| 44 |
44 |
require("filter.inc");
|
| 45 |
45 |
require("shaper.inc");
|
| 46 |
46 |
|
|
47 |
$specialsrcdst = explode(" ", "any pptp pppoe l2tp openvpn");
|
|
48 |
$ifdisp = get_configured_interface_with_descr();
|
|
49 |
foreach ($ifdisp as $kif => $kdescr) {
|
|
50 |
$specialsrcdst[] = "{$kif}";
|
|
51 |
$specialsrcdst[] = "{$kif}ip";
|
|
52 |
}
|
|
53 |
|
| 47 |
54 |
if (!is_array($config['nat']['rule'])) {
|
| 48 |
55 |
$config['nat']['rule'] = array();
|
| 49 |
56 |
}
|
| ... | ... | |
| 59 |
66 |
}
|
| 60 |
67 |
|
| 61 |
68 |
if (isset($id) && $a_nat[$id]) {
|
| 62 |
|
$pconfig['extaddr'] = $a_nat[$id]['external-address'];
|
|
69 |
$pconfig['disabled'] = isset($a_nat[$id]['disabled']);
|
|
70 |
$pconfig['nordr'] = isset($a_nat[$id]['nordr']);
|
|
71 |
|
|
72 |
address_to_pconfig($a_nat[$id]['source'], $pconfig['src'],
|
|
73 |
$pconfig['srcmask'], $pconfig['srcnot'],
|
|
74 |
$pconfig['srcbeginport'], $pconfig['srcendport']);
|
|
75 |
|
|
76 |
address_to_pconfig($a_nat[$id]['destination'], $pconfig['dst'],
|
|
77 |
$pconfig['dstmask'], $pconfig['dstnot'],
|
|
78 |
$pconfig['dstbeginport'], $pconfig['dstendport']);
|
|
79 |
|
| 63 |
80 |
$pconfig['proto'] = $a_nat[$id]['protocol'];
|
| 64 |
|
list($pconfig['beginport'],$pconfig['endport']) = explode("-", $a_nat[$id]['external-port']);
|
| 65 |
|
if(!$pconfig['endport'])
|
| 66 |
|
$pconfig['endport'] = $pconfig['beginport'];
|
| 67 |
81 |
$pconfig['localip'] = $a_nat[$id]['target'];
|
| 68 |
82 |
$pconfig['localbeginport'] = $a_nat[$id]['local-port'];
|
| 69 |
83 |
$pconfig['descr'] = $a_nat[$id]['descr'];
|
| 70 |
84 |
$pconfig['interface'] = $a_nat[$id]['interface'];
|
| 71 |
85 |
$pconfig['associated-rule-id'] = $a_nat[$id]['associated-rule-id'];
|
| 72 |
86 |
$pconfig['nosync'] = isset($a_nat[$id]['nosync']);
|
|
87 |
|
| 73 |
88 |
if (!$pconfig['interface'])
|
| 74 |
89 |
$pconfig['interface'] = "wan";
|
| 75 |
90 |
} else {
|
| 76 |
91 |
$pconfig['interface'] = "wan";
|
|
92 |
$pconfig['src'] = "any";
|
|
93 |
$pconfig['srcbeginport'] = "any";
|
|
94 |
$pconfig['srcendport'] = "any";
|
| 77 |
95 |
}
|
| 78 |
96 |
|
| 79 |
97 |
if (isset($_GET['dup']))
|
| 80 |
98 |
unset($id);
|
| 81 |
99 |
|
| 82 |
100 |
/* run through $_POST items encoding HTML entties so that the user
|
| 83 |
|
* cannot think he is slick and perform a XSS attack on the unwilling
|
|
101 |
* cannot think he is slick and perform a XSS attack on the unwilling
|
| 84 |
102 |
*/
|
| 85 |
103 |
foreach ($_POST as $key => $value) {
|
| 86 |
104 |
$temp = $value;
|
| 87 |
105 |
$newpost = htmlentities($temp);
|
| 88 |
|
if($newpost <> $temp)
|
| 89 |
|
$input_errors[] = "Invalid characters detected ($temp). Please remove invalid characters and save again.";
|
|
106 |
if($newpost <> $temp)
|
|
107 |
$input_errors[] = "Invalid characters detected ($temp). Please remove invalid characters and save again.";
|
| 90 |
108 |
}
|
| 91 |
109 |
|
| 92 |
110 |
if ($_POST) {
|
| 93 |
111 |
|
| 94 |
|
if ($_POST['beginport_cust'] && !$_POST['beginport'])
|
| 95 |
|
$_POST['beginport'] = $_POST['beginport_cust'];
|
| 96 |
|
if ($_POST['endport_cust'] && !$_POST['endport'])
|
| 97 |
|
$_POST['endport'] = $_POST['endport_cust'];
|
| 98 |
|
if ($_POST['localbeginport_cust'] && !$_POST['localbeginport'])
|
| 99 |
|
$_POST['localbeginport'] = $_POST['localbeginport_cust'];
|
|
112 |
if(strtoupper($_POST['proto']) == "TCP" || strtoupper($_POST['proto']) == "UDP" || strtoupper($_POST['proto']) == "TCP/UDP") {
|
|
113 |
if ($_POST['srcbeginport_cust'] && !$_POST['srcbeginport'])
|
|
114 |
$_POST['srcbeginport'] = $_POST['srcbeginport_cust'];
|
|
115 |
if ($_POST['srcendport_cust'] && !$_POST['srcendport'])
|
|
116 |
$_POST['srcendport'] = $_POST['srcendport_cust'];
|
|
117 |
|
|
118 |
if ($_POST['srcbeginport'] == "any") {
|
|
119 |
$_POST['srcbeginport'] = 0;
|
|
120 |
$_POST['srcendport'] = 0;
|
|
121 |
} else {
|
|
122 |
if (!$_POST['srcendport'])
|
|
123 |
$_POST['srcendport'] = $_POST['srcbeginport'];
|
|
124 |
}
|
|
125 |
if ($_POST['srcendport'] == "any")
|
|
126 |
$_POST['srcendport'] = $_POST['srcbeginport'];
|
|
127 |
|
|
128 |
if ($_POST['dstbeginport_cust'] && !$_POST['dstbeginport'])
|
|
129 |
