| 1 |
5ba18897
|
Scott Ullrich
|
<?php
|
| 2 |
b46bfcf5
|
Bill Marquette
|
/* $Id$ */
|
| 3 |
5b237745
|
Scott Ullrich
|
/*
|
| 4 |
bdb7d6e7
|
Scott Ullrich
|
firewall_rules_edit.php
|
| 5 |
e4cabb75
|
Scott Ullrich
|
part of pfSense (http://www.pfsense.com)
|
| 6 |
|
|
Copyright (C) 2005 Scott Ullrich (sullrich@gmail.com)
|
| 7 |
5ba18897
|
Scott Ullrich
|
|
| 8 |
e4cabb75
|
Scott Ullrich
|
originally part of m0n0wall (http://m0n0.ch/wall)
|
| 9 |
bdb7d6e7
|
Scott Ullrich
|
Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
|
| 10 |
|
|
All rights reserved.
|
| 11 |
5ba18897
|
Scott Ullrich
|
|
| 12 |
bdb7d6e7
|
Scott Ullrich
|
Redistribution and use in source and binary forms, with or without
|
| 13 |
|
|
modification, are permitted provided that the following conditions are met:
|
| 14 |
5ba18897
|
Scott Ullrich
|
|
| 15 |
bdb7d6e7
|
Scott Ullrich
|
1. Redistributions of source code must retain the above copyright notice,
|
| 16 |
|
|
this list of conditions and the following disclaimer.
|
| 17 |
5ba18897
|
Scott Ullrich
|
|
| 18 |
bdb7d6e7
|
Scott Ullrich
|
2. Redistributions in binary form must reproduce the above copyright
|
| 19 |
|
|
notice, this list of conditions and the following disclaimer in the
|
| 20 |
|
|
documentation and/or other materials provided with the distribution.
|
| 21 |
5ba18897
|
Scott Ullrich
|
|
| 22 |
bdb7d6e7
|
Scott Ullrich
|
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
| 23 |
|
|
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
|
| 24 |
|
|
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
| 25 |
|
|
AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
|
| 26 |
|
|
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
| 27 |
|
|
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
| 28 |
|
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
| 29 |
|
|
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
| 30 |
|
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
| 31 |
|
|
POSSIBILITY OF SUCH DAMAGE.
|
| 32 |
5b237745
|
Scott Ullrich
|
*/
|
| 33 |
7ac5a4cb
|
Scott Ullrich
|
/*
|
| 34 |
|
|
pfSense_MODULE: filter
|
| 35 |
|
|
*/
|
| 36 |
5b237745
|
Scott Ullrich
|
|
| 37 |
6b07c15a
|
Matthew Grooms
|
##|+PRIV
|
| 38 |
|
|
##|*IDENT=page-firewall-rules-edit
|
| 39 |
|
|
##|*NAME=Firewall: Rules: Edit page
|
| 40 |
|
|
##|*DESCR=Allow access to the 'Firewall: Rules: Edit' page.
|
| 41 |
|
|
##|*MATCH=firewall_rules_edit.php*
|
| 42 |
|
|
##|-PRIV
|
| 43 |
|
|
|
| 44 |
5b237745
|
Scott Ullrich
|
require("guiconfig.inc");
|
| 45 |
1a03cf69
|
Scott Ullrich
|
require("filter.inc");
|
| 46 |
|
|
require("shaper.inc");
|
| 47 |
5b237745
|
Scott Ullrich
|
|
| 48 |
1e578a7f
|
Ermal Lu?i
|
$specialsrcdst = explode(" ", "any pptp pppoe l2tp openvpn");
|
| 49 |
3331a640
|
Ermal Lu?i
|
$ifdisp = get_configured_interface_with_descr();
|
| 50 |
679d21bb
|
Ermal Lu?i
|
foreach ($ifdisp as $kif => $kdescr) {
|
| 51 |
3331a640
|
Ermal Lu?i
|
$specialsrcdst[] = "{$kif}";
|
| 52 |
|
|
$specialsrcdst[] = "{$kif}ip";
|
| 53 |
679d21bb
|
Ermal Lu?i
|
}
|
| 54 |
5b237745
|
Scott Ullrich
|
|
| 55 |
|
|
if (!is_array($config['filter']['rule'])) {
|
| 56 |
|
|
$config['filter']['rule'] = array();
|
| 57 |
|
|
}
|
| 58 |
|
|
filter_rules_sort();
|
| 59 |
|
|
$a_filter = &$config['filter']['rule'];
|
| 60 |
|
|
|
| 61 |
|
|
$id = $_GET['id'];
|
| 62 |
|
|
if (is_numeric($_POST['id']))
|
| 63 |
|
|
$id = $_POST['id'];
|
| 64 |
5ba18897
|
Scott Ullrich
|
|
| 65 |
5b237745
|
Scott Ullrich
|
$after = $_GET['after'];
|
| 66 |
|
|
|
| 67 |
|
|
if (isset($_POST['after']))
|
| 68 |
|
|
$after = $_POST['after'];
|
| 69 |
|
|
|
| 70 |
|
|
if (isset($_GET['dup'])) {
|
| 71 |
|
|
$id = $_GET['dup'];
|
| 72 |
|
|
$after = $_GET['dup'];
|
| 73 |
|
|
}
|
| 74 |
|
|
|
| 75 |
|
|
if (isset($id) && $a_filter[$id]) {
|
| 76 |
|
|
$pconfig['interface'] = $a_filter[$id]['interface'];
|
| 77 |
5ba18897
|
Scott Ullrich
|
|
| 78 |
b9e28d57
|
unknown
|
if (isset($a_filter[$id]['id']))
|
| 79 |
|
|
$pconfig['ruleid'] = $a_filter[$id]['id'];
|
| 80 |
|
|
|
| 81 |
5b237745
|
Scott Ullrich
|
if (!isset($a_filter[$id]['type']))
|
| 82 |
|
|
$pconfig['type'] = "pass";
|
| 83 |
|
|
else
|
| 84 |
|
|
$pconfig['type'] = $a_filter[$id]['type'];
|
| 85 |
5ba18897
|
Scott Ullrich
|
|
| 86 |
4633edc2
|
Ermal Luçi
|
if (isset($a_filter[$id]['floating']) || $if == "FloatingRules") {
|
| 87 |
661aed33
|
Ermal Luçi
|
$pconfig['floating'] = $a_filter[$id]['floating'];
|
| 88 |
|
|
if (isset($a_filter[$id]['interface']) && $a_filter[$id]['interface'] <> "")
|
| 89 |
|
|
$pconfig['interface'] = $a_filter[$id]['interface'];
|
| 90 |
|
|
}
|
| 91 |
|
|
|
| 92 |
|
|
if (isset($a_filter['floating']))
|
| 93 |
|
|
$pconfig['floating'] = "yes";
|
| 94 |
|
|
|
| 95 |
|
|
if (isset($a_filter[$id]['direction']))
|
| 96 |
|
|
$pconfig['direction'] = $a_filter[$id]['direction'];
|
| 97 |
|
|
|
| 98 |
5b237745
|
Scott Ullrich
|
if (isset($a_filter[$id]['protocol']))
|
| 99 |
|
|
$pconfig['proto'] = $a_filter[$id]['protocol'];
|
| 100 |
|
|
else
|
| 101 |
|
|
$pconfig['proto'] = "any";
|
| 102 |
5ba18897
|
Scott Ullrich
|
|
| 103 |
5b237745
|
Scott Ullrich
|
if ($a_filter[$id]['protocol'] == "icmp")
|
| 104 |
|
|
$pconfig['icmptype'] = $a_filter[$id]['icmptype'];
|
| 105 |
5ba18897
|
Scott Ullrich
|
|
| 106 |
5b237745
|
Scott Ullrich
|
address_to_pconfig($a_filter[$id]['source'], $pconfig['src'],
|
| 107 |
|
|
$pconfig['srcmask'], $pconfig['srcnot'],
|
| 108 |
|
|
$pconfig['srcbeginport'], $pconfig['srcendport']);
|
| 109 |
5ba18897
|
Scott Ullrich
|
|
| 110 |
8be60f21
|
Scott Ullrich
|
if($a_filter[$id]['os'] <> "")
|
| 111 |
|
|
$pconfig['os'] = $a_filter[$id]['os'];
|
| 112 |
e33c8694
|
Bill Marquette
|
|
| 113 |
5b237745
|
Scott Ullrich
|
address_to_pconfig($a_filter[$id]['destination'], $pconfig['dst'],
|
| 114 |
|
|
$pconfig['dstmask'], $pconfig['dstnot'],
|
| 115 |
|
|
$pconfig['dstbeginport'], $pconfig['dstendport']);
|
| 116 |
|
|
|
| 117 |
c5fc1b2e
|
Ermal Luçi
|
if ($a_filter[$id]['dscp'] <> "")
|
| 118 |
|
|
$pconfig['dscp'] = $a_filter[$id]['dscp'];
|
| 119 |
|
|
|
| 120 |
5b237745
|
Scott Ullrich
|
$pconfig['disabled'] = isset($a_filter[$id]['disabled']);
|
| 121 |
|
|
$pconfig['log'] = isset($a_filter[$id]['log']);
|
| 122 |
|
|
$pconfig['descr'] = $a_filter[$id]['descr'];
|
| 123 |
8c84fe43
|
Scott Ullrich
|
|
| 124 |
b8ed2a11
|
Ermal
|
if (isset($a_filter[$id]['tcpflags_any']))
|
| 125 |
|
|
$pconfig['tcpflags_any'] = true;
|
| 126 |
|
|
else {
|
| 127 |
|
|
if (isset($a_filter[$id]['tcpflags1']) && $a_filter[$id]['tcpflags1'] <> "")
|
| 128 |
|
|
$pconfig['tcpflags1'] = $a_filter[$id]['tcpflags1'];
|
| 129 |
|
|
if (isset($a_filter[$id]['tcpflags2']) && $a_filter[$id]['tcpflags2'] <> "")
|
| 130 |
|
|
$pconfig['tcpflags2'] = $a_filter[$id]['tcpflags2'];
|
| 131 |
|
|
}
|
| 132 |
|
|
|
| 133 |
5c1f5584
|
Ermal Luçi
|
if (isset($a_filter[$id]['tag']) && $a_filter[$id]['tag'] <> "")
|
| 134 |
661aed33
|
Ermal Luçi
|
$pconfig['tag'] = $a_filter[$id]['tag'];
|
| 135 |
b6494651
|
Ermal Lu?i
|
if (isset($a_filter[$id]['tagged']) && $a_filter[$id]['tagged'] <> "")
|
| 136 |
661aed33
|
Ermal Luçi
|
$pconfig['tagged'] = $a_filter[$id]['tagged'];
|
| 137 |
|
|
if (isset($a_filter[$id]['quick']) && $a_filter[$id]['quick'])
|
| 138 |
|
|
$pconfig['quick'] = $a_filter[$id]['quick'];
|
| 139 |
775ccea3
|
Ermal Luci
|
if (isset($a_filter[$id]['allowopts']))
|
| 140 |
|
|
$pconfig['allowopts'] = true;
|
| 141 |
19757916
|
Ermal Lu?i
|
if (isset($a_filter[$id]['disablereplyto']))
|
| 142 |
|
|
$pconfig['disablereplyto'] = true;
|
| 143 |
661aed33
|
Ermal Luçi
|
|
| 144 |
ed08ef3e
|
Scott Ullrich
|
/* advanced */
|
| 145 |
a56b2fa0
|
pierrepomes
|
$pconfig['max'] = $a_filter[$id]['max'];
|
| 146 |
f1c49ff4
|
Scott Ullrich
|
$pconfig['max-src-nodes'] = $a_filter[$id]['max-src-nodes'];
|
| 147 |
26dd6a54
|
pierrepomes
|
$pconfig['max-src-conn'] = $a_filter[$id]['max-src-conn'];
|
| 148 |
f1c49ff4
|
Scott Ullrich
|
$pconfig['max-src-states'] = $a_filter[$id]['max-src-states'];
|
| 149 |
|
|
$pconfig['statetype'] = $a_filter[$id]['statetype'];
|
| 150 |
5ba18897
|
Scott Ullrich
|
$pconfig['statetimeout'] = $a_filter[$id]['statetimeout'];
|
| 151 |
8c84fe43
|
Scott Ullrich
|
|
| 152 |
f1c49ff4
|
Scott Ullrich
|
/* advanced - nosync */
|
| 153 |
8c84fe43
|
Scott Ullrich
|
$pconfig['nosync'] = isset($a_filter[$id]['nosync']);
|
| 154 |
10f21e70
|
Scott Ullrich
|
|
| 155 |
ed08ef3e
|
Scott Ullrich
|
/* advanced - new connection per second banning*/
|
| 156 |
|
|
$pconfig['max-src-conn-rate'] = $a_filter[$id]['max-src-conn-rate'];
|
| 157 |
|
|
$pconfig['max-src-conn-rates'] = $a_filter[$id]['max-src-conn-rates'];
|
| 158 |
5ba18897
|
Scott Ullrich
|
|
| 159 |
e5980370
|
Scott Ullrich
|
/* Multi-WAN next-hop support */
|
| 160 |
c98ddde2
|
Bill Marquette
|
$pconfig['gateway'] = $a_filter[$id]['gateway'];
|
| 161 |
615b27bc
|
Scott Dale
|
|
| 162 |
197bfe96
|
Ermal Luçi
|
/* Shaper support */
|
| 163 |
|
|
$pconfig['defaultqueue'] = $a_filter[$id]['defaultqueue'];
|
| 164 |
|
|
$pconfig['ackqueue'] = $a_filter[$id]['ackqueue'];
|
| 165 |
a5fd67e1
|
Ermal Luçi
|
$pconfig['dnpipe'] = $a_filter[$id]['dnpipe'];
|
| 166 |
|
|
$pconfig['pdnpipe'] = $a_filter[$id]['pdnpipe'];
|
| 167 |
7e50413c
|
Ermal Luçi
|
$pconfig['l7container'] = $a_filter[$id]['l7container'];
|
| 168 |
197bfe96
|
Ermal Luçi
|
|
| 169 |
615b27bc
|
Scott Dale
|
//schedule support
|
| 170 |
|
|
$pconfig['sched'] = $a_filter[$id]['sched'];
|
| 171 |
35c9cd44
|
Erik Fonnesbeck
|
if (!isset($_GET['dup']))
|
| 172 |
|
|
$pconfig['associated-rule-id'] = $a_filter[$id]['associated-rule-id'];
|
| 173 |
c98ddde2
|
Bill Marquette
|
|
| 174 |
5b237745
|
Scott Ullrich
|
} else {
|
| 175 |
|
|
/* defaults */
|
| 176 |
a23d7248
|
Scott Ullrich
|
if ($_GET['if'])
|
| 177 |
|
|
$pconfig['interface'] = $_GET['if'];
|
| 178 |
5b237745
|
Scott Ullrich
|
$pconfig['type'] = "pass";
|
| 179 |
|
|
$pconfig['src'] = "any";
|
| 180 |
|
|
$pconfig['dst'] = "any";
|
| 181 |
|
|
}
|
| 182 |
72320b88
|
Ermal Luçi
|
/* Allow the FlotingRules to work */
|
| 183 |
|
|
$if = $pconfig['interface'];
|
| 184 |
5b237745
|
Scott Ullrich
|
|
| 185 |
|
|
if (isset($_GET['dup']))
|
| 186 |
|
|
unset($id);
|
| 187 |
|
|
|
| 188 |
|
|
if ($_POST) {
|
| 189 |
87f0be87
|
Chris Buechler
|
|
| 190 |
|
|
if ($_POST['type'] == "reject" && $_POST['proto'] <> "tcp")
