2 LuCI - Lua Configuration Interface
4 Copyright 2008 Steven Barth <steven@midlink.org>
5 Copyright 2010-2012 Jo-Philipp Wich <xm@subsignal.org>
7 Licensed under the Apache License, Version 2.0 (the "License");
8 you may not use this file except in compliance with the License.
9 You may obtain a copy of the License at
11 http://www.apache.org/licenses/LICENSE-2.0
15 local sys = require "luci.sys"
16 local dsp = require "luci.dispatcher"
17 local nxo = require "nixio"
19 local ft = require "luci.tools.firewall"
20 local nw = require "luci.model.network"
26 translate("Firewall - Traffic Rules"),
27 translate("This page allows you to change advanced properties of the \
28 traffic rule entry, such as matched source and destination \
31 m.redirect = dsp.build_url("admin/network/firewall/rules")
35 local rule_type = m.uci:get("firewall", arg[1])
36 if rule_type == "redirect" and m:get(arg[1], "target") ~= "SNAT" then
41 luci.http.redirect(m.redirect)
47 elseif rule_type == "redirect" then
49 local name = m:get(arg[1], "name") or m:get(arg[1], "_name")
50 if not name or #name == 0 then
51 name = translate("(Unnamed SNAT)")
53 name = "SNAT %s" % name
56 m.title = "%s - %s" %{ translate("Firewall - Traffic Rules"), name }
60 m.uci:foreach("firewall", "zone",
62 local n = s.network or s.name
65 for i in n:gmatch("%S+") do
74 s = m:section(NamedSection, arg[1], "redirect", "")
79 ft.opt_enabled(s, Button)
80 ft.opt_name(s, Value, translate("Name"))
83 o = s:option(Value, "proto",
84 translate("Protocol"),
85 translate("You may specify multiple by selecting \"-- custom --\" and \
86 then entering protocols separated by space."))
88 o:value("all", "All protocols")
89 o:value("tcp udp", "TCP+UDP")
92 o:value("icmp", "ICMP")
94 function o.cfgvalue(...)
95 local v = Value.cfgvalue(...)
96 if not v or v == "tcpudp" then
103 o = s:option(Value, "src", translate("Source zone"))
106 o.template = "cbi/firewall_zonelist"
109 o = s:option(DynamicList, "src_mac", translate("Source MAC address"))
111 o.datatype = "neg(macaddr)"
112 o.placeholder = translate("any")
114 luci.sys.net.mac_hints(function(mac, name)
115 o:value(mac, "%s (%s)" %{ mac, name })
119 o = s:option(Value, "src_ip", translate("Source IP address"))
121 o.datatype = "neg(ipaddr)"
122 o.placeholder = translate("any")
124 luci.sys.net.ipv4_hints(function(ip, name)
125 o:value(ip, "%s (%s)" %{ ip, name })
129 o = s:option(Value, "src_port",
130 translate("Source port"),
131 translate("Match incoming traffic originating from the given source \
132 port or port range on the client host."))
134 o.datatype = "neg(portrange)"
135 o.placeholder = translate("any")
138 o = s:option(Value, "dest", translate("Destination zone"))
141 o.template = "cbi/firewall_zonelist"
144 o = s:option(Value, "dest_ip", translate("Destination IP address"))
145 o.datatype = "neg(ip4addr)"
147 luci.sys.net.ipv4_hints(function(ip, name)
148 o:value(ip, "%s (%s)" %{ ip, name })
152 o = s:option(Value, "dest_port",
153 translate("Destination port"),
154 translate("Match forwarded traffic to the given destination port or \
158 o.placeholder = translate("any")
159 o.datatype = "neg(portrange)"
162 o = s:option(Value, "src_dip",
163 translate("SNAT IP address"),
164 translate("Rewrite matched traffic to the given address."))
166 o.datatype = "ip4addr"
168 for k, v in ipairs(nw:get_interfaces()) do
170 for k, a in ipairs(v:ipaddrs()) do
171 o:value(a:host():string(), '%s (%s)' %{
172 a:host():string(), v:shortname()
178 o = s:option(Value, "src_dport", translate("SNAT port"),
179 translate("Rewrite matched traffic to the given source port. May be \
180 left empty to only rewrite the IP address."))
181 o.datatype = "portrange"
183 o.placeholder = translate('Do not rewrite')
186 s:option(Value, "extra",
187 translate("Extra arguments"),
188 translate("Passes additional arguments to iptables. Use with care!"))
