Project

General

Profile

« Previous | Next » 

Revision 0d8a8615

Added by Vinicius Coque about 15 years ago

Adding new fields to improved NAT port forward

View differences:

usr/local/www/firewall_nat_edit.php
44 44
require("filter.inc");
45 45
require("shaper.inc");
46 46

  
47
$specialsrcdst = explode(" ", "any pptp pppoe l2tp openvpn");
48
$ifdisp = get_configured_interface_with_descr();
49
foreach ($ifdisp as $kif => $kdescr) {
50
	$specialsrcdst[] = "{$kif}";
51
	$specialsrcdst[] = "{$kif}ip";
52
}
53

  
47 54
if (!is_array($config['nat']['rule'])) {
48 55
	$config['nat']['rule'] = array();
49 56
}
......
59 66
}
60 67

  
61 68
if (isset($id) && $a_nat[$id]) {
62
	$pconfig['extaddr'] = $a_nat[$id]['external-address'];
69
	$pconfig['disabled'] = isset($a_nat[$id]['disabled']);
70
	$pconfig['nordr'] = isset($a_nat[$id]['nordr']);
71

  
72
	address_to_pconfig($a_nat[$id]['source'], $pconfig['src'],
73
		$pconfig['srcmask'], $pconfig['srcnot'],
74
		$pconfig['srcbeginport'], $pconfig['srcendport']);
75

  
76
	address_to_pconfig($a_nat[$id]['destination'], $pconfig['dst'],
77
		$pconfig['dstmask'], $pconfig['dstnot'],
78
		$pconfig['dstbeginport'], $pconfig['dstendport']);
79

  
63 80
	$pconfig['proto'] = $a_nat[$id]['protocol'];
64
	list($pconfig['beginport'],$pconfig['endport']) = explode("-", $a_nat[$id]['external-port']);
65
	if(!$pconfig['endport'])
66
		$pconfig['endport'] = $pconfig['beginport'];
67 81
	$pconfig['localip'] = $a_nat[$id]['target'];
68 82
	$pconfig['localbeginport'] = $a_nat[$id]['local-port'];
69 83
	$pconfig['descr'] = $a_nat[$id]['descr'];
70 84
	$pconfig['interface'] = $a_nat[$id]['interface'];
71 85
	$pconfig['associated-rule-id'] = $a_nat[$id]['associated-rule-id'];
72 86
	$pconfig['nosync'] = isset($a_nat[$id]['nosync']);
87

  
73 88
	if (!$pconfig['interface'])
74 89
		$pconfig['interface'] = "wan";
75 90
} else {
76 91
	$pconfig['interface'] = "wan";
92
	$pconfig['src'] = "any";
93
	$pconfig['srcbeginport'] = "any";
94
	$pconfig['srcendport'] = "any";
77 95
}
78 96

  
79 97
if (isset($_GET['dup']))
80 98
	unset($id);
81 99

  
82 100
/*  run through $_POST items encoding HTML entties so that the user
83
 *  cannot think he is slick and perform a XSS attack on the unwilling 
101
 *  cannot think he is slick and perform a XSS attack on the unwilling
84 102
 */
85 103
foreach ($_POST as $key => $value) {
86 104
	$temp = $value;
87 105
	$newpost = htmlentities($temp);
88
	if($newpost <> $temp) 
89
		$input_errors[] = "Invalid characters detected ($temp).  Please remove invalid characters and save again.";		
106
	if($newpost <> $temp)
107
		$input_errors[] = "Invalid characters detected ($temp).  Please remove invalid characters and save again.";
90 108
}
91 109

  
92 110
if ($_POST) {
93 111

  
94
	if ($_POST['beginport_cust'] && !$_POST['beginport'])
95
		$_POST['beginport'] = $_POST['beginport_cust'];
96
	if ($_POST['endport_cust'] && !$_POST['endport'])
97
		$_POST['endport'] = $_POST['endport_cust'];
98
	if ($_POST['localbeginport_cust'] && !$_POST['localbeginport'])
99
		$_POST['localbeginport'] = $_POST['localbeginport_cust'];
112
	if(strtoupper($_POST['proto']) == "TCP" || strtoupper($_POST['proto']) == "UDP" || strtoupper($_POST['proto']) == "TCP/UDP") {
113
		if ($_POST['srcbeginport_cust'] && !$_POST['srcbeginport'])
114
			$_POST['srcbeginport'] = $_POST['srcbeginport_cust'];
115
		if ($_POST['srcendport_cust'] && !$_POST['srcendport'])
116
			$_POST['srcendport'] = $_POST['srcendport_cust'];
117

  
118
		if ($_POST['srcbeginport'] == "any") {
119
			$_POST['srcbeginport'] = 0;
120
			$_POST['srcendport'] = 0;
121
		} else {
122
			if (!$_POST['srcendport'])
123
				$_POST['srcendport'] = $_POST['srcbeginport'];
124
		}
125
		if ($_POST['srcendport'] == "any")
126
			$_POST['srcendport'] = $_POST['srcbeginport'];
127

  
128
		if ($_POST['dstbeginport_cust'] && !$_POST['dstbeginport'])
129
			$_POST['dstbeginport'] = $_POST['dstbeginport_cust'];
130
		if ($_POST['dstendport_cust'] && !$_POST['dstendport'])
131
			$_POST['dstendport'] = $_POST['dstendport_cust'];
132

  
133
		if ($_POST['dstbeginport'] == "any") {
134
			$_POST['dstbeginport'] = 0;
135
			$_POST['dstendport'] = 0;
136
		} else {
137
			if (!$_POST['dstendport'])
138
				$_POST['dstendport'] = $_POST['dstbeginport'];
139
		}
140
		if ($_POST['dstendport'] == "any")
141
			$_POST['dstendport'] = $_POST['dstbeginport'];
142

