Merge remote branch 'mainline/master' into inc

Conflicts:
	etc/inc/filter.inc
	etc/inc/system.inc

15 files changed, 539 insertions, 155 deletions

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index cfa9466..59e9128 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -454,6 +454,8 @@ function local_user_set_groups($user, $new_groups = NULL ) {
 	foreach ($cur_groups as $groupname) {
 		if (in_array($groupname,$new_groups))
 			continue;
+		if (!isset($config['system']['group'][$groupindex[$groupname]]))
+			continue;
 		$group = & $config['system']['group'][$groupindex[$groupname]];
 		if (is_array($group['member'])) {
 			$index = array_search($user['uid'], $group['member']);
diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index c9d8b92..211f33a 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -57,6 +57,9 @@ $GatewaysList = array();
 /* Used for the hostname dns resolver */
 $filterdns = "";
 
+/* Used for aliases and interface macros */
+$aliases = "";
+
 function flowtable_configure() {
 	global $config, $g;
 	return;
@@ -172,7 +175,7 @@ function filter_delete_states_for_down_gateways() {
 /* reload filter sync */
 function filter_configure_sync() {
 	global $config, $g, $after_filter_configure_run, $FilterIflist;
-	global $time_based_rules, $filterdns;
+	global $time_based_rules, $filterdns, $aliases;
 
 	/* Use config lock to not allow recursion and config changes during this run. */
 	$filterlck = lock('config');
@@ -1095,7 +1098,7 @@ function filter_nat_rules_generate_if($if, $src = "any", $srcport = "", $dst = "
 }
 
 function filter_nat_rules_generate() {
-	global $config, $g, $after_filter_configure_run, $FilterIflist, $GatewaysList;
+	global $config, $g, $after_filter_configure_run, $FilterIflist, $GatewaysList, $aliases;
 
 	$natrules = "nat-anchor \"natearly/*\"\n";
 
@@ -2689,17 +2692,15 @@ EOD;
 }
 
 function discover_pkg_rules($ruletype) {
-	global $config, $g;
+	global $config, $g, $aliases;
 
 	/* Bail if there is no pkg directory, or if the package files might be out of sync. */
 	if(!is_dir("/usr/local/pkg") || file_exists('/conf/needs_package_sync'))
 		return "";
 
 	$rules = "";
-	$files = split("\n", trim(`ls /usr/local/pkg/*.inc`));
+	$files = glob("/usr/local/pkg/*.inc");
 	foreach($files as $pkg_inc) {
-		if($pkg_inc == "ls: No match.")
-			continue;
 		update_filter_reload_status(sprintf(gettext("Checking for %1$s PF hooks in package %2$s"), $ruletype, $pkg_inc));
 		require_once($pkg_inc);
 		$pkg = basename($pkg_inc, ".inc");
@@ -2707,7 +2708,7 @@ function discover_pkg_rules($ruletype) {
 		if(function_exists($pkg_generate_rules)) {
 			update_filter_reload_status(sprintf(gettext("Processing early %1$s rules for package %2$s"), $ruletype, $pkg_inc));
 			$tmprules = $pkg_generate_rules("$ruletype");
-			file_put_contents("{$g['tmp_path']}/rules.test.packages", $tmprules);
+			file_put_contents("{$g['tmp_path']}/rules.test.packages", $aliases . $tmprules);
 			$status = mwexec("/sbin/pfctl -nf {$g['tmp_path']}/rules.test.packages");
 			if ($status <> 0) {
 				$errorrules = sprintf(gettext("There was an error while parsing the package filter rules for %s."), $pkg_inc) . "\n";
diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc
index 02d8711..03cbf6f 100644
--- a/etc/inc/gwlb.inc
+++ b/etc/inc/gwlb.inc
@@ -339,11 +339,7 @@ function return_gateways_array($disabled = false) {
 			}
 		}
 
-		/* retrieve a proper monitor IP? */
-		$ifcfg =& $config['interfaces'][$ifname];
-		if (is_ipaddr($ifcfg['monitorip']))
-			$gateway['monitor'] = $ifcfg['monitorip'];
-		else
+		if (is_ipaddr($gateway['gateway']))
 			$gateway['monitor'] = $gateway['gateway'];
 
 		$gateway['descr'] = "Interface {$friendly} Dynamic Gateway";
@@ -478,7 +474,7 @@ function lookup_gateway_monitor_ip_by_name($name) {
 		if(!is_ipaddr($gateway['monitor']))
 			return $gateway['gateway'];
 
-		return ($monitorip);
+		return $gateway['monitor'];
         }
 
         return (false);
@@ -501,9 +497,7 @@ function get_interface_gateway($interface, &$dynamic = false) {
         $gw = NULL;
 
         $gwcfg =& $config['interfaces'][$interface];
-        if (is_ipaddr($gwcfg['gateway']))
-                $gw = $gwcfg['gateway'];
-        else if (!empty($gwcfg['gateway']) && is_array($config['gateways']['gateway_item'])) {
+        if (!empty($gwcfg['gateway']) && is_array($config['gateways']['gateway_item'])) {
                	foreach($config['gateways']['gateway_item'] as $gateway) {
                         if ($gateway['name'] == $gwcfg['gateway']) {
                                 $gw = $gateway['gateway'];
diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc
index f4d224e..93ff163 100644
--- a/etc/inc/interfaces.inc
+++ b/etc/inc/interfaces.inc
@@ -2499,9 +2499,6 @@ function interface_configure($interface = "wan", $reloadall = false, $linkupeven
 			} else if (substr($realif, 0, 4) == "ovpn") {
 				/* XXX: Should be done anything?! */
 			}
-
-			if (is_ipaddr($wancfg['gateway']))
-				file_put_contents("{$g['tmp_path']}/{$realif}_router", $wancfg['gateway']);
 			break;
 	}
 
diff --git a/etc/inc/system.inc b/etc/inc/system.inc
index 422ae77..59ea4ea 100644
--- a/etc/inc/system.inc
+++ b/etc/inc/system.inc
@@ -355,7 +355,7 @@ function system_routing_configure($interface = "") {
 	}
 
 	if ($dont_add_route == false ) {
-		if (!empty($interface) && $inteface != $interafegw)
+		if (!empty($interface) && $interface != $interfacegw)
 			;
 		else if (($interfacegw <> "bgpd") && (is_ipaddr($gatewayip))) {
 			$action = "add";
@@ -364,14 +364,6 @@ function system_routing_configure($interface = "") {
 			}
 			log_error(sprintf(gettext("ROUTING: %1$s default route to %2$s"), $action, $gatewayip));
 			mwexec("/sbin/route {$action} default " . escapeshellarg($gatewayip));
-		} else if (is_ipaddr($config['interfaces']['wan']['gateway'])) {
-			/* Adding gateway for 1.2-style configs without the new
-		  	 * gateway setup configured.
-		  	 * Force WAN to be default gateway because that is the 1.2 behavior.
-			 */
-			log_error(gettext("WARNING: There is no default gateway in the configuration."));
-			$gatewayip = $config['interfaces']['wan']['gateway'];
-			mwexec("/sbin/route add default " . escapeshellarg($gatewayip), true);
 		}
 	}
 
