";
-
+ print "
END
}
- &Header::closebox();
+ &Header::closebox();
+}
+sub pos_up
+{
+ my %uphash=();
+ my %tmp=();
+ &General::readhasharray($fwdfwsettings{'config'}, \%uphash);
+ foreach my $key (sort keys %uphash){
+ if ($key eq $fwdfwsettings{'key'}) {
+ my $last = $key -1;
+ if (exists $uphash{$last}){
+ #save rule last
+ foreach my $y (0 .. $#{$uphash{$last}}) {
+ $tmp{0}[$y] = $uphash{$last}[$y];
+ }
+ #copy active rule to last
+ foreach my $i (0 .. $#{$uphash{$last}}) {
+ $uphash{$last}[$i] = $uphash{$key}[$i];
+ }
+ #copy saved rule to actual position
+ foreach my $x (0 .. $#{$tmp{0}}) {
+ $uphash{$key}[$x] = $tmp{0}[$x];
+ }
+ }
+ }
+ }
+ &General::writehasharray($fwdfwsettings{'config'}, \%uphash);
+ &rules;
+}
+sub pos_down
+{
+ my %downhash=();
+ my %tmp=();
+ &General::readhasharray($fwdfwsettings{'config'}, \%downhash);
+ foreach my $key (sort keys %downhash){
+ if ($key eq $fwdfwsettings{'key'}) {
+ my $next = $key + 1;
+ if (exists $downhash{$next}){
+ #save rule next
+ foreach my $y (0 .. $#{$downhash{$next}}) {
+ $tmp{0}[$y] = $downhash{$next}[$y];
+ }
+ #copy active rule to next
+ foreach my $i (0 .. $#{$downhash{$next}}) {
+ $downhash{$next}[$i] = $downhash{$key}[$i];
+ }
+ #copy saved rule to actual position
+ foreach my $x (0 .. $#{$tmp{0}}) {
+ $downhash{$key}[$x] = $tmp{0}[$x];
+ }
+ }
+ }
+ }
+ &General::writehasharray($fwdfwsettings{'config'}, \%downhash);
+ &rules;
+}
+sub rules
+{
+ if (!-f "${General::swroot}/forward/reread"){
+ system("touch ${General::swroot}/forward/reread");
+ system("touch ${General::swroot}/fwhosts/reread");
+ }
+}
+sub reread_rules
+{
+ system("/usr/local/bin/forwardfwctrl");
+ if ( -f "${General::swroot}/forward/reread"){
+ system("rm ${General::swroot}/forward/reread");
+ system("rm ${General::swroot}/fwhosts/reread");
+ }
}
sub saverule
{
@@ -1644,66 +2024,95 @@ sub saverule
my $config=shift;
&General::readhasharray("$config", $hash);
if (!$errormessage){
- #check if we change a DMZ to an outgoing
- if( ($fwdfwsettings{'oldgrp1b'} eq 'ORANGE' || $fwdfwsettings{'oldorange'} eq 'on') && $fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'IPFire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
- &changerule($configdmz);
+ #check if we change a NAT to a FORWARD/DMZ
+ if(($fwdfwsettings{'oldruletype'} eq 'NAT_SOURCE' || $fwdfwsettings{'oldruletype'} eq 'NAT_DESTINATION') && $fwdfwsettings{'chain'} eq 'FORWARDFW'){
+ &changerule($confignat);
#print"1";
}
- #check if we change a DMZ to an external access
- elsif( $fwdfwsettings{'oldgrp1b'} eq 'ORANGE' && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ORANGE' && $fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
- &changerule($configdmz);
+ #check if we change a NAT to a INPUT (external access)
+ elsif(($fwdfwsettings{'oldruletype'} eq 'NAT_SOURCE' || $fwdfwsettings{'oldruletype'} eq 'NAT_DESTINATION') && $fwdfwsettings{'chain'} eq 'INPUTFW'){
+ &changerule($confignat);
#print"2";
}
- #check if we change an external access rule to a outgoing