|
| 191 |
|
|
$input_errors[] = "Reject type rules only works when the protocol is set to TCP.";
|
| 192 |
28f9e493
|
Scott Ullrich
|
|
| 193 |
5b237745
|
Scott Ullrich
|
if (($_POST['proto'] != "tcp") && ($_POST['proto'] != "udp") && ($_POST['proto'] != "tcp/udp")) {
|
| 194 |
|
|
$_POST['srcbeginport'] = 0;
|
| 195 |
|
|
$_POST['srcendport'] = 0;
|
| 196 |
|
|
$_POST['dstbeginport'] = 0;
|
| 197 |
|
|
$_POST['dstendport'] = 0;
|
| 198 |
|
|
} else {
|
| 199 |
5ba18897
|
Scott Ullrich
|
|
| 200 |
5b237745
|
Scott Ullrich
|
if ($_POST['srcbeginport_cust'] && !$_POST['srcbeginport'])
|
| 201 |
|
|
$_POST['srcbeginport'] = $_POST['srcbeginport_cust'];
|
| 202 |
|
|
if ($_POST['srcendport_cust'] && !$_POST['srcendport'])
|
| 203 |
|
|
$_POST['srcendport'] = $_POST['srcendport_cust'];
|
| 204 |
5ba18897
|
Scott Ullrich
|
|
| 205 |
5b237745
|
Scott Ullrich
|
if ($_POST['srcbeginport'] == "any") {
|
| 206 |
|
|
$_POST['srcbeginport'] = 0;
|
| 207 |
|
|
$_POST['srcendport'] = 0;
|
| 208 |
5ba18897
|
Scott Ullrich
|
} else {
|
| 209 |
5b237745
|
Scott Ullrich
|
if (!$_POST['srcendport'])
|
| 210 |
|
|
$_POST['srcendport'] = $_POST['srcbeginport'];
|
| 211 |
|
|
}
|
| 212 |
|
|
if ($_POST['srcendport'] == "any")
|
| 213 |
|
|
$_POST['srcendport'] = $_POST['srcbeginport'];
|
| 214 |
5ba18897
|
Scott Ullrich
|
|
| 215 |
5b237745
|
Scott Ullrich
|
if ($_POST['dstbeginport_cust'] && !$_POST['dstbeginport'])
|
| 216 |
|
|
$_POST['dstbeginport'] = $_POST['dstbeginport_cust'];
|
| 217 |
|
|
if ($_POST['dstendport_cust'] && !$_POST['dstendport'])
|
| 218 |
|
|
$_POST['dstendport'] = $_POST['dstendport_cust'];
|
| 219 |
5ba18897
|
Scott Ullrich
|
|
| 220 |
5b237745
|
Scott Ullrich
|
if ($_POST['dstbeginport'] == "any") {
|
| 221 |
|
|
$_POST['dstbeginport'] = 0;
|
| 222 |
|
|
$_POST['dstendport'] = 0;
|
| 223 |
5ba18897
|
Scott Ullrich
|
} else {
|
| 224 |
5b237745
|
Scott Ullrich
|
if (!$_POST['dstendport'])
|
| 225 |
|
|
$_POST['dstendport'] = $_POST['dstbeginport'];
|
| 226 |
|
|
}
|
| 227 |
|
|
if ($_POST['dstendport'] == "any")
|
| 228 |
5ba18897
|
Scott Ullrich
|
$_POST['dstendport'] = $_POST['dstbeginport'];
|
| 229 |
5b237745
|
Scott Ullrich
|
}
|
| 230 |
5ba18897
|
Scott Ullrich
|
|
| 231 |
5b237745
|
Scott Ullrich
|
if (is_specialnet($_POST['srctype'])) {
|
| 232 |
|
|
$_POST['src'] = $_POST['srctype'];
|
| 233 |
|
|
$_POST['srcmask'] = 0;
|
| 234 |
|
|
} else if ($_POST['srctype'] == "single") {
|
| 235 |
|
|
$_POST['srcmask'] = 32;
|
| 236 |
|
|
}
|
| 237 |
|
|
if (is_specialnet($_POST['dsttype'])) {
|
| 238 |
|
|
$_POST['dst'] = $_POST['dsttype'];
|
| 239 |
|
|
$_POST['dstmask'] = 0;
|
| 240 |
|
|
} else if ($_POST['dsttype'] == "single") {
|
| 241 |
|
|
$_POST['dstmask'] = 32;
|
| 242 |
|
|
}
|
| 243 |
5ba18897
|
Scott Ullrich
|
|
| 244 |
5b237745
|
Scott Ullrich
|
unset($input_errors);
|
| 245 |
|
|
$pconfig = $_POST;
|
| 246 |
|
|
|
| 247 |
ef2a753c
|
Scott Ullrich
|
/* run through $_POST items encoding HTML entties so that the user
|
| 248 |
|
|
* cannot think he is slick and perform a XSS attack on the unwilling
|
| 249 |
|
|
*/
|
| 250 |
21eff66f
|
Scott Ullrich
|
foreach ($_POST as $key => $value) {
|
| 251 |
08825acc
|
smos
|
$temp = str_replace(">", "", $value);
|
| 252 |
|
|
|
| 253 |
661aed33
|
Ermal Luçi
|
if (isset($_POST['floating']) && $key == "interface")
|
| 254 |
|
|
continue;
|
| 255 |
21eff66f
|
Scott Ullrich
|
$newpost = htmlentities($temp);
|
| 256 |
5157927f
|
Scott Ullrich
|
if($newpost <> $temp)
|
| 257 |
|
|
$input_errors[] = "Invalid characters detected ($temp). Please remove invalid characters and save again.";
|
| 258 |
ef2a753c
|
Scott Ullrich
|
}
|
| 259 |
|
|
|
| 260 |
5b237745
|
Scott Ullrich
|
/* input validation */
|
| 261 |
1122a892
|
Erik Fonnesbeck
|
$reqdfields = explode(" ", "type proto");
|
| 262 |
|
|
if ( isset($a_filter[$id]['associated-rule-id'])===false ) {
|
| 263 |
|
|
$redqfields[] = "src";
|
| 264 |
473d0ff0
|
pierrepomes
|
$redqfields[] = "dst";
|
| 265 |
1122a892
|
Erik Fonnesbeck
|
}
|
| 266 |
|
|
$reqdfieldsn = explode(",", "Type,Protocol");
|
| 267 |
|
|
if ( isset($a_filter[$id]['associated-rule-id'])===false ) {
|
| 268 |
|
|
$reqdfieldsn[] = "Source";
|
| 269 |
473d0ff0
|
pierrepomes
|
$reqdfieldsn[] = "Destination";
|
| 270 |
1122a892
|
Erik Fonnesbeck
|
}
|
| 271 |
5b237745
|
Scott Ullrich
|
|
| 272 |
452ade89
|
Bill Marquette
|
if($_POST['statetype'] == "modulate state" or $_POST['statetype'] == "synproxy state") {
|
| 273 |
c22767b1
|
Bill Marquette
|
if( $_POST['proto'] != "tcp" )
|
| 274 |
|
|
$input_errors[] = "{$_POST['statetype']} is only valid with protocol tcp.";
|
| 275 |
452ade89
|
Bill Marquette
|
if(($_POST['statetype'] == "synproxy state") && ($_POST['gateway'] != ""))
|
| 276 |
|
|
$input_errors[] = "{$_POST['statetype']} is only valid if the gateway is set to 'default'.";
|
| 277 |
|
|
}
|
| 278 |
10f7933f
|
Chris Buechler
|
|
| 279 |
1122a892
|
Erik Fonnesbeck
|
if ( isset($a_filter[$id]['associated-rule-id'])===false &&
|
| 280 |
|
|
(!(is_specialnet($_POST['srctype']) || ($_POST['srctype'] == "single"))) ) {
|
| 281 |
5b237745
|
Scott Ullrich
|
$reqdfields[] = "srcmask";
|
| 282 |
|
|
$reqdfieldsn[] = "Source bit count";
|
| 283 |
|
|
}
|
| 284 |
9b16b834
|
Ermal Lu?i
|
if ( isset($a_filter[$id]['associated-rule-id'])===false &&
|
| 285 |
473d0ff0
|
pierrepomes
|
(!(is_specialnet($_POST['dsttype']) || ($_POST['dsttype'] == "single"))) ) {
|
| 286 |
5b237745
|
Scott Ullrich
|
$reqdfields[] = "dstmask";
|
| 287 |
|
|
$reqdfieldsn[] = "Destination bit count";
|
| 288 |
|
|
}
|
| 289 |
5ba18897
|
Scott Ullrich
|
|
| 290 |
5b237745
|
Scott Ullrich
|
do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
|
| 291 |
5ba18897
|
Scott Ullrich
|
|
| 292 |
5b237745
|
Scott Ullrich
|
if (!$_POST['srcbeginport']) {
|
| 293 |
|
|
$_POST['srcbeginport'] = 0;
|
| 294 |
|
|
$_POST['srcendport'] = 0;
|
| 295 |
|
|
}
|
| 296 |
|
|
if (!$_POST['dstbeginport']) {
|
| 297 |
|
|
$_POST['dstbeginport'] = 0;
|
| 298 |
|
|
$_POST['dstendport'] = 0;
|
| 299 |
|
|
}
|
| 300 |
5ba18897
|
Scott Ullrich
|
|
| 301 |
9b45f821
|
Ermal Lu?i
|
if ($_POST['srcbeginport'] && !is_portoralias($_POST['srcbeginport']))
|
| 302 |
|
|
$input_errors[] = "{$_POST['srcbeginport']} is not a valid start source port. It must be a port alias or integer between 1 and 65535.";
|
| 303 |
|
|
if ($_POST['srcendport'] && !is_portoralias($_POST['srcendport']))
|
| 304 |
|
|
$input_errors[] = "{$_POST['srcendport']} is not a valid end source port. It must be a port alias or integer between 1 and 65535.";
|
| 305 |
|
|
if ($_POST['dstbeginport'] && !is_portoralias($_POST['dstbeginport']))
|
| 306 |
|
|
$input_errors[] = "{$_POST['dstbeginport']} is not a valid start destination port. It must be a port alias or integer between 1 and 65535.";
|
| 307 |
|
|
if ($_POST['dstendport'] && !is_portoralias($_POST['dstendport']))
|
| 308 |
|
|
$input_errors[] = "{$_POST['dstendport']} is not a valid end destination port. It must be a port alias or integer between 1 and 65535.";
|
| 309 |
5ba18897
|
Scott Ullrich
|
|
| 310 |
0e5ddcd9
|
Scott Ullrich
|
/* if user enters an alias and selects "network" then disallow. */
|
| 311 |
|
|
if($_POST['srctype'] == "network") {
|
| 312 |
|
|
if(is_alias($_POST['src']))
|
| 313 |
|
|
$input_errors[] = "You must specify single host or alias for alias entries.";
|
| 314 |
|
|
}
|
| 315 |
|
|
if($_POST['dsttype'] == "network") {
|
| 316 |
|
|
if(is_alias($_POST['dst']))
|
| 317 |
|
|
$input_errors[] = "You must specify single host or alias for alias entries.";
|
| 318 |
|
|
}
|
| 319 |
|
|
|
| 320 |
5b237745
|
Scott Ullrich
|
if (!is_specialnet($_POST['srctype'])) {
|
| 321 |
1e578a7f
|
Ermal Lu?i
|
if (($_POST['src'] && !is_ipaddroralias($_POST['src']))) {
|
| 322 |
9b45f821
|
Ermal Lu?i
|
$input_errors[] = "{$_POST['src']} is not a valid source IP address or alias.";
|
| 323 |
5b237745
|
Scott Ullrich
|
}
|
| 324 |
|
|
if (($_POST['srcmask'] && !is_numericint($_POST['srcmask']))) {
|
| 325 |
|
|
$input_errors[] = "A valid source bit count must be specified.";
|
| 326 |
|
|
}
|
| 327 |
|
|
}
|
| 328 |
|
|
if (!is_specialnet($_POST['dsttype'])) {
|
| 329 |
1e578a7f
|
Ermal Lu?i
|
if (($_POST['dst'] && !is_ipaddroralias($_POST['dst']))) {
|
| 330 |
9b45f821
|
Ermal Lu?i
|
$input_errors[] = "{$_POST['dst']} is not a valid destination IP address or alias.";
|
| 331 |
5b237745
|
Scott Ullrich
|
}
|
| 332 |
|
|
if (($_POST['dstmask'] && !is_numericint($_POST['dstmask']))) {
|
| 333 |
|
|
$input_errors[] = "A valid destination bit count must be specified.";
|
| 334 |
|
|
}
|
| 335 |
|
|
}
|
| 336 |
5ba18897
|
Scott Ullrich
|
|
| 337 |
5b237745
|
Scott Ullrich
|
if ($_POST['srcbeginport'] > $_POST['srcendport']) {
|
| 338 |
|
|
/* swap */
|
| 339 |
|
|
$tmp = $_POST['srcendport'];
|
| 340 |
|
|
$_POST['srcendport'] = $_POST['srcbeginport'];
|
| 341 |
|
|
$_POST['srcbeginport'] = $tmp;
|
| 342 |
|
|
}
|
| 343 |
|
|
if ($_POST['dstbeginport'] > $_POST['dstendport']) {
|
| 344 |
|
|
/* swap */
|
| 345 |
|
|
$tmp = $_POST['dstendport'];
|
| 346 |
|
|
$_POST['dstendport'] = $_POST['dstbeginport'];
|
| 347 |
|
|
$_POST['dstbeginport'] = $tmp;
|
| 348 |
|
|
}
|
| 349 |
e33c8694
|
Bill Marquette
|
if ($_POST['os'])
|
| 350 |
|
|
if( $_POST['proto'] != "tcp" )
|
| 351 |
|
|
$input_errors[] = "OS detection is only valid with protocol tcp.";
|
| 352 |
5b237745
|
Scott Ullrich
|
|
| 353 |
197bfe96
|
Ermal Luçi
|
if ($_POST['ackqueue'] && $_POST['ackqueue'] != "none") {
|
| 354 |
|
|
if ($_POST['defaultqueue'] == "none" )
|
| 355 |
|
|
$input_errors[] = "You have to select a queue when you select an acknowledge queue too.";
|
| 356 |
|
|
else if ($_POST['ackqueue'] == $_POST['defaultqueue'])
|
| 357 |
aa8cdf52
|
Scott Ullrich
|
$input_errors[] = "Acknowledge queue and Queue cannot be the same.";
|
| 358 |
197bfe96
|
Ermal Luçi
|
}
|
| 359 |
a5fd67e1
|
Ermal Luçi
|
if ($_POST['pdnpipe'] && $_POST['pdnpipe'] != "none") {
|
| 360 |
|
|
if ($_POST['dnpipe'] == "none" )
|
| 361 |
|
|
$input_errors[] = "You must select a queue for the In direction before selecting one for Out too.";
|
| 362 |
|
|
else if ($_POST['pdnpipe'] == $_POST['dnpipe'])
|
| 363 |
|
|
$input_errors[] = "In and Out Queue cannot be the same.";
|
| 364 |
|
|
else if ($pdnpipe[0] == "?" && $dnpipe[0] <> "?")
