Project

General

Profile

Download (39.5 KB) Statistics
| Branch: | Tag: | Revision:
1
<?php
2
/* $Id$ */
3
/*
4
	firewall_nat_edit.php
5
	part of m0n0wall (http://m0n0.ch/wall)
6

    
7
	Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
8
	All rights reserved.
9

    
10
	Redistribution and use in source and binary forms, with or without
11
	modification, are permitted provided that the following conditions are met:
12

    
13
	1. Redistributions of source code must retain the above copyright notice,
14
	   this list of conditions and the following disclaimer.
15

    
16
	2. Redistributions in binary form must reproduce the above copyright
17
	   notice, this list of conditions and the following disclaimer in the
18
	   documentation and/or other materials provided with the distribution.
19

    
20
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
21
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
22
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
24
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29
	POSSIBILITY OF SUCH DAMAGE.
30
*/
31
/*
32
	pfSense_MODULE:	nat
33
*/
34

    
35
##|+PRIV
36
##|*IDENT=page-firewall-nat-portforward-edit
37
##|*NAME=Firewall: NAT: Port Forward: Edit page
38
##|*DESCR=Allow access to the 'Firewall: NAT: Port Forward: Edit' page.
39
##|*MATCH=firewall_nat_edit.php*
40
##|-PRIV
41

    
42
require("guiconfig.inc");
43
require_once("itemid.inc");
44
require("filter.inc");
45
require("shaper.inc");
46

    
47
$specialsrcdst = explode(" ", "any pptp pppoe l2tp openvpn");
48
$ifdisp = get_configured_interface_with_descr();
49
foreach ($ifdisp as $kif => $kdescr) {
50
	$specialsrcdst[] = "{$kif}";
51
	$specialsrcdst[] = "{$kif}ip";
52
}
53

    
54
if (!is_array($config['nat']['rule'])) {
55
	$config['nat']['rule'] = array();
56
}
57
$a_nat = &$config['nat']['rule'];
58

    
59
$id = $_GET['id'];
60
if (isset($_POST['id']))
61
	$id = $_POST['id'];
62

    
63
if (isset($_GET['dup'])) {
64
        $id = $_GET['dup'];
65
        $after = $_GET['dup'];
66
}
67

    
68
if (isset($id) && $a_nat[$id]) {
69
	$pconfig['disabled'] = isset($a_nat[$id]['disabled']);
70
	$pconfig['nordr'] = isset($a_nat[$id]['nordr']);
71

    
72
	address_to_pconfig($a_nat[$id]['source'], $pconfig['src'],
73
		$pconfig['srcmask'], $pconfig['srcnot'],
74
		$pconfig['srcbeginport'], $pconfig['srcendport']);
75

    
76
	address_to_pconfig($a_nat[$id]['destination'], $pconfig['dst'],
77
		$pconfig['dstmask'], $pconfig['dstnot'],
78
		$pconfig['dstbeginport'], $pconfig['dstendport']);
79

    
80
	$pconfig['proto'] = $a_nat[$id]['protocol'];
81
	$pconfig['localip'] = $a_nat[$id]['target'];
82
	$pconfig['localbeginport'] = $a_nat[$id]['local-port'];
83
	$pconfig['descr'] = $a_nat[$id]['descr'];
84
	$pconfig['interface'] = $a_nat[$id]['interface'];
85
	$pconfig['associated-rule-id'] = $a_nat[$id]['associated-rule-id'];
86
	$pconfig['nosync'] = isset($a_nat[$id]['nosync']);
87
	$pconfig['natreflection'] = $a_nat[$id]['natreflection'];
88

    
89
	if (!$pconfig['interface'])
90
		$pconfig['interface'] = "wan";
91
} else {
92
	$pconfig['interface'] = "wan";
93
	$pconfig['src'] = "any";
94
	$pconfig['srcbeginport'] = "any";
95
	$pconfig['srcendport'] = "any";
96
}
97

    
98
if (isset($_GET['dup']))
99
	unset($id);
100

    
101
/*  run through $_POST items encoding HTML entties so that the user
102
 *  cannot think he is slick and perform a XSS attack on the unwilling
103
 */
104
foreach ($_POST as $key => $value) {
105
	$temp = $value;
106
	$newpost = htmlentities($temp);
107
	if($newpost <> $temp)
108
		$input_errors[] = sprintf(gettext("Invalid characters detected %s. Please remove invalid characters and save again."), $temp);
109
}
110

    
111
if ($_POST) {
112

    
113
	if(strtoupper($_POST['proto']) == "TCP" || strtoupper($_POST['proto']) == "UDP" || strtoupper($_POST['proto']) == "TCP/UDP") {
114
		if ($_POST['srcbeginport_cust'] && !$_POST['srcbeginport'])
115
			$_POST['srcbeginport'] = $_POST['srcbeginport_cust'];
116
		if ($_POST['srcendport_cust'] && !$_POST['srcendport'])
117
			$_POST['srcendport'] = $_POST['srcendport_cust'];
118

    
119
		if ($_POST['srcbeginport'] == "any") {
120
			$_POST['srcbeginport'] = 0;
121
			$_POST['srcendport'] = 0;
122
		} else {
123
			if (!$_POST['srcendport'])
124
				$_POST['srcendport'] = $_POST['srcbeginport'];
125
		}
126
		if ($_POST['srcendport'] == "any")
127
			$_POST['srcendport'] = $_POST['srcbeginport'];
128

    
129
		if ($_POST['dstbeginport_cust'] && !$_POST['dstbeginport'])
130
			$_POST['dstbeginport'] = $_POST['dstbeginport_cust'];
131
		if ($_POST['dstendport_cust'] && !$_POST['dstendport'])
132
			$_POST['dstendport'] = $_POST['dstendport_cust'];
133

