# Firewall Builder Release Notes

## Version 1.0.3

GUI v1.0.3 requires API library libfwbuilder version 0.10.7

## Summary

The main goal of this release is to incorporate fixes for bugs discovered in the new policy compiler for iptables (fwb_ipt). Firewall Builder GUI now comes preconfigured to call fwb_ipt instead of the old compiler fwb_iptables. If you have a reason to keep using the old compiler, you can do so. You need to install package fwbuilder-iptables and then type "fwb_iptables" in the entry field "Compiler (if different from default)" in the tab "Compile/Install" in the firewall object dialog. It is important to note though that per project road map I will stop maintaining compatibility with the old compiler in the next version (v1.0.4). Project roadmap can be found here: http://www.fwbuilder.org/pages/documents.html

## What is new in the API library

API library is in freeze until next release.

## What is new in the GUI

- Function that imports list of interfaces using SNMP query for host or firewall has been corrected and now creates objects only for interfaces that are "up".
- GUI now supports multi-window mode. It is now possible to open different objects from the same database in different windows. This simplifies task of managing large firewall policy since one does not have to close the policy to edit objects. Drag-and-drop works across different windows.
- Old feature of the GUI where the main window could be split onto two windows, one with the tree and another with object dialog, has been deprecated in favor of multi-window mode.
- Minor enhancement: gui shows icon of a floppy on the status bar as an indicator when data has been modified and requires saving. Current objects database file name is shown on the title bar of the main window.
- Several memory leaks found and fixed.

## What is new in iptables compiler fwb_ipt

- Support for time intervals

## Bugs fixed in GUI:

- bug #557899: GUI crashed on "Cut" operation on policy and NAT rules
- bug #562171: ICMP service dialog now provides widgets for setting ICMP type and code both numerically and from the list of predefined values. Any numeric value in the range 0-255 can be used for both type and code.
- bugs #559958 and #553299: Memory leak displaying large policies

## Bugs fixed in iptables policy compiler fwb_ipt:

- bug #556783: source and destination port ranges in "original" part of NAT rules should use ':' as a separator
- bug #556438: multiport does not accept source and destination ports simultaneously
- bug #557015: compiler crashed if it could not find firewall object
- bug #562173: compiler should be able to create DNAT rule even if all external interfaces of the firewall have dynamic address.
- bug #551323: (iptables modules names have changed in v1.2.6 and later) Added support for predefined firewall platform version numbers in firewall dialog. Policy compiler can now distinguish between pre-1.2.6 and 1.2.6 and use different file names when it generates code to load modules
- bug #564037: compiler should place rules with destination address 255.255.255.255 into INPUT chain
- bug #564633: compiler should set (x) permission on the firewall policy script
- bug #566172: original dest. in DNAT rules can be any

## Bugs fixed in ipfilter policy compiler (fwb_ipf):

- bug #557033 ipf supports 'keep state' only for icmp/udp/tcp protocols
- bug #564633: compiler did not set (x) permission on the firewall policy script

## Bugs fixed in ipfilter policy compiler (fwb_pf):

- bug #564633: compiler did not set (x) permission on the firewall policy script
- bug #569942: Syntax error while loading rules using icmp service on OpenBSD