwdfwsettings{'tgt_addr'})){
 585                         $errormessage.=$Lang::tr{'fwdfw err tgt_addr'}."<br>";
 586                         return $errormessage;
 587                 }
 588         }elsif($fwdfwsettings{'tgt_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'tgt_addr'} eq ''){
 589                 $fwdfwsettings{'grp2'}='std_net_tgt';
 590                 $fwdfwsettings{$fwdfwsettings{'grp2'}} = 'ALL';
 591         }
 592         #check for mac in targetgroup
 593         if ($fwdfwsettings{'grp2'} eq 'cust_grp_tgt'){
 594                 &General::readhasharray("$configgrp", \%customgrp);
 595                 &General::readhasharray("$confighost", \%customhost);
 596                 foreach my $grpkey (sort keys %customgrp){
 597                         foreach my $hostkey (sort keys %customhost){
 598                                 if ($customgrp{$grpkey}[2] eq $customhost{$hostkey}[0] && $customgrp{$grpkey}[2] eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $customhost{$hostkey}[1] eq 'mac'){
 599                                         $hint=$Lang::tr{'fwdfw hint mac'};
 600                                         return $hint;
 601                                 }
 602                         }
 603                 }
 604         }
 605         #check empty fields
 606         if ($fwdfwsettings{$fwdfwsettings{'grp2'}} eq ''){ $errormessage.=$Lang::tr{'fwdfw err notgt'}."<br>";}
 607         #check tgt services
 608         if ($fwdfwsettings{'USESRV'} eq 'ON'){
 609                 if ($fwdfwsettings{'grp3'} eq 'cust_srv'){
 610                         $fwdfwsettings{'TGT_PROT'}='';
 611                         $fwdfwsettings{'ICMP_TGT'}='';
 612                         $fwdfwsettings{'TGT_PORT'}='';
 613                 }
 614                 if ($fwdfwsettings{'grp3'} eq 'cust_srvgrp'){
 615                         $fwdfwsettings{'TGT_PROT'}='';
 616                         $fwdfwsettings{'ICMP_TGT'}='';
 617                         $fwdfwsettings{'TGT_PORT'}='';
 618                         #check target service
 619                         if($fwdfwsettings{$fwdfwsettings{'grp3'}} eq ''){
 620                                 $errormessage.=$Lang::tr{'fwdfw err tgt_grp'};
 621                         }
 622                 }
 623                 if ($fwdfwsettings{'grp3'} eq 'TGT_PORT'){
 624                         if ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP'){
 625                                 if ($fwdfwsettings{'TGT_PORT'} ne ''){
 626                                         if ($fwdfwsettings{'TGT_PORT'} =~ "," && $fwdfwsettings{'USE_NAT'} && $fwdfwsettings{'nat'} eq 'dnat') {
 627                                                 $errormessage=$Lang::tr{'fwdfw dnat porterr'}."<br>";
 628                                                 return $errormessage;
 629                                         }
 630                                         my @parts=split(",",$fwdfwsettings{'TGT_PORT'});
 631                                         my @values=();
 632                                         foreach (@parts){
 633                                                 chomp($_);
 634                                                 if ($_ =~ /^(\d+)\-(\d+)$/ || $_ =~ /^(\d+)\:(\d+)$/) {
 635                                                         my $check;
 636                                                         #change dashes with :
 637                                                         $_=~ tr/-/:/;
 638                                                         if ($_ eq "*") {
 639                                                                 push(@values,"1:65535");
 640                                                                 $check='on';
 641                                                         }
 642                                                         if ($_ =~ /^(\D)\:(\d+)$/ || $_ =~ /^(\D)\-(\d+)$/) {
 643                                                                 push(@values,"1:$2");
 644                                                                 $check='on';
 645                                                         }
 646                                                         if ($_ =~ /^(\d+)\:(\D)$/ || $_ =~ /^(\d+)\-(\D)$/) {
 647                                                                 push(@values,"$1:65535");
 648                                                                 $check='on'
 649                                                         }
 650                                                         $errormessage .= &General::validportrange($_, 'destination');
 651                                                         if(!$check){
 652                                                                 push (@values,$_);
 653                                                         }
 654                                                 }else{
 655                                                         if (&General::validport($_)){
 656                                                                 push (@values,$_);
 657                                                         }else{
 658                                                                 $errormessage=$Lang::tr{'fwdfw err tgt_port'};
 659                                                                 return $errormessage;
 660                                                         }
 661                                                 }
 662                                         }
 663                                         $fwdfwsettings{'TGT_PORT'}=join("|",@values);
 664                                 }
 665                         }elsif ($fwdfwsettings{'PROT'} eq 'GRE'){
 666                                         $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 667                                         $fwdfwsettings{'TGT_PORT'} = '';
 668                                         $fwdfwsettings{'ICMP_TGT'} = '';
 669                         }elsif ($fwdfwsettings{'PROT'} eq 'ESP'){
 670                                         $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 671                                         $fwdfwsettings{'TGT_PORT'} = '';
 672                                         $fwdfwsettings{'ICMP_TGT'}='';
 673                         }elsif ($fwdfwsettings{'PROT'} eq 'AH'){
 674                                         $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 675                                         $fwdfwsettings{'TGT_PORT'} = '';
 676                                         $fwdfwsettings{'ICMP_TGT'}='';
 677                         }elsif ($fwdfwsettings{'PROT'} eq 'ICMP'){
 678                                 $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 679                                 $fwdfwsettings{'TGT_PORT'} = '';
 680                         }
 681                 }
 682         }
 683         #check targetport
 684         if ($fwdfwsettings{'USESRV'} ne 'ON'){
 685                 $fwdfwsettings{'grp3'}='';
 686                 $fwdfwsettings{$fwdfwsettings{'grp3'}}='';
 687                 $fwdfwsettings{'ICMP_TGT'}='';
 688         }
 689         #check timeframe
 690         if($fwdfwsettings{'TIME'} eq 'ON'){
 691                 if($fwdfwsettings{'TIME_MON'} eq '' && $fwdfwsettings{'TIME_TUE'} eq '' && $fwdfwsettings{'TIME_WED'} eq '' && $fwdfwsettings{'TIME_THU'} eq '' && $fwdfwsettings{'TIME_FRI'} eq '' && $fwdfwsettings{'TIME_SAT'} eq '' && $fwdfwsettings{'TIME_SUN'} eq ''){
 692                         $errormessage=$Lang::tr{'fwdfw err time'};
 693                         return $errormessage;
 694                 }
 695         }
 696         return $errormessage;
 697 }
 698 sub check_natport
 699 {
 700         my $val=shift;
 701         if($fwdfwsettings{'USE_NAT'} eq 'ON' && $fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){
 702                 if ($fwdfwsettings{'dnatport'} =~ /^(\d+)\-(\d+)$/) {
 703                         $fwdfwsettings{'dnatport'} =~ tr/-/:/;
 704                         if ($fwdfwsettings{'dnatport'} eq "*") {
 705                                 $fwdfwsettings{'dnatport'}="1:65535";
 706                         }
 707                         if ($fwdfwsettings{'dnatport'} =~ /^(\D)\:(\d+)$/) {
 708                                 $fwdfwsettings{'dnatport'} = "1:$2";
 709                         }
 710                         if ($fwdfwsettings{'dnatport'} =~ /^(\d+)\:(\D)$/) {
 711                                 $fwdfwsettings{'dnatport'} ="$1:65535";
 712                         }
 713                 }
 714                 return 1;
 715         }
 716         if ($val =~ "," || $val>65536 || $val<0){
 717                 return 0;
 718         }
 719         return 1;
 720 }
 721 sub checkrule
 722 {
 723         #check valid port for NAT
 724         if($fwdfwsettings{'USE_NAT'} eq 'ON'){
 725                 #RULE_ACTION must be ACCEPT if we use NAT
 726                 $fwdfwsettings{'RULE_ACTION'} = 'ACCEPT';
 727
 728                 #if no dnat or snat selected errormessage
 729                 if ($fwdfwsettings{'nat'} eq ''){
 730                         $errormessage=$Lang::tr{'fwdfw dnat nochoice'};
 731                         return;
 732                 }
 733
 734                 #if using snat, the external port has to be empty
 735                 if ($fwdfwsettings{'nat'} eq 'snat' && $fwdfwsettings{'dnatport'} ne ''){
 736                         $errormessage=$Lang::tr{'fwdfw dnat extport'};
 737                         return;
 738                 }
 739                 #if no dest port is given in nat area, take target host port
 740                 if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'TGT_PORT' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$fwdfwsettings{'TGT_PORT'};}
 741                 if($fwdfwsettings{'TGT_PORT'} eq '' && $fwdfwsettings{'dnatport'} ne '' && ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP')){
 742                         $errormessage=$Lang::tr{'fwdfw dnat porterr2'};
 743                         return;
 744                 }
 745                 #check if port given in nat area is a single valid port or portrange
 746                 if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'TGT_PORT'} ne '' && !&check_natport($fwdfwsettings{'dnatport'})){
 747                         $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 748                 }elsif($fwdfwsettings{'USESRV'} eq 'ON' && $fwdfwsettings{'grp3'} eq 'cust_srv'){
 749                         my $custsrvport;
 750                         #get service Protocol and Port
 751                         foreach my $key (sort keys %customservice){
 752                                 if($fwdfwsettings{$fwdfwsettings{'grp3'}} eq $customservice{$key}[0]){
 753                                         if ($customservice{$key}[2] ne 'TCP' && $customservice{$key}[2] ne 'UDP'){
 754                                                 $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 755                                         }
 756                                         $custsrvport= $customservice{$key}[1];
 757                                 }
 758                         }
 759                         if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$custsrvport;}
 760                 }
 761                 #check if DNAT port is multiple
 762                 if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){
 763                         my @parts=split(",",$fwdfwsettings{'dnatport'});
 764                                         my @values=();
 765                                         foreach (@parts){
 766                                                 chomp($_);
 767                                                 if ($_ =~ /^(\d+)\-(\d+)$/ || $_ =~ /^(\d+)\:(\d+)$/) {
 768                                                         my $check;
 769                                                         #change dashes with :
 770                                                         $_=~ tr/-/:/;
 771                                                         if ($_ eq "*") {
 772                                                                 push(@values,"1:65535");
 773                                                                 $check='on';
 774                                                         }
 775                                                         if ($_ =~ /^(\D)\:(\d+)$/ || $_ =~ /^(\D)\-(\d+)$/) {
 776                                                                 push(@values,"1:$2");
 777                                                                 $check='on';
 778                                                         }
 779                                                         if ($_ =~ /^(\d+)\:(\D)$/ || $_ =~ /^(\d+)\-(\D)$/) {
 780                                                                 push(@values,"$1:65535");
 781                                                                 $check='on'
 782                                                         }
 783                                                         $errormessage .= &General::validportrange($_, 'destination');
 784                                                         if(!$check){
 785                                                                 push (@values,$_);
 786                                                         }
 787                                                 }else{
 788                                                         if (&General::validport($_)){
 789                                                                 push (@values,$_);
 790                                                         }else{
 791
 792                                                         }
 793                                                 }
 794                                         }
 795                                         $fwdfwsettings{'dnatport'}=join("|",@values);
 796                 }
 797                 #check if a rule with prot tcp or udp and ports is edited and now prot is "all", then delete all ports
 798                 if($fwdfwsettings{'PROT'} eq ''){
 799                         $fwdfwsettings{'dnatport'}='';
 800                 }
 801         }
 802         #check valid remark
 803         if ($fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){
 804                 $errormessage.=$Lang::tr{'fwdfw err remark'}."<br>";
 805         }
 806         #check if source and target identical
 807         if ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ALL' && $fwdfwsettings{'grp2'} ne 'ipfire'){
 808                 $errormessage=$Lang::tr{'fwdfw err same'};
 809                 return $errormessage;
 810         }
 811         #get source and targetip address if possible
 812         my ($sip,$scidr,$tip,$tcidr);
 813         ($sip,$scidr)=&get_ip("src","grp1");
 814         ($tip,$tcidr)=&get_ip("tgt","grp2");
 815         #check same iprange in source and target
 816         if ($sip ne '' && $scidr ne '' && $tip ne '' && $tcidr ne ''){
 817                 my $networkip1=&General::getnetworkip($sip,$scidr);
 818                 my $networkip2=&General::getnetworkip($tip,$tcidr);
 819                 if ($scidr gt $tcidr){
 820                         if ( &General::IpInSubnet($networkip1,$tip,&General::iporsubtodec($tcidr))){
 821                                 $errormessage.=$Lang::tr{'fwdfw err samesub'};
 822                         }
 823                 }elsif($scidr eq $tcidr && $scidr eq '32'){
 824                         my ($sbyte1,$sbyte2,$sbyte3,$sbyte4)=split(/\./,$networkip1);
 825                         my ($tbyte1,$tbyte2,$tbyte3,$tbyte4)=split(/\./,$networkip2);
 826                                 if ($sbyte1 eq $tbyte1 && $sbyte2 eq $tbyte2 && $sbyte3 eq $tbyte3){
 827                                         $hint=$Lang::tr{'fwdfw hint ip1'}."<br>";
 828                                         $hint.=$Lang::tr{'fwdfw hint ip2'}." Source: $networkip1/$scidr Target: $networkip2/$tcidr<br>";
 829                                 }
 830                 }else{
 831                         if ( &General::IpInSubnet($networkip2,$sip,&General::iporsubtodec($scidr)) ){
 832                         $errormessage.=$Lang::tr{'fwdfw err samesub'};
 833                         }
 834                 }
 835         }
 836         #when icmp selected, no source and targetport allowed
 837         if (($fwdfwsettings{'PROT'} ne '' && $fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP' && $fwdfwsettings{'PROT'} ne 'template') && ($fwdfwsettings{'USESRV'} eq 'ON' || $fwdfwsettings{'USE_SRC_PORT'} eq 'ON')){
 838                 $errormessage.=$Lang::tr{'fwdfw err prot_port'};
 839                 return;
 840         }
 841         #change protocol if prot not equal dest single service
 842         if ($fwdfwsettings{'grp3'} eq 'cust_srv'){
 843                 foreach my $key (sort keys %customservice){
 844                         if($customservice{$key}[0] eq $fwdfwsettings{$fwdfwsettings{'grp3'}}){
 845                                 if ($customservice{$key}[2] ne $fwdfwsettings{'PROT'}){
 846                                         $fwdfwsettings{'PROT'} = $customservice{$key}[2];
 847                                         last;
 848                                 }
 849                         }
 850                 }
 851         }
 852         #check source and destination protocol if source manual and dest servicegroup
 853         if ($fwdfwsettings{'grp3'} eq 'cust_srvgrp'){
 854                 $fwdfwsettings{'PROT'} = '';
 855         }
 856         #ATTENTION: $fwdfwsetting{'TGT_PROT'} deprecated since 30.09.2013
 857         $fwdfwsettings{'TGT_PROT'}=''; #Set field empty (deprecated)
 858         #Check ICMP Types
 859         if ($fwdfwsettings{'PROT'} eq 'ICMP'){
 860                 $fwdfwsettings{'USE_SRC_PORT'}='';
 861                 $fwdfwsettings{'SRC_PORT'}='';
 862                 #$fwdfwsettings{'USESRV'}='';
 863                 $fwdfwsettings{'TGT_PORT'}='';
 864                 &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
 865                 foreach my $key (keys %icmptypes){
 866                         if($fwdfwsettings{'ICMP_TYPES'} eq "$icmptypes{$key}[0] ($icmptypes{$key}[1])"){
 867                                 $fwdfwsettings{'ICMP_TYPES'}="$icmptypes{$key}[0]";
 868                         }
 869                 }
 870         }elsif($fwdfwsettings{'PROT'} eq 'GRE'){
 871                 $fwdfwsettings{'USE_SRC_PORT'}='';
 872                 $fwdfwsettings{'SRC_PORT'}='';
 873                 $fwdfwsettings{'ICMP_TYPES'}='';
 874                 $fwdfwsettings{'USESRV'}='';
 875                 $fwdfwsettings{'TGT_PORT'}='';
 876         }elsif($fwdfwsettings{'PROT'} eq 'ESP'){
 877                 $fwdfwsettings{'USE_SRC_PORT'}='';
 878                 $fwdfwsettings{'SRC_PORT'}='';
 879                 $fwdfwsettings{'ICMP_TYPES'}='';
 880                 $fwdfwsettings{'USESRV'}='';
 881                 $fwdfwsettings{'TGT_PORT'}='';
 882         }elsif($fwdfwsettings{'PROT'} eq 'AH'){
 883                 $fwdfwsettings{'USE_SRC_PORT'}='';
 884                 $fwdfwsettings{'SRC_PORT'}='';
 885                 $fwdfwsettings{'ICMP_TYPES'}='';
 886                 $fwdfwsettings{'USESRV'}='';
 887                 $fwdfwsettings{'TGT_PORT'}='';
 888         }elsif($fwdfwsettings{'PROT'} eq 'IGMP'){
 889                 $fwdfwsettings{'USE_SRC_PORT'}='';
 890                 $fwdfwsettings{'SRC_PORT'}='';
 891                 $fwdfwsettings{'ICMP_TYPES'}='';
 892                 $fwdfwsettings{'USESRV'}='';
 893                 $fwdfwsettings{'TGT_PORT'}='';
 894         }elsif($fwdfwsettings{'PROT'} eq 'IPv6'){
 895                 $fwdfwsettings{'USE_SRC_PORT'}='';
 896                 $fwdfwsettings{'SRC_PORT'}='';
 897                 $fwdfwsettings{'ICMP_TYPES'}='';
 898                 $fwdfwsettings{'USESRV'}='';
 899                 $fwdfwsettings{'TGT_PORT'}='';
 900         }elsif($fwdfwsettings{'PROT'} eq 'IPIP'){
 901                 $fwdfwsettings{'USE_SRC_PORT'}='';
 902                 $fwdfwsettings{'SRC_PORT'}='';
 903                 $fwdfwsettings{'ICMP_TYPES'}='';
 904                 $fwdfwsettings{'USESRV'}='';
 905                 $fwdfwsettings{'TGT_PORT'}='';
 906         }elsif($fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP'){
 907                 $fwdfwsettings{'ICMP_TYPES'}='';
 908                 $fwdfwsettings{'SRC_PORT'}='';
 909                 $fwdfwsettings{'TGT_PORT'}='';
 910         }elsif($fwdfwsettings{'PROT'} ne 'ICMP'){
 911                 $fwdfwsettings{'ICMP_TYPES'}='';
 912         }
 913 }
 914 sub checkvpn
 915 {
 916         my $ip=shift;
 917         #Test if manual IP is part of static OpenVPN networks
 918         &General::readhasharray("$configccdnet", \%ccdnet);
 919         foreach my $key (sort keys %ccdnet){
 920                 my ($vpnip,$vpnsubnet) = split ("/",$ccdnet{$key}[1]);
 921                 my $sub=&General::iporsubtodec($vpnsubnet);
 922                 if (&General::IpInSubnet($ip,$vpnip,$sub)){
 923                         return 0;
 924                 }
 925         }
 926         # A Test if manual ip is part of dynamic openvpn subnet is made in getcolor
 927         # because if one creates a custom host with the ip, we need to check the color there!