|
| 365 |
|
|
$input_errors[] = "You cannot select one queue and one virtual interface for IN and Out. both must be from the same type.";
|
| 366 |
|
|
else if ($dnpipe[0] == "?" && $pdnpipe[0] <> "?")
|
| 367 |
|
|
$input_errors[] = "You cannot select one queue and one virtual interface for IN and Out. both must be from the same type.";
|
| 368 |
|
|
}
|
| 369 |
b9e28d57
|
unknown
|
if( !empty($_POST['ruleid']) && !ctype_digit($_POST['ruleid']))
|
| 370 |
|
|
$input_errors[] = 'ID must be an integer';
|
| 371 |
7e50413c
|
Ermal Luçi
|
if($_POST['l7container'] && $_POST['l7container'] != "none") {
|
| 372 |
|
|
if(!($_POST['proto'] == "tcp" || $_POST['proto'] == "udp" || $_POST['proto'] == "tcp/udp"))
|
| 373 |
8b69a3e1
|
Chris Buechler
|
$input_errors[] = "You can only select a layer7 container for TCP and/or UDP protocols";
|
| 374 |
3b184ca5
|
Ermal Lu?i
|
if ($_POST['type'] <> "pass")
|
| 375 |
|
|
$input_errors[] = "You can only select a layer7 container for Pass type rules.";
|
| 376 |
7e50413c
|
Ermal Luçi
|
}
|
| 377 |
197bfe96
|
Ermal Luçi
|
|
| 378 |
b8ed2a11
|
Ermal
|
if (!$_POST['tcpflags_any']) {
|
| 379 |
|
|
$settcpflags = array();
|
| 380 |
|
|
$outoftcpflags = array();
|
| 381 |
|
|
foreach ($tcpflags as $tcpflag) {
|
| 382 |
|
|
if ($_POST['tcpflags1_' . $tcpflag] == "on")
|
| 383 |
|
|
$settcpflags[] = $tcpflag;
|
| 384 |
|
|
if ($_POST['tcpflags2_' . $tcpflag] == "on")
|
| 385 |
|
|
$outoftcpflags[] = $tcpflag;
|
| 386 |
|
|
}
|
| 387 |
|
|
if (empty($outoftcpflags) && !empty($settcpflags))
|
| 388 |
|
|
$input_errors[] = "If you specify TCP flags that should be set you should specify out of which flags as well.";
|
| 389 |
|
|
}
|
| 390 |
|
|
|
| 391 |
5b237745
|
Scott Ullrich
|
if (!$input_errors) {
|
| 392 |
|
|
$filterent = array();
|
| 393 |
b9e28d57
|
unknown
|
$filterent['id'] = $_POST['ruleid']>0?$_POST['ruleid']:'';
|
| 394 |
5b237745
|
Scott Ullrich
|
$filterent['type'] = $_POST['type'];
|
| 395 |
661aed33
|
Ermal Luçi
|
if (isset($_POST['interface'] ))
|
| 396 |
|
|
$filterent['interface'] = $_POST['interface'];
|
| 397 |
|
|
|
| 398 |
b8ed2a11
|
Ermal
|
if ($_POST['tcpflags_any']) {
|
| 399 |
|
|
$filterent['tcpflags_any'] = true;
|
| 400 |
|
|
} else {
|
| 401 |
|
|
$settcpflags = array();
|
| 402 |
|
|
$outoftcpflags = array();
|
| 403 |
|
|
foreach ($tcpflags as $tcpflag) {
|
| 404 |
|
|
if ($_POST['tcpflags1_' . $tcpflag] == "on")
|
| 405 |
|
|
$settcpflags[] = $tcpflag;
|
| 406 |
|
|
if ($_POST['tcpflags2_' . $tcpflag] == "on")
|
| 407 |
|
|
$outoftcpflags[] = $tcpflag;
|
| 408 |
|
|
}
|
| 409 |
|
|
if (!empty($outoftcpflags)) {
|
| 410 |
|
|
$filterent['tcpflags2'] = join(",", $outoftcpflags);
|
| 411 |
|
|
if (!empty($settcpflags))
|
| 412 |
|
|
$filterent['tcpflags1'] = join(",", $settcpflags);
|
| 413 |
|
|
}
|
| 414 |
|
|
}
|
| 415 |
|
|
|
| 416 |
661aed33
|
Ermal Luçi
|
if ($if == "FloatingRules" || isset($_POST['floating'])) {
|
| 417 |
|
|
if (isset($_POST['tag']))
|
| 418 |
|
|
$filterent['tag'] = $_POST['tag'];
|
| 419 |
|
|
if (isset($_POST['tagged']))
|
| 420 |
f1602cc4
|
sullrich
|
$filterent['tagged'] = $_POST['tagged'];
|
| 421 |
661aed33
|
Ermal Luçi
|
$filterent['direction'] = $_POST['direction'];
|
| 422 |
|
|
if (isset($_POST['quick']) && $_POST['quick'] <> "")
|
| 423 |
|
|
$filterent['quick'] = $_POST['quick'];
|
| 424 |
|
|
$filterent['floating'] = "yes";
|
| 425 |
|
|
if (isset($_POST['interface']) && count($_POST['interface']) > 0) {
|
| 426 |
f1602cc4
|
sullrich
|
$filterent['interface'] = implode(",", $_POST['interface']);
|
| 427 |
661aed33
|
Ermal Luçi
|
}
|
| 428 |
|
|
}
|
| 429 |
d59874c1
|
Scott Ullrich
|
|
| 430 |
bdb7d6e7
|
Scott Ullrich
|
/* Advanced options */
|
| 431 |
775ccea3
|
Ermal Luci
|
if ($_POST['allowopts'] == "yes")
|
| 432 |
|
|
$filterent['allowopts'] = true;
|
| 433 |
|
|
else
|
| 434 |
|
|
unset($filterent['allowopts']);
|
| 435 |
19757916
|
Ermal Lu?i
|
if ($_POST['disablereplyto'] == "yes")
|
| 436 |
|
|
$filterent['disablereplyto'] = true;
|
| 437 |
|
|
else
|
| 438 |
|
|
unset($filterent['disablereplyto']);
|
| 439 |
a56b2fa0
|
pierrepomes
|
$filterent['max'] = $_POST['max'];
|
| 440 |
bdb7d6e7
|
Scott Ullrich
|
$filterent['max-src-nodes'] = $_POST['max-src-nodes'];
|
| 441 |
26dd6a54
|
pierrepomes
|
$filterent['max-src-conn'] = $_POST['max-src-conn'];
|
| 442 |
bdb7d6e7
|
Scott Ullrich
|
$filterent['max-src-states'] = $_POST['max-src-states'];
|
| 443 |
5ba18897
|
Scott Ullrich
|
$filterent['statetimeout'] = $_POST['statetimeout'];
|
| 444 |
fa9af164
|
Scott Ullrich
|
$filterent['statetype'] = $_POST['statetype'];
|
| 445 |
e33c8694
|
Bill Marquette
|
$filterent['os'] = $_POST['os'];
|
| 446 |
10f21e70
|
Scott Ullrich
|
|
| 447 |
|
|
/* Nosync directive - do not xmlrpc sync this item */
|
| 448 |
8c84fe43
|
Scott Ullrich
|
if($_POST['nosync'] <> "")
|
| 449 |
10f21e70
|
Scott Ullrich
|
$filterent['nosync'] = true;
|
| 450 |
|
|
else
|
| 451 |
|
|
unset($filterent['nosync']);
|
| 452 |
|
|
|
| 453 |
3f00c1dc
|
Scott Ullrich
|
/* unless both values are provided, unset the values - ticket #650 */
|
| 454 |
|
|
if($_POST['max-src-conn-rate'] <> "" and $_POST['max-src-conn-rates'] <> "") {
|
| 455 |
|
|
$filterent['max-src-conn-rate'] = $_POST['max-src-conn-rate'];
|
| 456 |
|
|
$filterent['max-src-conn-rates'] = $_POST['max-src-conn-rates'];
|
| 457 |
|
|
} else {
|
| 458 |
|
|
unset($filterent['max-src-conn-rate']);
|
| 459 |
|
|
unset($filterent['max-src-conn-rates']);
|
| 460 |
|
|
}
|
| 461 |
5ba18897
|
Scott Ullrich
|
|
| 462 |
5b237745
|
Scott Ullrich
|
if ($_POST['proto'] != "any")
|
| 463 |
|
|
$filterent['protocol'] = $_POST['proto'];
|
| 464 |
|
|
else
|
| 465 |
|
|
unset($filterent['protocol']);
|
| 466 |
5ba18897
|
Scott Ullrich
|
|
| 467 |
5b237745
|
Scott Ullrich
|
if ($_POST['proto'] == "icmp" && $_POST['icmptype'])
|
| 468 |
|
|
$filterent['icmptype'] = $_POST['icmptype'];
|
| 469 |
|
|
else
|
| 470 |
|
|
unset($filterent['icmptype']);
|
| 471 |
5ba18897
|
Scott Ullrich
|
|
| 472 |
5b237745
|
Scott Ullrich
|
pconfig_to_address($filterent['source'], $_POST['src'],
|
| 473 |
|
|
$_POST['srcmask'], $_POST['srcnot'],
|
| 474 |
|
|
$_POST['srcbeginport'], $_POST['srcendport']);
|
| 475 |
5ba18897
|
Scott Ullrich
|
|
| 476 |
5b237745
|
Scott Ullrich
|
pconfig_to_address($filterent['destination'], $_POST['dst'],
|
| 477 |
|
|
$_POST['dstmask'], $_POST['dstnot'],
|
| 478 |
|
|
$_POST['dstbeginport'], $_POST['dstendport']);
|
| 479 |
5ba18897
|
Scott Ullrich
|
|
| 480 |
f1602cc4
|
sullrich
|
if ($_POST['disabled'])
|
| 481 |
|
|
$filterent['disabled'] = true;
|
| 482 |
|
|
else
|
| 483 |
|
|
unset($filterent['disabled']);
|
| 484 |
|
|
|
| 485 |
c5fc1b2e
|
Ermal Luçi
|
if ($_POST['dscp'])
|
| 486 |
|
|
$filterent['dscp'] = $_POST['dscp'];
|
| 487 |
|
|
|
| 488 |
f1602cc4
|
sullrich
|
if ($_POST['log'])
|
| 489 |
|
|
$filterent['log'] = true;
|
| 490 |
|
|
else
|
| 491 |
|
|
unset($filterent['log']);
|
| 492 |
c68fc1e7
|
Bill Marquette
|
strncpy($filterent['descr'], $_POST['descr'], 52);
|
| 493 |
5ba18897
|
Scott Ullrich
|
|
| 494 |
c98ddde2
|
Bill Marquette
|
if ($_POST['gateway'] != "") {
|
| 495 |
|
|
$filterent['gateway'] = $_POST['gateway'];
|
| 496 |
|
|
}
|
| 497 |
197bfe96
|
Ermal Luçi
|
|
| 498 |
|
|
if (isset($_POST['defaultqueue']) && $_POST['defaultqueue'] != "none") {
|
| 499 |
|
|
$filterent['defaultqueue'] = $_POST['defaultqueue'];
|
| 500 |
|
|
if (isset($_POST['ackqueue']) && $_POST['ackqueue'] != "none")
|
| 501 |
|
|
$filterent['ackqueue'] = $_POST['ackqueue'];
|
| 502 |
|
|
}
|
| 503 |
c98ddde2
|
Bill Marquette
|
|
| 504 |
a5fd67e1
|
Ermal Luçi
|
if (isset($_POST['dnpipe']) && $_POST['dnpipe'] != "none") {
|
| 505 |
|
|
$filterent['dnpipe'] = $_POST['dnpipe'];
|
| 506 |
|
|
if (isset($_POST['pdnpipe']) && $_POST['pdnpipe'] != "none")
|
| 507 |
|
|
$filterent['pdnpipe'] = $_POST['pdnpipe'];
|
| 508 |
|
|
}
|
| 509 |
|
|
|
| 510 |
7e50413c
|
Ermal Luçi
|
if (isset($_POST['l7container']) && $_POST['l7container'] != "none") {
|
| 511 |
|
|
$filterent['l7container'] = $_POST['l7container'];
|
| 512 |
|
|
}
|
| 513 |
|
|
|
| 514 |
615b27bc
|
Scott Dale
|
if ($_POST['sched'] != "") {
|
| 515 |
|
|
$filterent['sched'] = $_POST['sched'];
|
| 516 |
|
|
}
|
| 517 |
|
|
|
| 518 |
1122a892
|
Erik Fonnesbeck
|
// If we have an associated nat rule, make sure the source and destination doesn't change
|
| 519 |
9b16b834
|
Ermal Lu?i
|
if( isset($a_filter[$id]['associated-rule-id']) ) {
|
| 520 |
1122a892
|
Erik Fonnesbeck
|
$filterent['source'] = $a_filter[$id]['source'];
|
| 521 |
473d0ff0
|
pierrepomes
|
$filterent['destination'] = $a_filter[$id]['destination'];
|
| 522 |
9b16b834
|
Ermal Lu?i
|
$filterent['associated-rule-id'] = $a_filter[$id]['associated-rule-id'];
|
| 523 |
473d0ff0
|
pierrepomes
|
}
|
| 524 |
|
|
|
| 525 |
5b237745
|
Scott Ullrich
|
if (isset($id) && $a_filter[$id])
|
| 526 |
|
|
$a_filter[$id] = $filterent;
|
| 527 |
|
|
else {
|
| 528 |
|
|
if (is_numeric($after))
|
| 529 |
|
|
array_splice($a_filter, $after+1, 0, array($filterent));
|
| 530 |
|
|
else
|
| 531 |
|
|
$a_filter[] = $filterent;
|
| 532 |
|
|
}
|
| 533 |
f4e2a352
|
Scott Ullrich
|
|
| 534 |
5b237745
|
Scott Ullrich
|
write_config();
|
| 535 |
a368a026
|
Ermal Lu?i
|
mark_subsystem_dirty('filter');
|
| 536 |
5ba18897
|
Scott Ullrich
|
|
| 537 |
661aed33
|
Ermal Luçi
|
if (isset($_POST['floating']))
|
| 538 |
|
|
header("Location: firewall_rules.php?if=FloatingRules");
|
| 539 |
|
|
else
|
| 540 |
|
|
header("Location: firewall_rules.php?if=" . $_POST['interface']);
|
| 541 |
5b237745
|
Scott Ullrich
|
exit;
|
| 542 |
|
|
}
|
| 543 |
c60824d2
|
Scott Ullrich
|
}
|
| 544 |
|
|
|
| 545 |
37c53a0d
|
Ermal Lu?i
|
read_altq_config(); /* XXX: */
|
| 546 |
|
|
$qlist =& get_unique_queue_list();
|
| 547 |
|
|
read_dummynet_config(); /* XXX: */
|
| 548 |
|
|
$dnqlist =& get_unique_dnqueue_list();
|
| 549 |
|
|
read_layer7_config();
|
| 550 |
|
|
$l7clist =& get_l7_unique_list();
|
| 551 |
|
|
|
| 552 |
d88c6a9f
|
Scott Ullrich
|
$pgtitle = array("Firewall","Rules","Edit");
|
| 553 |
3cceb5d5
|
jim-p
|
$statusurl = "status_filter_reload.php";
|
| 554 |
|
|
$logurl = "diag_logs_filter.php";
|
| 555 |
|
|
|
| 556 |
a1357fe0
|
Bill Marquette
|
$closehead = false;
|
| 557 |
8ab3e9ed
|
Erik Kristensen
|
|
| 558 |
|
|
$page_filename = "firewall_rules_edit.php";
|
| 559 |
da7ae7ef
|
Bill Marquette
|
include("head.inc");
|
| 560 |
c60824d2
|
Scott Ullrich
|
|
| 561 |
5b237745
|
Scott Ullrich
|
?>
|
| 562 |
da7ae7ef
|
Bill Marquette
|
|
| 563 |
5b237745
|
Scott Ullrich
|
</head>
|
| 564 |
|
|
|
| 565 |
|
|
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
|
| 566 |
|
|
<?php include("fbegin.inc"); ?>
|
| 567 |
|
|
<?php if ($input_errors) print_input_errors($input_errors); ?>
|
| 568 |
8ab3e9ed
|
Erik Kristensen
|
|
| 569 |
|
|
<form action="firewall_rules_edit.php" method="post" name="iform" id="iform">
|
| 570 |
6eac9b90
|
Scott Ullrich
|
<input type='hidden' name="ruleid" value="<?=(isset($pconfig['ruleid'])&&$pconfig['ruleid']>0)?htmlspecialchars($pconfig['ruleid']):''?>">
|
| 571 |
|
|
|
| 572 |
8ab3e9ed
|
Erik Kristensen
|
<table width="100%" border="0" cellpadding="6" cellspacing="0">
|
| 573 |
e091cb45
|
Scott Ullrich
|
<tr>
|
| 574 |
|
|
<td colspan="2" valign="top" class="listtopic">Edit Firewall rule</td>
|
| 575 |
|
|
</tr>
|
| 576 |
8ab3e9ed
|
Erik Kristensen
|
<tr>
|
| 577 |
|
|
<td width="22%" valign="top" class="vncellreq">Action</td>
|
| 578 |
|
|
<td width="78%" class="vtable">
|
| 579 |
b5c78501
|
Seth Mos
|
<select name="type" class="formselect">
|
| 580 |
8ab3e9ed
|
Erik Kristensen
|
<?php $types = explode(" ", "Pass Block Reject"); foreach ($types as $type): ?>
|
| 581 |
|
|
<option value="<?=strtolower($type);?>" <?php if (strtolower($type) == strtolower($pconfig['type'])) echo "selected"; ?>>
|
| 582 |
|
|
<?=htmlspecialchars($type);?>
|
| 583 |
|
|
</option>
|
| 584 |
|
|
<?php endforeach; ?>
|
| 585 |
8c84fe43
|
Scott Ullrich
|
</select>
|
| 586 |
8ab3e9ed
|
Erik Kristensen
|
<br/>
|
| 587 |
|
|
<span class="vexpl">
|
| 588 |
|
|
Choose what to do with packets that match the criteria specified below. <br/>
|
| 589 |
e91baab8
|
Chris Buechler
|
Hint: the difference between block and reject is that with reject, a packet (TCP RST or ICMP port unreachable for UDP) is returned to the sender, whereas with block the packet is dropped silently. In either case, the original packet is discarded.
