2 LuCI - Lua Configuration Interface
4 Copyright 2008 Steven Barth <steven@midlink.org>
6 Licensed under the Apache License, Version 2.0 (the "License");
7 you may not use this file except in compliance with the License.
8 You may obtain a copy of the License at
10 http://www.apache.org/licenses/LICENSE-2.0
15 local ds = require "luci.dispatcher"
16 local ft = require "luci.tools.firewall"
19 translate("Firewall - Traffic Rules"),
20 translate("Traffic rules define policies for packets traveling between \
21 different zones, for example to reject traffic between certain hosts \
22 or to open WAN ports on the router."))
28 s = m:section(TypedSection, "rule", translate("Traffic Rules"))
32 s.template = "cbi/tblsection"
33 s.extedit = ds.build_url("admin/network/firewall/rules/%s")
34 s.defaults.target = "ACCEPT"
35 s.template_addremove = "firewall/cbi_addrule"
38 function s.create(self, section)
39 created = TypedSection.create(self, section)
42 function s.parse(self, ...)
43 TypedSection.parse(self, ...)
45 local i_n = m:formvalue("_newopen.name")
46 local i_p = m:formvalue("_newopen.proto")
47 local i_e = m:formvalue("_newopen.extport")
48 local i_x = m:formvalue("_newopen.submit")
50 local f_n = m:formvalue("_newfwd.name")
51 local f_s = m:formvalue("_newfwd.src")
52 local f_d = m:formvalue("_newfwd.dest")
53 local f_x = m:formvalue("_newfwd.submit")
56 created = TypedSection.create(self, section)
58 self.map:set(created, "target", "ACCEPT")
59 self.map:set(created, "src", "wan")
60 self.map:set(created, "proto", (i_p ~= "other") and i_p or "all")
61 self.map:set(created, "dest_port", i_e)
62 self.map:set(created, "_name", i_n)
64 if i_p ~= "other" and i_e and #i_e > 0 then
69 created = TypedSection.create(self, section)
71 self.map:set(created, "target", "ACCEPT")
72 self.map:set(created, "src", f_s)
73 self.map:set(created, "dest", f_d)
74 self.map:set(created, "_name", f_n)
78 m.uci:save("firewall")
79 luci.http.redirect(ds.build_url(
80 "admin/network/firewall/rules", created
85 name = s:option(DummyValue, "_name", translate("Name"))
86 function name.cfgvalue(self, s)
87 return self.map:get(s, "_name") or "-"
90 family = s:option(DummyValue, "family", translate("Family"))
91 function family.cfgvalue(self, s)
92 local f = self.map:get(s, "family")
93 if f and f:match("4") then
94 return translate("IPv4")
95 elseif f and f:match("6") then
96 return translate("IPv6")
98 return translate("Any")
102 proto = s:option(DummyValue, "proto", translate("Protocol"))
105 function proto.cfgvalue(self, s)
106 return ft.fmt_proto(self.map:get(s, "proto"), self.map:get(s, "icmp_type"))
110 src = s:option(DummyValue, "src", translate("Source"))
113 function src.cfgvalue(self, s)
114 local z = ft.fmt_zone(self.map:get(s, "src"), translate("any zone"))
115 local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any host"))
116 local p = ft.fmt_port(self.map:get(s, "src_port"))
117 local m = ft.fmt_mac(self.map:get(s, "src_mac"))
120 return translatef("From %s in %s with source %s and %s", a, z, p, m)
122 return translatef("From %s in %s with source %s", a, z, p or m)
124 return translatef("From %s in %s", a, z)
128 dest = s:option(DummyValue, "dest", translate("Destination"))
131 function dest.cfgvalue(self, s)
132 local z = ft.fmt_zone(self.map:get(s, "dest"))
133 local p = ft.fmt_port(self.map:get(s, "dest_port"))
137 local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host"))
139 return translatef("To %s, %s in %s", a, p, z)
141 return translatef("To %s in %s", a, z)
146 local a = ft.fmt_ip(self.map:get(s, "dest_ip"),
147 translate("any router IP"))
150 return translatef("To %s at %s on <var>this device</var>", a, p)
152 return translatef("To %s on <var>this device</var>", a)
158 target = s:option(DummyValue, "target", translate("Action"))
159 target.rawhtml = true
161 function target.cfgvalue(self, s)
162 local t = ft.fmt_target(self.map:get(s, "target"), self.map:get(s, "dest"))
163 local l = ft.fmt_limit(self.map:get(s, "limit"),
164 self.map:get(s, "limit_burst"))
167 return translatef("<var>%s</var> and limit to %s", t, l)
169 return "<var>%s</var>" % t
178 s = m:section(TypedSection, "redirect",
179 translate("Source NAT"),
180 translate("Source NAT is a specific form of masquerading which allows \
181 fine grained control over the source IP used for outgoing traffic, \
182 for example to map multiple WAN addresses to internal subnets."))