  
143
		if ($_POST['localbeginport_cust'] && !$_POST['localbeginport'])
144
			$_POST['localbeginport'] = $_POST['localbeginport_cust'];
145

  
146
		/* Make beginning port end port if not defined and endport is */
147
		if (!$_POST['srcbeginport'] && $_POST['srcendport'])
148
			$_POST['srcbeginport'] = $_POST['srcendport'];
149
		if (!$_POST['dstbeginport'] && $_POST['dstendport'])
150
			$_POST['dstbeginport'] = $_POST['dstendport'];
151
	} else {
152
		$_POST['srcbeginport'] = 0;
153
		$_POST['srcendport'] = 0;
154
		$_POST['dstbeginport'] = 0;
155
		$_POST['dstendport'] = 0;
156
	}
100 157

  
101
	if (!$_POST['endport'])
102
		$_POST['endport'] = $_POST['beginport'];
103
        /* Make beginning port end port if not defined and endport is */
104
        if (!$_POST['beginport'] && $_POST['endport'])
105
                $_POST['beginport'] = $_POST['endport'];
158
	if (is_specialnet($_POST['srctype'])) {
159
		$_POST['src'] = $_POST['srctype'];
160
		$_POST['srcmask'] = 0;
161
	} else if ($_POST['srctype'] == "single") {
162
		$_POST['srcmask'] = 32;
163
	}
164
	if (is_specialnet($_POST['dsttype'])) {
165
		$_POST['dst'] = $_POST['dsttype'];
166
		$_POST['dstmask'] = 0;
167
	}  else if ($_POST['dsttype'] == "single") {
168
		$_POST['dstmask'] = 32;
169
	}
106 170

  
107 171
	unset($input_errors);
108 172
	$pconfig = $_POST;
109 173

  
110 174
	/* input validation */
111 175
	if(strtoupper($_POST['proto']) == "TCP" or strtoupper($_POST['proto']) == "UDP" or strtoupper($_POST['proto']) == "TCP/UDP") {
112
		$reqdfields = explode(" ", "interface proto beginport endport localip localbeginport");
113
		$reqdfieldsn = explode(",", "Interface,Protocol,External port from,External port to,NAT IP,Local port");
176
		$reqdfields = explode(" ", "interface proto dstbeginport dstendport localip localbeginport");
177
		$reqdfieldsn = explode(",", "Interface,Protocol,Destination port from,Destination port to,NAT IP,Local port");
114 178
	} else {
115 179
		$reqdfields = explode(" ", "interface proto localip");
116 180
		$reqdfieldsn = explode(",", "Interface,Protocol,NAT IP");
......
118 182

  
119 183
	do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
120 184

  
185
	if (!$_POST['srcbeginport']) {
186
		$_POST['srcbeginport'] = 0;
187
		$_POST['srcendport'] = 0;
188
	}
189
	if (!$_POST['dstbeginport']) {
190
		$_POST['dstbeginport'] = 0;
191
		$_POST['dstendport'] = 0;
192
	}
193

  
121 194
	if (($_POST['localip'] && !is_ipaddroralias($_POST['localip']))) {
122 195
		$input_errors[] = "\"{$_POST['localip']}\" is not valid NAT IP address or host alias.";
123 196
	}
124 197

  
125
	/* only validate the ports if the protocol is TCP, UDP or TCP/UDP */
126
	if(strtoupper($_POST['proto']) == "TCP" or strtoupper($_POST['proto']) == "UDP" or strtoupper($_POST['proto']) == "TCP/UDP") {
198
	if ($_POST['srcbeginport'] && !is_portoralias($_POST['srcbeginport']))
199
		$input_errors[] = "{$_POST['srcbeginport']} is not a valid start source port. It must be a port alias or integer between 1 and 65535.";
200
	if ($_POST['srcendport'] && !is_portoralias($_POST['srcendport']))
201
		$input_errors[] = "{$_POST['srcendport']} is not a valid end source port. It must be a port alias or integer between 1 and 65535.";
202
	if ($_POST['dstbeginport'] && !is_portoralias($_POST['dstbeginport']))
203
		$input_errors[] = "{$_POST['dstbeginport']} is not a valid start destination port. It must be a port alias or integer between 1 and 65535.";
204
	if ($_POST['dstendport'] && !is_portoralias($_POST['dstendport']))
205
		$input_errors[] = "{$_POST['dstendport']} is not a valid end destination port. It must be a port alias or integer between 1 and 65535.";
206

  
207
	if ($_POST['localbeginport'] && !is_portoralias($_POST['localbeginport'])) {
208
		$input_errors[] = "{$_POST['localbeginport']} is not a valid local port. It must be a port alias or integer between 1 and 65535.";
209
	}
127 210

  
128
		if ($_POST['beginport'] && !is_portoralias($_POST['beginport'])) {
129
			$input_errors[] = "The start port must be an integer between 1 and 65535.";
130
		}
211
	/* if user enters an alias and selects "network" then disallow. */
212
	if($_POST['srctype'] == "network") {
213
		if(is_alias($_POST['src']))
214
			$input_errors[] = "You must specify single host or alias for alias entries.";
215
	}
216
	if($_POST['dsttype'] == "network") {
217
		if(is_alias($_POST['dst']))
218
			$input_errors[] = "You must specify single host or alias for alias entries.";
219
	}
131 220

  
132
		if ($_POST['endport'] && !is_portoralias($_POST['endport'])) {
133
			$input_errors[] = "The end port must be an integer between 1 and 65535.";
221
	if (!is_specialnet($_POST['srctype'])) {
222
		if (($_POST['src'] && !is_ipaddroralias($_POST['src']))) {
223
			$input_errors[] = "{$_POST['src']} is not a valid source IP address or alias.";
134 224
		}
135

