Rework LuCI build system

 * Rename subdirectories to their repective OpenWrt package names
 * Make each LuCI module its own standalone package
 * Deploy a shared luci.mk which is used by each module Makefile

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

12 files changed, 1877 insertions, 0 deletions

diff --git a/applications/luci-app-firewall/luasrc/controller/firewall.lua b/applications/luci-app-firewall/luasrc/controller/firewall.lua
new file mode 100644
index 000000000..5a6ab0ad3
--- /dev/null
+++ b/applications/luci-app-firewall/luasrc/controller/firewall.lua
@@ -0,0 +1,23 @@
+module("luci.controller.firewall", package.seeall)
+
+function index()
+	entry({"admin", "network", "firewall"},
+		alias("admin", "network", "firewall", "zones"),
+		_("Firewall"), 60)
+
+	entry({"admin", "network", "firewall", "zones"},
+		arcombine(cbi("firewall/zones"), cbi("firewall/zone-details")),
+		_("General Settings"), 10).leaf = true
+
+	entry({"admin", "network", "firewall", "forwards"},
+		arcombine(cbi("firewall/forwards"), cbi("firewall/forward-details")),
+		_("Port Forwards"), 20).leaf = true
+
+	entry({"admin", "network", "firewall", "rules"},
+		arcombine(cbi("firewall/rules"), cbi("firewall/rule-details")),
+		_("Traffic Rules"), 30).leaf = true
+
+	entry({"admin", "network", "firewall", "custom"},
+		cbi("firewall/custom"),
+		_("Custom Rules"), 40).leaf = true
+end
diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/custom.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/custom.lua
new file mode 100644
index 000000000..9b53a8a62
--- /dev/null
+++ b/applications/luci-app-firewall/luasrc/model/cbi/firewall/custom.lua
@@ -0,0 +1,38 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2011 Jo-Philipp Wich <xm@subsignal.org>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+$Id$
+]]--
+
+local fs = require "nixio.fs"
+
+local f = SimpleForm("firewall",
+	translate("Firewall - Custom Rules"),
+	translate("Custom rules allow you to execute arbritary iptables commands \
+		which are not otherwise covered by the firewall framework. \
+		The commands are executed after each firewall restart, right after \
+		the default ruleset has been loaded."))
+
+local o = f:field(Value, "_custom")
+
+o.template = "cbi/tvalue"
+o.rows = 20
+
+function o.cfgvalue(self, section)
+	return fs.readfile("/etc/firewall.user")
+end
+
+function o.write(self, section, value)
+	value = value:gsub("\r\n?", "\n")
+	fs.writefile("/etc/firewall.user", value)
+end
+
+return f
diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/forward-details.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/forward-details.lua
new file mode 100644
index 000000000..c80a6d0e7
--- /dev/null
+++ b/applications/luci-app-firewall/luasrc/model/cbi/firewall/forward-details.lua
@@ -0,0 +1,161 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2011 Jo-Philipp Wich <xm@subsignal.org>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+$Id$
+]]--
+
+local sys = require "luci.sys"
+local dsp = require "luci.dispatcher"
+local ft  = require "luci.tools.firewall"
+
+local m, s, o
+
+arg[1] = arg[1] or ""
+
+m = Map("firewall",
+	translate("Firewall - Port Forwards"),
+	translate("This page allows you to change advanced properties of the port \
+	           forwarding entry. In most cases there is no need to modify \
+			   those settings."))
+
+m.redirect = dsp.build_url("admin/network/firewall/forwards")
+
+if m.uci:get("firewall", arg[1]) ~= "redirect" then
+	luci.http.redirect(m.redirect)
+	return
+else
+	local name = m:get(arg[1], "name") or m:get(arg[1], "_name")
+	if not name or #name == 0 then
+		name = translate("(Unnamed Entry)")
+	end
+	m.title = "%s - %s" %{ translate("Firewall - Port Forwards"), name }
+end
+
+s = m:section(NamedSection, arg[1], "redirect", "")
+s.anonymous = true
+s.addremove = false
+
+ft.opt_enabled(s, Button)
+ft.opt_name(s, Value, translate("Name"))
+
+
+o = s:option(Value, "proto", translate("Protocol"))
+o:value("tcp udp", "TCP+UDP")
+o:value("tcp", "TCP")
+o:value("udp", "UDP")
+o:value("icmp", "ICMP")
+
+function o.cfgvalue(...)
+	local v = Value.cfgvalue(...)
+	if not v or v == "tcpudp" then
+		return "tcp udp"
+	end
+	return v
+end
+
+
+o = s:option(Value, "src", translate("Source zone"))
+o.nocreate = true
+o.default = "wan"
+o.template = "cbi/firewall_zonelist"
+
+
+o = s:option(DynamicList, "src_mac",
+	translate("Source MAC address"),
+	translate("Only match incoming traffic from these MACs."))
+o.rmempty = true
+o.datatype = "neg(macaddr)"
+o.placeholder = translate("any")
+
+luci.sys.net.mac_hints(function(mac, name)
+	o:value(mac, "%s (%s)" %{ mac, name })
+end)
+
+
+o = s:option(Value, "src_ip",
+	translate("Source IP address"),
+	translate("Only match incoming traffic from this IP or range."))
