2 LuCI - Lua Configuration Interface
4 Copyright 2008 Steven Barth <steven@midlink.org>
6 Licensed under the Apache License, Version 2.0 (the "License");
7 you may not use this file except in compliance with the License.
8 You may obtain a copy of the License at
10 http://www.apache.org/licenses/LICENSE-2.0
15 local ds = require "luci.dispatcher"
16 local ft = require "luci.tools.firewall"
19 translate("Firewall - Traffic Rules"),
20 translate("Traffic rules define policies for packets traveling between \
21 different zones, for example to reject traffic between certain hosts \
22 or to open WAN ports on the router."))
28 s = m:section(TypedSection, "rule", translate("Traffic Rules"))
32 s.template = "cbi/tblsection"
33 s.extedit = ds.build_url("admin/network/firewall/rules/%s")
34 s.defaults.target = "ACCEPT"
35 s.template_addremove = "firewall/cbi_addrule"
38 function s.create(self, section)
39 created = TypedSection.create(self, section)
42 function s.parse(self, ...)
43 TypedSection.parse(self, ...)
45 local i_n = m:formvalue("_newopen.name")
46 local i_p = m:formvalue("_newopen.proto")
47 local i_e = m:formvalue("_newopen.extport")
48 local i_x = m:formvalue("_newopen.submit")
50 local f_n = m:formvalue("_newfwd.name")
51 local f_s = m:formvalue("_newfwd.src")
52 local f_d = m:formvalue("_newfwd.dest")
53 local f_x = m:formvalue("_newfwd.submit")
56 created = TypedSection.create(self, section)
58 self.map:set(created, "target", "ACCEPT")
59 self.map:set(created, "src", "wan")
60 self.map:set(created, "proto", (i_p ~= "other") and i_p or "all")
61 self.map:set(created, "dest_port", i_e)
62 self.map:set(created, "_name", i_n)
64 if i_p ~= "other" and i_e and #i_e > 0 then
69 created = TypedSection.create(self, section)
71 self.map:set(created, "target", "ACCEPT")
72 self.map:set(created, "src", f_s)
73 self.map:set(created, "dest", f_d)
74 self.map:set(created, "_name", f_n)
78 m.uci:save("firewall")
79 luci.http.redirect(ds.build_url(
80 "admin", "network", "firewall", "rules", created
85 name = s:option(DummyValue, "_name", translate("Name"))
86 function name.cfgvalue(self, s)
87 return self.map:get(s, "_name") or "-"
90 family = s:option(DummyValue, "family", translate("Family"))
91 function family.cfgvalue(self, s)
92 local f = self.map:get(s, "family")
93 if f and f:match("4") then
94 return translate("IPv4")
95 elseif f and f:match("6") then
96 return translate("IPv6")
98 return translate("Any")
102 proto = s:option(DummyValue, "proto", translate("Protocol"))
105 function proto.cfgvalue(self, s)
106 return ft.fmt_proto(self.map:get(s, "proto"), self.map:get(s, "icmp_type"))
110 src = s:option(DummyValue, "src", translate("Source"))
113 function src.cfgvalue(self, s)
114 local z = ft.fmt_zone(self.map:get(s, "src"))
115 local a = ft.fmt_ip(self.map:get(s, "src_ip"))
116 local p = ft.fmt_port(self.map:get(s, "src_port"))
117 local m = ft.fmt_mac(self.map:get(s, "src_mac"))
119 local s = "From %s in %s " %{
120 (a or "<var>any host</var>"),
121 (z or "<var>any zone</var>")
125 s = s .. "with source %s and %s" %{ p, m }
127 s = s .. "with source %s" %( p or m )
133 dest = s:option(DummyValue, "dest", translate("Destination"))
136 function dest.cfgvalue(self, s)
137 local z = ft.fmt_zone(self.map:get(s, "dest"))
138 local a = ft.fmt_ip(self.map:get(s, "dest_ip"))
139 local p = ft.fmt_port(self.map:get(s, "dest_port"))
143 return "To %s%s in %s" %{
144 (a or "<var>any host</var>"),
145 (p and ", %s" % p or ""),
151 return "To %s%s on <var>this device</var>" %{
152 (a or "<var>any router IP</var>"),
153 (p and " at %s" % p or "")
159 target = s:option(DummyValue, "target", translate("Action"))
160 target.rawhtml = true
162 function target.cfgvalue(self, s)
163 local z = ft.fmt_zone(self.map:get(s, "dest"))
164 local l = ft.fmt_limit(self.map:get(s, "limit"), self.map:get(s, "limit_burst"))
165 local t = ft.fmt_target(self.map:get(s, "target"))
167 return "<var>%s</var> %s%s" %{
169 (z and "forward" or "input"),
170 (l and " and limit to %s" % l or "")
179 s = m:section(TypedSection, "redirect",
180 translate("Source NAT"),
181 translate("Source NAT is a specific form of masquerading which allows \
182 fine grained control over the source IP used for outgoing traffic, \
183 for example to map multiple WAN addresses to internal subnets."))