    
134
		if ($_POST['dstbeginport'] == "any") {
135
			$_POST['dstbeginport'] = 0;
136
			$_POST['dstendport'] = 0;
137
		} else {
138
			if (!$_POST['dstendport'])
139
				$_POST['dstendport'] = $_POST['dstbeginport'];
140
		}
141
		if ($_POST['dstendport'] == "any")
142
			$_POST['dstendport'] = $_POST['dstbeginport'];
143

    
144
		if ($_POST['localbeginport_cust'] && !$_POST['localbeginport'])
145
			$_POST['localbeginport'] = $_POST['localbeginport_cust'];
146

    
147
		/* Make beginning port end port if not defined and endport is */
148
		if (!$_POST['srcbeginport'] && $_POST['srcendport'])
149
			$_POST['srcbeginport'] = $_POST['srcendport'];
150
		if (!$_POST['dstbeginport'] && $_POST['dstendport'])
151
			$_POST['dstbeginport'] = $_POST['dstendport'];
152
	} else {
153
		$_POST['srcbeginport'] = 0;
154
		$_POST['srcendport'] = 0;
155
		$_POST['dstbeginport'] = 0;
156
		$_POST['dstendport'] = 0;
157
	}
158

    
159
	if (is_specialnet($_POST['srctype'])) {
160
		$_POST['src'] = $_POST['srctype'];
161
		$_POST['srcmask'] = 0;
162
	} else if ($_POST['srctype'] == "single") {
163
		$_POST['srcmask'] = 32;
164
	}
165
	if (is_specialnet($_POST['dsttype'])) {
166
		$_POST['dst'] = $_POST['dsttype'];
167
		$_POST['dstmask'] = 0;
168
	} else if ($_POST['dsttype'] == "single") {
169
		$_POST['dstmask'] = 32;
170
	} else if (is_ipaddr($_POST['dsttype'])) {
171
		$_POST['dst'] = $_POST['dsttype'];
172
		$_POST['dstmask'] = 32;
173
		$_POST['dsttype'] = "single";
174
	}
175

    
176
	unset($input_errors);
177
	$pconfig = $_POST;
178

    
179
	/* input validation */
180
	if(strtoupper($_POST['proto']) == "TCP" or strtoupper($_POST['proto']) == "UDP" or strtoupper($_POST['proto']) == "TCP/UDP") {
181
		$reqdfields = explode(" ", "interface proto dstbeginport dstendport");
182
		$reqdfieldsn = array(gettext("Interface"),gettext("Protocol"),gettext("Destination port from"),gettext("Destination port to"));
183
	} else {
184
		$reqdfields = explode(" ", "interface proto");
185
		$reqdfieldsn = array(gettext("Interface"),gettext("Protocol"));
186
	}
187

    
188
	if ($_POST['srctype'] == "single" || $_POST['srctype'] == "network") {
189
		$reqdfields[] = "src";
190
		$reqdfieldsn[] = gettext("Source address");
191
	}
192
	if ($_POST['dsttype'] == "single" || $_POST['dsttype'] == "network") {
193
		$reqdfields[] = "dst";
194
		$reqdfieldsn[] = gettext("Destination address");
195
	}
196
	if (!isset($_POST['nordr'])) {
197
		$reqdfields[] = "localip";
198
		$reqdfieldsn[] = gettext("Redirect target IP");
199
	}
200

    
201
	do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
202

    
203
	if (!$_POST['srcbeginport']) {
204
		$_POST['srcbeginport'] = 0;
205
		$_POST['srcendport'] = 0;
206
	}
207
	if (!$_POST['dstbeginport']) {
208
		$_POST['dstbeginport'] = 0;
209
		$_POST['dstendport'] = 0;
210
	}
211

    
212
	if (!isset($_POST['nordr']) && ($_POST['localip'] && !is_ipaddroralias($_POST['localip']))) {
213
		$input_errors[] = sprintf(gettext("\"%s\" is not a valid redirect target IP address or host alias."), $_POST['localip']);
214
	}
215

    
216
	if ($_POST['srcbeginport'] && !is_portoralias($_POST['srcbeginport']))
217
		$input_errors[] = sprintf(gettext("%s is not a valid start source port. It must be a port alias or integer between 1 and 65535."), $_POST['srcbeginport']);
218
	if ($_POST['srcendport'] && !is_portoralias($_POST['srcendport']))
219
		$input_errors[] = sprintf(gettext("%s is not a valid end source port. It must be a port alias or integer between 1 and 65535."), $_POST['srcendport']);
220
	if ($_POST['dstbeginport'] && !is_portoralias($_POST['dstbeginport']))
221
		$input_errors[] = sprintf(gettext("%s is not a valid start destination port. It must be a port alias or integer between 1 and 65535."), $_POST['dstbeginport']);
222
	if ($_POST['dstendport'] && !is_portoralias($_POST['dstendport']))
223
		$input_errors[] = sprintf(gettext("%s is not a valid end destination port. It must be a port alias or integer between 1 and 65535."), $_POST['dstendport']);
224

    
225
	if (!isset($_POST['nordr']) && $_POST['localbeginport'] && !is_portoralias($_POST['localbeginport'])) {
226
		$input_errors[] = sprintf(gettext("%s is not a valid local port. It must be a port alias or integer between 1 and 65535."), $_POST['localbeginport']);
227
	}
228

    
229
	/* if user enters an alias and selects "network" then disallow. */
230
	if( ($_POST['srctype'] == "network" && is_alias($_POST['src']) ) 
231
	 || ($_POST['dsttype'] == "network" && is_alias($_POST['dst']) ) ) {
232
		$input_errors[] = gettext("You must specify single host or alias for alias entries.");
233
	}
234