@@ -380,18 +372,15 @@ function system_routing_configure($interface = "") {
 
 		foreach ($config['staticroutes']['route'] as $rtent) {
 			$gatewayip = "";
-			if (isset($gateways_arr[$rtent['gateway']])) {
-				$gatewayip = $gateways_arr[$rtent['gateway']]['gateway'];
-				$interfacegw = $gateways_arr[$rtent['gateway']]['interface'];
-				if ($interface == $gateways_arr[$rtent['gateway']]['friendlyiface'])
-					continue;
-			} else if (is_ipaddr($rtent['gateway'])) {
-				$gatewayip = $rtent['gateway'];
-			} else {
+			if (empty($gateways_arr[$rtent['gateway']])) {
 				log_error(sprintf(gettext("Static Routes: Gateway IP could not be found for %s"), $rtent['network']));
 				continue;
 			}
-
+			$gateway = $gateways_arr[$rtent['gateway']];
+			if ($interface == $gateway['friendlyiface'])
+				continue;
+			$gatewayip = $gateway['gateway'];
+			$interfacegw = $gateway['interface'];
 			$action = "add";
 			if (isset($route_arr[$rtent['network']]))
 				$action = "change";
diff --git a/etc/rc.newwanip b/etc/rc.newwanip
index 9d3d484..c018cb0 100755
--- a/etc/rc.newwanip
+++ b/etc/rc.newwanip
@@ -78,15 +78,15 @@ system_resolvconf_generate(true);
 file_put_contents("{$g['vardb_path']}/{$interface}_ip", $curwanip);
 file_put_contents("{$g['vardb_path']}/{$interface}_cacheip", $curwanip);
 
-if (is_ipaddr($oldip) && $curwanip == $oldip)
-	exit;
-
 /* reconfigure static routes (kernel may have deleted them) */
 system_routing_configure($interface);
 
 /* reconfigure our gateway monitor */
 setup_gateways_monitor();
 
+if (is_ipaddr($oldip) && $curwanip == $oldip)
+	exit;
+
 /* perform RFC 2136 DNS update */
 services_dnsupdate_process($interface);
 
diff --git a/usr/local/share/mobile-broadband-provider-info/serviceproviders.xml b/usr/local/share/mobile-broadband-provider-info/serviceproviders.xml
index 5429421..a7222c3 100644
--- a/usr/local/share/mobile-broadband-provider-info/serviceproviders.xml
+++ b/usr/local/share/mobile-broadband-provider-info/serviceproviders.xml
@@ -58,6 +58,27 @@ conceived.
 			</apn>
 		</gsm>
 	</provider>
+	<provider>
+		<name>du</name>
+		<gsm>
+			<network-id mcc="424" mnc="03"/>
+			<apn value="du"/>
+		</gsm>
+	</provider>
+</country>
+
+<!-- Afghanistan -->
+<country code="af">
+	<provider>
+		<name>AWCC</name>
+		<gsm>
+			<network-id mcc="412" mnc="01"/>
+			<apn value="internet">
+				<username>awcc</username>
+				<password>1111</password>
+			</apn>
+		</gsm>
+	</provider>
 </country>
 
 <!-- Albania -->
@@ -148,11 +169,17 @@ conceived.
 			<network-id mcc="722" mnc="320"/>
 			<network-id mcc="722" mnc="330"/>
 			<apn value="igprs.claro.com.ar">
+				<name>3G Internet</name>
 				<username>clarogprs</username>
 				<password>clarogprs999</password>
 				<dns>170.51.255.100</dns>
 				<dns>170.51.242.18</dns>
 			</apn>
+			<apn value="internet.ctimovil.com.ar">
+				<name>GPRS</name>
+				<username>clarogprs</username>
+				<password>clarogprs999</password>
+			</apn>
 		</gsm>
 	</provider>
 	<provider>
@@ -250,7 +277,7 @@ conceived.
 		</gsm>
 	</provider>
 	<provider>
-		<name>Three</name>
+		<name>Drei (3)</name>
 		<name xml:lang="de">Drei</name>
 		<gsm>
 			<network-id mcc="232" mnc="10"/>
@@ -274,6 +301,18 @@ conceived.
 		</gsm>
 	</provider>
 	<provider>
+		<name>Internode</name>
+		<gsm>
+			<!-- http://www.internode.on.net/residential/broadband/3g_wireless/nodemobile_data/faq/#What_is_the_APN -->
+			<apn value="internode">
+				<name>NodeMobile Data</name>
+			</apn>
+			<apn value="splns333a1">
+				<name>Old NodeMobile Data (before 2009-08-26)</name>
+			</apn>
+		</gsm>
+	</provider>
+	<provider>
 		<name>Optus</name>
 		<gsm>
 			<network-id mcc="505" mnc="02"/>
@@ -298,6 +337,11 @@ conceived.
 		<name>Telstra</name>
 		<gsm>
 			<network-id mcc="505" mnc="01"/>
+			<balance-check>
+				<dtmf>125111</dtmf>
+				<dtmf>1258888</dtmf>
+				<ussd-response>*100#</ussd-response>
+			</balance-check>
 			<apn value="telstra.wap">
 				<dns>139.130.4.4</dns>
 				<dns>203.50.2.71</dns>
@@ -369,6 +413,13 @@ conceived.
 			</apn>
 		</gsm>
 	</provider>
+	<provider>
+		<name>Crazy John's</name>
+		<gsm>
+			<network-id mcc="505" mnc="38"/>
+			<apn value="purtona.net"/>
+		</gsm>
+	</provider>
 </country>
 
 <!-- Azerbaijan -->
@@ -832,6 +883,24 @@ conceived.
 	</provider>
 </country>
 
+<!-- Burundi -->
+<country code="bi">
+	<provider>
+		<name>Leo/UCom</name>
+		<gsm>
+			<network-id mcc="642" mnc="03"/>
+			<apn value="ucnet"/>
+		</gsm>
+	</provider>
+	<provider>
+		<name>Tempo/Africell</name>
+		<gsm>
+			<network-id mcc="642" mnc="02"/>
+			<apn value="internet"/>
+		</gsm>
+	</provider>
+</country>
+
 <!-- Canada -->
 <country code="ca">
 	<provider>
@@ -954,7 +1023,24 @@ conceived.
 		<name>WIND Mobile</name>
 		<gsm>
 			<network-id mcc="302" mnc="490"/>
-			<apn value="internet.windmobile.ca"/>
+			<apn value="internet.windmobile.ca">
+				<name>Mobile Internet</name>
+			</apn>
+			<apn value="broadband.windmobile.ca">
+				<name>Mobile Broadband</name>
+			</apn>
+		</gsm>
+	</provider>
+	<provider>
+		<name>Mobilicity</name>
+		<gsm>
+			<network-id mcc="302" mnc="320"/>
+			<apn value="wap.davewireless.com">
+				<name>Mobile Web</name>
+			</apn>
+			<apn value="internet.davewireless.com">
+				<name>Mobile Broadband</name>
+			</apn>
 		</gsm>
 	</provider>
 </country>
@@ -1388,6 +1474,17 @@ conceived.
 		</gsm>
 	</provider>
 	<provider>
+		<name>Tchibo-Mobil</name>
+		<gsm>
+			<network-id mcc="262" mnc="07"/>
+			<network-id mcc="262" mnc="08"/>
+			<network-id mcc="262" mnc="11"/>
+			<apn value="webmobil1">
+				<name>Tagesflat / Monats-Flatrate L / Monats-Flatrate XL</name>
+			</apn>
+		</gsm>
+	</provider>
+	<provider>
 		<name>T-mobile (D1)</name>
 		<gsm>
 			<network-id mcc="262" mnc="01"/>
@@ -1428,7 +1525,10 @@ conceived.
 			<network-id mcc="262" mnc="07"/>
 			<network-id mcc="262" mnc="08"/>
 			<network-id mcc="262" mnc="11"/>
-			<apn value="pinternet.interkom.de"/>
+			<apn value="pinternet.interkomm.de">
+				<username>fonic</username>
+				<password>fonic</password>
+			</apn>
 		</gsm>
 	</provider>
 	<provider>
@@ -1537,6 +1637,32 @@ conceived.
 			</apn>
 		</gsm>
 	</provider>
+	<provider>
+		<name>Alice</name>
+		<gsm>
+			<network-id mcc="262" mnc="07"/>
+			<apn value="internet.partner1">
+				<name>Option Mobile</name>
+				<dns>193.189.244.225</dns>
+				<dns>193.189.244.206</dns>
+			</apn>
+		</gsm>
+	</provider>
+	<provider>
+		<name>1&amp;1</name>
+		<gsm>
+			<!-- Vodafone (D2) network -->
+			<network-id mcc="262" mnc="02"/>
+			<network-id mcc="262" mnc="04"/>
+			<network-id mcc="262" mnc="09"/>
+			<apn value="web.vodafone.de">
+				<name>Mobile Broadband</name>
+			</apn>
+			<apn value="mail.partner.de">
+				<name>Mobile Web</name>
+			</apn>
+		</gsm>
+	</provider>
 </country>
 