 928         # It does not make sense to check this here
 929
 930         # Test if manual IP is part of an OpenVPN N2N subnet does also not make sense here
 931         # Is also checked in getcolor
 932
 933         # Test if manual ip is part of an IPsec Network is also checked in getcolor
 934         return 1;
 935 }
 936 sub checkvpncolor
 937 {
 938
 939 }
 940 sub deleterule
 941 {
 942         my %delhash=();
 943         &General::readhasharray($fwdfwsettings{'config'}, \%delhash);
 944         foreach my $key (sort {$a <=> $b} keys %delhash){
 945                 if ($key >= $fwdfwsettings{'key'}) {
 946                         my $next = $key + 1;
 947                         if (exists $delhash{$next}) {
 948                                 foreach my $i (0 .. $#{$delhash{$next}}) {
 949                                         $delhash{$key}[$i] = $delhash{$next}[$i];
 950                                 }
 951                         }
 952                 }
 953         }
 954         # Remove the very last entry.
 955         my $last_key = (sort {$a <=> $b} keys %delhash)[-1];
 956         delete $delhash{$last_key};
 957
 958         &General::writehasharray($fwdfwsettings{'config'}, \%delhash);
 959         &General::firewall_config_changed();
 960
 961         if($fwdfwsettings{'nobase'} ne 'on'){
 962                 &base;
 963         }
 964 }
 965 sub del_double
 966 {
 967         my %all=();
 968         @all{@_}=1;
 969         return (keys %all);
 970 }
 971 sub disable_rule
 972 {
 973         my $key1=shift;
 974         &General::readhasharray("$configfwdfw", \%configfwdfw);
 975         foreach my $key (sort keys %configfwdfw){
 976                         if ($key eq $key1 ){
 977                         if ($configfwdfw{$key}[2] eq 'ON'){$configfwdfw{$key}[2]='';}
 978                 }
 979         }
 980         &General::writehasharray("$configfwdfw", \%configfwdfw);
 981         &General::firewall_config_changed();
 982 }
 983 sub error
 984 {
 985         if ($errormessage) {
 986                 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
 987                 print "<class name='base'>$errormessage\n";
 988                 print "&nbsp;</class>\n";
 989                 &Header::closebox();
 990         }
 991 }
 992 sub fillselect
 993 {
 994         my %hash=%{(shift)};
 995         my $val=shift;
 996         my $key;
 997         foreach my $key (sort { ncmp($hash{$a}[0],$hash{$b}[0]) }  keys %hash){
 998                 if($hash{$key}[0] eq $val){
 999                         print"<option value='$hash{$key}[0]' selected>$hash{$key}[0]</option>";
1000                 }else{
1001                         print"<option value='$hash{$key}[0]'>$hash{$key}[0]</option>";
1002                 }
1003         }
1004 }
1005 sub gen_dd_block
1006 {
1007         my $srctgt = shift;
1008         my $grp=shift;
1009         my $helper='';
1010         my $show='';
1011         $checked{'grp1'}{$fwdfwsettings{'grp1'}}                                = 'CHECKED';
1012         $checked{'grp2'}{$fwdfwsettings{'grp2'}}                                = 'CHECKED';
1013         $checked{'grp3'}{$fwdfwsettings{'grp3'}}                                = 'CHECKED';
1014         $checked{'USE_SRC_PORT'}{$fwdfwsettings{'USE_SRC_PORT'}} = 'CHECKED';
1015         $checked{'USESRV'}{$fwdfwsettings{'USESRV'}}                    = 'CHECKED';
1016         $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}}                    = 'CHECKED';
1017         $checked{'LOG'}{$fwdfwsettings{'LOG'}}                                  = 'CHECKED';
1018         $checked{'TIME'}{$fwdfwsettings{'TIME'}}                                = 'CHECKED';
1019         $checked{'TIME_MON'}{$fwdfwsettings{'TIME_MON'}}                = 'CHECKED';
1020         $checked{'TIME_TUE'}{$fwdfwsettings{'TIME_TUE'}}                = 'CHECKED';
1021         $checked{'TIME_WED'}{$fwdfwsettings{'TIME_WED'}}                = 'CHECKED';
1022         $checked{'TIME_THU'}{$fwdfwsettings{'TIME_THU'}}                = 'CHECKED';
1023         $checked{'TIME_FRI'}{$fwdfwsettings{'TIME_FRI'}}                = 'CHECKED';
1024         $checked{'TIME_SAT'}{$fwdfwsettings{'TIME_SAT'}}                = 'CHECKED';
1025         $checked{'TIME_SUN'}{$fwdfwsettings{'TIME_SUN'}}                = 'CHECKED';
1026         $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}}             = 'selected';
1027         $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}}                 = 'selected';
1028         $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected';
1029         $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected';
1030 print<<END;
1031                 <table width='100%' border='0'>
1032                 <tr><td width='50%' valign='top'>
1033                 <table width='95%' border='0'>
1034                 <tr><td width='1%'><input type='radio' name='$grp' id='std_net_$srctgt' value='std_net_$srctgt' $checked{$grp}{'std_net_'.$srctgt}></td><td>$Lang::tr{'fwhost stdnet'}</td><td align='right'><select name='std_net_$srctgt' style='width:200px;'>
1035 END
1036         foreach my $network (sort keys %defaultNetworks)
1037                 {
1038                         next if($defaultNetworks{$network}{'NAME'} eq "IPFire");
1039                         print "<option value='$defaultNetworks{$network}{'NAME'}'";
1040                         print " selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $defaultNetworks{$network}{'NAME'});
1041                         my $defnet="$defaultNetworks{$network}{'NAME'}_NETADDRESS";
1042                         my $defsub="$defaultNetworks{$network}{'NAME'}_NETMASK";
1043                         my $defsub1=&General::subtocidr($ifaces{$defsub});
1044                         $ifaces{$defnet}='' if ($defaultNetworks{$network}{'NAME'} eq 'RED');
1045                         if ($ifaces{$defnet}){
1046                                 print ">$network ($ifaces{$defnet}/$defsub1)</option>";
1047                         }else{
1048                                 print ">$network</option>";
1049                         }
1050                 }
1051         print"</select></td></tr>";
1052         #custom networks
1053         if (! -z $confignet || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1054                 print"<tr><td><input type='radio' name='$grp' id='cust_net_$srctgt' value='cust_net_$srctgt' $checked{$grp}{'cust_net_'.$srctgt}></td><td>$Lang::tr{'fwhost cust net'}</td><td align='right'><select name='cust_net_$srctgt' style='width:200px;'>";
1055                 &fillselect(\%customnetwork,$fwdfwsettings{$fwdfwsettings{$grp}});
1056                 print"</select></td>";
1057         }
1058         #custom hosts
1059         if (! -z $confighost || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1060                 print"<tr><td><input type='radio' name='$grp' id='cust_host_$srctgt' value='cust_host_$srctgt' $checked{$grp}{'cust_host_'.$srctgt}></td><td>$Lang::tr{'fwhost cust addr'}</td><td align='right'><select name='cust_host_$srctgt' style='width:200px;'>";
1061                 &fillselect(\%customhost,$fwdfwsettings{$fwdfwsettings{$grp}});
1062                 print"</select></td>";
1063         }
1064         #custom groups
1065         if (! -z $configgrp || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1066                 print"<tr><td valign='top'><input type='radio' name='$grp' id='cust_grp_$srctgt' value='cust_grp_$srctgt' $checked{$grp}{'cust_grp_'.$srctgt}></td><td >$Lang::tr{'fwhost cust grp'}</td><td align='right'><select name='cust_grp_$srctgt' style='width:200px;'>";
1067                 foreach my $key (sort { ncmp($customgrp{$a}[0],$customgrp{$b}[0]) } keys %customgrp) {
1068                         if($helper ne $customgrp{$key}[0] && $customgrp{$key}[2] ne 'none'){
1069                                 print"<option ";
1070                                 print "selected='selected' " if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $customgrp{$key}[0]);
1071                                 print ">$customgrp{$key}[0]</option>";
1072                         }
1073                         $helper=$customgrp{$key}[0];
1074                 }
1075                 print"</select></td>";
1076         }
1077         # geoip locations / groups.
1078         my @geoip_locations = &fwlib::get_geoip_locations();
1079
1080         print "<tr>\n";
1081         print "<td valign='top'><input type='radio' name='$grp' id='cust_geoip_$srctgt' value='cust_geoip_$srctgt' $checked{$grp}{'cust_geoip_'.$srctgt}></td>\n";
1082         print "<td>$Lang::tr{'geoip'}</td>\n";
1083         print "<td align='right'><select name='cust_geoip_$srctgt' style='width:200px;'>\n";
1084
1085         # Add GeoIP groups to dropdown.
1086         if (!-z $configgeoipgrp) {
1087                 print "<optgroup label='$Lang::tr{'fwhost cust geoipgroup'}'>\n";
1088                 foreach my $key (sort { ncmp($customgeoipgrp{$a}[0],$customgeoipgrp{$b}[0]) } keys %customgeoipgrp) {
1089                         my $selected;
1090
1091                         # Generate stored value for select detection.
1092                         my $stored = join(':', "group",$customgeoipgrp{$key}[0]);
1093
1094                         # Only show a group once and group with elements.
1095                         if($helper ne $customgeoipgrp{$key}[0] && $customgeoipgrp{$key}[2] ne 'none') {
1096                                 # Mark current entry as selected.
1097                                 if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $stored) {
1098                                         $selected = "selected='selected'";
1099                                 }
1100                                 print"<option $selected value='group:$customgeoipgrp{$key}[0]'>$customgeoipgrp{$key}[0]</option>\n";
1101                         }
1102                         $helper=$customgeoipgrp{$key}[0];
1103                 }
1104                 print "</optgroup>\n";
1105         }
1106
1107         # Add locations.
1108         print "<optgroup label='$Lang::tr{'fwhost cust geoiplocation'}'>\n";
1109         foreach my $location (@geoip_locations) {
1110                 # Get country name.
1111                 my $country_name = &GeoIP::get_full_country_name($location);
1112
1113                 # Mark current entry as selected.
1114                 my $selected;
1115                 if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $location) {
1116                         $selected = "selected='selected'";
1117                 }
1118                 print "<option $selected value='$location'>$location - $country_name</option>\n";
1119         }
1120         print "</optgroup>\n";
1121
1122         # Close GeoIP dropdown.
