summaryrefslogtreecommitdiffstats
path: root/usr
diff options
context:
space:
mode:
authorunknown <lietu@.(none)>2009-08-14 23:53:54 +0300
committerunknown <lietu@.(none)>2009-08-14 23:53:54 +0300
commitb9e28d57da563f17d2e5c8d83269e1fa928d2b5d (patch)
treed46187e6778a7f72bd199af00643453fbc4e178a /usr
parenta4698195baff618dfa9f1c04d4461a1281521aa8 (diff)
downloadpfsense-b9e28d57da563f17d2e5c8d83269e1fa928d2b5d.zip
pfsense-b9e28d57da563f17d2e5c8d83269e1fa928d2b5d.tar.gz
Added support for automatically managing firewall rules with NAT rules.
Diffstat (limited to 'usr')
-rwxr-xr-xusr/local/www/firewall_nat.php12
-rwxr-xr-xusr/local/www/firewall_nat_edit.php55
-rwxr-xr-xusr/local/www/firewall_rules.php17
-rwxr-xr-xusr/local/www/firewall_rules_edit.php12
-rw-r--r--usr/local/www/themes/pfsense_ng/images/icons/icon_chain.pngbin0 -> 281 bytes
5 files changed, 78 insertions, 18 deletions
diff --git a/usr/local/www/firewall_nat.php b/usr/local/www/firewall_nat.php
index 741e15a..274a3f2 100755
--- a/usr/local/www/firewall_nat.php
+++ b/usr/local/www/firewall_nat.php
@@ -81,6 +81,12 @@ if (isset($_POST['del_x'])) {
if (is_array($_POST['rule']) && count($_POST['rule'])) {
foreach ($_POST['rule'] as $rulei) {
$target = $rule['target'];
+ // Check for filter rule associations
+ if (isset($a_nat[$rulei]['associated-filter-rule-id'])){
+ delete_id($a_nat[$rulei]['associated-filter-rule-id'], $config['filter']['rule']);
+
+ mark_subsystem_dirty('filter');
+ }
unset($a_nat[$rulei]);
}
write_config();
@@ -217,7 +223,11 @@ echo "<script type=\"text/javascript\" language=\"javascript\" src=\"/javascript
?>
<tr valign="top" id="fr<?=$nnats;?>">
<td class="listt"><input type="checkbox" id="frc<?=$nnats;?>" name="rule[]" value="<?=$i;?>" onClick="fr_bgcolor('<?=$nnats;?>')" style="margin: 0; padding: 0; width: 15px; height: 15px;"></td>
- <td class="listt" align="center"></td>
+ <td class="listt" align="center">
+ <?php if(isset($natent['associated-filter-rule-id']) && $natent['associated-filter-rule-id']>0): ?>
+ <img src="./themes/<?= $g['theme']; ?>/images/icons/icon_chain.png" width="17" height="17" title="Firewall rule ID <?=htmlspecialchars($natent['associated-filter-rule-id']); ?> is managed with this rule" border="0">
+ <?php endif; ?>
+ </td>
<td class="listlr" onClick="fr_toggle(<?=$nnats;?>)" id="frd<?=$nnats;?>" ondblclick="document.location='firewall_nat_edit.php?id=<?=$nnats;?>';">
<?php
if (!$natent['interface'] || ($natent['interface'] == "wan"))
diff --git a/usr/local/www/firewall_nat_edit.php b/usr/local/www/firewall_nat_edit.php
index 10fb84d..3d78049 100755
--- a/usr/local/www/firewall_nat_edit.php
+++ b/usr/local/www/firewall_nat_edit.php
@@ -61,6 +61,7 @@ if (isset($id) && $a_nat[$id]) {
$pconfig['localbeginport'] = $a_nat[$id]['local-port'];
$pconfig['descr'] = $a_nat[$id]['descr'];
$pconfig['interface'] = $a_nat[$id]['interface'];
+ $pconfig['associated-filter-rule-id'] = $a_nat[$id]['associated-filter-rule-id'];
$pconfig['nosync'] = isset($a_nat[$id]['nosync']);
if (!$pconfig['interface'])
$pconfig['interface'] = "wan";
@@ -181,24 +182,18 @@ if ($_POST) {
$natent['local-port'] = $_POST['localbeginport'];
$natent['interface'] = $_POST['interface'];
$natent['descr'] = $_POST['descr'];
+ $natent['associated-filter-rule-id'] = $_POST['associated-filter-rule-id'];
if($_POST['nosync'] == "yes")
$natent['nosync'] = true;
else
unset($natent['nosync']);
- if (isset($id) && $a_nat[$id])
- $a_nat[$id] = $natent;
- else {
- if (is_numeric($after))
- array_splice($a_nat, $after+1, 0, array($natent));
- else
- $a_nat[] = $natent;
- }
-
- mark_subsystem_dirty('natconf');
+ if ($_POST['autoadd'] || $natent['associated-filter-rule-id']>0) {
+ // If we had a previous rule associated with this NAT rule, delete that
+ if( $natent['associated-filter-rule-id'] > 0 )
+ delete_id($natent['associated-filter-rule-id'], $config['filter']['rule']);
- if ($_POST['autoadd']) {
/* auto-generate a matching firewall rule */
$filterent = array();