$_POST['dstbeginport'] = $_POST['dstbeginport_cust'];
|
|
130 |
if ($_POST['dstendport_cust'] && !$_POST['dstendport'])
|
|
131 |
$_POST['dstendport'] = $_POST['dstendport_cust'];
|
|
132 |
|
|
133 |
if ($_POST['dstbeginport'] == "any") {
|
|
134 |
$_POST['dstbeginport'] = 0;
|
|
135 |
$_POST['dstendport'] = 0;
|
|
136 |
} else {
|
|
137 |
if (!$_POST['dstendport'])
|
|
138 |
$_POST['dstendport'] = $_POST['dstbeginport'];
|
|
139 |
}
|
|
140 |
if ($_POST['dstendport'] == "any")
|
|
141 |
$_POST['dstendport'] = $_POST['dstbeginport'];
|
|
142 |
|
|
143 |
if ($_POST['localbeginport_cust'] && !$_POST['localbeginport'])
|
|
144 |
$_POST['localbeginport'] = $_POST['localbeginport_cust'];
|
|
145 |
|
|
146 |
/* Make beginning port end port if not defined and endport is */
|
|
147 |
if (!$_POST['srcbeginport'] && $_POST['srcendport'])
|
|
148 |
$_POST['srcbeginport'] = $_POST['srcendport'];
|
|
149 |
if (!$_POST['dstbeginport'] && $_POST['dstendport'])
|
|
150 |
$_POST['dstbeginport'] = $_POST['dstendport'];
|
|
151 |
} else {
|
|
152 |
$_POST['srcbeginport'] = 0;
|
|
153 |
$_POST['srcendport'] = 0;
|
|
154 |
$_POST['dstbeginport'] = 0;
|
|
155 |
$_POST['dstendport'] = 0;
|
|
156 |
}
|
| 100 |
157 |
|
| 101 |
|
if (!$_POST['endport'])
|
| 102 |
|
$_POST['endport'] = $_POST['beginport'];
|
| 103 |
|
/* Make beginning port end port if not defined and endport is */
|
| 104 |
|
if (!$_POST['beginport'] && $_POST['endport'])
|
| 105 |
|
$_POST['beginport'] = $_POST['endport'];
|
|
158 |
if (is_specialnet($_POST['srctype'])) {
|
|
159 |
$_POST['src'] = $_POST['srctype'];
|
|
160 |
$_POST['srcmask'] = 0;
|
|
161 |
} else if ($_POST['srctype'] == "single") {
|
|
162 |
$_POST['srcmask'] = 32;
|
|
163 |
}
|
|
164 |
if (is_specialnet($_POST['dsttype'])) {
|
|
165 |
$_POST['dst'] = $_POST['dsttype'];
|
|
166 |
$_POST['dstmask'] = 0;
|
|
167 |
} else if ($_POST['dsttype'] == "single") {
|
|
168 |
$_POST['dstmask'] = 32;
|
|
169 |
}
|
| 106 |
170 |
|
| 107 |
171 |
unset($input_errors);
|
| 108 |
172 |
$pconfig = $_POST;
|
| 109 |
173 |
|
| 110 |
174 |
/* input validation */
|
| 111 |
175 |
if(strtoupper($_POST['proto']) == "TCP" or strtoupper($_POST['proto']) == "UDP" or strtoupper($_POST['proto']) == "TCP/UDP") {
|
| 112 |
|
$reqdfields = explode(" ", "interface proto beginport endport localip localbeginport");
|
| 113 |
|
$reqdfieldsn = explode(",", "Interface,Protocol,External port from,External port to,NAT IP,Local port");
|
|
176 |
$reqdfields = explode(" ", "interface proto dstbeginport dstendport localip localbeginport");
|
|
177 |
$reqdfieldsn = explode(",", "Interface,Protocol,Destination port from,Destination port to,NAT IP,Local port");
|
| 114 |
178 |
} else {
|
| 115 |
179 |
$reqdfields = explode(" ", "interface proto localip");
|
| 116 |
180 |
$reqdfieldsn = explode(",", "Interface,Protocol,NAT IP");
|
| ... | ... | |
| 118 |
182 |
|
| 119 |
183 |
do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
|
| 120 |
184 |
|
|
185 |
if (!$_POST['srcbeginport']) {
|
|
186 |
$_POST['srcbeginport'] = 0;
|
|
187 |
$_POST['srcendport'] = 0;
|
|
188 |
}
|
|
189 |
if (!$_POST['dstbeginport']) {
|
|
190 |
$_POST['dstbeginport'] = 0;
|
|
191 |
$_POST['dstendport'] = 0;
|
|
192 |
}
|
|
193 |
|
| 121 |
194 |
if (($_POST['localip'] && !is_ipaddroralias($_POST['localip']))) {
|
| 122 |
195 |
$input_errors[] = "\"{$_POST['localip']}\" is not valid NAT IP address or host alias.";
|
| 123 |
196 |
}
|
| 124 |
197 |
|
| 125 |
|
/* only validate the ports if the protocol is TCP, UDP or TCP/UDP */
|
| 126 |
|
if(strtoupper($_POST['proto']) == "TCP" or strtoupper($_POST['proto']) == "UDP" or strtoupper($_POST['proto']) == "TCP/UDP") {
|
|
198 |
if ($_POST['srcbeginport'] && !is_portoralias($_POST['srcbeginport']))
|
|
199 |
$input_errors[] = "{$_POST['srcbeginport']} is not a valid start source port. It must be a port alias or integer between 1 and 65535.";
|
|
200 |
if ($_POST['srcendport'] && !is_portoralias($_POST['srcendport']))
|
|
201 |
$input_errors[] = "{$_POST['srcendport']} is not a valid end source port. It must be a port alias or integer between 1 and 65535.";
|
|
202 |
if ($_POST['dstbeginport'] && !is_portoralias($_POST['dstbeginport']))
|
|
203 |