+o.rmempty = true
+o.datatype = "neg(ip4addr)"
+o.placeholder = translate("any")
+
+luci.sys.net.ipv4_hints(function(ip, name)
+	o:value(ip, "%s (%s)" %{ ip, name })
+end)
+
+
+o = s:option(Value, "src_port",
+	translate("Source port"),
+	translate("Only match incoming traffic originating from the given source port or port range on the client host"))
+o.rmempty = true
+o.datatype = "neg(portrange)"
+o.placeholder = translate("any")
+
+
+o = s:option(Value, "src_dip",
+	translate("External IP address"),
+	translate("Only match incoming traffic directed at the given IP address."))
+
+luci.sys.net.ipv4_hints(function(ip, name)
+	o:value(ip, "%s (%s)" %{ ip, name })
+end)
+
+
+o.rmempty = true
+o.datatype = "neg(ip4addr)"
+o.placeholder = translate("any")
+
+
+o = s:option(Value, "src_dport", translate("External port"),
+	translate("Match incoming traffic directed at the given " ..
+		"destination port or port range on this host"))
+o.datatype = "neg(portrange)"
+
+
+
+o = s:option(Value, "dest", translate("Internal zone"))
+o.nocreate = true
+o.default = "lan"
+o.template = "cbi/firewall_zonelist"
+
+
+o = s:option(Value, "dest_ip", translate("Internal IP address"),
+	translate("Redirect matched incoming traffic to the specified \
+		internal host"))
+o.datatype = "ip4addr"
+
+luci.sys.net.ipv4_hints(function(ip, name)
+	o:value(ip, "%s (%s)" %{ ip, name })
+end)
+
+
+o = s:option(Value, "dest_port",
+	translate("Internal port"),
+	translate("Redirect matched incoming traffic to the given port on \
+		the internal host"))
+o.placeholder = translate("any")
+o.datatype = "portrange"
+
+
+o = s:option(Flag, "reflection", translate("Enable NAT Loopback"))
+o.rmempty = true
+o.default = o.enabled
+o.cfgvalue = function(...)
+	return Flag.cfgvalue(...) or "1"
+end
+
+
+s:option(Value, "extra",
+	translate("Extra arguments"),
+	translate("Passes additional arguments to iptables. Use with care!"))
+
+
+return m
diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/forwards.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/forwards.lua
new file mode 100644
index 000000000..5f7a69b25
--- /dev/null
+++ b/applications/luci-app-firewall/luasrc/model/cbi/firewall/forwards.lua
@@ -0,0 +1,144 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2008 Steven Barth <steven@midlink.org>
+Copyright 2010-2012 Jo-Philipp Wich <xm@subsignal.org>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+]]--
+
+local ds = require "luci.dispatcher"
+local ft = require "luci.tools.firewall"
+
+m = Map("firewall", translate("Firewall - Port Forwards"),
+	translate("Port forwarding allows remote computers on the Internet to \
+	           connect to a specific computer or service within the \
+	           private LAN."))
+
+--
+-- Port Forwards
+--
+
+s = m:section(TypedSection, "redirect", translate("Port Forwards"))
+s.template  = "cbi/tblsection"
+s.addremove = true
+s.anonymous = true
+s.sortable  = true
+s.extedit   = ds.build_url("admin/network/firewall/forwards/%s")
+s.template_addremove = "firewall/cbi_addforward"
+
+function s.create(self, section)
+	local n = m:formvalue("_newfwd.name")
+	local p = m:formvalue("_newfwd.proto")
+	local E = m:formvalue("_newfwd.extzone")
+	local e = m:formvalue("_newfwd.extport")
+	local I = m:formvalue("_newfwd.intzone")
+	local a = m:formvalue("_newfwd.intaddr")
+	local i = m:formvalue("_newfwd.intport")
+
+	if p == "other" or (p and a) then
+		created = TypedSection.create(self, section)
+
+		self.map:set(created, "target",    "DNAT")
+		self.map:set(created, "src",       E or "wan")
+		self.map:set(created, "dest",      I or "lan")
+		self.map:set(created, "proto",     (p ~= "other") and p or "all")
+		self.map:set(created, "src_dport", e)
+		self.map:set(created, "dest_ip",   a)
+		self.map:set(created, "dest_port", i)
+		self.map:set(created, "name",      n)
+	end
+
+	if p ~= "other" then
+		created = nil
+	end
+end
+
+function s.parse(self, ...)
+	TypedSection.parse(self, ...)