184 s.template = "cbi/tblsection"
188 s.extedit = ds.build_url("admin/network/firewall/rules/%s")
189 s.template_addremove = "firewall/cbi_addsnat"
191 function s.create(self, section)
192 created = TypedSection.create(self, section)
195 function s.parse(self, ...)
196 TypedSection.parse(self, ...)
198 local n = m:formvalue("_newsnat.name")
199 local s = m:formvalue("_newsnat.src")
200 local d = m:formvalue("_newsnat.dest")
201 local a = m:formvalue("_newsnat.dip")
202 local p = m:formvalue("_newsnat.dport")
203 local x = m:formvalue("_newsnat.submit")
205 if x and a and #a > 0 then
206 created = TypedSection.create(self, section)
208 self.map:set(created, "target", "SNAT")
209 self.map:set(created, "src", s)
210 self.map:set(created, "dest", d)
211 self.map:set(created, "proto", "all")
212 self.map:set(created, "src_dip", a)
213 self.map:set(created, "src_dport", p)
214 self.map:set(created, "_name", n)
218 m.uci:save("firewall")
219 luci.http.redirect(ds.build_url(
220 "admin/network/firewall/rules", created
225 function s.filter(self, sid)
226 return (self.map:get(sid, "target") == "SNAT")
229 name = s:option(DummyValue, "_name", translate("Name"))
230 function name.cfgvalue(self, s)
231 return self.map:get(s, "_name") or "-"
234 proto = s:option(DummyValue, "proto", translate("Protocol"))
236 function proto.cfgvalue(self, s)
237 return ft.fmt_proto(self.map:get(s, "proto")) or "TCP+UDP"
241 src = s:option(DummyValue, "src", translate("Source"))
244 function src.cfgvalue(self, s)
245 local z = ft.fmt_zone(self.map:get(s, "src"))
246 local a = ft.fmt_ip(self.map:get(s, "src_ip"))
247 local p = ft.fmt_port(self.map:get(s, "src_port"))
248 local m = ft.fmt_mac(self.map:get(s, "src_mac"))
250 local s = "From %s in %s " %{
251 (a or "<var>any host</var>"),
252 (z or "<var>any zone</var>")
256 s = s .. "with source %s and %s" %{ p, m }
258 s = s .. "with source %s" %( p or m )
264 dest = s:option(DummyValue, "dest", translate("Destination"))
267 function dest.cfgvalue(self, s)
268 local z = ft.fmt_zone(self.map:get(s, "dest"))
269 local a = ft.fmt_ip(self.map:get(s, "dest_ip"))
270 local p = ft.fmt_port(self.map:get(s, "dest_port")) or
271 ft.fmt_port(self.map:get(s, "src_dport"))
273 return "To %s%s in %s " %{
274 (a or "<var>any host</var>"),
275 (p and ", %s" % p or ""),
276 (z or "<var>any zone</var>")
280 snat = s:option(DummyValue, "via", translate("SNAT"))
283 function snat.cfgvalue(self, s)
284 local a = ft.fmt_ip(self.map:get(s, "src_dip"))
285 local p = ft.fmt_port(self.map:get(s, "src_dport"))
287 --local z = self.map:get(s, "src")
288 --local s = "To %s " %(a or "<var>any %s IP</var>" %( z or "router" ))
291 return "Rewrite to source %s, %s" %{ a, p }
293 return "Rewrite to source %s" %( a or p )