183 s.template = "cbi/tblsection"
187 s.extedit = ds.build_url("admin/network/firewall/rules/%s")
188 s.template_addremove = "firewall/cbi_addsnat"
190 function s.create(self, section)
191 created = TypedSection.create(self, section)
194 function s.parse(self, ...)
195 TypedSection.parse(self, ...)
197 local n = m:formvalue("_newsnat.name")
198 local s = m:formvalue("_newsnat.src")
199 local d = m:formvalue("_newsnat.dest")
200 local a = m:formvalue("_newsnat.dip")
201 local p = m:formvalue("_newsnat.dport")
202 local x = m:formvalue("_newsnat.submit")
204 if x and a and #a > 0 then
205 created = TypedSection.create(self, section)
207 self.map:set(created, "target", "SNAT")
208 self.map:set(created, "src", s)
209 self.map:set(created, "dest", d)
210 self.map:set(created, "proto", "all")
211 self.map:set(created, "src_dip", a)
212 self.map:set(created, "src_dport", p)
213 self.map:set(created, "_name", n)
217 m.uci:save("firewall")
218 luci.http.redirect(ds.build_url(
219 "admin/network/firewall/rules", created
224 function s.filter(self, sid)
225 return (self.map:get(sid, "target") == "SNAT")
228 name = s:option(DummyValue, "_name", translate("Name"))
229 function name.cfgvalue(self, s)
230 return self.map:get(s, "_name") or "-"
233 proto = s:option(DummyValue, "proto", translate("Protocol"))
235 function proto.cfgvalue(self, s)
236 return ft.fmt_proto(self.map:get(s, "proto")) or "TCP+UDP"
240 src = s:option(DummyValue, "src", translate("Source"))
243 function src.cfgvalue(self, s)
244 local z = ft.fmt_zone(self.map:get(s, "src"), translate("any zone"))
245 local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any host"))
246 local p = ft.fmt_port(self.map:get(s, "src_port"))
247 local m = ft.fmt_mac(self.map:get(s, "src_mac"))
250 return translatef("From %s in %s with source %s and %s", a, z, p, m)
252 return translatef("From %s in %s with source %s", a, z, p or m)
254 return translatef("From %s in %s", a, z)
258 dest = s:option(DummyValue, "dest", translate("Destination"))
261 function dest.cfgvalue(self, s)
262 local z = ft.fmt_zone(self.map:get(s, "dest"), translate("any zone"))
263 local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host"))
264 local p = ft.fmt_port(self.map:get(s, "dest_port")) or
265 ft.fmt_port(self.map:get(s, "src_dport"))
268 return translatef("To %s, %s in %s", a, p, z)
270 return translatef("To %s in %s", a, z)
274 snat = s:option(DummyValue, "via", translate("SNAT"))
277 function snat.cfgvalue(self, s)
278 local a = ft.fmt_ip(self.map:get(s, "src_dip"))
279 local p = ft.fmt_port(self.map:get(s, "src_dport"))
282 return translatef("Rewrite to source %s, %s", a, p)
284 return translatef("Rewrite to source %s", a or p)