 <!-- Denmark -->
@@ -1546,13 +1672,16 @@ conceived.
 		<gsm>
 			<network-id mcc="238" mnc="06"/>
 			<apn value="bredband.tre.dk">
-				<name>Bredbånd</name>
+				<name>Bredbånd (standard)</name>
  			</apn>
 			<apn value="net.tre.dk">
 				<name>Bredbånd Premium Kontant</name>
 			</apn>
 			<apn value="data.tre.dk">
-				<name>3 (Mobil Abonnement)</name>
+				<name>3 (standard for mobilkunder; spærret for indgående trafik)</name>
+			</apn>
+			<apn value="static.tre.dk">
+				<name>3 (statisk IP)</name>
 			</apn>
 		</gsm>
 	</provider>
@@ -1584,6 +1713,16 @@ conceived.
 			</apn>
 		</gsm>
 	</provider>
+
+	<!-- http://www.cbb.dk/mobil/hjaelp/manuel-opsaetning-af-mms-og-gprs/ -->
+	<provider>
+		<name>CBB Mobil</name>
+		<gsm>
+			<network-id mcc="238" mnc="02"/>
+			<network-id mcc="238" mnc="77"/>
+			<apn value="internet"/>
+		</gsm>
+	</provider>
 	<provider>
 		<name>TDC</name>
 		<gsm>
@@ -1616,6 +1755,29 @@ conceived.
 			<apn value="internet.bibob.dk"/>
 		</gsm>
 	</provider>
+	<!-- Telmore - Same network as TDC -->
+	<provider>
+		<name>Telmore</name>
+		<gsm>
+			<network-id mcc="238" mnc="01"/>
+			<apn value="internet">
+				<dns>194.239.134.83</dns>
+				<dns>193.162.153.164</dns>
+			</apn>
+		</gsm>
+	</provider>
+	<provider>
+		<name>Unotel</name>
+		<gsm>
+			<apn value="internet"/>
+		</gsm>
+	</provider>
+	<provider>
+		<name>happiimobil</name>
+		<gsm>
+			<apn value="internet"/>
+		</gsm>
+	</provider>
 </country>
 
 <!-- Dominican Republic -->
@@ -2066,7 +2228,11 @@ conceived.
 			<network-id mcc="234" mnc="02"/>
 			<network-id mcc="234" mnc="10"/>
 			<network-id mcc="234" mnc="11"/>
-
+			<voicemail>901</voicemail>
+			<balance-check>
+				<ussd>*#10#</ussd>
+				<dtmf>4444</dtmf>
+			</balance-check>
 			<apn value="mobile.o2.co.uk">
 				<name>Contract</name>
 				<username>o2web</username>
@@ -2107,6 +2273,12 @@ conceived.
 		<name>T-Mobile</name>
 		<gsm>
 			<network-id mcc="234" mnc="30"/>
+			<voicemail>222</voicemail>
+			<balance-check>
+				<dtmf>150</dtmf>
+				<sms text="BA">150</sms>
+				<sms text="AL">150</sms>
+			</balance-check>
 			<apn value="general.t-mobile.uk">
 				<username>User</username>
 				<password>mms</password>
@@ -2130,6 +2302,11 @@ conceived.
 		<name>Vodafone</name>
 		<gsm>
 			<network-id mcc="234" mnc="15"/>
+			<voicemail>121</voicemail>
+			<balance-check>
+				<ussd>*#1345#</ussd>
+				<dtmf>2345</dtmf>
+			</balance-check>
 			<apn value="internet">
 				<name>Contract</name>
 				<username>web</username>
@@ -2166,7 +2343,10 @@ conceived.
 		<gsm>
 			<network-id mcc="234" mnc="33"/>
 			<network-id mcc="234" mnc="34"/>
-
+			<voicemail>123</voicemail>
+			<balance-check>
+				<dtmf>453</dtmf>
+			</balance-check>
 			<apn value="orangeinternet">
 				<name>Contract</name>
 				<username>orange</username>
@@ -2417,7 +2597,7 @@ conceived.
 		<name>T-Mobile</name>
 		<gsm>
 			<network-id mcc="219" mnc="01"/>
-			<apn value="web.htgpr">
+			<apn value="web.htgprs">
 				<dns>10.12.0.1</dns>
 			</apn>
 		</gsm>
@@ -2438,7 +2618,7 @@ conceived.
 				<password>38591</password>
 				<dns>195.29.159.15</dns>
 			</apn>
-			<apn value="3g.vipnet.hr">
+			<apn value="3g.vip.hr">
 				<name>3G</name>
 				<username>38591</username>
 				<password>38591</password>
@@ -2447,28 +2627,47 @@ conceived.
 			</apn>
 		</gsm>
 	</provider>
+	<provider>
+		<name>CARNet VIPNET</name>
+		<gsm>
+			<network-id mcc="219" mnc="10"/>
+			<apn value="carnet.vip.hr">
+				<username>AAIEDU</username>
+				<password></password>
+			</apn>
+		</gsm>
+	</provider>
+	<provider>
+		<name>CARNet Tele2</name>
+		<gsm>
+			<network-id mcc="219" mnc="02"/>
+			<apn value="carnet.tele2.hr">
+				<username>AAIEDU</username>
+				<password></password>
+			</apn>
+		</gsm>
+	</provider>
+	<provider>
+		<name>Tele2</name>
+		<gsm>
+			<network-id mcc="219" mnc="02"/>
+			<apn value="mobileinternet.tele2.hr">
+				<dns>212.247.156.66</dns>
+			</apn>
+		</gsm>
+	</provider>
 </country>
 
 <!-- Hungary -->
 <country code="hu">
 	<provider>
-		<name>Pannon</name>
+		<name>Telenor</name>
 		<gsm>
 			<network-id mcc="216" mnc="01"/>
-			<apn value="netx">
-				<name>átalánydíjas</name>
-				<dns>193.225.155.254</dns>
-				<dns>194.149.0.157</dns>
-			</apn>
 			<apn value="net">
-				<name>Normál</name>
-				<dns>193.225.153.17</dns>
-				<dns>195.56.172.113</dns>
-			</apn>
-			<apn value="snet">
-				<name>Tömörített</name>
-				<dns>193.225.153.17</dns>
-				<dns>194.149.0.157</dns>
+				<name>mobilinternet</name>
+				<dns>217.79.128.40</dns>
+				<dns>217.79.128.45</dns>
 			</apn>
 		</gsm>
 	</provider>
@@ -2518,6 +2717,15 @@ conceived.
 			</apn>
 		</gsm>
 	</provider>
+	<provider>
+		<name>Invitel</name>
+                <!-- MVNO operating on Telenor's network -->
+		<gsm>
+			<apn value="invitel.mobilnet">
+				<name>net.and.go</name>
+			</apn>
+		</gsm>
+	</provider>
 </country>
 
