From: Alexander Marx Date: Fri, 28 Jun 2013 07:36:31 +0000 (+0200) Subject: Forward Firewall: Design changes X-Git-Url: http://git.ipfire.org/?p=people%2Fteissler%2Fipfire-2.x.git;a=commitdiff_plain;h=a0fb1099efded1fe13a7e7fb51a97097776a06a8 Forward Firewall: Design changes 1) source has a new option "firewall" with dropdown for interfaces 2) source default networks->deleted IPFire, all ip's now in brackets 3) deleted warning message in Target that a mac is not usable 4) changes for "apply" button 5) in ruletable the protocol is now right beneath the ruletype column 6) changed target dropdown "INTERNET" to "RED" 7) renamed OpenVPN N-2N to OpenVPN Net-to-Net 8) set missing default firewall options 9) little changes on the en and de lang files --- diff --git a/config/forwardfw/rules.pl b/config/forwardfw/rules.pl index 7184c0460..f3e1217c1 100755 --- a/config/forwardfw/rules.pl +++ b/config/forwardfw/rules.pl @@ -209,7 +209,7 @@ sub buildrules &get_address($customgrp{$grp}[3],$customgrp{$grp}[2],"tgt"); } } - }elsif($$hash{$key}[5] eq 'ipfire'){ + }elsif($$hash{$key}[5] eq 'ipfire' ){ if($$hash{$key}[6] eq 'GREEN'){ $targethash{$key}[0]=$defaultNetworks{'GREEN_ADDRESS'}; } @@ -505,6 +505,30 @@ sub get_address $$hash{$key}[0]=&fwlib::get_ovpn_n2n_ip($base2,11); }elsif($base eq 'ipsec_net_src' || $base eq 'ipsec_net_tgt' || $base eq 'IpSec Network'){ $$hash{$key}[0]=&fwlib::get_ipsec_net_ip($base2,11); + }elsif($base eq 'ipfire_src' ){ + if($base2 eq 'GREEN'){ + $$hash{$key}[0]=$defaultNetworks{'GREEN_ADDRESS'}; + } + if($base2 eq 'BLUE'){ + $$hash{$key}[0]=$defaultNetworks{'BLUE_ADDRESS'}; + } + if($base2 eq 'ORANGE'){ + $$hash{$key}[0]=$defaultNetworks{'ORANGE_ADDRESS'}; + } + if($base2 eq 'ALL'){ + $$hash{$key}[0]='0.0.0.0/0'; + } + if($base2 eq 'RED' || $base2 eq 'RED1'){ + open(FILE, "/var/ipfire/red/local-ipaddress")or die "Couldn't open local-ipaddress"; + $$hash{$key}[0]= ; + close(FILE); + }else{ + foreach my $alias (sort keys %aliases){ + if ($base2 eq $alias){ + $$hash{$key}[0]=$aliases{$alias}{'IPT'}; + } + } + } } } sub get_prot diff --git a/html/cgi-bin/forwardfw.cgi b/html/cgi-bin/forwardfw.cgi index 0725e2542..716f58810 100755 --- a/html/cgi-bin/forwardfw.cgi +++ b/html/cgi-bin/forwardfw.cgi @@ -189,8 +189,8 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') if($fwdfwsettings{'nosave2'} ne 'on'){ &saverule(\%configinputfw,$configinput); } - }elsif($fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'IPFire' ){ - # OUTGOING PART + }elsif($fwdfwsettings{'grp1'} eq 'ipfire_src' ){ + # OUTGOING PART $fwdfwsettings{'config'}=$configoutgoing; $fwdfwsettings{'chain'} = 'OUTGOINGFW'; my $maxkey=&General::findhasharraykey(\%configoutgoingfw); @@ -378,7 +378,7 @@ sub addrule { &error; if (-f "${General::swroot}/forward/reread"){ - print "
    $Lang::tr{'fwhost reread'}