+	if created then
+		m.uci:save("firewall")
+		luci.http.redirect(ds.build_url(
+			"admin/network/firewall/redirect", created
+		))
+	end
+end
+
+function s.filter(self, sid)
+	return (self.map:get(sid, "target") ~= "SNAT")
+end
+
+
+ft.opt_name(s, DummyValue, translate("Name"))
+
+
+local function forward_proto_txt(self, s)
+	return "%s-%s" %{
+		translate("IPv4"),
+		ft.fmt_proto(self.map:get(s, "proto"),
+	                 self.map:get(s, "icmp_type")) or "TCP+UDP"
+	}
+end
+
+local function forward_src_txt(self, s)
+	local z = ft.fmt_zone(self.map:get(s, "src"), translate("any zone"))
+	local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any host"))
+	local p = ft.fmt_port(self.map:get(s, "src_port"))
+	local m = ft.fmt_mac(self.map:get(s, "src_mac"))
+
+	if p and m then
+		return translatef("From %s in %s with source %s and %s", a, z, p, m)
+	elseif p or m then
+		return translatef("From %s in %s with source %s", a, z, p or m)
+	else
+		return translatef("From %s in %s", a, z)
+	end
+end
+
+local function forward_via_txt(self, s)
+	local a = ft.fmt_ip(self.map:get(s, "src_dip"), translate("any router IP"))
+	local p = ft.fmt_port(self.map:get(s, "src_dport"))
+
+	if p then
+		return translatef("Via %s at %s", a, p)
+	else
+		return translatef("Via %s", a)
+	end
+end
+
+match = s:option(DummyValue, "match", translate("Match"))
+match.rawhtml = true
+match.width   = "50%"
+function match.cfgvalue(self, s)
+	return "<small>%s<br />%s<br />%s</small>" % {
+		forward_proto_txt(self, s),
+		forward_src_txt(self, s),
+		forward_via_txt(self, s)
+	}
+end
+
+
+dest = s:option(DummyValue, "dest", translate("Forward to"))
+dest.rawhtml = true
+dest.width   = "40%"
+function dest.cfgvalue(self, s)
+	local z = ft.fmt_zone(self.map:get(s, "dest"), translate("any zone"))
+	local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host"))
+	local p = ft.fmt_port(self.map:get(s, "dest_port")) or
+		ft.fmt_port(self.map:get(s, "src_dport"))
+
+	if p then
+		return translatef("%s, %s in %s", a, p, z)
+	else
+		return translatef("%s in %s", a, z)
+	end
+end
+
+ft.opt_enabled(s, Flag, translate("Enable")).width = "1%"
+
+return m
diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/rule-details.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/rule-details.lua
new file mode 100644
index 000000000..d29879c24
--- /dev/null
+++ b/applications/luci-app-firewall/luasrc/model/cbi/firewall/rule-details.lua
@@ -0,0 +1,329 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2008 Steven Barth <steven@midlink.org>
+Copyright 2010-2012 Jo-Philipp Wich <xm@subsignal.org>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+]]--
+
+local sys = require "luci.sys"
+local utl = require "luci.util"
+local dsp = require "luci.dispatcher"
+local nxo = require "nixio"
+
+local ft = require "luci.tools.firewall"
+local nw = require "luci.model.network"
+local m, s, o, k, v
+
+arg[1] = arg[1] or ""
+
+m = Map("firewall",
+	translate("Firewall - Traffic Rules"),
+	translate("This page allows you to change advanced properties of the \
+	           traffic rule entry, such as matched source and destination \
+			   hosts."))
+
+m.redirect = dsp.build_url("admin/network/firewall/rules")
+
+nw.init(m.uci)
+
+local rule_type = m.uci:get("firewall", arg[1])
+if rule_type == "redirect" and m:get(arg[1], "target") ~= "SNAT" then
+	rule_type = nil
+end
+
+if not rule_type then
+	luci.http.redirect(m.redirect)
+	return
+
+--
+-- SNAT
+--
+elseif rule_type == "redirect" then
+
+	local name = m:get(arg[1], "name") or m:get(arg[1], "_name")
+	if not name or #name == 0 then
+		name = translate("(Unnamed SNAT)")
+	else
+		name = "SNAT %s" % name
+	end
+
+	m.title = "%s - %s" %{ translate("Firewall - Traffic Rules"), name }
+
+	local wan_zone = nil
+
+	m.uci:foreach("firewall", "zone",
+		function(s)
+			local n = s.network or s.name
+			if n then
+				local i
+				for i in utl.imatch(n) do
+					if i == "wan" then
+						wan_zone = s.name
+						return false
+					end
+				end
+			end
+		end)
+
+	s = m:section(NamedSection, arg[1], "redirect", "")
+	s.anonymous = true
+	s.addremove = false
+
+
+	ft.opt_enabled(s, Button)
+	ft.opt_name(s, Value, translate("Name"))
+
+
+	o = s:option(Value, "proto",
+		translate("Protocol"),
+		translate("You may specify multiple by selecting \"-- custom --\" and \
+		           then entering protocols separated by space."))
+
+	o:value("all", "All protocols")
+	o:value("tcp udp", "TCP+UDP")
+	o:value("tcp", "TCP")
+	o:value("udp", "UDP")
+	o:value("icmp", "ICMP")
+
+	function o.cfgvalue(...)
+		local v = Value.cfgvalue(...)
+		if not v or v == "tcpudp" then
+			return "tcp udp"
+		end
+		return v
+	end
+
+
+	o = s:option(Value, "src", translate("Source zone"))
+	o.nocreate = true
+	o.default = "wan"
+	o.template = "cbi/firewall_zonelist"
+
+
+	o = s:option(Value, "src_ip", translate("Source IP address"))
+	o.rmempty = true
+	o.datatype = "neg(ipaddr)"
+	o.placeholder = translate("any")
+
+	luci.sys.net.ipv4_hints(function(ip, name)
+		o:value(ip, "%s (%s)" %{ ip, name })
+	end)
+
+
+	o = s:option(Value, "src_port",
+		translate("Source port"),
+		translate("Match incoming traffic originating from the given source \
+			port or port range on the client host."))
