diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 922e461b60..c43ae9f25f 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -1367,7 +1367,9 @@ EOD; if(isset($rule['max-src-nodes']) & $rule['max-src-nodes'] <> "") $line .= "max-src-nodes " . $rule['max-src-nodes'] . ""; if(isset($rule['max-src-states']) & $rule['max-src-states'] <> "") - $line .= "max-src-states" . $rule['max-src-states'] . " "; + $line .= "max-src-states " . $rule['max-src-states'] . " "; + if(isset($rule['statetimeout']) & $rule['statetimeout'] <> "") + $line .= "tcp.established " . $rule['statetimeout'] . " "; $line .= " ) "; } diff --git a/usr/local/www/firewall_rules_edit.php b/usr/local/www/firewall_rules_edit.php index b5a5d730bc..b30eb83220 100755 --- a/usr/local/www/firewall_rules_edit.php +++ b/usr/local/www/firewall_rules_edit.php @@ -1,22 +1,22 @@ #!/usr/local/bin/php -. All rights reserved. - + Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - + 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - + 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE @@ -42,7 +42,7 @@ $a_filter = &$config['filter']['rule']; $id = $_GET['id']; if (is_numeric($_POST['id'])) $id = $_POST['id']; - + $after = $_GET['after']; if (isset($_POST['after'])) @@ -55,7 +55,7 @@ if (isset($_GET['dup'])) { function is_specialnet($net) { global $specialsrcdst; - + if (in_array($net, $specialsrcdst) || strstr($net, "opt")) return true; else @@ -63,7 +63,7 @@ function is_specialnet($net) { } function address_to_pconfig($adr, &$padr, &$pmask, &$pnot, &$pbeginport, &$pendport) { - + if (isset($adr['any'])) $padr = "any"; else if ($adr['network']) @@ -73,12 +73,12 @@ function address_to_pconfig($adr, &$padr, &$pmask, &$pnot, &$pbeginport, &$pendp if (!$pmask) $pmask = 32; } - + if (isset($adr['not'])) $pnot = 1; else $pnot = 0; - + if ($adr['port']) { list($pbeginport, $pendport) = explode("-", $adr['port']); if (!$pendport) @@ -90,9 +90,9 @@ function address_to_pconfig($adr, &$padr, &$pmask, &$pnot, &$pbeginport, &$pendp } function pconfig_to_address(&$adr, $padr, $pmask, $pnot, $pbeginport, $pendport) { - + $adr = array(); - + if ($padr == "any") $adr['any'] = true; else if (is_specialnet($padr)) @@ -102,9 +102,9 @@ function pconfig_to_address(&$adr, $padr, $pmask, $pnot, $pbeginport, $pendport) if ($pmask != 32) $adr['address'] .= "/" . $pmask; } - + $adr['not'] = $pnot ? true : false; - + if (($pbeginport != 0) && ($pbeginport != "any")) { if ($pbeginport != $pendport) $adr['port'] = $pbeginport . "-" . $pendport; @@ -115,24 +115,24 @@ function pconfig_to_address(&$adr, $padr, $pmask, $pnot, $pbeginport, $pendport) if (isset($id) && $a_filter[$id]) { $pconfig['interface'] = $a_filter[$id]['interface']; - + if (!isset($a_filter[$id]['type'])) $pconfig['type'] = "pass"; else $pconfig['type'] = $a_filter[$id]['type']; - + if (isset($a_filter[$id]['protocol'])) $pconfig['proto'] = $a_filter[$id]['protocol']; else $pconfig['proto'] = "any"; - + if ($a_filter[$id]['protocol'] == "icmp") $pconfig['icmptype'] = $a_filter[$id]['icmptype']; - + address_to_pconfig($a_filter[$id]['source'], $pconfig['src'], $pconfig['srcmask'], $pconfig['srcnot'], $pconfig['srcbeginport'], $pconfig['srcendport']); - + address_to_pconfig($a_filter[$id]['destination'], $pconfig['dst'], $pconfig['dstmask'], $pconfig['dstnot'], $pconfig['dstbeginport'], $pconfig['dstendport']); @@ -141,7 +141,8 @@ if (isset($id) && $a_filter[$id]) { $pconfig['log'] = isset($a_filter[$id]['log']); $pconfig['frags'] = isset($a_filter[$id]['frags']); $pconfig['descr'] = $a_filter[$id]['descr']; - + $pconfig['statetimeout'] = $a_filter[$id]['statetimeout']; + } else { /* defaults */ if ($_GET['if']) @@ -162,38 +163,38 @@ if ($_POST) { $_POST['dstbeginport'] = 0; $_POST['dstendport'] = 0; } else { - + if ($_POST['srcbeginport_cust'] && !$_POST['srcbeginport']) $_POST['srcbeginport'] = $_POST['srcbeginport_cust']; if ($_POST['srcendport_cust'] && !$_POST['srcendport']) $_POST['srcendport'] = $_POST['srcendport_cust']; - + if ($_POST['srcbeginport'] == "any") { $_POST['srcbeginport'] = 0; $_POST['srcendport'] = 0; - } else { + } else { if (!$_POST['srcendport']) $_POST['srcendport'] = $_POST['srcbeginport']; } if ($_POST['srcendport'] == "any") $_POST['srcendport'] = $_POST['srcbeginport']; - + if ($_POST['dstbeginport_cust'] && !