Firewall Builder Release Notes
Version 1.0.8
GUI and compilers v1.0.8 require API library libfwbuilder version 0.10.12
Summary
This is bug fix release.
For those who wish to build from source, instructions are outlined
in the document "Install and Build instructions" on our web site here
What's new
- Improvements in the GUI:
-
The title bar in the policy and NAT view stays in place while
rules are being scrolled up or down.
-
The GUI can show object icons in the tree (this feature can be
turned on and off in the main Options dialog, under "GUI/Tree View")
-
Few more rules have been added to the "Help me build
policy druid":
- SSH access to the firewall
- DNS queries made by the firewall
- DNS access from internal LAN to the firewall
- DHCP access from internal LAN to the firewall
-
Feature request #611604 has been implemented: Added main
menu item "Open Recent" which shows a submenu with 4
recently opened file names.
- Improvements in policy compiler for iptables:
-
Support for TCP flag masks implemented in the API and the
GUI. We can now generate rules that inspect only certain
subset of TCP flags (e.g. can inspect all flags and match
if none set). This is supported in iptables, ipf and pf.
-
Feature request #579374 has been implemented: Compiler can
now add blocks of virtual addresses to provide support for
one-to-one translations that map the whole networks (rules
with target NETMAP).
- Improvements in policy compiler for ipfiler:
-
Feature request #633534: Ipf Proxies. Support for h323 and
ipsec proxies has been added in ipfilter 'map' NAT
rules. Compiler generates code for proxies only when OSrv
object used in the rule matches port number and protocol
of the respective proxy.
-
Feature request #557042: ipf isims. Ipfilter rules are now
installed in "inactive" filter and filters are immediately
swapped with "ipf -s". Firewall admin can quickly revert
to that "last known good" policy by doing "ipf -s".
-
Feature request #604840: support for round-robin rules has
been added. Rules with multiple objects (or a group) in
"Translated destination" generate code for simple
round-robin based load balancing using keyword
"round-robin".
-
added support for NONAT rules in ipfilter per information
from ipfilter mailing list as reported by
lupe@lupe-christoph.de (Lupe Christoph): using "0/0" on
the right side of the "map" rule makes it do no
translation. I could not verify this actually works that
way, but ipnat accepts this syntax.
-
feature request #653803: flags for TCP keep state has been
implemented. See http://false.net/ipfilter/2002_12/0176.html
- Improvements in policy compilers for all platforms:
-
New sanity check for policy rules implemented in API and
all policy compilers: now compilers can find and eliminate
groups that have no elements. Before, compilers treated
these groups as 'any' which had obvious security risk. In
the current implementation compiler treats empty group as
a fatal error and aborts processing. Activating checkbox
"Ignore empty groups" (available in the "Firewall" tab for
all platforms) changes this behaviour and makes compiler
remove empty groups from rule elements, but if rule
element becomes empty after the last empty group has been
removed, then the whole rule is ignored. The default state
for this checkbox is off, that is empty gorups are treated
as an error. Sometimes firewall administrator may want to
use a group to control access to or from a bunch of
computers because it is easy to quickly add or remove them
in a group (and therefore in certain rules where this
group is used). It may be desired to ignore the whole rule
that uses this group if all computers have been removed
from the group.
-
New components:
-
General object lookup tool 'fwblookup' has been added to
the distribution. This tool can be used in scripts that
need to find and inspect objects in the database, for
example firewall policy install sctipt could use this tool
to find the firewall and identify its management address.
-
Install script fwb_install is now part of the package and
is installed in /usr/local/bin/ or /usr/bin
(depends on the parameter --prefix given to
autogen.sh). This script has been fixed and now uses
object lookup tool fwblookup, so it does not directly
depend on XML DTD anymore (since it works though
API). This script has been contributed by David Gullasch
and its original version was distributed via "Contrib"
area of our SourceForge site. See inside the script for
David's contact info.
-
GUI now includes all dialogs for all platforms, including
Cisco PIX. Packages fwbuilder-ipt, fwbuilder-pf,
fwbuilder-ipf and fwbuilder-pix contain only policy
compilers for respective platforms.
Bugs fixed in libfwbuilder API:
-
bug #635849: old and annoying problem where GUI detected
non-existent change in the data tree once the user opened
firewall object or any of the policy objects (InterfacePolicy,
Policy or NAT). It then asked if the user wants to save the
data before exiting the GUI.
-
bug #637694: bridge enabled / management. Background: if
firewall object is used in destination of the rule of the
bridging firewall, chain needs to be still INPUT.
-
bug #642161: problem with NAT rules that translate port
numbers but do not change addresses.
Bugs fixed in GUI:
-
bug #635844: GUI crash while dragging a rule near the bottom
of the ruleset when ruleset is large and the widget has been
scrolled to show the last rule.
-
bug #636279: Save As behavior seems wrong (main window did not
update title when user saved data in a different file using
Save As main menu item)
-
bug #637858: Bad Behavior on Firewall Interface object (the
GUI sometimes did not properly update object's label in the
tree)
-
bug #635849: old and annoying problem where GUI detected
non-existent change in the data tree once the user opened
firewall object or any of the policy objects (InterfacePolicy,
Policy or NAT). It then asked if the user wants to save the
data before exiting the GUI.
-
bug #640481: Typo in Help Me Build wizard
-
bug #642873: no way to block null scans (added support for TCP
flag masks to libfwbuilder::TCPService and to the GUI).
-
bug #641217: print HTML buglet (while printing rules with
multi-line comments, '\n' in comments should be replaced with
tag
)
Bugs fixed in iptables policy compiler fwb_ipt:
-
bug #637488: compiler chose wrong chain for rules where
interface with multiple addresses was used in Src or Dst
-
bug #634275: iptables modules loaded with -k
-
bug #633211: rule shading when firewall is not part of 'any' -
when option "firewall is part of any" is OFF, object "Any"
does not shade firewall
-
bug #637694 - bridge enbaled / management. Compiler can now
put rules with broadcast/multicast into FORWARD chain, but
still recognizes rules controlling access to the firewall
itself and puts those in INPUT chain.
-
bug #636497: MAC address compile mistake. (Problem happened in
rules with MAC address filtering and no destination, or fw
object in destination).
-
bug #634825: problem with dynamic external interface in MASQ
NAT rule
-
bug #642161: problem with NAT rules that translate port
numbers but do not change addresses.
-
bug #644138: 1.0.7 NAT mis-compiles rules (problem with rules
that do only port translation, this bug is similar to #642161,
but there is a difference: rule mentioned in this bug should
generate iptables command with target REDIRECT)
-
bug #636497: MAC address compile mistake (there was space
missing between --mac-source and --source-port in rules that
used TCP/UDP service with non-empty source port definition)
-
bug #644684: REDIRECT instead of DNAT (now we consider rule
REDIRECt only if TDst is firewall, in all other cases we
generate DNAT rule.)
-
bug #645553: NAT rules assigned to wrong interface (when
firewall's external and dmz interfaces are on overlapping
subnets and NAT rule uses negation)
-
bug (no number) : option "Accept TCP sessions opened prior to
firewall restart" should not depend on "assume firewall is
part of any". Even if the former option is OFF, with this fix
compiler generates code to block TCP packets in state NEW and
no SYN flag headed both for firewall and machines behind it.