. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* pfSense_MODULE: filter */ ##|+PRIV ##|*IDENT=page-firewall-rules-edit ##|*NAME=Firewall: Rules: Edit page ##|*DESCR=Allow access to the 'Firewall: Rules: Edit' page. ##|*MATCH=firewall_rules_edit.php* ##|-PRIV require("guiconfig.inc"); require("filter.inc"); require("shaper.inc"); $specialsrcdst = explode(" ", "any pptp pppoe l2tp openvpn"); $ifdisp = get_configured_interface_with_descr(); foreach ($ifdisp as $kif => $kdescr) { $specialsrcdst[] = "{$kif}"; $specialsrcdst[] = "{$kif}ip"; } if (!is_array($config['filter']['rule'])) { $config['filter']['rule'] = array(); } filter_rules_sort(); $a_filter = &$config['filter']['rule']; $id = $_GET['id']; if (is_numeric($_POST['id'])) $id = $_POST['id']; $after = $_GET['after']; if (isset($_POST['after'])) $after = $_POST['after']; if (isset($_GET['dup'])) { $id = $_GET['dup']; $after = $_GET['dup']; } if (isset($id) && $a_filter[$id]) { $pconfig['interface'] = $a_filter[$id]['interface']; if (isset($a_filter[$id]['id'])) $pconfig['ruleid'] = $a_filter[$id]['id']; if (!isset($a_filter[$id]['type'])) $pconfig['type'] = "pass"; else $pconfig['type'] = $a_filter[$id]['type']; if (isset($a_filter[$id]['floating']) || $if == "FloatingRules") { $pconfig['floating'] = $a_filter[$id]['floating']; if (isset($a_filter[$id]['interface']) && $a_filter[$id]['interface'] <> "") $pconfig['interface'] = $a_filter[$id]['interface']; } if (isset($a_filter['floating'])) $pconfig['floating'] = "yes"; if (isset($a_filter[$id]['direction'])) $pconfig['direction'] = $a_filter[$id]['direction']; if (isset($a_filter[$id]['ipprotocol'])) $pconfig['ipprotocol'] = $a_filter[$id]['ipprotocol']; if (isset($a_filter[$id]['protocol'])) $pconfig['proto'] = $a_filter[$id]['protocol']; else $pconfig['proto'] = "any"; if ($a_filter[$id]['protocol'] == "icmp") $pconfig['icmptype'] = $a_filter[$id]['icmptype']; address_to_pconfig($a_filter[$id]['source'], $pconfig['src'], $pconfig['srcmask'], $pconfig['srcnot'], $pconfig['srcbeginport'], $pconfig['srcendport']); if($a_filter[$id]['os'] <> "") $pconfig['os'] = $a_filter[$id]['os']; address_to_pconfig($a_filter[$id]['destination'], $pconfig['dst'], $pconfig['dstmask'], $pconfig['dstnot'], $pconfig['dstbeginport'], $pconfig['dstendport']); if ($a_filter[$id]['dscp'] <> "") $pconfig['dscp'] = $a_filter[$id]['dscp']; $pconfig['disabled'] = isset($a_filter[$id]['disabled']); $pconfig['log'] = isset($a_filter[$id]['log']); $pconfig['descr'] = $a_filter[$id]['descr']; if (isset($a_filter[$id]['tcpflags_any'])) $pconfig['tcpflags_any'] = true; else { if (isset($a_filter[$id]['tcpflags1']) && $a_filter[$id]['tcpflags1'] <> "") $pconfig['tcpflags1'] = $a_filter[$id]['tcpflags1']; if (isset($a_filter[$id]['tcpflags2']) && $a_filter[$id]['tcpflags2'] <> "") $pconfig['tcpflags2'] = $a_filter[$id]['tcpflags2']; } if (isset($a_filter[$id]['tag']) && $a_filter[$id]['tag'] <> "") $pconfig['tag'] = $a_filter[$id]['tag']; if (isset($a_filter[$id]['tagged']) && $a_filter[$id]['tagged'] <> "") $pconfig['tagged'] = $a_filter[$id]['tagged']; if (isset($a_filter[$id]['quick']) && $a_filter[$id]['quick']) $pconfig['quick'] = $a_filter[$id]['quick']; if (isset($a_filter[$id]['allowopts'])) $pconfig['allowopts'] = true; if (isset($a_filter[$id]['disablereplyto'])) $pconfig['disablereplyto'] = true; /* advanced */ $pconfig['max'] = $a_filter[$id]['max']; $pconfig['max-src-nodes'] = $a_filter[$id]['max-src-nodes']; $pconfig['max-src-conn'] = $a_filter[$id]['max-src-conn']; $pconfig['max-src-states'] = $a_filter[$id]['max-src-states']; $pconfig['statetype'] = $a_filter[$id]['statetype']; $pconfig['statetimeout'] = $a_filter[$id]['statetimeout']; /* advanced - nosync */ $pconfig['nosync'] = isset($a_filter[$id]['nosync']); /* advanced - new connection per second banning*/ $pconfig['max-src-conn-rate'] = $a_filter[$id]['max-src-conn-rate']; $pconfig['max-src-conn-rates'] = $a_filter[$id]['max-src-conn-rates']; /* Multi-WAN next-hop support */ $pconfig['gateway'] = $a_filter[$id]['gateway']; /* Shaper support */ $pconfig['defaultqueue'] = $a_filter[$id]['defaultqueue']; $pconfig['ackqueue'] = $a_filter[$id]['ackqueue']; $pconfig['dnpipe'] = $a_filter[$id]['dnpipe']; $pconfig['pdnpipe'] = $a_filter[$id]['pdnpipe']; $pconfig['l7container'] = $a_filter[$id]['l7container']; //schedule support $pconfig['sched'] = $a_filter[$id]['sched']; $pconfig['vlanprio'] = $a_filter[$id]['vlanprio']; $pconfig['vlanprioset'] = $a_filter[$id]['vlanprioset']; if (!isset($_GET['dup'])) $pconfig['associated-rule-id'] = $a_filter[$id]['associated-rule-id']; } else { /* defaults */ if ($_GET['if']) $pconfig['interface'] = $_GET['if']; $pconfig['type'] = "pass"; $pconfig['src'] = "any"; $pconfig['dst'] = "any"; } /* Allow the FloatingRules to work */ $if = $pconfig['interface']; if (isset($_GET['dup'])) unset($id); read_altq_config(); /* XXX: */ $qlist =& get_unique_queue_list(); read_dummynet_config(); /* XXX: */ $dnqlist =& get_unique_dnqueue_list(); read_layer7_config(); $l7clist =& get_l7_unique_list(); if ($_POST) { unset($input_errors); if( isset($a_filter[$id]['associated-rule-id']) ) { $_POST['proto'] = $pconfig['proto']; if ($pconfig['proto'] == "icmp") $_POST['icmptype'] = $pconfig['icmptype']; } if (($_POST['ipprotocol'] <> "") && ($_POST['gateway'] <> "")) { $a_gatewaygroups = return_gateway_groups_array(); if(is_array($config['gateways']['gateway_group'])) { foreach($config['gateways']['gateway_group'] as $gw_group) { if($gw_group['name'] == $_POST['gateway']) { $family = $a_gatewaygroups[$_POST['gateway']]['ipprotocol']; if($_POST['ipprotocol'] == $family) { continue; } if(($_POST['ipprotocol'] == "inet46") && ($_POST['ipprotocol'] != $family)) { $input_errors[] = gettext("You can not assign a gateway to a rule that applies to IPv4 and IPv6"); } if(($_POST['ipprotocol'] == "inet6") && ($_POST['ipprotocol'] != $family)) { $input_errors[] = gettext("You can not assign a IPv4 gateway group on IPv6 Address Family rule"); } if(($_POST['ipprotocol'] == "inet") && ($_POST['ipprotocol'] != $family)) { $input_errors[] = gettext("You can not assign a IPv6 gateway group on IPv4 Address Family rule"); } } } } } if (($_POST['ipprotocol'] <> "") && ($_POST['gateway'] <> "") && (is_ipaddr(lookup_gateway_ip_by_name($_POST['gateway'])))) { if(($_POST['ipprotocol'] == "inet46") && ($_POST['gateway'] <> "")) { $input_errors[] = gettext("You can not assign a gateway to a rule that applies to IPv4 and IPv6"); } if(($_POST['ipprotocol'] == "inet6") && (!is_ipaddrv6(lookup_gateway_ip_by_name($_POST['gateway'])))) { $input_errors[] = gettext("You can not assign the IPv4 Gateway to a IPv6 Filter rule"); } if(($_POST['ipprotocol'] == "inet") && (!is_ipaddrv4(lookup_gateway_ip_by_name($_POST['gateway'])))) { $input_errors[] = gettext("You can not assign the IPv6 Gateway to a IPv4 Filter rule"); } } if (($_POST['proto'] != "tcp") && ($_POST['proto'] != "udp") && ($_POST['proto'] != "tcp/udp") && ($_POST['proto'] != "icmp")) { if($_POST['ipprotocol'] == "inet46") $input_errors[] = gettext("You can not assign a protocol other then ICMP, TCP, UDP or TCP/UDP to a rule that applies to IPv4 and IPv6"); } if (($_POST['proto'] == "icmp") && ($_POST['icmptype'] <> "")){ if($_POST['ipprotocol'] == "inet46") $input_errors[] = gettext("You can not assign a ICMP type to a rule that applies to IPv4 and IPv6"); } if (($_POST['proto'] != "tcp") && ($_POST['proto'] != "udp") && ($_POST['proto'] != "tcp/udp")) { $_POST['srcbeginport'] = 0; $_POST['srcendport'] = 0; $_POST['dstbeginport'] = 0; $_POST['dstendport'] = 0; } else { if ($_POST['srcbeginport_cust'] && !$_POST['srcbeginport']) $_POST['srcbeginport'] = trim($_POST['srcbeginport_cust']); if ($_POST['srcendport_cust'] && !$_POST['srcendport']) $_POST['srcendport'] = trim($_POST['srcendport_cust']); if ($_POST['srcbeginport'] == "any") { $_POST['srcbeginport'] = 0; $_POST['srcendport'] = 0; } else { if (!$_POST['srcendport']) $_POST['srcendport'] = $_POST['srcbeginport']; } if ($_POST['srcendport'] == "any") $_POST['srcendport'] = $_POST['srcbeginport']; if ($_POST['dstbeginport_cust'] && !$_POST['dstbeginport']) $_POST['dstbeginport'] = trim($_POST['dstbeginport_cust']); if ($_POST['dstendport_cust'] && !$_POST['dstendport']) $_POST['dstendport'] = trim($_POST['dstendport_cust']); if ($_POST['dstbeginport'] == "any") { $_POST['dstbeginport'] = 0; $_POST['dstendport'] = 0; } else { if (!$_POST['dstendport']) $_POST['dstendport'] = $_POST['dstbeginport']; } if ($_POST['dstendport'] == "any") $_POST['dstendport'] = $_POST['dstbeginport']; } if (is_specialnet($_POST['srctype'])) { $_POST['src'] = $_POST['srctype']; $_POST['srcmask'] = 0; } else if ($_POST['srctype'] == "single") { if (is_ipaddrv6($_POST['src'])) $_POST['srcmask'] = 128; else $_POST['srcmask'] = 32; } if (is_specialnet($_POST['dsttype'])) { $_POST['dst'] = $_POST['dsttype']; $_POST['dstmask'] = 0; } else if ($_POST['dsttype'] == "single") { if (is_ipaddrv6($_POST['dst'])) $_POST['dstmask'] = 128; else $_POST['dstmask'] = 32; } $pconfig = $_POST; /* input validation */ $reqdfields = explode(" ", "type proto"); if ( isset($a_filter[$id]['associated-rule-id'])===false ) { $reqdfields[] = "src"; $reqdfields[] = "dst"; } $reqdfieldsn = explode(",", "Type,Protocol"); if ( isset($a_filter[$id]['associated-rule-id'])===false ) { $reqdfieldsn[] = "Source"; $reqdfieldsn[] = "Destination"; } if($_POST['statetype'] == "modulate state" or $_POST['statetype'] == "synproxy state") { if( $_POST['proto'] != "tcp" ) $input_errors[] = sprintf(gettext("%s is only valid with protocol tcp."),$_POST['statetype']); if(($_POST['statetype'] == "synproxy state") && ($_POST['gateway'] != "")) $input_errors[] = sprintf(gettext("%s is only valid if the gateway is set to 'default'."),$_POST['statetype']); } if ( isset($a_filter[$id]['associated-rule-id'])===false && (!(is_specialnet($_POST['srctype']) || ($_POST['srctype'] == "single"))) ) { $reqdfields[] = "srcmask"; $reqdfieldsn[] = "Source bit count"; } if ( isset($a_filter[$id]['associated-rule-id'])===false && (!(is_specialnet($_POST['dsttype']) || ($_POST['dsttype'] == "single"))) ) { $reqdfields[] = "dstmask"; $reqdfieldsn[] = gettext("Destination bit count"); } do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); if (!