1123         print "</select></td>\n";
1124
1125         #End left table. start right table (vpn)
1126         print"</tr></table></td><td valign='top'><table width='95%' border='0' align='right'><tr>";
1127         # CCD networks
1128         if( ! -z $configccdnet || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1129                 print"<td width='1%'><input type='radio' name='$grp' id='ovpn_net_$srctgt' value='ovpn_net_$srctgt'  $checked{$grp}{'ovpn_net_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ccdnet'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_net_$srctgt' style='width:200px;'>";
1130                 &fillselect(\%ccdnet,$fwdfwsettings{$fwdfwsettings{$grp}});
1131                 print"</select></td></tr>";
1132         }
1133         #OVPN CCD Hosts
1134         foreach my $key (sort { ncmp($ccdhost{$a}[0],$ccdhost{$b}[0]) } keys %ccdhost){
1135                 if ($ccdhost{$key}[33] ne '' ){
1136                         print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_host_$srctgt' value='ovpn_host_$srctgt' $checked{$grp}{'ovpn_host_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ccdhost'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_host_$srctgt' style='width:200px;'>" if ($show eq '');
1137                         $show='1';
1138                         print "<option value='$ccdhost{$key}[1]'";
1139                         print "selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $ccdhost{$key}[1]);
1140                         print ">$ccdhost{$key}[1]</option>";
1141                 }
1142         }
1143         if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){
1144                 print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_host_$srctgt' value='ovpn_host_$srctgt' $checked{$grp}{'ovpn_host_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ccdhost'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_host_$srctgt' style='width:200px;'></select></td></tr>" ;
1145         }
1146         if ($show eq '1'){$show='';print"</select></td></tr>";}
1147         #OVPN N2N
1148         foreach my $key (sort { ncmp($ccdhost{$a}[1],$ccdhost{$b}[1]) } keys %ccdhost){
1149                 if ($ccdhost{$key}[3] eq 'net'){
1150                         print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_n2n_$srctgt' value='ovpn_n2n_$srctgt' $checked{$grp}{'ovpn_n2n_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ovpn_n2n'}:</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_n2n_$srctgt' style='width:200px;'>" if ($show eq '');
1151                         $show='1';
1152                         print "<option value='$ccdhost{$key}[1]'";
1153                         print "selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $ccdhost{$key}[1]);
1154                         print ">$ccdhost{$key}[1]</option>";
1155                 }
1156         }
1157         if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){
1158                 print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_n2n_$srctgt' value='ovpn_n2n_$srctgt' $checked{$grp}{'ovpn_n2n_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ovpn_n2n'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_n2n_$srctgt' style='width:200px;'></select></td></tr>" ;
1159         }
1160         if ($show eq '1'){$show='';print"</select></td></tr>";}
1161         #IPsec netze
1162         foreach my $key (sort { ncmp($ipsecconf{$a}[1],$ipsecconf{$b}[1]) } keys %ipsecconf) {
1163                 if ($ipsecconf{$key}[3] eq 'net' || ($optionsfw{'SHOWDROPDOWN'} eq 'on' && $ipsecconf{$key}[3] ne 'host')){
1164                         print"<tr><td valign='top'><input type='radio' name='$grp' value='ipsec_net_$srctgt' $checked{$grp}{'ipsec_net_'.$srctgt}></td><td >$Lang::tr{'fwhost ipsec net'}</td><td align='right'><select name='ipsec_net_$srctgt' style='width:200px;'>" if ($show eq '');
1165                         $show='1';
1166                         print "<option ";
1167                         print "selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $ipsecconf{$key}[1]);
1168                         print ">$ipsecconf{$key}[1]</option>";
1169                 }
1170         }
1171         if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){
1172                 print"<tr><td valign='top'><input type='radio' name='$grp' id='ipsec_net_$srctgt' value='ipsec_net_$srctgt' $checked{$grp}{'ipsec_net_'.$srctgt}></td><td >$Lang::tr{'fwhost ipsec net'}</td><td align='right'><select name='ipsec_net_$srctgt' style='width:200px;'><select></td></tr>";
1173         }
1174         if ($show eq '1'){$show='';print"</select></td></tr>";}
1175
1176         print"</table>";
1177         print"</td></tr></table><br>";
1178 }
1179 sub get_ip
1180 {
1181         my $val=shift;
1182         my $grp =shift;
1183         my $a;
1184         my $b;
1185         &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
1186         if ($fwdfwsettings{$grp} ne $Lang::tr{'fwhost any'}){
1187                 if ($fwdfwsettings{$grp} eq $val.'_addr'){
1188                         ($a,$b)   = split (/\//, $fwdfwsettings{$fwdfwsettings{$grp}});
1189                 }elsif($fwdfwsettings{$grp} eq 'std_net_'.$val){
1190                         if ($fwdfwsettings{$fwdfwsettings{$grp}} =~ /Gr/i){
1191                                 $a=$netsettings{'GREEN_NETADDRESS'};
1192                                 $b=&General::iporsubtocidr($netsettings{'GREEN_NETMASK'});
1193                         }elsif($fwdfwsettings{$fwdfwsettings{$grp}} =~ /Ora/i){
1194                                 $a=$netsettings{'ORANGE_NETADDRESS'};
1195                                 $b=&General::iporsubtocidr($netsettings{'ORANGE_NETMASK'});
1196                         }elsif($fwdfwsettings{$fwdfwsettings{$grp}} =~ /Bl/i){
1197                                 $a=$netsettings{'BLUE_NETADDRESS'};
1198                                 $b=&General::iporsubtocidr($netsettings{'BLUE_NETMASK'});
1199                         }elsif($fwdfwsettings{$fwdfwsettings{$grp}} =~ /OpenVPN/i){
1200                                 &General::readhash("$configovpn",\%ovpnsettings);
1201                                 ($a,$b)   = split (/\//, $ovpnsettings{'DOVPN_SUBNET'});
1202                                 $b=&General::iporsubtocidr($b);
1203                         }
1204                 }elsif($fwdfwsettings{$grp} eq 'cust_net_'.$val){
1205                         &General::readhasharray("$confignet", \%customnetwork);
1206                         foreach my $key (keys %customnetwork){
1207                                 if($customnetwork{$key}[0] eq $fwdfwsettings{$fwdfwsettings{$grp}}){
1208                                         $a=$customnetwork{$key}[1];
1209                                         $b=&General::iporsubtocidr($customnetwork{$key}[2]);
1210                                 }
1211                         }
1212                 }elsif($fwdfwsettings{$grp} eq 'cust_host_'.$val){
1213                         &General::readhasharray("$confighost", \%customhost);
1214                         foreach my $key (keys %customhost){
1215                                 if($customhost{$key}[0] eq $fwdfwsettings{$fwdfwsettings{$grp}}){
1216                                         if ($customhost{$key}[1] eq 'ip'){
1217                                                 ($a,$b)=split (/\//,$customhost{$key}[2]);
1218                                                 $b=&General::iporsubtocidr($b);
1219                                         }else{
1220                                                 if ($grp eq 'grp2'){
1221                                                         $errormessage=$Lang::tr{'fwdfw err tgt_mac'};
1222                                                 }
1223                                         }
1224                                 }
1225                         }
1226                 }
1227         }
1228         return $a,$b;
1229 }
1230 sub get_name
1231 {
1232         my $val=shift;
1233         &General::setup_default_networks(\%defaultNetworks);
1234         foreach my $network (sort keys %defaultNetworks)
1235         {
1236                 return "$network" if ($val eq $defaultNetworks{$network}{'NAME'});
1237         }
1238 }
1239 sub getsrcport
1240 {
1241         my %hash=%{(shift)};
1242         my $key=shift;
1243         if($hash{$key}[7] eq 'ON' && $hash{$key}[10]){
1244                 $hash{$key}[10]=~ s/\|/,/g;
1245                 print": $hash{$key}[10]";
1246         }elsif($hash{$key}[7] eq 'ON' && $hash{$key}[8] eq 'ICMP'){
1247                 print": <br>$hash{$key}[9] ";
1248         }
1249 }
1250 sub gettgtport
1251 {
1252         my %hash=%{(shift)};
1253         my $key=shift;
1254         my $service;
1255         my $prot;
1256         if($hash{$key}[11] eq 'ON' && $hash{$key}[12] ne 'ICMP'){
1257                 if($hash{$key}[14] eq 'cust_srv'){
1258                         &General::readhasharray("$configsrv", \%customservice);
1259                         foreach my $i (sort keys %customservice){
1260                                 if($customservice{$i}[0] eq $hash{$key}[15]){
1261                                         $service = $customservice{$i}[0];
1262                                 }
1263                         }
1264                 }elsif($hash{$key}[14] eq 'cust_srvgrp'){
1265                         $service=$hash{$key}[15];
1266                 }elsif($hash{$key}[14] eq 'TGT_PORT'){
1267                         $hash{$key}[15]=~ s/\|/,/g;
1268                         $service=$hash{$key}[15];
1269                 }
1270                 if($service){
1271                         print": $service";
1272                 }
1273         }
1274 }
1275 sub get_serviceports
1276 {
1277         my $type=shift;
1278         my $name=shift;
1279         &General::readhasharray("$configsrv", \%customservice);
1280         &General::readhasharray("$configsrvgrp", \%customservicegrp);
1281         @protocols=();
1282         my @specprot=("IPIP","IPV6","IGMP","GRE","AH","ESP");
1283         if($type eq 'service'){
1284                 foreach my $key (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){
1285                         if ($customservice{$key}[0] eq $name){
1286                                 push (@protocols,$customservice{$key}[2]);
1287                         }
1288                 }
1289         }elsif($type eq 'group'){
1290                 foreach my $key (sort { ncmp($customservicegrp{$a}[0],$customservicegrp{$b}[0]) } keys %customservicegrp){
1291                         if ($customservicegrp{$key}[0] eq $name){
1292                                 if ($customservicegrp{$key}[2] ~~ @specprot){
1293                                         push (@protocols," ".$customservicegrp{$key}[2]);
1294                                 }else{
1295                                         foreach my $key1 (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){
1296                                                 if ($customservice{$key1}[0] eq $customservicegrp{$key}[2]){
1297                                                         if (!grep(/$customservice{$key1}[2]/, @protocols)){
1298                                                                 push (@protocols,$customservice{$key1}[2]);}
1299                                                 }
1300                                         }
1301                                 }
1302                         }
1303                 }
1304         }
1305
1306         # Sort protocols alphabetically.
1307         @protocols = sort(@protocols);
1308
1309         return @protocols;
1310 }
1311 sub getcolor
1312 {
1313         my $nettype=shift;
1314         my $val=shift;
1315         my $hash=shift;
1316         if($optionsfw{'SHOWCOLORS'} eq 'on'){
1317                 # Don't colourise MAC addresses
1318                 if (&General::validmac($val)) {
1319                         $tdcolor = "";
1320                         return;
1321                 }
1322
1323                 #custom Hosts
1324                 if ($nettype eq 'cust_host_src' || $nettype eq 'cust_host_tgt'){
1325                         foreach my $key (sort keys %$hash){
1326                                 if ($$hash{$key}[0] eq $val){
1327                                         $val=$$hash{$key}[2];
1328                                 }
1329                         }
1330                 }
1331                 #standard networks
1332                 if ($val eq 'GREEN'){
1333                         $tdcolor="style='background-color: $Header::colourgreen;color:white;'";
1334                         return;
1335                 }elsif ($val eq 'ORANGE'){
1336                         $tdcolor="style='background-color:  $Header::colourorange;color:white;'";
1337                         return;
1338                 }elsif ($val eq 'BLUE'){
1339                         $tdcolor="style='background-color: $Header::colourblue;color:white;'";
1340                         return;
1341                 }elsif ($val eq 'RED' ||$val eq 'RED1' ){
1342                         $tdcolor="style='background-color: $Header::colourred;color:white;'";
1343                         return;
1344                 }elsif ($val eq 'IPFire' ){
1345                         $tdcolor="style='background-color: $Header::colourred;color:white;'";
1346                         return;
1347                 }elsif ($val eq 'OpenVPN-Dyn' ){
1348                         $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1349                         return;
1350                 }elsif ($val eq 'IPsec RW' ){
1351                         $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1352                         return;
1353                 }elsif($val =~ /^(.*?)\/(.*?)$/){
1354                         my ($sip,$scidr) = split ("/",$val);
1355                         if ( &Header::orange_used() && &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
1356                                 $tdcolor="style='background-color: $Header::colourorange;color:white;'";
1357                                 return;
1358                         }
1359                         if ( &General::IpInSubnet($sip,$netsettings{'GREEN_ADDRESS'},$netsettings{'GREEN_NETMASK'})){
1360                                 $tdcolor="style='background-color: $Header::colourgreen;color:white;'";
1361                                 return;
1362                         }
1363                         if ( &Header::blue_used() && &General::IpInSubnet($sip,$netsettings{'BLUE_ADDRESS'},$netsettings{'BLUE_NETMASK'})){
1364                                 $tdcolor="style='background-color: $Header::colourblue;color:white;'";
1365                                 return;
1366                         }
1367                 }elsif ($val eq 'Default IP'){
1368                         $tdcolor="style='background-color: $Header::colourred;color:white;'";
1369                         return;
1370                 }
1371                 #Check if a manual IP or custom host is part of a VPN
1372                 if ($nettype eq 'src_addr' || $nettype eq 'tgt_addr' || $nettype eq 'cust_host_src' || $nettype eq 'cust_host_tgt'){
1373                         #Check if IP is part of OpenVPN dynamic subnet
1374                         my ($a,$b) = split("/",$ovpnsettings{'DOVPN_SUBNET'});
1375                         my ($c,$d) = split("/",$val);
1376                         if (&General::IpInSubnet($c,$a,$b)){
1377                                 $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1378                                 return;
1379                         }
1380                         #Check if IP is part of OpenVPN static subnet
1381                         foreach my $key (sort keys %ccdnet){
1382                                 my ($a,$b) = split("/",$ccdnet{$key}[1]);
1383                                 $b =&General::iporsubtodec($b);
1384                                 if (&General::IpInSubnet($c,$a,$b)){
1385                                         $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1386                                         return;
1387                                 }
1388                         }
1389                         #Check if IP is part of OpenVPN N2N subnet
1390                         foreach my $key (sort keys %ccdhost){
1391                                 if ($ccdhost{$key}[3] eq 'net'){
1392                                         my ($a,$b) = split("/",$ccdhost{$key}[11]);
1393                                         if (&General::IpInSubnet($c,$a,$b)){
1394                                                 $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1395                                                 return;
1396                                         }
1397                                 }
1398                         }
1399                         #Check if IP is part of IPsec RW network
1400                         if ($ipsecsettings{'RW_NET'} ne ''){
1401                                 my ($a,$b) = split("/",$ipsecsettings{'RW_NET'});
1402                                 $b=&General::iporsubtodec($b);
1403                                 if (&General::IpInSubnet($c,$a,$b)){
1404                                         $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1405                                         return;
1406                                 }
1407                         }
1408                         #Check if IP is part of a IPsec N2N network
1409                         foreach my $key (sort keys %ipsecconf){
1410                                 if ($ipsecconf{$key}[11]){
1411                                         my ($a,$b) = split("/",$ipsecconf{$key}[11]);
1412                                         $b=&General::iporsubtodec($b);
1413                                         if (&General::IpInSubnet($c,$a,$b)){
1414                                                 $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1415                                                 return;
1416                                         }
1417                                 }
1418                         }
1419                 }
1420                 #VPN networks
1421                 if ($nettype eq 'ovpn_n2n_src' || $nettype eq 'ovpn_n2n_tgt' || $nettype eq 'ovpn_net_src' || $nettype eq 'ovpn_net_tgt'|| $nettype eq 'ovpn_host_src' || $nettype eq 'ovpn_host_tgt'){
1422                         $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1423                         return;
1424                 }
1425                 if ($nettype eq 'ipsec_net_src' || $nettype eq 'ipsec_net_tgt'){
1426                         $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1427                         return;
1428                 }
1429                 #ALIASE
1430                 foreach my $alias (sort keys %aliases)
1431                 {
1432                         if ($val eq $alias){
1433                                 $tdcolor="style='background-color:$Header::colourred;color:white;'";
1434                                 return;
1435                         }
1436                 }
1437         }
1438         $tdcolor='';
1439         return;
1440 }
1441 sub hint
1442 {
1443         if ($hint) {
1444                 &Header::openbox('100%', 'left', $Lang::tr{'fwhost hint'});
1445                 print "<class name='base'>$hint\n";
1446                 print "&nbsp;</class>\n";
1447                 &Header::closebox();
1448         }
1449 }
1450 sub newrule
1451 {
1452         &error;
1453         &General::setup_default_networks(\%defaultNetworks);
1454         &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
1455         #read all configfiles
1456         &General::readhasharray("$configccdnet", \%ccdnet);
1457         &General::readhasharray("$confignet", \%customnetwork);