 <!-- Indonesia -->
@@ -2593,6 +2801,9 @@ conceived.
 		<name>O2</name>
 		<gsm>
 			<network-id mcc="272" mnc="02"/>
+			<balance-check>
+				<ussd>*#100#</ussd>
+			</balance-check>
 			<apn value="open.internet">
 				<name>Contract</name>
 				<username>gprs</username>
@@ -2669,7 +2880,8 @@ conceived.
 		<name>Orange</name>
 		<gsm>
 			<network-id mcc="425" mnc="01"/>
-			<apn value="orangeinternet">
+			<apn value="uinternet">
+				<name>3G Internet</name>
 				<dns>158.43.192.1</dns>
 				<dns>158.43.128.1</dns>
 			</apn>
@@ -2679,7 +2891,7 @@ conceived.
 		<name>Pelephone</name>
 		<gsm>
 			<network-id mcc="425" mnc="03"/>
-			<apn value="internet.pelephone.net.il ">
+			<apn value="internet.pelephone.net.il">
 				<name>3G</name>
 				<username>pcl@3g</username>
 				<password>pcl</password>
@@ -3054,6 +3266,26 @@ conceived.
 	</provider>
 </country>
 
+<!-- Iran -->
+<country code="ir">
+	<provider>
+		<name>همراه اول</name>
+		<gsm>
+			<network-id mcc="432" mnc="11"/>
+			<apn value="mcinet">
+			</apn>
+		</gsm>
+	</provider>
+	<provider>
+		<name>ایرانسل</name>
+		<gsm>
+			<network-id mcc="432" mnc="35"/>
+			<apn value="mtnirancell">
+			</apn>
+		</gsm>
+	</provider>
+</country>
+
 <!-- Iceland -->
 <country code="is">
 	<provider>
@@ -3143,10 +3375,10 @@ conceived.
 		<gsm>
 			<network-id mcc="222" mnc="99"/>
 			<apn value="tre.it">
-				<name>Standard</name>
+				<name>Ricaricabile</name>
 			</apn>
 			<apn value="datacard.tre.it">
-				<name>Tre.Dati</name>
+				<name>Abbonamento</name>
 			</apn>
 		</gsm>
 	</provider>
@@ -3168,6 +3400,15 @@ conceived.
 			<apn value="internet.postemobile.it"/>
 		</gsm>
 	</provider>
+	<provider>
+		<name>CoopVoce</name>
+		<gsm>
+			<network-id mcc="222" mnc="01"/>
+			<apn value="web.coopvoce.it">
+				<name>Internet Mobile</name>
+			</apn>
+		</gsm>
+	</provider>
 </country>
 
 <!-- Jersey -->
@@ -3352,11 +3593,22 @@ conceived.
 		</gsm>
 	</provider>
 	<provider>
-		<name>Econet</name>
+		<name>yu (Econet)</name>
 		<gsm>
+			<network-id mcc="639" mnc="05"/>
 			<apn value="internet.econet.co.ke"/>
 		</gsm>
 	</provider>
+	<provider>
+		<name>Orange</name>
+		<gsm>
+			<network-id mcc="639" mnc="07"/>
+			<apn value="bew.orange.co.ke"/>
+		</gsm>
+		<cdma>
+			<name>Orange Fixed Plus</name>
+		</cdma>
+	</provider>
 </country>
 
 <!-- Cambodia -->
@@ -3793,7 +4045,22 @@ conceived.
 		<name>T-Mobile</name>
 		<gsm>
 			<network-id mcc="297" mnc="02"/>
-			<apn value="internet-postpaid"/>
+			<apn value="tcmg-data">
+				<name>Mobile Broadband</name>
+				<username>38267</username>
+				<password>38267</password>
+			</apn>
+			<apn value="tcmg-nw">
+				<name>GPRS</name>
+				<username>38267</username>
+				<password>38267</password>
+			</apn>
+			<apn value="internet-postpaid">
+				<name>Postpaid (old)</name>
+			</apn>
+			<apn value="internet-prepaid">
+				<name>Prepaid (old)</name>
+			</apn>
 		</gsm>
 	</provider>
 	<provider>
@@ -3921,7 +4188,6 @@ conceived.
 			<apn value="internet.itelcel.com">
 				<username>webgprs</username>
 				<password>webgprs2002</password>
-				<dns>148.233.151.245</dns>
 			</apn>
 		</gsm>
 	</provider>
@@ -4169,7 +4435,10 @@ conceived.
 	<provider>
 		<name>XS4ALL Mobiel Internet</name>
 		<gsm>
-			<apn value="umts.xs4all.nl"/>
+			<apn value="umts.xs4all.nl">
+				<username>xs4all</username>
+				<password>xs4all</password>
+			</apn>
 		</gsm>
 	</provider>
 	<provider>
@@ -4216,6 +4485,10 @@ conceived.
 		<name>Telenor</name>
 		<gsm>
 			<network-id mcc="242" mnc="01"/>
+			<balance-check>
+				<dtmf>220</dtmf>
+				<sms text="saldo">222</sms>
+			</balance-check>
 			<apn value="telenor">
 				<dns>212.17.131.3</dns>
 				<dns>148.122.161.2</dns>
@@ -4413,6 +4686,17 @@ conceived.
 	</provider>
 </country>
 
+<!-- French Polynesia -->
+<country code="pf">
+	<provider>
+		<name>Vini</name>
+		<gsm>
+			<network-id mcc="547" mnc="20"/>
+			<apn value="internet"/>
+		</gsm>
+	</provider>
+</country>
+
 <!-- Philippines -->
 <country code="ph">
 	<provider>
@@ -4596,10 +4880,22 @@ conceived.
 		</gsm>
 	</provider>
 	<provider>
+		<!-- Merged with Optimus in 2010 -->
+		<name>Clix</name>
+		<gsm>
+			<network-id mcc="286" mnc="03"/>
+			<apn value="clixinternetmovel"/>
+		</gsm>
+	</provider>
+	<provider>
 		<name>Optimus</name>
 		<gsm>
 			<network-id mcc="286" mnc="03"/>
+			<apn value="umts">
+				<name>3G</name>
+			</apn>
 			<apn value="internet">
+				<name>GPRS</name>
 				<dns>194.79.69.129</dns>
 			</apn>
 		</gsm>
@@ -4609,6 +4905,8 @@ conceived.
 		<gsm>
 			<network-id mcc="286" mnc="06"/>
 			<apn value="internet">
+				<username>tmn</username>
+				<password>tmn</password>
 				<dns>194.65.3.20</dns>
 				<dns>194.65.3.21</dns>
 			</apn>
@@ -4775,6 +5073,18 @@ conceived.
 	</provider>
 </country>
 
+<!-- Rwanda -->
+<country code="rw">
+	<provider>
+		<name>MTN</name>
+		<gsm>
+			<network-id mcc="635" mnc="10"/>
+			<apn value="internet.mtn">
+			</apn>
+		</gsm>
+	</provider>
+</country>
+
 <!-- Russia -->
 <country code="ru">
 	<provider>
@@ -5158,6 +5468,10 @@ conceived.
 		<gsm>
 			<network-id mcc="240" mnc="07"/>
 			<network-id mcc="240" mnc="05"/>
+			<balance-check>
+				<ussd>*111#</ussd>
+				<dtmf>211</dtmf>
+			</balance-check>
 			<!-- http://www.tele2.se/internet-via-gprs.html -->
 			<apn value="internet.tele2.se">
 				<name>Mobilt Internet</name>
@@ -5214,7 +5528,10 @@ conceived.
 		<gsm>
 			<network-id mcc="240" mnc="01"/>
 			<network-id mcc="240" mnc="05"/>
-
+			<balance-check>
+				<ussd>*120#</ussd>
+				<ussd>*121#</ussd>
+			</balance-check>
 			<!-- http://www3.telia.se/foretag/mobilguiden/ -->
 			<apn value="online.telia.se"/>
 		</gsm>
@@ -5497,6 +5814,22 @@ conceived.
 	</provider>
 </country>
 