$_POST['srcbeginport']) { $_POST['srcbeginport'] = 0; $_POST['srcendport'] = 0; } if (!$_POST['dstbeginport']) { $_POST['dstbeginport'] = 0; $_POST['dstendport'] = 0; } if ($_POST['srcbeginport'] && !is_portoralias($_POST['srcbeginport'])) $input_errors[] = sprintf(gettext("%s is not a valid start source port. It must be a port alias or integer between 1 and 65535."),$_POST['srcbeginposrt']); if ($_POST['srcendport'] && !is_portoralias($_POST['srcendport'])) $input_errors[] = sprintf(gettext("%s is not a valid end source port. It must be a port alias or integer between 1 and 65535."),$_POST['srcendport']); if ($_POST['dstbeginport'] && !is_portoralias($_POST['dstbeginport'])) $input_errors[] = sprintf(gettext("%s is not a valid start destination port. It must be a port alias or integer between 1 and 65535."),$_POST['dstbeginport']); if ($_POST['dstendport'] && !is_portoralias($_POST['dstendport'])) $input_errors[] = sprintf(gettext("%s is not a valid end destination port. It must be a port alias or integer between 1 and 65535."),$_POST['dstendport']); if ( !$_POST['srcbeginport_cust'] && $_POST['srcendport_cust']) if (is_alias($_POST['srcendport_cust'])) $input_errors[] = 'If you put port alias in Source port range to: field you must put the same port alias in from: field'; if ( $_POST['srcbeginport_cust'] && $_POST['srcendport_cust']){ if (is_alias($_POST['srcendport_cust']) && is_alias($_POST['srcendport_cust']) && $_POST['srcbeginport_cust'] != $_POST['srcendport_cust']) $input_errors[] = 'The same port alias must be used in Source port range from: and to: fields'; if ((is_alias($_POST['srcbeginport_cust']) && (!is_alias($_POST['srcendport_cust']) && $_POST['srcendport_cust']!='')) || ((!is_alias($_POST['srcbeginport_cust']) && $_POST['srcbeginport_cust']!='') && is_alias($_POST['srcendport_cust']))) $input_errors[] = 'You cannot specify numbers and port aliases at the same time in Source port range from: and to: field'; } if ( !$_POST['dstbeginport_cust'] && $_POST['dstendport_cust']) if (is_alias($_POST['dstendport_cust'])) $input_errors[] = 'If you put port alias in Destination port range to: field you must put the same port alias in from: field'; if ( $_POST['dstbeginport_cust'] && $_POST['dstendport_cust']){ if (is_alias($_POST['dstendport_cust']) && is_alias($_POST['dstendport_cust']) && $_POST['dstbeginport_cust'] != $_POST['dstendport_cust']) $input_errors[] = 'The same port alias must be used in Destination port range from: and to: fields'; if ((is_alias($_POST['dstbeginport_cust']) && (!is_alias($_POST['dstendport_cust']) && $_POST['dstendport_cust']!='')) || ((!is_alias($_POST['dstbeginport_cust']) && $_POST['dstbeginport_cust']!='') && is_alias($_POST['dstendport_cust']))) $input_errors[] = 'You cannot specify numbers and port aliases at the same time in Destination port range from: and to: field'; } if ($_POST['src']) $_POST['src'] = trim($_POST['src']); if ($_POST['dst']) $_POST['dst'] = trim($_POST['dst']); /* if user enters an alias and selects "network" then disallow. */ if($_POST['srctype'] == "network") { if(is_alias($_POST['src'])) $input_errors[] = gettext("You must specify single host or alias for alias entries."); } if($_POST['dsttype'] == "network") { if(is_alias($_POST['dst'])) $input_errors[] = gettext("You must specify single host or alias for alias entries."); } if (!is_specialnet($_POST['srctype'])) { if (($_POST['src'] && !is_ipaddroralias($_POST['src']))) { $input_errors[] = sprintf(gettext("%s