From ee8c38898ddc37bb606c86ff9258ff11014edff1 Mon Sep 17 00:00:00 2001 From: Chris Buechler Date: Sat, 24 Apr 2010 19:04:30 -0400 Subject: [PATCH 1/6] remove bunk input validation --- usr/local/www/firewall_virtual_ip_edit.php | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/usr/local/www/firewall_virtual_ip_edit.php b/usr/local/www/firewall_virtual_ip_edit.php index 4b99f3f91f..096fb86e36 100755 --- a/usr/local/www/firewall_virtual_ip_edit.php +++ b/usr/local/www/firewall_virtual_ip_edit.php @@ -127,16 +127,6 @@ if ($_POST) { } } - /* check for overlaps with 1:1 NAT */ - if (is_array($config['nat']['onetoone'])) { - foreach ($config['nat']['onetoone'] as $natent) { - if (check_subnets_overlap($_POST['subnet'], 32, $natent['external'], $natent['subnet'])) { - $input_errors[] = "A 1:1 NAT mapping overlaps with the specified IP address."; - break; - } - } - } - /* make sure new ip is within the subnet of a valid ip * on one of our interfaces (wan, lan optX) */ From e05b5278cf7fb238ee5355f9701be4c11869f1d2 Mon Sep 17 00:00:00 2001 From: Chris Buechler Date: Sat, 24 Apr 2010 22:16:48 -0400 Subject: [PATCH 2/6] remove this check, the WAN IP can be used in binat now with no problems --- usr/local/www/firewall_nat_1to1_edit.php | 6 ------ 1 file changed, 6 deletions(-) diff --git a/usr/local/www/firewall_nat_1to1_edit.php b/usr/local/www/firewall_nat_1to1_edit.php index 62c4c33bcd..daf5927172 100755 --- a/usr/local/www/firewall_nat_1to1_edit.php +++ b/usr/local/www/firewall_nat_1to1_edit.php @@ -100,12 +100,6 @@ if ($_POST) { $input_errors[] = "A valid internal subnet must be specified."; } - if (is_ipaddr($config['interfaces']['wan']['ipaddr'])) { - if (check_subnets_overlap($_POST['external'], $_POST['subnet'], - get_interface_ip("wan"), 32)) - $input_errors[] = "The WAN IP address may not be used in a 1:1 rule."; - } - /* check for overlaps with other 1:1 */ foreach ($a_1to1 as $natent) { if (isset($id) && ($a_1to1[$id]) && ($a_1to1[$id] === $natent)) From 81a242773ee39eb1e2c25cafe279f02780a98de3 Mon Sep 17 00:00:00 2001 From: Chris Buechler Date: Sat, 24 Apr 2010 22:25:06 -0400 Subject: [PATCH 3/6] remove unnecessary input validation checks --- usr/local/www/firewall_nat_1to1_edit.php | 11 ----------- usr/local/www/firewall_nat_out_edit.php | 12 ------------ 2 files changed, 23 deletions(-) diff --git a/usr/local/www/firewall_nat_1to1_edit.php b/usr/local/www/firewall_nat_1to1_edit.php index daf5927172..d7ed094d4a 100755 --- a/usr/local/www/firewall_nat_1to1_edit.php +++ b/usr/local/www/firewall_nat_1to1_edit.php @@ -114,17 +114,6 @@ if ($_POST) { } } - /* check for overlaps with advanced outbound NAT */ - if (is_array($config['nat']['advancedoutbound']['rule'])) { - foreach ($config['nat']['advancedoutbound']['rule'] as $natent) { - if ($natent['target'] && - check_subnets_overlap($_POST['external'], $_POST['subnet'], $natent['target'], 32)) { - $input_errors[] = "An advanced outbound NAT entry overlaps with the specified external subnet."; - break; - } - } - } - if (!$input_errors) { $natent = array(); diff --git a/usr/local/www/firewall_nat_out_edit.php b/usr/local/www/firewall_nat_out_edit.php index 45db4bae09..483aec1ce2 100755 --- a/usr/local/www/firewall_nat_out_edit.php +++ b/usr/local/www/firewall_nat_out_edit.php @@ -169,18 +169,6 @@ if ($_POST) { $ext = gen_subnet($_POST['destination'], $_POST['destination_subnet']) . "/" . $_POST['destination_subnet']; } - if ($_POST['target']) { - /* check for clashes with 1:1 NAT (NAT Addresses is OK) */ - if (is_array($config['nat']['onetoone'])) { - foreach ($config['nat']['onetoone'] as $natent) { - if (check_subnets_overlap($_POST['target'], 32, $natent['external'], $natent['subnet'])) { - $input_errors[] = "A 1:1 NAT mapping overlaps with the specified target IP address."; - break; - } - } - } - } - foreach ($a_out as $natent) { if (isset($id) && ($a_out[$id]) && ($a_out[$id] === $natent)) { continue; From a73f50e2bb28d6816f2f42806afa1fe4a7d6b886 Mon Sep 17 00:00:00 2001 From: Chris Buechler Date: Sat, 24 Apr 2010 22:36:49 -0400 Subject: [PATCH 4/6] add note about 1:1s and interface IPs --- usr/local/www/firewall_nat_1to1.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/usr/local/www/firewall_nat_1to1.php b/usr/local/www/firewall_nat_1to1.php index d44ced8224..52a1268649 100755 --- a/usr/local/www/firewall_nat_1to1.php +++ b/usr/local/www/firewall_nat_1to1.php @@ -158,7 +158,9 @@ include("head.inc");

Note:
- Depending on the way your WAN connection is setup, you may also need a Virtual IP.

+ Depending on the way your WAN connection is setup, you may also need a Virtual IP.
+ If you add a 1:1 NAT entry for any of the interface IPs on this system, it will make this system inaccessible on that IP address. i.e. if + you use your WAN IP address, any services on this system (IPsec, OpenVPN server, etc.) using the WAN IP address will no longer function.

From 0534d60ae9862068a9403c84aa001c92bc8d2b82 Mon Sep 17 00:00:00 2001 From: Chris Buechler Date: Sun, 25 Apr 2010 00:04:50 -0400 Subject: [PATCH 5/6] temporary work around for ticket #536 --- etc/inc/gwlb.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc index 3d95678a4f..24193d6d53 100644 --- a/etc/inc/gwlb.inc +++ b/etc/inc/gwlb.inc @@ -60,8 +60,8 @@ function setup_gateways_monitor() { # pfSense apinger configuration file. Automatically Generated! ## User and group the pinger should run as -user "nobody" -group "nobody" +user "root" +group "wheel" ## Mailer to use (default: "/usr/lib/sendmail -t") #mailer "/var/qmail/bin/qmail-inject" From 67d5b508edd6a2f84b33a6c82da9dff8b74909f1 Mon Sep 17 00:00:00 2001 From: Chris Buechler Date: Sun, 25 Apr 2010 20:18:27 -0400 Subject: [PATCH 6/6] correctly go to interface for edit bogons/rfc1918 --- usr/local/www/firewall_rules.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/usr/local/www/firewall_rules.php b/usr/local/www/firewall_rules.php index af0fedb6b0..75557bc595 100755 --- a/usr/local/www/firewall_rules.php +++ b/usr/local/www/firewall_rules.php @@ -327,7 +327,7 @@ echo "