1458         &General::readhasharray("$configccdhost", \%ccdhost);
1459         &General::readhasharray("$confighost", \%customhost);
1460         &General::readhasharray("$configccdhost", \%ccdhost);
1461         &General::readhasharray("$configgrp", \%customgrp);
1462         &General::readhasharray("$configgeoipgrp", \%customgeoipgrp);
1463         &General::readhasharray("$configipsec", \%ipsecconf);
1464         &General::get_aliases(\%aliases);
1465         my %checked=();
1466         my $helper;
1467         my $sum=0;
1468         if($fwdfwsettings{'config'} eq ''){$fwdfwsettings{'config'}=$configfwdfw;}
1469         my $config=$fwdfwsettings{'config'};
1470         my %hash=();
1471         #Get Red IP-ADDRESS
1472         open (CONN1,"/var/ipfire/red/local-ipaddress");
1473         my $redip = <CONN1>;
1474         close(CONN1);
1475         if (! $fwdfwsettings{'RULE_ACTION'} && $fwdfwsettings{'POLICY'} eq 'MODE2'){
1476                 $fwdfwsettings{'RULE_ACTION'}='DROP';
1477         }elsif(! $fwdfwsettings{'RULE_ACTION'} && $fwdfwsettings{'POLICY'} eq 'MODE1'){
1478                 $fwdfwsettings{'RULE_ACTION'}='ACCEPT';
1479         }
1480         $checked{'grp1'}{$fwdfwsettings{'grp1'}}                                = 'CHECKED';
1481         $checked{'grp2'}{$fwdfwsettings{'grp2'}}                                = 'CHECKED';
1482         $checked{'grp3'}{$fwdfwsettings{'grp3'}}                                = 'CHECKED';
1483         $checked{'USE_SRC_PORT'}{$fwdfwsettings{'USE_SRC_PORT'}} = 'CHECKED';
1484         $checked{'USESRV'}{$fwdfwsettings{'USESRV'}}                    = 'CHECKED';
1485         $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}}                    = 'CHECKED';
1486         $checked{'LOG'}{$fwdfwsettings{'LOG'}}                                  = 'CHECKED';
1487         $checked{'TIME'}{$fwdfwsettings{'TIME'}}                                = 'CHECKED';
1488         $checked{'TIME_MON'}{$fwdfwsettings{'TIME_MON'}}                = 'CHECKED';
1489         $checked{'TIME_TUE'}{$fwdfwsettings{'TIME_TUE'}}                = 'CHECKED';
1490         $checked{'TIME_WED'}{$fwdfwsettings{'TIME_WED'}}                = 'CHECKED';
1491         $checked{'TIME_THU'}{$fwdfwsettings{'TIME_THU'}}                = 'CHECKED';
1492         $checked{'TIME_FRI'}{$fwdfwsettings{'TIME_FRI'}}                = 'CHECKED';
1493         $checked{'TIME_SAT'}{$fwdfwsettings{'TIME_SAT'}}                = 'CHECKED';
1494         $checked{'TIME_SUN'}{$fwdfwsettings{'TIME_SUN'}}                = 'CHECKED';
1495         $checked{'USE_NAT'}{$fwdfwsettings{'USE_NAT'}}                  = 'CHECKED';
1496         $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}}             = 'selected';
1497         $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}}                 = 'selected';
1498         $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected';
1499         $selected{'ipfire_src'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected';
1500         #check if update and get values
1501         if($fwdfwsettings{'updatefwrule'} eq 'on' || $fwdfwsettings{'copyfwrule'} eq 'on' && !$errormessage){
1502                 &General::readhasharray("$config", \%hash);
1503                 foreach my $key (sort keys %hash){
1504                         $sum++;
1505                         if ($key eq $fwdfwsettings{'key'}){
1506                                 $fwdfwsettings{'oldrulenumber'}                 = $fwdfwsettings{'key'};
1507                                 $fwdfwsettings{'RULE_ACTION'}                   = $hash{$key}[0];
1508                                 $fwdfwsettings{'chain'}                                 = $hash{$key}[1];
1509                                 $fwdfwsettings{'ACTIVE'}                                = $hash{$key}[2];
1510                                 $fwdfwsettings{'grp1'}                                  = $hash{$key}[3];
1511                                 $fwdfwsettings{$fwdfwsettings{'grp1'}}  = $hash{$key}[4];
1512                                 $fwdfwsettings{'grp2'}                                  = $hash{$key}[5];
1513                                 $fwdfwsettings{$fwdfwsettings{'grp2'}}  = $hash{$key}[6];
1514                                 $fwdfwsettings{'USE_SRC_PORT'}                  = $hash{$key}[7];
1515                                 $fwdfwsettings{'PROT'}                                  = $hash{$key}[8];
1516                             $fwdfwsettings{'ICMP_TYPES'}                        = $hash{$key}[9];
1517                             $fwdfwsettings{'SRC_PORT'}                          = $hash{$key}[10];
1518                             $fwdfwsettings{'USESRV'}                            = $hash{$key}[11];
1519                             $fwdfwsettings{'TGT_PROT'}                          = $hash{$key}[12];
1520                             $fwdfwsettings{'ICMP_TGT'}                          = $hash{$key}[13];
1521                             $fwdfwsettings{'grp3'}                                      = $hash{$key}[14];
1522                             $fwdfwsettings{$fwdfwsettings{'grp3'}}      = $hash{$key}[15];
1523                             $fwdfwsettings{'ruleremark'}                        = $hash{$key}[16];
1524                             $fwdfwsettings{'LOG'}                                       = $hash{$key}[17];
1525                             $fwdfwsettings{'TIME'}                                      = $hash{$key}[18];
1526                                 $fwdfwsettings{'TIME_MON'}                              = $hash{$key}[19];
1527                                 $fwdfwsettings{'TIME_TUE'}                              = $hash{$key}[20];
1528                                 $fwdfwsettings{'TIME_WED'}                              = $hash{$key}[21];
1529                                 $fwdfwsettings{'TIME_THU'}                              = $hash{$key}[22];
1530                                 $fwdfwsettings{'TIME_FRI'}                              = $hash{$key}[23];
1531                                 $fwdfwsettings{'TIME_SAT'}                              = $hash{$key}[24];
1532                                 $fwdfwsettings{'TIME_SUN'}                              = $hash{$key}[25];
1533                                 $fwdfwsettings{'TIME_FROM'}                             = $hash{$key}[26];
1534                                 $fwdfwsettings{'TIME_TO'}                               = $hash{$key}[27];
1535                                 $fwdfwsettings{'USE_NAT'}                               = $hash{$key}[28];
1536                                 $fwdfwsettings{'nat'}                                   = $hash{$key}[31]; #changed order
1537                                 $fwdfwsettings{$fwdfwsettings{'nat'}}   = $hash{$key}[29];
1538                                 $fwdfwsettings{'dnatport'}                              = $hash{$key}[30];
1539                                 $fwdfwsettings{'LIMIT_CON_CON'}                 = $hash{$key}[32];
1540                                 $fwdfwsettings{'concon'}                                = $hash{$key}[33];
1541                                 $fwdfwsettings{'RATE_LIMIT'}                    = $hash{$key}[34];
1542                                 $fwdfwsettings{'ratecon'}                               = $hash{$key}[35];
1543                                 $fwdfwsettings{'RATETIME'}                              = $hash{$key}[36];
1544                                 $checked{'grp1'}{$fwdfwsettings{'grp1'}}                                = 'CHECKED';
1545                                 $checked{'grp2'}{$fwdfwsettings{'grp2'}}                                = 'CHECKED';
1546                                 $checked{'grp3'}{$fwdfwsettings{'grp3'}}                                = 'CHECKED';
1547                                 $checked{'USE_SRC_PORT'}{$fwdfwsettings{'USE_SRC_PORT'}} = 'CHECKED';
1548                                 $checked{'USESRV'}{$fwdfwsettings{'USESRV'}}                    = 'CHECKED';
1549                                 $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}}                    = 'CHECKED';
1550                                 $checked{'LOG'}{$fwdfwsettings{'LOG'}}                                  = 'CHECKED';
1551                                 $checked{'TIME'}{$fwdfwsettings{'TIME'}}                                = 'CHECKED';
1552                                 $checked{'TIME_MON'}{$fwdfwsettings{'TIME_MON'}}                = 'CHECKED';
1553                                 $checked{'TIME_TUE'}{$fwdfwsettings{'TIME_TUE'}}                = 'CHECKED';
1554                                 $checked{'TIME_WED'}{$fwdfwsettings{'TIME_WED'}}                = 'CHECKED';
1555                                 $checked{'TIME_THU'}{$fwdfwsettings{'TIME_THU'}}                = 'CHECKED';
1556                                 $checked{'TIME_FRI'}{$fwdfwsettings{'TIME_FRI'}}                = 'CHECKED';
1557                                 $checked{'TIME_SAT'}{$fwdfwsettings{'TIME_SAT'}}                = 'CHECKED';
1558                                 $checked{'TIME_SUN'}{$fwdfwsettings{'TIME_SUN'}}                = 'CHECKED';
1559                                 $checked{'USE_NAT'}{$fwdfwsettings{'USE_NAT'}}                  = 'CHECKED';
1560                                 $checked{'nat'}{$fwdfwsettings{'nat'}}                                  = 'CHECKED';
1561                                 $checked{'LIMIT_CON_CON'}{$fwdfwsettings{'LIMIT_CON_CON'}}      = 'CHECKED';
1562                                 $checked{'RATE_LIMIT'}{$fwdfwsettings{'RATE_LIMIT'}}    = 'CHECKED';
1563                                 $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}}             = 'selected';
1564                                 $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}}                 = 'selected';
1565                                 $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected';
1566                                 $selected{'ipfire_src'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected';
1567                                 $selected{'dnat'}{$fwdfwsettings{'dnat'}}                               ='selected';
1568                                 $selected{'snat'}{$fwdfwsettings{'snat'}}                               ='selected';
1569                                 $selected{'RATETIME'}{$fwdfwsettings{'RATETIME'}}               ='selected';
1570                         }
1571                 }
1572                 $fwdfwsettings{'oldgrp1a'}=$fwdfwsettings{'grp1'};
1573                 $fwdfwsettings{'oldgrp1b'}=$fwdfwsettings{$fwdfwsettings{'grp1'}};
1574                 $fwdfwsettings{'oldgrp2a'}=$fwdfwsettings{'grp2'};
1575                 $fwdfwsettings{'oldgrp2b'}=$fwdfwsettings{$fwdfwsettings{'grp2'}};
1576                 $fwdfwsettings{'oldgrp3a'}=$fwdfwsettings{'grp3'};
1577                 $fwdfwsettings{'oldgrp3b'}=$fwdfwsettings{$fwdfwsettings{'grp3'}};
1578                 $fwdfwsettings{'oldusesrv'}=$fwdfwsettings{'USESRV'};
1579                 $fwdfwsettings{'oldruleremark'}=$fwdfwsettings{'ruleremark'};
1580                 $fwdfwsettings{'oldnat'}=$fwdfwsettings{'USE_NAT'};
1581                 $fwdfwsettings{'oldruletype'}=$fwdfwsettings{'chain'};
1582                 $fwdfwsettings{'oldconcon'}=$fwdfwsettings{'LIMIT_CON_CON'};
1583                 $fwdfwsettings{'olduseratelimit'}=$fwdfwsettings{'RATE_LIMIT'};
1584                 $fwdfwsettings{'olduseratelimitamount'}=$fwdfwsettings{'ratecon'};
1585                 $fwdfwsettings{'oldratelimittime'}=$fwdfwsettings{'RATETIME'};
1586
1587                 #check if manual ip (source) is orange network
1588                 if ($fwdfwsettings{'grp1'} eq 'src_addr'){
1589                         my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
1590                         if ( &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
1591                                 $fwdfwsettings{'oldorange'} ='on';
1592                         }
1593                 }
1594         }else{
1595                 $fwdfwsettings{'ACTIVE'}='ON';
1596                 $fwdfwsettings{'nat'} = 'dnat';
1597                 $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}} = 'CHECKED';
1598                 $checked{'nat'}{$fwdfwsettings{'nat'}} = 'CHECKED';
1599                 $fwdfwsettings{'oldgrp1a'}=$fwdfwsettings{'grp1'};
1600                 $fwdfwsettings{'oldgrp1b'}=$fwdfwsettings{$fwdfwsettings{'grp1'}};
1601                 $fwdfwsettings{'oldgrp2a'}=$fwdfwsettings{'grp2'};
1602                 $fwdfwsettings{'oldgrp2b'}=$fwdfwsettings{$fwdfwsettings{'grp2'}};
1603                 $fwdfwsettings{'oldgrp3a'}=$fwdfwsettings{'grp3'};
1604                 $fwdfwsettings{'oldgrp3b'}=$fwdfwsettings{$fwdfwsettings{'grp3'}};
1605                 $fwdfwsettings{'oldusesrv'}=$fwdfwsettings{'USESRV'};
1606                 $fwdfwsettings{'oldruleremark'}=$fwdfwsettings{'ruleremark'};
1607                 $fwdfwsettings{'oldnat'}=$fwdfwsettings{'USE_NAT'};
1608                 $fwdfwsettings{'oldconcon'}=$fwdfwsettings{'LIMIT_CON_CON'};
1609                 #check if manual ip (source) is orange network
1610                 if ($fwdfwsettings{'grp1'} eq 'src_addr'){
1611                         my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
1612                         if ( &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
1613                                 $fwdfwsettings{'oldorange'} ='on';
1614                         }
1615                 }
1616         }
1617         # Split manual source and target address and delete the subnet
1618         my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
1619         if ($scidr eq '32'){$fwdfwsettings{$fwdfwsettings{'grp1'}}=$sip;}
1620         my ($dip,$dcidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp2'}});
1621         if ($dcidr eq '32'){$fwdfwsettings{$fwdfwsettings{'grp2'}}=$dip;}
1622         &Header::openbox('100%', 'left', $Lang::tr{'fwdfw source'});
1623         #------SOURCE-------------------------------------------------------
1624         print "<form method='post'>";
1625         print<<END;
1626                 <table width='100%' border='0'>
1627                 <tr><td width='1%'><input type='radio' name='grp1' value='src_addr'  checked></td><td width='60%'>$Lang::tr{'fwdfw sourceip'}<input type='TEXT' name='src_addr' value='$fwdfwsettings{'src_addr'}' size='16' maxlength='18' ></td><td width='1%'><input type='radio' name='grp1' id='ipfire_src' value='ipfire_src'  $checked{'grp1'}{'ipfire_src'}></td><td><b>Firewall</b></td>
1628 END
1629                 print"<td align='right'><select name='ipfire_src' style='width:200px;'>";
1630                 print "<option value='ALL' $selected{'ipfire_src'}{'ALL'}>$Lang::tr{'all'}</option>";
1631                 print "<option value='GREEN' $selected{'ipfire_src'}{'GREEN'}>$Lang::tr{'green'} ($ifaces{'GREEN_ADDRESS'})</option>" if $ifaces{'GREEN_ADDRESS'};
1632                 print "<option value='ORANGE' $selected{'ipfire_src'}{'ORANGE'}>$Lang::tr{'orange'} ($ifaces{'ORANGE_ADDRESS'})</option>" if (&Header::orange_used());
1633                 print "<option value='BLUE' $selected{'ipfire_src'}{'BLUE'}>$Lang::tr{'blue'} ($ifaces{'BLUE_ADDRESS'})</option>" if (&Header::blue_used());
1634                 print "<option value='RED1' $selected{'ipfire_src'}{'RED1'}>$Lang::tr{'red1'} ($redip)" if ($redip);
1635                 if (! -z "${General::swroot}/ethernet/aliases"){
1636                         foreach my $alias (sort keys %aliases)
1637                         {
1638                                 print "<option value='$alias' $selected{'ipfire_src'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1639                         }
1640                 }
1641                 print<<END;
1642                 </select></td></tr>
1643                 <tr><td><br></td></tr>
1644                 </table>
1645 END
1646                 &gen_dd_block('src','grp1');
1647                 &Header::closebox();
1648
1649                 #---SNAT / DNAT ------------------------------------------------
1650                 &Header::openbox('100%', 'left', 'NAT');
1651                 print<<END;
1652                         <label>
1653                                 <input type='checkbox' name='USE_NAT' id='USE_NAT' value="ON" $checked{'USE_NAT'}{'ON'}>
1654                                 $Lang::tr{'fwdfw use nat'}
1655                         </label>
1656                         <div class="NAT">
1657                                 <table class='fw-nat' width='100%' border='0'>
1658                                         <tr>
1659                                                 <td width='5%'></td>
1660                                                 <td width='40%'>
1661                                                         <label>
1662                                                                 <input type='radio' name='nat'  value='dnat' $checked{'nat'}{'dnat'}>
1663                                                                 $Lang::tr{'fwdfw dnat'}
1664                                                         </label>
1665                                                 </td>
1666 END
1667
1668         print <<END;
1669                                                 <td width='25%' align='right'><span class='dnat'>$Lang::tr{'dnat address'}:</span></td>
1670                                                 <td width='30%'>
1671                                                         <select name='dnat' class='dnat' style='width: 100%;'>
1672                                                                 <option value='AUTO' $selected{'dnat'}{'AUTO'}>- $Lang::tr{'automatic'} -</option>
1673                                                                 <option value='Default IP' $selected{'dnat'}{'Default IP'}>$Lang::tr{'red1'} ($redip)</option>
1674 END
1675                 if (%aliases) {
1676                         foreach my $alias (sort keys %aliases) {
1677                                 print "<option value='$alias' $selected{'dnat'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1678                         }
1679                 }
1680                 #DNAT Dropdown
1681                 foreach my $network (sort keys %defaultNetworks)
1682                 {
1683                         if ($defaultNetworks{$network}{'NAME'} eq 'BLUE'||$defaultNetworks{$network}{'NAME'} eq 'GREEN' ||$defaultNetworks{$network}{'NAME'} eq 'ORANGE'){
1684                                 print "<option value='$defaultNetworks{$network}{'NAME'}'";
1685                                 print " selected='selected'" if ($fwdfwsettings{'dnat'} eq $defaultNetworks{$network}{'NAME'});
1686                                 print ">$network ($defaultNetworks{$network}{'NET'})</option>";
1687                         }
1688                 }
1689                 print "</select>";
1690                 print "</tr>";
1691
1692                 #SNAT
1693                 print <<END;
1694                                         <tr>
1695                                                 <td width='5%'></td>
1696                                                 <td width='40%'>
1697                                                         <label>
1698                                                                 <input type='radio' name='nat'  value='snat' $checked{'nat'}{'snat'}>
1699                                                                 $Lang::tr{'fwdfw snat'}
1700                                                         </label>
1701                                                 </td>
1702                                                 <td width='25%' align='right'><span class='snat'>$Lang::tr{'snat new source ip address'}:</span></td>
1703                                                 <td width='30%'>