- elsif( $fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'IPFire' && $fwdfwsettings{'oldgrp1b'} ne 'IPFire' && $fwdfwsettings{'grp2'} ne 'ipfire' && $fwdfwsettings{'oldgrp2a'} eq 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
- &changerule($configinput);
+ #check if we change a NAT to a OUTGOING
+ elsif(($fwdfwsettings{'oldruletype'} eq 'NAT_SOURCE' || $fwdfwsettings{'oldruletype'} eq 'NAT_DESTINATION') && $fwdfwsettings{'chain'} eq 'OUTGOINGFW'){
+ &changerule($confignat);
#print"3";
}
- #check if we change an external access rule to a DMZ
- elsif( $fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'ORANGE' && $fwdfwsettings{'grp2'} ne 'ipfire' && $fwdfwsettings{'oldgrp2a'} eq 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
- &changerule($configinput);
+ ################################################################
+ #check if we change a DMZ to a NAT
+ elsif($fwdfwsettings{'oldruletype'} eq 'DMZ' && ($fwdfwsettings{'chain'} eq 'NAT_SOURCE' || $fwdfwsettings{'chain'} eq 'NAT_DESTINATION')){
+ &changerule($configdmz);
#print"4";
}
- #check if we change an outgoing rule to a external access
- if( $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'IPFire' && $fwdfwsettings{'oldgrp1b'} eq 'IPFire' && $fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{'oldgrp2a'} ne 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
- &changerule($configoutgoing);
+ #check if we change a DMZ to an OUTGOING
+ elsif($fwdfwsettings{'oldruletype'} eq 'DMZ' && $fwdfwsettings{'chain'} eq 'OUTGOINGFW' ){
+ &changerule($configdmz);
#print"5";
}
- #check if we change an outgoing rule to a DMZ
- if( ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'ORANGE' || $checkorange eq 'on') && $fwdfwsettings{'oldgrp1b'} eq 'IPFire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
- &changerule($configoutgoing);
+ #check if we change a DMZ to an INPUT
+ elsif($fwdfwsettings{'oldruletype'} eq 'DMZ' && $fwdfwsettings{'chain'} eq 'INPUTFW' ){
+ &changerule($configdmz);
#print"6";
}
- #check if we change an forward rule to an external access
- elsif( $fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{'oldgrp2a'} ne 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
- &changerule($configfwdfw);
+ #check if we change a DMZ to a FORWARD/DMZ
+ elsif($fwdfwsettings{'oldruletype'} eq 'DMZ' && $fwdfwsettings{'chain'} eq 'FORWARDFW' && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ORANGE'){
+ &changerule($configdmz);
#print"7";
}
- #check if we change an forward rule to an DMZ
- if( ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'ORANGE' || $checkorange eq 'on') && ($fwdfwsettings{'oldgrp1b'} ne 'ORANGE' && $fwdfwsettings{'oldorange'} ne 'on') && $fwdfwsettings{'updatefwrule'} eq 'on'){
- &changerule($configfwdfw);
+ ################################################################
+ #check if we change an INPUT rule to a NAT
+ elsif($fwdfwsettings{'oldruletype'} eq 'INPUTFW' && ($fwdfwsettings{'chain'} eq 'NAT_SOURCE' || $fwdfwsettings{'chain'} eq 'NAT_DESTINATION')){
+ &changerule($configinput);
#print"8";
}
- #check if we change an forward rule to an outgoing
- elsif( $fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'IPFire' && $fwdfwsettings{'oldgrp1b'} ne 'IPFire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
