Merge remote-tracking branch 'amarx/firewall-dnat' into next

Conflicts:
	config/firewall/rules.pl

diff --combined config/firewall/rules.pl
index aa8870cdc488a47b123d0d794689573ec2f5b2d4,887c0526575ed9713a9f399ad623cfcee611ec8d..e0f69554e847d7949fc28b50e657d1cf6101ed9e
--- 1/config/firewall/rules.pl
--- 2/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@@ -291,26 -291,28 +291,30 @@@ sub buildrules 
  
                        foreach my $src (@sources) {
                                # Skip invalid source.
 -                              next unless (@$src[0]);
 +                              next unless (defined $src);
 +                              next unless ($src);
  
                                # Sanitize source.
-                               my $source = $src;
+                               my $source = @$src[0];
                                if ($source ~~ @ANY_ADDRESSES) {
                                        $source = "";
                                }
  
+                               my $source_intf = @$src[1];
+ 
                                foreach my $dst (@destinations) {
                                        # Skip invalid rules.
 -                                      next if (!@$dst[0] || (@$dst[0] eq "none"));
 +                                      next unless (defined $dst);
 +                                      next if (!$dst || ($dst eq "none"));
  
                                        # Sanitize destination.
-                                       my $destination = $dst;
+                                       my $destination = @$dst[0];
                                        if ($destination ~~ @ANY_ADDRESSES) {
                                                $destination = "";
                                        }
  
+                                       my $destination_intf = @$dst[1];
+ 
                                        # Array with iptables arguments.
                                        my @options = ();
  
@@@ -327,12 -329,20 +331,20 @@@
                                                push(@source_options, ("-s", $source));
                                        }
  
+                                       if ($source_intf) {
+                                               push(@source_options, ("-i", $source_intf));
+                                       }
+ 
                                        # Prepare destination options.
                                        my @destination_options = ();
                                        if ($destination) {
                                                push(@destination_options, ("-d", $destination));
                                        }
  
+                                       if ($destination_intf) {
+                                               push(@destination_options, ("-o", $destination_intf));
+                                       }
+ 
                                        # Add time constraint options.
                                        push(@options, @time_options);
  
@@@ -366,7 -376,7 +378,7 @@@
                                                        # Make port-forwardings useable from the internal networks.
                                                        my @internal_addresses = &fwlib::get_internal_firewall_ip_addresses(1);
                                                        unless ($nat_address ~~ @internal_addresses) {
-                                                               &add_dnat_mangle_rules($nat_address, @nat_options);
+                                                               &add_dnat_mangle_rules($nat_address, $source_intf, @nat_options);
                                                        }
  
                                                        push(@nat_options, @source_options);
@@@ -683,6 -693,7 +695,7 @@@ sub get_dnat_target_port 
  
  sub add_dnat_mangle_rules {
        my $nat_address = shift;
+       my $interface = shift;
        my @options = @_;
  
        my $mark = 0;
@@@ -693,6 -704,8 +706,8 @@@
                next unless (exists $defaultNetworks{$zone . "_NETADDRESS"});
                next unless (exists $defaultNetworks{$zone . "_NETMASK"});
  
+               next if ($interface && $interface ne $defaultNetworks{$zone . "_DEV"});
+ 
                my @mangle_options = @options;
  
                my $netaddress = $defaultNetworks{$zone . "_NETADDRESS"};