    
235
	if (!is_specialnet($_POST['srctype'])) {
236
		if (($_POST['src'] && !is_ipaddroralias($_POST['src']))) {
237
			$input_errors[] = sprintf(gettext("%s is not a valid source IP address or alias."), $_POST['src']);
238
		}
239
		if (($_POST['srcmask'] && !is_numericint($_POST['srcmask']))) {
240
			$input_errors[] = gettext("A valid source bit count must be specified.");
241
		}
242
	}
243
	if (!is_specialnet($_POST['dsttype'])) {
244
		if (($_POST['dst'] && !is_ipaddroralias($_POST['dst']))) {
245
			$input_errors[] = sprintf(gettext("%s is not a valid destination IP address or alias."), $_POST['dst']);
246
		}
247
		if (($_POST['dstmask'] && !is_numericint($_POST['dstmask']))) {
248
			$input_errors[] = gettext("A valid destination bit count must be specified.");
249
		}
250
	}
251

    
252
	if ($_POST['srcbeginport'] > $_POST['srcendport']) {
253
		/* swap */
254
		$tmp = $_POST['srcendport'];
255
		$_POST['srcendport'] = $_POST['srcbeginport'];
256
		$_POST['srcbeginport'] = $tmp;
257
	}
258
	if ($_POST['dstbeginport'] > $_POST['dstendport']) {
259
		/* swap */
260
		$tmp = $_POST['dstendport'];
261
		$_POST['dstendport'] = $_POST['dstbeginport'];
262
		$_POST['dstbeginport'] = $tmp;
263
	}
264

    
265
	if (!$input_errors) {
266
		if (!isset($_POST['nordr']) && ($_POST['dstendport'] - $_POST['dstbeginport'] + $_POST['localbeginport']) > 65535)
267
			$input_errors[] = gettext("The target port range must be an integer between 1 and 65535.");
268
	}
269

    
270
	/* check for overlaps */
271
	foreach ($a_nat as $natent) {
272
		if (isset($id) && ($a_nat[$id]) && ($a_nat[$id] === $natent))
273
			continue;
274
		if ($natent['interface'] != $_POST['interface'])
275
			continue;
276
		if ($natent['destination']['address'] != $_POST['dst'])
277
			continue;
278
		if (($natent['proto'] != $_POST['proto']) && ($natent['proto'] != "tcp/udp") && ($_POST['proto'] != "tcp/udp"))
279
			continue;
280

    
281
		list($begp,$endp) = explode("-", $natent['destination']['port']);
282
		if (!$endp)
283
			$endp = $begp;
284

    
285
		if (!(   (($_POST['beginport'] < $begp) && ($_POST['endport'] < $begp))
286
		      || (($_POST['beginport'] > $endp) && ($_POST['endport'] > $endp)))) {
287

    
288
			$input_errors[] = gettext("The destination port range overlaps with an existing entry.");
289
			break;
290
		}
291
	}
292

    
293
	if (!$input_errors) {
294
		$natent = array();
295

    
296
		$natent['disabled'] = isset($_POST['disabled']) ? true:false;
297
		$natent['nordr'] = isset($_POST['nordr']) ? true:false;
298

    
299
		if ($natent['nordr']) {
300
			$_POST['associated-rule-id'] = '';
301
			$_POST['filter-rule-association'] = '';
302
		}
303

    
304
		pconfig_to_address($natent['source'], $_POST['src'],
305
			$_POST['srcmask'], $_POST['srcnot'],
306
			$_POST['srcbeginport'], $_POST['srcendport']);
307

    
308
		pconfig_to_address($natent['destination'], $_POST['dst'],
309
			$_POST['dstmask'], $_POST['dstnot'],
310
			$_POST['dstbeginport'], $_POST['dstendport']);
311

    
312
		$natent['protocol'] = $_POST['proto'];
313

    
314
		if (!$natent['nordr']) {
315
			$natent['target'] = $_POST['localip'];
316
			$natent['local-port'] = $_POST['localbeginport'];
317
		}
318
		$natent['interface'] = $_POST['interface'];
319
		$natent['descr'] = $_POST['descr'];
320
		$natent['associated-rule-id'] = $_POST['associated-rule-id'];
321

    
322
		if($_POST['filter-rule-association'] == "pass")
323
			$natent['associated-rule-id'] = "pass";
324

    
325
		if($_POST['nosync'] == "yes")
326
			$natent['nosync'] = true;
327
		else
328
			unset($natent['nosync']);
329

    
330
		if ($_POST['natreflection'] == "enable" || $_POST['natreflection'] == "disable")
331
			$natent['natreflection'] = $_POST['natreflection'];
332
		else
333
			unset($natent['natreflection']);
334

    
335
		// If we used to have an associated filter rule, but no-longer should have one
336
		if (!empty($a_nat[$id]) && ( empty($natent['associated-rule-id']) || $natent['associated-rule-id'] != $a_nat[$id]['associated-rule-id'] ) ) {
337
			// Delete the previous rule
338
			delete_id($a_nat[$id]['associated-rule-id'], $config['filter']['rule']);
339
			mark_subsystem_dirty('filter');
340
		}
341

    
342
		$need_filter_rule = false;
343
		// Updating a rule with a filter rule associated
344
		if (!empty($natent['associated-rule-id']))
345
			$need_filter_rule = true;
346
		// Create a rule or if we want to create a new one
347
		if( $natent['associated-rule-id']=='new' ) {
348
			$need_filter_rule = true;
349
			unset( $natent['associated-rule-id'] );
350
			$_POST['filter-rule-association']='add-associated';
351
		}
352
		// If creating a new rule, where we want to add the filter rule, associated or not
353
		else if( isset($_POST['filter-rule-association']) &&
354
			($_POST['filter-rule-association']=='add-associated' ||
355
			$_POST['filter-rule-association']=='add-unassociated') )
356
			$need_filter_rule = true;
357

    
358
		// Determine NAT entry ID now, we need it for the firewall rule
359
		if (isset($id) && $a_nat[$id])
360
			$a_nat[$id] = $natent;
361
		else {
362
			if (is_numeric($after))
363
				$id = $after + 1;
364
			else
365
				$id = count($a_nat);
366
		}
367