$filterent['interface'] = $_POST['interface'];
@@ -221,11 +216,30 @@ if ($_POST) {
*/
$filterent['descr'] = substr("NAT " . $_POST['descr'], 0, 59);
+ // If we had a previous rule association, update this rule with that ID so we don't lose association
+ if ($natent['associated-filter-rule-id'] > 0)
+ $filterent['id'] = $natent['associated-filter-rule-id'];
+ // Otherwise generate an ID for this rule, make sure the NAT entry is updated with the same ID
+ else
+ $natent['associated-filter-rule-id'] = $filterent['id'] = get_next_id($config['filter']['rule']);
+
$config['filter']['rule'][] = $filterent;
mark_subsystem_dirty('filter');
}
+ // Update NAT entry after creating/updating the firewall rule, so we have it's rule ID if one was created
+ if (isset($id) && $a_nat[$id])
+ $a_nat[$id] = $natent;
+ else {
+ if (is_numeric($after))
+ array_splice($a_nat, $after+1, 0, array($natent));
+ else
+ $a_nat[] = $natent;
+ }
+
+ mark_subsystem_dirty('natconf');
+
write_config();
header("Location: firewall_nat.php");
@@ -390,13 +404,30 @@ include("fbegin.inc"); ?>
HINT: This prevents the rule from automatically syncing to other CARP members.
</td>
</tr>
+ <?php if (isset($id) && $a_nat[$id] && !isset($_GET['dup'])): ?>
+ <tr>
+ <td width="22%" valign="top" class="vncell">Automatically update firewall rule with this rule</td>
+ <td width="78%" class="vtable">
+ <select name="associated-filter-rule-id">
+ <option value="">Do not automatically update</option>
+ <?php foreach ($config['filter']['rule'] as $filter_rule): ?>
+ <?php if (isset($filter_rule['id']) && $filter_rule['id']>0): ?>
+ <option value="<?php echo $filter_rule['id']; ?>"<?php if($filter_rule['id']==$pconfig['associated-filter-rule-id']) echo " SELECTED"; ?>>
+ <?php echo htmlspecialchars('Rule ' . $filter_rule['id'] . ' - ' . $filter_rule['descr']); ?>
+ </option>
+ <?php endif; ?>
+ <?php endforeach; ?>
+ </select>
+ </td>
+ </tr>
+ <?php endif; ?>
<?php if ((!(isset($id) && $a_nat[$id])) || (isset($_GET['dup']))): ?>
<tr>
<td width="22%" valign="top">&nbsp;</td>
<td width="78%">
<input name="autoadd" type="checkbox" id="autoadd" value="yes" CHECKED>
<strong>Auto-add a firewall rule to permit traffic through
- this NAT rule</strong></td>
+ this NAT rule and manage it with this NAT rule.</strong></td>
</tr><?php endif; ?>
<tr>
<td width="22%" valign="top">&nbsp;</td>
diff --git a/usr/local/www/firewall_rules.php b/usr/local/www/firewall_rules.php
index a4da1e0..9c8f979 100755
--- a/usr/local/www/firewall_rules.php
+++ b/usr/local/www/firewall_rules.php
@@ -230,15 +230,16 @@ echo "<script type=\"text/javascript\" language=\"javascript\" src=\"/javascript
<tr id="frheader">
<td width="3%" class="list">&nbsp;</td>
<td width="5%" class="list">&nbsp;</td>
+ <td width="3%" class="listhdrr">ID</td>
<td width="6%" class="listhdrr">Proto</td>
- <td width="15%" class="listhdrr">Source</td>
+ <td width="14%" class="listhdrr">Source</td>
<td width="7%" class="listhdrr">Port</td>
- <td width="15%" class="listhdrr">Destination</td>
+ <td width="14%" class="listhdrr">Destination</td>
<td width="7%" class="listhdrr">Port</td>
<td width="5%" class="listhdrr">Gateway</td>
<td width="10%" class="listhdrr">Queue</td>
<td width="5%" class="listhdrr">Schedule</td>
- <td width="22%" class="listhdr">Description</td>
+ <td width="21%" class="listhdr">Description</td>
<td width="10%" class="list">
<table border="0" cellspacing="0" cellpadding="1">
<tr>
@@ -267,7 +268,8 @@ echo "<script type=\"text/javascript\" language=\"javascript\" src=\"/javascript
<tr valign="top" id="frrfc1918">
<td width="3%" class="list">&nbsp;</td>
<td class="listt" align="center"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_block.gif" width="11" height="11" border="0"></td>
- <td class="listlr" style="background-color: #e0e0e0">*</td>
+ <td class="listlr" style="background-color: #e0e0e0"></td>
+ <td class="listr" style="background-color: #e0e0e0">*</td>
<td class="listr" style="background-color: #e0e0e0">RFC 1918 networks</td>