$_POST['dstbeginport']) $_POST['dstbeginport'] = $_POST['dstbeginport_cust']; if ($_POST['dstendport_cust'] && !$_POST['dstendport']) $_POST['dstendport'] = $_POST['dstendport_cust']; - + if ($_POST['dstbeginport'] == "any") { $_POST['dstbeginport'] = 0; $_POST['dstendport'] = 0; - } else { + } else { if (!$_POST['dstendport']) $_POST['dstendport'] = $_POST['dstbeginport']; } if ($_POST['dstendport'] == "any") - $_POST['dstendport'] = $_POST['dstbeginport']; + $_POST['dstendport'] = $_POST['dstbeginport']; } - + if (is_specialnet($_POST['srctype'])) { $_POST['src'] = $_POST['srctype']; $_POST['srcmask'] = 0; @@ -206,7 +207,7 @@ if ($_POST) { } else if ($_POST['dsttype'] == "single") { $_POST['dstmask'] = 32; } - + unset($input_errors); $pconfig = $_POST; @@ -219,7 +220,7 @@ if ($_POST) { if( $_POST['proto'] == "udp" or $_POST['proto'] == "tcp/udp" or $_POST['proto'] == "icmp") $input_errors[] = "You cannot select udp or icmp when using modulate state or synproxy state."; - + if (!(is_specialnet($_POST['srctype']) || ($_POST['srctype'] == "single"))) { $reqdfields[] = "srcmask"; $reqdfieldsn[] = "Source bit count"; @@ -228,9 +229,9 @@ if ($_POST) { $reqdfields[] = "dstmask"; $reqdfieldsn[] = "Destination bit count"; } - + do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); - + if (!$_POST['srcbeginport']) { $_POST['srcbeginport'] = 0; $_POST['srcendport'] = 0; @@ -239,7 +240,7 @@ if ($_POST) { $_POST['dstbeginport'] = 0; $_POST['dstendport'] = 0; } - + if (($_POST['srcbeginport'] && !is_port($_POST['srcbeginport']))) { $input_errors[] = "The start source port must be an integer between 1 and 65535."; } @@ -252,7 +253,7 @@ if ($_POST) { if (($_POST['dstendport'] && !is_port($_POST['dstendport']))) { $input_errors[] = "The end destination port must be an integer between 1 and 65535."; } - + if (!is_specialnet($_POST['srctype'])) { if (($_POST['src'] && !is_ipaddroranyalias($_POST['src']))) { $input_errors[] = "A valid source IP address or alias must be specified."; @@ -269,7 +270,7 @@ if ($_POST) { $input_errors[] = "A valid destination bit count must be specified."; } } - + if ($_POST['srcbeginport'] > $_POST['srcendport']) { /* swap */ $tmp = $_POST['srcendport']; @@ -291,30 +292,31 @@ if ($_POST) { /* Advanced options */ $filterent['max-src-nodes'] = $_POST['max-src-nodes']; $filterent['max-src-states'] = $_POST['max-src-states']; - + $filterent['statetimeout'] = $_POST['statetimeout']; + if ($_POST['proto'] != "any") $filterent['protocol'] = $_POST['proto']; else unset($filterent['protocol']); - + if ($_POST['proto'] == "icmp" && $_POST['icmptype']) $filterent['icmptype'] = $_POST['icmptype']; else unset($filterent['icmptype']); - + pconfig_to_address($filterent['source'], $_POST['src'], $_POST['srcmask'], $_POST['srcnot'], $_POST['srcbeginport'], $_POST['srcendport']); - + pconfig_to_address($filterent['destination'], $_POST['dst'], $_POST['dstmask'], $_POST['dstnot'], $_POST['dstbeginport'], $_POST['dstendport']); - + $filterent['disabled'] = $_POST['disabled'] ? true : false; $filterent['log'] = $_POST['log'] ? true : false; $filterent['frags'] = $_POST['frags'] ? true : false; $filterent['descr'] = $_POST['descr']; - + if (isset($id) && $a_filter[$id]) $a_filter[$id] = $filterent; else { @@ -323,10 +325,10 @@ if ($_POST) { else $a_filter[] = $filterent; } - + write_config(); touch($d_filterconfdirty_path); - + header("Location: firewall_rules.php?if=" . $_POST['interface']); exit; } @@ -367,7 +369,7 @@ function ext_change() { document.iform.dstendport_cust.value = ""; document.iform.dstendport_cust.disabled = 1; } - + if (!portsenabled) { document.iform.srcbeginport.disabled = 1; document.iform.srcendport.disabled = 1; @@ -424,13 +426,13 @@ function proto_change() { } else { portsenabled = 0; } - + if (document.iform.proto.selectedIndex == 3) { document.iform.icmptype.disabled = 0; } else { document.iform.icmptype.disabled = 1; } - + ext_change(); } @@ -450,7 +452,7 @@ function dst_rep_change() {
- + - + - - + - + @@ -508,7 +510,7 @@ Hint: the difference between block and reject is that with reject, a packet (TCP - + - - + - - + - - - + - - - + + - - + - - + - @@ -748,22 +750,32 @@ Hint: the difference between block and reject is that with reject, a packet (TCP
HINT: Select which type of state tracking mechanism you would like to use. If in doubt, use keep state.

