Revision 0d8a8615
Added by Vinicius Coque about 15 years ago
| usr/local/www/firewall_nat_edit.php | ||
|---|---|---|
| 44 | 44 |
require("filter.inc");
|
| 45 | 45 |
require("shaper.inc");
|
| 46 | 46 |
|
| 47 |
$specialsrcdst = explode(" ", "any pptp pppoe l2tp openvpn");
|
|
| 48 |
$ifdisp = get_configured_interface_with_descr(); |
|
| 49 |
foreach ($ifdisp as $kif => $kdescr) {
|
|
| 50 |
$specialsrcdst[] = "{$kif}";
|
|
| 51 |
$specialsrcdst[] = "{$kif}ip";
|
|
| 52 |
} |
|
| 53 |
|
|
| 47 | 54 |
if (!is_array($config['nat']['rule'])) {
|
| 48 | 55 |
$config['nat']['rule'] = array(); |
| 49 | 56 |
} |
| ... | ... | |
| 59 | 66 |
} |
| 60 | 67 |
|
| 61 | 68 |
if (isset($id) && $a_nat[$id]) {
|
| 62 |
$pconfig['extaddr'] = $a_nat[$id]['external-address']; |
|
| 69 |
$pconfig['disabled'] = isset($a_nat[$id]['disabled']); |
|
| 70 |
$pconfig['nordr'] = isset($a_nat[$id]['nordr']); |
|
| 71 |
|
|
| 72 |
address_to_pconfig($a_nat[$id]['source'], $pconfig['src'], |
|
| 73 |
$pconfig['srcmask'], $pconfig['srcnot'], |
|
| 74 |
$pconfig['srcbeginport'], $pconfig['srcendport']); |
|
| 75 |
|
|
| 76 |
address_to_pconfig($a_nat[$id]['destination'], $pconfig['dst'], |
|
| 77 |
$pconfig['dstmask'], $pconfig['dstnot'], |
|
| 78 |
$pconfig['dstbeginport'], $pconfig['dstendport']); |
|
| 79 |
|
|
| 63 | 80 |
$pconfig['proto'] = $a_nat[$id]['protocol']; |
| 64 |
list($pconfig['beginport'],$pconfig['endport']) = explode("-", $a_nat[$id]['external-port']);
|
|
| 65 |
if(!$pconfig['endport']) |
|
| 66 |
$pconfig['endport'] = $pconfig['beginport']; |
|
| 67 | 81 |
$pconfig['localip'] = $a_nat[$id]['target']; |
| 68 | 82 |
$pconfig['localbeginport'] = $a_nat[$id]['local-port']; |
| 69 | 83 |
$pconfig['descr'] = $a_nat[$id]['descr']; |
| 70 | 84 |
$pconfig['interface'] = $a_nat[$id]['interface']; |
| 71 | 85 |
$pconfig['associated-rule-id'] = $a_nat[$id]['associated-rule-id']; |
| 72 | 86 |
$pconfig['nosync'] = isset($a_nat[$id]['nosync']); |
| 87 |
|
|
| 73 | 88 |
if (!$pconfig['interface']) |
| 74 | 89 |
$pconfig['interface'] = "wan"; |
| 75 | 90 |
} else {
|
| 76 | 91 |
$pconfig['interface'] = "wan"; |
| 92 |
$pconfig['src'] = "any"; |
|
| 93 |
$pconfig['srcbeginport'] = "any"; |
|
| 94 |
$pconfig['srcendport'] = "any"; |
|
| 77 | 95 |
} |
| 78 | 96 |
|
| 79 | 97 |
if (isset($_GET['dup'])) |
| 80 | 98 |
unset($id); |
| 81 | 99 |
|
| 82 | 100 |
/* run through $_POST items encoding HTML entties so that the user |
| 83 |
* cannot think he is slick and perform a XSS attack on the unwilling
|
|
| 101 |
* cannot think he is slick and perform a XSS attack on the unwilling |
|
| 84 | 102 |
*/ |
| 85 | 103 |
foreach ($_POST as $key => $value) {
|
| 86 | 104 |
$temp = $value; |
| 87 | 105 |
$newpost = htmlentities($temp); |
| 88 |
if($newpost <> $temp)
|
|
| 89 |
$input_errors[] = "Invalid characters detected ($temp). Please remove invalid characters and save again.";
|
|
| 106 |
if($newpost <> $temp) |
|
| 107 |
$input_errors[] = "Invalid characters detected ($temp). Please remove invalid characters and save again."; |
|
| 90 | 108 |
} |
| 91 | 109 |
|
| 92 | 110 |
if ($_POST) {
|
| 93 | 111 |
|
| 94 |
if ($_POST['beginport_cust'] && !$_POST['beginport']) |
|
| 95 |
$_POST['beginport'] = $_POST['beginport_cust']; |
|
| 96 |
if ($_POST['endport_cust'] && !$_POST['endport']) |
|
| 97 |
$_POST['endport'] = $_POST['endport_cust']; |
|
| 98 |
if ($_POST['localbeginport_cust'] && !$_POST['localbeginport']) |
|
| 99 |
$_POST['localbeginport'] = $_POST['localbeginport_cust']; |
|
| 112 |
if(strtoupper($_POST['proto']) == "TCP" || strtoupper($_POST['proto']) == "UDP" || strtoupper($_POST['proto']) == "TCP/UDP") {
|
|
| 113 |
if ($_POST['srcbeginport_cust'] && !$_POST['srcbeginport']) |
|
| 114 |
$_POST['srcbeginport'] = $_POST['srcbeginport_cust']; |
|
| 115 |
if ($_POST['srcendport_cust'] && !$_POST['srcendport']) |
|
| 116 |
$_POST['srcendport'] = $_POST['srcendport_cust']; |
|
| 117 |
|
|
| 118 |
if ($_POST['srcbeginport'] == "any") {
|
|
| 119 |
$_POST['srcbeginport'] = 0; |
|
| 120 |
$_POST['srcendport'] = 0; |
|
| 121 |
} else {
|
|
| 122 |
if (!$_POST['srcendport']) |
|
| 123 |
$_POST['srcendport'] = $_POST['srcbeginport']; |
|
| 124 |
} |
|
| 125 |
if ($_POST['srcendport'] == "any") |
|
| 126 |
$_POST['srcendport'] = $_POST['srcbeginport']; |
|
| 127 |
|
|
| 128 |
if ($_POST['dstbeginport_cust'] && !$_POST['dstbeginport']) |