1704                                                         <select name='snat' class='snat' style='width: 100%;'>
1705 END
1706
1707                 foreach my $alias (sort keys %aliases) {
1708                         print "<option value='$alias' $selected{'snat'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1709                 }
1710                 # SNAT Dropdown
1711                 foreach my $network (sort keys %defaultNetworks) {
1712                         if ($defaultNetworks{$network}{'NAME'} eq 'BLUE'||$defaultNetworks{$network}{'NAME'} eq 'GREEN' ||$defaultNetworks{$network}{'NAME'} eq 'ORANGE'){
1713                                 print "<option value='$defaultNetworks{$network}{'NAME'}'";
1714                                 print " selected='selected'" if ($fwdfwsettings{'snat'} eq $defaultNetworks{$network}{'NAME'});
1715                                 print ">$network ($defaultNetworks{$network}{'NET'})</option>";
1716                         }
1717                 }
1718                 print <<END;
1719                                                         </select>
1720                                                 </td>
1721                                         </tr>
1722                                 </table>
1723                         </div>
1724 END
1725                 &Header::closebox();
1726
1727                 #---TARGET------------------------------------------------------
1728                 &Header::openbox('100%', 'left', $Lang::tr{'fwdfw target'});
1729                 print<<END;
1730                 <table width='100%' border='0'>
1731                 <tr><td width='1%'><input type='radio' name='grp2' value='tgt_addr'  checked></td><td width='60%' nowrap='nowrap'>$Lang::tr{'fwdfw targetip'}<input type='TEXT' name='tgt_addr' value='$fwdfwsettings{'tgt_addr'}' size='16' maxlength='18'><td width='1%'><input type='radio' name='grp2' id='ipfire' value='ipfire'  $checked{'grp2'}{'ipfire'}></td><td><b>Firewall</b></td>
1732 END
1733                 print"<td align='right'><select name='ipfire' style='width:200px;'>";
1734                 print "<option value='ALL' $selected{'ipfire'}{'ALL'}>$Lang::tr{'all'}</option>";
1735                 print "<option value='GREEN' $selected{'ipfire'}{'GREEN'}>$Lang::tr{'green'} ($ifaces{'GREEN_ADDRESS'})</option>" if $ifaces{'GREEN_ADDRESS'};
1736                 print "<option value='ORANGE' $selected{'ipfire'}{'ORANGE'}>$Lang::tr{'orange'} ($ifaces{'ORANGE_ADDRESS'})</option>" if (&Header::orange_used());
1737                 print "<option value='BLUE' $selected{'ipfire'}{'BLUE'}>$Lang::tr{'blue'} ($ifaces{'BLUE_ADDRESS'})</option>"if (&Header::blue_used());
1738                 print "<option value='RED1' $selected{'ipfire'}{'RED1'}>$Lang::tr{'red1'} ($redip)" if ($redip);
1739                 if (! -z "${General::swroot}/ethernet/aliases"){
1740                         foreach my $alias (sort keys %aliases)
1741                         {
1742                                 print "<option value='$alias' $selected{'ipfire'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1743                         }
1744                 }
1745                 print<<END;
1746                 </select></td></tr>
1747                 <tr><td><br></td></tr></table>
1748 END
1749                 &gen_dd_block('tgt','grp2');
1750                 &Header::closebox;
1751                 #---PROTOCOL------------------------------------------------------
1752                 $fwdfwsettings{'SRC_PORT'} =~ s/\|/,/g;
1753                 $fwdfwsettings{'TGT_PORT'} =~ s/\|/,/g;
1754                 $fwdfwsettings{'dnatport'} =~ tr/|/,/;
1755
1756                 # The dnatport may be empty, if it matches TGT_PORT
1757                 if ($fwdfwsettings{'dnatport'} eq $fwdfwsettings{'TGT_PORT'}) {
1758                         $fwdfwsettings{'dnatport'} = "";
1759                 }
1760
1761                 &Header::openbox('100%', 'left', $Lang::tr{'fwhost prot'});
1762                 #Fix Protocol for JQuery
1763                 if ($fwdfwsettings{'grp3'} eq 'cust_srv' || $fwdfwsettings{'grp3'} eq 'cust_srvgrp'){
1764                         $fwdfwsettings{'PROT'} = 'template';
1765                 }
1766                 print<<END;
1767                         <table width='100%' border='0'>
1768                                 <tr>
1769                                         <td width="25%">
1770                                                 <select name='PROT' id='protocol' style="width: 95px;">
1771 END
1772                 print "<option value=\"\"";
1773                 if ($fwdfwsettings{'PROT'} eq '') {
1774                         print " selected=\"selected\"";
1775                 }
1776                 print ">$Lang::tr{'all'}</option>";
1777
1778                 print "<option value=\"template\"";
1779                 print " selected=\"selected\"" if ($fwdfwsettings{'grp3'} eq 'cust_srv' || $fwdfwsettings{'grp3'} eq 'cust_srvgrp');
1780                 print ">- $Lang::tr{'template'} -</option>";
1781
1782                 foreach (@PROTOCOLS) {
1783                         print"<option value=\"$_\"";
1784                         if ($_ eq $fwdfwsettings{'PROT'}) {
1785                                 print " selected=\"selected\"";
1786                         }
1787                         if($_ eq "IPv6"){
1788                                 print ">$Lang::tr{'fwdfw prot41'}</option>";
1789                         }else{
1790                                 print ">$_</option>";
1791                         }
1792                 }
1793
1794                 print<<END;
1795                                                 </select>
1796                                         </td>
1797                                         <td width="75%">
1798                                                 <table width='100%' border='0' id="PROTOCOL_ICMP_TYPES">
1799                                                         <tr>
1800                                                                 <td width='20%'>$Lang::tr{'fwhost icmptype'}</td>
1801                                                                 <td colspan='2'>
1802                                                                         <select name='ICMP_TYPES' style='min-width:230px;'>
1803 END
1804                 &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
1805                 print"<option value='All ICMP-Types'>$Lang::tr{'fwdfw all icmp'}</option>";
1806                 foreach my $key (sort { ncmp($icmptypes{$a}[0],$icmptypes{$b}[0]) }keys %icmptypes){
1807                         if($fwdfwsettings{'ICMP_TYPES'} eq "$icmptypes{$key}[0]"){
1808                                 print"<option selected>$icmptypes{$key}[0] ($icmptypes{$key}[1])</option>";
1809                         }else{
1810                                 print"<option>$icmptypes{$key}[0] ($icmptypes{$key}[1])</option>";
1811                         }
1812                 }
1813
1814                 print <<END;
1815                                                                         </select>
1816                                                                 </td>
1817                                                         </tr>
1818                                                 </table>
1819
1820                                                 <table width="100%" border="0" id="PROTOCOL_PORTS">
1821                                                         <tr>
1822                                                                 <!-- #SOURCEPORT -->
1823                                                                 <td>
1824                                                                         $Lang::tr{'fwdfw use srcport'}
1825                                                                 </td>
1826                                                                 <td>
1827                                                                         <input type='text' name='SRC_PORT' value='$fwdfwsettings{'SRC_PORT'}' maxlength='20' size='18'>
1828                                                                 </td>
1829                                                                 <td width='10%'>
1830                                                                 </td>
1831
1832                                                                 <!-- #TARGETPORT -->
1833                                                                 <td>
1834                                                                         $Lang::tr{'fwdfw use srv'}
1835                                                                 </td>
1836
1837                                                                 <td>
1838                                                                         <input type='text' name='TGT_PORT' value='$fwdfwsettings{'TGT_PORT'}' maxlength='20' size='18'>
1839                                                                 </td>
1840                                                         </tr>
1841                                                         <tr class="NAT">
1842                                                                 <td colspan='3'></td>
1843                                                                 <td>$Lang::tr{'fwdfw external port nat'}:</td>
1844                                                                 <td>
1845                                                                         <input type='text' name='dnatport' value=\"$fwdfwsettings{'dnatport'}\" maxlength='20' size='18'>
1846                                                                 </td>
1847                                                         </tr>
1848                                                 </table>
1849
1850                                                 <table width="100%" border="0" id="PROTOCOL_TEMPLATE">
1851                                                         <tr>
1852                                                                 <td>
1853                                                                         <input type='radio' name='grp3' id='cust_srv' value='cust_srv' checked>
1854                                                                         $Lang::tr{'fwhost cust service'}
1855                                                                 </td>
1856                                                                 <td>
1857                                                                         <select name='cust_srv' style='min-width: 230px;'>
1858 END
1859
1860                 &General::readhasharray("$configsrv", \%customservice);
1861                 foreach my $key (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){
1862                         print"<option ";
1863                         print"selected='selected'" if ($fwdfwsettings{$fwdfwsettings{'grp3'}} eq $customservice{$key}[0]);
1864                         print"value='$customservice{$key}[0]'>$customservice{$key}[0]</option>";
1865                 }
1866
1867                 print <<END;
1868                                                                         </select>
1869                                                                 </td>
1870                                                         </tr>
1871                                                         <tr>
1872                                                                 <td>
1873                                                                         <input type='radio' name='grp3' id='cust_srvgrp' value='cust_srvgrp' $checked{'grp3'}{'cust_srvgrp'}>
1874                                                                         $Lang::tr{'fwhost cust srvgrp'}
1875                                                                 </td>
1876                                                                 <td>
1877                                                                         <select name='cust_srvgrp' style='min-width:230px;'>
1878 END
1879
1880                 &General::readhasharray("$configsrvgrp", \%customservicegrp);
1881                 my $helper;
1882                 foreach my $key (sort { ncmp($customservicegrp{$a}[0],$customservicegrp{$b}[0]) } keys %customservicegrp){
1883                         if ($helper ne $customservicegrp{$key}[0] && $customservicegrp{$key}[2] ne 'none'){
1884                                 print"<option ";
1885                                 print"selected='selected'" if ($fwdfwsettings{$fwdfwsettings{'grp3'}} eq $customservicegrp{$key}[0]);
1886                                 print">$customservicegrp{$key}[0]</option>";
1887                         }
1888                         $helper=$customservicegrp{$key}[0];
1889                 }
1890
1891                 print<<END;
1892                                                                         </select>
1893                                                                 </td>
1894                                                         </tr>
1895                                                 </table>
1896                                         </td>
1897                                 </tr>
1898                         </table>
1899 END
1900
1901                 &Header::closebox;
1902                 $checked{"RULE_ACTION"}{$fwdfwsettings{'RULE_ACTION'}}  = 'CHECKED';
1903                 print <<END;
1904                         <center>
1905                                 <table width="80%" class='tbl' id='actions'>
1906                                         <tr>
1907                                                 <td width="33%" align="center" bgcolor="$color{'color17'}">
1908                                                         &nbsp;<br>&nbsp;
1909                                                 </td>
1910                                                 <td width="33%" align="center" bgcolor="$color{'color25'}">
1911                                                         &nbsp;<br>&nbsp;
1912                                                 </td>
1913                                                 <td width="33%" align="center" bgcolor="$color{'color16'}">
1914                                                         &nbsp;<br>&nbsp;
1915                                                 </td>
1916                                         </tr>
1917                                         <tr>
1918                                                 <td width="33%" align="center">
1919                                                         <label>
1920                                                                 <input type="radio" name="RULE_ACTION" value="ACCEPT" $checked{"RULE_ACTION"}{"ACCEPT"}>
1921                                                                 <strong>$Lang::tr{'fwdfw ACCEPT'}</strong>
1922                                                         </label>
1923                                                 </td>
1924                                                 <td width="33%" align="center">
1925                                                         <label>
1926                                                                 <input type="radio" name="RULE_ACTION" value="DROP" $checked{"RULE_ACTION"}{"DROP"}>
1927                                                                 <strong>$Lang::tr{'fwdfw DROP'}</strong>
1928                                                         </label>
1929                                                 </td>
1930                                                 <td width="33%" align="center">
1931                                                         <label>
1932                                                                 <input type="radio" name="RULE_ACTION" value="REJECT" $checked{"RULE_ACTION"}{"REJECT"}>
1933                                                                 <strong>$Lang::tr{'fwdfw REJECT'}</strong>
1934                                                         </label>
1935                                                 </td>
1936                                         </tr>
1937                                 </table>
1938                         </center>
1939
1940                         <br>
1941 END
1942                 #---Activate/logging/remark-------------------------------------
1943                 &Header::openbox('100%', 'left', $Lang::tr{'fwdfw additional'});
1944                 print<<END;
1945                 <table width='100%' border='0'>
1946 END
1947                 print"<tr><td width='12%'>$Lang::tr{'remark'}:</td><td width='88%' align='left'><input type='text' name='ruleremark' maxlength='255' value='$fwdfwsettings{'ruleremark'}' style='width:99%;'></td></tr>";
1948                 if($fwdfwsettings{'updatefwrule'} eq 'on' || $fwdfwsettings{'copyfwrule'} eq 'on'){
1949                         print "<tr><td width='12%'>$Lang::tr{'fwdfw rulepos'}:</td><td><select name='rulepos' >";
1950                         for (my $count =1; $count <= $sum; $count++){
1951                                 print"<option value='$count' ";
1952                                 print"selected='selected'" if($fwdfwsettings{'oldrulenumber'} eq $count);
1953                                 print">$count</option>";
1954                         }
1955                         print"</select></td></tr>";
1956                 }else{
1957                         print "<tr><td width='12%'>$Lang::tr{'fwdfw rulepos'}:</td><td><input type='text' name='rulepos' size='2'></td></tr>";
1958                 }
1959
1960                 print<<END;
1961                 </table>
1962                 <table width='100%'>
1963                         <tr>
1964 END
1965
1966                 if ($fwdfwsettings{'updatefwrule'} eq 'on') {
1967                         print <<END;
1968                                 <td>
1969                                         <input type='checkbox' name='ACTIVE' value="ON" $checked{'ACTIVE'}{'ON'}>
1970                                 </td>
1971                                 <td>$Lang::tr{'fwdfw rule activate'}</td>
1972 END
1973                 } else {
1974                         print <<END;
1975                                 <td colspan="2">
1976                                         <input type="hidden" name="ACTIVE" value="ON">
1977                                 </td>
1978 END
1979                 }
1980
1981                 print <<END;
1982                         </tr>
1983                         <tr>
1984                                 <td>
1985                                         <input type='checkbox' name='LOG' value='ON' $checked{'LOG'}{'ON'}>
1986                                 </td>
1987                                 <td>$Lang::tr{'fwdfw log rule'}</td>
1988                         </tr>
1989                         <tr>
1990                                 <td width='1%'>
1991                                         <input type='checkbox' name='TIME' id="USE_TIME_CONSTRAINTS" value='ON' $checked{'TIME'}{'ON'}>
1992                                 </td>
1993                                 <td>$Lang::tr{'fwdfw timeframe'}</td>
1994                         </tr>
1995                         <tr id="TIME_CONSTRAINTS">
1996                                 <td colspan="2">
1997                                         <table width="66%" border="0">
1998                                                 <tr>
1999                                                         <td width="8em">&nbsp;</td>
2000                                                         <td align="center">$Lang::tr{'advproxy monday'}</td>
2001                                                         <td align="center">$Lang::tr{'advproxy tuesday'}</td>
2002                                                         <td align="center">$Lang::tr{'advproxy wednesday'}</td>