|
| 590 |
8ab3e9ed
|
Erik Kristensen
|
</span>
|
| 591 |
|
|
</td>
|
| 592 |
|
|
</tr>
|
| 593 |
|
|
<tr>
|
| 594 |
|
|
<td width="22%" valign="top" class="vncellreq">Disabled</td>
|
| 595 |
|
|
<td width="78%" class="vtable">
|
| 596 |
|
|
<input name="disabled" type="checkbox" id="disabled" value="yes" <?php if ($pconfig['disabled']) echo "checked"; ?>>
|
| 597 |
|
|
<strong>Disable this rule</strong><br />
|
| 598 |
|
|
<span class="vexpl">Set this option to disable this rule without removing it from the list.</span>
|
| 599 |
|
|
</td>
|
| 600 |
|
|
</tr>
|
| 601 |
661aed33
|
Ermal Luçi
|
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
|
| 602 |
|
|
<tr>
|
| 603 |
f1602cc4
|
sullrich
|
<td width="22%" valign="top" class="vncellreq">
|
| 604 |
|
|
<?=gettext("Quick");?>
|
| 605 |
|
|
</td>
|
| 606 |
|
|
<td width="78%" class="vtable">
|
| 607 |
|
|
<input name="quick" type="checkbox" id="quick" value="yes" <?php if ($pconfig['quick']) echo "checked=\"checked\""; ?> />
|
| 608 |
|
|
<strong><?=gettext("Apply the action immediately on match.");?></strong><br />
|
| 609 |
|
|
<span class="vexpl"><?=gettext("Set this option if you need to apply this action to traffic that matches this rule immediately.");?></span>
|
| 610 |
|
|
</td>
|
| 611 |
|
|
</tr>
|
| 612 |
661aed33
|
Ermal Luçi
|
<? endif; ?>
|
| 613 |
8ab3e9ed
|
Erik Kristensen
|
<tr>
|
| 614 |
|
|
<td width="22%" valign="top" class="vncellreq">Interface</td>
|
| 615 |
|
|
<td width="78%" class="vtable">
|
| 616 |
4633edc2
|
Ermal Luçi
|
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
|
| 617 |
8e6ac824
|
Ermal Luçi
|
<select name="interface[]" multiple="true" class="formselect" size="3">
|
| 618 |
661aed33
|
Ermal Luçi
|
<? else: ?>
|
| 619 |
b5c78501
|
Seth Mos
|
<select name="interface" class="formselect">
|
| 620 |
8ab3e9ed
|
Erik Kristensen
|
<?php
|
| 621 |
661aed33
|
Ermal Luçi
|
endif;
|
| 622 |
a7782099
|
Ermal Lu?i
|
/* add group interfaces */
|
| 623 |
f1602cc4
|
sullrich
|
if (is_array($config['ifgroups']['ifgroupentry']))
|
| 624 |
a7782099
|
Ermal Lu?i
|
foreach($config['ifgroups']['ifgroupentry'] as $ifgen)
|
| 625 |
|
|
if (have_ruleint_access($ifgen['ifname']))
|
| 626 |
|
|
$interfaces[$ifgen['ifname']] = $ifgen['ifname'];
|
| 627 |
b7391125
|
Ermal Luçi
|
$ifdescs = get_configured_interface_with_descr();
|
| 628 |
5335811d
|
Ermal Luçi
|
foreach ($ifdescs as $ifent => $ifdesc)
|
| 629 |
|
|
if(have_ruleint_access($ifent))
|
| 630 |
f1602cc4
|
sullrich
|
$interfaces[$ifent] = $ifdesc;
|
| 631 |
617f8d25
|
Ermal Lu?i
|
if ($config['l2tp']['mode'] == "server")
|
| 632 |
f1602cc4
|
sullrich
|
if(have_ruleint_access("l2tp"))
|
| 633 |
|
|
$interfaces['l2tp'] = "L2TP VPN";
|
| 634 |
b6742927
|
Scott Ullrich
|
if ($config['pptpd']['mode'] == "server")
|
| 635 |
|
|
if(have_ruleint_access("pptp"))
|
| 636 |
|
|
$interfaces['pptp'] = "PPTP VPN";
|
| 637 |
|
|
|
| 638 |
|
|
if ($config['pppoe']['mode'] == "server")
|
| 639 |
|
|
if(have_ruleint_access("pppoe"))
|
| 640 |
|
|
$interfaces['pppoe'] = "PPPoE VPN";
|
| 641 |
|
|
/* add ipsec interfaces */
|
| 642 |
|
|
if (isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable']))
|
| 643 |
|
|
if(have_ruleint_access("enc0"))
|
| 644 |
0f266b2e
|
Chris Buechler
|
$interfaces["enc0"] = "IPsec";
|
| 645 |
bfb60ac8
|
Ermal Luçi
|
/* add openvpn/tun interfaces */
|
| 646 |
d799787e
|
Matthew Grooms
|
if ($config['openvpn']["openvpn-server"] || $config['openvpn']["openvpn-client"])
|
| 647 |
d030c9de
|
Erik Fonnesbeck
|
$interfaces["openvpn"] = "OpenVPN";
|
| 648 |
|
|
$selected_interfaces = explode(",", $pconfig['interface']);
|
| 649 |
8ab3e9ed
|
Erik Kristensen
|
foreach ($interfaces as $iface => $ifacename): ?>
|
| 650 |
0ddddb7a
|
Renato Botelho
|
<option value="<?=$iface;?>" <?php if ($pconfig['interface'] <> "" && ( strcasecmp($pconfig['interface'], $iface) == 0 || in_array($iface, $selected_interfaces) )) echo "selected"; ?>><?=$ifacename?></option>
|
| 651 |
8ab3e9ed
|
Erik Kristensen
|
<?php endforeach; ?>
|
| 652 |
8c84fe43
|
Scott Ullrich
|
</select>
|
| 653 |
8ab3e9ed
|
Erik Kristensen
|
<br />
|
| 654 |
|
|
<span class="vexpl">Choose on which interface packets must come in to match this rule.</span>
|
| 655 |
|
|
</td>
|
| 656 |
|
|
</tr>
|
| 657 |
661aed33
|
Ermal Luçi
|
<?php if ($if == "FloatingRules" || isset($pconfig['floating'])): ?>
|
| 658 |
f1602cc4
|
sullrich
|
<tr>
|
| 659 |
|
|
<td width="22%" valign="top" class="vncellreq">
|
| 660 |
|
|
<?=gettext("Direction");?>
|
| 661 |
|
|
</td>
|
| 662 |
|
|
<td width="78%" class="vtable">
|
| 663 |
|
|
<select name="direction" class="formselect">
|
| 664 |
|
|
<?php $directions = array('any', 'in', 'out');
|
| 665 |
|
|
foreach ($directions as $direction): ?>
|
| 666 |
|
|
<option value="<?=$direction;?>"
|
| 667 |
|
|
<?php if ($direction == $pconfig['direction']): ?>
|
| 668 |
|
|
selected="selected"
|
| 669 |
|
|
<?php endif; ?>
|
| 670 |
|
|
><?=$direction;?></option>
|
| 671 |
|
|
<?php endforeach; ?>
|
| 672 |
|
|
</select>
|
| 673 |
|
|
<input type="hidden" id="floating" name="floating" value="floating">
|
| 674 |
|
|
</td>
|
| 675 |
|
|
<tr>
|
| 676 |
661aed33
|
Ermal Luçi
|
<?php endif; ?>
|
| 677 |
8ab3e9ed
|
Erik Kristensen
|
<tr>
|
| 678 |
|
|
<td width="22%" valign="top" class="vncellreq">Protocol</td>
|
| 679 |
|
|
<td width="78%" class="vtable">
|
| 680 |
b5c78501
|
Seth Mos
|
<select name="proto" class="formselect" onchange="proto_change()">
|
| 681 |
8ab3e9ed
|
Erik Kristensen
|
<?php
|
| 682 |
87f0be87
|
Chris Buechler
|
$protocols = explode(" ", "TCP UDP TCP/UDP ICMP ESP AH GRE IGMP any carp pfsync");
|
| 683 |
8ab3e9ed
|
Erik Kristensen
|
foreach ($protocols as $proto): ?>
|
| 684 |
|
|
<option value="<?=strtolower($proto);?>" <?php if (strtolower($proto) == $pconfig['proto']) echo "selected"; ?>><?=htmlspecialchars($proto);?></option>
|
| 685 |
|
|
<?php endforeach; ?>
|
| 686 |
|
|
</select>
|
| 687 |
|
|
<br />
|
| 688 |
|
|
<span class="vexpl">Choose which IP protocol this rule should match. <br /> Hint: in most cases, you should specify <em>TCP</em> here.</span>
|
| 689 |
|
|
</td>
|
| 690 |
|
|
</tr>
|
| 691 |
3de8af0e
|
Scott Ullrich
|
<tr id="icmpbox" name="icmpbox">
|
| 692 |
8ab3e9ed
|
Erik Kristensen
|
<td valign="top" class="vncell">ICMP type</td>
|
| 693 |
|
|
<td class="vtable">
|
| 694 |
b5c78501
|
Seth Mos
|
<select name="icmptype" class="formselect">
|
| 695 |
8ab3e9ed
|
Erik Kristensen
|
<?php
|
| 696 |
|
|
$icmptypes = array(
|
| 697 |
|
|
"" => "any",
|
| 698 |
|
|
"echorep" => "Echo reply",
|
| 699 |
|
|
"unreach" => "Destination unreachable",
|
| 700 |
|
|
"squench" => "Source quench",
|
| 701 |
|
|
"redir" => "Redirect",
|
| 702 |
|
|
"althost" => "Alternate Host",
|
| 703 |
|
|
"echoreq" => "Echo",
|
| 704 |
|
|
"routeradv" => "Router advertisement",
|
| 705 |
|
|
"routersol" => "Router solicitation",
|
| 706 |
|
|
"timex" => "Time exceeded",
|
| 707 |
|
|
"paramprob" => "Invalid IP header",
|
| 708 |
|
|
"timereq" => "Timestamp",
|
| 709 |
|
|
"timerep" => "Timestamp reply",
|
| 710 |
|
|
"inforeq" => "Information request",
|
| 711 |
|
|
"inforep" => "Information reply",
|
| 712 |
|
|
"maskreq" => "Address mask request",
|
| 713 |
|
|
"maskrep" => "Address mask reply"
|
| 714 |
|
|
);
|
| 715 |
|
|
|
| 716 |
|
|
foreach ($icmptypes as $icmptype => $descr): ?>
|
| 717 |
|
|
<option value="<?=$icmptype;?>" <?php if ($icmptype == $pconfig['icmptype']) echo "selected"; ?>><?=htmlspecialchars($descr);?></option>
|
| 718 |
|
|
<?php endforeach; ?>
|
| 719 |
|
|
</select>
|
| 720 |
|
|
<br />
|
| 721 |
|
|
<span class="vexpl">If you selected ICMP for the protocol above, you may specify an ICMP type here.</span>
|
| 722 |
|
|
</td>
|
| 723 |
|
|
</tr>
|
| 724 |
|
|
<tr>
|
| 725 |
|
|
<td width="22%" valign="top" class="vncellreq">Source</td>
|
| 726 |
|
|
<td width="78%" class="vtable">
|
| 727 |
383654fc
|
Vinicius Coque
|
<?php $edit_disabled=false; ?>
|
| 728 |
|
|
<?php if( isset($pconfig['associated-rule-id']) ): ?>
|
| 729 |
|
|
<span class="red"><strong>NOTE: </strong></span> This is associated to a NAT rule.<br />
|
| 730 |
|
|
You cannot edit the source and destination of associated filter rules.<br />
|
| 731 |
|
|
<br />
|
| 732 |
bae53989
|
Renato Botelho
|
<?php
|
| 733 |
383654fc
|
Vinicius Coque
|
$edit_disabled=true;
|
| 734 |
|
|
if (is_array($config['nat']['rule'])) {
|
| 735 |
bae53989
|
Renato Botelho
|
foreach( $config['nat']['rule'] as $index => $nat_rule ) {
|
| 736 |
1122a892
|
Erik Fonnesbeck
|
if( isset($nat_rule['associated-rule-id']) && $nat_rule['associated-rule-id']==$pconfig['associated-rule-id'] ) {
|
| 737 |
|
|
echo "<a href=\"firewall_nat_edit.php?id={$index}\">View the NAT rule</a><br>";
|
| 738 |
bae53989
|
Renato Botelho
|
break;
|
| 739 |
383654fc
|
Vinicius Coque
|
}
|
| 740 |
bae53989
|
Renato Botelho
|
}
|
| 741 |
383654fc
|
Vinicius Coque
|
}
|
| 742 |
|
|
?>
|
| 743 |
|
|
<br />
|
| 744 |
|
|
<script type="text/javascript">
|
| 745 |
|
|
editenabled = 0;
|
| 746 |
|
|
</script>
|
| 747 |
|
|
<?php endif; ?>
|
| 748 |
|
|
<input<?php echo ($edit_disabled===true?' DISABLED':''); ?> name="srcnot" type="checkbox" id="srcnot" value="yes" <?php if ($pconfig['srcnot']) echo "checked"; ?>>
|
| 749 |
8ab3e9ed
|
Erik Kristensen
|
<strong>not</strong>
|
| 750 |
|
|
<br />
|
| 751 |
|
|
Use this option to invert the sense of the match.