    
368
		if ($need_filter_rule == true) {
369

    
370
			/* auto-generate a matching firewall rule */
371
			$filterent = array();
372
			unset($filterentid);
373
			// If a rule already exists, load it
374
			if (!empty($natent['associated-rule-id'])) {
375
				$filterentid = get_id($natent['associated-rule-id'], $config['filter']['rule']);
376
				if ($filterentid == false)
377
					$filterent['associated-rule-id'] = $natent['associated-rule-id'];
378
				else
379
					$filterent =& $config['filter']['rule'][$filterentid];
380
			}
381
			pconfig_to_address($filterent['source'], $_POST['src'],
382
				$_POST['srcmask'], $_POST['srcnot'],
383
				$_POST['srcbeginport'], $_POST['srcendport']);
384

    
385
			// Update interface, protocol and destination
386
			$filterent['interface'] = $_POST['interface'];
387
			$filterent['protocol'] = $_POST['proto'];
388
			$filterent['destination']['address'] = $_POST['localip'];
389

    
390
			$dstpfrom = $_POST['localbeginport'];
391
			$dstpto = $dstpfrom + $_POST['dstendport'] - $_POST['dstbeginport'];
392

    
393
			if ($dstpfrom == $dstpto)
394
				$filterent['destination']['port'] = $dstpfrom;
395
			else
396
				$filterent['destination']['port'] = $dstpfrom . "-" . $dstpto;
397

    
398
			/*
399
			 * Our firewall filter description may be no longer than
400
			 * 63 characters, so don't let it be.
401
			 */
402
			$filterent['descr'] = substr("NAT " . $_POST['descr'], 0, 62);
403

    
404
			// If this is a new rule, create an ID and add the rule
405
			if( $_POST['filter-rule-association']=='add-associated' ) {
406
				$filterent['associated-rule-id'] = $natent['associated-rule-id'] = get_unique_id();
407
				$config['filter']['rule'][] = $filterent;
408
			}
409

    
410
			mark_subsystem_dirty('filter');
411
		}
412

    
413
		// Update the NAT entry now
414
		if (isset($id) && $a_nat[$id])
415
			$a_nat[$id] = $natent;
416
		else {
417
			if (is_numeric($after))
418
				array_splice($a_nat, $after+1, 0, array($natent));
419
			else
420
				$a_nat[] = $natent;
421
		}
422

    
423
		mark_subsystem_dirty('natconf');
424

    
425
		write_config();
426

    
427
		header("Location: firewall_nat.php");
428
		exit;
429
	}
430
}
431

    
432
$pgtitle = array(gettext("Firewall"),gettext("NAT"),gettext("Port Forward"),gettext("Edit"));
433
include("head.inc");
434

    
435
?>
436

    
437
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
438
<?php
439
include("fbegin.inc"); ?>
440
<?php if ($input_errors) print_input_errors($input_errors); ?>
441
            <form action="firewall_nat_edit.php" method="post" name="iform" id="iform">
442
              <table width="100%" border="0" cellpadding="6" cellspacing="0">
443
				<tr>
444
					<td colspan="2" valign="top" class="listtopic"><?=gettext("Edit Redirect entry"); ?></td>
445
				</tr>
446
		<tr>
447
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Disabled"); ?></td>
448
			<td width="78%" class="vtable">
449
				<input name="disabled" type="checkbox" id="disabled" value="yes" <?php if ($pconfig['disabled']) echo "checked"; ?>>
450
				<strong><?=gettext("Disable this rule"); ?></strong><br />
451
				<span class="vexpl"><?=gettext("Set this option to disable this rule without removing it from the list."); ?></span>
452
			</td>
453
		</tr>
454
                <tr>
455
                  <td width="22%" valign="top" class="vncell"><?=gettext("No RDR (NOT)"); ?></td>
456
                  <td width="78%" class="vtable">
457
                    <input type="checkbox" name="nordr" id="nordr" onClick="nordr_change();" <?php if($pconfig['nordr']) echo "CHECKED"; ?>>
458
                    <span class="vexpl"><?=gettext("Enabling this option will disable redirection for traffic matching this rule."); ?>
459
                    <br><?=gettext("Hint: this option is rarely needed, don't use this unless you know what you're doing."); ?></span>
460
                  </td>
461
                </tr>
462
		<tr>
463
                  <td width="22%" valign="top" class="vncellreq"><?=gettext("Interface"); ?></td>
464
                  <td width="78%" class="vtable">
465
					<select name="interface" class="formselect" onChange="dst_change(this.value,iface_old,document.iform.dsttype.value);iface_old = document.iform.interface.value;typesel_change();">
466
						<?php
467

    
468
						$iflist = get_configured_interface_with_descr(false, true);
469
						foreach ($iflist as $if => $ifdesc)
470
							if(have_ruleint_access($if))
471
								$interfaces[$if] = $ifdesc;
472

    
473
						if ($config['l2tp']['mode'] == "server")
474
							if(have_ruleint_access("l2tp"))
475
								$interfaces['l2tp'] = "L2TP VPN";
476

    
477
						if ($config['pptpd']['mode'] == "server")
478
							if(have_ruleint_access("pptp"))
479
								$interfaces['pptp'] = "PPTP VPN";
480

    
481
						if ($config['pppoe']['mode'] == "server")
482
							if(have_ruleint_access("pppoe"))
483
								$interfaces['pppoe'] = "PPPoE VPN";
484

    
485
						/* add ipsec interfaces */
486
						if (isset($config['ipsec']['enable']) || isset($config['ipsec']['mobileclients']['enable']))
487
							if(have_ruleint_access("enc0"))
488
								$interfaces["enc0"] = "IPsec";
489

    
490
						/* add openvpn/tun interfaces */
491
						if  ($config['openvpn']["openvpn-server"] || $config['openvpn']["openvpn-client"])
492
							$interfaces["openvpn"] = "OpenVPN";
493