2003                                                         <td align="center">$Lang::tr{'advproxy thursday'}</td>
2004                                                         <td align="center">$Lang::tr{'advproxy friday'}</td>
2005                                                         <td align="center">$Lang::tr{'advproxy saturday'}</td>
2006                                                         <td align="center">$Lang::tr{'advproxy sunday'}</td>
2007                                                         <td>&nbsp;</td>
2008                                                 </tr>
2009                                                 <tr>
2010                                                         <td width="8em">&nbsp;</td>
2011                                                         <td align="center"><input type='checkbox' name='TIME_MON' value='on' $checked{'TIME_MON'}{'on'} ></td>
2012                                                         <td align="center"><input type='checkbox' name='TIME_TUE' value='on' $checked{'TIME_TUE'}{'on'} ></td>
2013                                                         <td align="center"><input type='checkbox' name='TIME_WED' value='on' $checked{'TIME_WED'}{'on'} ></td>
2014                                                         <td align="center"><input type='checkbox' name='TIME_THU' value='on' $checked{'TIME_THU'}{'on'} ></td>
2015                                                         <td align="center"><input type='checkbox' name='TIME_FRI' value='on' $checked{'TIME_FRI'}{'on'} ></td>
2016                                                         <td align="center"><input type='checkbox' name='TIME_SAT' value='on' $checked{'TIME_SAT'}{'on'} ></td>
2017                                                         <td align="center"><input type='checkbox' name='TIME_SUN' value='on' $checked{'TIME_SUN'}{'on'} ></td>
2018                                                         <td>
2019                                                                 <select name='TIME_FROM'>
2020 END
2021                 for (my $i=0;$i<=23;$i++) {
2022                         $i = sprintf("%02s",$i);
2023                         for (my $j=0;$j<=45;$j+=15) {
2024                                 $j = sprintf("%02s",$j);
2025                                 my $time = $i.":".$j;
2026                                 print "<option $selected{'TIME_FROM'}{$time}>$i:$j</option>\n";
2027                         }
2028                 }
2029                 print<<END;
2030                                                                 </select> &dash;
2031                                                                 <select name='TIME_TO'>
2032 END
2033                 for (my $i=0;$i<=23;$i++) {
2034                         $i = sprintf("%02s",$i);
2035                         for (my $j=0;$j<=45;$j+=15) {
2036                                 $j = sprintf("%02s",$j);
2037                                 my $time = $i.":".$j;
2038                                 print "<option $selected{'TIME_TO'}{$time}>$i:$j</option>\n";
2039                         }
2040                 }
2041                 print<<END;
2042                                                                 </select>
2043                                                         </td>
2044                                                 </tr>
2045                                         </table>
2046                                 </td>
2047                         </tr>
2048                         <tr>
2049                                 <td width='1%'>
2050                                         <input type='checkbox' name='LIMIT_CON_CON' id="USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP" value='ON' $checked{'LIMIT_CON_CON'}{'ON'}>
2051                                 </td>
2052                                 <td>$Lang::tr{'fwdfw limitconcon'}</td>
2053                         </tr>
2054                         <tr id="LIMIT_CON">
2055                                 <td colspan='2'>
2056                                         <table width='66%' border='0'>
2057                                                 <tr>
2058                                                         <td width="20em">&nbsp;</td>
2059                                                         <td>$Lang::tr{'fwdfw maxconcon'}: <input type='text' name='concon' size='2' value="$fwdfwsettings{'concon'}"></td>
2060                                                 </tr>
2061                                         </table>
2062                                 </td>
2063                         </tr>
2064                         <tr>
2065                                 <td width='1%'>
2066                                         <input type='checkbox' name='RATE_LIMIT' id="USE_RATELIMIT" value='ON' $checked{'RATE_LIMIT'}{'ON'}>
2067                                 </td>
2068                                 <td>$Lang::tr{'fwdfw ratelimit'}</td>
2069                         </tr>
2070                         <tr id="RATELIMIT">
2071                                 <td colspan='2'>
2072                                         <table width='66%' border='0'>
2073                                                 <tr>
2074                                                         <td width="20em">&nbsp;</td>
2075                                                         <td>$Lang::tr{'fwdfw numcon'}: <input type='text' name='ratecon' size='2' value="$fwdfwsettings{'ratecon'}"> /
2076                                                                 <select name='RATETIME' style='width:100px;'>
2077                                                                         <option value='second' $selected{'RATETIME'}{'second'}>$Lang::tr{'age second'}</option>
2078                                                                         <option value='minute' $selected{'RATETIME'}{'minute'}>$Lang::tr{'minute'}</option>
2079                                                                         <option value='hour' $selected{'RATETIME'}{'hour'}>$Lang::tr{'hour'}</option>
2080                                                                 </select>
2081                                                         </td>
2082                                                 </tr>
2083                                         </table>
2084                                 </td>
2085                         </tr>
2086                 </table>
2087                 <br>
2088 END
2089
2090                 #---ACTION------------------------------------------------------
2091                 if($fwdfwsettings{'updatefwrule'} ne 'on'){
2092                         print<<END;
2093                         <table border='0' width='100%'>
2094                         <tr><td align='right'><input type='submit' value='$Lang::tr{'add'}' style='min-width:100px;' />
2095                         <input type='hidden' name='config' value='$config' >
2096                         <input type='hidden' name='ACTION' value='saverule' ></form>
2097                         <form method='post' style='display:inline;'><input type='submit' value='$Lang::tr{'fwhost back'}' style='min-width:100px;'><input type='hidden' name='ACTION' value='reset'></form></td></tr>
2098                         </table>
2099                         <br>
2100 END
2101                 }else{
2102                         print<<END;
2103                         <table border='0' width='100%'>
2104                         <tr><td align='right'><input type='submit' value='$Lang::tr{'fwdfw change'}' style='min-width:100px;' /><input type='hidden' name='updatefwrule' value='$fwdfwsettings{'updatefwrule'}'><input type='hidden' name='key' value='$fwdfwsettings{'key'}'>
2105                         <input type='hidden' name='oldgrp1a' value='$fwdfwsettings{'oldgrp1a'}' />
2106                         <input type='hidden' name='oldgrp1b' value='$fwdfwsettings{'oldgrp1b'}' />
2107                         <input type='hidden' name='oldgrp2a' value='$fwdfwsettings{'oldgrp2a'}' />
2108                         <input type='hidden' name='oldgrp2b' value='$fwdfwsettings{'oldgrp2b'}' />
2109                         <input type='hidden' name='oldgrp3a' value='$fwdfwsettings{'oldgrp3a'}' />
2110                         <input type='hidden' name='oldgrp3b' value='$fwdfwsettings{'oldgrp3b'}' />
2111                         <input type='hidden' name='oldusesrv' value='$fwdfwsettings{'oldusesrv'}' />
2112                         <input type='hidden' name='oldrulenumber' value='$fwdfwsettings{'oldrulenumber'}' />
2113                         <input type='hidden' name='rulenumber' value='$fwdfwsettings{'rulepos'}' />
2114                         <input type='hidden' name='oldruleremark' value='$fwdfwsettings{'oldruleremark'}' />
2115                         <input type='hidden' name='oldorange' value='$fwdfwsettings{'oldorange'}' />
2116                         <input type='hidden' name='oldnat' value='$fwdfwsettings{'oldnat'}' />
2117                         <input type='hidden' name='oldruletype' value='$fwdfwsettings{'oldruletype'}' />
2118                         <input type='hidden' name='oldconcon' value='$fwdfwsettings{'oldconcon'}' />
2119                         <input type='hidden' name='ACTION' value='saverule' ></form><form method='post' style='display:inline'><input type='submit' value='$Lang::tr{'fwhost back'}' style='min-width:100px;'><input type='hidden' name='ACTION' value'reset'></td></td>
2120                         </table></form>
2121 END
2122                 }
2123                 &Header::closebox();
2124 }
2125 sub pos_up
2126 {
2127         my %uphash=();
2128         my %tmp=();
2129         &General::readhasharray($fwdfwsettings{'config'}, \%uphash);
2130         foreach my $key (sort keys %uphash){
2131                 if ($key eq $fwdfwsettings{'key'}) {
2132                         my $last = $key -1;
2133                         if (exists $uphash{$last}){
2134                                 #save rule last
2135                                 foreach my $y (0 .. $#{$uphash{$last}}) {
2136                                                 $tmp{0}[$y] = $uphash{$last}[$y];
2137                                 }
2138                                 #copy active rule to last
2139                                 foreach my $i (0 .. $#{$uphash{$last}}) {
2140                                         $uphash{$last}[$i] = $uphash{$key}[$i];
2141                                 }
2142                                 #copy saved rule to actual position
2143                                 foreach my $x (0 .. $#{$tmp{0}}) {
2144                                                 $uphash{$key}[$x] = $tmp{0}[$x];
2145                                 }
2146                         }
2147                 }
2148         }
2149         &General::writehasharray($fwdfwsettings{'config'}, \%uphash);
2150         &General::firewall_config_changed();
2151 }
2152 sub pos_down
2153 {
2154         my %downhash=();
2155         my %tmp=();
2156         &General::readhasharray($fwdfwsettings{'config'}, \%downhash);
2157         foreach my $key (sort keys %downhash){
2158                 if ($key eq $fwdfwsettings{'key'}) {
2159                         my $next = $key + 1;
2160                         if (exists $downhash{$next}){
2161                                 #save rule next
2162                                 foreach my $y (0 .. $#{$downhash{$next}}) {
2163                                                 $tmp{0}[$y] = $downhash{$next}[$y];
2164                                 }
2165                                 #copy active rule to next
2166                                 foreach my $i (0 .. $#{$downhash{$next}}) {
2167                                         $downhash{$next}[$i] = $downhash{$key}[$i];
2168                                 }
2169                                 #copy saved rule to actual position
2170                                 foreach my $x (0 .. $#{$tmp{0}}) {
2171                                                 $downhash{$key}[$x] = $tmp{0}[$x];
2172                                 }
2173                         }
2174                 }
2175         }
2176         &General::writehasharray($fwdfwsettings{'config'}, \%downhash);
2177         &General::firewall_config_changed();
2178 }
2179 sub saverule
2180 {
2181         my $hash=shift;
2182         my $config=shift;
2183         &General::readhasharray("$config", $hash);
2184         if (!$errormessage){
2185                 ################################################################
2186                 #check if we change an INPUT rule to a OUTGOING
2187                 if($fwdfwsettings{'oldruletype'} eq 'INPUTFW'  && $fwdfwsettings{'chain'} eq 'OUTGOINGFW'  ){
2188                         &changerule($configinput);
2189                         #print"1";
2190                 }
2191                 #check if we change an INPUT rule to a FORWARD
2192                 elsif($fwdfwsettings{'oldruletype'} eq 'INPUTFW'  && $fwdfwsettings{'chain'} eq 'FORWARDFW'  ){
2193                         &changerule($configinput);
2194                         #print"2";
2195                 }
2196                 ################################################################
2197                 #check if we change an OUTGOING rule to an INPUT
2198                 elsif($fwdfwsettings{'oldruletype'} eq 'OUTGOINGFW'  && $fwdfwsettings{'chain'} eq 'INPUTFW'  ){
2199                         &changerule($configoutgoing);
2200                         #print"3";
2201                 }
2202                 #check if we change an OUTGOING rule to a FORWARD
2203                 elsif($fwdfwsettings{'oldruletype'} eq 'OUTGOINGFW'  && $fwdfwsettings{'chain'} eq 'FORWARDFW'  ){
2204                         &changerule($configoutgoing);
2205                         #print"4";
2206                 }
2207                 ################################################################
2208                 #check if we change a FORWARD rule to an INPUT
2209                 elsif($fwdfwsettings{'oldruletype'} eq 'FORWARDFW'  && $fwdfwsettings{'chain'} eq 'INPUTFW'){
2210                         &changerule($configfwdfw);
2211                         #print"5";
2212                 }
2213                 #check if we change a FORWARD rule to an OUTGOING
2214                 elsif($fwdfwsettings{'oldruletype'} eq 'FORWARDFW'  && $fwdfwsettings{'chain'} eq 'OUTGOINGFW'){
2215                         &changerule($configfwdfw);
2216                         #print"6";
2217                 }
2218                 $fwdfwsettings{'ruleremark'}=~ s/,/;/g;
2219                 utf8::decode($fwdfwsettings{'ruleremark'});
2220                 $fwdfwsettings{'ruleremark'}=&Header::escape($fwdfwsettings{'ruleremark'});
2221                 if ($fwdfwsettings{'updatefwrule'} ne 'on'){
2222                         my $key = &General::findhasharraykey ($hash);
2223                         $$hash{$key}[0]  = $fwdfwsettings{'RULE_ACTION'};
2224                         $$hash{$key}[1]  = $fwdfwsettings{'chain'};
2225                         $$hash{$key}[2]  = $fwdfwsettings{'ACTIVE'};
2226                         $$hash{$key}[3]  = $fwdfwsettings{'grp1'};
2227                         $$hash{$key}[4]  = $fwdfwsettings{$fwdfwsettings{'grp1'}};
2228                         $$hash{$key}[5]  = $fwdfwsettings{'grp2'};
2229                         $$hash{$key}[6]  = $fwdfwsettings{$fwdfwsettings{'grp2'}};
2230                         $$hash{$key}[7]  = $fwdfwsettings{'USE_SRC_PORT'};
2231                         $$hash{$key}[8]  = $fwdfwsettings{'PROT'};
2232                         $$hash{$key}[9]  = $fwdfwsettings{'ICMP_TYPES'};
2233                         $$hash{$key}[10] = $fwdfwsettings{'SRC_PORT'};
2234                         $$hash{$key}[11] = $fwdfwsettings{'USESRV'};
2235                         $$hash{$key}[12] = $fwdfwsettings{'TGT_PROT'};
2236                         $$hash{$key}[13] = $fwdfwsettings{'ICMP_TGT'};
2237                         $$hash{$key}[14] = $fwdfwsettings{'grp3'};
2238                         $$hash{$key}[15] = $fwdfwsettings{$fwdfwsettings{'grp3'}};
2239                         $$hash{$key}[16] = $fwdfwsettings{'ruleremark'};
2240                         $$hash{$key}[17] = $fwdfwsettings{'LOG'};
2241                         $$hash{$key}[18] = $fwdfwsettings{'TIME'};
2242                         $$hash{$key}[19] = $fwdfwsettings{'TIME_MON'};
2243                         $$hash{$key}[20] = $fwdfwsettings{'TIME_TUE'};
2244                         $$hash{$key}[21] = $fwdfwsettings{'TIME_WED'};
2245                         $$hash{$key}[22] = $fwdfwsettings{'TIME_THU'};
2246                         $$hash{$key}[23] = $fwdfwsettings{'TIME_FRI'};
2247                         $$hash{$key}[24] = $fwdfwsettings{'TIME_SAT'};
2248                         $$hash{$key}[25] = $fwdfwsettings{'TIME_SUN'};
2249                         $$hash{$key}[26] = $fwdfwsettings{'TIME_FROM'};
2250                         $$hash{$key}[27] = $fwdfwsettings{'TIME_TO'};
2251                         $$hash{$key}[28] = $fwdfwsettings{'USE_NAT'};
2252                         $$hash{$key}[29] = $fwdfwsettings{$fwdfwsettings{'nat'}};
2253                         $$hash{$key}[30] = $fwdfwsettings{'dnatport'};
2254                         $$hash{$key}[31] = $fwdfwsettings{'nat'};
2255                         $$hash{$key}[32] = $fwdfwsettings{'LIMIT_CON_CON'};
2256                         $$hash{$key}[33] = $fwdfwsettings{'concon'};
2257                         $$hash{$key}[34] = $fwdfwsettings{'RATE_LIMIT'};
2258                         $$hash{$key}[35] = $fwdfwsettings{'ratecon'};
2259                         $$hash{$key}[36] = $fwdfwsettings{'RATETIME'};
2260                         &General::writehasharray("$config", $hash);
2261                 }else{
2262                         foreach my $key (sort {$a <=> $b} keys %$hash){
2263                                 if($key eq $fwdfwsettings{'key'}){
2264                                         $$hash{$key}[0]  = $fwdfwsettings{'RULE_ACTION'};
2265                                         $$hash{$key}[1]  = $fwdfwsettings{'chain'};
2266                                         $$hash{$key}[2]  = $fwdfwsettings{'ACTIVE'};
2267                                         $$hash{$key}[3]  = $fwdfwsettings{'grp1'};
2268                                         $$hash{$key}[4]  = $fwdfwsettings{$fwdfwsettings{'grp1'}};
2269                                         $$hash{$key}[5]  = $fwdfwsettings{'grp2'};
2270                                         $$hash{$key}[6]  = $fwdfwsettings{$fwdfwsettings{'grp2'}};
2271                                         $$hash{$key}[7]  = $fwdfwsettings{'USE_SRC_PORT'};
2272                                         $$hash{$key}[8]  = $fwdfwsettings{'PROT'};
2273                                         $$hash{$key}[9]  = $fwdfwsettings{'ICMP_TYPES'};
2274                                         $$hash{$key}[10] = $fwdfwsettings{'SRC_PORT'};
2275                                         $$hash{$key}[11] = $fwdfwsettings{'USESRV'};
2276                                         $$hash{$key}[12] = $fwdfwsettings{'TGT_PROT'};
2277                                         $$hash{$key}[13] = $fwdfwsettings{'ICMP_TGT'};
2278                                         $$hash{$key}[14] = $fwdfwsettings{'grp3'};
2279                                         $$hash{$key}[15] = $fwdfwsettings{$fwdfwsettings{'grp3'}};
2280                                         $$hash{$key}[16] = $fwdfwsettings{'ruleremark'};
2281                                         $$hash{$key}[17] = $fwdfwsettings{'LOG'};
2282                                         $$hash{$key}[18] = $fwdfwsettings{'TIME'};
2283                                         $$hash{$key}[19] = $fwdfwsettings{'TIME_MON'};
2284                                         $$hash{$key}[20] = $fwdfwsettings{'TIME_TUE'};
