Added support for automatically managing firewall rules with NAT rules.

5 files changed, 78 insertions, 18 deletions

diff --git a/usr/local/www/firewall_nat.php b/usr/local/www/firewall_nat.php
index 741e15a..274a3f2 100755
--- a/usr/local/www/firewall_nat.php
+++ b/usr/local/www/firewall_nat.php
@@ -81,6 +81,12 @@ if (isset($_POST['del_x'])) {
     if (is_array($_POST['rule']) && count($_POST['rule'])) {
 	    foreach ($_POST['rule'] as $rulei) {
 		$target = $rule['target'];
+			// Check for filter rule associations
+			if (isset($a_nat[$rulei]['associated-filter-rule-id'])){
+				delete_id($a_nat[$rulei]['associated-filter-rule-id'], $config['filter']['rule']);
+				
+				mark_subsystem_dirty('filter');
+			}
 	        unset($a_nat[$rulei]);
 	    }
 	    write_config();
@@ -217,7 +223,11 @@ echo "<script type=\"text/javascript\" language=\"javascript\" src=\"/javascript
 	?>
                 <tr valign="top" id="fr<?=$nnats;?>">
                   <td class="listt"><input type="checkbox" id="frc<?=$nnats;?>" name="rule[]" value="<?=$i;?>" onClick="fr_bgcolor('<?=$nnats;?>')" style="margin: 0; padding: 0; width: 15px; height: 15px;"></td>
-                  <td class="listt" align="center"></td>
+                  <td class="listt" align="center">
+					<?php if(isset($natent['associated-filter-rule-id']) && $natent['associated-filter-rule-id']>0): ?>
+					<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_chain.png" width="17" height="17" title="Firewall rule ID <?=htmlspecialchars($natent['associated-filter-rule-id']); ?> is managed with this rule" border="0">
+					<?php endif; ?>
+				  </td>
                   <td class="listlr" onClick="fr_toggle(<?=$nnats;?>)" id="frd<?=$nnats;?>" ondblclick="document.location='firewall_nat_edit.php?id=<?=$nnats;?>';">
 		    <?php
 			if (!$natent['interface'] || ($natent['interface'] == "wan"))
diff --git a/usr/local/www/firewall_nat_edit.php b/usr/local/www/firewall_nat_edit.php
index 10fb84d..3d78049 100755
--- a/usr/local/www/firewall_nat_edit.php
+++ b/usr/local/www/firewall_nat_edit.php
@@ -61,6 +61,7 @@ if (isset($id) && $a_nat[$id]) {
 	$pconfig['localbeginport'] = $a_nat[$id]['local-port'];
 	$pconfig['descr'] = $a_nat[$id]['descr'];
 	$pconfig['interface'] = $a_nat[$id]['interface'];
+	$pconfig['associated-filter-rule-id'] = $a_nat[$id]['associated-filter-rule-id'];
 	$pconfig['nosync'] = isset($a_nat[$id]['nosync']);
 	if (!$pconfig['interface'])
 		$pconfig['interface'] = "wan";
@@ -181,24 +182,18 @@ if ($_POST) {
 		$natent['local-port'] = $_POST['localbeginport'];
 		$natent['interface'] = $_POST['interface'];
 		$natent['descr'] = $_POST['descr'];
+		$natent['associated-filter-rule-id'] = $_POST['associated-filter-rule-id'];
 
 		if($_POST['nosync'] == "yes")
 			$natent['nosync'] = true;
 		else
 			unset($natent['nosync']);
 
-		if (isset($id) && $a_nat[$id])
-			$a_nat[$id] = $natent;
-		else {
-			if (is_numeric($after))
-				array_splice($a_nat, $after+1, 0, array($natent));
-			else
-				$a_nat[] = $natent;
-		}
-
-		mark_subsystem_dirty('natconf');
+		if ($_POST['autoadd'] || $natent['associated-filter-rule-id']>0) {
+			// If we had a previous rule associated with this NAT rule, delete that
+			if( $natent['associated-filter-rule-id'] > 0 )
+				delete_id($natent['associated-filter-rule-id'], $config['filter']['rule']);
 
-		if ($_POST['autoadd']) {
 			/* auto-generate a matching firewall rule */
 			$filterent = array();
 			$filterent['interface'] = $_POST['interface'];
@@ -221,11 +216,30 @@ if ($_POST) {
 			 */
 			$filterent['descr'] = substr("NAT " . $_POST['descr'], 0, 59);
 