|
| 129 |
$_POST['dstbeginport'] = $_POST['dstbeginport_cust']; |
|
| 130 |
if ($_POST['dstendport_cust'] && !$_POST['dstendport']) |
|
| 131 |
$_POST['dstendport'] = $_POST['dstendport_cust']; |
|
| 132 |
|
|
| 133 |
if ($_POST['dstbeginport'] == "any") {
|
|
| 134 |
$_POST['dstbeginport'] = 0; |
|
| 135 |
$_POST['dstendport'] = 0; |
|
| 136 |
} else {
|
|
| 137 |
if (!$_POST['dstendport']) |
|
| 138 |
$_POST['dstendport'] = $_POST['dstbeginport']; |
|
| 139 |
} |
|
| 140 |
if ($_POST['dstendport'] == "any") |
|
| 141 |
$_POST['dstendport'] = $_POST['dstbeginport']; |
|
| 142 |
|
|
| 143 |
if ($_POST['localbeginport_cust'] && !$_POST['localbeginport']) |
|
| 144 |
$_POST['localbeginport'] = $_POST['localbeginport_cust']; |
|
| 145 |
|
|
| 146 |
/* Make beginning port end port if not defined and endport is */ |
|
| 147 |
if (!$_POST['srcbeginport'] && $_POST['srcendport']) |
|
| 148 |
$_POST['srcbeginport'] = $_POST['srcendport']; |
|
| 149 |
if (!$_POST['dstbeginport'] && $_POST['dstendport']) |
|
| 150 |
$_POST['dstbeginport'] = $_POST['dstendport']; |
|
| 151 |
} else {
|
|
| 152 |
$_POST['srcbeginport'] = 0; |
|
| 153 |
$_POST['srcendport'] = 0; |
|
| 154 |
$_POST['dstbeginport'] = 0; |
|
| 155 |
$_POST['dstendport'] = 0; |
|
| 156 |
} |
|
| 100 | 157 |
|
| 101 |
if (!$_POST['endport']) |
|
| 102 |
$_POST['endport'] = $_POST['beginport']; |
|
| 103 |
/* Make beginning port end port if not defined and endport is */ |
|
| 104 |
if (!$_POST['beginport'] && $_POST['endport']) |
|
| 105 |
$_POST['beginport'] = $_POST['endport']; |
|
| 158 |
if (is_specialnet($_POST['srctype'])) {
|
|
| 159 |
$_POST['src'] = $_POST['srctype']; |
|
| 160 |
$_POST['srcmask'] = 0; |
|
| 161 |
} else if ($_POST['srctype'] == "single") {
|
|
| 162 |
$_POST['srcmask'] = 32; |
|
| 163 |
} |
|
| 164 |
if (is_specialnet($_POST['dsttype'])) {
|
|
| 165 |
$_POST['dst'] = $_POST['dsttype']; |
|
| 166 |
$_POST['dstmask'] = 0; |
|
| 167 |
} else if ($_POST['dsttype'] == "single") {
|
|
| 168 |
$_POST['dstmask'] = 32; |
|
| 169 |
} |
|
| 106 | 170 |
|
| 107 | 171 |
unset($input_errors); |
| 108 | 172 |
$pconfig = $_POST; |
| 109 | 173 |
|
| 110 | 174 |
/* input validation */ |
| 111 | 175 |
if(strtoupper($_POST['proto']) == "TCP" or strtoupper($_POST['proto']) == "UDP" or strtoupper($_POST['proto']) == "TCP/UDP") {
|
| 112 |
$reqdfields = explode(" ", "interface proto beginport endport localip localbeginport");
|
|
| 113 |
$reqdfieldsn = explode(",", "Interface,Protocol,External port from,External port to,NAT IP,Local port");
|
|
| 176 |
$reqdfields = explode(" ", "interface proto dstbeginport dstendport localip localbeginport");
|
|
| 177 |
$reqdfieldsn = explode(",", "Interface,Protocol,Destination port from,Destination port to,NAT IP,Local port");
|
|
| 114 | 178 |
} else {
|
| 115 | 179 |
$reqdfields = explode(" ", "interface proto localip");
|
| 116 | 180 |
$reqdfieldsn = explode(",", "Interface,Protocol,NAT IP");
|
| ... | ... | |
| 118 | 182 |
|
| 119 | 183 |
do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); |
| 120 | 184 |
|
| 185 |
if (!$_POST['srcbeginport']) {
|
|
| 186 |
$_POST['srcbeginport'] = 0; |
|
| 187 |
$_POST['srcendport'] = 0; |
|
| 188 |
} |
|
| 189 |
if (!$_POST['dstbeginport']) {
|
|
| 190 |
$_POST['dstbeginport'] = 0; |
|
| 191 |
$_POST['dstendport'] = 0; |
|
| 192 |
} |
|
| 193 |
|
|
| 121 | 194 |
if (($_POST['localip'] && !is_ipaddroralias($_POST['localip']))) {
|
| 122 | 195 |
$input_errors[] = "\"{$_POST['localip']}\" is not valid NAT IP address or host alias.";
|
| 123 | 196 |
} |
| 124 | 197 |
|
| 125 |
/* only validate the ports if the protocol is TCP, UDP or TCP/UDP */ |
|
| 126 |
if(strtoupper($_POST['proto']) == "TCP" or strtoupper($_POST['proto']) == "UDP" or strtoupper($_POST['proto']) == "TCP/UDP") {
|
|
| 198 |
if ($_POST['srcbeginport'] && !is_portoralias($_POST['srcbeginport'])) |
|
| 199 |
$input_errors[] = "{$_POST['srcbeginport']} is not a valid start source port. It must be a port alias or integer between 1 and 65535.";
|
|
| 200 |
if ($_POST['srcendport'] && !is_portoralias($_POST['srcendport'])) |
|
| 201 |
$input_errors[] = "{$_POST['srcendport']} is not a valid end source port. It must be a port alias or integer between 1 and 65535.";
|
|
| 202 |
if ($_POST['dstbeginport'] && !is_portoralias($_POST['dstbeginport'])) |
|
| 203 |