"; + print "
    $Lang::tr{'fwhost reread'}

"; } &Header::openbox('100%', 'left', $Lang::tr{'fwdfw menu'}); print "
"; @@ -979,6 +979,7 @@ sub gen_dd_block $checked{'TIME_SUN'}{$fwdfwsettings{'TIME_SUN'}} = 'CHECKED'; $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}} = 'selected'; $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}} = 'selected'; + $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected'; $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected'; print< @@ -989,13 +990,16 @@ END foreach my $network (sort keys %defaultNetworks) { next if($defaultNetworks{$network}{'NAME'} eq "RED" && $srctgt eq 'src'); - next if($defaultNetworks{$network}{'NAME'} eq "IPFire" && $srctgt eq 'tgt'); + next if($defaultNetworks{$network}{'NAME'} eq "IPFire"); print ""; + $ifaces{$defnet}='0.0.0.0' if ($defaultNetworks{$network}{'NAME'} eq 'RED'); + if ($ifaces{$defnet}){ + print ">$network ($ifaces{$defnet})"; + }else{ + print ">$network"; + } } print""; #custom networks @@ -1403,6 +1407,7 @@ sub newrule $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}} = 'selected'; $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}} = 'selected'; $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected'; + $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected'; #check if update and get values if($fwdfwsettings{'updatefwrule'} eq 'on' || $fwdfwsettings{'copyfwrule'} eq 'on' && !$errormessage){ &General::readhasharray("$config", \%hash); @@ -1462,6 +1467,7 @@ sub newrule $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}} = 'selected'; $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}} = 'selected'; $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected'; + $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected'; $selected{'dnat'}{$fwdfwsettings{$fwdfwsettings{'nat'}}} ='selected'; $selected{'snat'}{$fwdfwsettings{$fwdfwsettings{'nat'}}} ='selected'; } @@ -1510,9 +1516,24 @@ sub newrule #------SOURCE------------------------------------------------------- print< - $Lang::tr{'fwdfw sourceip'} -
- + $Lang::tr{'fwdfw sourceip'}Firewall +END + print"$Lang::tr{'fwdfw targetip'}Firewall + $Lang::tr{'fwdfw targetip'}Firewall END print"$Lang::tr{'fwdfw use srv'}$Lang::tr{'fwhost cust service'}"; - print"$Lang::tr{'remark'}:"; + print"$Lang::tr{'remark'}:"; + #print"$Lang::tr{'remark'}:"; if($fwdfwsettings{'updatefwrule'} eq 'on' || $fwdfwsettings{'copyfwrule'} eq 'on'){ print "$Lang::tr{'fwdfw rulepos'}: END + #TARGET &getcolor($$hash{$key}[5],$$hash{$key}[6],\%customhost); print< END #Is this a DNAT rule? if ($$hash{$key}[31] eq 'dnat' && $$hash{$key}[28] eq 'ON'){ - print "IPFire ($$hash{$key}[29])"; + print "Firewall ($$hash{$key}[29])"; if($$hash{$key}[30] ne ''){ $$hash{$key}[30]=~ tr/|/,/; print": $$hash{$key}[30]"; @@ -2225,25 +2268,10 @@ END print $$hash{$key}[6]; } $tdcolor=''; + #TARGETPORT &gettgtport(\%$hash,$key); print""; - #Get Protocol - my $prot; - if ($$hash{$key}[8] && $$hash{$key}[7] eq 'ON'){#source prot if manual - push (@protocols,$$hash{$key}[8]); - }elsif ($$hash{$key}[12]){ #target prot if manual - push (@protocols,$$hash{$key}[12]); - }elsif($$hash{$key}[14] eq 'cust_srv'){ - &get_serviceports("service",$$hash{$key}[15]); - }elsif($$hash{$key}[14] eq 'cust_srvgrp'){ - &get_serviceports("group",$$hash{$key}[15]); - }else{ - push (@protocols,$Lang::tr{'all'}); - } - my $protz=join(",",@protocols); - print"$protz"; - @protocols=(); - + #RULE ACTIVE if($$hash{$key}[2] eq 'ON'){ $gif="/images/on.gif" diff --git a/html/cgi-bin/fwhosts.cgi b/html/cgi-bin/fwhosts.cgi index 4aee444b9..ac0c04489 100755 --- a/html/cgi-bin/fwhosts.cgi +++ b/html/cgi-bin/fwhosts.cgi @@ -1061,7 +1061,7 @@ if($fwhostsettings{'ACTION'} eq '') sub showmenu { if (-f "${General::swroot}/forward/reread"){ - print "
    $Lang::tr{'fwhost reread'}

"; + print "
    $Lang::tr{'fwhost reread'}

"; } &Header::openbox('100%', 'left',$Lang::tr{'fwhost menu'}); print<$Lang::tr{'name'}: IP/MAC: $Lang::tr{'remark'}: -