+			// If we had a previous rule association, update this rule with that ID so we don't lose association
+			if ($natent['associated-filter-rule-id'] > 0)
+				$filterent['id'] = $natent['associated-filter-rule-id']; 
+			// Otherwise generate an ID for this rule, make sure the NAT entry is updated with the same ID
+			else
+				$natent['associated-filter-rule-id'] = $filterent['id'] = get_next_id($config['filter']['rule']);
+
 			$config['filter']['rule'][] = $filterent;
 
 			mark_subsystem_dirty('filter');
 		}
 
+		// Update NAT entry after creating/updating the firewall rule, so we have it's rule ID if one was created
+		if (isset($id) && $a_nat[$id])
+			$a_nat[$id] = $natent;
+		else {
+			if (is_numeric($after))
+				array_splice($a_nat, $after+1, 0, array($natent));
+			else
+				$a_nat[] = $natent;
+		}
+
+		mark_subsystem_dirty('natconf');
+
 		write_config();
 
 		header("Location: firewall_nat.php");
@@ -390,13 +404,30 @@ include("fbegin.inc"); ?>
 						HINT: This prevents the rule from automatically syncing to other CARP members.
 					</td>
 				</tr>
+				<?php if (isset($id) && $a_nat[$id] && !isset($_GET['dup'])): ?>
+				<tr>
+					<td width="22%" valign="top" class="vncell">Automatically update firewall rule with this rule</td>
+					<td width="78%" class="vtable">
+						<select name="associated-filter-rule-id">
+							<option value="">Do not automatically update</option>
+							<?php foreach ($config['filter']['rule'] as $filter_rule): ?>
+								<?php if (isset($filter_rule['id']) && $filter_rule['id']>0): ?>
+									<option value="<?php echo $filter_rule['id']; ?>"<?php if($filter_rule['id']==$pconfig['associated-filter-rule-id']) echo " SELECTED"; ?>>
+									<?php echo htmlspecialchars('Rule ' . $filter_rule['id'] . ' - ' . $filter_rule['descr']); ?>
+									</option>
+								<?php endif; ?>
+							<?php endforeach; ?>
+						</select>
+					</td>
+				</tr>
+				<?php endif; ?>
                 <?php if ((!(isset($id) && $a_nat[$id])) || (isset($_GET['dup']))): ?>
                 <tr>
                   <td width="22%" valign="top">&nbsp;</td>
                   <td width="78%">
                     <input name="autoadd" type="checkbox" id="autoadd" value="yes" CHECKED>
                     <strong>Auto-add a firewall rule to permit traffic through
-                    this NAT rule</strong></td>
+                    this NAT rule and manage it with this NAT rule.</strong></td>
                 </tr><?php endif; ?>
                 <tr>
                   <td width="22%" valign="top">&nbsp;</td>
diff --git a/usr/local/www/firewall_rules.php b/usr/local/www/firewall_rules.php
index a4da1e0..9c8f979 100755
--- a/usr/local/www/firewall_rules.php
+++ b/usr/local/www/firewall_rules.php
@@ -230,15 +230,16 @@ echo "<script type=\"text/javascript\" language=\"javascript\" src=\"/javascript
                 <tr id="frheader">
                   <td width="3%" class="list">&nbsp;</td>
                   <td width="5%" class="list">&nbsp;</td>
+                  <td width="3%" class="listhdrr">ID</td>
                   <td width="6%" class="listhdrr">Proto</td>
-                  <td width="15%" class="listhdrr">Source</td>
+                  <td width="14%" class="listhdrr">Source</td>
                   <td width="7%" class="listhdrr">Port</td>
-                  <td width="15%" class="listhdrr">Destination</td>
+                  <td width="14%" class="listhdrr">Destination</td>
                   <td width="7%" class="listhdrr">Port</td>
 		  <td width="5%" class="listhdrr">Gateway</td>
 		  <td width="10%" class="listhdrr">Queue</td>
 		  <td width="5%" class="listhdrr">Schedule</td>
-                  <td width="22%" class="listhdr">Description</td>
+                  <td width="21%" class="listhdr">Description</td>
                   <td width="10%" class="list">
 			<table border="0" cellspacing="0" cellpadding="1">
 			   <tr>
@@ -267,7 +268,8 @@ echo "<script type=\"text/javascript\" language=\"javascript\" src=\"/javascript
                 <tr valign="top" id="frrfc1918">
                   <td width="3%" class="list">&nbsp;</td>
                   <td class="listt" align="center"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_block.gif" width="11" height="11" border="0"></td>
-                  <td class="listlr" style="background-color: #e0e0e0">*</td>
+                  <td class="listlr" style="background-color: #e0e0e0"></td>
+                  <td class="listr" style="background-color: #e0e0e0">*</td>
                   <td class="listr" style="background-color: #e0e0e0">RFC 1918 networks</td>
                   <td class="listr" style="background-color: #e0e0e0">*</td>
                   <td class="listr" style="background-color: #e0e0e0">*</td>
@@ -294,7 +296,8 @@ echo "<script type=\"text/javascript\" language=\"javascript\" src=\"/javascript
                 <tr valign="top" id="frrfc1918">
                   <td width="3%" class="list">&nbsp;</td>
                   <td class="listt" align="center"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_block.gif" width="11" height="11" border="0"></td>
-                  <td class="listlr" style="background-color: #e0e0e0">*</td>
+                  <td class="listlr" style="background-color: #e0e0e0"></td>
+                  <td class="listr" style="background-color: #e0e0e0">*</td>
                   <td class="listr" style="background-color: #e0e0e0">Reserved/not assigned by IANA</td>
                   <td class="listr" style="background-color: #e0e0e0">*</td>
                   <td class="listr" style="background-color: #e0e0e0">*</td>
@@ -518,6 +521,9 @@ echo "<script type=\"text/javascript\" language=\"javascript\" src=\"/javascript
 				}
 				?>
                   <td class="listlr" onClick="fr_toggle(<?=$nrules;?>)" id="frd<?=$nrules;?>" ondblclick="document.location='firewall_rules_edit.php?id=<?=$i;?>';">
+                    <?=$textss;?><?php if (isset($filterent['id'])) echo $filterent['id']; else echo ""; ?><?=$textse;?>
+                  </td>
+                  <td class="listr" onClick="fr_toggle(<?=$nrules;?>)" id="frd<?=$nrules;?>" ondblclick="document.location='firewall_rules_edit.php?id=<?=$i;?>';">
                     <?=$textss;?><?php if (isset($filterent['protocol'])) echo strtoupper($filterent['protocol']); else echo "*"; ?><?=$textse;?>
                   </td>
                   <td class="listr" onClick="fr_toggle(<?=$nrules;?>)" id="frd<?=$nrules;?>" ondblclick="document.location='firewall_rules_edit.php?id=<?=$i;?>';">
@@ -584,6 +590,7 @@ echo "<script type=\"text/javascript\" language=\"javascript\" src=\"/javascript
                   <td class="list">&nbsp;</td>
                   <td class="list">&nbsp;</td>
                   <td class="list">&nbsp;</td>
+                  <td class="list">&nbsp;</td>
 		  <td class="list">&nbsp;</td>
 		  <td class="list">&nbsp;</td>
                   <td class="list">&nbsp;</td>
diff --git a/usr/local/www/firewall_rules_edit.php b/usr/local/www/firewall_rules_edit.php
index 8844451..efd3a9c 100755
--- a/usr/local/www/firewall_rules_edit.php
+++ b/usr/local/www/firewall_rules_edit.php
@@ -71,6 +71,9 @@ if (isset($_GET['dup'])) {
 if (isset($id) && $a_filter[$id]) {
 	$pconfig['interface'] = $a_filter[$id]['interface'];
 
