1 -- Copyright 2008 Steven Barth <steven@midlink.org>
2 -- Copyright 2010-2011 Jo-Philipp Wich <jow@openwrt.org>
3 -- Licensed to the public under the Apache License 2.0.
5 local nw = require "luci.model.network"
6 local fw = require "luci.model.firewall"
7 local ds = require "luci.dispatcher"
8 local ut = require "luci.util"
11 local s, name, net, family, msrc, mdest, log, lim
15 m = Map("firewall", translate("Firewall - Zone Settings"))
16 m.redirect = luci.dispatcher.build_url("admin/network/firewall/zones")
22 local zone = fw:get_zone(arg[1])
24 luci.http.redirect(ds.build_url("admin/network/firewall/zones"))
27 m.title = "%s - %s" %{
28 translate("Firewall - Zone Settings"),
29 translatef("Zone %q", zone:name() or "?")
34 s = m:section(NamedSection, zone.sid, "zone",
35 translatef("Zone %q", zone:name()),
36 translatef("This section defines common properties of %q. \
37 The <em>input</em> and <em>output</em> options set the default \
38 policies for traffic entering and leaving this zone while the \
39 <em>forward</em> option describes the policy for forwarded traffic \
40 between different networks within the zone. \
41 <em>Covered networks</em> specifies which available networks are \
42 members of this zone.", zone:name()))
47 m.on_commit = function(map)
48 local zone = fw:get_zone(arg[1])
56 s:tab("general", translate("General Settings"))
57 s:tab("advanced", translate("Advanced Settings"))
60 name = s:taboption("general", Value, "name", translate("Name"))
62 name.forcewrite = true
63 name.datatype = "and(uciname,maxlength(11))"
65 function name.write(self, section, value)
66 if zone:name() ~= value then
67 fw:rename_zone(zone:name(), value)
74 s:taboption("general", ListValue, "input", translate("Input")),
75 s:taboption("general", ListValue, "output", translate("Output")),
76 s:taboption("general", ListValue, "forward", translate("Forward"))
79 for i, v in ipairs(p) do
80 v:value("REJECT", translate("reject"))
81 v:value("DROP", translate("drop"))
82 v:value("ACCEPT", translate("accept"))
85 s:taboption("general", Flag, "masq", translate("Masquerading"))
86 s:taboption("general", Flag, "mtu_fix", translate("MSS clamping"))
88 net = s:taboption("general", Value, "network", translate("Covered networks"))
89 net.template = "cbi/network_netlist"
90 net.widget = "checkbox"
93 function net.formvalue(self, section)
94 return Value.formvalue(self, section) or "-"
97 function net.cfgvalue(self, section)
98 return Value.cfgvalue(self, section) or name:cfgvalue(section)
101 function net.write(self, section, value)
102 zone:clear_networks()
105 for net in ut.imatch(value) do
106 local n = nw:get_network(net) or nw:add_network(net, { proto = "none" })
108 zone:add_network(n:name())
114 family = s:taboption("advanced", ListValue, "family",
115 translate("Restrict to address family"))
117 family.rmempty = true
118 family:value("", translate("IPv4 and IPv6"))
119 family:value("ipv4", translate("IPv4 only"))
120 family:value("ipv6", translate("IPv6 only"))
122 msrc = s:taboption("advanced", DynamicList, "masq_src",
123 translate("Restrict Masquerading to given source subnets"))
126 msrc.datatype = "list(neg(or(uciname,hostname,ipmask4)))"
127 msrc.placeholder = "0.0.0.0/0"
128 msrc:depends("family", "")
129 msrc:depends("family", "ipv4")
131 mdest = s:taboption("advanced", DynamicList, "masq_dest",
132 translate("Restrict Masquerading to given destination subnets"))
134 mdest.optional = true
135 mdest.datatype = "list(neg(or(uciname,hostname,ipmask4)))"
136 mdest.placeholder = "0.0.0.0/0"
137 mdest:depends("family", "")
138 mdest:depends("family", "ipv4")
140 s:taboption("advanced", Flag, "conntrack",
141 translate("Force connection tracking"))
143 log = s:taboption("advanced", Flag, "log",
144 translate("Enable logging on this zone"))
149 lim = s:taboption("advanced", Value, "log_limit",
150 translate("Limit log messages"))
152 lim.placeholder = "10/minute"
153 lim:depends("log", "1")
156 s2 = m:section(NamedSection, zone.sid, "fwd_out",
157 translate("Inter-Zone Forwarding"),
158 translatef("The options below control the forwarding policies between \
159 this zone (%s) and other zones. <em>Destination zones</em> cover \
160 forwarded traffic <strong>originating from %q</strong>. \
161 <em>Source zones</em> match forwarded traffic from other zones \
162 <strong>targeted at %q</strong>. The forwarding rule is \
163 <em>unidirectional</em>, e.g. a forward from lan to wan does \
164 <em>not</em> imply a permission to forward from wan to lan as well.",
165 zone:name(), zone:name(), zone:name()
169 out = s2:option(Value, "out",
170 translate("Allow forward to <em>destination zones</em>:"))
173 out.widget = "checkbox"
174 out.exclude = zone:name()
175 out.template = "cbi/firewall_zonelist"
177 inp = s2:option(Value, "in",
178 translate("Allow forward from <em>source zones</em>:"))
181 inp.widget = "checkbox"
182 inp.exclude = zone:name()
183 inp.template = "cbi/firewall_zonelist"
185 function out.cfgvalue(self, section)
188 for _, f in ipairs(zone:get_forwardings_by("src")) do
191 return table.concat(v, " ")
194 function inp.cfgvalue(self, section)
197 for _, f in ipairs(zone:get_forwardings_by("dest")) do
203 function out.formvalue(self, section)
204 return Value.formvalue(self, section) or "-"
207 function inp.formvalue(self, section)
208 return Value.formvalue(self, section) or "-"
211 function out.write(self, section, value)
212 zone:del_forwardings_by("src")
215 for f in ut.imatch(value) do
216 zone:add_forwarding_to(f)
220 function inp.write(self, section, value)
221 zone:del_forwardings_by("dest")
224 for f in ut.imatch(value) do
225 zone:add_forwarding_from(f)