- &changerule($configfwdfw);
+ #check if we change an INPUT rule to a OUTGOING
+ elsif($fwdfwsettings{'oldruletype'} eq 'INPUTFW' && $fwdfwsettings{'chain'} eq 'OUTGOINGFW' ){
+ &changerule($configinput);
#print"9";
}
- #check if we change a DMZ to a forward
- elsif( ($fwdfwsettings{'oldgrp1b'} eq 'ORANGE' || $fwdfwsettings{'oldorange'} eq 'on') && ($fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ORANGE' && $checkorange ne 'on') && $fwdfwsettings{'updatefwrule'} eq 'on'){
- &changerule($configdmz);
+ #check if we change an INPUT rule to a FORWARD/DMZ
+ elsif($fwdfwsettings{'oldruletype'} eq 'INPUTFW' && $fwdfwsettings{'chain'} eq 'FORWARDFW' ){
+ &changerule($configinput);
#print"10";
}
- #check if we change an external access rule to a forward
- elsif( $fwdfwsettings{'grp2'} ne 'ipfire' && $fwdfwsettings{'oldgrp2a'} eq 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
- &changerule($configinput);
+ ################################################################
+ #check if we change an OUTGOING rule to an INPUT
+ elsif($fwdfwsettings{'oldruletype'} eq 'OUTGOINGFW' && $fwdfwsettings{'chain'} eq 'INPUTFW' ){
+ &changerule($configoutgoing);
#print"11";
}
- #check if we change an outgoing rule to a forward
- elsif( $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'IPFire' && $fwdfwsettings{'oldgrp1b'} eq 'IPFire' && $fwdfwsettings{'grp2'} ne 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ #check if we change an OUTGOING rule to a FORWARD/DMZ
+ elsif($fwdfwsettings{'oldruletype'} eq 'OUTGOINGFW' && $fwdfwsettings{'chain'} eq 'FORWARDFW' ){
&changerule($configoutgoing);
#print"12";
}
+ #check if we change an OUTGOING rule to a NAT
+ elsif($fwdfwsettings{'oldruletype'} eq 'OUTGOINGFW' && ($fwdfwsettings{'chain'} eq 'NAT_SOURCE' || $fwdfwsettings{'chain'} eq 'NAT_DESTINATION')){
+ &changerule($configoutgoing);
+ #print"13";
+ }
+ ################################################################
+ #check if we change a FORWARD rule to an INPUT
+ elsif($fwdfwsettings{'oldruletype'} eq 'FORWARDFW' && $fwdfwsettings{'chain'} eq 'INPUTFW'){
+ &changerule($configfwdfw);
+ #print"14";
+ }
+ #check if we change a FORWARD rule to an DMZ
+ elsif($fwdfwsettings{'oldruletype'} eq 'FORWARDFW' && $fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'ORANGE' || $checkorange eq 'on'){
+ &changerule($configfwdfw);
+ #print"15";
+ }
+ #check if we change a FORWARD rule to an OUTGOING
+ elsif($fwdfwsettings{'oldruletype'} eq 'FORWARDFW' && $fwdfwsettings{'chain'} eq 'OUTGOINGFW'){
+ &changerule($configfwdfw);
+ #print"16";
+ }
+ #check if we change a FORWARD rule to an NAT
+ elsif($fwdfwsettings{'oldruletype'} eq 'FORWARDFW' && ($fwdfwsettings{'chain'} eq 'NAT_SOURCE' || $fwdfwsettings{'chain'} eq 'NAT_DESTINATION')){
+ &changerule($configfwdfw);
+ #print"17";
+ }
if ($fwdfwsettings{'updatefwrule'} ne 'on'){
my $key = &General::findhasharraykey ($hash);
$$hash{$key}[0] = $fwdfwsettings{'RULE_ACTION'};
@@ -1734,6 +2143,12 @@ sub saverule
$$hash{$key}[25] = $fwdfwsettings{'TIME_SUN'};
$$hash{$key}[26] = $fwdfwsettings{'TIME_FROM'};