is not a valid source IP address or alias."),$_POST['src']); } if (($_POST['srcmask'] && !is_numericint($_POST['srcmask']))) { $input_errors[] = gettext("A valid source bit count must be specified."); } } if (!is_specialnet($_POST['dsttype'])) { if (($_POST['dst'] && !is_ipaddroralias($_POST['dst']))) { $input_errors[] = sprintf(gettext("%s is not a valid destination IP address or alias."),$_POST['dst']); } if (($_POST['dstmask'] && !is_numericint($_POST['dstmask']))) { $input_errors[] = gettext("A valid destination bit count must be specified."); } } if((is_ipaddr($_POST['src']) && is_ipaddr($_POST['dst']))) { if(!validate_address_family($_POST['src'], $_POST['dst'])) $input_errors[] = sprintf(gettext("The Source IP address %s Address Family differs from the destination %s."), $_POST['src'], $_POST['dst']); if((is_ipaddrv6($_POST['src']) || is_ipaddrv6($_POST['dst'])) && ($_POST['ipprotocol'] == "inet")) $input_errors[] = gettext("You can not use IPv6 addresses in IPv4 rules."); if((is_ipaddrv4($_POST['src']) || is_ipaddrv4($_POST['dst'])) && ($_POST['ipprotocol'] == "inet6")) $input_errors[] = gettext("You can not use IPv4 addresses in IPv6 rules."); if((is_ipaddr($_POST['src']) || is_ipaddr($_POST['dst'])) && ($_POST['ipprotocol'] == "inet46")) $input_errors[] = gettext("You can not use a IPv4 or IPv6 address in combined IPv4 + IPv6 rules."); } if ($_POST['srcbeginport'] > $_POST['srcendport']) { /* swap */ $tmp = $_POST['srcendport']; $_POST['srcendport'] = $_POST['srcbeginport']; $_POST['srcbeginport'] = $tmp; } if ($_POST['dstbeginport'] > $_POST['dstendport']) { /* swap */ $tmp = $_POST['dstendport']; $_POST['dstendport'] = $_POST['dstbeginport']; $_POST['dstbeginport'] = $tmp; } if ($_POST['os']) if( $_POST['proto'] != "tcp" ) $input_errors[] = gettext("OS detection is only valid with protocol tcp."); if ($_POST['ackqueue'] && $_POST['ackqueue'] != "none") { if ($_POST['defaultqueue'] == "none" ) $input_errors[] = gettext("You have to select a queue when you select an acknowledge queue too."); else if ($_POST['ackqueue'] == $_POST['defaultqueue']) $input_errors[] = gettext("Acknowledge queue and Queue cannot be the same."); } if (isset($_POST['floating']) && $_POST['pdnpipe'] != "none" && (empty($_POST['direction']) || $_POST['direction'] == "any")) $input_errors[] = gettext("You can not use limiters in Floating rules without choosing a direction."); if (isset($_POST['floating']) && $_POST['gateway'] != "" && (empty($_POST['direction']) || $_POST['direction'] == "any")) $input_errors[] = gettext("You can not use gateways in Floating rules without choosing a direction."); if ($_POST['pdnpipe'] && $_POST['pdnpipe'] != "none") { if ($_POST['dnpipe'] == "none" ) $input_errors[] = gettext("You must select a queue for the In direction before selecting one for Out too."); else if ($_POST['pdnpipe'] == $_POST['dnpipe']) $input_errors[] = gettext("In and Out Queue cannot be the same."); else if ($dnqlist[$_POST['pdnpipe']][0] == "?" && $dnqlist[$_POST['dnpipe']][0] <> "?") $input_errors[] = gettext("You cannot select one queue and one virtual interface for IN and Out. both must be from the same type."); else if ($dnqlist[$_POST['dnpipe']][0] == "?" && $dnqlist[$_POST['pdnpipe']][0] <> "?") $input_errors[] = gettext("You cannot select one queue and one virtual interface for IN and Out. both must be from the same type."); if ($_POST['direction'] == "out" && empty($_POST['gateway'])) $input_errors[] = gettext("Please select a gateway, normaly the interface selected gateway, so the limiters work correctly"); } if( !empty($_POST['ruleid']) && !ctype_digit($_POST['ruleid'])) $input_errors[] = gettext('ID must be an integer'); if($_POST['l7container'] && $_POST['l7container'] != "none") { if(!