# Firewall Builder Release Notes

## Version 1.0.10

Released 05/21/2003
GUI and compilers v1.0.10 require API library libfwbuilder version 1.0.0

## Summary

For those who wish to build from source, instructions are outlined in the document "Install and Build instructions" on our web site here

## What's new

- Improvements in the GUI:
  - GUI and compilers compile and work on Solaris (again).
  - implemented caching of all icons and images supported through the class SimplePixmaps (icons in the policy and group views and icons on buttons). This helped to significantly speed-up the GUI, it is especially noticeable in time it takes to load a long policy.
  - If user called "Save As" operation, but the file with suggested name already exists, the GUI asks user if they want to overwrite existing file
  - A GUI crash has been found and eliminated: if an IP address or network object has somehow been created with illegal IP address or netmask, it could not have been used in the policy. The GUI just crashed as soon as user dropped such object in the rule element.
  - The check of the correctness of the IP address on every keystroke has been disabled in a widget that manages IP address or netmask field. All dialogs that use this widget should check it before storing the data. It was annoying when program popped an error dialog on every typo.

- Improvements in policy compiler for iptables:
  - Feature Req. 551137: Improvement for dynamic ext. interfaces. Compiler generates shell code that determines addresses of all dynamic interfaces and assigns them to variables, which can then be used in rules. This lets us correctly implement anti-spoofing rules for dynamic interfaces, among other things. If the script can not determine the address of a dynamic interface, it won't install the policy.
  - implemented a better way to configure blocks of virtual addresses for firewall's interfaces (works with busybox shell that does not support fancy regular expression operators)
  - DNAT rules are no longer assigned to interfaces. This simplifies many configurations where packets headed for the address used for DNAT enter the firewall through "wrong" interface (e.g. users on internal LAN access web server using its DNAT address; in this case packets with destination address belonging to the external interface enter firewall through internal interface. If translation works right, these packets will go back through the same interface and never cross external one. Should DNAT rule have "-i..." clause, it would never work.)
  - SNAT rules are now assigned to interfaces (using "-o iface_name") as follows:

    - if firewall's interface or its address is in TSrc, the rule the uses its address for "--to-source" and its name for "-o"
    - if firewall object is in TSrc, then it gets replaced with its interfaces except for unnumbered and loopback interfaces and rule is processed using each interface as described above
    - if some other object is in TSrc, the rule is assigned to all interfaces of the firewall except for unnumbered and loopback inetrfaces using "-o" argument and address of the object in TSrc is used for "--to-source". Compiler combines interfaces with similar names using "+" notation to reduce overall number of rules. There are reasons why rule has to be explicitly assigned to all interfaces using "-o" as opposed to skipping "-o" all together. Consider for example a configuration with an unnumbred tunnel interface (e.g. ipsec0) used for "road varrior" connections where IP address on the other end of the tunnel is unknown. We can not add a "no nat" rule because we do not know address of the net on the other side of the tunnel, but fortunately ipsec0 is skipped in the assignment of SNAT rule because it is unnumbered, so the firewall won't translate packets going through this interface.

  - Implemented feature Req. #700994: "DNAT rule with chain OUTPUT". A new option "local NAT" have been added on the "Firewall" tab of the firewall dialog. This option, when enabled, causes policy compiler to generate NAT rules in OUTPUT chain for DNAT rules where firewall is in OSrc. Rules where OSrc is 'any' are split and also generate code in the OUTPUT chain if both options "assume firewall is part of any" and "local NAT" are enabled.

    Note: With iptables 1.2.7a and later, DNAT rules using OUTPUT chain are supported only if the kernel has been compiled with option CONFIG_IP_NF_NAT_LOCAL

  - Compiler generates shell code that can properly add virtual addresses for point-to-point interfaces
  - generated policy script does not turn ip forwarding off before installing firewall policy. It used to turn it off, but it seems to be an overkill since we set default policy to DROP on all chains anyway. Firewalls with really long policies that take a long time to install cause all sorts of problems (like dropped ssh sessions and tripped monitoring) because of disabled forwarding. Now administrator can add rules for ssh sessions and monitoring systems on the top of the policy so that even if policy takes a long time to install, those rules will be activated first.
  - Feature Req. #684604: TIME restrictions in interface policies. Firewall Builder now supports time restrictions in the Interface Policy rules for platforms that can match time intervals.
  - added optimizer that removes duplicate iptables rules
  - Global policy rules that have firewall object in both source and destination now use all interfaces of the firewall, including loopback. Previously address "127.0.0.1" was used only if the rule was associated with loopback interface.
  - Feature Req. #669022: "Support for multiple negated targets in NAT table". Port translation rules that change only port and do not change destination address now allow multiple objects in Original Destination (with or without negation).
  - Port translation rules with TDst 'any' now generate iptables command with " ... -j DNAT --to-destination :80" (no address in front of the ':' ). Similar rules with firewall object in ODst and TDst 'any' are treated as redirection rules and generate iptables command using target REDIRECT.
- Improvements in policy compiler for ipfiler:

  - 'map' rules are now assigned to interfaces using the same algorithm as in compiler for iptables:

    - if firewall's interface or its address is in TSrc, the rule the uses its address to the right of -> and its name for map ifname construct.
    - if firewall object is in TSrc, then it gets replaced with its interfaces except for unnumbered and loopback interfaces and rule is processed using each interface as described above
    - if some other object is in TSrc, the rule is assigned to all interfaces of the firewall except for unnumbered and loopback inetrfaces using map ifname and address of the object in TSrc is used to the right of ->.

- Improvements in policy compiler for pf:

  - Feature Req. #680055: implemented custom log prefix in PF using 'label' keyword. NOTE: According to the PF author, custom logging labels will be implemented after OpenBSD 3.3 is out. So, tentatively, this should be expected in 3.4.
  - 'rdr' rules in PF are not associated with particular interface anymore. This allows for configurations where translation is supposed to happen on igress interface (e.g. NAT is done on enc0 interface for IPSEC tunnel)
  - 'nat' rules are now assigned to interfaces using the same algorithm as in compiler for iptables. Rules

    - if firewall's interface or its address is in TSrc, the rule the uses its address to the right of -> and its name for nat on
    - if firewall object is in TSrc, then it gets replaced with its interfaces except for unnumbered and loopback interfaces and rule is processed using each interface as described above
    - if some other object is in TSrc, the rule is assigned to all interfaces of the firewall except for unnumbered and loopback inetrfaces using nat on argument and address of the object in TSrc is used to the right of ->. Compiler combines interfaces with similar names using {ifname1,ifname2,ifname2} notation to reduce overall number of rules.

- Improvements in policy compilers for all platforms:

  - implemented action 'Accounting'. This provides for rules that only count packets they match but do not make any decision whether the packet should be passed or blocked. This action can be used for logging-only rules as well. In iptables, Accounting is implemented via user-defined chain with target RETURN. In pf it is implemented using action 'pass' without option 'quick'. In ipf and ipfw it uses action 'count' This implements Feature Req. #597259: "'NILL' action rule at top of mainchains" and #672272: "Log-only Rules"
  - Number of code optimizations have been made in API and all policy compilers. This helped to reduce compile time, sometimes significantly.
  - Compilers for iptables and PF: added support for NAT rules that can translate both source and destination. This allows for nice single rule for the classic "DNAT back to the same LAN" rule. This rule looks like this: OSrc is internal net, ODst is a translated address for the server, TSrc is firewall's internal interface and TDst is a real server's object. This generates two NAT rules: one DNAT rule to translate destination and another SNAT rule to translate source. This is more logical than previously recommended combination of two rules because our model assumes that the first rule that matches the packet works and further rules are not consulted. The recommended two rule combination silently broke this assumption which was counter-intuitive and caused confusion.

- New components:

  - This version includes experimental policy compiler that supports ipfw and Mac OS X. The new ipfw (ipfw2) is not supported yet, this is only for the old one. Ipfw2 is supposed to be backwards compatible though. NAT is not supported at all at this time ( will add support for natd in the future).
  - added service objects pop3s, nntps, netbios-ssn (TCP), ftp_data_passive, WINS replication, LDAP GC and LDAP GC SSL.
  - additional objects added to the objects database per Microsoft Knowledge Base article #179442. Groups "WinNT" and "Win2000" have been created in accrodance with this article.
  - install script fwb_install now uses ssh-agent to interact with the user. User's key should be protected with a good passphrase, the script uses agent to ask for passphrase and then unlock the key.