|
| 752 |
|
|
<br />
|
| 753 |
|
|
<br />
|
| 754 |
|
|
<table border="0" cellspacing="0" cellpadding="0">
|
| 755 |
|
|
<tr>
|
| 756 |
|
|
<td>Type: </td>
|
| 757 |
|
|
<td>
|
| 758 |
383654fc
|
Vinicius Coque
|
<select<?php echo ($edit_disabled===true?' DISABLED':''); ?> name="srctype" class="formselect" onChange="typesel_change()">
|
| 759 |
87f0be87
|
Chris Buechler
|
<?php
|
| 760 |
|
|
$sel = is_specialnet($pconfig['src']); ?>
|
| 761 |
8ab3e9ed
|
Erik Kristensen
|
<option value="any" <?php if ($pconfig['src'] == "any") { echo "selected"; } ?>>any</option>
|
| 762 |
87f0be87
|
Chris Buechler
|
<option value="single" <?php if (($pconfig['srcmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>>Single host or alias</option>
|
| 763 |
|
|
<option value="network" <?php if (!$sel) echo "selected"; ?>>Network</option>
|
| 764 |
99ea4439
|
Scott Ullrich
|
<?php if(have_ruleint_access("pptp")): ?>
|
| 765 |
8ab3e9ed
|
Erik Kristensen
|
<option value="pptp" <?php if ($pconfig['src'] == "pptp") { echo "selected"; } ?>>PPTP clients</option>
|
| 766 |
99ea4439
|
Scott Ullrich
|
<?php endif; ?>
|
| 767 |
|
|
<?php if(have_ruleint_access("pppoe")): ?>
|
| 768 |
8c84fe43
|
Scott Ullrich
|
<option value="pppoe" <?php if ($pconfig['src'] == "pppoe") { echo "selected"; } ?>>PPPoE clients</option>
|
| 769 |
99ea4439
|
Scott Ullrich
|
<?php endif; ?>
|
| 770 |
8a6bc505
|
Ermal Lu?i
|
<?php if(have_ruleint_access("l2tp")): ?>
|
| 771 |
|
|
<option value="l2tp" <?php if ($pconfig['src'] == "l2tp") { echo "selected"; } ?>>L2TP clients</option>
|
| 772 |
|
|
<?php endif; ?>
|
| 773 |
8ab3e9ed
|
Erik Kristensen
|
<?php
|
| 774 |
5335811d
|
Ermal Luçi
|
foreach ($ifdisp as $ifent => $ifdesc): ?>
|
| 775 |
|
|
<?php if(have_ruleint_access($ifent)): ?>
|
| 776 |
|
|
<option value="<?=$ifent;?>" <?php if ($pconfig['src'] == $ifent) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?> subnet</option>
|
| 777 |
|
|
<option value="<?=$ifent;?>ip"<?php if ($pconfig['src'] == $ifent . "ip") { echo "selected"; } ?>>
|
| 778 |
b7391125
|
Ermal Luçi
|
<?=$ifdesc?> address
|
| 779 |
e30a5970
|
Scott Ullrich
|
</option>
|
| 780 |
99ea4439
|
Scott Ullrich
|
<?php endif; ?>
|
| 781 |
b7391125
|
Ermal Luçi
|
<?php endforeach; ?>
|
| 782 |
8ab3e9ed
|
Erik Kristensen
|
</select>
|
| 783 |
|
|
</td>
|
| 784 |
|
|
</tr>
|
| 785 |
|
|
<tr>
|
| 786 |
|
|
<td>Address: </td>
|
| 787 |
|
|
<td>
|
| 788 |
383654fc
|
Vinicius Coque
|
<input<?php echo ($edit_disabled===true?' DISABLED':''); ?> autocomplete='off' name="src" type="text" class="formfldalias" id="src" size="20" value="<?php if (!is_specialnet($pconfig['src'])) echo htmlspecialchars($pconfig['src']);?>"> /
|
| 789 |
|
|
<select<?php echo ($edit_disabled===true?' DISABLED':''); ?> name="srcmask" class="formselect" id="srcmask">
|
| 790 |
8ab3e9ed
|
Erik Kristensen
|
<?php for ($i = 31; $i > 0; $i--): ?>
|
| 791 |
|
|
<option value="<?=$i;?>" <?php if ($i == $pconfig['srcmask']) echo "selected"; ?>><?=$i;?></option>
|
| 792 |
|
|
<?php endfor; ?>
|
| 793 |
|
|
</select>
|
| 794 |
bdb7d6e7
|
Scott Ullrich
|
</td>
|
| 795 |
8ab3e9ed
|
Erik Kristensen
|
</tr>
|
| 796 |
|
|
</table>
|
| 797 |
22abf2ef
|
Scott Ullrich
|
<div id="showadvancedboxspr">
|
| 798 |
|
|
<p>
|
| 799 |
383654fc
|
Vinicius Coque
|
<input<?php echo ($edit_disabled===true?' DISABLED':''); ?> type="button" onClick="show_source_port_range()" value="Advanced"></input> - Show source port range</a>
|
| 800 |
22abf2ef
|
Scott Ullrich
|
</div>
|
| 801 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 802 |
e33c8694
|
Bill Marquette
|
</tr>
|
| 803 |
3de8af0e
|
Scott Ullrich
|
<tr style="display:none" id="sprtable" name="sprtable">
|
| 804 |
8ab3e9ed
|
Erik Kristensen
|
<td width="22%" valign="top" class="vncellreq">Source port range</td>
|
| 805 |
|
|
<td width="78%" class="vtable">
|
| 806 |
|
|
<table border="0" cellspacing="0" cellpadding="0">
|
| 807 |
|
|
<tr>
|
| 808 |
|
|
<td>from: </td>
|
| 809 |
|
|
<td>
|
| 810 |
383654fc
|
Vinicius Coque
|
<select<?php echo ($edit_disabled===true?' DISABLED':''); ?> name="srcbeginport" class="formselect" onchange="src_rep_change();ext_change()">
|
| 811 |
8ab3e9ed
|
Erik Kristensen
|
<option value="">(other)</option>
|
| 812 |
|
|
<option value="any" <?php $bfound = 0; if ($pconfig['srcbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
|
| 813 |
|
|
<?php foreach ($wkports as $wkport => $wkportdesc): ?>
|
| 814 |
|
|
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcbeginport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
|
| 815 |
|
|
<?php endforeach; ?>
|
| 816 |
8c84fe43
|
Scott Ullrich
|
</select>
|
| 817 |
383654fc
|
Vinicius Coque
|
<input<?php echo ($edit_disabled===true?' DISABLED':''); ?> autocomplete='off' class="formfldalias" name="srcbeginport_cust" id="srcbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcbeginport']) echo $pconfig['srcbeginport']; ?>">
|
| 818 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 819 |
|
|
</tr>
|
| 820 |
|
|
<tr>
|
| 821 |
|
|
<td>to:</td>
|
| 822 |
|
|
<td>
|
| 823 |
383654fc
|
Vinicius Coque
|
<select<?php echo ($edit_disabled===true?' DISABLED':''); ?> name="srcendport" class="formselect" onchange="ext_change()">
|
| 824 |
8ab3e9ed
|
Erik Kristensen
|
<option value="">(other)</option>
|
| 825 |
|
|
<option value="any" <?php $bfound = 0; if ($pconfig['srcendport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
|
| 826 |
|
|
<?php foreach ($wkports as $wkport => $wkportdesc): ?>
|
| 827 |
|
|
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
|
| 828 |
|
|
<?php endforeach; ?>
|
| 829 |
8c84fe43
|
Scott Ullrich
|
</select>
|
| 830 |
383654fc
|
Vinicius Coque
|
<input<?php echo ($edit_disabled===true?' DISABLED':''); ?> autocomplete='off' class="formfldalias" name="srcendport_cust" id="srcendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcendport']) echo $pconfig['srcendport']; ?>">
|
| 831 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 832 |
|
|
</tr>
|
| 833 |
|
|
</table>
|
| 834 |
|
|
<br />
|
| 835 |
3e3582a9
|
Erik Fonnesbeck
|
<span class="vexpl"><?=gettext("Specify the source port or port range for this rule. <b>This is usually <em>random</em> and almost never equal to the destination port range (and should usually be "any").</b> <br /> Hint: you can leave the <em>'to'</em> field empty if you only want to filter a single port.");?></span><br/>
|
| 836 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 837 |
8c84fe43
|
Scott Ullrich
|
</tr>
|
| 838 |
8ab3e9ed
|
Erik Kristensen
|
<tr>
|
| 839 |
|
|
<td width="22%" valign="top" class="vncellreq">Destination</td>
|
| 840 |
|
|
<td width="78%" class="vtable">
|
| 841 |
383654fc
|
Vinicius Coque
|
<input<?php echo ($edit_disabled===true?' DISABLED':''); ?> name="dstnot" type="checkbox" id="dstnot" value="yes" <?php if ($pconfig['dstnot']) echo "checked"; ?>>
|
| 842 |
8ab3e9ed
|
Erik Kristensen
|
<strong>not</strong>
|
| 843 |
|
|
<br />
|
| 844 |
|
|
Use this option to invert the sense of the match.
|
| 845 |
|
|
<br />
|
| 846 |
|
|
<br />
|
| 847 |
|
|
<table border="0" cellspacing="0" cellpadding="0">
|
| 848 |
|
|
<tr>
|
| 849 |
|
|
<td>Type: </td>
|
| 850 |
|
|
<td>
|
| 851 |
383654fc
|
Vinicius Coque
|
<select<?php echo ($edit_disabled===true?' DISABLED':''); ?> name="dsttype" class="formselect" onChange="typesel_change()">
|
| 852 |
87f0be87
|
Chris Buechler
|
<?php
|
| 853 |
|
|
$sel = is_specialnet($pconfig['dst']); ?>
|
| 854 |
8ab3e9ed
|
Erik Kristensen
|
<option value="any" <?php if ($pconfig['dst'] == "any") { echo "selected"; } ?>>any</option>
|
| 855 |
87f0be87
|
Chris Buechler
|
<option value="single" <?php if (($pconfig['dstmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>>Single host or alias</option>
|
| 856 |
|
|
<option value="network" <?php if (!$sel) echo "selected"; ?>>Network</option>
|
| 857 |
99ea4439
|
Scott Ullrich
|
<?php if(have_ruleint_access("pptp")): ?>
|
| 858 |
8ab3e9ed
|
Erik Kristensen
|
<option value="pptp" <?php if ($pconfig['dst'] == "pptp") { echo "selected"; } ?>>PPTP clients</option>
|
| 859 |
99ea4439
|
Scott Ullrich
|
<?php endif; ?>
|
| 860 |
|
|
<?php if(have_ruleint_access("pppoe")): ?>
|
| 861 |
8ab3e9ed
|
Erik Kristensen
|
<option value="pppoe" <?php if ($pconfig['dst'] == "pppoe") { echo "selected"; } ?>>PPPoE clients</option>
|
| 862 |
99ea4439
|
Scott Ullrich
|
<?php endif; ?>
|
| 863 |
3331a640
|
Ermal Lu?i
|
<?php if(have_ruleint_access("l2tp")): ?>
|
| 864 |
|
|
<option value="l2tp" <?php if ($pconfig['dst'] == "l2tp") { echo "selected"; } ?>>L2TP clients</option>
|
| 865 |
|
|
<?php endif; ?>
|
| 866 |
b7391125
|
Ermal Luçi
|
|
| 867 |
|
|
<?php foreach ($ifdisp as $if => $ifdesc): ?>
|
| 868 |
|
|
<?php if(have_ruleint_access($if)): ?>
|
| 869 |
|
|
<option value="<?=$if;?>" <?php if ($pconfig['dst'] == $if) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?> subnet</option>
|
| 870 |
|
|
<option value="<?=$if;?>ip"<?php if ($pconfig['dst'] == $if . "ip") { echo "selected"; } ?>>
|
| 871 |
|
|
<?=$ifdesc;?> address
|
| 872 |
cbff71a1
|
Scott Ullrich
|
</option>
|
| 873 |
99ea4439
|
Scott Ullrich
|
<?php endif; ?>
|
| 874 |
b7391125
|
Ermal Luçi
|
<?php endforeach; ?>
|
| 875 |
8ab3e9ed
|
Erik Kristensen
|
</select>
|
| 876 |
|
|
</td>
|
| 877 |
|
|
</tr>
|
| 878 |
|
|
<tr>
|
| 879 |
|
|
<td>Address: </td>
|
| 880 |
|
|
<td>
|
| 881 |
383654fc
|
Vinicius Coque
|
<input<?php echo ($edit_disabled===true?' DISABLED':''); ?> name="dst" type="text" class="formfldalias" id="dst" size="20" value="<?php if (!is_specialnet($pconfig['dst'])) echo htmlspecialchars($pconfig['dst']);?>">
|
| 882 |
8ab3e9ed
|
Erik Kristensen
|
/
|
| 883 |
383654fc
|
Vinicius Coque
|
<select<?php echo ($edit_disabled===true?' DISABLED':''); ?> name="dstmask" class="formselect" id="dstmask">
|
| 884 |
8ab3e9ed
|
Erik Kristensen
|
<?php
|
| 885 |
|
|
for ($i = 31; $i > 0; $i--): ?>
|
| 886 |
|
|
<option value="<?=$i;?>" <?php if ($i == $pconfig['dstmask']) echo "selected"; ?>><?=$i;?></option>
|
| 887 |
|
|
<?php endfor; ?>
|
| 888 |
|
|
</select>
|
| 889 |
|
|
</td>
|
| 890 |
|
|
</tr>
|
| 891 |
|
|
</table>
|
| 892 |
|
|
</td>
|
| 893 |
|
|
</tr>
|
| 894 |
3de8af0e
|
Scott Ullrich
|
<tr id="dprtr" name="dprtr">
|
| 895 |
8ab3e9ed
|
Erik Kristensen
|
<td width="22%" valign="top" class="vncellreq">Destination port range </td>
|
| 896 |
|
|
<td width="78%" class="vtable">
|
| 897 |
|
|
<table border="0" cellspacing="0" cellpadding="0">
|
| 898 |
|
|
<tr>
|
| 899 |
|
|
<td>from: </td>
|
| 900 |
|
|
<td>
|
| 901 |
383654fc
|
Vinicius Coque
|
<select<?php echo ($edit_disabled===true?' DISABLED':''); ?> name="dstbeginport" class="formselect" onchange="dst_rep_change();ext_change()">
|
| 902 |
8ab3e9ed
|
Erik Kristensen
|
<option value="">(other)</option>
|
| 903 |
|
|
<option value="any" <?php $bfound = 0; if ($pconfig['dstbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
|
| 904 |
|
|
<?php foreach ($wkports as $wkport => $wkportdesc): ?>
|
| 905 |
|
|
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstbeginport']) { echo "selected"; $bfound = 1; }?>><?=htmlspecialchars($wkportdesc);?></option>
|
| 906 |
|
|
<?php endforeach; ?>
|
| 907 |
|
|
</select>
|
| 908 |
383654fc
|
Vinicius Coque
|
<input<?php echo ($edit_disabled===true?' DISABLED':''); ?> autocomplete='off' class="formfldalias" name="dstbeginport_cust" id="dstbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstbeginport']) echo $pconfig['dstbeginport']; ?>">
|
| 909 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 910 |
|
|
</tr>
|
| 911 |
|
|
<tr>
|
| 912 |
|
|
<td>to:</td>
|
| 913 |
|
|
<td>
|
| 914 |
383654fc
|
Vinicius Coque
|
<select<?php echo ($edit_disabled===true?' DISABLED':''); ?> name="dstendport" class="formselect" onchange="ext_change()">
|
| 915 |
8ab3e9ed
|
Erik Kristensen
|
<option value="">(other)</option>
|
| 916 |
|
|
<option value="any" <?php $bfound = 0; if ($pconfig['dstendport'] == "any") { echo "selected"; $bfound = 1; } ?>>any</option>
|
| 917 |
|
|
<?php foreach ($wkports as $wkport => $wkportdesc): ?>
|
| 918 |
|
|
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
|
| 919 |
|
|
<?php endforeach; ?>
|
| 920 |
8c84fe43
|
Scott Ullrich
|
</select>
|
| 921 |
383654fc
|
Vinicius Coque
|
<input<?php echo ($edit_disabled===true?' DISABLED':''); ?> autocomplete='off' class="formfldalias" name="dstendport_cust" id="dstendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstendport']) echo $pconfig['dstendport']; ?>">
|
| 922 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 923 |
|
|
</tr>
|
| 924 |
|
|
</table>
|
| 925 |
|
|
<br />
|
| 926 |
|
|
<span class="vexpl">
|
| 927 |
|
|
Specify the port or port range for the destination of the packet for this rule.