Action
Disabled + > Disable this rule
Set this option to disable this rule without removing it from the list.
Interface
- Choose on which interface packets must + Choose on which interface packets must come in to match this rule.
Protocol
- Choose which IP protocol this rule should + Choose which IP protocol this rule should match.
Hint: in most cases, you should specify TCP  here.
Source > @@ -543,7 +545,7 @@ Hint: the difference between block and reject is that with reject, a packet (TCP Use this option to invert the sense of the match.

- + - +
Type:  
Address:   / @@ -576,12 +578,12 @@ Hint: the difference between block and reject is that with reject, a packet (TCP
Source port range +
Source port range + - + - +
from:  
to:
-
- Specify the port or port range for +
+ Specify the port or port range for the source of the packet for this rule. This is usually not equal to the destination port range (and is often "any").
- Hint: you can leave the 'to' field empty if you only + Hint: you can leave the 'to' field empty if you only want to filter a single port
Destination - > + + > not
Use this option to invert the sense of the match.

- + - +
Type:  
Address:   - / + /
Destination port +
Destination port range + - + - +
from:  
to:
-
Specify the port or port range for +
Specify the port or port range for the destination of the packet for this rule.
- Hint: you can leave the 'to' field empty if you only + Hint: you can leave the 'to' field empty if you only want to filter a single port
Fragments + > Allow fragmented packets
- Hint: this option puts additional load - on the firewall and may make it vulnerable to DoS attacks. - In most cases, it is not needed. Try enabling it if you have + Hint: this option puts additional load + on the firewall and may make it vulnerable to DoS attacks. + In most cases, it is not needed. Try enabling it if you have troubles connecting to certain sites.
Log + > Log packets that are handled by this rule
- Hint: the firewall has limited local log - space. Don't turn on logging for everything. If you want to - do a lot of logging, consider using a remote syslog server - (see the Diagnostics: System + Hint: the firewall has limited local log + space. Don't turn on logging for everything. If you want to + do a lot of logging, consider using a remote syslog server + (see the Diagnostics: System logs: Settings page).
Description - -
You may enter a description here + 		+ +
You may enter a description here for your reference (not parsed).
- - - - + + + + +
  • keep state
    		• works with TCP, UDP, and ICMP.
  • modulate state
    		• works only with TCP. pfSense will generate strong Initial Sequence Numbers (ISNs) for packets matching this rule.
  • synproxy state
    		• proxies incoming TCP connections to help protect servers from spoofed TCP SYN floods. This option includes the functionality of keep state and modulate state combined.
  • none
    		• do not use state mechanisms to keep track. this is only useful if your doing advanced queueing in certain situations. please check the faq.
  • keep state
    		• works with TCP, UDP, and ICMP.
  • modulate state
    		• works only with TCP. pfSense will generate strong Initial Sequence Numbers (ISNs) for packets matching this rule.
  • synproxy state
    		• proxies incoming TCP connections to help protect servers from spoofed TCP SYN floods. This option includes the functionality of keep state and modulate state combined.
  • none
    		• do not use state mechanisms to keep track. this is only useful if your doing advanced queueing in certain situations. please check the faq.
    - + + State Timeout + + +

    Leave blank for default. Amount is in seconds. + + + + +   - - + + - + - +