| Age | Commit message (Collapse) | Author |
|---|
|
Signed-off-by: Steven Barth <steven@midlink.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@40510 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@39965 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@39649 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
- Do not consider bitmap storage for IPv6 family sets
- Move ipset family parameter before any additional option
- Only emit family parameter for hash sets
- Do not allow IPv6 iprange for IPv4 sets and vice versa
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@39647 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
add validation data
Signed-off-by: John Crispin <blogic@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@39617 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
This fixes packet loss due to reloading firewall every minute with IPv6
implementation of certain ISPs.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@39332 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
Signed-off-by: Nathan Hintz <nlhintz@hotmail.com>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@39300 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
The firewall3 implementation as well as the shell implementation predating it
used to process the tcp_ecnoption as boolean while it actually is an integer.
Change the code to parse tcp_ecn as integer.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@39122 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
- instead of writing one (or more) ACCEPT rules in the filter table
for each redirect install a global ctstate DNAT accept rule per zone
- discard rules and redirects which have invalid options set instead
of silently skipping the invalid values
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38849 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
* Use network.interface dump call instead of individual status calls
to reduce overall netifd lookups and invokes to 1 per fw3 process.
* Allow protocol handlers to assign a firewall zone for an interface
in the data section to allow for dynamic firewall zone assignment.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38504 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
- do not insert duplicate rules when setting up reflection to a zone containing multiple interfaces
- set up reflection for any protocol, not just TCP and UDP
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38361 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
- uses "-j CT --notrack" instead of deprecated "-j NOTRACK"
- fixes support for rule sections with target "NOTRACK"
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37777 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
- handles redirects as port relocations if the dest_ip points to the router itself
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37374 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37224 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37171 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
- uses custom formatting for mac addresses to ensure leading zeroes, required for older iptables mac match parser
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37082 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
- fixes misprocessing of unknown symbolic protocol names
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36963 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
- fixes calculation of IPv4 netmasks derived from 0.0.0.0/0 CIDRs
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36960 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
- properly process intermediate "!" options in argument list (fixes negated ipsets)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36935 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
- fixes handling of reject target for rule sections with specific destination zone
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36933 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
- optimizes chain usage for ingress rules
- adds limit match support for redirect rules
- fixes automatic redirect dest detection on little endian systems
- leaves base chains in place on reload to allow user rules to target e.g. "reject"
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36871 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
solves problem with colliding CONFIG_IPV6 symbols
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36868 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
- simplifies using ipsets for rules and redirects, match direction can be specified in-place like option ipset 'setname src dst dst'
- uses zone_name_src_ACTION chains for input rules, this fixes logging with log enabled src zones
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36854 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36840 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36839 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
head with compatibility fixes for AA
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36838 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36837 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36622 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35745 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
- reduce mssfix related log spam (#10681)
- separate src and dest terminal chains (#11453, #12945)
- disable per-zone custom chains by default, they're rarely used
Additionally introduce options "device", "subnet", "extra", "extra_src" and "extra_dest"
to allow defining zones not related to uci interfaces, e.g. to match "ppp+" or any tcp
traffic to and from a specific port.
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35484 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35348 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
This prevents private traffic from leaking out to the internet
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35012 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@34569 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
- use comment match to keep track of per-network rules
- setup reflection for any interface which is part of a masqueraded zone, not just "wan"
- delete per-network reflection rules if network is brought down
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@34472 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
|
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@33688 3c298f89-4303-0410-b956-a3cf2f4a3e73
|