$input_errors[] = "{$_POST['dstbeginport']} is not a valid start destination port. It must be a port alias or integer between 1 and 65535.";
|
|
204 |
if ($_POST['dstendport'] && !is_portoralias($_POST['dstendport']))
|
|
205 |
$input_errors[] = "{$_POST['dstendport']} is not a valid end destination port. It must be a port alias or integer between 1 and 65535.";
|
|
206 |
|
|
207 |
if ($_POST['localbeginport'] && !is_portoralias($_POST['localbeginport'])) {
|
|
208 |
$input_errors[] = "{$_POST['localbeginport']} is not a valid local port. It must be a port alias or integer between 1 and 65535.";
|
|
209 |
}
|
| 127 |
210 |
|
| 128 |
|
if ($_POST['beginport'] && !is_portoralias($_POST['beginport'])) {
|
| 129 |
|
$input_errors[] = "The start port must be an integer between 1 and 65535.";
|
| 130 |
|
}
|
|
211 |
/* if user enters an alias and selects "network" then disallow. */
|
|
212 |
if($_POST['srctype'] == "network") {
|
|
213 |
if(is_alias($_POST['src']))
|
|
214 |
$input_errors[] = "You must specify single host or alias for alias entries.";
|
|
215 |
}
|
|
216 |
if($_POST['dsttype'] == "network") {
|
|
217 |
if(is_alias($_POST['dst']))
|
|
218 |
$input_errors[] = "You must specify single host or alias for alias entries.";
|
|
219 |
}
|
| 131 |
220 |
|
| 132 |
|
if ($_POST['endport'] && !is_portoralias($_POST['endport'])) {
|
| 133 |
|
$input_errors[] = "The end port must be an integer between 1 and 65535.";
|
|
221 |
if (!is_specialnet($_POST['srctype'])) {
|
|
222 |
if (($_POST['src'] && !is_ipaddroralias($_POST['src']))) {
|
|
223 |
$input_errors[] = "{$_POST['src']} is not a valid source IP address or alias.";
|
| 134 |
224 |
}
|
| 135 |
|
|
| 136 |
|
if ($_POST['localbeginport'] && !is_portoralias($_POST['localbeginport'])) {
|
| 137 |
|
$input_errors[] = "The local port must be an integer between 1 and 65535.";
|
|
225 |
if (($_POST['srcmask'] && !is_numericint($_POST['srcmask']))) {
|
|
226 |
$input_errors[] = "A valid source bit count must be specified.";
|
| 138 |
227 |
}
|
| 139 |
|
|
| 140 |
|
if ($_POST['beginport'] > $_POST['endport']) {
|
| 141 |
|
/* swap */
|
| 142 |
|
$tmp = $_POST['endport'];
|
| 143 |
|
$_POST['endport'] = $_POST['beginport'];
|
| 144 |
|
$_POST['beginport'] = $tmp;
|
|
228 |
}
|
|
229 |
if (!is_specialnet($_POST['dsttype'])) {
|
|
230 |
if (($_POST['dst'] && !is_ipaddroralias($_POST['dst']))) {
|
|
231 |
$input_errors[] = "{$_POST['dst']} is not a valid destination IP address or alias.";
|
| 145 |
232 |
}
|
| 146 |
|
|
| 147 |
|
if (!$input_errors) {
|
| 148 |
|
if (($_POST['endport'] - $_POST['beginport'] + $_POST['localbeginport']) > 65535)
|
| 149 |
|
$input_errors[] = "The target port range must be an integer between 1 and 65535.";
|
|
233 |
if (($_POST['dstmask'] && !is_numericint($_POST['dstmask']))) {
|
|
234 |
$input_errors[] = "A valid destination bit count must be specified.";
|
| 150 |
235 |
}
|
|
236 |
}
|
|
237 |
|
|
238 |
if ($_POST['srcbeginport'] > $_POST['srcendport']) {
|
|
239 |
/* swap */
|
|
240 |
$tmp = $_POST['srcendport'];
|
|
241 |
$_POST['srcendport'] = $_POST['srcbeginport'];
|
|
242 |
$_POST['srcbeginport'] = $tmp;
|
|
243 |
}
|
|
244 |
if ($_POST['dstbeginport'] > $_POST['dstendport']) {
|
|
245 |
/* swap */
|
|
246 |
$tmp = $_POST['dstendport'];
|
|
247 |
$_POST['dstendport'] = $_POST['dstbeginport'];
|
|
248 |
$_POST['dstbeginport'] = $tmp;
|
|
249 |
}
|
| 151 |
250 |
|
|
251 |
if (!$input_errors) {
|
|
252 |
if (($_POST['dstendport'] - $_POST['dstbeginport'] + $_POST['localbeginport']) > 65535)
|
|
253 |
$input_errors[] = "The target port range must be an integer between 1 and 65535.";
|
| 152 |
254 |
}
|
| 153 |
255 |
|
| 154 |
256 |
/* check for overlaps */
|
| ... | ... | |
| 157 |
259 |
continue;
|
| 158 |
260 |
if ($natent['interface'] != $_POST['interface'])
|
| 159 |
261 |
continue;
|
| 160 |
|
if ($natent['external-address'] != $_POST['extaddr'])
|
|
262 |
if ($natent['destination']['address'] != $_POST['dst'])
|
| 161 |
263 |
continue;
|
| 162 |
264 |
if (($natent['proto'] != $_POST['proto']) && ($natent['proto'] != "tcp/udp") && ($_POST['proto'] != "tcp/udp"))
|
| 163 |
265 |
continue;
|
| 164 |
266 |
|
| 165 |
|
list($begp,$endp) = explode("-", $natent['external-port']);