$$hash{$key}[27] = $fwdfwsettings{'TIME_TO'};
+ if($fwdfwsettings{'USE_NAT'} eq 'ON'){
+ $$hash{$key}[28] = $fwdfwsettings{'USE_NAT'};
+ $$hash{$key}[29] = $fwdfwsettings{$fwdfwsettings{'nat'}};
+ $$hash{$key}[30] = $fwdfwsettings{'dnatport'};
+ $$hash{$key}[31] = $fwdfwsettings{'nat'};
+ }
&General::writehasharray("$config", $hash);
}else{
foreach my $key (sort {$a <=> $b} keys %$hash){
@@ -1766,6 +2181,12 @@ sub saverule
$$hash{$key}[25] = $fwdfwsettings{'TIME_SUN'};
$$hash{$key}[26] = $fwdfwsettings{'TIME_FROM'};
$$hash{$key}[27] = $fwdfwsettings{'TIME_TO'};
+ if($fwdfwsettings{'USE_NAT'} eq 'ON'){
+ $$hash{$key}[28] = $fwdfwsettings{'USE_NAT'};
+ $$hash{$key}[29] = $fwdfwsettings{$fwdfwsettings{'nat'}};
+ $$hash{$key}[30] = $fwdfwsettings{'dnatport'};
+ $$hash{$key}[31] = $fwdfwsettings{'nat'};
+ }
last;
}
}
@@ -1828,35 +2249,6 @@ sub saverule
}
}
}
-sub error
-{
- if ($errormessage) {
- &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
- print "$errormessage\n";
- print " \n";
- &Header::closebox();
- print"";
- }
-}
-sub hint
-{
- if ($hint) {
- &Header::openbox('100%', 'left', $Lang::tr{'fwhost hint'});
- print "$hint\n";
- print " \n";
- &Header::closebox();
- print"";
- }
-}
-sub get_name
-{
- my $val=shift;
- &General::setup_default_networks(\%defaultNetworks);
- foreach my $network (sort keys %defaultNetworks)
- {
- return "$network" if ($val eq $defaultNetworks{$network}{'NAME'});
- }
-}
sub validremark
{
# Checks a hostname against RFC1035
@@ -1877,82 +2269,14 @@ sub validremark
return 0;}
return 1;
}
-sub getsrcport
-{
- my %hash=%{(shift)};
- my $key=shift;
- if($hash{$key}[7] eq 'ON' && $hash{$key}[8] ne '' && $hash{$key}[10]){
- $hash{$key}[10]=~ s/\|/,/g;
- print": $hash{$key}[10]";
- }elsif($hash{$key}[7] eq 'ON' && $hash{$key}[8] eq 'ICMP'){
- print": $hash{$key}[9] ";
- }
-}
-sub gettgtport
-{
- my %hash=%{(shift)};
- my $key=shift;
- my $service;
- my $prot;
- if($hash{$key}[11] eq 'ON' && $hash{$key}[12] ne 'ICMP'){
- if($hash{$key}[14] eq 'cust_srv'){
- &General::readhasharray("$configsrv", \%customservice);
- foreach my $i (sort keys %customservice){
- if($customservice{$i}[0] eq $hash{$key}[15]){
- $service = $customservice{$i}[0];
- }
- }
- }elsif($hash{$key}[14] eq 'cust_srvgrp'){
- $service=$hash{$key}[15];
- }elsif($hash{$key}[14] eq 'TGT_PORT'){
- $hash{$key}[15]=~ s/\|/,/g;
- $service=$hash{$key}[15];
- }
- if($service){
- print": $service";
- }
- }elsif($hash{$key}[11] eq 'ON' && $hash{$key}[12] eq 'ICMP'){
- print": $hash{$key}[13]";
- }
-}
-sub get_serviceports
-{
- my $type=shift;
- my $name=shift;
- &General::readhasharray("$configsrv", \%customservice);
- &General::readhasharray("$configsrvgrp", \%customservicegrp);
- my $protocols;
- my $tcp;
- my $udp;
- if($type eq 'service'){
- foreach my $key (sort { uc($customservice{$a}[0]) cmp uc($customservice{$b}[0]) } keys %customservice){
- if ($customservice{$key}[0] eq $name){
- $protocols=$customservice{$key}[2];
- }
- }
- }elsif($type eq 'group'){
- foreach my $key (sort { uc($customservicegrp{$a}[0]) cmp uc($customservicegrp{$b}[0]) } keys %customservicegrp){
- if ($customservicegrp{$key}[0] eq $name){