+	o.rmempty = true
+	o.datatype = "neg(portrange)"
+	o.placeholder = translate("any")
+
+
+	o = s:option(Value, "dest", translate("Destination zone"))
+	o.nocreate = true
+	o.default = "lan"
+	o.template = "cbi/firewall_zonelist"
+
+
+	o = s:option(Value, "dest_ip", translate("Destination IP address"))
+	o.datatype = "neg(ip4addr)"
+
+	luci.sys.net.ipv4_hints(function(ip, name)
+		o:value(ip, "%s (%s)" %{ ip, name })
+	end)
+
+
+	o = s:option(Value, "dest_port",
+		translate("Destination port"),
+		translate("Match forwarded traffic to the given destination port or \
+			port range."))
+
+	o.rmempty = true
+	o.placeholder = translate("any")
+	o.datatype = "neg(portrange)"
+
+
+	o = s:option(Value, "src_dip",
+		translate("SNAT IP address"),
+		translate("Rewrite matched traffic to the given address."))
+	o.rmempty = false
+	o.datatype = "ip4addr"
+
+	for k, v in ipairs(nw:get_interfaces()) do
+		local a
+		for k, a in ipairs(v:ipaddrs()) do
+			o:value(a:host():string(), '%s (%s)' %{
+				a:host():string(), v:shortname()
+			})
+		end
+	end
+
+
+	o = s:option(Value, "src_dport", translate("SNAT port"),
+		translate("Rewrite matched traffic to the given source port. May be \
+			left empty to only rewrite the IP address."))
+	o.datatype = "portrange"
+	o.rmempty = true
+	o.placeholder = translate('Do not rewrite')
+
+
+	s:option(Value, "extra",
+		translate("Extra arguments"),
+		translate("Passes additional arguments to iptables. Use with care!"))
+
+
+--
+-- Rule
+--
+else
+	local name = m:get(arg[1], "name") or m:get(arg[1], "_name")
+	if not name or #name == 0 then
+		name = translate("(Unnamed Rule)")
+	end
+
+	m.title = "%s - %s" %{ translate("Firewall - Traffic Rules"), name }
+
+
+	s = m:section(NamedSection, arg[1], "rule", "")
+	s.anonymous = true
+	s.addremove = false
+
+	ft.opt_enabled(s, Button)
+	ft.opt_name(s, Value, translate("Name"))
+
+
+	o = s:option(ListValue, "family", translate("Restrict to address family"))
+	o.rmempty = true
+	o:value("", translate("IPv4 and IPv6"))
+	o:value("ipv4", translate("IPv4 only"))
+	o:value("ipv6", translate("IPv6 only"))
+
+
+	o = s:option(Value, "proto", translate("Protocol"))
+	o:value("all", translate("Any"))
+	o:value("tcp udp", "TCP+UDP")
+	o:value("tcp", "TCP")
+	o:value("udp", "UDP")
+	o:value("icmp", "ICMP")
+
+	function o.cfgvalue(...)
+		local v = Value.cfgvalue(...)
+		if not v or v == "tcpudp" then
+			return "tcp udp"
+		end
+		return v
+	end
+
+
+	o = s:option(DynamicList, "icmp_type", translate("Match ICMP type"))
+	o:value("", "any")
+	o:value("echo-reply")
+	o:value("destination-unreachable")
+	o:value("network-unreachable")
+	o:value("host-unreachable")
+	o:value("protocol-unreachable")
+	o:value("port-unreachable")
+	o:value("fragmentation-needed")
+	o:value("source-route-failed")
+	o:value("network-unknown")
+	o:value("host-unknown")
+	o:value("network-prohibited")
+	o:value("host-prohibited")
+	o:value("TOS-network-unreachable")
+	o:value("TOS-host-unreachable")
+	o:value("communication-prohibited")
+	o:value("host-precedence-violation")
+	o:value("precedence-cutoff")
+	o:value("source-quench")
+	o:value("redirect")
+	o:value("network-redirect")
+	o:value("host-redirect")
+	o:value("TOS-network-redirect")
+	o:value("TOS-host-redirect")
+	o:value("echo-request")
+	o:value("router-advertisement")
+	o:value("router-solicitation")
+	o:value("time-exceeded")
+	o:value("ttl-zero-during-transit")
+	o:value("ttl-zero-during-reassembly")
+	o:value("parameter-problem")
+	o:value("ip-header-bad")
+	o:value("required-option-missing")
+	o:value("timestamp-request")
+	o:value("timestamp-reply")
+	o:value("address-mask-request")
+	o:value("address-mask-reply")
+
+
+	o = s:option(Value, "src", translate("Source zone"))
+	o.nocreate = true
+	o.allowany = true
+	o.default = "wan"
+	o.template = "cbi/firewall_zonelist"
+
+
+	o = s:option(Value, "src_mac", translate("Source MAC address"))
+	o.datatype = "list(macaddr)"
+	o.placeholder = translate("any")
+
+	luci.sys.net.mac_hints(function(mac, name)
+		o:value(mac, "%s (%s)" %{ mac, name })
+	end)
+
+
+	o = s:option(Value, "src_ip", translate("Source address"))
+	o.datatype = "neg(ipaddr)"
+	o.placeholder = translate("any")
+
+	luci.sys.net.ipv4_hints(function(ip, name)
+		o:value(ip, "%s (%s)" %{ ip, name })
+	end)
+
+
+	o = s:option(Value, "src_port", translate("Source port"))
+	o.datatype = "list(neg(portrange))"
+	o.placeholder = translate("any")
+
+
+	o = s:option(Value, "dest", translate("Destination zone"))
+	o.nocreate = true
+	o.allowany = true
+	o.allowlocal = true
+	o.template = "cbi/firewall_zonelist"
+
+
+	o = s:option(Value, "dest_ip", translate("Destination address"))
+	o.datatype = "neg(ipaddr)"
+	o.placeholder = translate("any")
+
+	luci.sys.net.ipv4_hints(function(ip, name)
+		o:value(ip, "%s (%s)" %{ ip, name })
+	end)
+
+
+	o = s:option(Value, "dest_port", translate("Destination port"))
+	o.datatype = "list(neg(portrange))"
+	o.placeholder = translate("any")
+
+
+	o = s:option(ListValue, "target", translate("Action"))
+	o.default = "ACCEPT"
+	o:value("DROP", translate("drop"))
+	o:value("ACCEPT", translate("accept"))
+	o:value("REJECT", translate("reject"))
+	o:value("NOTRACK", translate("don't track"))
+
+
+	s:option(Value, "extra",
+		translate("Extra arguments"),
+		translate("Passes additional arguments to iptables. Use with care!"))