+<!-- Tunisia -->
+<country code="tn">
+	<provider>
+		<name>Orange</name>
+		<gsm>
+			<network-id mcc="605" mnc="01"/>
+			<apn value="keygp">
+				<name>Internet Everywhere Prepaid</name>
+			</apn>
+			<apn value="keypro">
+				<name>Internet Everywhere Professional</name>
+			</apn>
+		</gsm>
+	</provider>
+</country>
+
 <!-- Turkey -->
 <country code="tr">
 	<provider>
@@ -6102,6 +6435,7 @@ conceived.
 			<sid value="1224"/>
 			<sid value="1227"/>
 			<sid value="1230"/>
+			<sid value="1267"/>
 			<sid value="1285"/>
 			<sid value="1330"/>
 			<sid value="1358"/>
@@ -6258,6 +6592,10 @@ conceived.
 	</provider>
 	<provider>
 		<name>Alltel</name>
+		<gsm>
+			<!-- Former Western Wireless (roaming only) -->
+			<network-id mcc="310" mnc="590"/>
+		</gsm>
 		<cdma>
 			<!-- Assignments taken from IFAST: http://www.ifast.org/files/NationalSID.htm -->
 			<sid value="32"/>
@@ -6328,6 +6666,7 @@ conceived.
 			<sid value="478"/>
 			<sid value="487"/>
 			<sid value="491"/>
+			<sid value="504"/>
 			<sid value="518"/>
 			<sid value="520"/>
 			<sid value="544"/>
@@ -6362,6 +6701,7 @@ conceived.
 			<sid value="1148"/>
 			<sid value="1154"/>
 			<sid value="1156"/>
+			<sid value="1236"/>
 			<sid value="1244"/>
 			<sid value="1246"/>
 			<sid value="1248"/>
@@ -6390,6 +6730,8 @@ conceived.
 			<sid value="1344"/>
 			<sid value="1346"/>
 			<sid value="1348"/>
+			<sid value="1370"/>
+			<sid value="1372"/>
 			<sid value="1375"/>
 			<sid value="1383"/>
 			<sid value="1385"/>
@@ -6462,6 +6804,7 @@ conceived.
 			<sid value="3020"/>
 			<sid value="3226"/>
 			<sid value="3244"/>
+			<sid value="3292"/>
 			<sid value="30524"/>
 			<sid value="30635"/>
 		</cdma>
@@ -6528,6 +6871,19 @@ conceived.
 			<apn value="ISP"/>
 		</gsm>
 	</provider>
+	<provider>
+		<name>MTPCS (Cellular One)</name>
+		<gsm>
+			<network-id mcc="310" mnc="570"/>
+			<apn value="wapgw.chinookwireless.net"/>
+		</gsm>
+	</provider>
+	<provider>
+		<name>Mid-Rivers Cellular</name>
+		<cdma>
+			<sid value="3102"/>
+		</cdma>
+	</provider>
 </country>
 
 <!-- Uruguay -->
@@ -6624,6 +6980,26 @@ conceived.
 			</apn>
 		</gsm>
 	</provider>
+	<provider>
+		<name>Movilnet</name>
+		<gsm>
+			<network-id mcc="734" mnc="06"/>
+			<apn value="int.movilnet.com.ve">
+				<dns>200.44.32.12</dns>
+				<dns>200.11.248.12</dns>
+			</apn>
+		</gsm>
+	</provider>
+	<provider>
+		<name>Movistar</name>
+		<gsm>
+			<network-id mcc="734" mnc="04"/>
+			<apn value="internet.movistar.ve">
+				<dns>200.35.65.3</dns>
+				<dns>200.35.65.4</dns>
+			</apn>
+		</gsm>
+	</provider>
 </country>
 
 <!-- Viet Nam -->
@@ -6632,7 +7008,7 @@ conceived.
 		<name>MobiFone</name>
 		<gsm>
 			<network-id mcc="452" mnc="01"/>
-			<apn value="v-wap">
+			<apn value="m-wap">
 				<username>mms</username>
 				<password>mms</password>
 			</apn>
@@ -6643,6 +7019,12 @@ conceived.
 		<gsm>
 			<network-id mcc="452" mnc="02"/>
 			<apn value="m3-world">
+				<name>Mobile Internet</name>
+				<username>mms</username>
+				<password>mms</password>
+			</apn>
+			<apn value="m3-card">
+				<name>Mobile Broadband</name>
 				<username>mms</username>
 				<password>mms</password>
 			</apn>
@@ -6663,7 +7045,12 @@ conceived.
 		<name>Viettel Mobile</name>
 		<gsm>
 			<network-id mcc="452" mnc="04"/>
-			<apn value="v-internet"/>
+			<apn value="v-internet">
+				<name>Mobile Internet</name>
+			</apn>
+			<apn value="e-connect">
+				<name>D-com 3G</name>
+			</apn>
 		</gsm>
 	</provider>
 	<provider>
@@ -6674,7 +7061,13 @@ conceived.
 		</gsm>
 	</provider>
 	<provider>
-		<name>E-Mobile</name>
+		<name>EVNTelecom/E-Mobile</name>
+		<gsm>
+			<network-id mcc="452" mnc="08"/>
+			<apn value="e-internet">
+				<name>EVNTelecomNet</name>
+			</apn>
+		</gsm>
 		<cdma>
 			<username>evntelecom</username>
 			<password>evntelecom</password>
diff --git a/usr/local/www/diag_dump_states.php b/usr/local/www/diag_dump_states.php
index 108f138..a2009c9 100755
--- a/usr/local/www/diag_dump_states.php
+++ b/usr/local/www/diag_dump_states.php
@@ -126,7 +126,7 @@ include("head.inc");
 	$current_statecount=`pfctl -si | grep "current entries" | awk '{ print $3 }'`;
 ?>
 