- foreach my $key1 (sort { uc($customservice{$a}[0]) cmp uc($customservice{$b}[0]) } keys %customservice){
- if ($customservice{$key1}[0] eq $customservicegrp{$key}[2]){
- if($customservice{$key1}[2] eq 'TCP'){$tcp='TCP';}else{$udp='UDP';}
- }
- }
- }
- }
- }
- if($tcp && $udp){$protocols="TCP,UDP";
- }elsif($tcp){$protocols.="TCP";
- }elsif($udp){$protocols.="UDP";}
- return $protocols;
-}
sub viewtablerule
{
&General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
- &viewtablenew(\%configdmzfw,$configdmz,$Lang::tr{'fwdfw rules'},"DMZ" );
+ &viewtablenew(\%confignatfw,$confignat,"$Lang::tr{'fwdfw rules'}","Portforward / SNAT" );
&viewtablenew(\%configfwdfw,$configfwdfw,"","Forward" );
- &viewtablenew(\%configinputfw,$configinput,"",$Lang::tr{'external access'} );
&viewtablenew(\%configoutgoingfw,$configoutgoing,"","Outgoing" );
+ &viewtablenew(\%configinputfw,$configinput,"",$Lang::tr{'fwdfw xt access'} );
+ &viewtablenew(\%configdmzfw,$configdmz,"","DMZ" );
}
sub viewtablenew
{
@@ -1974,7 +2298,7 @@ sub viewtablenew
my @tmpsrc=();
my $coloryellow='';
print"$title1 ";
- print"
";
+ print"
";
print"
#
$Lang::tr{'fwdfw source'}
Log
$Lang::tr{'fwdfw target'}
$Lang::tr{'protocol'}
$Lang::tr{'fwdfw time'}
$Lang::tr{'fwdfw action'}
";
foreach my $key (sort {$a <=> $b} keys %$hash){
$tdcolor='';
@@ -2012,8 +2336,6 @@ sub viewtablenew
$$hash{$key}[2]='';
}
}
- #$$hash{$key}[3]='';
- #$$hash{$key}[5]='';
}
$$hash{'ACTIVE'}=$$hash{$key}[2];
$count++;
@@ -2055,6 +2377,13 @@ END
}
$tdcolor='';
&getsrcport(\%$hash,$key);
+ #Is this a SNAT rule?
+ if ($$hash{$key}[31] eq 'snat'){
+ print" SNAT -> $$hash{$key}[29]";
+ if ($$hash{$key}[30] ne ''){
+ print": $$hash{$key}[30]";
+ }
+ }
if ($$hash{$key}[17] eq 'ON'){
$log="/images/on.gif";
}else{
@@ -2073,6 +2402,15 @@ END
print<
END
+ #Is this a DNAT rule?
+ if ($$hash{$key}[31] eq 'dnat'){
+ print "IPFire ($$hash{$key}[29])";
+ if($$hash{$key}[30] ne ''){
+ $$hash{$key}[30]=~ tr/|/,/;
+ print": $$hash{$key}[30]";
+ }
+ print" DNAT->";
+ }
if ($$hash{$key}[5] eq 'std_net_tgt'){
print &get_name($$hash{$key}[6]);
}else{
@@ -2084,17 +2422,19 @@ END
#Get Protocol
my $prot;
if ($$hash{$key}[12]){ #target prot if manual
- $prot=$$hash{$key}[12];
+ push (@protocols,$$hash{$key}[12]);
}elsif($$hash{$key}[8]){ #source prot if manual
- $prot=$$hash{$key}[8];
- }elsif($$hash{$key}[14] eq 'cust_srv'){
- $prot=&get_serviceports("service",$$hash{$key}[15]);
+ push (@protocols,$$hash{$key}[8]);
+ }elsif($$hash{$key}[14] eq 'cust_srv'){
+ &get_serviceports("service",$$hash{$key}[15]);
}elsif($$hash{$key}[14] eq 'cust_srvgrp'){
- $prot=&get_serviceports("group",$$hash{$key}[15]);
+ &get_serviceports("group",$$hash{$key}[15]);
}else{
- $prot=$Lang::tr{'all'};
+ push (@protocols,$Lang::tr{'all'});
}
- print"
$prot
";
+ my $protz=join(",",@protocols);
+ print"
$protz
";
+ @protocols=();
if ($$hash{$key}[18] eq 'ON'){
my @days=();
if($$hash{$key}[19] ne ''){push (@days,$Lang::tr{'fwdfw wd_mon'});}
@@ -2106,7 +2446,7 @@ END
if($$hash{$key}[25] ne ''){push (@days,$Lang::tr{'fwdfw wd_sun'});}
my $weekdays=join(",",@days);
if (@days){
- print"