+	if (isset($a_filter[$id]['id']))
+		$pconfig['ruleid'] = $a_filter[$id]['id'];
+
 	if (!isset($a_filter[$id]['type']))
 		$pconfig['type'] = "pass";
 	else
@@ -336,6 +339,8 @@ if ($_POST) {
 		else if ($dnpipe[0] == "?" && $pdnpipe[0] <> "?")
 			$input_errors[] = "You cannot select one queue and one virtual interface for IN and Out. both must be from the same type.";
 	}
+	if( !empty($_POST['ruleid']) && !ctype_digit($_POST['ruleid']))
+		$input_errors[] = 'ID must be an integer';
 	if($_POST['l7container'] && $_POST['l7container'] != "none") {
 		if(!($_POST['proto'] == "tcp" || $_POST['proto'] == "udp" || $_POST['proto'] == "tcp/udp"))
 			$input_errors[] = "You can only select a layer7 container for tcp and/or udp protocols";
@@ -345,6 +350,7 @@ if ($_POST) {
 
 	if (!$input_errors) {
 		$filterent = array();
+		$filterent['id'] = $_POST['ruleid']>0?$_POST['ruleid']:'';
 		$filterent['type'] = $_POST['type'];
 		if (isset($_POST['interface'] ))
 			$filterent['interface'] = $_POST['interface'];
@@ -492,6 +498,12 @@ include("head.inc");
 			<td colspan="2" valign="top" class="listtopic">Edit Firewall rule</td>
 		</tr>	
     	<tr>
+			<td width="22%" valign="top" class="vncell">ID</td>
+			<td width="78%" class="vtable">
+				<input name="ruleid" value="<?=(isset($pconfig['ruleid'])&&$pconfig['ruleid']>0)?htmlspecialchars($pconfig['ruleid']):''?>">
+			</td>
+		</tr>
+    	<tr>
 			<td width="22%" valign="top" class="vncellreq">Action</td>
 			<td width="78%" class="vtable">
 				<select name="type" class="formselect">
diff --git a/usr/local/www/themes/pfsense_ng/images/icons/icon_chain.png b/usr/local/www/themes/pfsense_ng/images/icons/icon_chain.png
new file mode 100644
index 0000000..cd9a7cc
--- /dev/null
+++ b/usr/local/www/themes/pfsense_ng/images/icons/icon_chain.png