-<table class="tabcont sortable" width="100%" border="0" cellspacing="0" cellpadding="0">
+<table class="tabcont" width="100%" border="0" cellspacing="0" cellpadding="0">
 	<tr>
 		<td>
 			<form action="<?=$_SERVER['SCRIPT_NAME'];?>" method="get">
@@ -145,13 +145,16 @@ include("head.inc");
 	</tr>
 	<tr>
 		<td>
-			<table class="tabcont" width="100%" border="0" cellspacing="0" cellpadding="0">
+			<table class="tabcont sortable" width="100%" border="0" cellspacing="0" cellpadding="0">
+				<thead>
 				<tr>
-					<td class="listhdrr" width="10%"><?=gettext("Proto");?></td>
-					<td class="listhdrr" width="65"><?=gettext("Source -> Router -> Destination");?></td>
-					<td class="listhdr" width="24%"><?=gettext("State");?></td>
-					<td class="list sort_ignore" width="1%"></td>
+					<th class="listhdrr" width="10%"><?=gettext("Proto");?></th>
+					<th class="listhdrr" width="65"><?=gettext("Source -> Router -> Destination");?></th>
+					<th class="listhdr" width="24%"><?=gettext("State");?></th>
+					<th class="list sort_ignore" width="1%"></th>
 				</tr>
+				</thead>
+				<tbody>
 <?php
 $row = 0;
 if(count($states) > 0) {
@@ -194,6 +197,7 @@ else {
 		  </tr>";
 }
 ?>
+			</tbody>
 			</table>
 		</td>
 	</tr>
diff --git a/usr/local/www/firewall_nat_1to1_edit.php b/usr/local/www/firewall_nat_1to1_edit.php
index f04c736..8532755 100755
--- a/usr/local/www/firewall_nat_1to1_edit.php
+++ b/usr/local/www/firewall_nat_1to1_edit.php
@@ -304,7 +304,16 @@ function typesel_change() {
 			  <span class="vexpl"><?=gettext("Choose which interface this rule applies to"); ?>.<br>
 			  <?=gettext("Hint: in most cases, you'll want to use WAN here"); ?>.</span></td>
 		</tr>
-		<tr id="srctable" name="srctable">
+                <tr> 
+                  <td width="22%" valign="top" class="vncellreq"><?=gettext("External subnet"); ?></td>
+                  <td width="78%" class="vtable"> 
+                    <input name="external" type="text" class="formfldalias" id="external" size="20" value="<?=htmlspecialchars($pconfig['external']);?>"> 
+                    <br/>
+                    <span class="vexpl"><?=gettext("Enter the external (usually on a WAN) subnet's starting address for the 1:1 mapping."); ?><br>
+                    <?=gettext("Hint: this is generally an address owned by the router itself on the selected interface."); ?></span>
+			</td>
+                </tr>
+		<tr>
                         <td width="22%" valign="top" class="vncellreq"><?=gettext("Source"); ?></td>
                         <td width="78%" class="vtable">
                                 <input name="srcnot" type="checkbox" id="srcnot" value="yes" <?php if ($pconfig['srcnot']) echo "checked"; ?>>
@@ -346,7 +355,7 @@ function typesel_change() {
                                         <tr>
                                                 <td><?=gettext("Address:"); ?>&nbsp;&nbsp;</td>
                                                 <td>
-                                                        <input name="src" type="text" class="formfld unknown" id="src" size="20" value="<?php if (!is_specialnet($pconfig['src'])) echo htmlspecialchars($pconfig['src']);?>"> /
+                                                        <input name="src" type="text" class="formfldalias" id="src" size="20" value="<?php if (!is_specialnet($pconfig['src'])) echo htmlspecialchars($pconfig['src']);?>"> /
                                                         <select name="srcmask" class="formselect" id="srcmask">
 <?php                                           for ($i = 31; $i > 0; $i--): ?>
                                                         <option value="<?=$i;?>" <?php if ($i == $pconfig['srcmask']) echo "selected"; ?>><?=$i;?></option>
@@ -356,7 +365,7 @@ function typesel_change() {
                                         </tr>
                                 </table>
 			<br/>
-                     <span class="vexpl"><?=gettext("Enter the internal (LAN) subnet for the 1:1 mapping. The subnet size specified for the external subnet also applies to the internal subnet (they  have to be the same)."); ?></span>
+                     <span class="vexpl"><?=gettext("Enter the internal (LAN) subnet for the 1:1 mapping. The subnet size specified for the internal subnet also applies to the external subnet (they  have to be the same)."); ?></span>
 			</td>
                 </tr>
 		<tr>
@@ -375,9 +384,9 @@ function typesel_change() {
                                                         <select name="dsttype" class="formselect" onChange="typesel_change()">
 <?php
                                                                 $sel = is_specialnet($pconfig['dst']); ?>
-                                                                <option value="any" <?php if ($pconfig['dst'] == "any") { echo "selected"; } ?>><?=gettext("any"); ?></option>
+                                                                <option value="any" <?php if (empty($pconfig['dst']) || $pconfig['dst'] == "any") { echo "selected"; } ?>><?=gettext("any"); ?></option>
                                                                 <option value="single" <?php if (($pconfig['dstmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>><?=gettext("Single host or alias"); ?></option>
-                                                                <option value="network" <?php if (!$sel) echo "selected"; ?>><?=gettext("Network"); ?></option>
+                                                                <option value="network" <?php if (!$sel && !empty($pconfig['dst'])) echo "selected"; ?>><?=gettext("Network"); ?></option>
                                                                 <?php if(have_ruleint_access("pptp")): ?>
                                                                 <option value="pptp" <?php if ($pconfig['dst'] == "pptp") { echo "selected"; } ?>><?=gettext("PPTP clients"); ?></option>
                                                                 <?php endif; ?>
@@ -394,25 +403,7 @@ function typesel_change() {
                                                                         <option value="<?=$if;?>ip"<?php if ($pconfig['dst'] == $if . "ip") { echo "selected"; } ?>>
                                                                                 <?=$ifdesc;?> <?=gettext("address");?>
                                                                         </option>
-<?php							endif; endforeach; 
-							if (is_array($config['virtualip']['vip'])):
-                                                        	foreach ($config['virtualip']['vip'] as $sn):
-                                                                	if ($sn['mode'] == "proxyarp" && $sn['type'] == "network"):
-                                                                        	$start = ip2long32(gen_subnet($sn['subnet'], $sn['subnet_bits']));
-                                                                                $end = ip2long32(gen_subnet_max($sn['subnet'], $sn['subnet_bits']));
-                                                                                $len = $end - $start;
-                                                                                for ($i = 0; $i <= $len; $i++):
-                                                                                $snip = long2ip32($start+$i);
-?>
-                                                                          <option value="<?=$snip;?>" <?php if ($snip == $pconfig['dst']) echo "selected"; ?>><?=htmlspecialchars("{$snip} ({$sn['descr']})");?></option>
-<?php                                                          endfor;
-                                                        else:
-?>
-                                                                          <option value="<?=$sn['subnet'];?>" <?php if ($sn['subnet'] == $pconfig['dst']) echo "selected"; ?>><?=htmlspecialchars("{$sn['subnet']} ({$sn['descr']})");?></option>
-<?php                                                   endif;
-						endforeach;
-						endif;
-?>
+<?php							endif; endforeach; ?>
                                                 	</select>
                                                 </td>
                                         </tr>
@@ -431,13 +422,8 @@ function typesel_change() {
                                         </tr>
                                 </table>
 			<br/>
-                </tr>
-                <tr> 
-                  <td width="22%" valign="top" class="vncellreq"><?=gettext("External subnet"); ?></td>
-                  <td width="78%" class="vtable"> 
-                    <input name="external" type="text" class="formfldalias" id="external" size="20" value="<?=htmlspecialchars($pconfig['external']);?>"> 
-                    <br/>
-			</td>
+                     <span class="vexpl"><?=gettext("The 1:1 mapping will only be used for connections to or from the specified destination."); ?><br>
+                     <?=gettext("Hint: this is usually 'any'."); ?></span>
                 </tr>
                 <tr> 
                   <td width="22%" valign="top" class="vncell"><?=gettext("Description"); ?></td>
@@ -496,6 +482,7 @@ if($config['aliases']['alias'] <> "")
         var addressarray=new Array(<?php echo $aliasesaddr; ?>);
 
         var oTextbox1 = new AutoSuggestControl(document.getElementById("external"), new StateSuggestions(addressarray));
+        var oTextbox2 = new AutoSuggestControl(document.getElementById("src"), new StateSuggestions(addressarray));
         var oTextbox3 = new AutoSuggestControl(document.getElementById("dst"), new StateSuggestions(addressarray));
 //-->
 </script>
diff --git a/usr/local/www/firewall_nat_edit.php b/usr/local/www/firewall_nat_edit.php
index 7f75f83..c6c50a5 100755
--- a/usr/local/www/firewall_nat_edit.php
+++ b/usr/local/www/firewall_nat_edit.php
@@ -178,11 +178,11 @@ if ($_POST) {
 