|
| 928 |
adb633a0
|
sullrich
|
<br />
|
| 929 |
8ab3e9ed
|
Erik Kristensen
|
Hint: you can leave the <em>'to'</em> field empty if you only want to filter a single port
|
| 930 |
|
|
</span>
|
| 931 |
|
|
</td>
|
| 932 |
|
|
</tr>
|
| 933 |
|
|
<tr>
|
| 934 |
|
|
<td width="22%" valign="top" class="vncellreq">Log</td>
|
| 935 |
|
|
<td width="78%" class="vtable">
|
| 936 |
|
|
<input name="log" type="checkbox" id="log" value="yes" <?php if ($pconfig['log']) echo "checked"; ?>>
|
| 937 |
|
|
<strong>Log packets that are handled by this rule</strong>
|
| 938 |
adb633a0
|
sullrich
|
<br />
|
| 939 |
8ab3e9ed
|
Erik Kristensen
|
<span class="vexpl">Hint: the firewall has limited local log space. Don't turn on logging for everything. If you want to do a lot of logging, consider using a remote syslog server (see the <a href="diag_logs_settings.php">Diagnostics: System logs: Settings</a> page).</span>
|
| 940 |
|
|
</td>
|
| 941 |
|
|
</tr>
|
| 942 |
151eb2a9
|
sullrich
|
<tr>
|
| 943 |
|
|
<td width="22%" valign="top" class="vncell">Description</td>
|
| 944 |
|
|
<td width="78%" class="vtable">
|
| 945 |
|
|
<input name="descr" type="text" class="formfld unknown" id="descr" size="52" maxlength="52" value="<?=htmlspecialchars($pconfig['descr']);?>">
|
| 946 |
|
|
<br />
|
| 947 |
|
|
<span class="vexpl">You may enter a description here for your reference.</span>
|
| 948 |
|
|
</td>
|
| 949 |
|
|
</tr>
|
| 950 |
|
|
<tr>
|
| 951 |
|
|
<td width="22%" valign="top"> </td>
|
| 952 |
|
|
<td width="78%">
|
| 953 |
|
|
<br>
|
| 954 |
|
|
<input name="Submit" type="submit" class="formbtn" value="Save"> <input type="button" class="formbtn" value="Cancel" onclick="history.back()">
|
| 955 |
|
|
<?php if (isset($id) && $a_filter[$id]): ?>
|
| 956 |
|
|
<input name="id" type="hidden" value="<?=$id;?>">
|
| 957 |
|
|
<?php endif; ?>
|
| 958 |
|
|
<input name="after" type="hidden" value="<?=$after;?>">
|
| 959 |
|
|
</td>
|
| 960 |
|
|
</tr>
|
| 961 |
|
|
<tr>
|
| 962 |
|
|
<td> </td>
|
| 963 |
|
|
</tr>
|
| 964 |
|
|
<tr>
|
| 965 |
|
|
<td colspan="2" valign="top" class="listtopic">Advanced features</td>
|
| 966 |
|
|
</tr>
|
| 967 |
f1602cc4
|
sullrich
|
<tr>
|
| 968 |
|
|
<td width="22%" valign="top" class="vncell">Source OS</td>
|
| 969 |
e265d9f5
|
sullrich
|
<td width="78%" class="vtable">
|
| 970 |
8ba13f00
|
Ermal
|
<div id="showadvsourceosbox" <? if ($pconfig['os']) echo "style='display:none'"; ?>>
|
| 971 |
adb633a0
|
sullrich
|
<input type="button" onClick="show_advanced_sourceos()" value="Advanced"></input> - Show advanced option</a>
|
| 972 |
|
|
</div>
|
| 973 |
8ba13f00
|
Ermal
|
<div id="showsourceosadv" <? if (empty($pconfig['os'])) echo "style='display:none'"; ?>>
|
| 974 |
e265d9f5
|
sullrich
|
OS Type:
|
| 975 |
adb633a0
|
sullrich
|
<select name="os" id="os" class="formselect">
|
| 976 |
f1602cc4
|
sullrich
|
<?php
|
| 977 |
adb633a0
|
sullrich
|
$ostypes = array(
|
| 978 |
|
|
"" => "any",
|
| 979 |
|
|
"AIX" => "AIX",
|
| 980 |
|
|
"Linux" => "Linux",
|
| 981 |
|
|
"FreeBSD" => "FreeBSD",
|
| 982 |
|
|
"NetBSD" => "NetBSD",
|
| 983 |
|
|
"OpenBSD" => "OpenBSD",
|
| 984 |
|
|
"Solaris" => "Solaris",
|
| 985 |
|
|
"MacOS" => "MacOS",
|
| 986 |
|
|
"Windows" => "Windows",
|
| 987 |
|
|
"Novell" => "Novell",
|
| 988 |
|
|
"NMAP" => "NMAP"
|
| 989 |
|
|
);
|
| 990 |
|
|
foreach ($ostypes as $ostype => $descr): ?>
|
| 991 |
|
|
<option value="<?=$ostype;?>" <?php if ($ostype == $pconfig['os']) echo "selected"; ?>><?=htmlspecialchars($descr);?></option>
|
| 992 |
|
|
<?php
|
| 993 |
|
|
endforeach;
|
| 994 |
|
|
?>
|
| 995 |
|
|
</select>
|
| 996 |
|
|
<br />
|
| 997 |
|
|
Note: this only works for TCP rules
|
| 998 |
|
|
</div>
|
| 999 |
f1602cc4
|
sullrich
|
</td>
|
| 1000 |
|
|
</tr>
|
| 1001 |
30c4ae8a
|
sullrich
|
<tr>
|
| 1002 |
|
|
<td width="22%" valign="top" class="vncell">Diffserv Code Point</td>
|
| 1003 |
|
|
<td width="78%" class="vtable">
|
| 1004 |
8ba13f00
|
Ermal
|
<div id="dsadv" name="dsadv" <? if ($pconfig['dscp']) echo "style='display:none'"; ?>>
|
| 1005 |
75c34cbb
|
sullrich
|
<input type="button" onClick="show_dsdiv();" value="Advanced"> - Show advanced option
|
| 1006 |
30c4ae8a
|
sullrich
|
</div>
|
| 1007 |
8ba13f00
|
Ermal
|
<div id="dsdivmain" name="dsdivmain" <? if (empty($pconfig['dscp'])) echo "style='display:none'"; ?>>
|
| 1008 |
30c4ae8a
|
sullrich
|
<select name="dscp" id="dscp">
|
| 1009 |
|
|
<option value=""></option>
|
| 1010 |
|
|
<?php foreach($firewall_rules_dscp_types as $frdt): ?>
|
| 1011 |
|
|
<option value="<?=$frdt?>"<?php if($pconfig['dscp'] == $frdt) echo " SELECTED"; ?>><?=$frdt?></option>
|
| 1012 |
|
|
<?php endforeach; ?>
|
| 1013 |
|
|
</select>
|
| 1014 |
|
|
</div>
|
| 1015 |
|
|
</td>
|
| 1016 |
|
|
</tr>
|
| 1017 |
661aed33
|
Ermal Luçi
|
<tr>
|
| 1018 |
e6db3f58
|
Ermal Luçi
|
<td width="22%" valign="top" class="vncell">Advanced Options</td>
|
| 1019 |
|
|
<td width="78%" class="vtable">
|
| 1020 |
|
|
<div id="aoadv" name="aoadv">
|
| 1021 |
75c34cbb
|
sullrich
|
<input type="button" onClick="show_aodiv();" value="Advanced"> - Show advanced option
|
| 1022 |
e6db3f58
|
Ermal Luçi
|
</div>
|
| 1023 |
|
|
<div id="aodivmain" name="aodivmain" style="display:none">
|
| 1024 |
f1602cc4
|
sullrich
|
<input type="checkbox" id="allowopts" value="yes" name="allowopts"<?php if($pconfig['allowopts'] == true) echo " checked"; ?>>
|
| 1025 |
a29dc11b
|
Chris Buechler
|
<br/><span class="vexpl"><?=gettext("This allows packets with IP options to pass. Otherwise they are blocked by default. This is usually only seen with multicast traffic.");?>
|
| 1026 |
f1602cc4
|
sullrich
|
</span><p>
|
| 1027 |
19757916
|
Ermal Lu?i
|
<input type="checkbox" id="disablereplyto" value="yes" name="disablereplyto"<?php if($pconfig['disablereplyto'] == true) echo " checked"; ?>>
|
| 1028 |
|
|
<br/><span class="vexpl"><?=gettext("This will disable auto generated reply-to for this rule.");?>
|
| 1029 |
|
|
</span><p>
|
| 1030 |
f1602cc4
|
sullrich
|
<input name="tag" id="tag" value="<?=htmlspecialchars($pconfig['tag']);?>">
|
| 1031 |
a29dc11b
|
Chris Buechler
|
<br /><span class="vexpl"><?=gettext("You can mark a packet matching this rule and use this mark to match on other NAT/filter rules. It is called <b>Policy filtering</b>");?>
|
| 1032 |
775ccea3
|
Ermal Luci
|
</span><p>
|
| 1033 |
f1602cc4
|
sullrich
|
<input name="tagged" id="tagged" value="<?=htmlspecialchars($pconfig['tagged']);?>">
|
| 1034 |
|
|
<br /><span class="vexpl"><?=gettext("You can match packet on a mark placed before on another rule.")?>
|
| 1035 |
|
|
</span> <p>
|
| 1036 |
a56b2fa0
|
pierrepomes
|
<input name="max" id="max" value="<?php echo $pconfig['max'] ?>"><br> Maximum state entries this rule can create<p>
|
| 1037 |
29adf437
|
Chris Buechler
|
<input name="max-src-nodes" id="max-src-nodes" value="<?php echo $pconfig['max-src-nodes'] ?>"><br> Maximum number of unique source hosts<p>
|
| 1038 |
|
|
<input name="max-src-conn" id="max-src-conn" value="<?php echo $pconfig['max-src-conn'] ?>"><br> Maximum number of established connections per host<p>
|
| 1039 |
8ab3e9ed
|
Erik Kristensen
|
<input name="max-src-states" id="max-src-states" value="<?php echo $pconfig['max-src-states'] ?>"><br> Maximum state entries per host<p>
|
| 1040 |
|
|
<input name="max-src-conn-rate" id="max-src-conn-rate" value="<?php echo $pconfig['max-src-conn-rate'] ?>"> /
|
| 1041 |
|
|
<select name="max-src-conn-rates" id="max-src-conn-rates">
|
| 1042 |
|
|
<option value=""<?php if(intval($pconfig['max-src-conn-rates']) < 1) echo " selected"; ?>></option>
|
| 1043 |
|
|
<?php for($x=1; $x<255; $x++) {
|
| 1044 |
|
|
if($x == $pconfig['max-src-conn-rates']) $selected = " selected"; else $selected = "";
|
| 1045 |
|
|
echo "<option value=\"{$x}\"{$selected}>{$x}</option>\n";
|
| 1046 |
|
|
} ?>
|
| 1047 |
47042140
|
Scott Ullrich
|
</select><br />
|
| 1048 |
29adf437
|
Chris Buechler
|
Maximum new connections / per second(s)
|
| 1049 |
47042140
|
Scott Ullrich
|
<p>
|
| 1050 |
|
|
|
| 1051 |
|
|
<input name="statetimeout" value="<?php echo $pconfig['statetimeout'] ?>"><br>
|
| 1052 |
3906617b
|
Scott Ullrich
|
State Timeout in seconds
|
| 1053 |
47042140
|
Scott Ullrich
|
<p />
|
| 1054 |
|
|
|
| 1055 |
29adf437
|
Chris Buechler
|
<p><strong>NOTE: Leave fields blank to disable that feature.</strong>
|
| 1056 |
197b2a47
|
Scott Ullrich
|
</div>
|
| 1057 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 1058 |
|
|
</tr>
|
| 1059 |
b8ed2a11
|
Ermal
|
<tr id="tcpflags" name="tcpflags">
|
| 1060 |
|
|
<td width="22%" valign="top" class="vncell">TCP flags</td>
|
| 1061 |
|
|
<td width="78%" class="vtable">
|
| 1062 |
8ba13f00
|
Ermal
|
<div id="showtcpflagsbox" <? if ($pconfig['tcpflags_any'] || $pconfig['tcpflags1'] || $pconfig['tcpflags2']) echo "style='display:none'"; ?>>
|
| 1063 |
b8ed2a11
|
Ermal
|
<input type="button" onClick="show_advanced_tcpflags()" value="Advanced"></input> - Show advanced option</a>
|
| 1064 |
|
|
</div>
|
| 1065 |
8ba13f00
|
Ermal
|
<div id="showtcpflagsadv" <? if (empty($pconfig['tcpflags_any']) && empty($pconfig['tcpflags1']) && empty($pconfig['tcpflags2'])) echo "style='display:none'"; ?>>
|
| 1066 |
b8ed2a11
|
Ermal
|
<div id="tcpheader" name="tcpheader">
|
| 1067 |
|
|
<center>
|
| 1068 |
|
|
<table border="0" cellspacing="0" cellpadding="0">
|
| 1069 |
|
|
<?php
|
| 1070 |
|
|
$setflags = explode(",", $pconfig['tcpflags1']);
|
| 1071 |
|
|
$outofflags = explode(",", $pconfig['tcpflags2']);
|
| 1072 |
|
|
$header = "<td width='40' nowrap></td>";
|
| 1073 |
|
|
$tcpflags1 = "<td width='40' nowrap>set</td>";
|