## Bugs fixed in GUI:

- bug #686156: "Insert Firewall Object" Druid not translated. Added missing files to the list in POTFILES.in
- bug #686154: Print Dialog not translated. Added missing files to the list in POTFILES.in
- bug #686962: can not create network 0.0.0.0/8
- bug in NewHostDruid and NewFirewallDruid - both druids run in a non-modal windows and should not insert newly created object into the tree until all its parameters have been entered in the Druid.
- bug #691698: child object deletion. Bug caused the GUI to crash if interface of the firewall or one of its addresses was used in the policy rule of another firewall, and the first firewall was deleted.
- bug #702661: "NETBIOS ports wrong"

## Bugs fixed in policy compiler fwb_ipt:

- bug #685165: "using dynamic interface in global policy". Address of dynamic interface is now determined at the policy activation time and then used in rules.
- bug #685611: add_addr statements even if switched off in fw config. Policy compiler should generate commands to configure firewall's interfaces only if option "Configure interfaces" is on.
- bug #687589: problems on floppyfw. Generated script should not use 'which' and shell arithmetics operations. Now script does not check if specified paths and names for command line utilities it uses are correct. This is to avoid having to use 'which'. Script will abort anyway if these path/name specifications are incorrect. Arithmetics operator $(( )) has been replaced with a call to 'expr' which is more portable since it is available in systems built around busybox (floppyfw, Devil Linux etc.)
- bug #685947 "Rules with firewall object allow too much"
- bug #685624 "Interface rules with strange result".
- bug #691522: rule 'any any any accept both' on loopback. Compiler can detect a special case where rule with 'any' in both src and dst is used on a loopback interface and option 'assume firewall is part of any' is OFF. Generated code should go into INPUT and OUTPUT chains. This also implements Feature Req. #688799: Allow all traffic on loopback interface.
- bug #698687: creating ips for the all interfaces should also bring them up. The requestor wanted generated firewall script to not only configure all interfaces defined in the object in the GUI, but also bring them up (ifconfig eth0 up). Why not.
- bug #698705: bad mac-address in nat rules. Two problems here: 1) GUI did not allow to change option "Use MAC address filtering" in the Host object dialog, and 2) compiler should generate code checking MAC address only if this option is ON. Also matching MAC addresses is allowed in NAT rules only in PREROUTING chain.
- bug #698711: "DNAT to range of ips". Compiler should generate code for DNAT rule with multiple destination addresses if AddressRange object or multiple Host objects are used in TDst. Address range defined this way must be contiguous.
- bug #715601: SNAT to specific host uses wrong interface. SNAT rules are now assigned to all interfaces (using "+" notation); this should take care of configurations where address that belongs to subnet of one interface of the firewall is used for translation for packets that exit firewall through another interface.
- fixed a bug (no number) where iptables 1.2.7a did not like "-m time" with its parameters if it appeared after "-j ULOG". Target "-j ULOG" with its parameters should be the last in the command.
- fixed bug #727229: "0/0 address in to-destination". Port translation rules with TDst 'any' should generate iptables command with " ... -j DNAT --to-destination :80" (no address in front of the ':' )
- fixed bug #727324: policy rules generated wrong code if service contained a single object with negation.

## Bugs fixed in policy compiler fwb_ipf:

- bug #694189: incomplete ipnat map rules. Ipfilter needs "portmap tcp/udp auto" statement to dynamically relocate TCP/UDP ports of connections translated by 'map' rules.
- bug #697504: Wrong interface is chosen for ipnat compiled rule.
- bug #698396: wrong values in "skip" rules (The lines-to-skip counters were wrong because they have to be calculated independently for "in" and "out" rules.)
- bug #697388: netmask is not passed to ifconfig command in add_addr()
- bug #697235: "or-block" is used in the "block" rules
- bug #700092: "Wrong interface is chosen for ipnat compiled rule (again)". Compiler for ipfilter should use OSrc to assign NAT rules that generate 'rdr' command to appropriate interface. If OSrc is 'any' or does not correspond to any interface, compiler should assign the rule to all interfaces.
- bug #725853: "Flag for no SYN by default for tcp". Implemented support for option "Accept TCP sessions opened prior to firewall restart" in ipfilter. This can be used in redundand firewall pairs where backup firewall takes over when the primary one goes down and should not drop sessions opened before failover happens.
- bug #732176: "FwBuilder 1.0.9 and ip_fragments". Keyword "fragment" used in OpenBSD pf to match on ip fragments can not be used with ipfilter.

## Bugs fixed in policy compiler fwb_pf:

- bug #692043: problem with redirection NAT rules in PF. This is rather obscure case of dependency between policy and redirection NAT rules. See ChangeLog for more details.

## Bugs fixed in other components:

- fixed bug #713582: Cannot build libfwbuilder from rpm src file on RH 8.0. Libfwbuilder should detect presence of net-snmp before it checks for ucd-snmp because RH8.0 comes with both libnetsnmp and libsnmp.
- bug #686434: fwblookup is broken in 1.0.9 and #686486: error parsing /usr/share/fwbuilder
- fixed bug #720250. Generated script defines varialbe LOGGER containing a path and name for the "logger" tool. Script should use this variable to call logger. This has been fixed in policy compilers for all platforms.