                         Firewall Builder Release Notes

Version 1.0.3

   GUI v1.0.3 requires API library libfwbuilder version 0.10.7

Summary

   The main goal of this release is to incorporate fixes for bugs discovered
   in the new policy compiler for iptables (fwb_ipt). Firewall Builder GUI
   now comes preconfigured to call fwb_ipt instead of the old compiler
   fwb_iptables. If you have a reason to keep using the old compiler, you can
   do so. You need to install package fwbuilder-iptables and then type
   "fwb_iptables" in the entry field "Compiler (if different from default)"
   in the tab "Compile/Install" in the firewall object dialog. It is
   important to note though that per project road map I will stop maintaining
   compatibility with the old compiler in the next version (v1.0.4). Project
   roadmap can be found here: http://www.fwbuilder.org/pages/documents.html

What is new in the API library

   API library is in freeze until next release.

What is new in the GUI

     * Function that imports list of interfaces using SNMP query for host or
       firewall has been corrected and now creates objects only for
       interfaces that are "up".
     * GUI now supports multi-window mode. It is now possible to open
       different objects from the same database in different windows. This
       simplifies task of managing large firewall policy since one does not
       have to close the policy to edit objects. Drag-and-drop works across
       different windows.
     * Old feature of the GUI where the main window could be split onto two
       windows, one with the tree and another with object dialog, has been
       deprecated in favor of multi-window mode.
     * Minor enhancement: gui shows icon of a floppy on the status bar as an
       indicator when data has been modified and requires saving. Current
       objects database file name is shown on the title bar of the main
       window.
     * Several memory leaks found and fixed.

What is new in iptables compiler fwb_ipt

     * Support for time intervals

     ----------------------------------------------------------------------

Bugs fixed in GUI:

     * bug #557899: GUI crashed on "Cut" operation on policy and NAT rules
     * bug #562171: ICMP service dialog now provides widgets for setting ICMP
       type and code both numerically and from the list of predefined values.
       Any numeric value in the range 0-255 can be used for both type and
       code.
     * bugs #559958 and #553299: Memory leak displaying large policies

Bugs fixed in iptables policy compiler fwb_ipt:

     * bug #556783: source and destination port ranges in "original" part of
       NAT rules should use ':' as a separator
     * bug #556438: multiport does not accept source and destination ports
       simultaneously
     * bug #557015: compiler crashed if it could not find firewall object
     * bug #562173: compiler should be able to create DNAT rule even if all
       external interfaces of the firewall have dynamic address.
     * bug #551323: (iptables modules names have changed in v1.2.6 and later)
       Added support for predefined firewall platform version numbers in
       firewall dialog. Policy compiler can now distinguish between pre-1.2.6
       and 1.2.6 and use different file names when it generates code to load
       modules
     * bug #564037: compiler should place rules with destination address
       255.255.255.255 into INPUT chain
     * bug #564633: compiler should set (x) permission on the firewall policy
       script
     * bug #566172: original dest. in DNAT rules can be any

Bugs fixed in ipfilter policy compiler (fwb_ipf):

     * bug #557033 ipf supports 'keep state' only for icmp/udp/tcp protocols
     * bug #564633: compiler did not set (x) permission on the firewall
       policy script

Bugs fixed in ipfilter policy compiler (fwb_pf):

     * bug #564633: compiler did not set (x) permission on the firewall
       policy script
     * bug #569942: Syntax error while loading rules using icmp service on
       OpenBSD
