| Age | Commit message (Collapse) | Author | |
|---|---|---|---|
| 2009-04-13 | Add conntrack and post firewall hooks for IPv6. | Bob Gilligan | |
| 2009-04-13 | Fix bug where an empty firewall rule deletes the default drop policy. | Stig Thormodsrud | |
| 2009-04-13 | Move firewall "end" processing down to each table. | Stig Thormodsrud | |
| Fix bug for global enable/disable of conntrack. | |||
| 2009-04-09 | Add ability for firename to select default policy. | Stig Thormodsrud | |
| 2009-04-08 | Fix faulty search loop. | Stig Thormodsrud | |
| 2009-04-07 | Apply interface firewalls to separate VYATTA_(IN|OUT)_HOOK. | Stig Thormodsrud | |
| This enforces in firewall to be processed before out firewall. | |||
| 2009-03-27 | Revert "Allow user configurable default-policy on firewall." | Stig Thormodsrud | |
| Further test identified a problem. The patch is broken if a packet must do both an in & out filter. This reverts commit 754d0f4d855a59020afa20ad8867218708b5c978. | |||
| 2009-03-27 | Allow user configurable default-policy on firewall. | Stig Thormodsrud | |
| 2009-03-12 | Doing strict ES won't work for router | Stephen Hemminger | |
| Need a different kind of filter to fix 4061. (Not sure if it is even possible as firewall rule since it depends on quagga config rules). | |||
| 2009-03-12 | Don't use -P | Stephen Hemminger | |
| Changing default property of rules screws up other things | |||
| 2009-03-12 | Enable strict host matching | Stephen Hemminger | |
| Bug 4061 Host (INPUT) chain will only accept packets where destination address matches address on incoming interface. | |||
| 2009-03-04 | Don't attempt to delete ruleset from "other" trees | Bob Gilligan | |
| When a ruleset was being applied to an interface, the code previously attempted to find out if that ruleset name was being applied to that same interface and in the same direction, but under a different "tree" name (e.g. "name", "ipv6-name", "modify", etc.). If it found a match, it would delete the other rule. But the matching logic was insufficient, so it killed off some random other rule instead. There is really no need to perform this check anyway, so I have removed it. | |||
| 2009-02-24 | Allow IPv6 firewall rulesets to be configured on an interface independent of ↵ | Bob Gilligan | |
| IPv4. Replaced the hand-coded config templates under each type of interface with script-generated templates. This should be easier to maintain as we add new types of interfaces. Added sub-trees for "modify", "ipv6-name" and "ipv6-modify" under "in", "out" and "local" for all interfaces. Added command-completion for ruleset names being configured on an interface. | |||
| 2009-02-15 | Add support for ranges in firewall group address & port. | Stig Thormodsrud | |
| 2009-02-13 | Add description and references to "show firewall group". | Stig Thormodsrud | |
| 2009-02-13 | Add show-set to display all sets. | Stig Thormodsrud | |
| 2009-02-13 | Add support for "show firewall group". | Stig Thormodsrud | |
| 2009-02-09 | Add back parameter that was dropped when converting to use run_cmd(). | Stig Thormodsrud | |
| 2009-02-06 | Add carriage return to error message. | Stig Thormodsrud | |
| 2009-02-06 | Add validation of group type. | Stig Thormodsrud | |
| 2009-02-04 | Delete commented out code. | Stig Thormodsrud | |
| 2009-02-03 | Turn on strict checking and fix warnings | Stephen Hemminger | |
| Turn on strict checking and fix the resulting errors. Get rid of perlcritic warnings. | |||
| 2009-02-02 | Add 1st pass of firewall group support (ipset netfilter module | Stig Thormodsrud | |
| integration). | |||
| 2009-01-29 | Use iptables comment to identify CLI rule numbers in iptables output | Mohit Mehta | |
| 2009-01-23 | Bugfix 4062: Don't reference parameters outside the config tree. | Bob Gilligan | |
| The AddressFilter module was reaching up the config tree to find a config parameter that was used to determine whether the address type was IPv4 or IPv6. This breaks when the functions are called from some locations in the config tree. I added explicity function calls to allow the caller to to set the IP version, obviating the need to reference a config parameter to determin the IP version. | |||
| 2009-01-21 | Initial support for IPv6. | Bob Gilligan | |
| 2008-12-03 | fix for perl module reorganization | An-Cheng Huang | |
| 2008-11-24 | Convert VyattaConfig to Vyatta::Config | Stephen Hemminger | |
| 2008-11-21 | Rename VyattaIpTablesRule to Vyatta::IpTables::Rule | Stephen Hemminger | |
| 2008-08-21 | fix for bug 3622: add pre-SNAT hook | An-Cheng Huang | |
| 2008-08-21 | fix for bug 3604: add fragment matching options | An-Cheng Huang | |
| 2008-08-07 | fix conntrack enabling mechanism | An-Cheng Huang | |
| 2008-08-07 | fix for bug 2224: add "recent" matching | An-Cheng Huang | |
| 2008-06-04 | rename "mangle" to "modify" | An-Cheng Huang | |
| 2008-05-19 | allow firewall rule to match inbound IPsec packets. | An-Cheng Huang | |
| 2008-05-13 | add "inspect" action (maps to QUEUE) so "custom" traffic-filter for IPS | An-Cheng Huang | |
| can be defined in "firewall". | |||
| 2008-05-09 | add mangle table support to firewall configuration. initial implementation | An-Cheng Huang | |
| allows MARK and DSCP jump targets. | |||
| 2008-04-21 | Merge branch 'glendale' into hollywood | rbalocca | |
| 2008-04-16 | fix for bug 3167: disallow multiport specification if both source and | An-Cheng Huang | |
| destination ports are defined. | |||
| 2008-04-16 | fix for bug 3167: get the actual return status from iptables. | An-Cheng Huang | |
| 2008-04-08 | add post-firewall hook for other features | An-Cheng Huang | |
| 2008-04-08 | fix for bug 3127: look for an exact match to replace/delete. | An-Cheng Huang | |
| 2008-04-08 | fix for bug 3127: look for an exact match to replace/delete. | An-Cheng Huang | |
| 2008-03-10 | update from VPL1 to GPLv2 | Stephen Hemminger | |
| 2008-03-10 | Change to GPLv2 | Stephen Hemminger | |
| VPL 1.0 is replaced with GPL in Glendale. | |||
| 2008-02-29 | fix a problem in the interaction between "firewall" and "interfaces". | An-Cheng Huang | |
| 2008-02-11 | move common module to vyatta-cfg | An-Cheng Huang | |
| 2008-02-08 | add address validation | An-Cheng Huang | |
| 2008-02-08 | merge address range into address | An-Cheng Huang | |
| 2008-02-08 | merge ports in show output | An-Cheng Huang | |
 |
index : vyatta-cfg-firewall.git | |
| Configuration templates and scripts for the firewall subsystem. (mirror of https://github.com/vyos/vyatta-cfg-firewall.git) |
| summaryrefslogtreecommitdiff |