$Lang::tr{'fwhost attention'}
$Lang::tr{'fwhost macwarn'}
END diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 0445dda97..b205c85bc 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -940,7 +940,7 @@ 'fwdfw pol title' => 'Standardverhalten der Firewall', 'fwdfw pol text' => 'Standardverhalten für Verbindungen aus den lokalen Netzwerken. Bei "Zugelassen" werden sämtliche Verbindungen zugelassen mit Ausnahme der konfigurierten Regeln. Mit "Blockiert" werden alle Verbindungsversuche blockiert, mit Ausnahme erstellten Regeln.', 'fwdfw pol text1' => 'Standardverhalten für Verbindungen von Firewall. Bei "Zugelassen" werden sämtliche Verbindungen zugelassen mit Ausnahme konfigurierten Regeln. Mit "Blockiert" werden alle Verbindungsversuche blockiert, mit Ausnahme der erstellten Regeln.Achtung! Mit diesen Einstellungen kann man sich aussperren. Normalerweise ist keine Änderung nötig.', -'fwdfw red' => 'INTERNET', +'fwdfw red' => 'ROT', 'fwdfw REJECT' => 'Verweigern (REJECT)', 'fwdfw reread' => 'Übernehmen', 'fwdfw rules' => 'Regeln', @@ -985,11 +985,11 @@ 'fwhost ccdnet' => 'OpenVPN Netzwerke:', 'fwhost change' => 'Ändern', 'fwhost changeremark' => 'Es wurde nur die Bemerkung angepasst.', -'fwhost cust addr' => 'Custom Adressen:', -'fwhost cust grp' => 'Custom Gruppen:', -'fwhost cust net' => 'Custom Netzwerke:', -'fwhost cust service' => 'Custom Dienste:', -'fwhost cust srvgrp' => 'Custom Dienstgruppen', +'fwhost cust addr' => 'Adressen:', +'fwhost cust grp' => 'Gruppen:', +'fwhost cust net' => 'Netzwerke:', +'fwhost cust service' => 'Dienste:', +'fwhost cust srvgrp' => 'Dienstgruppen', 'fwhost deleted' => 'Gelöscht', 'fwhost empty' => 'Keine Regeln definiert', 'fwhost err addr' => 'IP Adresse oder Subnetzmaske ungültig', @@ -1034,10 +1034,9 @@ 'fwhost newgrp' => 'Adressgruppierung', 'fwhost newservice' => 'Diensteinstellungen', 'fwhost newservicegrp' => 'Dienstgruppierung', -'fwhost macwarn' => 'MAC Adressen können nicht als Ziel definiert werden. Solche Adressen werden ignoriert.', 'fwhost menu' => 'Firewallgruppen', 'fwhost orange' => 'Orange', -'fwhost ovpn_n2n' => 'OpenVPN N-2-N', +'fwhost ovpn_n2n' => 'OpenVPN Net-to-Net', 'fwhost port' => 'Port(s)', 'fwhost prot' => 'Protokoll', 'fwhost reread' => 'Die Firewallregeln müssen neu eingelesen werden.', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 37c3b1257..49a3c1ef8 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -965,7 +965,7 @@ 'fwdfw pol title' => 'Firewall default behavior', 'fwdfw pol text' => 'Default behavior for connections from local networks. "Allowed" allows all connections from local networks except the defined rules. "Blocked" prohibits all connections except the defined ones. Also external access and connections to/from the demilitarized zone are configurable here.', 'fwdfw pol text1' => 'Default behavior for connections from IPFire. "Allowed" allows all connections from local networks except the defined rules. "Blocked" prohibits all connections except the defined ones. Attention! You can lock yourself out with these settings. Normally there is no need to change anything here.', -'fwdfw red' => 'INTERNET', +'fwdfw red' => 'RED', 'fwdfw REJECT' => 'REJECT', 'fwdfw reread' => 'Apply', 'fwdfw rules' => 'Rules', @@ -1010,11 +1010,11 @@ 'fwhost ccdnet' => 'OpenVPN networks:', 'fwhost change' => 'Modify', 'fwhost changeremark' => 'You just modified the remark', -'fwhost cust addr' => 'Custom addresses:', -'fwhost cust grp' => 'Custom groups:', -'fwhost cust net' => 'Custom networks:', -'fwhost cust service' => 'Custom services:', -'fwhost cust srvgrp' => 'Custom servicegroups', +'fwhost cust addr' => 'Addresses:', +'fwhost cust grp' => 'Groups:', +'fwhost cust net' => 'Networks:', +'fwhost cust service' => 'Services:', +'fwhost cust srvgrp' => 'Servicegroups', 'fwhost deleted' => 'Deleted', 'fwhost empty' => 'No rules defined', 'fwhost err addr' => 'Invalid IP address or subnet', @@ -1059,10 +1059,9 @@ 'fwhost newgrp' => 'Address grouping', 'fwhost newservice' => 'Service', 'fwhost newservicegrp' => 'Service grouping', -'fwhost macwarn' => 'MAC addresses can not be used as target. Such addresses will be ignored.', 'fwhost menu' => 'Firewall Groups', 'fwhost orange' => 'Orange', -'fwhost ovpn_n2n' => 'OpenVPN N-2-N', +'fwhost ovpn_n2n' => 'OpenVPN Net-to-Net', 'fwhost port' => 'Port(s)', 'fwhost prot' => 'Protocol', 'fwhost reread' => 'Firewall rules need to be updated.', diff --git a/lfs/configroot b/lfs/configroot index fcaa13f1d..4268f1502 100644 --- a/lfs/configroot +++ b/lfs/configroot @@ -123,6 +123,8 @@ $(TARGET) : echo "FWPOLICY2=DROP" >> $(CONFIG_ROOT)/optionsfw/settings echo "DROPPORTSCAN=on" >> $(CONFIG_ROOT)/optionsfw/settings echo "DROPOUTGOING=on" >> $(CONFIG_ROOT)/optionsfw/settings + echo "DROPSAMBA=on" >> $(CONFIG_ROOT)/optionsfw/settings + echo "DROPPROXY=on" >> $(CONFIG_ROOT)/optionsfw/settings echo "SHOWREMARK=on" >> $(CONFIG_ROOT)/optionsfw/settings echo "SHOWCOLORS=on" >> $(CONFIG_ROOT)/optionsfw/settings echo "SHOWTABLES=off" >> $(CONFIG_ROOT)/optionsfw/settings