+end
+
+return m
diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/rules.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/rules.lua
new file mode 100644
index 000000000..9bfa66bd0
--- /dev/null
+++ b/applications/luci-app-firewall/luasrc/model/cbi/firewall/rules.lua
@@ -0,0 +1,269 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2008 Steven Barth <steven@midlink.org>
+Copyright 2010-2012 Jo-Philipp Wich <xm@subsignal.org>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+]]--
+
+local ds = require "luci.dispatcher"
+local ft = require "luci.tools.firewall"
+
+m = Map("firewall",
+	translate("Firewall - Traffic Rules"),
+	translate("Traffic rules define policies for packets traveling between \
+		different zones, for example to reject traffic between certain hosts \
+		or to open WAN ports on the router."))
+
+--
+-- Rules
+--
+
+s = m:section(TypedSection, "rule", translate("Traffic Rules"))
+s.addremove = true
+s.anonymous = true
+s.sortable  = true
+s.template = "cbi/tblsection"
+s.extedit   = ds.build_url("admin/network/firewall/rules/%s")
+s.defaults.target = "ACCEPT"
+s.template_addremove = "firewall/cbi_addrule"
+
+
+function s.create(self, section)
+	created = TypedSection.create(self, section)
+end
+
+function s.parse(self, ...)
+	TypedSection.parse(self, ...)
+
+	local i_n = m:formvalue("_newopen.name")
+	local i_p = m:formvalue("_newopen.proto")
+	local i_e = m:formvalue("_newopen.extport")
+	local i_x = m:formvalue("_newopen.submit")
+
+	local f_n = m:formvalue("_newfwd.name")
+	local f_s = m:formvalue("_newfwd.src")
+	local f_d = m:formvalue("_newfwd.dest")
+	local f_x = m:formvalue("_newfwd.submit")
+
+	if i_x then
+		created = TypedSection.create(self, section)
+
+		self.map:set(created, "target",    "ACCEPT")
+		self.map:set(created, "src",       "wan")
+		self.map:set(created, "proto",     (i_p ~= "other") and i_p or "all")
+		self.map:set(created, "dest_port", i_e)
+		self.map:set(created, "name",      i_n)
+
+		if i_p ~= "other" and i_e and #i_e > 0 then
+			created = nil
+		end
+
+	elseif f_x then
+		created = TypedSection.create(self, section)
+
+		self.map:set(created, "target", "ACCEPT")
+		self.map:set(created, "src",    f_s)
+		self.map:set(created, "dest",   f_d)
+		self.map:set(created, "name",   f_n)
+	end
+
+	if created then
+		m.uci:save("firewall")
+		luci.http.redirect(ds.build_url(
+			"admin/network/firewall/rules", created
+		))
+	end
+end
+
+ft.opt_name(s, DummyValue, translate("Name"))
+
+local function rule_proto_txt(self, s)
+	local f = self.map:get(s, "family")
+	local p = ft.fmt_proto(self.map:get(s, "proto"),
+	                       self.map:get(s, "icmp_type")) or translate("traffic")
+
+	if f and f:match("4") then
+		return "%s-%s" %{ translate("IPv4"), p }
+	elseif f and f:match("6") then
+		return "%s-%s" %{ translate("IPv6"), p }
+	else
+		return "%s %s" %{ translate("Any"), p }
+	end
+end
+
+local function rule_src_txt(self, s)
+	local z = ft.fmt_zone(self.map:get(s, "src"), translate("any zone"))
+	local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any host"))
+	local p = ft.fmt_port(self.map:get(s, "src_port"))
+	local m = ft.fmt_mac(self.map:get(s, "src_mac"))
+
+	if p and m then
+		return translatef("From %s in %s with source %s and %s", a, z, p, m)
+	elseif p or m then
+		return translatef("From %s in %s with source %s", a, z, p or m)
+	else
+		return translatef("From %s in %s", a, z)
+	end
+end
+
+local function rule_dest_txt(self, s)
+	local z = ft.fmt_zone(self.map:get(s, "dest"))
+	local p = ft.fmt_port(self.map:get(s, "dest_port"))
+
+	-- Forward
+	if z then
+		local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host"))
+		if p then
+			return translatef("To %s, %s in %s", a, p, z)
+		else
+			return translatef("To %s in %s", a, z)
+		end
+
+	-- Input
+	else
+		local a = ft.fmt_ip(self.map:get(s, "dest_ip"),
+			translate("any router IP"))
+
+		if p then
+			return translatef("To %s at %s on <var>this device</var>", a, p)
+		else
+			return translatef("To %s on <var>this device</var>", a)
+		end
+	end
+end
+
+local function snat_dest_txt(self, s)
+	local z = ft.fmt_zone(self.map:get(s, "dest"), translate("any zone"))
+	local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host"))
+	local p = ft.fmt_port(self.map:get(s, "dest_port")) or
+		ft.fmt_port(self.map:get(s, "src_dport"))
+
+	if p then
