1 -- Copyright 2008 Steven Barth <steven@midlink.org>
2 -- Copyright 2010-2012 Jo-Philipp Wich <jow@openwrt.org>
3 -- Licensed to the public under the Apache License 2.0.
5 local ds = require "luci.dispatcher"
6 local ft = require "luci.tools.firewall"
9 translate("Firewall - Traffic Rules"),
10 translate("Traffic rules define policies for packets traveling between \
11 different zones, for example to reject traffic between certain hosts \
12 or to open WAN ports on the router."))
18 s = m:section(TypedSection, "rule", translate("Traffic Rules"))
22 s.template = "cbi/tblsection"
23 s.extedit = ds.build_url("admin/network/firewall/rules/%s")
24 s.defaults.target = "ACCEPT"
25 s.template_addremove = "firewall/cbi_addrule"
28 function s.create(self, section)
29 created = TypedSection.create(self, section)
32 function s.parse(self, ...)
33 TypedSection.parse(self, ...)
35 local i_n = m:formvalue("_newopen.name")
36 local i_p = m:formvalue("_newopen.proto")
37 local i_e = m:formvalue("_newopen.extport")
38 local i_x = m:formvalue("_newopen.submit")
40 local f_n = m:formvalue("_newfwd.name")
41 local f_s = m:formvalue("_newfwd.src")
42 local f_d = m:formvalue("_newfwd.dest")
43 local f_x = m:formvalue("_newfwd.submit")
46 created = TypedSection.create(self, section)
48 self.map:set(created, "target", "ACCEPT")
49 self.map:set(created, "src", "wan")
50 self.map:set(created, "proto", (i_p ~= "other") and i_p or "all")
51 self.map:set(created, "dest_port", i_e)
52 self.map:set(created, "name", i_n)
54 if i_p ~= "other" and i_e and #i_e > 0 then
59 created = TypedSection.create(self, section)
61 self.map:set(created, "target", "ACCEPT")
62 self.map:set(created, "src", f_s)
63 self.map:set(created, "dest", f_d)
64 self.map:set(created, "name", f_n)
68 m.uci:save("firewall")
69 luci.http.redirect(ds.build_url(
70 "admin/network/firewall/rules", created
75 function s.sectiontitle(self, sid)
76 return (self.map:get(sid, "name") or translate("Unnamed rule"))
79 local function rule_proto_txt(self, s)
80 local f = self.map:get(s, "family")
81 local p = ft.fmt_proto(self.map:get(s, "proto"),
82 self.map:get(s, "icmp_type")) or translate("traffic")
84 if f and f:match("4") then
85 return "%s-%s" %{ translate("IPv4"), p }
86 elseif f and f:match("6") then
87 return "%s-%s" %{ translate("IPv6"), p }
89 return "%s %s" %{ translate("Any"), p }
93 local function rule_src_txt(self, s)
94 local z = ft.fmt_zone(self.map:get(s, "src"))
95 local p = ft.fmt_port(self.map:get(s, "src_port"))
96 local m = ft.fmt_mac(self.map:get(s, "src_mac"))
100 local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any host"))
102 return translatef("From %s in %s with source %s and %s", a, z, p, m)
104 return translatef("From %s in %s with source %s", a, z, p or m)
106 return translatef("From %s in %s", a, z)
111 local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any router IP"))
113 return translatef("From %s on <var>this device</var> with source %s and %s", a, p, m)
115 return translatef("From %s on <var>this device</var> with source %s", a, p or m)
117 return translatef("From %s on <var>this device</var>", a)
122 local function rule_dest_txt(self, s)
123 local z = ft.fmt_zone(self.map:get(s, "dest"))
124 local p = ft.fmt_port(self.map:get(s, "dest_port"))
128 local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host"))
130 return translatef("To %s, %s in %s", a, p, z)