diff --combined html/cgi-bin/fwhosts.cgi
index 1f96336a6b4d9b964b80572504aeacf5089c5cf3,ce2f7f558adaa9a9f208722c60aa6479b3bee9d7..ddf1e39d6acca4c1bcfd37ae08ed80400a5d3360
--- 1/html/cgi-bin/fwhosts.cgi
--- 2/html/cgi-bin/fwhosts.cgi
+++ b/html/cgi-bin/fwhosts.cgi
@@@ -292,25 -292,25 +292,25 @@@ if ($fwhostsettings{'ACTION'} eq 'saven
                }
                if($fwhostsettings{'error'} ne 'on'){
                        #check if we use one of ipfire's networks (green,orange,blue)
 -                      if (($ownnet{'GREEN_NETADDRESS'}        ne '' && $ownnet{'GREEN_NETADDRESS'}    ne '0.0.0.0') && &General::IpInSubnet($fwhostsettings{'IP'},$ownnet{'GREEN_NETADDRESS'},$ownnet{'GREEN_NETMASK'}))
 +                      if (($ownnet{'GREEN_NETADDRESS'}        ne '' && $ownnet{'GREEN_NETADDRESS'}    ne '0.0.0.0') && ($fwhostsettings{'IP'} eq $ownnet{'GREEN_NETADDRESS'} && $fwhostsettings{'SUBNET'} eq $ownnet{'GREEN_NETMASK'}))
                        { 
                                $errormessage=$errormessage.$Lang::tr{'ccd err green'}."<br>";
                                $fwhostsettings{'HOSTNAME'} = $fwhostsettings{'orgname'};
                                if ($fwhostsettings{'update'} eq 'on'){$fwhostsettings{'ACTION'}='editnet';}
                        }
 -                      if (($ownnet{'ORANGE_NETADDRESS'}       ne '' && $ownnet{'ORANGE_NETADDRESS'}   ne '0.0.0.0') && &General::IpInSubnet($fwhostsettings{'IP'},$ownnet{'ORANGE_NETADDRESS'},$ownnet{'ORANGE_NETMASK'}))
 +                      if (($ownnet{'ORANGE_NETADDRESS'}       ne '' && $ownnet{'ORANGE_NETADDRESS'}   ne '0.0.0.0') && ($fwhostsettings{'IP'} eq $ownnet{'ORANGE_NETADDRESS'} && $fwhostsettings{'SUBNET'} eq $ownnet{'ORANGE_NETMASK'}))
                        { 
                                $errormessage=$errormessage.$Lang::tr{'ccd err orange'}."<br>";
                                $fwhostsettings{'HOSTNAME'} = $fwhostsettings{'orgname'};
                                if ($fwhostsettings{'update'} eq 'on'){$fwhostsettings{'ACTION'}='editnet';}
                        }
 -                      if (($ownnet{'BLUE_NETADDRESS'}         ne '' && $ownnet{'BLUE_NETADDRESS'}     ne '0.0.0.0') && &General::IpInSubnet($fwhostsettings{'IP'},$ownnet{'BLUE_NETADDRESS'},$ownnet{'BLUE_NETMASK'}))
 +                      if (($ownnet{'BLUE_NETADDRESS'}         ne '' && $ownnet{'BLUE_NETADDRESS'}     ne '0.0.0.0') && ($fwhostsettings{'IP'} eq $ownnet{'BLUE_NETADDRESS'} && $fwhostsettings{'SUBNET'} eq $ownnet{'BLUE_NETMASK'}))
                        { 
                                $errormessage=$errormessage.$Lang::tr{'ccd err blue'}."<br>";
                                $fwhostsettings{'HOSTNAME'} = $fwhostsettings{'orgname'};
                                if ($fwhostsettings{'update'} eq 'on'){$fwhostsettings{'ACTION'}='editnet';}
                        }
 -                      if (($ownnet{'RED_NETADDRESS'}  ne '' && $ownnet{'RED_NETADDRESS'}              ne '0.0.0.0') && &General::IpInSubnet($fwhostsettings{'IP'},$ownnet{'RED_NETADDRESS'},$ownnet{'RED_NETMASK'}))
 +                      if (($ownnet{'RED_NETADDRESS'}  ne '' && $ownnet{'RED_NETADDRESS'}              ne '0.0.0.0') && ($fwhostsettings{'IP'} eq $ownnet{'RED_NETADDRESS'} && $fwhostsettings{'SUBNET'} eq $ownnet{'RED_NETMASK'}))
                        { 
                                $errormessage=$errormessage.$Lang::tr{'ccd err red'}."<br>";
                                $fwhostsettings{'HOSTNAME'} = $fwhostsettings{'orgname'};
@@@ -1644,7 -1644,10 +1644,10 @@@ sub getcolo
                        $tdcolor="<font style='color: $Header::colourblue;'>$c</font>";
                        return $tdcolor;
                }
- 
+               if ("$sip/$scidr" eq "0.0.0.0/0"){
+                       $tdcolor="<font style='color: $Header::colourred;'>$c</font>";
+                       return $tdcolor;
+               }
                #Check if IP is part of OpenVPN N2N subnet
                foreach my $key (sort keys %ccdhost){
                        if ($ccdhost{$key}[3] eq 'net'){
@@@ -2501,6 -2504,9 +2504,9 @@@ sub getipforgrou
                        &General::readhash("${General::swroot}/vpn/settings",\%hash);
                        return $hash{'RW_NET'};
                }
+               if ($name eq 'RED'){
+                       return "0.0.0.0/0";
+               }
        }
  }
  sub decrease