+		return translatef("To %s, %s in %s", a, p, z)
+	else
+		return translatef("To %s in %s", a, z)
+	end
+end
+
+
+match = s:option(DummyValue, "match", translate("Match"))
+match.rawhtml = true
+match.width   = "70%"
+function match.cfgvalue(self, s)
+	return "<small>%s<br />%s<br />%s</small>" % {
+		rule_proto_txt(self, s),
+		rule_src_txt(self, s),
+		rule_dest_txt(self, s)
+	}
+end
+
+target = s:option(DummyValue, "target", translate("Action"))
+target.rawhtml = true
+target.width   = "20%"
+function target.cfgvalue(self, s)
+	local t = ft.fmt_target(self.map:get(s, "target"), self.map:get(s, "dest"))
+	local l = ft.fmt_limit(self.map:get(s, "limit"),
+		self.map:get(s, "limit_burst"))
+
+	if l then
+		return translatef("<var>%s</var> and limit to %s", t, l)
+	else
+		return "<var>%s</var>" % t
+	end
+end
+
+ft.opt_enabled(s, Flag, translate("Enable")).width = "1%"
+
+
+--
+-- SNAT
+--
+
+s = m:section(TypedSection, "redirect",
+	translate("Source NAT"),
+	translate("Source NAT is a specific form of masquerading which allows \
+		fine grained control over the source IP used for outgoing traffic, \
+		for example to map multiple WAN addresses to internal subnets."))
+s.template  = "cbi/tblsection"
+s.addremove = true
+s.anonymous = true
+s.sortable  = true
+s.extedit   = ds.build_url("admin/network/firewall/rules/%s")
+s.template_addremove = "firewall/cbi_addsnat"
+
+function s.create(self, section)
+	created = TypedSection.create(self, section)
+end
+
+function s.parse(self, ...)
+	TypedSection.parse(self, ...)
+
+	local n = m:formvalue("_newsnat.name")
+	local s = m:formvalue("_newsnat.src")
+	local d = m:formvalue("_newsnat.dest")
+	local a = m:formvalue("_newsnat.dip")
+	local p = m:formvalue("_newsnat.dport")
+	local x = m:formvalue("_newsnat.submit")
+
+	if x and a and #a > 0 then
+		created = TypedSection.create(self, section)
+
+		self.map:set(created, "target",    "SNAT")
+		self.map:set(created, "src",       s)
+		self.map:set(created, "dest",      d)
+		self.map:set(created, "proto",     "all")
+		self.map:set(created, "src_dip",   a)
+		self.map:set(created, "src_dport", p)
+		self.map:set(created, "name",      n)
+	end
+
+	if created then
+		m.uci:save("firewall")
+		luci.http.redirect(ds.build_url(
+			"admin/network/firewall/rules", created
+		))
+	end
+end
+
+function s.filter(self, sid)
+	return (self.map:get(sid, "target") == "SNAT")
+end
+
+ft.opt_name(s, DummyValue, translate("Name"))
+
+match = s:option(DummyValue, "match", translate("Match"))
+match.rawhtml = true
+match.width   = "70%"
+function match.cfgvalue(self, s)
+	return "<small>%s<br />%s<br />%s</small>" % {
+		rule_proto_txt(self, s),
+		rule_src_txt(self, s),
+		snat_dest_txt(self, s)
+	}
+end
+
+snat = s:option(DummyValue, "via", translate("Action"))
+snat.rawhtml = true
+snat.width   = "20%"
+function snat.cfgvalue(self, s)
+	local a = ft.fmt_ip(self.map:get(s, "src_dip"))
+	local p = ft.fmt_port(self.map:get(s, "src_dport"))
+
+	if a and p then
+		return translatef("Rewrite to source %s, %s", a, p)
+	else
+		return translatef("Rewrite to source %s", a or p)
+	end
+end
+
+ft.opt_enabled(s, Flag, translate("Enable")).width = "1%"
+
+
+return m
diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/zone-details.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/zone-details.lua
new file mode 100644
index 000000000..e5bcb34da
--- /dev/null
+++ b/applications/luci-app-firewall/luasrc/model/cbi/firewall/zone-details.lua
@@ -0,0 +1,243 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2008 Steven Barth <steven@midlink.org>
+Copyright 2010-2011 Jo-Philipp Wich <xm@subsignal.org>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+$Id$
+]]--
+
+local nw = require "luci.model.network"
+local fw = require "luci.model.firewall"
+local ds = require "luci.dispatcher"
+local ut = require "luci.util"
+
+local m, p, i, v
+local s, name, net, family, msrc, mdest, log, lim
+local s2, out, inp
+
+
+m = Map("firewall", translate("Firewall - Zone Settings"))
+m.redirect = luci.dispatcher.build_url("admin/network/firewall/zones")
+
+fw.init(m.uci)
+nw.init(m.uci)
+
+
+local zone = fw:get_zone(arg[1])
+if not zone then
+	luci.http.redirect(dsp.build_url("admin/network/firewall/zones"))
+	return
+else
+	m.title = "%s - %s" %{
+		translate("Firewall - Zone Settings"),
+		translatef("Zone %q", zone:name() or "?")