2285                                         $$hash{$key}[21] = $fwdfwsettings{'TIME_WED'};
2286                                         $$hash{$key}[22] = $fwdfwsettings{'TIME_THU'};
2287                                         $$hash{$key}[23] = $fwdfwsettings{'TIME_FRI'};
2288                                         $$hash{$key}[24] = $fwdfwsettings{'TIME_SAT'};
2289                                         $$hash{$key}[25] = $fwdfwsettings{'TIME_SUN'};
2290                                         $$hash{$key}[26] = $fwdfwsettings{'TIME_FROM'};
2291                                         $$hash{$key}[27] = $fwdfwsettings{'TIME_TO'};
2292                                         $$hash{$key}[28] = $fwdfwsettings{'USE_NAT'};
2293                                         $$hash{$key}[29] = $fwdfwsettings{$fwdfwsettings{'nat'}};
2294                                         $$hash{$key}[30] = $fwdfwsettings{'dnatport'};
2295                                         $$hash{$key}[31] = $fwdfwsettings{'nat'};
2296                                         $$hash{$key}[32] = $fwdfwsettings{'LIMIT_CON_CON'};
2297                                         $$hash{$key}[33] = $fwdfwsettings{'concon'};
2298                                         $$hash{$key}[34] = $fwdfwsettings{'RATE_LIMIT'};
2299                                         $$hash{$key}[35] = $fwdfwsettings{'ratecon'};
2300                                         $$hash{$key}[36] = $fwdfwsettings{'RATETIME'};
2301                                         last;
2302                                 }
2303                         }
2304                 }
2305                 &General::writehasharray("$config", $hash);
2306                 if($fwdfwsettings{'oldrulenumber'} > $fwdfwsettings{'rulepos'}){
2307                         my %tmp=();
2308                         my $val=$fwdfwsettings{'oldrulenumber'}-$fwdfwsettings{'rulepos'};
2309                         for (my $z=0;$z<$val;$z++){
2310                                 foreach my $key (sort {$a <=> $b} keys %$hash){
2311                                         if ($key eq $fwdfwsettings{'oldrulenumber'}) {
2312                                                 my $last = $key -1;
2313                                                 if (exists $$hash{$last}){
2314                                                         #save rule last
2315                                                         foreach my $y (0 .. $#{$$hash{$last}}) {
2316                                                                 $tmp{0}[$y] = $$hash{$last}[$y];
2317                                                         }
2318                                                         #copy active rule to last
2319                                                         foreach my $i (0 .. $#{$$hash{$last}}) {
2320                                                                 $$hash{$last}[$i] = $$hash{$key}[$i];
2321                                                         }
2322                                                         #copy saved rule to actual position
2323                                                         foreach my $x (0 .. $#{$tmp{0}}) {
2324                                                                 $$hash{$key}[$x] = $tmp{0}[$x];
2325                                                         }
2326                                                 }
2327                                         }
2328                                 }
2329                                 $fwdfwsettings{'oldrulenumber'}--;
2330                         }
2331                         &General::writehasharray("$config", $hash);
2332                         &General::firewall_config_changed();
2333                 }elsif($fwdfwsettings{'rulepos'} > $fwdfwsettings{'oldrulenumber'}){
2334                         my %tmp=();
2335                         my $val=$fwdfwsettings{'rulepos'}-$fwdfwsettings{'oldrulenumber'};
2336                                 for (my $z=0;$z<$val;$z++){
2337                                         foreach my $key (sort {$a <=> $b} keys %$hash){
2338                                         if ($key eq $fwdfwsettings{'oldrulenumber'}) {
2339                                                 my $next = $key + 1;
2340                                                 if (exists $$hash{$next}){
2341                                                         #save rule next
2342                                                         foreach my $y (0 .. $#{$$hash{$next}}) {
2343                                                                 $tmp{0}[$y] = $$hash{$next}[$y];
2344                                                         }
2345                                                         #copy active rule to next
2346                                                         foreach my $i (0 .. $#{$$hash{$next}}) {
2347                                                                 $$hash{$next}[$i] = $$hash{$key}[$i];
2348                                                         }
2349                                                         #copy saved rule to actual position
2350                                                         foreach my $x (0 .. $#{$tmp{0}}) {
2351                                                                 $$hash{$key}[$x] = $tmp{0}[$x];
2352                                                         }
2353                                                 }
2354                                         }
2355                                 }
2356                                 $fwdfwsettings{'oldrulenumber'}++;
2357                         }
2358                         &General::writehasharray("$config", $hash);
2359                         &General::firewall_config_changed();
2360                 }
2361         }
2362 }
2363 sub validremark
2364 {
2365         # Checks a hostname against RFC1035
2366         my $remark = $_[0];
2367
2368         # Try to decode $remark into UTF-8. If this doesn't work,
2369         # we assume that the string it not sane.
2370         if (!utf8::decode($remark)) {
2371                 return 0;
2372         }
2373
2374         # Check if the string only contains of printable characters.
2375         if ($remark =~ /^[[:print:]]*$/) {
2376                 return 1;
2377         }
2378         return 0;
2379 }
2380 sub viewtablerule
2381 {
2382         &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
2383
2384         &viewtablenew(\%configfwdfw, $configfwdfw, $Lang::tr{'firewall rules'});
2385         &viewtablenew(\%configinputfw, $configinput, $Lang::tr{'incoming firewall access'});
2386         &viewtablenew(\%configoutgoingfw, $configoutgoing, $Lang::tr{'outgoing firewall access'});
2387 }
2388 sub viewtablenew
2389 {
2390         my $hash=shift;
2391         my $config=shift;
2392         my $title=shift;
2393         my $go='';
2394
2395         my $show_box = (! -z $config) || ($optionsfw{'SHOWTABLES'} eq 'on');
2396         return if (!$show_box);
2397
2398         &General::get_aliases(\%aliases);
2399         &General::readhasharray("$confighost", \%customhost);
2400         &General::readhasharray("$config", $hash);
2401         &General::readhasharray("$configccdnet", \%ccdnet);
2402         &General::readhasharray("$configccdhost", \%ccdhost);
2403         &General::readhasharray("$configgrp", \%customgrp);
2404         &General::readhasharray("$configsrvgrp", \%customservicegrp);
2405
2406         &Header::openbox('100%', 'left', $title);
2407         print "<table width='100%' cellspacing='0' class='tbl'>";
2408
2409         if (! -z $config) {
2410                 my $count=0;
2411                 my ($gif,$log);
2412                 my $ruletype;
2413                 my $rulecolor;
2414                 my $tooltip;
2415                 my @tmpsrc=();
2416                 my @tmptgt=();
2417                 my $coloryellow='';
2418
2419                 print <<END;
2420                                 <tr>
2421                                         <th align='right' width='3%'>
2422                                                 #
2423                                         </th>
2424                                         <th width='2%'></th>
2425                                         <th align='center'>
2426                                                 <b>$Lang::tr{'protocol'}</b>
2427                                         </th>
2428                                         <th align='center' width='30%'>
2429                                                 <b>$Lang::tr{'fwdfw source'}</b>
2430                                         </th>
2431                                         <th align='center'>
2432                                                 <b>$Lang::tr{'fwdfw log'}</b>
2433                                         </th>
2434                                         <th align='center' width='30%'>
2435                                                 <b>$Lang::tr{'fwdfw target'}</b>
2436                                         </th>
2437                                         <th align='center' colspan='6' width='18%'>
2438                                                 <b>$Lang::tr{'fwdfw action'}</b>
2439                                         </th>
2440                                 </tr>
2441 END
2442
2443                 foreach my $key (sort  {$a <=> $b} keys %$hash){
2444                         $tdcolor='';
2445                         @tmpsrc=();
2446                         @tmptgt=();
2447                         #check if vpn hosts/nets have been deleted
2448                         if($$hash{$key}[3] =~ /ipsec/i || $$hash{$key}[3] =~ /ovpn/i){
2449                                 push (@tmpsrc,$$hash{$key}[4]);
2450                         }
2451                         if($$hash{$key}[5] =~ /ipsec/i || $$hash{$key}[5] =~ /ovpn/i){
2452                                 push (@tmptgt,$$hash{$key}[6]);
2453                         }
2454                         foreach my $host (@tmpsrc){
2455                                 if($$hash{$key}[3] eq  'ipsec_net_src'){
2456                                         if(&fwlib::get_ipsec_net_ip($host,11) eq ''){
2457                                                 $coloryellow='on';
2458                                         }
2459                                 }elsif($$hash{$key}[3] eq  'ovpn_net_src'){
2460                                         if(&fwlib::get_ovpn_net_ip($host,1) eq ''){
2461                                                 $coloryellow='on';
2462                                         }
2463                                 }elsif($$hash{$key}[3] eq  'ovpn_n2n_src'){
2464                                         if(&fwlib::get_ovpn_n2n_ip($host,27) eq ''){
2465                                                 $coloryellow='on';
2466                                         }
2467                                 }elsif($$hash{$key}[3] eq  'ovpn_host_src'){
2468                                         if(&fwlib::get_ovpn_host_ip($host,33) eq ''){
2469                                                 $coloryellow='on';
2470                                         }
2471                                 }
2472                         }
2473                         foreach my $host (@tmptgt){
2474                                 if($$hash{$key}[5] eq 'ipsec_net_tgt'){
2475                                         if(&fwlib::get_ipsec_net_ip($host,11) eq ''){
2476                                                 $coloryellow='on';
2477                                         }
2478                                 }elsif($$hash{$key}[5] eq 'ovpn_net_tgt'){
2479                                         if(&fwlib::get_ovpn_net_ip($host,1) eq ''){
2480                                                 $coloryellow='on';
2481                                         }
2482                                 }elsif($$hash{$key}[5] eq 'ovpn_n2n_tgt'){
2483                                         if(&fwlib::get_ovpn_n2n_ip($host,27) eq ''){
2484                                                 $coloryellow='on';
2485                                         }
2486                                 }elsif($$hash{$key}[5] eq 'ovpn_host_tgt'){
2487                                         if(&fwlib::get_ovpn_host_ip($host,33) eq ''){
2488                                                 $coloryellow='on';
2489                                         }
2490                                 }
2491                         }
2492                         #check if networkgroups or servicegroups are empty
2493                         foreach my $netgroup (sort keys %customgrp){
2494                                 if(($$hash{$key}[4] eq $customgrp{$netgroup}[0] || $$hash{$key}[6] eq $customgrp{$netgroup}[0]) && $customgrp{$netgroup}[2] eq 'none'){
2495                                         $coloryellow='on';
2496                                 }
2497                         }
2498                         foreach my $srvgroup (sort keys %customservicegrp){
2499                                 if($$hash{$key}[15] eq $customservicegrp{$srvgroup}[0] && $customservicegrp{$srvgroup}[2] eq 'none'){
2500                                         $coloryellow='on';
2501                                 }
2502                         }
2503                         $$hash{'ACTIVE'}=$$hash{$key}[2];
2504                         $count++;
2505                         if($coloryellow eq 'on'){
2506                                 $color="$color{'color14'}";
2507                                 $coloryellow='';
2508                         }elsif($coloryellow eq ''){
2509                                 if ($count % 2){
2510                                         $color="$color{'color22'}";
2511                                 }
2512                                 else{
2513                                         $color="$color{'color20'}";
2514                                 }
2515                         }
2516                         print<<END;
2517                                 <tr bgcolor='$color'>
2518                                         <td align='right' width='3%'>
2519                                                 <b>$key&nbsp;</b>
2520                                         </td>
2521 END
2522
2523                         #RULETYPE (A,R,D)
2524                         if ($$hash{$key}[0] eq 'ACCEPT'){
2525                                 $ruletype='A';
2526                                 $tooltip='ACCEPT';
2527                                 $rulecolor=$color{'color17'};
2528                         }elsif($$hash{$key}[0] eq 'DROP'){
2529                                 $ruletype='D';
2530                                 $tooltip='DROP';
2531                                 $rulecolor=$color{'color25'};
2532                         }elsif($$hash{$key}[0] eq 'REJECT'){
2533                                 $ruletype='R';
2534                                 $tooltip='REJECT';
2535                                 $rulecolor=$color{'color16'};
2536                         }
2537
2538                         print <<END;
2539                                         <td bgcolor='$rulecolor' align='center' width='2%'>
2540                                                 <span title='$tooltip'>&nbsp;&nbsp;</span>
2541                                         </td>
2542 END
2543
2544                         #Get Protocol
2545                         my $prot;
2546                         if ($$hash{$key}[8]){
2547                                 if ($$hash{$key}[8] eq "IPv6"){
2548                                         push (@protocols,$Lang::tr{'fwdfw prot41 short'})
2549                                 }else{
2550                                         push (@protocols,$$hash{$key}[8]);
2551                                 }
2552                         }elsif($$hash{$key}[14] eq 'cust_srv'){
2553                                 &get_serviceports("service",$$hash{$key}[15]);
2554                         }elsif($$hash{$key}[14] eq 'cust_srvgrp'){
2555                                 &get_serviceports("group",$$hash{$key}[15]);
2556                         }else{
2557                                 push (@protocols,$Lang::tr{'all'});
2558                         }
2559
2560                         my $protz=join(", ",@protocols);
2561                         if($protz eq 'ICMP' && $$hash{$key}[9] ne 'All ICMP-Types' && $$hash{$key}[14] ne 'cust_srvgrp'){
2562                                 &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
2563                                 foreach my $keyicmp (sort { ncmp($icmptypes{$a}[0],$icmptypes{$b}[0]) }keys %icmptypes){
2564                                         if($$hash{$key}[9] eq "$icmptypes{$keyicmp}[0]"){
2565                                                 print "<td align='center'><span title='$icmptypes{$keyicmp}[0]'><b>$protz ($icmptypes{$keyicmp}[1])</b></span></td>";
2566                                                 last;
2567                                         }
2568                                 }
2569                         }elsif($#protocols gt '3'){
2570                                 print"<td align='center'><span title='$protz'>$Lang::tr{'fwdfw many'}</span></td>";
2571                         }else{
2572                                 print"<td align='center'>$protz</td>";
2573                         }
2574                         @protocols=();
2575                         #SOURCE
2576                         my $ipfireiface;
2577                         &getcolor($$hash{$key}[3],$$hash{$key}[4],\%customhost);
2578                         print"<td align='center' width='30%' $tdcolor>";
2579                         if ($$hash{$key}[3] eq 'ipfire_src'){
2580                                 $ipfireiface=$Lang::tr{'fwdfw iface'};
2581                         }
2582                         if ($$hash{$key}[3] eq 'std_net_src'){
2583                                 print &get_name($$hash{$key}[4]);
2584                         }elsif ($$hash{$key}[3] eq 'src_addr'){
2585                                 my ($split1,$split2) = split("/",$$hash{$key}[4]);
2586                                 if ($split2 eq '32'){
2587                                         print $split1;
2588                                 }else{
2589                                         print $$hash{$key}[4];
2590                                 }
2591                         }elsif ($$hash{$key}[3] eq 'cust_geoip_src') {
2592                                 my ($split1,$split2) = split(":", $$hash{$key}[4]);
2593                                 if ($split2) {
2594                                         print "$split2\n";
2595                                 }else{
2596                                         print "$Lang::tr{'geoip'}: $$hash{$key}[4]\n";
2597                                 }
2598                         }elsif ($$hash{$key}[4] eq 'RED1'){
2599                                 print "$ipfireiface $Lang::tr{'fwdfw red'}";
2600                         }elsif ($$hash{$key}[4] eq 'ALL'){
2601                                 print "$ipfireiface $Lang::tr{'all'}";
2602                         }else{
2603                                 if ($$hash{$key}[4] eq 'GREEN' || $$hash{$key}[4] eq 'ORANGE' || $$hash{$key}[4] eq 'BLUE' || $$hash{$key}[4] eq 'RED'){
2604                                         print "$ipfireiface $Lang::tr{lc($$hash{$key}[4])}";
2605                                 }else{
2606                                         print "$ipfireiface $$hash{$key}[4]";
2607                                 }
2608                         }
2609                         $tdcolor='';
2610                         #SOURCEPORT
2611                         &getsrcport(\%$hash,$key);
2612                         #Is this a SNAT rule?
