2 LuCI - Lua Configuration Interface
4 Copyright 2008 Steven Barth <steven@midlink.org>
5 Copyright 2010-2012 Jo-Philipp Wich <xm@subsignal.org>
7 Licensed under the Apache License, Version 2.0 (the "License");
8 you may not use this file except in compliance with the License.
9 You may obtain a copy of the License at
11 http://www.apache.org/licenses/LICENSE-2.0
15 local ds = require "luci.dispatcher"
16 local ft = require "luci.tools.firewall"
19 translate("Firewall - Traffic Rules"),
20 translate("Traffic rules define policies for packets traveling between \
21 different zones, for example to reject traffic between certain hosts \
22 or to open WAN ports on the router."))
28 s = m:section(TypedSection, "rule", translate("Traffic Rules"))
32 s.template = "cbi/tblsection"
33 s.extedit = ds.build_url("admin/network/firewall/rules/%s")
34 s.defaults.target = "ACCEPT"
35 s.template_addremove = "firewall/cbi_addrule"
38 function s.create(self, section)
39 created = TypedSection.create(self, section)
42 function s.parse(self, ...)
43 TypedSection.parse(self, ...)
45 local i_n = m:formvalue("_newopen.name")
46 local i_p = m:formvalue("_newopen.proto")
47 local i_e = m:formvalue("_newopen.extport")
48 local i_x = m:formvalue("_newopen.submit")
50 local f_n = m:formvalue("_newfwd.name")
51 local f_s = m:formvalue("_newfwd.src")
52 local f_d = m:formvalue("_newfwd.dest")
53 local f_x = m:formvalue("_newfwd.submit")
56 created = TypedSection.create(self, section)
58 self.map:set(created, "target", "ACCEPT")
59 self.map:set(created, "src", "wan")
60 self.map:set(created, "proto", (i_p ~= "other") and i_p or "all")
61 self.map:set(created, "dest_port", i_e)
62 self.map:set(created, "name", i_n)
64 if i_p ~= "other" and i_e and #i_e > 0 then
69 created = TypedSection.create(self, section)
71 self.map:set(created, "target", "ACCEPT")
72 self.map:set(created, "src", f_s)
73 self.map:set(created, "dest", f_d)
74 self.map:set(created, "name", f_n)
78 m.uci:save("firewall")
79 luci.http.redirect(ds.build_url(
80 "admin/network/firewall/rules", created
85 ft.opt_name(s, DummyValue, translate("Name"))
87 local function rule_proto_txt(self, s)
88 local f = self.map:get(s, "family")
89 local p = ft.fmt_proto(self.map:get(s, "proto"),
90 self.map:get(s, "icmp_type")) or "TCP+UDP"
92 if f and f:match("4") then
93 return "%s-%s" %{ translate("IPv4"), p }
94 elseif f and f:match("6") then
95 return "%s-%s" %{ translate("IPv6"), p }
97 return "%s %s" %{ translate("Any"), p }
101 local function rule_src_txt(self, s)
102 local z = ft.fmt_zone(self.map:get(s, "src"), translate("any zone"))
103 local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any host"))
104 local p = ft.fmt_port(self.map:get(s, "src_port"))
105 local m = ft.fmt_mac(self.map:get(s, "src_mac"))
108 return translatef("From %s in %s with source %s and %s", a, z, p, m)
110 return translatef("From %s in %s with source %s", a, z, p or m)
112 return translatef("From %s in %s", a, z)
116 local function rule_dest_txt(self, s)
117 local z = ft.fmt_zone(self.map:get(s, "dest"))
118 local p = ft.fmt_port(self.map:get(s, "dest_port"))
122 local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host"))
124 return translatef("To %s, %s in %s", a, p, z)
126 return translatef("To %s in %s", a, z)
131 local a = ft.fmt_ip(self.map:get(s, "dest_ip"),
132 translate("any router IP"))
135 return translatef("To %s at %s on <var>this device</var>", a, p)
137 return translatef("To %s on <var>this device</var>", a)
142 local function snat_dest_txt(self, s)
143 local z = ft.fmt_zone(self.map:get(s, "dest"), translate("any zone"))
144 local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host"))
145 local p = ft.fmt_port(self.map:get(s, "dest_port")) or
146 ft.fmt_port(self.map:get(s, "src_dport"))
149 return translatef("To %s, %s in %s", a, p, z)
151 return translatef("To %s in %s", a, z)
156 match = s:option(DummyValue, "match", translate("Match"))
159 function match.cfgvalue(self, s)
160 return "<small>%s<br />%s<br />%s</small>" % {
161 rule_proto_txt(self, s),
162 rule_src_txt(self, s),
163 rule_dest_txt(self, s)
167 target = s:option(DummyValue, "target", translate("Action"))
168 target.rawhtml = true
170 function target.cfgvalue(self, s)
171 local t = ft.fmt_target(self.map:get(s, "target"), self.map:get(s, "dest"))
172 local l = ft.fmt_limit(self.map:get(s, "limit"),
173 self.map:get(s, "limit_burst"))
176 return translatef("<var>%s</var> and limit to %s", t, l)
178 return "<var>%s</var>" % t
182 ft.opt_enabled(s, Flag, translate("Enable")).width = "1%"
189 s = m:section(TypedSection, "redirect",
190 translate("Source NAT"),
191 translate("Source NAT is a specific form of masquerading which allows \
192 fine grained control over the source IP used for outgoing traffic, \
193 for example to map multiple WAN addresses to internal subnets."))
194 s.template = "cbi/tblsection"
198 s.extedit = ds.build_url("admin/network/firewall/rules/%s")
199 s.template_addremove = "firewall/cbi_addsnat"
201 function s.create(self, section)
202 created = TypedSection.create(self, section)
205 function s.parse(self, ...)
206 TypedSection.parse(self, ...)
208 local n = m:formvalue("_newsnat.name")
209 local s = m:formvalue("_newsnat.src")
210 local d = m:formvalue("_newsnat.dest")
211 local a = m:formvalue("_newsnat.dip")
212 local p = m:formvalue("_newsnat.dport")
213 local x = m:formvalue("_newsnat.submit")
215 if x and a and #a > 0 then
216 created = TypedSection.create(self, section)
218 self.map:set(created, "target", "SNAT")
219 self.map:set(created, "src", s)
220 self.map:set(created, "dest", d)
221 self.map:set(created, "proto", "all")
222 self.map:set(created, "src_dip", a)
223 self.map:set(created, "src_dport", p)
224 self.map:set(created, "name", n)
228 m.uci:save("firewall")
229 luci.http.redirect(ds.build_url(
230 "admin/network/firewall/rules", created
235 function s.filter(self, sid)
236 return (self.map:get(sid, "target") == "SNAT")
239 ft.opt_name(s, DummyValue, translate("Name"))
241 match = s:option(DummyValue, "match", translate("Match"))
244 function match.cfgvalue(self, s)
245 return "<small>%s<br />%s<br />%s</small>" % {
246 rule_proto_txt(self, s),
247 rule_src_txt(self, s),
248 snat_dest_txt(self, s)
252 snat = s:option(DummyValue, "via", translate("Action"))
255 function snat.cfgvalue(self, s)
256 local a = ft.fmt_ip(self.map:get(s, "src_dip"))
257 local p = ft.fmt_port(self.map:get(s, "src_dport"))
260 return translatef("Rewrite to source %s, %s", a, p)
262 return translatef("Rewrite to source %s", a or p)
266 ft.opt_enabled(s, Flag, translate("Enable")).width = "1%"