$input_errors[] = "{$_POST['dstbeginport']} is not a valid start destination port. It must be a port alias or integer between 1 and 65535.";
|
|
| 204 |
if ($_POST['dstendport'] && !is_portoralias($_POST['dstendport'])) |
|
| 205 |
$input_errors[] = "{$_POST['dstendport']} is not a valid end destination port. It must be a port alias or integer between 1 and 65535.";
|
|
| 206 |
|
|
| 207 |
if ($_POST['localbeginport'] && !is_portoralias($_POST['localbeginport'])) {
|
|
| 208 |
$input_errors[] = "{$_POST['localbeginport']} is not a valid local port. It must be a port alias or integer between 1 and 65535.";
|
|
| 209 |
} |
|
| 127 | 210 |
|
| 128 |
if ($_POST['beginport'] && !is_portoralias($_POST['beginport'])) {
|
|
| 129 |
$input_errors[] = "The start port must be an integer between 1 and 65535."; |
|
| 130 |
} |
|
| 211 |
/* if user enters an alias and selects "network" then disallow. */ |
|
| 212 |
if($_POST['srctype'] == "network") {
|
|
| 213 |
if(is_alias($_POST['src'])) |
|
| 214 |
$input_errors[] = "You must specify single host or alias for alias entries."; |
|
| 215 |
} |
|
| 216 |
if($_POST['dsttype'] == "network") {
|
|
| 217 |
if(is_alias($_POST['dst'])) |
|
| 218 |
$input_errors[] = "You must specify single host or alias for alias entries."; |
|
| 219 |
} |
|
| 131 | 220 |
|
| 132 |
if ($_POST['endport'] && !is_portoralias($_POST['endport'])) {
|
|
| 133 |
$input_errors[] = "The end port must be an integer between 1 and 65535."; |
|
| 221 |
if (!is_specialnet($_POST['srctype'])) {
|
|
| 222 |
if (($_POST['src'] && !is_ipaddroralias($_POST['src']))) {
|
|
| 223 |
$input_errors[] = "{$_POST['src']} is not a valid source IP address or alias.";
|
|
| 134 | 224 |
} |
| 135 |
|
|
| 136 |
if ($_POST['localbeginport'] && !is_portoralias($_POST['localbeginport'])) {
|
|
| 137 |
$input_errors[] = "The local port must be an integer between 1 and 65535."; |
|
| 225 |
if (($_POST['srcmask'] && !is_numericint($_POST['srcmask']))) {
|
|
| 226 |
$input_errors[] = "A valid source bit count must be specified."; |
|
| 138 | 227 |
} |
| 139 |
|
|
| 140 |
if ($_POST['beginport'] > $_POST['endport']) {
|
|
| 141 |
/* swap */ |
|
| 142 |
$tmp = $_POST['endport']; |
|
| 143 |
$_POST['endport'] = $_POST['beginport']; |
|
| 144 |
$_POST['beginport'] = $tmp; |
|
| 228 |
} |
|
| 229 |
if (!is_specialnet($_POST['dsttype'])) {
|
|
| 230 |
if (($_POST['dst'] && !is_ipaddroralias($_POST['dst']))) {
|
|
| 231 |
$input_errors[] = "{$_POST['dst']} is not a valid destination IP address or alias.";
|
|
| 145 | 232 |
} |
| 146 |
|
|
| 147 |
if (!$input_errors) {
|
|
| 148 |
if (($_POST['endport'] - $_POST['beginport'] + $_POST['localbeginport']) > 65535) |
|
| 149 |
$input_errors[] = "The target port range must be an integer between 1 and 65535."; |
|
| 233 |
if (($_POST['dstmask'] && !is_numericint($_POST['dstmask']))) {
|
|
| 234 |
$input_errors[] = "A valid destination bit count must be specified."; |
|
| 150 | 235 |
} |
| 236 |
} |
|
| 237 |
|
|
| 238 |
if ($_POST['srcbeginport'] > $_POST['srcendport']) {
|
|
| 239 |
/* swap */ |
|
| 240 |
$tmp = $_POST['srcendport']; |
|
| 241 |
$_POST['srcendport'] = $_POST['srcbeginport']; |
|
| 242 |
$_POST['srcbeginport'] = $tmp; |
|
| 243 |
} |
|
| 244 |
if ($_POST['dstbeginport'] > $_POST['dstendport']) {
|
|
| 245 |
/* swap */ |
|
| 246 |
$tmp = $_POST['dstendport']; |
|
| 247 |
$_POST['dstendport'] = $_POST['dstbeginport']; |
|
| 248 |
$_POST['dstbeginport'] = $tmp; |
|
| 249 |
} |
|
| 151 | 250 |
|
| 251 |
if (!$input_errors) {
|
|
| 252 |
if (($_POST['dstendport'] - $_POST['dstbeginport'] + $_POST['localbeginport']) > 65535) |
|
| 253 |
$input_errors[] = "The target port range must be an integer between 1 and 65535."; |
|
| 152 | 254 |
} |
| 153 | 255 |
|
| 154 | 256 |
/* check for overlaps */ |
| ... | ... | |
| 157 | 259 |
continue; |
| 158 | 260 |
if ($natent['interface'] != $_POST['interface']) |
| 159 | 261 |
continue; |
| 160 |
if ($natent['external-address'] != $_POST['extaddr'])
|
|
| 262 |
if ($natent['destination']['address'] != $_POST['dst'])
|
|
| 161 | 263 |
continue; |
| 162 | 264 |
if (($natent['proto'] != $_POST['proto']) && ($natent['proto'] != "tcp/udp") && ($_POST['proto'] != "tcp/udp")) |
| 163 | 265 |
continue; |
| 164 | 266 |
|
| 165 |
list($begp,$endp) = explode("-", $natent['external-port']);
|
|
| 267 |
list($begp,$endp) = explode("-", $natent['destination']['port']);