    
494
						foreach ($interfaces as $iface => $ifacename): ?>
495
						<option value="<?=$iface;?>" <?php if ($iface == $pconfig['interface']) echo "selected"; ?>>
496
						<?=htmlspecialchars($ifacename);?>
497
						</option>
498
						<?php endforeach; ?>
499
					</select><br>
500
                     <span class="vexpl"><?=gettext("Choose which interface this rule applies to."); ?><br>
501
                     <?=gettext("Hint: in most cases, you'll want to use WAN here."); ?></span></td>
502
                </tr>
503
                <tr>
504
                  <td width="22%" valign="top" class="vncellreq"><?=gettext("Protocol"); ?></td>
505
                  <td width="78%" class="vtable">
506
                    <select name="proto" class="formselect" onChange="proto_change(); check_for_aliases();">
507
                      <?php $protocols = explode(" ", "TCP UDP TCP/UDP GRE ESP"); foreach ($protocols as $proto): ?>
508
                      <option value="<?=strtolower($proto);?>" <?php if (strtolower($proto) == $pconfig['proto']) echo "selected"; ?>><?=htmlspecialchars($proto);?></option>
509
                      <?php endforeach; ?>
510
                    </select> <br> <span class="vexpl"><?=gettext("Choose which IP protocol " .
511
                    "this rule should match."); ?><br>
512
                    <?=gettext("Hint: in most cases, you should specify"); ?> <em><?=gettext("TCP"); ?></em> &nbsp;<?=gettext("here."); ?></span></td>
513
                </tr>
514
		<tr id="showadvancedboxsrc" name="showadvancedboxsrc">
515
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Source"); ?></td>
516
			<td width="78%" class="vtable">
517
				<input type="button" onClick="show_source()" value="<?=gettext("Advanced"); ?>"></input> - <?=gettext("Show source address and port range"); ?></a>
518
			</td>
519
		</tr>
520
		<tr style="display: none;" id="srctable" name="srctable">
521
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Source"); ?></td>
522
			<td width="78%" class="vtable">
523
				<input name="srcnot" type="checkbox" id="srcnot" value="yes" <?php if ($pconfig['srcnot']) echo "checked"; ?>>
524
				<strong><?=gettext("not"); ?></strong>
525
				<br />
526
				<?=gettext("Use this option to invert the sense of the match."); ?>
527
				<br />
528
				<br />
529
				<table border="0" cellspacing="0" cellpadding="0">
530
					<tr>
531
						<td><?=gettext("Type:"); ?>&nbsp;&nbsp;</td>
532
						<td>
533
							<select name="srctype" class="formselect" onChange="typesel_change()">
534
<?php
535
								$sel = is_specialnet($pconfig['src']); ?>
536
								<option value="any"     <?php if ($pconfig['src'] == "any") { echo "selected"; } ?>><?=gettext("any"); ?></option>
537
								<option value="single"  <?php if (($pconfig['srcmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>><?=gettext("Single host or alias"); ?></option>
538
								<option value="network" <?php if (!$sel) echo "selected"; ?>><?=gettext("Network"); ?></option>
539
								<?php if(have_ruleint_access("pptp")): ?>
540
								<option value="pptp"    <?php if ($pconfig['src'] == "pptp") { echo "selected"; } ?>><?=gettext("PPTP clients"); ?></option>
541
								<?php endif; ?>
542
								<?php if(have_ruleint_access("pppoe")): ?>
543
								<option value="pppoe"   <?php if ($pconfig['src'] == "pppoe") { echo "selected"; } ?>><?=gettext("PPPoE clients"); ?></option>
544
								<?php endif; ?>
545
								 <?php if(have_ruleint_access("l2tp")): ?>
546
                                                                <option value="l2tp"   <?php if ($pconfig['src'] == "l2tp") { echo "selected"; } ?>><?=gettext("L2TP clients"); ?></option>
547
                                 <?php endif; ?>
548
<?php
549
								foreach ($ifdisp as $ifent => $ifdesc): ?>
550
								<?php if(have_ruleint_access($ifent)): ?>
551
									<option value="<?=$ifent;?>" <?php if ($pconfig['src'] == $ifent) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?> <?=gettext("subnet"); ?></option>
552
									<option value="<?=$ifent;?>ip"<?php if ($pconfig['src'] ==  $ifent . "ip") { echo "selected"; } ?>>
553
										<?=$ifdesc?> <?=gettext("address");?>
554
									</option>
555
								<?php endif; ?>
556
<?php 							endforeach; ?>
557
							</select>
558
						</td>
559
					</tr>
560
					<tr>
561
						<td><?=gettext("Address:"); ?>&nbsp;&nbsp;</td>
562
						<td>
563
							<input autocomplete='off' name="src" type="text" class="formfldalias" id="src" size="20" value="<?php if (!is_specialnet($pconfig['src'])) echo htmlspecialchars($pconfig['src']);?>"> /
564
							<select name="srcmask" class="formselect" id="srcmask">
565
<?php						for ($i = 31; $i > 0; $i--): ?>
566
								<option value="<?=$i;?>" <?php if ($i == $pconfig['srcmask']) echo "selected"; ?>><?=$i;?></option>
567
<?php 						endfor; ?>
568
							</select>
569
						</td>
570
					</tr>
571
				</table>
572
			</td>
573
		</tr>
574
		<tr style="display:none" id="sprtable" name="sprtable">
575
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Source port range"); ?></td>
576
			<td width="78%" class="vtable">
577
				<table border="0" cellspacing="0" cellpadding="0">
578
					<tr>
579
						<td><?=gettext("from:"); ?>&nbsp;&nbsp;</td>
580
						<td>
581
							<select name="srcbeginport" class="formselect" onchange="src_rep_change();ext_change()">
582
								<option value="">(<?=gettext("other"); ?>)</option>
583
								<option value="any" <?php $bfound = 0; if ($pconfig['srcbeginport'] == "any") { echo "selected"; $bfound = 1; } ?>><?=gettext("any"); ?></option>
584
<?php 							foreach ($wkports as $wkport => $wkportdesc): ?>
585
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcbeginport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
586
<?php 							endforeach; ?>
587
							</select>
588
							<input autocomplete='off' class="formfldalias" name="srcbeginport_cust" id="srcbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcbeginport']) echo htmlspecialchars($pconfig['srcbeginport']); ?>">
589
						</td>
590
					</tr>
591
					<tr>
592
						<td><?=gettext("to:"); ?></td>
593
						<td>
594
							<select name="srcendport" class="formselect" onchange="ext_change()">
595
								<option value="">(<?=gettext("other"); ?>)</option>
596
								<option value="any" <?php $bfound = 0; if ($pconfig['srcendport'] == "any") { echo "selected"; $bfound = 1; } ?>><?=gettext("any"); ?></option>
597
<?php							foreach ($wkports as $wkport => $wkportdesc): ?>
598
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
599
<?php							endforeach; ?>
600
							</select>
601
							<input autocomplete='off' class="formfldalias" name="srcendport_cust" id="srcendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcendport']) echo htmlspecialchars($pconfig['srcendport']); ?>">
602
						</td>
603
					</tr>
604
				</table>
605
				<br />
606
				<span class="vexpl"><?=gettext("Specify the source port or port range for this rule"); ?>. <b><?=gettext("This is usually"); ?> <em><?=gettext("random"); ?></em> <?=gettext("and almost never equal to the destination port range (and should usually be 'any')"); ?>.</b> <br /> <?=gettext("Hint: you can leave the"); ?> <em>'<?=gettext("to"); ?>'</em> <?=gettext("field empty if you only want to filter a single port."); ?></span><br/>
607
			</td>
608
		</tr>
609
		<tr>
610
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Destination"); ?></td>
611
			<td width="78%" class="vtable">
612
				<input name="dstnot" type="checkbox" id="dstnot" value="yes" <?php if ($pconfig['dstnot']) echo "checked"; ?>>
613
				<strong><?=gettext("not"); ?></strong>
614
					<br />
615
				<?=gettext("Use this option to invert the sense of the match."); ?>
616
					<br />
617
					<br />
618
				<table border="0" cellspacing="0" cellpadding="0">
619
					<tr>
620
						<td><?=gettext("Type:"); ?>&nbsp;&nbsp;</td>
621
						<td>
622
							<select name="dsttype" class="formselect" onChange="typesel_change()">
623
<?php
624
								$sel = is_specialnet($pconfig['dst']); ?>
625
								<option value="any" <?php if ($pconfig['dst'] == "any") { echo "selected"; } ?>><?=gettext("any"); ?></option>
626
								<option value="single" <?php if (($pconfig['dstmask'] == 32) && !$sel) { echo "selected"; $sel = 1; } ?>><?=gettext("Single host or alias"); ?></option>
627
								<option value="network" <?php if (!$sel) echo "selected"; ?>><?=gettext("Network"); ?></option>
628
								<?php if(have_ruleint_access("pptp")): ?>
629
								<option value="pptp" <?php if ($pconfig['dst'] == "pptp") { echo "selected"; } ?>><?=gettext("PPTP clients"); ?></option>
630
								<?php endif; ?>
631
								<?php if(have_ruleint_access("pppoe")): ?>
632
								<option value="pppoe" <?php if ($pconfig['dst'] == "pppoe") { echo "selected"; } ?>><?=gettext("PPPoE clients"); ?></option>
633
								<?php endif; ?>
634
								<?php if(have_ruleint_access("l2tp")): ?>
635
                                                                <option value="l2tp" <?php if ($pconfig['dst'] == "l2tp") { echo "selected"; } ?>><?=gettext("L2TP clients"); ?></option>
636
                                                                <?php endif; ?>
637