($_POST['proto'] == "tcp" || $_POST['proto'] == "udp" || $_POST['proto'] == "tcp/udp")) $input_errors[] = gettext("You can only select a layer7 container for TCP and/or UDP protocols"); if ($_POST['type'] <> "pass") $input_errors[] = gettext("You can only select a layer7 container for Pass type rules."); } if (!$_POST['tcpflags_any']) { $settcpflags = array(); $outoftcpflags = array(); foreach ($tcpflags as $tcpflag) { if ($_POST['tcpflags1_' . $tcpflag] == "on") $settcpflags[] = $tcpflag; if ($_POST['tcpflags2_' . $tcpflag] == "on") $outoftcpflags[] = $tcpflag; } if (empty($outoftcpflags) && !empty($settcpflags)) $input_errors[] = gettext("If you specify TCP flags that should be set you should specify out of which flags as well."); } // Allow extending of the firewall edit page and include custom input validation pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/input_validation"); if (!$input_errors) { $filterent = array(); $filterent['id'] = $_POST['ruleid']>0?$_POST['ruleid']:''; $filterent['type'] = $_POST['type']; if (isset($_POST['interface'] )) $filterent['interface'] = $_POST['interface']; if (isset($_POST['ipprotocol'] )) $filterent['ipprotocol'] = $_POST['ipprotocol']; if ($_POST['tcpflags_any']) { $filterent['tcpflags_any'] = true; } else { $settcpflags = array(); $outoftcpflags = array(); foreach ($tcpflags as $tcpflag) { if ($_POST['tcpflags1_' . $tcpflag] == "on") $settcpflags[] = $tcpflag; if ($_POST['tcpflags2_' . $tcpflag] == "on") $outoftcpflags[] = $tcpflag; } if (!empty($outoftcpflags)) { $filterent['tcpflags2'] = join(",", $outoftcpflags); if (!empty($settcpflags)) $filterent['tcpflags1'] = join(",", $settcpflags); } } if (isset($_POST['tag'])) $filterent['tag'] = $_POST['tag']; if (isset($_POST['tagged'])) $filterent['tagged'] = $_POST['tagged']; if ($if == "FloatingRules" || isset($_POST['floating'])) { $filterent['direction'] = $_POST['direction']; if (isset($_POST['quick']) && $_POST['quick'] <> "") $filterent['quick'] = $_POST['quick']; $filterent['floating'] = "yes"; if (isset($_POST['interface']) && count($_POST['interface']) > 0) { $filterent['interface'] = implode(",", $_POST['interface']); } } /* Advanced options */ if ($_POST['allowopts'] == "yes") $filterent['allowopts'] = true; else unset($filterent['allowopts']); if ($_POST['disablereplyto'] == "yes") $filterent['disablereplyto'] = true; else unset($filterent['disablereplyto']); $filterent['max'] = $_POST['max']; $filterent['max-src-nodes'] = $_POST['max-src-nodes']; $filterent['max-src-conn'] = $_POST['max-src-conn']; $filterent['max-src-states'] = $_POST['max-src-states']; $filterent['statetimeout'] = $_POST['statetimeout']; $filterent['statetype'] = $_POST['statetype']; $filterent['os'] = $_POST['os']; /* Nosync directive - do not xmlrpc sync this item */ if($_POST['nosync'] <> "") $filterent['nosync'] = true; else unset($filterent['nosync']); /* unless both values are provided, unset the values - ticket #650 */ if($_POST['max-src-conn-rate'] <> "" and $_POST['max-src-conn-rates'] <> "") { $filterent['max-src-conn-rate'] = $_POST['max-src-conn-rate']; $filterent['max-src-conn-rates'] = $_POST['max-src-conn-rates']; } else { unset($filterent['max-src-conn-rate']); unset($filterent['max-src-conn-rates']); } if ($_POST['proto'] != "any") $filterent['protocol'] = $_POST['proto']; else unset($filterent['protocol']); if ($_POST['proto'] == "icmp" && $_POST['icmptype']) $filterent['icmptype'] = $_POST['icmptype']; else unset($filterent['icmptype']); pconfig_to_address($filterent['source'], $_POST['src'], $_POST['srcmask'], $_POST['srcnot'], $_POST['srcbeginport'], $_POST['srcendport']); pconfig_to_address($filterent['destination'], $_POST['dst'], $_POST['dstmask'], $_POST['dstnot'], $_POST['dstbeginport'], $_POST['dstendport']); if ($_POST['disabled']) $filterent['disabled'] = true; else unset($filterent['disabled']); if ($_POST['dscp']) $filterent['dscp'] = $_POST['dscp']; if ($_POST['log']) $filterent['log'] = true; else unset($filterent['log']); strncpy($filterent['descr'], $_POST['descr'], 52); if ($_POST['gateway'] != "") { $filterent['gateway'] = $_POST['gateway']; } if (isset($_POST['defaultqueue']) && $_POST['defaultqueue'] != "none") { $filterent['defaultqueue'] = $_POST['defaultqueue']; if (isset($_POST['ackqueue']) && $_POST['ackqueue'] != "none") $filterent['ackqueue'] = $_POST['ackqueue']; } if (isset($_POST['dnpipe']) && $_POST['dnpipe'] != "none") { $filterent['dnpipe'] = $_POST['dnpipe']; if (isset($_POST['pdnpipe']) && $_POST['pdnpipe'] != "none") $filterent['pdnpipe'] = $_POST['pdnpipe']; } if (isset($_POST['l7container']) && $_POST['l7container'] != "none") { $filterent['l7container'] = $_POST['l7container']; } if ($_POST['sched'] != "") { $filterent['sched'] = $_POST['sched']; } if ($_POST['vlanprio'] != "") { $filterent['vlanprio'] = $_POST['vlanprio']; } if ($_POST['vlanprioset'] != "") { $filterent['vlanprioset'] = $_POST['vlanprioset']; } // If we have an associated nat rule, make sure the source and destination doesn't change if( isset($a_filter[$id]['associated-rule-id']) ) { $filterent['interface'] = $a_filter[$id]['interface']; if (isset($a_filter[$id]['protocol'])) $filterent['protocol'] = $a_filter[$id]['protocol']; else if (isset($filterent['protocol'])) unset($filterent['protocol']); if ($a_filter[$id]['protocol'] == "icmp" && $a_filter[$id]['icmptype']) $filterent['icmptype'] = $a_filter[$id]['icmptype']; else if (isset($filterent['icmptype'])) unset($filterent['icmptype']); $filterent['source'] = $a_filter[$id]['source']; $filterent['destination'] = $a_filter[$id]['destination']; $filterent['associated-rule-id'] = $a_filter[$id]['associated-rule-id']; } // Allow extending of the firewall edit page and include custom input validation pfSense_handle_custom_code("/usr/local/pkg/firewall_rules/pre_write_config"); if (isset($id) && $a_filter[$id]) $a_filter[$id] = $filterent; else { if (is_numeric($after)) array_splice($a_filter, $after+1, 0, array($filterent)); else $a_filter[] = $filterent; } filter_rules_sort(); if (write_config()) mark_subsystem_dirty('filter'); if (isset($_POST['floating'])) header("Location: firewall_rules.php?if=FloatingRules"); else header("Location: firewall_rules.php?if=" . htmlspecialchars($_POST['interface'])); exit; } } $pgtitle = array(gettext("Firewall"),gettext("Rules"),gettext("Edit")); $shortcut_section = "firewall"; $closehead = false; $page_filename = "firewall_rules_edit.php"; include("head.inc"); ?>
"")): ?> "") $schedules[] = $schedule['name']; } } ?>


