# Firewall Builder Release Notes

## Version 1.0.5

GUI and compilers v1.0.5 require API library libfwbuilder version 0.10.9

## Summary

This release delivers long-awaited support for virtual addresses on interfaces and other improvements, as well as fixes bugs discovered during the testing of the previous version.

For those who wish to build from source, instructions are outlined in the document "Requirements" on our web site here

## What's new

- Support for virtual addresses (see below).
- Added French and German translations in policy compilers.
- The GUI shows warning dialog if user tries to load data file with firewall objects configured for platform, support for wich has not been installed. GUI also shows a warning if it is being started on a system where no modules supporting target firewall platforms were installed.
- On FreeBSD and OpenBSD fwbuilder uses lwres library for thread-safe DNS calls. This library comes as a part of bind 9.1.3 port (and newer). One needs to start daemon lwresd in order for library functions to work; fwbuilder GUI issues warning if the daemon is not running. Unfortunately objects discovery via DNS zone transfers does not work on FreeBSD and OpenBSD because of lack of a library providing functions for zone transfers.
- Firewall scripts generated by compilers calls command line tools (iptables, logger, ip etc.) using their explicit full directory path and a file name. GUI provides controls so that user can change path if tools are located in a non-standard place.
- GUI automatically sorts branches in the tree when objects are renamed or new ones are inserted.
- new additions to a collection of standard objects coming with the program.
- Using glademm 1.1.1b

## Notes on virtual interfaces

Data files created in previous versions of Firewall Builder are automatically converted when loaded in fwbuilder GUI. All host and firewall objects get address objects added to their interfaces. Newly created address objects are named after their parent host or firewall objects; this seems to be a reasonable default since it makes it easier to distinguish address objects when they are used in firewall policy rules. On the other hand, you may need to rename address objects that belong to firewall interfaces since they all are going to have the same name (that of the firewall).

It may take some getting used to the new tree structure, especially if address objects have the same name as their host or firewall parent objects. I am going to add icons in the tree in the future versions.

- interfaces appear in the tree as regular objects. New interface can be created either using main menu "Insert" or popup menu that appear when user clicks right mouse button on the host or firewall object in the tree.
- addresses appear in the tree as child objects of interfaces. New address can be created either using main menu "Insert" or popup menu in the tree.
- Popup menu in the tree is context-sensitive and presents items that create interfaces only if it is called on host or firewall object. Likewise, it presents an item that creates an address object only if it is called on interface object.
- Main menu items "Insert/Host" and "Insert/Firewall" call a simple two-page Druid which facilitates adding interfaces for the object being created.
- One interface of the Firewall can be marked as "management interface". Management interface is used for all communications between GUI and the firewall machine.
- Interfaces are shown using their labels in the tree. If label is blank, then its name is used.

## What's new in policy compiler for iptables

- optimized processing of negation in Src, Dst and Srv for the case where rule element holds single object (using '!')
- implemented Feature req. #514507: ability to change logging level in rule options
- implemented support for ULOG target. Feature req. #591486
- implemented "log all" global logging option per Feature req. #481670
- better code for "ip addr add" and "ip addr flush" commands, suggested by Jeremy Bouse

## What's new in all policy compilers

Firewall script generated by policy compiler calls command-line tools such as 'ip', 'iptables', 'logger', 'pfctl', 'ipf', 'ipnat' etc using their full directory path and a file name. The program can generate correct default paths for these programs on Debian, Mandrake, RedHat, SuSE, FreeBSD, OpenBSD, Solaris; GUI provides controls so that user can make changes if these tools are located in non-standard places.

## Bugs fixed in libfwbuilder API:

- bug #594656: outbound rule shades inbound rule
- bug #554286: crawler discovered multicast addresses and created objects

## Bugs fixed in GUI:

- bug #589767: added missing text to *.po files
- bug #589763: made tree autoresizeable in Options dialog.
- bug #589768 : proper handling of plurals in translated text
- bug #589769: missing translations for column titles in Policy and NAT widgets
- bug #590029: When duplicating a firewall the new fw has no platform ("Unknown/Unknown") even if the original firewall had one.
- bug #593234: running in German locale causes "help me build policy" Druid to produce incorrect rules (XML attribute "direction" translated)
- bug #592396: GUI behaved erratically if menu item "add rule after current" was used on the empty policy
- bug #597285 (GUI crash opening tab "Interfaces" in firewall dialog)

## Bugs fixed in iptables policy compiler fwb_ipt:

- bug #590691: logger assumed to be in /usr/bin
- bug #590690: incorrect processing of action_on_reject "TCP RST" in combination with logging.
- bug #596255: log-prefix missing in rules with 'limit' option
- bug #594093: wrong TZ name in the generated script
- bug #596349: wrong netmask in virtual addresses added by compiler
- bug #596430: compiler ignored more than one custom object used in the ServiceGroup or together in one rule element
- bugs #596983 and #603470: multiport requires options --source-ports and --destination-ports (and does not recognize "--destination-port" and "--source-port" anymore) starting from iptables v1.2.6 and newer
- bug #597418: problems with iptables commands generated for MAC filtering
- bug #597296: added netmask and broadcast specification to "ip addr add" command generated by fwb_ipt
- bug #597418: (compiler placed code into chain OUTPUT if MAC address match was requested for a Host with dynamic interface)
- bug #599454: module 'time' requires specification of all three parameters: --timestart, --timestop and --days
- bug# 599650: missing protocol option ("-p") in SNAT/DNAT/REDIRECT rules with translated port specification

## Bugs fixed in ipfilter policy compiler fwb_ipf:

- bug #601069: fwb_ipf can't compile DNAT rule with ODst any; also implemented support for "from"/"to" in rdr rules