  
136
		if ($_POST['localbeginport'] && !is_portoralias($_POST['localbeginport'])) {
137
			$input_errors[] = "The local port must be an integer between 1 and 65535.";
225
		if (($_POST['srcmask'] && !is_numericint($_POST['srcmask']))) {
226
			$input_errors[] = "A valid source bit count must be specified.";
138 227
		}
139

  
140
		if ($_POST['beginport'] > $_POST['endport']) {
141
			/* swap */
142
			$tmp = $_POST['endport'];
143
			$_POST['endport'] = $_POST['beginport'];
144
			$_POST['beginport'] = $tmp;
228
	}
229
	if (!is_specialnet($_POST['dsttype'])) {
230
		if (($_POST['dst'] && !is_ipaddroralias($_POST['dst']))) {
231
			$input_errors[] = "{$_POST['dst']} is not a valid destination IP address or alias.";
145 232
		}
146

  
147
		if (!$input_errors) {
148
			if (($_POST['endport'] - $_POST['beginport'] + $_POST['localbeginport']) > 65535)
149
				$input_errors[] = "The target port range must be an integer between 1 and 65535.";
233
		if (($_POST['dstmask'] && !is_numericint($_POST['dstmask']))) {
234
			$input_errors[] = "A valid destination bit count must be specified.";
150 235
		}
236
	}
237

  
238
	if ($_POST['srcbeginport'] > $_POST['srcendport']) {
239
		/* swap */
240
		$tmp = $_POST['srcendport'];
241
		$_POST['srcendport'] = $_POST['srcbeginport'];
242
		$_POST['srcbeginport'] = $tmp;
243
	}
244
	if ($_POST['dstbeginport'] > $_POST['dstendport']) {
245
		/* swap */
246
		$tmp = $_POST['dstendport'];
247
		$_POST['dstendport'] = $_POST['dstbeginport'];
248
		$_POST['dstbeginport'] = $tmp;
249
	}
151 250

  
251
	if (!$input_errors) {
252
		if (($_POST['dstendport'] - $_POST['dstbeginport'] + $_POST['localbeginport']) > 65535)
253
			$input_errors[] = "The target port range must be an integer between 1 and 65535.";
152 254
	}
153 255

  
154 256
	/* check for overlaps */
......
157 259
			continue;
158 260
		if ($natent['interface'] != $_POST['interface'])
159 261
			continue;
160
		if ($natent['external-address'] != $_POST['extaddr'])
262
		if ($natent['destination']['address'] != $_POST['dst'])
161 263
			continue;
162 264
		if (($natent['proto'] != $_POST['proto']) && ($natent['proto'] != "tcp/udp") && ($_POST['proto'] != "tcp/udp"))
163 265
			continue;
164 266

  
165
		list($begp,$endp) = explode("-", $natent['external-port']);
267
		list($begp,$endp) = explode("-", $natent['destination']['port']);
166 268
		if (!$endp)
167 269
			$endp = $begp;
168 270

  
169 271
		if (!(   (($_POST['beginport'] < $begp) && ($_POST['endport'] < $begp))
170 272
		      || (($_POST['beginport'] > $endp) && ($_POST['endport'] > $endp)))) {
171 273

  
172
			$input_errors[] = "The external port range overlaps with an existing entry.";
274
			$input_errors[] = "The destination port range overlaps with an existing entry.";
173 275
			break;
174 276
		}
175 277
	}
176 278

  
177 279
	if (!$input_errors) {
178 280
		$natent = array();
179
		if ($_POST['extaddr'])
180
			$natent['external-address'] = $_POST['extaddr'];
181
		$natent['protocol'] = $_POST['proto'];
182 281

  
183
		if ($_POST['beginport'] == $_POST['endport'])
184
			$natent['external-port'] = $_POST['beginport'];
185
		else
186
			$natent['external-port'] = $_POST['beginport'] . "-" . $_POST['endport'];
282
		$natent['disabled'] = isset($_POST['disabled']) ? true:false;
283
		$natent['nordr'] = isset($_POST['nordr']) ? true:false;
284

  
285
		pconfig_to_address($natent['source'], $_POST['src'],
286
			$_POST['srcmask'], $_POST['srcnot'],
287
			$_POST['srcbeginport'], $_POST['srcendport']);
288

  
289
		pconfig_to_address($natent['destination'], $_POST['dst'],
290
			$_POST['dstmask'], $_POST['dstnot'],
291
			$_POST['dstbeginport'], $_POST['dstendport']);
292

  
293
		$natent['protocol'] = $_POST['proto'];
187 294

  
188 295
		$natent['target'] = $_POST['localip'];
189 296
		$natent['local-port'] = $_POST['localbeginport'];
190 297
		$natent['interface'] = $_POST['interface'];
191 298
		$natent['descr'] = $_POST['descr'];
192 299
		$natent['associated-rule-id'] = $_POST['associated-rule-id'];
193
		
300

  
194 301
		if($_POST['filter-rule-association'] == "pass")
195 302
			$natent['associated-rule-id'] = "pass";
196 303

  
......
241 348
			if (!empty($natent['associated-rule-id'])) {
242 349
				$filterentid = get_id($natent['associated-rule-id'], $config['filter']['rule']);
243 350
				if ($filterentid == false) {
244
					$filterent['source']['any'] = "";
351
					pconfig_to_address($filterent['source'], $_POST['src'],
352
						$_POST['srcmask'], $_POST['srcnot'],
353
						$_POST['srcbeginport'], $_POST['srcendport']);
245 354
					$filterent['associated-rule-id'] = $natent['associated-rule-id'];
246 355
				} else
247 356
					$filterent =& $config['filter']['rule'][$filterentid];
248 357
			} else
249
				// Create the default source entry for new filter entries
250
				$filterent['source']['any'] = "";
358
				pconfig_to_address($filterent['source'], $_POST['src'],
359
					$_POST['srcmask'], $_POST['srcnot'],
360
					$_POST['srcbeginport'], $_POST['srcendport']);
251 361