|
|
| 166 | 268 |
if (!$endp) |
| 167 | 269 |
$endp = $begp; |
| 168 | 270 |
|
| 169 | 271 |
if (!( (($_POST['beginport'] < $begp) && ($_POST['endport'] < $begp)) |
| 170 | 272 |
|| (($_POST['beginport'] > $endp) && ($_POST['endport'] > $endp)))) {
|
| 171 | 273 |
|
| 172 |
$input_errors[] = "The external port range overlaps with an existing entry.";
|
|
| 274 |
$input_errors[] = "The destination port range overlaps with an existing entry.";
|
|
| 173 | 275 |
break; |
| 174 | 276 |
} |
| 175 | 277 |
} |
| 176 | 278 |
|
| 177 | 279 |
if (!$input_errors) {
|
| 178 | 280 |
$natent = array(); |
| 179 |
if ($_POST['extaddr']) |
|
| 180 |
$natent['external-address'] = $_POST['extaddr']; |
|
| 181 |
$natent['protocol'] = $_POST['proto']; |
|
| 182 | 281 |
|
| 183 |
if ($_POST['beginport'] == $_POST['endport']) |
|
| 184 |
$natent['external-port'] = $_POST['beginport']; |
|
| 185 |
else |
|
| 186 |
$natent['external-port'] = $_POST['beginport'] . "-" . $_POST['endport']; |
|
| 282 |
$natent['disabled'] = isset($_POST['disabled']) ? true:false; |
|
| 283 |
$natent['nordr'] = isset($_POST['nordr']) ? true:false; |
|
| 284 |
|
|
| 285 |
pconfig_to_address($natent['source'], $_POST['src'], |
|
| 286 |
$_POST['srcmask'], $_POST['srcnot'], |
|
| 287 |
$_POST['srcbeginport'], $_POST['srcendport']); |
|
| 288 |
|
|
| 289 |
pconfig_to_address($natent['destination'], $_POST['dst'], |
|
| 290 |
$_POST['dstmask'], $_POST['dstnot'], |
|
| 291 |
$_POST['dstbeginport'], $_POST['dstendport']); |
|
| 292 |
|
|
| 293 |
$natent['protocol'] = $_POST['proto']; |
|
| 187 | 294 |
|
| 188 | 295 |
$natent['target'] = $_POST['localip']; |
| 189 | 296 |
$natent['local-port'] = $_POST['localbeginport']; |
| 190 | 297 |
$natent['interface'] = $_POST['interface']; |
| 191 | 298 |
$natent['descr'] = $_POST['descr']; |
| 192 | 299 |
$natent['associated-rule-id'] = $_POST['associated-rule-id']; |
| 193 |
|
|
| 300 |
|
|
| 194 | 301 |
if($_POST['filter-rule-association'] == "pass") |
| 195 | 302 |
$natent['associated-rule-id'] = "pass"; |
| 196 | 303 |
|
| ... | ... | |
| 241 | 348 |
if (!empty($natent['associated-rule-id'])) {
|
| 242 | 349 |
$filterentid = get_id($natent['associated-rule-id'], $config['filter']['rule']); |
| 243 | 350 |
if ($filterentid == false) {
|
| 244 |
$filterent['source']['any'] = ""; |
|
| 351 |
pconfig_to_address($filterent['source'], $_POST['src'], |
|
| 352 |
$_POST['srcmask'], $_POST['srcnot'], |
|
| 353 |
$_POST['srcbeginport'], $_POST['srcendport']); |
|
| 245 | 354 |
$filterent['associated-rule-id'] = $natent['associated-rule-id']; |
| 246 | 355 |
} else |
| 247 | 356 |
$filterent =& $config['filter']['rule'][$filterentid]; |
| 248 | 357 |
} else |
| 249 |
// Create the default source entry for new filter entries |
|
| 250 |
$filterent['source']['any'] = ""; |
|
| 358 |
pconfig_to_address($filterent['source'], $_POST['src'], |
|
| 359 |
$_POST['srcmask'], $_POST['srcnot'], |
|
| 360 |
$_POST['srcbeginport'], $_POST['srcendport']); |
|
| 251 | 361 |
|
| 252 | 362 |
// Update interface, protocol and destination |
| 253 | 363 |
$filterent['interface'] = $_POST['interface']; |
| ... | ... | |
| 309 | 419 |
<table width="100%" border="0" cellpadding="6" cellspacing="0"> |
| 310 | 420 |
<tr> |
| 311 | 421 |
<td colspan="2" valign="top" class="listtopic">Edit NAT entry</td> |
| 312 |
</tr> |
|
| 313 |
<tr> |
|
| 422 |
</tr> |
|
| 423 |
<tr> |
|
| 424 |
<td width="22%" valign="top" class="vncellreq">Disabled</td> |
|
| 425 |
<td width="78%" class="vtable"> |
|
| 426 |
<input name="disabled" type="checkbox" id="disabled" value="yes" <?php if ($pconfig['disabled']) echo "checked"; ?>> |
|
| 427 |
<strong>Disable this rule</strong><br /> |
|
| 428 |
<span class="vexpl">Set this option to disable this rule without removing it from the list.</span> |
|
| 429 |
</td> |
|
| 430 |
</tr> |
|
| 431 |
<tr> |
|
| 432 |
<td width="22%" valign="top" class="vncell">No RDR (NOT)</td> |
|
| 433 |
<td width="78%" class="vtable"> |
|
| 434 |
<input type="checkbox" name="nordr"<?php if($pconfig['nordr']) echo " CHECKED"; ?>> |
|
| 435 |
<span class="vexpl">Enabling this option will disable NATing for the item and stop processing outgoing NAT rules. |
|
| 436 |
<br>Hint: this option is rarely needed, don't use this unless you know what you're doing.</span> |
|
| 437 |
</td> |
|
| 438 |
</tr> |