+	}
+end
+
+
+s = m:section(NamedSection, zone.sid, "zone",
+	translatef("Zone %q", zone:name()),
+	translatef("This section defines common properties of %q. \
+		The <em>input</em> and <em>output</em> options set the default \
+		policies for traffic entering and leaving this zone while the \
+		<em>forward</em> option describes the policy for forwarded traffic \
+		between different networks within the zone. \
+		<em>Covered networks</em> specifies which available networks are \
+		members of this zone.", zone:name()))
+
+s.anonymous = true
+s.addremove = false
+
+m.on_commit = function(map)
+	local zone = fw:get_zone(arg[1])
+	if zone then
+		s.section  = zone.sid
+		s2.section = zone.sid
+	end
+end
+
+
+s:tab("general", translate("General Settings"))
+s:tab("advanced", translate("Advanced Settings"))
+
+
+name = s:taboption("general", Value, "name", translate("Name"))
+name.optional = false
+name.forcewrite = true
+name.datatype = "uciname"
+
+function name.write(self, section, value)
+	if zone:name() ~= value then
+		fw:rename_zone(zone:name(), value)
+		out.exclude = value
+		inp.exclude = value
+	end
+
+	m.redirect = ds.build_url("admin/network/firewall/zones", value)
+	m.title = "%s - %s" %{
+		translate("Firewall - Zone Settings"),
+		translatef("Zone %q", value or "?")
+	}
+end
+
+p = {
+	s:taboption("general", ListValue, "input", translate("Input")),
+	s:taboption("general", ListValue, "output", translate("Output")),
+	s:taboption("general", ListValue, "forward", translate("Forward"))
+}
+
+for i, v in ipairs(p) do
+	v:value("REJECT", translate("reject"))
+	v:value("DROP", translate("drop"))
+	v:value("ACCEPT", translate("accept"))
+end
+
+s:taboption("general", Flag, "masq", translate("Masquerading"))
+s:taboption("general", Flag, "mtu_fix", translate("MSS clamping"))
+
+net = s:taboption("general", Value, "network", translate("Covered networks"))
+net.template = "cbi/network_netlist"
+net.widget = "checkbox"
+net.cast = "string"
+
+function net.formvalue(self, section)
+	return Value.formvalue(self, section) or "-"
+end
+
+function net.cfgvalue(self, section)
+	return Value.cfgvalue(self, section) or name:cfgvalue(section)
+end
+
+function net.write(self, section, value)
+	zone:clear_networks()
+
+	local n
+	for n in ut.imatch(value) do
+		zone:add_network(n)
+	end
+end
+
+
+family = s:taboption("advanced", ListValue, "family",
+	translate("Restrict to address family"))
+
+family.rmempty = true
+family:value("", translate("IPv4 and IPv6"))
+family:value("ipv4", translate("IPv4 only"))
+family:value("ipv6", translate("IPv6 only"))
+
+msrc = s:taboption("advanced", DynamicList, "masq_src",
+	translate("Restrict Masquerading to given source subnets"))
+
+msrc.optional = true
+msrc.datatype = "list(neg(or(uciname,hostname,ip4addr)))"
+msrc.placeholder = "0.0.0.0/0"
+msrc:depends("family", "")
+msrc:depends("family", "ipv4")
+
+mdest = s:taboption("advanced", DynamicList, "masq_dest",
+	translate("Restrict Masquerading to given destination subnets"))
+
+mdest.optional = true
+mdest.datatype = "list(neg(or(uciname,hostname,ip4addr)))"
+mdest.placeholder = "0.0.0.0/0"
+mdest:depends("family", "")
+mdest:depends("family", "ipv4")
+
+s:taboption("advanced", Flag, "conntrack",
+	translate("Force connection tracking"))
+
+log = s:taboption("advanced", Flag, "log",
+	translate("Enable logging on this zone"))
+
+log.rmempty = true
+log.enabled = "1"
+
+lim = s:taboption("advanced", Value, "log_limit",
+	translate("Limit log messages"))
+
+lim.placeholder = "10/minute"
+lim:depends("log", "1")
+
+
+s2 = m:section(NamedSection, zone.sid, "fwd_out",
+	translate("Inter-Zone Forwarding"),
+	translatef("The options below control the forwarding policies between \
+		this zone (%s) and other zones. <em>Destination zones</em> cover \
+		forwarded traffic <strong>originating from %q</strong>. \
+		<em>Source zones</em> match forwarded traffic from other zones \
+		<strong>targeted at %q</strong>. The forwarding rule is \
+		<em>unidirectional</em>, e.g. a forward from lan to wan does \
+		<em>not</em> imply a permission to forward from wan to lan as well.",
+		zone:name(), zone:name(), zone:name()
+