  
252 362
			// Update interface, protocol and destination
253 363
			$filterent['interface'] = $_POST['interface'];
......
309 419
              <table width="100%" border="0" cellpadding="6" cellspacing="0">
310 420
				<tr>
311 421
					<td colspan="2" valign="top" class="listtopic">Edit NAT entry</td>
312
				</tr>	
313
				<tr>
422
				</tr>
423
		<tr>
424
			<td width="22%" valign="top" class="vncellreq">Disabled</td>
425
			<td width="78%" class="vtable">
426
				<input name="disabled" type="checkbox" id="disabled" value="yes" <?php if ($pconfig['disabled']) echo "checked"; ?>>
427
				<strong>Disable this rule</strong><br />
428
				<span class="vexpl">Set this option to disable this rule without removing it from the list.</span>
429
			</td>
430
		</tr>
431
                <tr>
432
                  <td width="22%" valign="top" class="vncell">No RDR (NOT)</td>
433
                  <td width="78%" class="vtable">
434
                    <input type="checkbox" name="nordr"<?php if($pconfig['nordr']) echo " CHECKED"; ?>>
435
                    <span class="vexpl">Enabling this option will disable NATing for the item and stop processing outgoing NAT rules.
436
                    <br>Hint: this option is rarely needed, don't use this unless you know what you're doing.</span>
437
                  </td>
438
                </tr>
439
		<tr>
314 440
                  <td width="22%" valign="top" class="vncellreq">Interface</td>
315 441
                  <td width="78%" class="vtable">
316 442
					<select name="interface" class="formselect">
317 443
						<?php
318
						
444

  
319 445
						$iflist = get_configured_interface_with_descr(false, true);
320
						foreach ($iflist as $if => $ifdesc) 
321
							if(have_ruleint_access($if)) 
446
						foreach ($iflist as $if => $ifdesc)
447
							if(have_ruleint_access($if))
322 448
								$interfaces[$if] = $ifdesc;
323
						
449

  
324 450
						if ($config['pptpd']['mode'] == "server")
325
							if(have_ruleint_access("pptp")) 
451
							if(have_ruleint_access("pptp"))
326 452
								$interfaces['pptp'] = "PPTP VPN";
327
						
453

  
328 454
						if ($config['pppoe']['mode'] == "server")
329
							if(have_ruleint_access("pppoe")) 
455
							if(have_ruleint_access("pppoe"))
330 456
								$interfaces['pppoe'] = "PPPoE VPN";
331
						
457

  
332 458
						/* add ipsec interfaces */
333 459
						if (isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable']))
334
							if(have_ruleint_access("enc0")) 
335
								$interfaces["enc0"] = "IPsec";						
460
							if(have_ruleint_access("enc0"))
461
								$interfaces["enc0"] = "IPsec";
336 462