|
|
267 |
list($begp,$endp) = explode("-", $natent['destination']['port']);
|
| 166 |
268 |
if (!$endp)
|
| 167 |
269 |
$endp = $begp;
|
| 168 |
270 |
|
| 169 |
271 |
if (!( (($_POST['beginport'] < $begp) && ($_POST['endport'] < $begp))
|
| 170 |
272 |
|| (($_POST['beginport'] > $endp) && ($_POST['endport'] > $endp)))) {
|
| 171 |
273 |
|
| 172 |
|
$input_errors[] = "The external port range overlaps with an existing entry.";
|
|
274 |
$input_errors[] = "The destination port range overlaps with an existing entry.";
|
| 173 |
275 |
break;
|
| 174 |
276 |
}
|
| 175 |
277 |
}
|
| 176 |
278 |
|
| 177 |
279 |
if (!$input_errors) {
|
| 178 |
280 |
$natent = array();
|
| 179 |
|
if ($_POST['extaddr'])
|
| 180 |
|
$natent['external-address'] = $_POST['extaddr'];
|
| 181 |
|
$natent['protocol'] = $_POST['proto'];
|
| 182 |
281 |
|
| 183 |
|
if ($_POST['beginport'] == $_POST['endport'])
|
| 184 |
|
$natent['external-port'] = $_POST['beginport'];
|
| 185 |
|
else
|
| 186 |
|
$natent['external-port'] = $_POST['beginport'] . "-" . $_POST['endport'];
|
|
282 |
$natent['disabled'] = isset($_POST['disabled']) ? true:false;
|
|
283 |
$natent['nordr'] = isset($_POST['nordr']) ? true:false;
|
|
284 |
|
|
285 |
pconfig_to_address($natent['source'], $_POST['src'],
|
|
286 |
$_POST['srcmask'], $_POST['srcnot'],
|
|
287 |
$_POST['srcbeginport'], $_POST['srcendport']);
|
|
288 |
|
|
289 |
pconfig_to_address($natent['destination'], $_POST['dst'],
|
|
290 |
$_POST['dstmask'], $_POST['dstnot'],
|
|
291 |
$_POST['dstbeginport'], $_POST['dstendport']);
|
|
292 |
|
|
293 |
$natent['protocol'] = $_POST['proto'];
|
| 187 |
294 |
|
| 188 |
295 |
$natent['target'] = $_POST['localip'];
|
| 189 |
296 |
$natent['local-port'] = $_POST['localbeginport'];
|
| 190 |
297 |
$natent['interface'] = $_POST['interface'];
|
| 191 |
298 |
$natent['descr'] = $_POST['descr'];
|
| 192 |
299 |
$natent['associated-rule-id'] = $_POST['associated-rule-id'];
|
| 193 |
|
|
|
300 |
|
| 194 |
301 |
if($_POST['filter-rule-association'] == "pass")
|
| 195 |
302 |
$natent['associated-rule-id'] = "pass";
|
| 196 |
303 |
|
| ... | ... | |
| 241 |
348 |
if (!empty($natent['associated-rule-id'])) {
|
| 242 |
349 |
$filterentid = get_id($natent['associated-rule-id'], $config['filter']['rule']);
|
| 243 |
350 |
if ($filterentid == false) {
|
| 244 |
|
$filterent['source']['any'] = "";
|
|
351 |
pconfig_to_address($filterent['source'], $_POST['src'],
|
|
352 |
$_POST['srcmask'], $_POST['srcnot'],
|
|
353 |
$_POST['srcbeginport'], $_POST['srcendport']);
|
| 245 |
354 |
$filterent['associated-rule-id'] = $natent['associated-rule-id'];
|
| 246 |
355 |
} else
|
| 247 |
356 |
$filterent =& $config['filter']['rule'][$filterentid];
|
| 248 |
357 |
} else
|
| 249 |
|
// Create the default source entry for new filter entries
|
| 250 |
|
$filterent['source']['any'] = "";
|
|
358 |
pconfig_to_address($filterent['source'], $_POST['src'],
|
|
359 |
$_POST['srcmask'], $_POST['srcnot'],
|
|
360 |
$_POST['srcbeginport'], $_POST['srcendport']);
|
| 251 |
361 |
|
| 252 |
362 |
// Update interface, protocol and destination
|
| 253 |
363 |
$filterent['interface'] = $_POST['interface'];
|
| ... | ... | |
| 309 |
419 |
<table width="100%" border="0" cellpadding="6" cellspacing="0">
|
| 310 |
420 |
<tr>
|
| 311 |
421 |
<td colspan="2" valign="top" class="listtopic">Edit NAT entry</td>
|
| 312 |
|
</tr>
|
| 313 |
|
<tr>
|
|
422 |
</tr>
|
|
423 |
<tr>
|
|
424 |
<td width="22%" valign="top" class="vncellreq">Disabled</td>
|
|
425 |
<td width="78%" class="vtable">
|
|
426 |
<input name="disabled" type="checkbox" id="disabled" value="yes" <?php if ($pconfig['disabled']) echo "checked"; ?>>
|
|
427 |
<strong>Disable this rule</strong><br />
|
|
428 |
<span class="vexpl">Set this option to disable this rule without removing it from the list.</span>
|
|
429 |
</td>
|
|
430 |
</tr>
|
|
431 |
<tr>
|
|
432 |
<td width="22%" valign="top" class="vncell">No RDR (NOT)</td>
|
|
433 |
<td width="78%" class="vtable">
|
|
434 |
<input type="checkbox" name="nordr"<?php if($pconfig['nordr']) echo " CHECKED"; ?>>
|
|
435 |
<span class="vexpl">Enabling this option will disable NATing for the item and stop processing outgoing NAT rules.