    
638
<?php 							foreach ($ifdisp as $if => $ifdesc): ?>
639
								<?php if(have_ruleint_access($if)): ?>
640
									<option value="<?=$if;?>" <?php if ($pconfig['dst'] == $if) { echo "selected"; } ?>><?=htmlspecialchars($ifdesc);?> <?=gettext("subnet"); ?></option>
641
									<option value="<?=$if;?>ip"<?php if ($pconfig['dst'] == $if . "ip") { echo "selected"; } ?>>
642
										<?=$ifdesc;?> <?=gettext("address");?>
643
									</option>
644
								<?php endif; ?>
645
<?php 							endforeach; ?>
646

    
647
<?php							if (is_array($config['virtualip']['vip'])):
648
									foreach ($config['virtualip']['vip'] as $sn):
649
										if (isset($sn['noexpand']))
650
											continue;
651
										if ($sn['mode'] == "proxyarp" && $sn['type'] == "network"):
652
											$start = ip2long32(gen_subnet($sn['subnet'], $sn['subnet_bits']));
653
											$end = ip2long32(gen_subnet_max($sn['subnet'], $sn['subnet_bits']));
654
											$len = $end - $start;
655
											for ($i = 0; $i <= $len; $i++):
656
												$snip = long2ip32($start+$i);
657
?>
658
												<option value="<?=$snip;?>" <?php if ($snip == $pconfig['dst']) echo "selected"; ?>><?=htmlspecialchars("{$snip} ({$sn['descr']})");?></option>
659
<?php										endfor;
660
										else:
661
?>
662
											<option value="<?=$sn['subnet'];?>" <?php if ($sn['subnet'] == $pconfig['dst']) echo "selected"; ?>><?=htmlspecialchars("{$sn['subnet']} ({$sn['descr']})");?></option>
663
<?php									endif;
664
									endforeach;
665
								endif;
666
?>
667
							</select>
668
						</td>
669
					</tr>
670
					<tr>
671
						<td><?=gettext("Address:"); ?>&nbsp;&nbsp;</td>
672
						<td>
673
							<input name="dst" type="text" class="formfldalias" id="dst" size="20" value="<?php if (!is_specialnet($pconfig['dst'])) echo htmlspecialchars($pconfig['dst']);?>">
674
							/
675
							<select name="dstmask" class="formselect" id="dstmask">
676
<?php
677
							for ($i = 31; $i > 0; $i--): ?>
678
								<option value="<?=$i;?>" <?php if ($i == $pconfig['dstmask']) echo "selected"; ?>><?=$i;?></option>
679
<?php						endfor; ?>
680
							</select>
681
						</td>
682
					</tr>
683
				</table>
684
			</td>
685
		</tr>
686
		<tr id="dprtr" name="dprtr">
687
			<td width="22%" valign="top" class="vncellreq"><?=gettext("Destination port range"); ?> </td>
688
			<td width="78%" class="vtable">
689
				<table border="0" cellspacing="0" cellpadding="0">
690
					<tr>
691
						<td><?=gettext("from:"); ?>&nbsp;&nbsp;</td>
692
						<td>
693
							<select name="dstbeginport" class="formselect" onchange="dst_rep_change();ext_change()">
694
								<option value="">(<?=gettext("other"); ?>)</option>
695
<?php 							$bfound = 0;
696
								foreach ($wkports as $wkport => $wkportdesc): ?>
697
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstbeginport']) { echo "selected"; $bfound = 1; }?>><?=htmlspecialchars($wkportdesc);?></option>
698
<?php 							endforeach; ?>
699
							</select>
700
							<input autocomplete='off' class="formfldalias" name="dstbeginport_cust" id="dstbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstbeginport']) echo htmlspecialchars($pconfig['dstbeginport']); ?>">
701
						</td>
702
					</tr>
703
					<tr>
704
						<td><?=gettext("to:"); ?></td>
705
						<td>
706
							<select name="dstendport" class="formselect" onchange="ext_change()">
707
								<option value="">(<?=gettext("other"); ?>)</option>
708
<?php							$bfound = 0;
709
								foreach ($wkports as $wkport => $wkportdesc): ?>
710
									<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
711
<?php 							endforeach; ?>
712
							</select>
713
							<input autocomplete='off' class="formfldalias" name="dstendport_cust" id="dstendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstendport']) echo htmlspecialchars($pconfig['dstendport']); ?>">
714
						</td>
715
					</tr>
716
				</table>
717
				<br />
718
				<span class="vexpl">
719
					<?=gettext("Specify the port or port range for the destination of the packet for this mapping."); ?>
720
					<br />
721
					<?=gettext("Hint: you can leave the"); ?> <em>'<?=gettext("to"); ?>'</em> <?=gettext("field empty if you only want to map a single port"); ?>
722
				</span>
723
			</td>
724
		</tr>
725
                <tr name="localiptable" id="localiptable">
726
                  <td width="22%" valign="top" class="vncellreq"><?=gettext("Redirect target IP"); ?></td>
727
                  <td width="78%" class="vtable">
728
                    <input autocomplete='off' name="localip" type="text" class="formfldalias" id="localip" size="20" value="<?=htmlspecialchars($pconfig['localip']);?>">
729