 	/* input validation */
 	if(strtoupper($_POST['proto']) == "TCP" or strtoupper($_POST['proto']) == "UDP" or strtoupper($_POST['proto']) == "TCP/UDP") {
-		$reqdfields = explode(" ", "interface proto dstbeginport dstendport localip");
-		$reqdfieldsn = array(gettext("Interface"),gettext("Protocol"),gettext("Destination port from"),gettext("Destination port to"),gettext("NAT IP"));
+		$reqdfields = explode(" ", "interface proto dstbeginport dstendport");
+		$reqdfieldsn = array(gettext("Interface"),gettext("Protocol"),gettext("Destination port from"),gettext("Destination port to"));
 	} else {
-		$reqdfields = explode(" ", "interface proto localip");
-		$reqdfieldsn = array(gettext("Interface"),gettext("Protocol"),gettext("NAT IP"));
+		$reqdfields = explode(" ", "interface proto");
+		$reqdfieldsn = array(gettext("Interface"),gettext("Protocol"));
 	}
 
 	if ($_POST['srctype'] == "single" || $_POST['srctype'] == "network") {
@@ -193,6 +193,10 @@ if ($_POST) {
 		$reqdfields[] = "dst";
 		$reqdfieldsn[] = gettext("Destination address");
 	}
+	if (!isset($_POST['nordr'])) {
+		$reqdfields[] = "localip";
+		$reqdfieldsn[] = gettext("Redirect target IP");
+	}
 
 	do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
 
@@ -205,8 +209,8 @@ if ($_POST) {
 		$_POST['dstendport'] = 0;
 	}
 
-	if (($_POST['localip'] && !is_ipaddroralias($_POST['localip']))) {
-		$input_errors[] = sprintf(gettext("\"%s\" is not valid NAT IP address or host alias."), $_POST['localip']);
+	if (!isset($_POST['nordr']) && ($_POST['localip'] && !is_ipaddroralias($_POST['localip']))) {
+		$input_errors[] = sprintf(gettext("\"%s\" is not a valid redirect target IP address or host alias."), $_POST['localip']);
 	}
 
 	if ($_POST['srcbeginport'] && !is_portoralias($_POST['srcbeginport']))
@@ -218,7 +222,7 @@ if ($_POST) {
 	if ($_POST['dstendport'] && !is_portoralias($_POST['dstendport']))
 		$input_errors[] = sprintf(gettext("%s is not a valid end destination port. It must be a port alias or integer between 1 and 65535."), $_POST['dstendport']);
 
-	if ($_POST['localbeginport'] && !is_portoralias($_POST['localbeginport'])) {
+	if (!isset($_POST['nordr']) && $_POST['localbeginport'] && !is_portoralias($_POST['localbeginport'])) {
 		$input_errors[] = sprintf(gettext("%s is not a valid local port. It must be a port alias or integer between 1 and 65535."), $_POST['localbeginport']);
 	}
 
@@ -259,7 +263,7 @@ if ($_POST) {
 	}
 
 	if (!$input_errors) {
-		if (($_POST['dstendport'] - $_POST['dstbeginport'] + $_POST['localbeginport']) > 65535)
+		if (!isset($_POST['nordr']) && ($_POST['dstendport'] - $_POST['dstbeginport'] + $_POST['localbeginport']) > 65535)
 			$input_errors[] = gettext("The target port range must be an integer between 1 and 65535.");
 	}
 
@@ -292,6 +296,11 @@ if ($_POST) {
 		$natent['disabled'] = isset($_POST['disabled']) ? true:false;
 		$natent['nordr'] = isset($_POST['nordr']) ? true:false;
 
+		if ($natent['nordr']) {
+			$_POST['associated-rule-id'] = '';
+			$_POST['filter-rule-association'] = '';
+		}
+
 		pconfig_to_address($natent['source'], $_POST['src'],
 			$_POST['srcmask'], $_POST['srcnot'],
 			$_POST['srcbeginport'], $_POST['srcendport']);
@@ -302,8 +311,10 @@ if ($_POST) {
 
 		$natent['protocol'] = $_POST['proto'];
 
-		$natent['target'] = $_POST['localip'];
-		$natent['local-port'] = $_POST['localbeginport'];
+		if (!$natent['nordr']) {
+			$natent['target'] = $_POST['localip'];
+			$natent['local-port'] = $_POST['localbeginport'];
+		}
 		$natent['interface'] = $_POST['interface'];
 		$natent['descr'] = $_POST['descr'];
 		$natent['associated-rule-id'] = $_POST['associated-rule-id'];
@@ -443,7 +454,7 @@ include("fbegin.inc"); ?>
                 <tr>
                   <td width="22%" valign="top" class="vncell"><?=gettext("No RDR (NOT)"); ?></td>
                   <td width="78%" class="vtable">
-                    <input type="checkbox" name="nordr"<?php if($pconfig['nordr']) echo " CHECKED"; ?>>
+                    <input type="checkbox" name="nordr" id="nordr" onClick="nordr_change();" <?php if($pconfig['nordr']) echo "CHECKED"; ?>>
                     <span class="vexpl"><?=gettext("Enabling this option will disable redirection for traffic matching this rule."); ?>
                     <br><?=gettext("Hint: this option is rarely needed, don't use this unless you know what you're doing."); ?></span>
                   </td>
@@ -709,7 +720,7 @@ include("fbegin.inc"); ?>
 				</span>
 			</td>
 		</tr>
-                <tr>
+                <tr name="localiptable" id="localiptable">
                   <td width="22%" valign="top" class="vncellreq"><?=gettext("Redirect target IP"); ?></td>
                   <td width="78%" class="vtable">
                     <input autocomplete='off' name="localip" type="text" class="formfldalias" id="localip" size="20" value="<?=htmlspecialchars($pconfig['localip']);?>">
@@ -763,7 +774,7 @@ include("fbegin.inc"); ?>
 					</td>
 				</tr>
 				<?php if (isset($id) && $a_nat[$id] && !isset($_GET['dup'])): ?>
-				<tr>
+				<tr name="assoctable" id="assoctable">
 					<td width="22%" valign="top" class="vncell"><?=gettext("Filter rule association"); ?></td>
 					<td width="78%" class="vtable">
 						<select name="associated-rule-id">
@@ -794,7 +805,7 @@ include("fbegin.inc"); ?>
 				</tr>
 				<?php endif; ?>
                 <?php if ((!(isset($id) && $a_nat[$id])) || (isset($_GET['dup']))): ?>
-                <tr>
+                <tr name="assoctable" id="assoctable">
                   <td width="22%" valign="top" class="vncell"><?=gettext("Filter rule association"); ?></td>
                   <td width="78%" class="vtable">
                     <select name="filter-rule-association" id="filter-rule-association">
@@ -830,6 +841,7 @@ include("fbegin.inc"); ?>
 	<?php if ($pconfig['srcnot'] || $pconfig['src'] != "any" || $pconfig['srcbeginport'] != "any" || $pconfig['srcendport'] != "any"): ?>
 	show_source();
 	<?php endif; ?>
+	nordr_change();
 //-->
 </script>
 <?php
diff --git a/usr/local/www/firewall_rules_edit.php b/usr/local/www/firewall_rules_edit.php
index 813842c..a51fdf2 100755
--- a/usr/local/www/firewall_rules_edit.php
+++ b/usr/local/www/firewall_rules_edit.php
@@ -1383,7 +1383,9 @@ include("head.inc");
 	ext_change();
 	typesel_change();
 	proto_change();
+	<?php if ( (!empty($pconfig['srcbeginport']) && $pconfig['srcbeginport'] != "any") || (!empty($pconfig['srcendport']) && $pconfig['srcendport'] != "any") ): ?>
 	show_source_port_range();
+	<?php endif; ?>
 
 <?php
 	$isfirst = 0;
diff --git a/usr/local/www/javascript/firewall_nat_edit/firewall_nat_edit.js b/usr/local/www/javascript/firewall_nat_edit/firewall_nat_edit.js
index e75e192..bd88145 100644
--- a/usr/local/www/javascript/firewall_nat_edit/firewall_nat_edit.js
+++ b/usr/local/www/javascript/firewall_nat_edit/firewall_nat_edit.js
@@ -1,6 +1,7 @@
 <!--
 var portsenabled = 1;
 var dstenabled = 1;
+var showsource = 0;
 
 function ext_change() {
 	if ((document.iform.srcbeginport.selectedIndex == 0) && portsenabled) {
@@ -52,12 +53,25 @@ function ext_change() {
 	}
 }
 