| 1074 |
|
|
$tcpflags2 = "<td width='40' nowrap>out of</td>";
|
| 1075 |
|
|
foreach ($tcpflags as $tcpflag) {
|
| 1076 |
|
|
$header .= "<td width='40' nowrap><strong>" . strtoupper($tcpflag) . "</strong></td>\n";
|
| 1077 |
|
|
$tcpflags1 .= "<td width='40' nowrap> <input type='checkbox' name='tcpflags1_{$tcpflag}' value='on' ";
|
| 1078 |
|
|
if (array_search($tcpflag, $setflags) !== false)
|
| 1079 |
|
|
$tcpflags1 .= "checked";
|
| 1080 |
|
|
$tcpflags1 .= "></td>\n";
|
| 1081 |
|
|
$tcpflags2 .= "<td width='40' nowrap> <input type='checkbox' name='tcpflags2_{$tcpflag}' value='on' ";
|
| 1082 |
|
|
if (array_search($tcpflag, $outofflags) !== false)
|
| 1083 |
|
|
$tcpflags2 .= "checked";
|
| 1084 |
|
|
$tcpflags2 .= "></td>\n";
|
| 1085 |
|
|
}
|
| 1086 |
|
|
echo "<tr id='tcpheader' name='tcpheader'>{$header}</tr>\n";
|
| 1087 |
|
|
echo "<tr id='tcpflags1' name='tcpflags1'>{$tcpflags1}</tr>\n";
|
| 1088 |
|
|
echo "<tr id='tcpflags2' name='tcpflags2'>{$tcpflags2}</tr>\n";
|
| 1089 |
|
|
?>
|
| 1090 |
|
|
</table>
|
| 1091 |
|
|
<center>
|
| 1092 |
|
|
</div>
|
| 1093 |
|
|
<br/><center>
|
| 1094 |
|
|
<input onClick='tcpflags_anyclick(this);' type='checkbox' name='tcpflags_any' value='on' <?php if ($pconfig['tcpflags_any']) echo "checked"; ?>><strong>Any flags.</strong><br/></center>
|
| 1095 |
|
|
<br/>
|
| 1096 |
|
|
<span class="vexpl">Use this to choose TCP flags that must
|
| 1097 |
|
|
be set or cleared for this rule to match.</span>
|
| 1098 |
|
|
</div>
|
| 1099 |
|
|
</td>
|
| 1100 |
|
|
</tr>
|
| 1101 |
8ab3e9ed
|
Erik Kristensen
|
<tr>
|
| 1102 |
|
|
<td width="22%" valign="top" class="vncell">State Type</td>
|
| 1103 |
|
|
<td width="78%" class="vtable">
|
| 1104 |
8ba13f00
|
Ermal
|
<div id="showadvstatebox" <? if (!empty($pconfig['statetype']) && $pconfig['statetype'] != "keep state") echo "style='display:none'"; ?>>
|
| 1105 |
75c34cbb
|
sullrich
|
<input type="button" onClick="show_advanced_state()" value="Advanced"></input> - Show advanced option</a>
|
| 1106 |
f6970b2f
|
Scott Ullrich
|
</div>
|
| 1107 |
8ba13f00
|
Ermal
|
<div id="showstateadv" <? if (empty($pconfig['statetype']) || $pconfig['statetype'] == "keep state") echo "style='display:none'"; ?>>
|
| 1108 |
f6970b2f
|
Scott Ullrich
|
<select name="statetype">
|
| 1109 |
|
|
<option value="keep state" <?php if(!isset($pconfig['statetype']) or $pconfig['statetype'] == "keep state") echo "selected"; ?>>keep state</option>
|
| 1110 |
b8ed2a11
|
Ermal
|
<option value="sloppy state" <?php if($pconfig['statetype'] == "sloppy state") echo "selected"; ?>>sloppy state</option>
|
| 1111 |
f6970b2f
|
Scott Ullrich
|
<option value="synproxy state"<?php if($pconfig['statetype'] == "synproxy state") echo "selected"; ?>>synproxy state</option>
|
| 1112 |
|
|
<option value="none"<?php if($pconfig['statetype'] == "none") echo "selected"; ?>>none</option>
|
| 1113 |
|
|
</select><br>HINT: Select which type of state tracking mechanism you would like to use. If in doubt, use keep state.
|
| 1114 |
|
|
<p>
|
| 1115 |
|
|
<table width="90%">
|
| 1116 |
c62ff4e7
|
Chris Buechler
|
<tr><td width="25%"><ul><li>keep state</li></td><td>Works with all IP protocols.</ul></td></tr>
|
| 1117 |
b8ed2a11
|
Ermal
|
<tr><td width="25%"><ul><li>sloppy state</li></td><td>Works with all IP protocols.</ul></td></tr>
|
| 1118 |
8eb08ba7
|
Chris Buechler
|
<tr><td width="25%"><ul><li>synproxy state</li></td><td>Proxies incoming TCP connections to help protect servers from spoofed TCP SYN floods. This option includes the functionality of keep state and modulate state combined.</ul></td></tr>
|
| 1119 |
|
|
<tr><td width="25%"><ul><li>none</li></td><td>Do not use state mechanisms to keep track. This is only useful if you're doing advanced queueing in certain situations. Please check the documentation.</ul></td></tr>
|
| 1120 |
f6970b2f
|
Scott Ullrich
|
</table>
|
| 1121 |
|
|
</p>
|
| 1122 |
|
|
</div>
|
| 1123 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 1124 |
|
|
</tr>
|
| 1125 |
10f21e70
|
Scott Ullrich
|
<tr>
|
| 1126 |
|
|
<td width="22%" valign="top" class="vncell">No XMLRPC Sync</td>
|
| 1127 |
|
|
<td width="78%" class="vtable">
|
| 1128 |
8ba13f00
|
Ermal
|
<div id="showadvnoxmlrpcsyncbox" <? if ($pconfig['nosync']) echo "style='display:none'"; ?>>
|
| 1129 |
75c34cbb
|
sullrich
|
<input type="button" onClick="show_advanced_noxmlrpc()" value="Advanced"></input> - Show advanced option</a>
|
| 1130 |
0239d8ee
|
sullrich
|
</div>
|
| 1131 |
8ba13f00
|
Ermal
|
<div id="shownoxmlrpcadv" <? if (empty($pconfig['nosync'])) echo "style='display:none'"; ?>>
|
| 1132 |
0239d8ee
|
sullrich
|
<input type="checkbox" name="nosync"<?php if($pconfig['nosync']) echo " CHECKED"; ?>><br>
|
| 1133 |
a29dc11b
|
Chris Buechler
|
HINT: This prevents the rule from automatically syncing to other CARP members.
|
| 1134 |
0239d8ee
|
sullrich
|
</div>
|
| 1135 |
10f21e70
|
Scott Ullrich
|
</td>
|
| 1136 |
8c84fe43
|
Scott Ullrich
|
</tr>
|
| 1137 |
615b27bc
|
Scott Dale
|
<?php
|
| 1138 |
|
|
//build list of schedules
|
| 1139 |
|
|
$schedules = array();
|
| 1140 |
|
|
$schedules[] = "none";//leave none to leave rule enabled all the time
|
| 1141 |
a60fd0cb
|
Scott Ullrich
|
if(is_array($config['schedules']['schedule'])) {
|
| 1142 |
|
|
foreach ($config['schedules']['schedule'] as $schedule) {
|
| 1143 |
|
|
if ($schedule['name'] <> "")
|
| 1144 |
|
|
$schedules[] = $schedule['name'];
|
| 1145 |
|
|
}
|
| 1146 |
|
|
}
|
| 1147 |
615b27bc
|
Scott Dale
|
?>
|
| 1148 |
|
|
<tr>
|
| 1149 |
|
|
<td width="22%" valign="top" class="vncell">Schedule</td>
|
| 1150 |
|
|
<td width="78%" class="vtable">
|
| 1151 |
8ba13f00
|
Ermal
|
<div id="showadvschedulebox" <? if (!empty($pconfig['sched'])) echo "style='display:none'"; ?>>
|
| 1152 |
75c34cbb
|
sullrich
|
<input type="button" onClick="show_advanced_schedule()" value="Advanced"></input> - Show advanced option</a>
|
| 1153 |
0239d8ee
|
sullrich
|
</div>
|
| 1154 |
8ba13f00
|
Ermal
|
<div id="showscheduleadv" <? if (empty($pconfig['sched'])) echo "style='display:none'"; ?>>
|
| 1155 |
0239d8ee
|
sullrich
|
<select name='sched'>
|
| 1156 |
615b27bc
|
Scott Dale
|
<?php
|
| 1157 |
0239d8ee
|
sullrich
|
foreach($schedules as $schedule) {
|
| 1158 |
|
|
if($schedule == $pconfig['sched']) {
|
| 1159 |
|
|
$selected = " SELECTED";
|
| 1160 |
|
|
} else {
|
| 1161 |
|
|
$selected = "";
|
| 1162 |
|
|
}
|
| 1163 |
|
|
if ($schedule == "none") {
|
| 1164 |
|
|
echo "<option value=\"\" {$selected}>{$schedule}</option>\n";
|
| 1165 |
|
|
} else {
|
| 1166 |
|
|
echo "<option value=\"{$schedule}\" {$selected}>{$schedule}</option>\n";
|
| 1167 |
|
|
}
|
| 1168 |
615b27bc
|
Scott Dale
|
}
|
| 1169 |
0239d8ee
|
sullrich
|
?>
|
| 1170 |
|
|
</select>
|
| 1171 |
|
|
<p>Leave as 'none' to leave the rule enabled all the time.</p>
|
| 1172 |
|
|
</div>
|
| 1173 |
615b27bc
|
Scott Dale
|
</td>
|
| 1174 |
|
|
</tr>
|
| 1175 |
82628210
|
Scott Ullrich
|
<tr>
|
| 1176 |
8ab3e9ed
|
Erik Kristensen
|
<td width="22%" valign="top" class="vncell">Gateway</td>
|
| 1177 |
|
|
<td width="78%" class="vtable">
|
| 1178 |
8ba13f00
|
Ermal
|
<div id="showadvgatewaybox" <? if (!empty($pconfig['gateway'])) echo "style='display:none'"; ?>>
|
| 1179 |
75c34cbb
|
sullrich
|
<input type="button" onClick="show_advanced_gateway()" value="Advanced"></input> - Show advanced option</a>
|
| 1180 |
0239d8ee
|
sullrich
|
</div>
|
| 1181 |
8ba13f00
|
Ermal
|
<div id="showgatewayadv" <? if (empty($pconfig['gateway'])) echo "style='display:none'"; ?>>
|
| 1182 |
0239d8ee
|
sullrich
|
<select name='gateway'>
|
| 1183 |
1b38ac36
|
Ermal
|
<option value="" >default</option>
|
| 1184 |
8ab3e9ed
|
Erik Kristensen
|
<?php
|
| 1185 |
1b38ac36
|
Ermal
|
/* build a list of gateways */
|
| 1186 |
|
|
$gateways = return_gateways_array();
|
| 1187 |
106804a2
|
Chris Buechler
|
// add statically configured gateways to list
|
| 1188 |
1b38ac36
|
Ermal
|
foreach($gateways as $gwname => $gw) {
|
| 1189 |
0239d8ee
|
sullrich
|
if($gw == "")
|
| 1190 |
0581660c
|
Scott Ullrich
|
continue;
|
| 1191 |
1b38ac36
|
Ermal
|
if($gwname == $pconfig['gateway']) {
|
| 1192 |
4443d4d6
|
Scott Ullrich
|
$selected = " SELECTED";
|
| 1193 |
1fda0968
|
Scott Ullrich
|
} else {
|
| 1194 |
|
|
$selected = "";
|
| 1195 |
|
|
}
|
| 1196 |
1b38ac36
|
Ermal
|
echo "<option value=\"{$gwname}\" {$selected}>{$gw['name']} - {$gw['gateway']}</option>\n";
|
| 1197 |
106804a2
|
Chris Buechler
|
}
|
| 1198 |
0239d8ee
|
sullrich
|
/* add gateway groups to the list */
|
| 1199 |
|
|
if (is_array($config['gateways']['gateway_group'])) {
|
| 1200 |
|
|
foreach($config['gateways']['gateway_group'] as $gw_group) {
|
| 1201 |
|
|
if($gw_group['name'] == "")
|
| 1202 |
|
|
continue;
|
| 1203 |
|
|
if($pconfig['gateway'] == $gw_group['name']) {
|
| 1204 |
|
|
echo "<option value=\"{$gw_group['name']}\" SELECTED>{$gw_group['name']}</option>\n";
|
| 1205 |
|
|
} else {
|
| 1206 |
|
|
echo "<option value=\"{$gw_group['name']}\">{$gw_group['name']}</option>\n";
|
| 1207 |
|
|
}
|
| 1208 |
|
|
}
|
| 1209 |
|
|
}
|
| 1210 |
8ab3e9ed
|
Erik Kristensen
|
?>
|
| 1211 |
0239d8ee
|
sullrich
|
</select>
|
| 1212 |
|
|
<p><strong>Leave as 'default' to use the system routing table. Or choose a gateway to utilize policy based routing.</strong></p>
|
| 1213 |
|
|
</div>
|
| 1214 |
8ab3e9ed
|
Erik Kristensen
|
</td>
|
| 1215 |
|
|
</tr>
|
| 1216 |
a5fd67e1
|
Ermal Luçi
|
<tr>
|
| 1217 |
|
|
<td width="22%" valign="top" class="vncell">In/Out</td>
|
| 1218 |
|
|
<td width="78%" class="vtable">
|
| 1219 |
8ba13f00
|
Ermal
|