  
337 463
						foreach ($interfaces as $iface => $ifacename): ?>
338 464
						<option value="<?=$iface;?>" <?php if ($iface == $pconfig['interface']) echo "selected"; ?>>
......
342 468
					</select><br>
343 469
                     <span class="vexpl">Choose which interface this rule applies to.<br>
344 470
                     Hint: in most cases, you'll want to use WAN here.</span></td>
345
                </tr>
346
			    <tr>
347
                  <td width="22%" valign="top" class="vncellreq">External address</td>
348
                  <td width="78%" class="vtable">
349
					<select name="extaddr" class="formselect">
350
						<option value="" <?php if (!$pconfig['extaddr']) echo "selected"; ?>>Interface address</option>
351
<?php					if (is_array($config['virtualip']['vip'])):
352
						foreach ($config['virtualip']['vip'] as $sn): 
353
							if ($sn['mode'] == "proxyarp" && $sn['type'] == "network"):
354
								$baseip = ip2long($sn['subnet']) & ip2long(gen_subnet_mask($sn['subnet_bits']));
355
								for ($i = $sn['subnet_bits']; $i <= 32; $i++): 
356
									$baseip = $baseip + 1;
357
									$snip = long2ip($baseip);
358
								?>
359
						<option value="<?=$snip;?>" <?php if ($snip == $pconfig['extaddr']) echo "selected"; ?>><?=htmlspecialchars("{$snip} ({$sn['descr']})");?></option>
360
								<?php endfor; 
361
							else: ?>
362
						<option value="<?=$sn['subnet'];?>" <?php if ($sn['subnet'] == $pconfig['extaddr']) echo "selected"; ?>><?=htmlspecialchars("{$sn['subnet']} ({$sn['descr']})");?></option>
363
						<?php endif; ?>
364
<?php					endforeach;
365
						endif; ?>
366
						<option value="any" <?php if($pconfig['extaddr'] == "any") echo "selected"; ?>>any</option>
367
					</select>
368
					<br />
369
                    <span class="vexpl">
370
					If you want this rule to apply to another IP address than the IP address of the interface chosen above,
371
					select it here (you need to define <a href="firewall_virtual_ip.php">Virtual IP</a> addresses on the first).  Also note that if you are trying to redirect connections on the LAN select the "any" option.</span></td>
372 471
                </tr>
373 472
                <tr>
374 473
                  <td width="22%" valign="top" class="vncellreq">Protocol</td>
......
381 480
                    this rule should match.<br>
382 481
                    Hint: in most cases, you should specify <em>TCP</em> &nbsp;here.</span></td>
383 482
                </tr>
384
                <tr>
385
                  <td width="22%" valign="top" class="vncellreq">External port
386
                    range </td>
387
                  <td width="78%" class="vtable">
388
                    <table border="0" cellspacing="0" cellpadding="0">
389
                      <tr>
390
                        <td>from:&nbsp;&nbsp;</td>
391
                        <td><select name="beginport" class="formselect" onChange="ext_rep_change(); ext_change(); check_for_aliases();">
392
                            <option value="">(other)</option>
393
                            <?php $bfound = 0; foreach ($wkports as $wkport => $wkportdesc): ?>
394
                            <option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['beginport']) {
395
								echo "selected";
396
								$bfound = 1;
397
							}?>>
398
							<?=htmlspecialchars($wkportdesc);?>
399
							</option>
400
                            <?php endforeach; ?>
401
                          </select> <input onChange="check_for_aliases();" autocomplete='off' class="formfldalias" name="beginport_cust" id="beginport_cust" type="text" size="5" value="<?php if (!$bfound) echo $pconfig['beginport']; ?>"></td>
402
                      </tr>
403
                      <tr>
404
                        <td>to:</td>
405
                        <td><select name="endport" class="formselect" onChange="ext_change(); check_for_aliases();">
406
                            <option value="">(other)</option>
407
                            <?php $bfound = 0; foreach ($wkports as $wkport => $wkportdesc): ?>
408
                            <option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['endport']) {
409
								echo "selected";
410
								$bfound = 1;
411
							}?>>
412
							<?=htmlspecialchars($wkportdesc);?>
413
							</option>
414
							<?php endforeach; ?>
415
                          </select> <input onChange="check_for_aliases();" class="formfldalias" autocomplete='off' name="endport_cust" id="endport_cust" type="text" size="5" value="<?php if (!$bfound) echo $pconfig['endport']; ?>"></td>
416
                      </tr>
417
                    </table>
418
                    <br> <span class="vexpl">Specify the port or port range on
419
                    the firewall's external address for this mapping.<br>
420
                    Hint: you can leave the <em>'to'</em> field empty if you only
421
                    want to map a single port</span></td>
422
                </tr>
483
		<tr id="showadvancedboxsrc" name="showadvancedboxsrc">
484
			<td width="22%" valign="top" class="vncellreq">Source</td>
485
			<td width="78%" class="vtable">
486
				<input type="button" onClick="show_source()" value="Advanced"></input> - Show source address and port range</a>
487
			</td>
488
		</tr>
489
		<tr style="display: none;" id="srctable" name="srctable">
490
			<td width="22%" valign="top" class="vncellreq">Source</td>
491
			<td width="78%" class="vtable">
492
				<input name="srcnot" type="checkbox" id="srcnot" value="yes" <?php if ($pconfig['srcnot']) echo "checked"; ?>>
493
				<strong>not</strong>
494
				<br />
495
				Use this option to invert the sense of the match.
496
				<br />
497
				<br />
498
				<table border="0" cellspacing="0" cellpadding="0">
499
					<tr>
500
						<td>Type:&nbsp;&nbsp;</td>
501
						<td>
502
							<select name="srctype" class="formselect" onChange="typesel_change()">
503
<?php
504
								$sel = is_specialnet($pconfig['src']); ?>
505
								<option value="any"     <?php if ($pconfig['src'] == "any") { echo "selected"; } ?>>any</option>
506
								<option value="single"  <?php if (($pconfig['srcmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>>Single host or alias</option>
507
								<option value="network" <?php if (!$sel) echo "selected"; ?>>Network</option>
508
								<?php if(have_ruleint_access("pptp")): ?>
509
								<option value="pptp"    <?php if ($pconfig['src'] == "pptp") { echo "selected"; } ?>>PPTP clients</option>
510
								<?php endif; ?>
511
								<?php if(have_ruleint_access("pppoe")): ?>
512
								<option value="pppoe"   <?php if ($pconfig['src'] == "pppoe") { echo "selected"; } ?>>PPPoE clients</option>
513
								<?php endif; ?>
514
								 <?php if(have_ruleint_access("l2tp")): ?>
515
                                                                <option value="l2tp"   <?php if ($pconfig['src'] == "l2tp") { echo "selected"; } ?>>L2TP clients</option>
516
                                                                <?php endif; ?>
517
<?php
518
								foreach ($ifdisp as $ifent => $ifdesc): ?>
519
								<?php if(have_ruleint_access($ifent)): ?>
520
									<option value="<?=$ifent;?>" <?php if ($pconfig['src'] == $ifent) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?> subnet</option>
521
									<option value="<?=$ifent;?>ip"<?php if ($pconfig['src'] ==  $ifent . "ip") { echo "selected"; } ?>>
522
										<?=$ifdesc?> address
523
									</option>
524
								<?php endif; ?>
525
<?php 							endforeach; ?>
526
							</select>
527
						</td>
528
					</tr>
529
					<tr>
530
						<td>Address:&nbsp;&nbsp;</td>
531
						<td>
532
							<input autocomplete='off' name="src" type="text" class="formfldalias" id="src" size="20" value="<?php if (!is_specialnet($pconfig['src'])) echo htmlspecialchars($pconfig['src']);?>"> /
533
							<select name="srcmask" class="formselect" id="srcmask">
534
<?php						for ($i = 31; $i > 0; $i--): ?>
535
								<option value="<?=$i;?>" <?php if ($i == $pconfig['srcmask']) echo "selected"; ?>><?=$i;?></option>
536
<?php 						endfor; ?>
537
							</select>
538
						</td>
539
					</tr>
540
				</table>
541
			</td>
542
		</tr>
543
		<tr style="display:none" id="sprtable" name="sprtable">
544
			<td width="22%" valign="top" class="vncellreq">Source port range</td>
545
			<td width="78%" class="vtable">
546
				<table border="0" cellspacing="0" cellpadding="0">
547
					<tr>
548
						<td>from:&nbsp;&nbsp;</td>
549
						<td>
550
							<select name="srcbeginport" class="formselect" onchange="src_rep_change();ext_change()">
551
								<option value="">(other)</option>
552
								<option value="any" <?php $bfound = 0; if ($pconfig['srcbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
553
<?php 							foreach ($wkports as $wkport => $wkportdesc): ?>
554
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcbeginport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
555
<?php 							endforeach; ?>
556
							</select>
557
							<input autocomplete='off' class="formfldalias" name="srcbeginport_cust" id="srcbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcbeginport']) echo $pconfig['srcbeginport']; ?>">
558
						</td>
559
					</tr>
560
					<tr>
561
						<td>to:</td>
562
						<td>
563
							<select name="srcendport" class="formselect" onchange="ext_change()">
564
								<option value="">(other)</option>
565
								<option value="any" <?php $bfound = 0; if ($pconfig['srcendport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
566
<?php							foreach ($wkports as $wkport => $wkportdesc): ?>
567
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
568
<?php							endforeach; ?>
569
							</select>
570
							<input autocomplete='off' class="formfldalias" name="srcendport_cust" id="srcendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcendport']) echo $pconfig['srcendport']; ?>">
571
						</td>
572
					</tr>
573
				</table>
574
				<br />
575
				<span class="vexpl">Specify the source port or port range for this rule. <b>This is almost never equal to the destination port range (and is usually &quot;any&quot;)</b>. <br /> Hint: you can leave the <em>'to'</em> field empty if you only want to filter a single port</span><br/>
576
			</td>
577
		</tr>
578
		<tr>
579
			<td width="22%" valign="top" class="vncellreq">Destination</td>
580
			<td width="78%" class="vtable">
581
				<input name="dstnot" type="checkbox" id="dstnot" value="yes" <?php if ($pconfig['dstnot']) echo "checked"; ?>>
582
				<strong>not</strong>
583
					<br />
584
				Use this option to invert the sense of the match.
585
					<br />
586
					<br />
587
				<table border="0" cellspacing="0" cellpadding="0">
588
					<tr>
589
						<td>Type:&nbsp;&nbsp;</td>
590
						<td>
591
							<select name="dsttype" class="formselect" onChange="typesel_change()">
592
<?php
593
								$sel = is_specialnet($pconfig['dst']); ?>
594
								<option value="any" <?php if ($pconfig['dst'] == "any") { echo "selected"; } ?>>any</option>
595
								<option value="single" <?php if (($pconfig['dstmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>>Single host or alias</option>
596
								<option value="network" <?php if (!$sel) echo "selected"; ?>>Network</option>
597
								<?php if(have_ruleint_access("pptp")): ?>
598
								<option value="pptp" <?php if ($pconfig['dst'] == "pptp") { echo "selected"; } ?>>PPTP clients</option>
599
								<?php endif; ?>
600
								<?php if(have_ruleint_access("pppoe")): ?>
601
								<option value="pppoe" <?php if ($pconfig['dst'] == "pppoe") { echo "selected"; } ?>>PPPoE clients</option>
602
								<?php endif; ?>
603
								<?php if(have_ruleint_access("l2tp")): ?>
604
                                                                <option value="l2tp" <?php if ($pconfig['dst'] == "l2tp") { echo "selected"; } ?>>L2TP clients</option>
605
                                                                <?php endif; ?>
606