|
| 439 |
<tr> |
|
| 314 | 440 |
<td width="22%" valign="top" class="vncellreq">Interface</td> |
| 315 | 441 |
<td width="78%" class="vtable"> |
| 316 | 442 |
<select name="interface" class="formselect"> |
| 317 | 443 |
<?php |
| 318 |
|
|
| 444 |
|
|
| 319 | 445 |
$iflist = get_configured_interface_with_descr(false, true); |
| 320 |
foreach ($iflist as $if => $ifdesc)
|
|
| 321 |
if(have_ruleint_access($if))
|
|
| 446 |
foreach ($iflist as $if => $ifdesc) |
|
| 447 |
if(have_ruleint_access($if)) |
|
| 322 | 448 |
$interfaces[$if] = $ifdesc; |
| 323 |
|
|
| 449 |
|
|
| 324 | 450 |
if ($config['pptpd']['mode'] == "server") |
| 325 |
if(have_ruleint_access("pptp"))
|
|
| 451 |
if(have_ruleint_access("pptp"))
|
|
| 326 | 452 |
$interfaces['pptp'] = "PPTP VPN"; |
| 327 |
|
|
| 453 |
|
|
| 328 | 454 |
if ($config['pppoe']['mode'] == "server") |
| 329 |
if(have_ruleint_access("pppoe"))
|
|
| 455 |
if(have_ruleint_access("pppoe"))
|
|
| 330 | 456 |
$interfaces['pppoe'] = "PPPoE VPN"; |
| 331 |
|
|
| 457 |
|
|
| 332 | 458 |
/* add ipsec interfaces */ |
| 333 | 459 |
if (isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable'])) |
| 334 |
if(have_ruleint_access("enc0"))
|
|
| 335 |
$interfaces["enc0"] = "IPsec";
|
|
| 460 |
if(have_ruleint_access("enc0"))
|
|
| 461 |
$interfaces["enc0"] = "IPsec"; |
|
| 336 | 462 |
|
| 337 | 463 |
foreach ($interfaces as $iface => $ifacename): ?> |
| 338 | 464 |
<option value="<?=$iface;?>" <?php if ($iface == $pconfig['interface']) echo "selected"; ?>> |
| ... | ... | |
| 342 | 468 |
</select><br> |
| 343 | 469 |
<span class="vexpl">Choose which interface this rule applies to.<br> |
| 344 | 470 |
Hint: in most cases, you'll want to use WAN here.</span></td> |
| 345 |
</tr> |
|
| 346 |
<tr> |
|
| 347 |
<td width="22%" valign="top" class="vncellreq">External address</td> |
|
| 348 |
<td width="78%" class="vtable"> |
|
| 349 |
<select name="extaddr" class="formselect"> |
|
| 350 |
<option value="" <?php if (!$pconfig['extaddr']) echo "selected"; ?>>Interface address</option> |
|
| 351 |
<?php if (is_array($config['virtualip']['vip'])): |
|
| 352 |
foreach ($config['virtualip']['vip'] as $sn): |
|
| 353 |
if ($sn['mode'] == "proxyarp" && $sn['type'] == "network"): |
|
| 354 |
$baseip = ip2long($sn['subnet']) & ip2long(gen_subnet_mask($sn['subnet_bits'])); |
|
| 355 |
for ($i = $sn['subnet_bits']; $i <= 32; $i++): |
|
| 356 |
$baseip = $baseip + 1; |
|
| 357 |
$snip = long2ip($baseip); |
|
| 358 |
?> |
|
| 359 |
<option value="<?=$snip;?>" <?php if ($snip == $pconfig['extaddr']) echo "selected"; ?>><?=htmlspecialchars("{$snip} ({$sn['descr']})");?></option>
|
|
| 360 |
<?php endfor; |
|
| 361 |
else: ?> |
|
| 362 |
<option value="<?=$sn['subnet'];?>" <?php if ($sn['subnet'] == $pconfig['extaddr']) echo "selected"; ?>><?=htmlspecialchars("{$sn['subnet']} ({$sn['descr']})");?></option>
|
|
| 363 |
<?php endif; ?> |
|
| 364 |
<?php endforeach; |
|
| 365 |
endif; ?> |
|
| 366 |
<option value="any" <?php if($pconfig['extaddr'] == "any") echo "selected"; ?>>any</option> |
|
| 367 |
</select> |
|
| 368 |
<br /> |
|
| 369 |
<span class="vexpl"> |
|
| 370 |
If you want this rule to apply to another IP address than the IP address of the interface chosen above, |
|
| 371 |
select it here (you need to define <a href="firewall_virtual_ip.php">Virtual IP</a> addresses on the first). Also note that if you are trying to redirect connections on the LAN select the "any" option.</span></td> |
|
| 372 | 471 |
</tr> |
| 373 | 472 |
<tr> |
| 374 | 473 |
<td width="22%" valign="top" class="vncellreq">Protocol</td> |
| ... | ... | |
| 381 | 480 |
this rule should match.<br> |
| 382 | 481 |
Hint: in most cases, you should specify <em>TCP</em> here.</span></td> |
| 383 | 482 |
</tr> |
| 384 |
<tr> |
|
| 385 |
<td width="22%" valign="top" class="vncellreq">External port |
|
| 386 |
range </td> |
|
| 387 |
<td width="78%" class="vtable"> |
|
| 388 |
<table border="0" cellspacing="0" cellpadding="0"> |
|
| 389 |
<tr> |
|
| 390 |
<td>from: </td> |
|
| 391 |
<td><select name="beginport" class="formselect" onChange="ext_rep_change(); ext_change(); check_for_aliases();"> |
|
| 392 |
<option value="">(other)</option> |
|
| 393 |
<?php $bfound = 0; foreach ($wkports as $wkport => $wkportdesc): ?> |
|
| 394 |
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['beginport']) {
|
|
| 395 |
