 Hans Dedecker
|
70f8785b9e
zones: add zone identifying local traffic in raw OUTPUT chain
|
5 anni fa |
 Jo-Philipp Wich
|
30463d0805
zones: add interface/subnet bound LOG rules
|
6 anni fa |
|
Jo-Philipp Wich
|
d5923f1924
Reword rule comments
|
6 anni fa |
 Stijn Tintel
|
a3ef503ed5
zones: allow per-table log control
|
6 anni fa |
|
Jo-Philipp Wich
|
f50a524847
helpers: implement explicit CT helper assignment support
|
6 anni fa |
|
Jo-Philipp Wich
|
503db4a2e5
zones: disable masq when resolving of all masq_src or masq_dest items failed
|
7 anni fa |
 Pierre Lebleu
|
6039c7f4b0
firewall3: check the return value of fw3_parse_options()
|
7 anni fa |
|
Jo-Philipp Wich
|
e751cde895
zones: drop outgoing invalid traffic in masqueraded zones
|
7 anni fa |
|
Jo-Philipp Wich
|
37cb4cb437
zones: do not check conntrack state in zone_*_dest_ACCEPT chains
|
7 anni fa |
|
Jo-Philipp Wich
|
13698aafb5
global: remove automatic notrack rules
|
7 anni fa |
|
Jo-Philipp Wich
|
097282eace
zones: properly handle multiple masq_src / masq_dest negations (FS#248)
|
8 anni fa |
 Florian Fainelli
|
18f4c6fda6
utils.h: Avoid name clashes for setbit/delbit/hasbit
|
8 anni fa |
|
Jo-Philipp Wich
|
6818f758fe
zones: allow untracked traffic as well
|
8 anni fa |
|
Jo-Philipp Wich
|
6009904eb4
zones: restrict default ACCEPT rules to NEW ctstate
|
8 anni fa |
|
Jo-Philipp Wich
|
be8ead27f6
treewide: replace jow@openwrt.org with jo@mein.io
|
8 anni fa |
 Jo-Philipp Wich
|
410cff5e62
Use xt_id match to track own rules
|
8 anni fa |
|
Jo-Philipp Wich
|
b59934331c
redirects: respect src_dip option for reflection rules
|
9 anni fa |
|
Jo-Philipp Wich
|
2807cc26b8
Selectively flush conntrack
|
10 anni fa |
|
Jo-Philipp Wich
|
91953d6a6e
zones: make forward policy destination bound
|
10 anni fa |
 Felix Fietkau
|
92281eb747
make fw3_ubus_address take a list_head * argument instead of allocating & returning one
|
10 anni fa |
|
Felix Fietkau
|
a9c694d5b6
use calloc instead of malloc+memset
|
10 anni fa |
|
Jo-Philipp Wich
|
fa3386a705
Clean up dead code
|
10 anni fa |
|
Jo-Philipp Wich
|
d54cb962eb
Use a global -m conntrack --ctstate DNAT rule to accept all port forwards of a given zone in filter
|
11 anni fa |
 Steven Barth
|
c25922c05a
Improve ubus support
|
11 anni fa |
|
Jo-Philipp Wich
|
76976c044d
Use fw3_ipt_rule_replace() when setting up zone interface rules
|
11 anni fa |
|
Jo-Philipp Wich
|
224d93afe9
Reorganize chain layout for raw/NOTRACK rules to fix support for custom rules with target "NOTRACK"
|
11 anni fa |
|
Jo-Philipp Wich
|
52d62c3d46
Keep all basic chains on reload and only flush them, this allows user rules to jump to targets like "reject" or "notrack"
|
11 anni fa |
|
Jo-Philipp Wich
|
182abe47ae
Fix wrong chain emitted for zone forward policy, the terminal chain is source, not destination bound.
|
11 anni fa |
|
Jo-Philipp Wich
|
35d57952d7
Replace fw3_free_zone() with the generic implementation
|
11 anni fa |
|
Jo-Philipp Wich
|
1fc128a601
Add fw3_resolve_zone_addresses() helper to obtain a list of all subnets covered by a zone
|
11 anni fa |