|
|
436 |
<br>Hint: this option is rarely needed, don't use this unless you know what you're doing.</span>
|
|
437 |
</td>
|
|
438 |
</tr>
|
|
439 |
<tr>
|
| 314 |
440 |
<td width="22%" valign="top" class="vncellreq">Interface</td>
|
| 315 |
441 |
<td width="78%" class="vtable">
|
| 316 |
442 |
<select name="interface" class="formselect">
|
| 317 |
443 |
<?php
|
| 318 |
|
|
|
444 |
|
| 319 |
445 |
$iflist = get_configured_interface_with_descr(false, true);
|
| 320 |
|
foreach ($iflist as $if => $ifdesc)
|
| 321 |
|
if(have_ruleint_access($if))
|
|
446 |
foreach ($iflist as $if => $ifdesc)
|
|
447 |
if(have_ruleint_access($if))
|
| 322 |
448 |
$interfaces[$if] = $ifdesc;
|
| 323 |
|
|
|
449 |
|
| 324 |
450 |
if ($config['pptpd']['mode'] == "server")
|
| 325 |
|
if(have_ruleint_access("pptp"))
|
|
451 |
if(have_ruleint_access("pptp"))
|
| 326 |
452 |
$interfaces['pptp'] = "PPTP VPN";
|
| 327 |
|
|
|
453 |
|
| 328 |
454 |
if ($config['pppoe']['mode'] == "server")
|
| 329 |
|
if(have_ruleint_access("pppoe"))
|
|
455 |
if(have_ruleint_access("pppoe"))
|
| 330 |
456 |
$interfaces['pppoe'] = "PPPoE VPN";
|
| 331 |
|
|
|
457 |
|
| 332 |
458 |
/* add ipsec interfaces */
|
| 333 |
459 |
if (isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable']))
|
| 334 |
|
if(have_ruleint_access("enc0"))
|
| 335 |
|
$interfaces["enc0"] = "IPsec";
|
|
460 |
if(have_ruleint_access("enc0"))
|
|
461 |
$interfaces["enc0"] = "IPsec";
|
| 336 |
462 |
|
| 337 |
463 |
foreach ($interfaces as $iface => $ifacename): ?>
|
| 338 |
464 |
<option value="<?=$iface;?>" <?php if ($iface == $pconfig['interface']) echo "selected"; ?>>
|
| ... | ... | |
| 342 |
468 |
</select><br>
|
| 343 |
469 |
<span class="vexpl">Choose which interface this rule applies to.<br>
|
| 344 |
470 |
Hint: in most cases, you'll want to use WAN here.</span></td>
|
| 345 |
|
</tr>
|
| 346 |
|
<tr>
|
| 347 |
|
<td width="22%" valign="top" class="vncellreq">External address</td>
|
| 348 |
|
<td width="78%" class="vtable">
|
| 349 |
|
<select name="extaddr" class="formselect">
|
| 350 |
|
<option value="" <?php if (!$pconfig['extaddr']) echo "selected"; ?>>Interface address</option>
|
| 351 |
|
<?php if (is_array($config['virtualip']['vip'])):
|
| 352 |
|
foreach ($config['virtualip']['vip'] as $sn):
|
| 353 |
|
if ($sn['mode'] == "proxyarp" && $sn['type'] == "network"):
|
| 354 |
|
$baseip = ip2long($sn['subnet']) & ip2long(gen_subnet_mask($sn['subnet_bits']));
|
| 355 |
|
for ($i = $sn['subnet_bits']; $i <= 32; $i++):
|
| 356 |
|
$baseip = $baseip + 1;
|
| 357 |
|
$snip = long2ip($baseip);
|
| 358 |
|
?>
|
| 359 |
|
<option value="<?=$snip;?>" <?php if ($snip == $pconfig['extaddr']) echo "selected"; ?>><?=htmlspecialchars("{$snip} ({$sn['descr']})");?></option>
|
| 360 |
|
<?php endfor;
|
| 361 |
|
else: ?>
|
| 362 |
|
<option value="<?=$sn['subnet'];?>" <?php if ($sn['subnet'] == $pconfig['extaddr']) echo "selected"; ?>><?=htmlspecialchars("{$sn['subnet']} ({$sn['descr']})");?></option>
|
| 363 |
|
<?php endif; ?>
|
| 364 |
|
<?php endforeach;
|
| 365 |
|
endif; ?>
|
| 366 |
|
<option value="any" <?php if($pconfig['extaddr'] == "any") echo "selected"; ?>>any</option>
|
| 367 |
|
</select>
|
| 368 |
|
<br />
|
| 369 |
|
<span class="vexpl">
|
| 370 |
|
If you want this rule to apply to another IP address than the IP address of the interface chosen above,
|
| 371 |
|
select it here (you need to define <a href="firewall_virtual_ip.php">Virtual IP</a> addresses on the first). Also note that if you are trying to redirect connections on the LAN select the "any" option.</span></td>
|
| 372 |
471 |
</tr>
|
| 373 |
472 |
<tr>
|
| 374 |
473 |
<td width="22%" valign="top" class="vncellreq">Protocol</td>
|
| ... | ... | |
| 381 |
480 |
this rule should match.<br>
|
| 382 |
481 |
Hint: in most cases, you should specify <em>TCP</em> here.</span></td>