echo "selected"; |
|
| 396 |
$bfound = 1; |
|
| 397 |
}?>> |
|
| 398 |
<?=htmlspecialchars($wkportdesc);?> |
|
| 399 |
</option> |
|
| 400 |
<?php endforeach; ?> |
|
| 401 |
</select> <input onChange="check_for_aliases();" autocomplete='off' class="formfldalias" name="beginport_cust" id="beginport_cust" type="text" size="5" value="<?php if (!$bfound) echo $pconfig['beginport']; ?>"></td> |
|
| 402 |
</tr> |
|
| 403 |
<tr> |
|
| 404 |
<td>to:</td> |
|
| 405 |
<td><select name="endport" class="formselect" onChange="ext_change(); check_for_aliases();"> |
|
| 406 |
<option value="">(other)</option> |
|
| 407 |
<?php $bfound = 0; foreach ($wkports as $wkport => $wkportdesc): ?> |
|
| 408 |
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['endport']) {
|
|
| 409 |
echo "selected"; |
|
| 410 |
$bfound = 1; |
|
| 411 |
}?>> |
|
| 412 |
<?=htmlspecialchars($wkportdesc);?> |
|
| 413 |
</option> |
|
| 414 |
<?php endforeach; ?> |
|
| 415 |
</select> <input onChange="check_for_aliases();" class="formfldalias" autocomplete='off' name="endport_cust" id="endport_cust" type="text" size="5" value="<?php if (!$bfound) echo $pconfig['endport']; ?>"></td> |
|
| 416 |
</tr> |
|
| 417 |
</table> |
|
| 418 |
<br> <span class="vexpl">Specify the port or port range on |
|
| 419 |
the firewall's external address for this mapping.<br> |
|
| 420 |
Hint: you can leave the <em>'to'</em> field empty if you only |
|
| 421 |
want to map a single port</span></td> |
|
| 422 |
</tr> |
|
| 483 |
<tr id="showadvancedboxsrc" name="showadvancedboxsrc"> |
|
| 484 |
<td width="22%" valign="top" class="vncellreq">Source</td> |
|
| 485 |
<td width="78%" class="vtable"> |
|
| 486 |
<input type="button" onClick="show_source()" value="Advanced"></input> - Show source address and port range</a> |
|
| 487 |
</td> |
|
| 488 |
</tr> |
|
| 489 |
<tr style="display: none;" id="srctable" name="srctable"> |
|
| 490 |
<td width="22%" valign="top" class="vncellreq">Source</td> |
|
| 491 |
<td width="78%" class="vtable"> |
|
| 492 |
<input name="srcnot" type="checkbox" id="srcnot" value="yes" <?php if ($pconfig['srcnot']) echo "checked"; ?>> |
|
| 493 |
<strong>not</strong> |
|
| 494 |
<br /> |
|
| 495 |
Use this option to invert the sense of the match. |
|
| 496 |
<br /> |
|
| 497 |
<br /> |
|
| 498 |
<table border="0" cellspacing="0" cellpadding="0"> |
|
| 499 |
<tr> |
|
| 500 |
<td>Type: </td> |
|
| 501 |
<td> |
|
| 502 |
<select name="srctype" class="formselect" onChange="typesel_change()"> |
|
| 503 |
<?php |
|
| 504 |
$sel = is_specialnet($pconfig['src']); ?> |
|
| 505 |
<option value="any" <?php if ($pconfig['src'] == "any") { echo "selected"; } ?>>any</option>
|
|
| 506 |
<option value="single" <?php if (($pconfig['srcmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>>Single host or alias</option>
|
|
| 507 |
<option value="network" <?php if (!$sel) echo "selected"; ?>>Network</option> |
|
| 508 |
<?php if(have_ruleint_access("pptp")): ?>
|
|
| 509 |
<option value="pptp" <?php if ($pconfig['src'] == "pptp") { echo "selected"; } ?>>PPTP clients</option>
|
|
| 510 |
<?php endif; ?> |
|
| 511 |
<?php if(have_ruleint_access("pppoe")): ?>
|
|
| 512 |
<option value="pppoe" <?php if ($pconfig['src'] == "pppoe") { echo "selected"; } ?>>PPPoE clients</option>
|
|
| 513 |
<?php endif; ?> |
|
| 514 |
<?php if(have_ruleint_access("l2tp")): ?>
|
|
| 515 |
<option value="l2tp" <?php if ($pconfig['src'] == "l2tp") { echo "selected"; } ?>>L2TP clients</option>
|
|
| 516 |
<?php endif; ?> |
|
| 517 |
<?php |
|
| 518 |
foreach ($ifdisp as $ifent => $ifdesc): ?> |
|
| 519 |
<?php if(have_ruleint_access($ifent)): ?> |
|
| 520 |
<option value="<?=$ifent;?>" <?php if ($pconfig['src'] == $ifent) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?> subnet</option>
|
|
| 521 |
<option value="<?=$ifent;?>ip"<?php if ($pconfig['src'] == $ifent . "ip") { echo "selected"; } ?>>
|
|
| 522 |
<?=$ifdesc?> address |
|
| 523 |
</option> |
|
| 524 |
<?php endif; ?> |
|
| 525 |
<?php endforeach; ?> |
|
| 526 |
</select> |
|
| 527 |
</td> |
|
| 528 |
</tr> |
|
| 529 |
<tr> |
|
| 530 |
<td>Address: </td> |
|
| 531 |
<td> |
|
| 532 |
<input autocomplete='off' name="src" type="text" class="formfldalias" id="src" size="20" value="<?php if (!is_specialnet($pconfig['src'])) echo htmlspecialchars($pconfig['src']);?>"> / |
|
| 533 |
<select name="srcmask" class="formselect" id="srcmask"> |