132 return translatef("To %s in %s", a, z)
137 local a = ft.fmt_ip(self.map:get(s, "dest_ip"),
138 translate("any router IP"))
141 return translatef("To %s at %s on <var>this device</var>", a, p)
143 return translatef("To %s on <var>this device</var>", a)
148 local function snat_dest_txt(self, s)
149 local z = ft.fmt_zone(self.map:get(s, "dest"), translate("any zone"))
150 local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host"))
151 local p = ft.fmt_port(self.map:get(s, "dest_port")) or
152 ft.fmt_port(self.map:get(s, "src_dport"))
155 return translatef("To %s, %s in %s", a, p, z)
157 return translatef("To %s in %s", a, z)
162 match = s:option(DummyValue, "match", translate("Match"))
164 function match.cfgvalue(self, s)
165 return "<small>%s<br />%s<br />%s</small>" % {
166 rule_proto_txt(self, s),
167 rule_src_txt(self, s),
168 rule_dest_txt(self, s)
172 target = s:option(DummyValue, "target", translate("Action"))
173 target.rawhtml = true
174 function target.cfgvalue(self, s)
175 local t = ft.fmt_target(self.map:get(s, "target"), self.map:get(s, "src"), self.map:get(s, "dest"))
176 local l = ft.fmt_limit(self.map:get(s, "limit"),
177 self.map:get(s, "limit_burst"))
180 return translatef("<var>%s</var> and limit to %s", t, l)
182 return "<var>%s</var>" % t
186 ft.opt_enabled(s, Flag, translate("Enable"))
193 s = m:section(TypedSection, "redirect",
194 translate("Source NAT"),
195 translate("Source NAT is a specific form of masquerading which allows \
196 fine grained control over the source IP used for outgoing traffic, \
197 for example to map multiple WAN addresses to internal subnets."))
198 s.template = "cbi/tblsection"
202 s.extedit = ds.build_url("admin/network/firewall/rules/%s")
203 s.template_addremove = "firewall/cbi_addsnat"
205 function s.create(self, section)
206 created = TypedSection.create(self, section)
209 function s.parse(self, ...)
210 TypedSection.parse(self, ...)
212 local n = m:formvalue("_newsnat.name")
213 local s = m:formvalue("_newsnat.src")
214 local d = m:formvalue("_newsnat.dest")
215 local a = m:formvalue("_newsnat.dip")
216 local p = m:formvalue("_newsnat.dport")
217 local x = m:formvalue("_newsnat.submit")
219 if x and a and #a > 0 then
220 created = TypedSection.create(self, section)
222 self.map:set(created, "target", "SNAT")
223 self.map:set(created, "src", s)
224 self.map:set(created, "dest", d)
225 self.map:set(created, "proto", "all")
226 self.map:set(created, "src_dip", a)
227 self.map:set(created, "src_dport", p)
228 self.map:set(created, "name", n)
232 m.uci:save("firewall")
233 luci.http.redirect(ds.build_url(
234 "admin/network/firewall/rules", created
239 function s.filter(self, sid)
240 return (self.map:get(sid, "target") == "SNAT")
243 function s.sectiontitle(self, sid)
244 return (self.map:get(sid, "name") or translate("Unnamed SNAT"))
247 match = s:option(DummyValue, "match", translate("Match"))
249 function match.cfgvalue(self, s)
250 return "<small>%s<br />%s<br />%s</small>" % {
251 rule_proto_txt(self, s),
252 rule_src_txt(self, s),
253 snat_dest_txt(self, s)
257 snat = s:option(DummyValue, "via", translate("Action"))
259 function snat.cfgvalue(self, s)
260 local a = ft.fmt_ip(self.map:get(s, "src_dip"))
261 local p = ft.fmt_port(self.map:get(s, "src_dport"))
264 return translatef("Rewrite to source %s, %s", a, p)
266 return translatef("Rewrite to source %s", a or p)
270 ft.opt_enabled(s, Flag, translate("Enable"))