  
607
<?php 							foreach ($ifdisp as $if => $ifdesc): ?>
608
								<?php if(have_ruleint_access($if)): ?>
609
									<option value="<?=$if;?>" <?php if ($pconfig['dst'] == $if) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?> subnet</option>
610
									<option value="<?=$if;?>ip"<?php if ($pconfig['dst'] == $if . "ip") { echo "selected"; } ?>>
611
										<?=$ifdesc;?> address
612
									</option>
613
								<?php endif; ?>
614
<?php 							endforeach; ?>
615
							</select>
616
						</td>
617
					</tr>
618
					<tr>
619
						<td>Address:&nbsp;&nbsp;</td>
620
						<td>
621
							<input name="dst" type="text" class="formfldalias" id="dst" size="20" value="<?php if (!is_specialnet($pconfig['dst'])) echo htmlspecialchars($pconfig['dst']);?>">
622
							/
623
							<select name="dstmask" class="formselect" id="dstmask">
624
<?php
625
							for ($i = 31; $i > 0; $i--): ?>
626
								<option value="<?=$i;?>" <?php if ($i == $pconfig['dstmask']) echo "selected"; ?>><?=$i;?></option>
627
<?php						endfor; ?>
628
							</select>
629
						</td>
630
					</tr>
631
				</table>
632
			</td>
633
		</tr>
634
		<tr id="dprtr" name="dprtr">
635
			<td width="22%" valign="top" class="vncellreq">Destination port range </td>
636
			<td width="78%" class="vtable">
637
				<table border="0" cellspacing="0" cellpadding="0">
638
					<tr>
639
						<td>from:&nbsp;&nbsp;</td>
640
						<td>
641
							<select name="dstbeginport" class="formselect" onchange="dst_rep_change();ext_change()">
642
								<option value="">(other)</option>
643
								<option value="any" <?php $bfound = 0; if ($pconfig['dstbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
644
<?php 							foreach ($wkports as $wkport => $wkportdesc): ?>
645
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstbeginport']) { echo "selected"; $bfound = 1; }?>><?=htmlspecialchars($wkportdesc);?></option>
646
<?php 							endforeach; ?>
647
							</select>
648
							<input autocomplete='off' class="formfldalias" name="dstbeginport_cust" id="dstbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstbeginport']) echo $pconfig['dstbeginport']; ?>">
649
						</td>
650
					</tr>
651
					<tr>
652
						<td>to:</td>
653
						<td>
654
							<select name="dstendport" class="formselect" onchange="ext_change()">
655
								<option value="">(other)</option>
656
								<option value="any" <?php $bfound = 0; if ($pconfig['dstendport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
657
<?php							foreach ($wkports as $wkport => $wkportdesc): ?>
658
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
659
<?php 							endforeach; ?>
660
							</select>
661
							<input autocomplete='off' class="formfldalias" name="dstendport_cust" id="dstendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstendport']) echo $pconfig['dstendport']; ?>">
662
						</td>
663
					</tr>
664
				</table>
665
				<br />
666
				<span class="vexpl">
667
					Specify the port or port range for the destination of the packet for this rule.
668
					<br />
669
					Hint: you can leave the <em>'to'</em> field empty if you only want to filter a single port
670
				</span>
671
			</td>
672
		</tr>
423 673
                <tr>
424 674
                  <td width="22%" valign="top" class="vncellreq">NAT IP</td>
425 675
                  <td width="78%" class="vtable">
......
470 720
						<select name="associated-rule-id">
471 721
							<option value="">None</option>
472 722
							<option value="pass" <?php if($pconfig['associated-rule-id'] == "pass") echo " SELECTED"; ?>>Pass</option>
473
							<?php 
723
							<?php
474 724
							$linkedrule = "";
475 725
							if (is_array($config['filter']['rule'])) {
476 726
								$filter_id = 0;
......
482 732
										$linkedrule = "<br /><a href=\"firewall_rules_edit.php?id={$filter_id}\">View the filter rule</a><br/>";
483 733
									}
484 734
									echo ">". htmlspecialchars('Rule ' . $filter_rule['descr']) . "</option>\n";
485
									