|
| 383 |
482 |
</tr>
|
| 384 |
|
<tr>
|
| 385 |
|
<td width="22%" valign="top" class="vncellreq">External port
|
| 386 |
|
range </td>
|
| 387 |
|
<td width="78%" class="vtable">
|
| 388 |
|
<table border="0" cellspacing="0" cellpadding="0">
|
| 389 |
|
<tr>
|
| 390 |
|
<td>from: </td>
|
| 391 |
|
<td><select name="beginport" class="formselect" onChange="ext_rep_change(); ext_change(); check_for_aliases();">
|
| 392 |
|
<option value="">(other)</option>
|
| 393 |
|
<?php $bfound = 0; foreach ($wkports as $wkport => $wkportdesc): ?>
|
| 394 |
|
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['beginport']) {
|
| 395 |
|
echo "selected";
|
| 396 |
|
$bfound = 1;
|
| 397 |
|
}?>>
|
| 398 |
|
<?=htmlspecialchars($wkportdesc);?>
|
| 399 |
|
</option>
|
| 400 |
|
<?php endforeach; ?>
|
| 401 |
|
</select> <input onChange="check_for_aliases();" autocomplete='off' class="formfldalias" name="beginport_cust" id="beginport_cust" type="text" size="5" value="<?php if (!$bfound) echo $pconfig['beginport']; ?>"></td>
|
| 402 |
|
</tr>
|
| 403 |
|
<tr>
|
| 404 |
|
<td>to:</td>
|
| 405 |
|
<td><select name="endport" class="formselect" onChange="ext_change(); check_for_aliases();">
|
| 406 |
|
<option value="">(other)</option>
|
| 407 |
|
<?php $bfound = 0; foreach ($wkports as $wkport => $wkportdesc): ?>
|
| 408 |
|
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['endport']) {
|
| 409 |
|
echo "selected";
|
| 410 |
|
$bfound = 1;
|
| 411 |
|
}?>>
|
| 412 |
|
<?=htmlspecialchars($wkportdesc);?>
|
| 413 |
|
</option>
|
| 414 |
|
<?php endforeach; ?>
|
| 415 |
|
</select> <input onChange="check_for_aliases();" class="formfldalias" autocomplete='off' name="endport_cust" id="endport_cust" type="text" size="5" value="<?php if (!$bfound) echo $pconfig['endport']; ?>"></td>
|
| 416 |
|
</tr>
|
| 417 |
|
</table>
|
| 418 |
|
<br> <span class="vexpl">Specify the port or port range on
|
| 419 |
|
the firewall's external address for this mapping.<br>
|
| 420 |
|
Hint: you can leave the <em>'to'</em> field empty if you only
|
| 421 |
|
want to map a single port</span></td>
|
| 422 |
|
</tr>
|
|
483 |
<tr id="showadvancedboxsrc" name="showadvancedboxsrc">
|
|
484 |
<td width="22%" valign="top" class="vncellreq">Source</td>
|
|
485 |
<td width="78%" class="vtable">
|
|
486 |
<input type="button" onClick="show_source()" value="Advanced"></input> - Show source address and port range</a>
|
|
487 |
</td>
|
|
488 |
</tr>
|
|
489 |
<tr style="display: none;" id="srctable" name="srctable">
|
|
490 |
<td width="22%" valign="top" class="vncellreq">Source</td>
|
|
491 |
<td width="78%" class="vtable">
|
|
492 |
<input name="srcnot" type="checkbox" id="srcnot" value="yes" <?php if ($pconfig['srcnot']) echo "checked"; ?>>
|
|
493 |
<strong>not</strong>
|
|
494 |
<br />
|
|
495 |
Use this option to invert the sense of the match.
|
|
496 |
<br />
|
|
497 |
<br />
|
|
498 |
<table border="0" cellspacing="0" cellpadding="0">
|
|
499 |
<tr>
|
|
500 |
<td>Type: </td>
|
|
501 |
<td>
|
|
502 |
<select name="srctype" class="formselect" onChange="typesel_change()">
|
|
503 |
<?php
|
|
504 |
$sel = is_specialnet($pconfig['src']); ?>
|
|
505 |
<option value="any" <?php if ($pconfig['src'] == "any") { echo "selected"; } ?>>any</option>
|
|
506 |
<option value="single" <?php if (($pconfig['srcmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>>Single host or alias</option>
|
|
507 |
<option value="network" <?php if (!$sel) echo "selected"; ?>>Network</option>
|
|
508 |
<?php if(have_ruleint_access("pptp")): ?>
|
|
509 |
<option value="pptp" <?php if ($pconfig['src'] == "pptp") { echo "selected"; } ?>>PPTP clients</option>
|
|
510 |
<?php endif; ?>
|
|
511 |
<?php if(have_ruleint_access("pppoe")): ?>
|
|
512 |
<option value="pppoe" <?php if ($pconfig['src'] == "pppoe") { echo "selected"; } ?>>PPPoE clients</option>