<div id="showadvinoutbox" <? if (!empty($pconfig['dnpipe'])) echo "style='display:none'"; ?>>
|
| 1220 |
75c34cbb
|
sullrich
|
<input type="button" onClick="show_advanced_inout()" value="Advanced"></input> - Show advanced option</a>
|
| 1221 |
4c263f57
|
sullrich
|
</div>
|
| 1222 |
8ba13f00
|
Ermal
|
<div id="showinoutadv" <? if (empty($pconfig['dnpipe'])) echo "style='display:none'"; ?>>
|
| 1223 |
4c263f57
|
sullrich
|
<select name="dnpipe">
|
| 1224 |
a5fd67e1
|
Ermal Luçi
|
<?php
|
| 1225 |
|
|
if (!is_array($dnqlist))
|
| 1226 |
|
|
$dnqlist = array();
|
| 1227 |
|
|
echo "<option value=\"none\"";
|
| 1228 |
|
|
if (!$dnqselected) echo " SELECTED";
|
| 1229 |
|
|
echo " >none</option>";
|
| 1230 |
|
|
foreach ($dnqlist as $dnq => $dnqkey) {
|
| 1231 |
|
|
if($dnq == "")
|
| 1232 |
|
|
continue;
|
| 1233 |
|
|
echo "<option value=\"$dnqkey\"";
|
| 1234 |
|
|
if ($dnqkey == $pconfig['dnpipe']) {
|
| 1235 |
|
|
$dnqselected = 1;
|
| 1236 |
|
|
echo " SELECTED";
|
| 1237 |
|
|
}
|
| 1238 |
|
|
echo ">{$dnq}</option>";
|
| 1239 |
|
|
}
|
| 1240 |
|
|
?>
|
| 1241 |
|
|
</select> /
|
| 1242 |
|
|
<select name="pdnpipe">
|
| 1243 |
|
|
<?php
|
| 1244 |
|
|
$dnqselected = 0;
|
| 1245 |
|
|
echo "<option value=\"none\"";
|
| 1246 |
|
|
if (!$dnqselected) echo " SELECTED";
|
| 1247 |
|
|
echo " >none</option>";
|
| 1248 |
|
|
foreach ($dnqlist as $dnq => $dnqkey) {
|
| 1249 |
|
|
if($dnq == "")
|
| 1250 |
|
|
continue;
|
| 1251 |
|
|
echo "<option value=\"$dnqkey\"";
|
| 1252 |
|
|
if ($dnqkey == $pconfig['pdnpipe']) {
|
| 1253 |
|
|
$dnqselected = 1;
|
| 1254 |
|
|
echo " SELECTED";
|
| 1255 |
|
|
}
|
| 1256 |
|
|
echo ">{$dnq}</option>";
|
| 1257 |
|
|
}
|
| 1258 |
|
|
?>
|
| 1259 |
4c263f57
|
sullrich
|
</select>
|
| 1260 |
a5fd67e1
|
Ermal Luçi
|
<br />
|
| 1261 |
|
|
<span class="vexpl">Choose the Out queue/Virtual interface only if you have selected In too. <br/> The Out selection is applied to traffic going out the interface the rule is created, In is the incoming one. <br/> If you are creating a rule on the Floating tab if the direction is In then the same rules apply, if the direction is out the selections are reverted Out is for incoming and In is for outgoing and if you do not select any direction use only the In since the Out selection does not make sense in there to prevent oddities.</span>
|
| 1262 |
4c263f57
|
sullrich
|
</div>
|
| 1263 |
a5fd67e1
|
Ermal Luçi
|
</td>
|
| 1264 |
|
|
</tr>
|
| 1265 |
|
|
|
| 1266 |
197bfe96
|
Ermal Luçi
|
<tr>
|
| 1267 |
|
|
<td width="22%" valign="top" class="vncell">Ackqueue/Queue</td>
|
| 1268 |
|
|
<td width="78%" class="vtable">
|
| 1269 |
8ba13f00
|
Ermal
|
<div id="showadvackqueuebox" <? if (!empty($pconfig['defaultqueue'])) echo "style='display:none'"; ?>>
|
| 1270 |
75c34cbb
|
sullrich
|
<input type="button" onClick="show_advanced_ackqueue()" value="Advanced"></input> - Show advanced option</a>
|
| 1271 |
0239d8ee
|
sullrich
|
</div>
|
| 1272 |
8ba13f00
|
Ermal
|
<div id="showackqueueadv" <? if (empty($pconfig['defaultqueue'])) echo "style='display:none'"; ?>>
|
| 1273 |
0239d8ee
|
sullrich
|
<select name="ackqueue">
|
| 1274 |
197bfe96
|
Ermal Luçi
|
<?php
|
| 1275 |
0239d8ee
|
sullrich
|
if (!is_array($qlist))
|
| 1276 |
|
|
$qlist = array();
|
| 1277 |
|
|
echo "<option value=\"none\"";
|
| 1278 |
|
|
if (!$qselected) echo " SELECTED";
|
| 1279 |
|
|
echo " >none</option>";
|
| 1280 |
|
|
foreach ($qlist as $q => $qkey) {
|
| 1281 |
|
|
if($q == "")
|
| 1282 |
|
|
continue;
|
| 1283 |
|
|
echo "<option value=\"$q\"";
|
| 1284 |
|
|
if ($q == $pconfig['ackqueue']) {
|
| 1285 |
|
|
$qselected = 1;
|
| 1286 |
|
|
echo " SELECTED";
|
| 1287 |
|
|
}
|
| 1288 |
|
|
echo ">{$q}</option>";
|
| 1289 |
197bfe96
|
Ermal Luçi
|
}
|
| 1290 |
|
|
?>
|
| 1291 |
0239d8ee
|
sullrich
|
</select> /
|
| 1292 |
|
|
<select name="defaultqueue">
|
| 1293 |
197bfe96
|
Ermal Luçi
|
<?php
|
| 1294 |
0239d8ee
|
sullrich
|
$qselected = 0;
|
| 1295 |
|
|
echo "<option value=\"none\"";
|
| 1296 |
|
|
if (!$qselected) echo " SELECTED";
|
| 1297 |
|
|
echo " >none</option>";
|
| 1298 |
|
|
foreach ($qlist as $q => $qkey) {
|
| 1299 |
|
|
if($q == "")
|
| 1300 |
|
|
continue;
|
| 1301 |
|
|
echo "<option value=\"$q\"";
|
| 1302 |
|
|
if ($q == $pconfig['defaultqueue']) {
|
| 1303 |
|
|
$qselected = 1;
|
| 1304 |
|
|
echo " SELECTED";
|
| 1305 |
|
|
}
|
| 1306 |
|
|
echo ">{$q}</option>";
|
| 1307 |
197bfe96
|
Ermal Luçi
|
}
|
| 1308 |
|
|
?>
|
| 1309 |
0239d8ee
|
sullrich
|
</select>
|
| 1310 |
|
|
<br />
|
| 1311 |
|
|
<span class="vexpl">Choose the Acknowledge Queue only if you have selected Queue.</span>
|
| 1312 |
|
|
</td>
|
| 1313 |
|
|
</tr>
|
| 1314 |
|
|
<tr>
|
| 1315 |
|
|
<td width="22%" valign="top" class="vncell">Layer7</td>
|
| 1316 |
|
|
<td width="78%" class="vtable">
|
| 1317 |
8ba13f00
|
Ermal
|
<div id="showadvlayer7box" <? if (!empty($pconfig['l7container'])) echo "style='display:none'"; ?>>
|
| 1318 |
75c34cbb
|
sullrich
|
<input type="button" onClick="show_advanced_layer7()" value="Advanced"></input> - Show advanced option</a>
|
| 1319 |
4c263f57
|
sullrich
|
</div>
|
| 1320 |
8ba13f00
|
Ermal
|
<div id="showlayer7adv" <? if (empty($pconfig['l7container'])) echo "style='display:none'"; ?>>
|
| 1321 |
0239d8ee
|
sullrich
|
<select name="l7container">
|
| 1322 |
7e50413c
|
Ermal Luçi
|
<?php
|
| 1323 |
0239d8ee
|
sullrich
|
if (!is_array($l7clist))
|
| 1324 |
06e2a55d
|
thompsa
|
$l7clist = array();
|
| 1325 |
0239d8ee
|
sullrich
|
echo "<option value=\"none\"";
|
| 1326 |
|
|
echo " >none</option>";
|
| 1327 |
|
|
foreach ($l7clist as $l7ckey) {
|
| 1328 |
|
|
echo "<option value=\"{$l7ckey}\"";
|
| 1329 |
|
|
if ($l7ckey == $pconfig['l7container']) {
|
| 1330 |
|
|
echo " SELECTED";
|
| 1331 |
|
|
}
|
| 1332 |
|
|
echo ">{$l7ckey}</option>";
|
| 1333 |
|
|
}
|
| 1334 |
7e50413c
|
Ermal Luçi
|
?>
|
| 1335 |
0239d8ee
|
sullrich
|
</select>
|
| 1336 |
7e50413c
|
Ermal Luçi
|
<br/>
|
| 1337 |
0239d8ee
|
sullrich
|
<span class="vexpl">
|
| 1338 |
|
|
Choose a Layer7 container to apply application protocol inspection rules.
|
| 1339 |
a29dc11b
|
Chris Buechler
|
These are valid for TCP and UDP protocols only.
|
| 1340 |
0239d8ee
|
sullrich
|
</span>
|
| 1341 |
|
|
</div>
|
| 1342 |
7e50413c
|
Ermal Luçi
|
</td>
|
| 1343 |
|
|
</tr>
|
| 1344 |
8ab3e9ed
|
Erik Kristensen
|
<tr>
|
| 1345 |
|
|
<td width="22%" valign="top"> </td>
|
| 1346 |
|
|
<td width="78%">
|
| 1347 |
151eb2a9
|
sullrich
|
<br>
|
| 1348 |
8ab3e9ed
|
Erik Kristensen
|
<input name="Submit" type="submit" class="formbtn" value="Save"> <input type="button" class="formbtn" value="Cancel" onclick="history.back()">
|
| 1349 |
|
|
<?php if (isset($id) && $a_filter[$id]): ?>
|
| 1350 |
|
|
<input name="id" type="hidden" value="<?=$id;?>">
|
| 1351 |
|
|
<?php endif; ?>
|
| 1352 |
|
|
<input name="after" type="hidden" value="<?=$after;?>">
|
| 1353 |
|
|
</td>
|
| 1354 |
82628210
|
Scott Ullrich
|
</tr>
|
| 1355 |
8ab3e9ed
|
Erik Kristensen
|
</table>
|
| 1356 |
5b237745
|
Scott Ullrich
|
</form>
|
| 1357 |
|
|
<script language="JavaScript">
|
| 1358 |
|
|
<!--
|
| 1359 |
8ab3e9ed
|
Erik Kristensen
|
ext_change();
|
| 1360 |
|
|
typesel_change();
|
| 1361 |
|
|
proto_change();
|
| 1362 |
19757279
|
Scott Ullrich
|
|
| 1363 |
|
|
<?php
|
| 1364 |
8ab3e9ed
|
Erik Kristensen
|
$isfirst = 0;
|
| 1365 |
|
|
$aliases = "";
|
| 1366 |
|
|
$addrisfirst = 0;
|
| 1367 |
|
|
$aliasesaddr = "";
|
| 1368 |
|
|
if($config['aliases']['alias'] <> "" and is_array($config['aliases']['alias']))
|
| 1369 |
|
|
foreach($config['aliases']['alias'] as $alias_name) {
|
| 1370 |
72cb5baf
|
Ermal Lu?i
|
switch ($alias_name['type']) {
|
| 1371 |
|
|
case "port":
|
| 1372 |
|
|
if($isfirst == 1) $portaliases .= ",";
|
| 1373 |
|
|
$portaliases .= "'" . $alias_name['name'] . "'";
|
| 1374 |
8ab3e9ed
|
Erik Kristensen
|
$isfirst = 1;
|
| 1375 |
72cb5baf
|
Ermal Lu?i
|
break;
|
| 1376 |
|
|
case "host":
|
| 1377 |
|
|
case "network":
|
| 1378 |
|
|
case "openvpn":
|
| 1379 |
c7de8be4
|
jim-p
|
case "urltable":
|
| 1380 |
8ab3e9ed
|
Erik Kristensen
|
if($addrisfirst == 1) $aliasesaddr .= ",";
|
| 1381 |
|
|
$aliasesaddr .= "'" . $alias_name['name'] . "'";
|
| 1382 |
|
|
$addrisfirst = 1;
|
| 1383 |
72cb5baf
|
Ermal Lu?i
|
break;
|
| 1384 |
|
|
default:
|
| 1385 |
|
|
break;
|
| 1386 |
8ab3e9ed
|
Erik Kristensen
|
}
|
| 1387 |
092ac49d
|
Scott Ullrich
|
}
|
| 1388 |
19757279
|
Scott Ullrich
|
?>
|
| 1389 |
|
|
|
| 1390 |
8ab3e9ed
|
Erik Kristensen
|
var addressarray=new Array(<?php echo $aliasesaddr; ?>);
|
| 1391 |
72cb5baf
|
Ermal Lu?i
|
var customarray=new Array(<?php echo $portaliases; ?>);
|
| 1392 |
19757279
|
Scott Ullrich
|
|
| 1393 |
9eb60dcc
|
Ermal Lu?i
|
var oTextbox1 = new AutoSuggestControl(document.getElementById("src"), new StateSuggestions(addressarray));
|
| 1394 |
|
|
var oTextbox2 = new AutoSuggestControl(document.getElementById("srcbeginport_cust"), new StateSuggestions(customarray));
|
| 1395 |
|
|
var oTextbox3 = new AutoSuggestControl(document.getElementById("srcendport_cust"), new StateSuggestions(customarray));
|
| 1396 |
|
|
var oTextbox4 = new AutoSuggestControl(document.getElementById("dst"), new StateSuggestions(addressarray));
|
| 1397 |
|
|
var oTextbox5 = new AutoSuggestControl(document.getElementById("dstbeginport_cust"), new StateSuggestions(customarray));
|
| 1398 |
|
|
var oTextbox6 = new AutoSuggestControl(document.getElementById("dstendport_cust"), new StateSuggestions(customarray));
|
| 1399 |
5b237745
|
Scott Ullrich
|
//-->
|
| 1400 |
|
|
</script>
|
| 1401 |
|
|
<?php include("fend.inc"); ?>
|
| 1402 |
|
|
</body>
|
| 1403 |
9b45f821
|
Ermal Lu?i
|
</html>
|