735

  
486 736
								}
487 737
								if ($filter_rule['interface'] == $pconfig['interface'])
488 738
									$filter_id++;
......
526 776
<script language="JavaScript">
527 777
<!--
528 778
	ext_change();
779
	typesel_change();
780
	proto_change();
529 781
//-->
530 782
</script>
531 783
<?php
usr/local/www/javascript/firewall_nat_edit/firewall_nat_edit.js
1 1
<!--
2
var portsenabled = 1;
3
var dstenabled = 1;
4
var showsource = 0;
5

  
2 6
function ext_change() {
3
	if (document.iform.beginport.selectedIndex == 0) {
4
		document.iform.beginport_cust.disabled = 0;
7
	if ((document.iform.srcbeginport.selectedIndex == 0) && portsenabled) {
8
		document.iform.srcbeginport_cust.disabled = 0;
9
	} else {
10
		document.iform.srcbeginport_cust.value = "";
11
		document.iform.srcbeginport_cust.disabled = 1;
12
	}
13
	if ((document.iform.srcendport.selectedIndex == 0) && portsenabled) {
14
		document.iform.srcendport_cust.disabled = 0;
15
	} else {
16
		document.iform.srcendport_cust.value = "";
17
		document.iform.srcendport_cust.disabled = 1;
18
	}
19
	if ((document.iform.dstbeginport.selectedIndex == 0) && portsenabled && dstenabled) {
20
		document.iform.dstbeginport_cust.disabled = 0;
5 21
	} else {
6
		document.iform.beginport_cust.value = "";
7
		document.iform.beginport_cust.disabled = 1;
22
		document.iform.dstbeginport_cust.value = "";
23
		document.iform.dstbeginport_cust.disabled = 1;
8 24
	}
9
	if (document.iform.endport.selectedIndex == 0) {
10
		document.iform.endport_cust.disabled = 0;
25
	if ((document.iform.dstendport.selectedIndex == 0) && portsenabled && dstenabled) {
26
		document.iform.dstendport_cust.disabled = 0;
11 27
	} else {
12
		document.iform.endport_cust.value = "";
13
		document.iform.endport_cust.disabled = 1;
28
		document.iform.dstendport_cust.value = "";
29
		document.iform.dstendport_cust.disabled = 1;
14 30
	}
15
	if (document.iform.localbeginport.selectedIndex == 0) {
16
		document.iform.localbeginport_cust.disabled = 0;
31

  
32
	if (!portsenabled) {
33
		document.iform.srcbeginport.disabled = 1;
34
		document.iform.srcendport.disabled = 1;
35
		document.iform.dstbeginport.disabled = 1;
36
		document.iform.dstendport.disabled = 1;
17 37
	} else {
18
		document.iform.localbeginport_cust.value = "";
19
		document.iform.localbeginport_cust.disabled = 1;
38
		document.iform.srcbeginport.disabled = 0;
39
		document.iform.srcendport.disabled = 0;
40
		if( dstenabled ) {
41
			document.iform.dstbeginport.disabled = 0;
42
			document.iform.dstendport.disabled = 0;
43
		}
20 44
	}
21 45
}
22 46

  
23
function ext_rep_change() {
24
	document.iform.endport.selectedIndex = document.iform.beginport.selectedIndex;
25
	document.iform.localbeginport.selectedIndex = document.iform.beginport.selectedIndex;
47
function show_source() {
48
	document.getElementById("sprtable").style.display = '';
49
	document.getElementById("srctable").style.display = '';
50
	document.getElementById("showadvancedboxsrc").style.display = 'none';
51
	showsource = 1;
26 52
}
27 53