                    <br> <span class="vexpl"><?=gettext("Enter the internal IP address of " .
730
                    "the server on which you want to map the ports."); ?><br>
731
                    <?=gettext("e.g."); ?> <em>192.168.1.12</em></span></td>
732
                </tr>
733
                <tr name="lprtr" id="lprtr">
734
                  <td width="22%" valign="top" class="vncellreq"><?=gettext("Redirect target port"); ?></td>
735
                  <td width="78%" class="vtable">
736
                    <select name="localbeginport" class="formselect" onChange="ext_change();check_for_aliases();">
737
                      <option value="">(<?=gettext("other"); ?>)</option>
738
                      <?php $bfound = 0; foreach ($wkports as $wkport => $wkportdesc): ?>
739
                      <option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['localbeginport']) {
740
							echo "selected";
741
							$bfound = 1;
742
						}?>>
743
					  <?=htmlspecialchars($wkportdesc);?>
744
					  </option>
745
                      <?php endforeach; ?>
746
                    </select> <input onChange="check_for_aliases();" autocomplete='off' class="formfldalias" name="localbeginport_cust" id="localbeginport_cust" type="text" size="5" value="<?php if (!$bfound) echo htmlspecialchars($pconfig['localbeginport']); ?>">
747
                    <br>
748
                    <span class="vexpl"><?=gettext("Specify the port on the machine with the " .
749
                    "IP address entered above. In case of a port range, specify " .
750
                    "the beginning port of the range (the end port will be calculated " .
751
                    "automatically)."); ?><br>
752
                    <?=gettext("Hint: this is usually identical to the 'from' port above"); ?></span></td>
753
                </tr>
754
                <tr>
755
                  <td width="22%" valign="top" class="vncell"><?=gettext("Description"); ?></td>
756
                  <td width="78%" class="vtable">
757
                    <input name="descr" type="text" class="formfld unknown" id="descr" size="40" value="<?=htmlspecialchars($pconfig['descr']);?>">
758
                    <br> <span class="vexpl"><?=gettext("You may enter a description here " .
759
                    "for your reference (not parsed)."); ?></span></td>
760
                </tr>
761
				<tr>
762
					<td width="22%" valign="top" class="vncell"><?=gettext("No XMLRPC Sync"); ?></td>
763
					<td width="78%" class="vtable">
764
						<input type="checkbox" value="yes" name="nosync"<?php if($pconfig['nosync']) echo " CHECKED"; ?>><br>
765
						<?=gettext("HINT: This prevents the rule from automatically syncing to other CARP members"); ?>.
766
					</td>
767
				</tr>
768
				<tr>
769
					<td width="22%" valign="top" class="vncell"><?=gettext("NAT reflection"); ?></td>
770
					<td width="78%" class="vtable">
771
						<select name="natreflection" class="formselect">
772
						<option value="default" <?php if ($pconfig['natreflection'] != "enable" && $pconfig['natreflection'] != "disable") echo "selected"; ?>><?=gettext("use system default"); ?></option>
773
						<option value="enable" <?php if ($pconfig['natreflection'] == "enable") echo "selected"; ?>><?=gettext("enable"); ?></option>
774
						<option value="disable" <?php if ($pconfig['natreflection'] == "disable") echo "selected"; ?>><?=gettext("disable"); ?></option>
775
						</select>
776
					</td>
777
				</tr>
778
				<?php if (isset($id) && $a_nat[$id] && !isset($_GET['dup'])): ?>
779
				<tr name="assoctable" id="assoctable">
780
					<td width="22%" valign="top" class="vncell"><?=gettext("Filter rule association"); ?></td>
781
					<td width="78%" class="vtable">
782
						<select name="associated-rule-id">
783
							<option value=""><?=gettext("None"); ?></option>
784
							<option value="pass" <?php if($pconfig['associated-rule-id'] == "pass") echo " SELECTED"; ?>><?=gettext("Pass"); ?></option>
785
							<?php
786
							$linkedrule = "";
787
							if (is_array($config['filter']['rule'])) {
788
							      filter_rules_sort();
789
							      foreach ($config['filter']['rule'] as $filter_id => $filter_rule) {
790
								if (isset($filter_rule['associated-rule-id'])) {
791
									echo "<option value=\"{$filter_rule['associated-rule-id']}\"";
792
									if ($filter_rule['associated-rule-id']==$pconfig['associated-rule-id']) {
793
										echo " SELECTED";
794
										$linkedrule = "<br /><a href=\"firewall_rules_edit.php?id={$filter_id}\">" . gettext("View the filter rule") . "</a><br/>";
795
									}
796
									echo ">". htmlspecialchars('Rule ' . $filter_rule['descr']) . "</option>\n";
797