|
| 534 |
<?php for ($i = 31; $i > 0; $i--): ?> |
|
| 535 |
<option value="<?=$i;?>" <?php if ($i == $pconfig['srcmask']) echo "selected"; ?>><?=$i;?></option> |
|
| 536 |
<?php endfor; ?> |
|
| 537 |
</select> |
|
| 538 |
</td> |
|
| 539 |
</tr> |
|
| 540 |
</table> |
|
| 541 |
</td> |
|
| 542 |
</tr> |
|
| 543 |
<tr style="display:none" id="sprtable" name="sprtable"> |
|
| 544 |
<td width="22%" valign="top" class="vncellreq">Source port range</td> |
|
| 545 |
<td width="78%" class="vtable"> |
|
| 546 |
<table border="0" cellspacing="0" cellpadding="0"> |
|
| 547 |
<tr> |
|
| 548 |
<td>from: </td> |
|
| 549 |
<td> |
|
| 550 |
<select name="srcbeginport" class="formselect" onchange="src_rep_change();ext_change()"> |
|
| 551 |
<option value="">(other)</option> |
|
| 552 |
<option value="any" <?php $bfound = 0; if ($pconfig['srcbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
|
|
| 553 |
<?php foreach ($wkports as $wkport => $wkportdesc): ?> |
|
| 554 |
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcbeginport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
|
|
| 555 |
<?php endforeach; ?> |
|
| 556 |
</select> |
|
| 557 |
<input autocomplete='off' class="formfldalias" name="srcbeginport_cust" id="srcbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcbeginport']) echo $pconfig['srcbeginport']; ?>"> |
|
| 558 |
</td> |
|
| 559 |
</tr> |
|
| 560 |
<tr> |
|
| 561 |
<td>to:</td> |
|
| 562 |
<td> |
|
| 563 |
<select name="srcendport" class="formselect" onchange="ext_change()"> |
|
| 564 |
<option value="">(other)</option> |
|
| 565 |
<option value="any" <?php $bfound = 0; if ($pconfig['srcendport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
|
|
| 566 |
<?php foreach ($wkports as $wkport => $wkportdesc): ?> |
|
| 567 |
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
|
|
| 568 |
<?php endforeach; ?> |
|
| 569 |
</select> |
|
| 570 |
<input autocomplete='off' class="formfldalias" name="srcendport_cust" id="srcendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcendport']) echo $pconfig['srcendport']; ?>"> |
|
| 571 |
</td> |
|
| 572 |
</tr> |
|
| 573 |
</table> |
|
| 574 |
<br /> |
|
| 575 |
<span class="vexpl">Specify the source port or port range for this rule. <b>This is almost never equal to the destination port range (and is usually "any")</b>. <br /> Hint: you can leave the <em>'to'</em> field empty if you only want to filter a single port</span><br/> |
|
| 576 |
</td> |
|
| 577 |
</tr> |
|
| 578 |
<tr> |
|
| 579 |
<td width="22%" valign="top" class="vncellreq">Destination</td> |
|
| 580 |
<td width="78%" class="vtable"> |
|
| 581 |
<input name="dstnot" type="checkbox" id="dstnot" value="yes" <?php if ($pconfig['dstnot']) echo "checked"; ?>> |
|
| 582 |
<strong>not</strong> |
|
| 583 |
<br /> |
|
| 584 |
Use this option to invert the sense of the match. |
|
| 585 |
<br /> |
|
| 586 |
<br /> |
|
| 587 |
<table border="0" cellspacing="0" cellpadding="0"> |
|
| 588 |
<tr> |
|
| 589 |
<td>Type: </td> |
|
| 590 |
<td> |
|
| 591 |
<select name="dsttype" class="formselect" onChange="typesel_change()"> |
|
| 592 |
<?php |
|
| 593 |
$sel = is_specialnet($pconfig['dst']); ?> |
|
| 594 |
<option value="any" <?php if ($pconfig['dst'] == "any") { echo "selected"; } ?>>any</option>
|
|
| 595 |
<option value="single" <?php if (($pconfig['dstmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>>Single host or alias</option>
|
|
| 596 |
<option value="network" <?php if (!$sel) echo "selected"; ?>>Network</option> |
|
| 597 |
<?php if(have_ruleint_access("pptp")): ?>
|
|
| 598 |
<option value="pptp" <?php if ($pconfig['dst'] == "pptp") { echo "selected"; } ?>>PPTP clients</option>
|
|
| 599 |
<?php endif; ?> |
|
| 600 |
<?php if(have_ruleint_access("pppoe")): ?>
|
|
| 601 |
<option value="pppoe" <?php if ($pconfig['dst'] == "pppoe") { echo "selected"; } ?>>PPPoE clients</option>
|
|
| 602 |
<?php endif; ?> |
|
| 603 |
<?php if(have_ruleint_access("l2tp")): ?>
|
|
| 604 |
<option value="l2tp" <?php if ($pconfig['dst'] == "l2tp") { echo "selected"; } ?>>L2TP clients</option>
|
|
| 605 |
<?php endif; ?> |
|
| 606 |
|
|
| 607 |
<?php foreach ($ifdisp as $if => $ifdesc): ?> |
|
| 608 |
<?php if(have_ruleint_access($if)): ?> |
|
| 609 |
<option value="<?=$if;?>" <?php if ($pconfig['dst'] == $if) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?> subnet</option>