  
28 54
function check_for_aliases() {
......
30 56
	 *  entry of Local port
31 57
	 */
32 58
	for(i=0; i<customarray.length; i++) {
33
		if(document.iform.beginport_cust.value == customarray[i]) {
34
			document.iform.endport_cust.value = customarray[i];
59
		if(document.iform.dstbeginport_cust.value == customarray[i]) {
60
			document.iform.dstendport_cust.value = customarray[i];
35 61
			document.iform.localbeginport_cust.value = customarray[i];
36
			document.iform.endport_cust.disabled = 1;
62
			document.iform.dstendport_cust.disabled = 1;
37 63
			document.iform.localbeginport.disabled = 1;
38 64
			document.iform.localbeginport_cust.disabled = 1;
39
			document.iform.endport_cust.disabled = 0;
65
			document.iform.dstendport_cust.disabled = 0;
40 66
			document.iform.localbeginport.disabled = 0;
41 67
			document.iform.localbeginport_cust.disabled = 0;
42 68
		}
43
		if(document.iform.beginport.value == customarray[i]) {
44
			document.iform.endport_cust.value = customarray[i];
69
		if(document.iform.dstbeginport.value == customarray[i]) {
70
			document.iform.dstendport_cust.value = customarray[i];
45 71
			document.iform.localbeginport_cust.value = customarray[i];
46
			document.iform.endport_cust.disabled = 1;
72
			document.iform.dstendport_cust.disabled = 1;
47 73
			document.iform.localbeginport.disabled = 1;
48 74
			document.iform.localbeginport_cust.disabled = 1;
49
			document.iform.endport_cust.disabled = 0;
75
			document.iform.dstendport_cust.disabled = 0;
50 76
			document.iform.localbeginport.disabled = 0;
51 77
			document.iform.localbeginport_cust.disabled = 0;
52 78
		}
53
		if(document.iform.endport_cust.value == customarray[i]) {
54
			document.iform.endport_cust.value = customarray[i];
79
		if(document.iform.dstendport_cust.value == customarray[i]) {
80
			document.iform.dstendport_cust.value = customarray[i];
55 81
			document.iform.localbeginport_cust.value = customarray[i];
56
			document.iform.endport_cust.disabled = 1;
82
			document.iform.dstendport_cust.disabled = 1;
57 83
			document.iform.localbeginport.disabled = 1;
58 84
			document.iform.localbeginport_cust.disabled = 1;
59
			document.iform.endport_cust.disabled = 0;
85
			document.iform.dstendport_cust.disabled = 0;
60 86
			document.iform.localbeginport.disabled = 0;
61 87
			document.iform.localbeginport_cust.disabled = 0;
62 88
		}
63
		if(document.iform.endport.value == customarray[i]) {
64
			document.iform.endport_cust.value = customarray[i];
89
		if(document.iform.dstendport.value == customarray[i]) {
90
			document.iform.dstendport_cust.value = customarray[i];
65 91
			document.iform.localbeginport_cust.value = customarray[i];
66
			document.iform.endport_cust.disabled = 1;
92
			document.iform.dstendport_cust.disabled = 1;
67 93
			document.iform.localbeginport.disabled = 1;
68 94
			document.iform.localbeginport_cust.disabled = 1;
69
			document.iform.endport_cust.disabled = 0;
95
			document.iform.dstendport_cust.disabled = 0;
70 96
			document.iform.localbeginport.disabled = 0;
71 97
			document.iform.localbeginport_cust.disabled = 0;
72 98
		}
......
74 100
}
75 101

  
76 102
function proto_change() {
77
	if(document.iform.proto.selectedIndex > 2) {
78
		document.iform.beginport_cust.disabled = 1;
79
		document.iform.endport_cust.disabled = 1;
80
		document.iform.beginport.disabled = 1;
81
		document.iform.endport.disabled = 1;
82
		document.iform.localbeginport_cust.disabled = 1;
83
		document.iform.localbeginport.disabled = 1;
103
	if (document.iform.proto.selectedIndex < 3) {
104
		portsenabled = 1;
105
	} else {
106
		portsenabled = 0;
107
	}
108

  
109
	if(document.iform.proto.selectedIndex >= 0 && document.iform.proto.selectedIndex <= 2) {
110
		document.getElementById("sprtable").style.display = showsource == 1 ? '':'none';
111
		document.getElementById("dprtr").style.display = '';
84 112
	} else {
85
		document.iform.beginport_cust.disabled = 0;
86
		document.iform.endport_cust.disabled = 0;
87
		document.iform.beginport.disabled = 0;
88
		document.iform.endport.disabled = 0;
89
		document.iform.localbeginport_cust.disabled = 0;
90
		document.iform.localbeginport.disabled = 0;
113
		document.getElementById("sprtable").style.display = 'none';
114
		document.getElementById("dprtr").style.display = 'none';
91 115
	}
92 116
}
117

  
118
function typesel_change() {
119
	switch (document.iform.srctype.selectedIndex) {
120
		case 1:	/* single */
121
			document.iform.src.disabled = 0;
122
			document.iform.srcmask.value = "";
123
			document.iform.srcmask.disabled = 1;
124
			break;
125
		case 2:	/* network */
126
			document.iform.src.disabled = 0;
127
			document.iform.srcmask.disabled = 0;
128
			break;
129
		default:
130
			document.iform.src.value = "";
131
			document.iform.src.disabled = 1;
132
			document.iform.srcmask.value = "";
133
			document.iform.srcmask.disabled = 1;
134
			break;
135
	}
136
	if( dstenabled )
137
	{
138
		switch (document.iform.dsttype.selectedIndex) {
139
			case 1:	/* single */
140
				document.iform.dst.disabled = 0;
141
				document.iform.dstmask.value = "";
142
				document.iform.dstmask.disabled = 1;
143
				break;
144
			case 2:	/* network */
145
				document.iform.dst.disabled = 0;
146
				document.iform.dstmask.disabled = 0;
147
				break;
148
			default:
149
				document.iform.dst.value = "";
150
				document.iform.dst.disabled = 1;
151
				document.iform.dstmask.value = "";
152
				document.iform.dstmask.disabled = 1;
153
				break;
154
		}
155
	}
156
}
157

  
158
function src_rep_change() {
159
	document.iform.srcendport.selectedIndex = document.iform.srcbeginport.selectedIndex;
160
}
161

  
162
function dst_rep_change() {
163
	document.iform.dstendport.selectedIndex = document.iform.dstbeginport.selectedIndex;
164
}
93 165
//-->

Also available in: Unified diff