    
798
								}
799
							      }
800
							}
801
							if (isset($pconfig['associated-rule-id']))
802
								echo "<option value=\"new\">" . gettext("Create new associated filter rule") . "</option>\n";
803
						echo "</select>\n";
804
						echo $linkedrule;
805
						?>
806
					</td>
807
				</tr>
808
				<?php endif; ?>
809
                <?php if ((!(isset($id) && $a_nat[$id])) || (isset($_GET['dup']))): ?>
810
                <tr name="assoctable" id="assoctable">
811
                  <td width="22%" valign="top" class="vncell"><?=gettext("Filter rule association"); ?></td>
812
                  <td width="78%" class="vtable">
813
                    <select name="filter-rule-association" id="filter-rule-association">
814
						<option value=""><?=gettext("None"); ?></option>
815
						<option value="add-associated" selected="selected"><?=gettext("Add associated filter rule"); ?></option>
816
						<option value="add-unassociated"><?=gettext("Add unassociated filter rule"); ?></option>
817
						<option value="pass"><?=gettext("Pass"); ?></option>
818
					</select>
819
				  </td>
820
                </tr><?php endif; ?>
821
				<tr>
822
                  <td width="22%" valign="top">&nbsp;</td>
823
                  <td width="78%">&nbsp;</td>
824
				</tr>
825
                <tr>
826
                  <td width="22%" valign="top">&nbsp;</td>
827
                  <td width="78%">
828
                    <input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"> <input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
829
                    <?php if (isset($id) && $a_nat[$id]): ?>
830
                    <input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
831
                    <?php endif; ?>
832
                  </td>
833
                </tr>
834
              </table>
835
</form>
836
<script language="JavaScript">
837
<!--
838
	ext_change();
839
	dst_change(document.iform.interface.value,'<?=htmlspecialchars($pconfig['interface'])?>','<?=htmlspecialchars($pconfig['dst'])?>');
840
	var iface_old = document.iform.interface.value;
841
	typesel_change();
842
	proto_change();
843
	<?php if ($pconfig['srcnot'] || $pconfig['src'] != "any" || $pconfig['srcbeginport'] != "any" || $pconfig['srcendport'] != "any"): ?>
844
	show_source();
845
	<?php endif; ?>
846
	nordr_change();
847
//-->
848
</script>
849
<?php
850
$isfirst = 0;
851
$aliases = "";
852
$addrisfirst = 0;
853
$aliasesaddr = "";
854
if($config['aliases']['alias'] <> "")
855
	foreach($config['aliases']['alias'] as $alias_name) {
856
		switch ($alias_name['type']) {
857
                        case "port":
858
                                if($isfirst == 1) $portaliases .= ",";
859
                                $portaliases .= "'" . $alias_name['name'] . "'";
860
                                $isfirst = 1;
861
                                break;
862
                        case "host":
863
                        case "network":
864
                        case "openvpn":
865
			case "urltable":
866
                                if($addrisfirst == 1) $aliasesaddr .= ",";
867
                                $aliasesaddr .= "'" . $alias_name['name'] . "'";
868
                                $addrisfirst = 1;
869
                                break;
870
                        default:
871
                                break;
872
		}
873
	}
874
?>
875
<script language="JavaScript">
876
<!--
877
	var addressarray=new Array(<?php echo $aliasesaddr; ?>);
878
	var customarray=new Array(<?php echo $portaliases; ?>);
879

    
880
	var oTextbox1 = new AutoSuggestControl(document.getElementById("localip"), new StateSuggestions(addressarray));
881
	var oTextbox2 = new AutoSuggestControl(document.getElementById("src"), new StateSuggestions(addressarray));
882
	var oTextbox3 = new AutoSuggestControl(document.getElementById("dst"), new StateSuggestions(addressarray));
883
	var oTextbox4 = new AutoSuggestControl(document.getElementById("dstbeginport_cust"), new StateSuggestions(customarray));
884
	var oTextbox5 = new AutoSuggestControl(document.getElementById("dstendport_cust"), new StateSuggestions(customarray));
885
	var oTextbox6 = new AutoSuggestControl(document.getElementById("srcbeginport_cust"), new StateSuggestions(customarray));
886
	var oTextbox7 = new AutoSuggestControl(document.getElementById("srcendport_cust"), new StateSuggestions(customarray));
887
	var oTextbox8 = new AutoSuggestControl(document.getElementById("localbeginport_cust"), new StateSuggestions(customarray));
888
//-->
889
</script>
890
<?php include("fend.inc"); ?>
891
</body>
892
</html>
(56-56/224)