|
|
513 |
<?php endif; ?>
|
|
514 |
<?php if(have_ruleint_access("l2tp")): ?>
|
|
515 |
<option value="l2tp" <?php if ($pconfig['src'] == "l2tp") { echo "selected"; } ?>>L2TP clients</option>
|
|
516 |
<?php endif; ?>
|
|
517 |
<?php
|
|
518 |
foreach ($ifdisp as $ifent => $ifdesc): ?>
|
|
519 |
<?php if(have_ruleint_access($ifent)): ?>
|
|
520 |
<option value="<?=$ifent;?>" <?php if ($pconfig['src'] == $ifent) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?> subnet</option>
|
|
521 |
<option value="<?=$ifent;?>ip"<?php if ($pconfig['src'] == $ifent . "ip") { echo "selected"; } ?>>
|
|
522 |
<?=$ifdesc?> address
|
|
523 |
</option>
|
|
524 |
<?php endif; ?>
|
|
525 |
<?php endforeach; ?>
|
|
526 |
</select>
|
|
527 |
</td>
|
|
528 |
</tr>
|
|
529 |
<tr>
|
|
530 |
<td>Address: </td>
|
|
531 |
<td>
|
|
532 |
<input autocomplete='off' name="src" type="text" class="formfldalias" id="src" size="20" value="<?php if (!is_specialnet($pconfig['src'])) echo htmlspecialchars($pconfig['src']);?>"> /
|
|
533 |
<select name="srcmask" class="formselect" id="srcmask">
|
|
534 |
<?php for ($i = 31; $i > 0; $i--): ?>
|
|
535 |
<option value="<?=$i;?>" <?php if ($i == $pconfig['srcmask']) echo "selected"; ?>><?=$i;?></option>
|
|
536 |
<?php endfor; ?>
|
|
537 |
</select>
|
|
538 |
</td>
|
|
539 |
</tr>
|
|
540 |
</table>
|
|
541 |
</td>
|
|
542 |
</tr>
|
|
543 |
<tr style="display:none" id="sprtable" name="sprtable">
|
|
544 |
<td width="22%" valign="top" class="vncellreq">Source port range</td>
|
|
545 |
<td width="78%" class="vtable">
|
|
546 |
<table border="0" cellspacing="0" cellpadding="0">
|
|
547 |
<tr>
|
|
548 |
<td>from: </td>
|
|
549 |
<td>
|
|
550 |
<select name="srcbeginport" class="formselect" onchange="src_rep_change();ext_change()">
|
|
551 |
<option value="">(other)</option>
|
|
552 |
<option value="any" <?php $bfound = 0; if ($pconfig['srcbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
|
|
553 |
<?php foreach ($wkports as $wkport => $wkportdesc): ?>
|
|
554 |
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcbeginport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
|
|
555 |
<?php endforeach; ?>
|
|
556 |
</select>
|
|
557 |
<input autocomplete='off' class="formfldalias" name="srcbeginport_cust" id="srcbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcbeginport']) echo $pconfig['srcbeginport']; ?>">
|
|
558 |
</td>
|
|
559 |
</tr>
|
|
560 |
<tr>
|
|
561 |
<td>to:</td>
|
|
562 |
<td>
|
|
563 |
<select name="srcendport" class="formselect" onchange="ext_change()">
|
|
564 |
<option value="">(other)</option>
|
|
565 |
<option value="any" <?php $bfound = 0; if ($pconfig['srcendport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
|
|
566 |
<?php foreach ($wkports as $wkport => $wkportdesc): ?>
|
|
567 |
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
|
|
568 |
<?php endforeach; ?>
|
|
569 |
</select>
|
|
570 |
<input autocomplete='off' class="formfldalias" name="srcendport_cust" id="srcendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcendport']) echo $pconfig['srcendport']; ?>">
|
|
571 |
</td>
|
|
572 |
</tr>
|
|
573 |
</table>
|
|
574 |
<br />
|
|
575 |
<span class="vexpl">Specify the source port or port range for this rule. <b>This is almost never equal to the destination port range (and is usually "any")</b>. <br /> Hint: you can leave the <em>'to'</em> field empty if you only want to filter a single port</span><br/>
|
|
576 |
</td>
|
|
577 |
</tr>
|
|
578 |
<tr>
|
|
579 |
<td width="22%" valign="top" class="vncellreq">Destination</td>
|
|
580 |
<td width="78%" class="vtable">
|
|
581 |
<input name="dstnot" type="checkbox" id="dstnot" value="yes" <?php if ($pconfig['dstnot']) echo "checked"; ?>>
|
|
582 |
<strong>not</strong>
|
|
583 |
<br />
|
|
584 |
Use this option to invert the sense of the match.