>
/>



$nat_rule ) { if( isset($nat_rule['associated-rule-id']) && $nat_rule['associated-rule-id']==$pconfig['associated-rule-id'] ) { echo "" . gettext("View the NAT rule") . "
"; break; } } } echo ""; if (!empty($pconfig['interface'])) echo ""; ?>
> $ifdesc) if(have_ruleint_access($ifent)) $interfaces[$ifent] = $ifdesc; if ($config['l2tp']['mode'] == "server") if(have_ruleint_access("l2tp")) $interfaces['l2tp'] = "L2TP VPN"; if ($config['pptpd']['mode'] == "server") if(have_ruleint_access("pptp")) $interfaces['pptp'] = "PPTP VPN"; if (is_pppoe_server_enabled() && have_ruleint_access("pppoe")) $interfaces['pppoe'] = "PPPoE VPN"; /* add ipsec interfaces */ if (isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable'])) if(have_ruleint_access("enc0")) $interfaces["enc0"] = "IPsec"; /* add openvpn/tun interfaces */ if ($config['openvpn']["openvpn-server"] || $config['openvpn']["openvpn-client"]) $interfaces["openvpn"] = "OpenVPN"; if (is_array($pconfig['interface'])) $pconfig['interface'] = implode(",", $pconfig['interface']); $selected_interfaces = explode(",", $pconfig['interface']); foreach ($interfaces as $iface => $ifacename): ?>



TCP  

name="srcnot" type="checkbox" id="srcnot" value="yes" >


  
   autocomplete='off' name="src" type="text" class="formfldalias ipv4v6" id="src" size="20" value=""> /

type="button" onClick="show_source_port_range()" value=""> -

name="dstnot" type="checkbox" id="dstnot" value="yes" >


  
   autocomplete='off' name="dst" type="text" class="formfldalias ipv4v6" id="dst" size="20" value=""> /
   autocomplete='off' class="formfldalias" name="dstbeginport_cust" id="dstbeginport_cust" type="text" size="5" value="">
autocomplete='off' class="formfldalias" name="dstendport_cust" id="dstendport_cust" type="text" size="5" value="">


>
( ).

   
  "> " onclick="history.back()">
 
> "> -
>  
> "> -
>
"> -
> "> -
>
"; $tcpflags1 = ""; $tcpflags2 = ""; foreach ($tcpflags as $tcpflag) { $header .= "\n"; $tcpflags1 .= "\n"; echo "{$tcpflags1}\n"; echo "{$tcpflags2}\n"; ?>
setout of" . strtoupper($tcpflag) . " {$header}

>
> "> -
>

> "> -
> >
> "> -
> {$vprio}\n"; else $opts .= "\n"; } ?>

> "> -
>

> "> -
>

> "> -
> /
".gettext("The Out selection is applied to traffic leaving the interface where the rule is created, In is applied to traffic coming into the chosen interface.")."
".gettext("If you are creating a floating rule, if the direction is In then the same rules apply, if the direction is out the selections are reverted Out is for incoming and In is for outgoing.");?>
> "> -
> /
> "> -
>
   
  "> " onclick="history.back()">