2613                         if ($$hash{$key}[31] eq 'snat' && $$hash{$key}[28] eq 'ON'){
2614                                 my $net=&get_name($$hash{$key}[29]);
2615                                 if ( ! $net){ $net=$$hash{$key}[29];}
2616                                         print"<br>->$net";
2617                                 if ($$hash{$key}[30] ne ''){
2618                                         print": $$hash{$key}[30]";
2619                                 }
2620                         }
2621                         if ($$hash{$key}[17] eq 'ON'){
2622                                 $log="/images/on.gif";
2623                         }else{
2624                                 $log="/images/off.gif";
2625                         }
2626                         #LOGGING
2627                         print<<END;
2628                                         </td>
2629                                         <td align='center'>
2630                                                 <form method='POST' action=''>
2631                                                         <input type='image' img src='$log' alt='$Lang::tr{'click to disable'}' title='$Lang::tr{'fwdfw togglelog'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;'/>
2632                                                         <input type='hidden' name='key' value='$key' />
2633                                                         <input type='hidden' name='config' value='$config' />
2634                                                         <input type='hidden' name='ACTION' value='$Lang::tr{'fwdfw togglelog'}' />
2635                                                 </form>
2636                                         </td>
2637 END
2638                         #TARGET
2639                         &getcolor($$hash{$key}[5],$$hash{$key}[6],\%customhost);
2640                         print<<END;
2641                                         <td align='center' $tdcolor>
2642 END
2643                         #Is this a DNAT rule?
2644                         my $natstring;
2645                         if ($$hash{$key}[31] eq 'dnat' && $$hash{$key}[28] eq 'ON'){
2646                                 if ($$hash{$key}[29] eq 'Default IP'){$$hash{$key}[29]=$Lang::tr{'red1'};}
2647                                 if ($$hash{$key}[29] eq 'AUTO'){
2648                                         my @src_addresses=&fwlib::get_addresses(\%$hash,$key,'src');
2649                                         my @nat_ifaces;
2650                                         foreach my $val (@src_addresses){
2651                                                 push (@nat_ifaces,&fwlib::get_nat_address($$hash{$key}[29],$val));
2652                                         }
2653                                         @nat_ifaces=&del_double(@nat_ifaces);
2654                                         $natstring = "";
2655                                 }else{
2656                                         $natstring = "($$hash{$key}[29])";
2657                                 }
2658                                 print "$Lang::tr{'firewall'} $natstring";
2659                                 if($$hash{$key}[30] ne ''){
2660                                         $$hash{$key}[30]=~ tr/|/,/;
2661                                         print": $$hash{$key}[30]";
2662                                 }
2663                                 print"<br>-&gt;";
2664                         }
2665                         if ($$hash{$key}[5] eq 'std_net_tgt' || $$hash{$key}[5] eq 'ipfire'){
2666                                 if ($$hash{$key}[6] eq 'RED1'){
2667                                         print "$Lang::tr{'red1'}";
2668                                 }elsif ($$hash{$key}[6] eq 'GREEN' || $$hash{$key}[6] eq 'ORANGE' || $$hash{$key}[6] eq 'BLUE'|| $$hash{$key}[6] eq 'ALL' || $$hash{$key}[6] eq 'RED')
2669                                 {
2670                                         print &get_name($$hash{$key}[6]);
2671                                 }else{
2672                                         print $$hash{$key}[6];
2673                                 }
2674                         }elsif ($$hash{$key}[5] eq 'cust_geoip_tgt') {
2675                                 my ($split1,$split2) = split(":", $$hash{$key}[6]);
2676                                 if ($split2) {
2677                                         print "$split2\n";
2678                                 }else{
2679                                         print "$Lang::tr{'geoip'}: $$hash{$key}[6]\n";
2680                                 }
2681                         }elsif ($$hash{$key}[5] eq 'tgt_addr'){
2682                                 my ($split1,$split2) = split("/",$$hash{$key}[6]);
2683                                 if ($split2 eq '32'){
2684                                         print $split1;
2685                                 }else{
2686                                         print $$hash{$key}[6];
2687                                 }
2688                         }else{
2689                                 print "$$hash{$key}[6]";
2690                         }
2691                         $tdcolor='';
2692                         #TARGETPORT
2693                         &gettgtport(\%$hash,$key);
2694                         print"</td>";
2695                         #RULE ACTIVE
2696                         if($$hash{$key}[2] eq 'ON'){
2697                                 $gif="/images/on.gif"
2698                         }else{
2699                                 $gif="/images/off.gif"
2700                         }
2701                         print<<END;
2702                                 <td width='3%' align='center'>
2703                                         <form method='POST' action=''>
2704                                                 <input type='image' img src='$gif' alt='$Lang::tr{'click to disable'}' title='$Lang::tr{'fwdfw toggle'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;' />
2705                                                 <input type='hidden' name='key' value='$key' />
2706                                                 <input type='hidden' name='config' value='$config' />
2707                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'fwdfw toggle'}' />
2708                                         </form>
2709                                 </td>
2710                                 <td width='3%' align='center'>
2711                                         <form method='POST' action=''>
2712                                                 <input type='image' img src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'fwdfw edit'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'  />
2713                                                 <input type='hidden' name='key' value='$key' />
2714                                                 <input type='hidden' name='config' value='$config' />
2715                                                 <input type='hidden' name='ACTION' value='editrule' />
2716                                         </form>
2717                                 </td>
2718                                 <td width='3%' align='center'>
2719                                         <form method='POST' action=''>
2720                                                 <input type='image' img src='/images/addblue.gif' alt='$Lang::tr{'fwdfw copy'}' title='$Lang::tr{'fwdfw copy'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;' />
2721                                                 <input type='hidden' name='key' value='$key' />
2722                                                 <input type='hidden' name='config' value='$config' />
2723                                                 <input type='hidden' name='ACTION' value='copyrule' />
2724                                         </form>
2725                                 </td>
2726                                 <td width='3%' align='center'>
2727                                         <form method='POST' action=''>
2728                                                 <input type='image' img src='/images/delete.gif' alt='$Lang::tr{'delete'}' title='$Lang::tr{'fwdfw delete'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'   />
2729                                                 <input type='hidden' name='key' value='$key' />
2730                                                 <input type='hidden' name='config' value='$config' />
2731                                                 <input type='hidden' name='ACTION' value='deleterule' />
2732                                         </form>
2733                                 </td>
2734 END
2735                         if (exists $$hash{$key-1}){
2736                                 print<<END;
2737                                         <td width='3%' align='center'>
2738                                                 <form method='POST' action=''>
2739                                                         <input type='image' img src='/images/up.gif' alt='$Lang::tr{'fwdfw moveup'}' title='$Lang::tr{'fwdfw moveup'}'  style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'  />
2740                                                         <input type='hidden' name='key' value='$key' />
2741                                                         <input type='hidden' name='config' value='$config' />
2742                                                         <input type='hidden' name='ACTION' value='moveup' />
2743                                                 </form>
2744                                         </td>
2745 END
2746                         }else{
2747                                 print"<td width='3%'></td>";
2748                         }
2749
2750                         if (exists $$hash{$key+1}){
2751                                 print<<END;
2752                                         <td width='3%' align='center'>
2753                                                 <form method='POST' action=''>
2754                                                         <input type='image' img src='/images/down.gif' alt='$Lang::tr{'fwdfw movedown'}' title='$Lang::tr{'fwdfw movedown'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'  />
2755                                                         <input type='hidden' name='key' value='$key' />
2756                                                         <input type='hidden' name='config' value='$config' />
2757                                                         <input type='hidden' name='ACTION' value='movedown' />
2758                                                 </form>
2759                                         </td>
2760                                 </tr>
2761 END
2762                         }else{
2763                                 print"<td width='3%'></td></tr>";
2764                         }
2765                         #REMARK
2766                         if ($optionsfw{'SHOWREMARK'} eq 'on' && $$hash{$key}[16] ne ''){
2767                                 print <<END;
2768                                         <tr bgcolor='$color'>
2769                                                 <td>&nbsp;</td>
2770                                                 <td bgcolor='$rulecolor'></td>
2771                                                 <td colspan='10'>
2772                                                         &nbsp; <em>$$hash{$key}[16]</em>
2773                                                 </td>
2774                                         </tr>
2775 END
2776                         }
2777
2778                         if ($$hash{$key}[18] eq 'ON'){
2779                                 #TIMEFRAME
2780                                 if ($$hash{$key}[18] eq 'ON'){
2781                                         my @days=();
2782                                         if($$hash{$key}[19] ne ''){push (@days,$Lang::tr{'fwdfw wd_mon'});}
2783                                         if($$hash{$key}[20] ne ''){push (@days,$Lang::tr{'fwdfw wd_tue'});}
2784                                         if($$hash{$key}[21] ne ''){push (@days,$Lang::tr{'fwdfw wd_wed'});}
2785                                         if($$hash{$key}[22] ne ''){push (@days,$Lang::tr{'fwdfw wd_thu'});}
2786                                         if($$hash{$key}[23] ne ''){push (@days,$Lang::tr{'fwdfw wd_fri'});}
2787                                         if($$hash{$key}[24] ne ''){push (@days,$Lang::tr{'fwdfw wd_sat'});}
2788                                         if($$hash{$key}[25] ne ''){push (@days,$Lang::tr{'fwdfw wd_sun'});}
2789                                         my $weekdays=join(",",@days);
2790                                         if (@days){
2791                                                 print"<tr bgcolor='$color'>";
2792                                                 print"<td>&nbsp;</td><td bgcolor='$rulecolor'></td><td align='left' colspan='10'>&nbsp; $weekdays &nbsp; $$hash{$key}[26] - $$hash{$key}[27]</td></tr>";
2793                                         }
2794                                 }
2795                         }
2796                         print"<tr bgcolor='FFFFFF'><td colspan='13' height='1'></td></tr>";
2797                 }
2798         } elsif ($optionsfw{'SHOWTABLES'} eq 'on') {
2799                 print <<END;
2800                         <tr>
2801                                 <td colspan='7' height='30' bgcolor=$color{'color22'} align='center'>$Lang::tr{'fwhost empty'}</td>
2802                         </tr>
2803 END
2804         }
2805
2806         #SHOW FINAL RULE
2807         my $policy = 'fwdfw ' . $fwdfwsettings{'POLICY'};
2808         my $colour = "bgcolor='green'";
2809         if ($fwdfwsettings{'POLICY'} eq 'MODE1') {
2810                 $colour = "bgcolor='darkred'";
2811         }
2812
2813         my $message;
2814         if (($config eq '/var/ipfire/firewall/config') && ($fwdfwsettings{'POLICY'} ne 'MODE1')) {
2815                 print <<END;
2816                         <tr>
2817                                 <td colspan='13'>&nbsp;</td>
2818                         </tr>
2819                         <tr>
2820                                 <td colspan='13' style="padding-left:0px;padding-right:0px">
2821                                         <table width="100%" border='1' rules="cols" cellspacing='0'>
2822 END
2823
2824                 # GREEN
2825                 print <<END;
2826                         <tr>
2827                                 <td align='center'>
2828                                         <font color="$Header::colourgreen">$Lang::tr{'green'}</font>
2829                                 </td>
2830                                 <td align='center'>
2831                                         <font color="$Header::colourred">$Lang::tr{'red'}</font>
2832                                         ($Lang::tr{'fwdfw pol allow'})
2833                                 </td>
2834 END
2835
2836                 if (&Header::orange_used()) {
2837                         print <<END;
2838                                 <td align='center'>
2839                                         <font color="$Header::colourorange">$Lang::tr{'orange'}</font>
2840                                         ($Lang::tr{'fwdfw pol allow'})
2841                                 </td>
2842 END
2843                 }
2844
2845                 if (&Header::blue_used()) {
2846                         print <<END;
2847                                 <td align='center'>
2848                                         <font color="$Header::colourblue">$Lang::tr{'blue'}</font>
2849                                         ($Lang::tr{'fwdfw pol allow'})
2850                                 </td>
2851 END
2852                 }
2853
2854                 print"</tr>";
2855
2856                 # ORANGE
2857                 if (&Header::orange_used()) {
2858                         print <<END;
2859                                 <tr>
2860                                         <td align='center' width='20%'>
2861                                                 <font color="$Header::colourorange">$Lang::tr{'orange'}</font>
2862                                         </td>
2863                                         <td align='center'>
2864                                                 <font color="$Header::colourred">$Lang::tr{'red'}</font>
2865                                                 ($Lang::tr{'fwdfw pol allow'})
2866                                         </td>
2867                                         <td align='center'>
2868                                                 <font color="$Header::colourgreen">$Lang::tr{'green'}</font>
2869                                                 ($Lang::tr{'fwdfw pol block'})
2870                                         </td>
2871 END
2872
2873                         if (&Header::blue_used()) {
2874                                 print <<END;
2875                                         <td align='center'>
2876                                                 <font color="$Header::colourblue">$Lang::tr{'blue'}</font>
2877                                                 ($Lang::tr{'fwdfw pol block'})
2878                                         </td>
2879 END
2880                         }
2881
2882                         print"</tr>";
2883                 }
2884
2885                 if (&Header::blue_used()) {
2886                         print <<END;
2887                                 <tr>
2888                                         <td align='center'>
2889                                                 <font color="$Header::colourblue">$Lang::tr{'blue'}</font>
2890                                         </td>
2891                                         <td align='center'>
2892                                                 <font color="$Header::colourred">$Lang::tr{'red'}</font>
2893                                                 ($Lang::tr{'fwdfw pol allow'})
2894                                         </td>
2895 END
2896
2897                         if (&Header::orange_used()) {
2898                                 print <<END;
2899                                         <td align='center'>
2900                                                 <font color="$Header::colourorange">$Lang::tr{'orange'}</font>
2901                                                 ($Lang::tr{'fwdfw pol block'})
2902                                         </td>
2903 END
2904                         }
2905
2906                         print <<END;
2907                                         <td align='center'>
2908                                                 <font color="$Header::colourgreen">$Lang::tr{'green'}</font>
2909                                                 ($Lang::tr{'fwdfw pol block'})
2910                                         </td>
2911                                 </tr>
2912 END
2913                 }
2914
2915                 print <<END;
2916                                         </table>
2917                                 </td>
2918                         </tr>
2919 END
2920
2921                 $message = $Lang::tr{'fwdfw pol allow'};
2922
2923         } elsif ($config eq '/var/ipfire/firewall/outgoing' && ($fwdfwsettings{'POLICY1'} ne 'MODE1')) {
2924                 $message = $Lang::tr{'fwdfw pol allow'};
2925                 $colour = "bgcolor='green'";
2926         } else {
2927                 $message = $Lang::tr{'fwdfw pol block'};
2928                 $colour = "bgcolor='darkred'";
2929         }
2930
2931         if ($message) {
2932                 print <<END;
2933                         <tr>
2934                                 <td $colour align='center' colspan='13'>
2935                                         <font color='#FFFFFF'>$Lang::tr{'policy'}: $message</font>
2936                                 </td>
2937                         </tr>
2938 END
2939         }
2940
2941         print "</table>";
2942         print "<br>";
2943
2944         &Header::closebox();
2945 }
2946
2947 &Header::closebigbox();
2948 &Header::closepage();