|
|
| 610 |
<option value="<?=$if;?>ip"<?php if ($pconfig['dst'] == $if . "ip") { echo "selected"; } ?>>
|
|
| 611 |
<?=$ifdesc;?> address |
|
| 612 |
</option> |
|
| 613 |
<?php endif; ?> |
|
| 614 |
<?php endforeach; ?> |
|
| 615 |
</select> |
|
| 616 |
</td> |
|
| 617 |
</tr> |
|
| 618 |
<tr> |
|
| 619 |
<td>Address: </td> |
|
| 620 |
<td> |
|
| 621 |
<input name="dst" type="text" class="formfldalias" id="dst" size="20" value="<?php if (!is_specialnet($pconfig['dst'])) echo htmlspecialchars($pconfig['dst']);?>"> |
|
| 622 |
/ |
|
| 623 |
<select name="dstmask" class="formselect" id="dstmask"> |
|
| 624 |
<?php |
|
| 625 |
for ($i = 31; $i > 0; $i--): ?> |
|
| 626 |
<option value="<?=$i;?>" <?php if ($i == $pconfig['dstmask']) echo "selected"; ?>><?=$i;?></option> |
|
| 627 |
<?php endfor; ?> |
|
| 628 |
</select> |
|
| 629 |
</td> |
|
| 630 |
</tr> |
|
| 631 |
</table> |
|
| 632 |
</td> |
|
| 633 |
</tr> |
|
| 634 |
<tr id="dprtr" name="dprtr"> |
|
| 635 |
<td width="22%" valign="top" class="vncellreq">Destination port range </td> |
|
| 636 |
<td width="78%" class="vtable"> |
|
| 637 |
<table border="0" cellspacing="0" cellpadding="0"> |
|
| 638 |
<tr> |
|
| 639 |
<td>from: </td> |
|
| 640 |
<td> |
|
| 641 |
<select name="dstbeginport" class="formselect" onchange="dst_rep_change();ext_change()"> |
|
| 642 |
<option value="">(other)</option> |
|
| 643 |
<option value="any" <?php $bfound = 0; if ($pconfig['dstbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
|
|
| 644 |
<?php foreach ($wkports as $wkport => $wkportdesc): ?> |
|
| 645 |
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstbeginport']) { echo "selected"; $bfound = 1; }?>><?=htmlspecialchars($wkportdesc);?></option>
|
|
| 646 |
<?php endforeach; ?> |
|
| 647 |
</select> |
|
| 648 |
<input autocomplete='off' class="formfldalias" name="dstbeginport_cust" id="dstbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstbeginport']) echo $pconfig['dstbeginport']; ?>"> |
|
| 649 |
</td> |
|
| 650 |
</tr> |
|
| 651 |
<tr> |
|
| 652 |
<td>to:</td> |
|
| 653 |
<td> |
|
| 654 |
<select name="dstendport" class="formselect" onchange="ext_change()"> |
|
| 655 |
<option value="">(other)</option> |
|
| 656 |
<option value="any" <?php $bfound = 0; if ($pconfig['dstendport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
|
|
| 657 |
<?php foreach ($wkports as $wkport => $wkportdesc): ?> |
|
| 658 |
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
|
|
| 659 |
<?php endforeach; ?> |
|
| 660 |
</select> |
|
| 661 |
<input autocomplete='off' class="formfldalias" name="dstendport_cust" id="dstendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstendport']) echo $pconfig['dstendport']; ?>"> |
|
| 662 |
</td> |
|
| 663 |
</tr> |
|
| 664 |
</table> |
|
| 665 |
<br /> |
|
| 666 |
<span class="vexpl"> |
|
| 667 |
Specify the port or port range for the destination of the packet for this rule. |
|
| 668 |
<br /> |
|
| 669 |
Hint: you can leave the <em>'to'</em> field empty if you only want to filter a single port |
|
| 670 |
</span> |
|
| 671 |
</td> |
|
| 672 |
</tr> |
|
| 423 | 673 |
<tr> |
| 424 | 674 |
<td width="22%" valign="top" class="vncellreq">NAT IP</td> |
| 425 | 675 |
<td width="78%" class="vtable"> |
| ... | ... | |
| 470 | 720 |
<select name="associated-rule-id"> |
| 471 | 721 |
<option value="">None</option> |
| 472 | 722 |
<option value="pass" <?php if($pconfig['associated-rule-id'] == "pass") echo " SELECTED"; ?>>Pass</option> |
| 473 |
<?php
|
|
| 723 |
<?php |
|
| 474 | 724 |
$linkedrule = ""; |
| 475 | 725 |
if (is_array($config['filter']['rule'])) {
|
| 476 | 726 |
$filter_id = 0; |
| ... | ... | |
| 482 | 732 |
$linkedrule = "<br /><a href=\"firewall_rules_edit.php?id={$filter_id}\">View the filter rule</a><br/>";
|
| 483 | 733 |
} |
| 484 | 734 |
echo ">". htmlspecialchars('Rule ' . $filter_rule['descr']) . "</option>\n";
|
| 485 |
|
|
| 735 |
|
|
| 486 | 736 |
} |
| 487 | 737 |
if ($filter_rule['interface'] == $pconfig['interface']) |
| 488 | 738 |
$filter_id++; |
| ... | ... | |
| 526 | 776 |
<script language="JavaScript"> |
| 527 | 777 |
<!-- |
| 528 | 778 |
ext_change(); |
| 779 |
typesel_change(); |
|
| 780 |
proto_change(); |
|
| 529 | 781 |
//--> |
| 530 | 782 |
</script> |
| 531 | 783 |
<?php |
Also available in: Unified diff
Adding new fields to improved NAT port forward