+function nordr_change() {
+	if (document.iform.nordr.checked) {
+		document.getElementById("localiptable").style.display = 'none';
+		document.getElementById("lprtr").style.display = 'none';
+		document.getElementById("assoctable").style.display = 'none';
+	} else {
+		document.getElementById("localiptable").style.display = '';
+		document.getElementById("lprtr").style.display = portsenabled ? '' : 'none';
+		document.getElementById("assoctable").style.display = '';
+	}
+}
+
 function show_source() {
 	if(portsenabled)
 		document.getElementById("sprtable").style.display = '';
 
 	document.getElementById("srctable").style.display = '';
 	document.getElementById("showadvancedboxsrc").style.display = 'none';
+	showsource = 1;
 }
 
 function check_for_aliases() {
@@ -110,16 +124,16 @@ function check_for_aliases() {
 }
 
 function proto_change() {
-	if (document.iform.proto.selectedIndex < 3) {
+	if (document.iform.proto.selectedIndex >= 0 && document.iform.proto.selectedIndex <= 2) {
 		portsenabled = 1;
 	} else {
 		portsenabled = 0;
 	}
 
-	if(document.iform.proto.selectedIndex >= 0 && document.iform.proto.selectedIndex <= 2) {
-		document.getElementById("sprtable").style.display = portsenabled == 1 ? '':'none';
+	if (portsenabled) {
+		document.getElementById("sprtable").style.display = showsource == 1 ? '':'none';
 		document.getElementById("dprtr").style.display = '';
-		document.getElementById("lprtr").style.display = '';
+		document.getElementById("lprtr").style.display = document.iform.nordr.checked ? 'none' : '';
 	} else {
 		document.getElementById("sprtable").style.display = 'none';
 		document.getElementById("dprtr").style.display = 'none';
diff --git a/usr/local/www/javascript/firewall_rules_edit/firewall_rules_edit.js b/usr/local/www/javascript/firewall_rules_edit/firewall_rules_edit.js
index 3ce0b64..138dbf4 100644
--- a/usr/local/www/javascript/firewall_rules_edit/firewall_rules_edit.js
+++ b/usr/local/www/javascript/firewall_rules_edit/firewall_rules_edit.js
@@ -44,7 +44,7 @@ function ext_change() {
 }
 
 function show_source_port_range() {
-	if(portsenabled) {
+	if (portsenabled) {
 		document.getElementById("sprtable").style.display = '';
 		document.getElementById("showadvancedboxspr").style.display = 'none';
 	}
diff --git a/usr/local/www/system_gateways_edit.php b/usr/local/www/system_gateways_edit.php
index b9ea2fe..dd08e64 100755
--- a/usr/local/www/system_gateways_edit.php
+++ b/usr/local/www/system_gateways_edit.php
@@ -63,11 +63,15 @@ if (isset($_GET['dup'])) {
 }
 
 if (isset($id) && $a_gateways[$id]) {
+	$pconfig = array();
 	$pconfig['name'] = $a_gateways[$id]['name'];
 	$pconfig['weight'] = $a_gateways[$id]['weight'];
 	$pconfig['interface'] = $a_gateways[$id]['interface'];
 	$pconfig['friendlyiface'] = $a_gateways[$id]['friendlyiface'];
-	$pconfig['gateway'] = $a_gateways[$id]['gateway'];
+	if ($a_gateways[$id]['gateway'] == "dynamic" || $a_gateway_item[$id]['gateway'] == "dynamic")
+		$pconfig['gateway'] = gettext("dynamic");
+	else
+		$pconfig['gateway'] = $a_gateways[$id]['gateway'];
 	$pconfig['defaultgw'] = isset($a_gateways[$id]['defaultgw']);
 	$pconfig['latencylow'] = $a_gateway_item[$id]['latencylow'];
         $pconfig['latencyhigh'] = $a_gateway_item[$id]['latencyhigh'];
@@ -192,17 +196,10 @@ if ($_POST) {
 		$save = false;
 		if (($_POST['weight'] && $_POST['weight'] > 1) ||
 		    $_POST['latencylow'] || $_POST['latencyhigh'] || $_POST['losslow'] || $_POST['losshigh'] || $_POST['down'] ||
-		    $_POST['defaultgw'] || ($_POST['gateway'] && $_POST['gateway'] != "dynamic") || $_POST['monitor'])
+		    $_POST['defaultgw'] || ($_POST['gateway'] && $_POST['gateway'] != "dynamic"))
 			$save = true;
 		/* if we are processing a system gateway only save the monitorip */
 		if (!$save && (empty($_POST['gateway']) || $_POST['gateway'] == "dynamic")) {
-			if (is_ipaddr($_POST['monitor'])) {
-				if (empty($_POST['interface']))
-					$interface = $pconfig['friendlyiface'];
-				else
-					$interface = $_POST['interface'];
-				$config['interfaces'][$interface]['monitorip'] = $_POST['monitor'];
-			}
 			/* when dynamic gateway is not anymore a default the entry is no more needed. */
                         if (isset($id) && $a_gateway_item[$id])
                                 unset($a_gateway_item[$id]);
@@ -222,8 +219,6 @@ if ($_POST) {
 			$gateway['descr'] = $_POST['descr'];
 			if (is_ipaddr($_POST['monitor']))
 				$gateway['monitor'] = $_POST['monitor'];
-			else
-				unset($gateway['monitor']);
 
 			if ($_POST['defaultgw'] == "yes" || $_POST['defaultgw'] == "on") {
 				$i = 0;
@@ -233,8 +228,7 @@ if ($_POST) {
 				}
 				$gateway['defaultgw'] = true;
 				$reloadif = true;
-			} else
-				unset($gateway['defaultgw']);
+			}
 
 			if ($_POST['latencylow'])
 				$gateway['latencylow'] = $_POST['latencylow'];
@@ -315,7 +309,8 @@ function show_advanced_gateway() {
                 <tr> 
                   <td width="22%" valign="top" class="vncellreq"><?=gettext("Interface"); ?></td>
                   <td width="78%" class="vtable">
-				  <select name="interface" class="formselect" <?php if ($pconfig['dynamic'] == true && $pconfig['attribute'] == "system") echo "disabled"; ?>>
+		 	<select name='interface' class='formselect' <?php if ($pconfig['dynamic'] == true && $pconfig['attribute'] == "system") echo "disabled"; ?>>
+
 		<?php 
                       	$interfaces = get_configured_interface_with_descr(false, true);
 			foreach ($interfaces as $iface => $ifacename) {
@@ -358,7 +353,7 @@ function show_advanced_gateway() {
 		  <td width="22%" valign="top" class="vncell"><?=gettext("Monitor IP"); ?></td>
 		  <td width="78%" class="vtable">
 			<?php
-				if(($pconfig['attribute'] == "system") && ($pconfig['gateway'] == "dynamic") && ($pconfig['monitor'] == "")) {
+				if(($pconfig['attribute'] == "system") && $pconfig['dynamic'] && ($pconfig['monitor'] == "")) {
 					$monitor = "";
 				} else {
 					$monitor = htmlspecialchars($pconfig['monitor']);
diff --git a/usr/local/www/system_routes_edit.php b/usr/local/www/system_routes_edit.php
index 9895d0e..96d24d5 100755
--- a/usr/local/www/system_routes_edit.php
+++ b/usr/local/www/system_routes_edit.php
@@ -182,15 +182,9 @@ include("head.inc");
 			<select name="gateway" id="gateway" class="formselect">
 			<?php
 				foreach ($a_gateways as $gateway) {
-					if ($gateway['attribute'] == "system") {
-	                      			echo "<option value='{$gateway['friendlyiface']}' ";
-						if ($gateway['friendlyiface'] == $pconfig['gateway'])
-							echo "selected";
-					} else {
-	                      			echo "<option value='{$gateway['name']}' ";
-						if ($gateway['name'] == $pconfig['gateway'])
-							echo "selected";
-					}
+	                      		echo "<option value='{$gateway['name']}' ";
+					if ($gateway['name'] == $pconfig['gateway'])
+						echo "selected";
 	                      		echo ">" . htmlspecialchars($gateway['name']) . " - " . htmlspecialchars($gateway['gateway']) . "</option>\n";
 				}
 			?>