195 local name = m:get(arg[1], "name") or m:get(arg[1], "_name")
196 if not name or #name == 0 then
197 name = translate("(Unnamed Rule)")
200 m.title = "%s - %s" %{ translate("Firewall - Traffic Rules"), name }
203 s = m:section(NamedSection, arg[1], "rule", "")
207 ft.opt_enabled(s, Button)
208 ft.opt_name(s, Value, translate("Name"))
211 o = s:option(ListValue, "family", translate("Restrict to address family"))
213 o:value("", translate("IPv4 and IPv6"))
214 o:value("ipv4", translate("IPv4 only"))
215 o:value("ipv6", translate("IPv6 only"))
218 o = s:option(Value, "proto", translate("Protocol"))
219 o:value("all", translate("Any"))
220 o:value("tcp udp", "TCP+UDP")
221 o:value("tcp", "TCP")
222 o:value("udp", "UDP")
223 o:value("icmp", "ICMP")
225 function o.cfgvalue(...)
226 local v = Value.cfgvalue(...)
227 if not v or v == "tcpudp" then
234 o = s:option(DynamicList, "icmp_type", translate("Match ICMP type"))
236 o:value("echo-reply")
237 o:value("destination-unreachable")
238 o:value("network-unreachable")
239 o:value("host-unreachable")
240 o:value("protocol-unreachable")
241 o:value("port-unreachable")
242 o:value("fragmentation-needed")
243 o:value("source-route-failed")
244 o:value("network-unknown")
245 o:value("host-unknown")
246 o:value("network-prohibited")
247 o:value("host-prohibited")
248 o:value("TOS-network-unreachable")
249 o:value("TOS-host-unreachable")
250 o:value("communication-prohibited")
251 o:value("host-precedence-violation")
252 o:value("precedence-cutoff")
253 o:value("source-quench")
255 o:value("network-redirect")
256 o:value("host-redirect")
257 o:value("TOS-network-redirect")
258 o:value("TOS-host-redirect")
259 o:value("echo-request")
260 o:value("router-advertisement")
261 o:value("router-solicitation")
262 o:value("time-exceeded")
263 o:value("ttl-zero-during-transit")
264 o:value("ttl-zero-during-reassembly")
265 o:value("parameter-problem")
266 o:value("ip-header-bad")
267 o:value("required-option-missing")
268 o:value("timestamp-request")
269 o:value("timestamp-reply")
270 o:value("address-mask-request")
271 o:value("address-mask-reply")
274 o = s:option(Value, "src", translate("Source zone"))
278 o.template = "cbi/firewall_zonelist"
281 o = s:option(Value, "src_mac", translate("Source MAC address"))
282 o.datatype = "list(macaddr)"
283 o.placeholder = translate("any")
285 luci.sys.net.mac_hints(function(mac, name)
286 o:value(mac, "%s (%s)" %{ mac, name })
290 o = s:option(Value, "src_ip", translate("Source address"))
291 o.datatype = "neg(ipaddr)"
292 o.placeholder = translate("any")
294 luci.sys.net.ipv4_hints(function(ip, name)
295 o:value(ip, "%s (%s)" %{ ip, name })
299 o = s:option(Value, "src_port", translate("Source port"))
300 o.datatype = "list(neg(portrange))"
301 o.placeholder = translate("any")
304 o = s:option(Value, "dest", translate("Destination zone"))
308 o.template = "cbi/firewall_zonelist"
311 o = s:option(Value, "dest_ip", translate("Destination address"))
312 o.datatype = "neg(ipaddr)"
313 o.placeholder = translate("any")
315 luci.sys.net.ipv4_hints(function(ip, name)
316 o:value(ip, "%s (%s)" %{ ip, name })
320 o = s:option(Value, "dest_port", translate("Destination port"))
321 o.datatype = "list(neg(portrange))"
322 o.placeholder = translate("any")
325 o = s:option(ListValue, "target", translate("Action"))
327 o:value("DROP", translate("drop"))
328 o:value("ACCEPT", translate("accept"))
329 o:value("REJECT", translate("reject"))
330 o:value("NOTRACK", translate("don't track"))
333 s:option(Value, "extra",
334 translate("Extra arguments"),
335 translate("Passes additional arguments to iptables. Use with care!"))