<td class="listr" style="background-color: #e0e0e0">*</td>
<td class="listr" style="background-color: #e0e0e0">*</td>
@@ -294,7 +296,8 @@ echo "<script type=\"text/javascript\" language=\"javascript\" src=\"/javascript
<tr valign="top" id="frrfc1918">
<td width="3%" class="list">&nbsp;</td>
<td class="listt" align="center"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_block.gif" width="11" height="11" border="0"></td>
- <td class="listlr" style="background-color: #e0e0e0">*</td>
+ <td class="listlr" style="background-color: #e0e0e0"></td>
+ <td class="listr" style="background-color: #e0e0e0">*</td>
<td class="listr" style="background-color: #e0e0e0">Reserved/not assigned by IANA</td>
<td class="listr" style="background-color: #e0e0e0">*</td>
<td class="listr" style="background-color: #e0e0e0">*</td>
@@ -518,6 +521,9 @@ echo "<script type=\"text/javascript\" language=\"javascript\" src=\"/javascript
}
?>
<td class="listlr" onClick="fr_toggle(<?=$nrules;?>)" id="frd<?=$nrules;?>" ondblclick="document.location='firewall_rules_edit.php?id=<?=$i;?>';">
+ <?=$textss;?><?php if (isset($filterent['id'])) echo $filterent['id']; else echo ""; ?><?=$textse;?>
+ </td>
+ <td class="listr" onClick="fr_toggle(<?=$nrules;?>)" id="frd<?=$nrules;?>" ondblclick="document.location='firewall_rules_edit.php?id=<?=$i;?>';">
<?=$textss;?><?php if (isset($filterent['protocol'])) echo strtoupper($filterent['protocol']); else echo "*"; ?><?=$textse;?>
</td>
<td class="listr" onClick="fr_toggle(<?=$nrules;?>)" id="frd<?=$nrules;?>" ondblclick="document.location='firewall_rules_edit.php?id=<?=$i;?>';">
@@ -584,6 +590,7 @@ echo "<script type=\"text/javascript\" language=\"javascript\" src=\"/javascript
<td class="list">&nbsp;</td>
<td class="list">&nbsp;</td>
<td class="list">&nbsp;</td>
+ <td class="list">&nbsp;</td>
<td class="list">&nbsp;</td>
<td class="list">&nbsp;</td>
<td class="list">&nbsp;</td>
diff --git a/usr/local/www/firewall_rules_edit.php b/usr/local/www/firewall_rules_edit.php
index 8844451..efd3a9c 100755
--- a/usr/local/www/firewall_rules_edit.php
+++ b/usr/local/www/firewall_rules_edit.php
@@ -71,6 +71,9 @@ if (isset($_GET['dup'])) {
if (isset($id) && $a_filter[$id]) {
$pconfig['interface'] = $a_filter[$id]['interface'];
+ if (isset($a_filter[$id]['id']))
+ $pconfig['ruleid'] = $a_filter[$id]['id'];
+
if (!isset($a_filter[$id]['type']))
$pconfig['type'] = "pass";
else
@@ -336,6 +339,8 @@ if ($_POST) {
else if ($dnpipe[0] == "?" && $pdnpipe[0] <> "?")
$input_errors[] = "You cannot select one queue and one virtual interface for IN and Out. both must be from the same type.";
}
+ if( !empty($_POST['ruleid']) && !ctype_digit($_POST['ruleid']))
+ $input_errors[] = 'ID must be an integer';
if($_POST['l7container'] && $_POST['l7container'] != "none") {
if(!($_POST['proto'] == "tcp" || $_POST['proto'] == "udp" || $_POST['proto'] == "tcp/udp"))
$input_errors[] = "You can only select a layer7 container for tcp and/or udp protocols";
@@ -345,6 +350,7 @@ if ($_POST) {
if (!$input_errors) {
$filterent = array();
+ $filterent['id'] = $_POST['ruleid']>0?$_POST['ruleid']:'';
$filterent['type'] = $_POST['type'];
if (isset($_POST['interface'] ))
$filterent['interface'] = $_POST['interface'];
@@ -492,6 +498,12 @@ include("head.inc");
<td colspan="2" valign="top" class="listtopic">Edit Firewall rule</td>
</tr>
<tr>
+ <td width="22%" valign="top" class="vncell">ID</td>
+ <td width="78%" class="vtable">
+ <input name="ruleid" value="<?=(isset($pconfig['ruleid'])&&$pconfig['ruleid']>0)?htmlspecialchars($pconfig['ruleid']):''?>">
+ </td>
+ </tr>
+ <tr>
<td width="22%" valign="top" class="vncellreq">Action</td>
<td width="78%" class="vtable">
<select name="type" class="formselect">
diff --git a/usr/local/www/themes/pfsense_ng/images/icons/icon_chain.png b/usr/local/www/themes/pfsense_ng/images/icons/icon_chain.png
new file mode 100644
index 0000000..cd9a7cc
--- /dev/null
+++ b/usr/local/www/themes/pfsense_ng/images/icons/icon_chain.png
Binary files differ
OpenPOWER on IntegriCloud