|
|
585 |
<br />
|
|
586 |
<br />
|
|
587 |
<table border="0" cellspacing="0" cellpadding="0">
|
|
588 |
<tr>
|
|
589 |
<td>Type: </td>
|
|
590 |
<td>
|
|
591 |
<select name="dsttype" class="formselect" onChange="typesel_change()">
|
|
592 |
<?php
|
|
593 |
$sel = is_specialnet($pconfig['dst']); ?>
|
|
594 |
<option value="any" <?php if ($pconfig['dst'] == "any") { echo "selected"; } ?>>any</option>
|
|
595 |
<option value="single" <?php if (($pconfig['dstmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>>Single host or alias</option>
|
|
596 |
<option value="network" <?php if (!$sel) echo "selected"; ?>>Network</option>
|
|
597 |
<?php if(have_ruleint_access("pptp")): ?>
|
|
598 |
<option value="pptp" <?php if ($pconfig['dst'] == "pptp") { echo "selected"; } ?>>PPTP clients</option>
|
|
599 |
<?php endif; ?>
|
|
600 |
<?php if(have_ruleint_access("pppoe")): ?>
|
|
601 |
<option value="pppoe" <?php if ($pconfig['dst'] == "pppoe") { echo "selected"; } ?>>PPPoE clients</option>
|
|
602 |
<?php endif; ?>
|
|
603 |
<?php if(have_ruleint_access("l2tp")): ?>
|
|
604 |
<option value="l2tp" <?php if ($pconfig['dst'] == "l2tp") { echo "selected"; } ?>>L2TP clients</option>
|
|
605 |
<?php endif; ?>
|
|
606 |
|
|
607 |
<?php foreach ($ifdisp as $if => $ifdesc): ?>
|
|
608 |
<?php if(have_ruleint_access($if)): ?>
|
|
609 |
<option value="<?=$if;?>" <?php if ($pconfig['dst'] == $if) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?> subnet</option>
|
|
610 |
<option value="<?=$if;?>ip"<?php if ($pconfig['dst'] == $if . "ip") { echo "selected"; } ?>>
|
|
611 |
<?=$ifdesc;?> address
|
|
612 |
</option>
|
|
613 |
<?php endif; ?>
|
|
614 |
<?php endforeach; ?>
|
|
615 |
</select>
|
|
616 |
</td>
|
|
617 |
</tr>
|
|
618 |
<tr>
|
|
619 |
<td>Address: </td>
|
|
620 |
<td>
|
|
621 |
<input name="dst" type="text" class="formfldalias" id="dst" size="20" value="<?php if (!is_specialnet($pconfig['dst'])) echo htmlspecialchars($pconfig['dst']);?>">
|
|
622 |
/
|
|
623 |
<select name="dstmask" class="formselect" id="dstmask">
|
|
624 |
<?php
|
|
625 |
for ($i = 31; $i > 0; $i--): ?>
|
|
626 |
<option value="<?=$i;?>" <?php if ($i == $pconfig['dstmask']) echo "selected"; ?>><?=$i;?></option>
|
|
627 |
<?php endfor; ?>
|
|
628 |
</select>
|
|
629 |
</td>
|
|
630 |
</tr>
|
|
631 |
</table>
|
|
632 |
</td>
|
|
633 |
</tr>
|
|
634 |
<tr id="dprtr" name="dprtr">
|
|
635 |
<td width="22%" valign="top" class="vncellreq">Destination port range </td>
|
|
636 |
<td width="78%" class="vtable">
|
|
637 |
<table border="0" cellspacing="0" cellpadding="0">
|
|
638 |
<tr>
|
|
639 |
<td>from: </td>
|
|
640 |
<td>
|
|
641 |
<select name="dstbeginport" class="formselect" onchange="dst_rep_change();ext_change()">
|
|
642 |
<option value="">(other)</option>
|
|
643 |
<option value="any" <?php $bfound = 0; if ($pconfig['dstbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
|
|
644 |
<?php foreach ($wkports as $wkport => $wkportdesc): ?>
|
|
645 |
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstbeginport']) { echo "selected"; $bfound = 1; }?>><?=htmlspecialchars($wkportdesc);?></option>
|
|
646 |
<?php endforeach; ?>
|
|
647 |
</select>
|
|
648 |
<input autocomplete='off' class="formfldalias" name="dstbeginport_cust" id="dstbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstbeginport']) echo $pconfig['dstbeginport']; ?>">
|
|
649 |
</td>
|
|
650 |
</tr>
|
|
651 |
<tr>
|
|
652 |
<td>to:</td>
|
|
653 |
<td>
|
|
654 |
<select name="dstendport" class="formselect" onchange="ext_change()">
|
|
655 |
<option value="">(other)</option>
|
|
656 |
<option value="any" <?php $bfound = 0; if ($pconfig['dstendport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
|
|
657 |
<?php foreach ($wkports as $wkport => $wkportdesc): ?>
|
|
658 |
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
|
|
659 |
<?php endforeach; ?>
|
|
660 |
</select>
|
|
661 |
<input autocomplete='off' class="formfldalias" name="dstendport_cust" id="dstendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstendport']) echo $pconfig['dstendport']; ?>">
|
|
662 |
</td>
|
|
663 |
</tr>
|
|
664 |
</table>
|
|
665 |
<br />
|
|
666 |
<span class="vexpl">
|
|
667 |
Specify the port or port range for the destination of the packet for this rule.
|
|
668 |
<br />
|
|
669 |
Hint: you can leave the <em>'to'</em> field empty if you only want to filter a single port
|
|
670 |
</span>
|
|
671 |
</td>
|
|
672 |
</tr>
|
| 423 |
673 |
<tr>
|
| 424 |
674 |
<td width="22%" valign="top" class="vncellreq">NAT IP</td>
|
| 425 |
675 |
<td width="78%" class="vtable">
|
| ... | ... | |
| 470 |
720 |
<select name="associated-rule-id">
|
| 471 |
721 |
<option value="">None</option>
|
| 472 |
722 |
<option value="pass" <?php if($pconfig['associated-rule-id'] == "pass") echo " SELECTED"; ?>>Pass</option>
|
| 473 |
|
<?php
|
|
723 |
<?php
|
| 474 |
724 |
$linkedrule = "";
|
| 475 |
725 |
if (is_array($config['filter']['rule'])) {
|
| 476 |
726 |
$filter_id = 0;
|
| ... | ... | |
| 482 |
732 |
$linkedrule = "<br /><a href=\"firewall_rules_edit.php?id={$filter_id}\">View the filter rule</a><br/>";
|
| 483 |
733 |
}
|
| 484 |
734 |
echo ">". htmlspecialchars('Rule ' . $filter_rule['descr']) . "</option>\n";
|
| 485 |
|
|
|
735 |
|
| 486 |
736 |
}
|
| 487 |
737 |
if ($filter_rule['interface'] == $pconfig['interface'])
|
| 488 |
738 |
$filter_id++;
|
| ... | ... | |
| 526 |
776 |
<script language="JavaScript">
|
| 527 |
777 |
<!--
|
| 528 |
778 |
ext_change();
|
|
779 |
typesel_change();
|
|
780 |
proto_change();
|
| 529 |
781 |
//-->
|
| 530 |
782 |
</script>
|
| 531 |
783 |
<?php
|
Adding new fields to improved NAT port forward