+	))
+
+out = s2:option(Value, "out",
+	translate("Allow forward to <em>destination zones</em>:"))
+
+out.nocreate = true
+out.widget = "checkbox"
+out.exclude = zone:name()
+out.template = "cbi/firewall_zonelist"
+
+inp = s2:option(Value, "in",
+	translate("Allow forward from <em>source zones</em>:"))
+
+inp.nocreate = true
+inp.widget = "checkbox"
+inp.exclude = zone:name()
+inp.template = "cbi/firewall_zonelist"
+
+function out.cfgvalue(self, section)
+	local v = { }
+	local f
+	for _, f in ipairs(zone:get_forwardings_by("src")) do
+		v[#v+1] = f:dest()
+	end
+	return table.concat(v, " ")
+end
+
+function inp.cfgvalue(self, section)
+	local v = { }
+	local f
+	for _, f in ipairs(zone:get_forwardings_by("dest")) do
+		v[#v+1] = f:src()
+	end
+	return v
+end
+
+function out.formvalue(self, section)
+	return Value.formvalue(self, section) or "-"
+end
+
+function inp.formvalue(self, section)
+	return Value.formvalue(self, section) or "-"
+end
+
+function out.write(self, section, value)
+	zone:del_forwardings_by("src")
+
+	local f
+	for f in ut.imatch(value) do
+		zone:add_forwarding_to(f)
+	end
+end
+
+function inp.write(self, section, value)
+	zone:del_forwardings_by("dest")
+
+	local f
+	for f in ut.imatch(value) do
+		zone:add_forwarding_from(f)
+	end
+end
+
+return m
diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/zones.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/zones.lua
new file mode 100644
index 000000000..e6d8548bf
--- /dev/null
+++ b/applications/luci-app-firewall/luasrc/model/cbi/firewall/zones.lua
@@ -0,0 +1,88 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2008 Steven Barth <steven@midlink.org>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+$Id$
+]]--
+
+local ds = require "luci.dispatcher"
+local fw = require "luci.model.firewall"
+
+local m, s, o, p, i, v
+
+m = Map("firewall",
+	translate("Firewall - Zone Settings"),
+	translate("The firewall creates zones over your network interfaces to control network traffic flow."))
+
+fw.init(m.uci)
+
+s = m:section(TypedSection, "defaults", translate("General Settings"))
+s.anonymous = true
+s.addremove = false
+
+s:option(Flag, "syn_flood", translate("Enable SYN-flood protection"))
+
+o = s:option(Flag, "drop_invalid", translate("Drop invalid packets"))
+o.default = o.disabled
+
+p = {
+	s:option(ListValue, "input", translate("Input")),
+	s:option(ListValue, "output", translate("Output")),
+	s:option(ListValue, "forward", translate("Forward"))
+}
+
+for i, v in ipairs(p) do
+	v:value("REJECT", translate("reject"))
+	v:value("DROP", translate("drop"))
+	v:value("ACCEPT", translate("accept"))
+end
+
+
+s = m:section(TypedSection, "zone", translate("Zones"))
+s.template = "cbi/tblsection"
+s.anonymous = true
+s.addremove = true
+s.extedit   = ds.build_url("admin", "network", "firewall", "zones", "%s")
+
+function s.create(self)
+	local z = fw:new_zone()
+	if z then
+		luci.http.redirect(
+			ds.build_url("admin", "network", "firewall", "zones", z.sid)
+		)
+	end
+end
+
+function s.remove(self, section)
+	return fw:del_zone(section)
+end
+
+o = s:option(DummyValue, "_info", translate("Zone ⇒ Forwardings"))
+o.template = "cbi/firewall_zoneforwards"
+o.cfgvalue = function(self, section)
+	return self.map:get(section, "name")
+end
+
+p = {
+	s:option(ListValue, "input", translate("Input")),
+	s:option(ListValue, "output", translate("Output")),
+	s:option(ListValue, "forward", translate("Forward"))
+}
+
+for i, v in ipairs(p) do
+	v:value("REJECT", translate("reject"))
+	v:value("DROP", translate("drop"))
+	v:value("ACCEPT", translate("accept"))
+end
+
+s:option(Flag, "masq", translate("Masquerading"))
+s:option(Flag, "mtu_fix", translate("MSS clamping"))
+
+return m
diff --git a/applications/luci-app-firewall/luasrc/tools/firewall.lua b/applications/luci-app-firewall/luasrc/tools/firewall.lua
new file mode 100644
index 000000000..07162cba5
--- /dev/null
+++ b/applications/luci-app-firewall/luasrc/tools/firewall.lua
@@ -0,0 +1,289 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2011-2012 Jo-Philipp Wich <xm@subsignal.org>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+]]--
+
+module("luci.tools.firewall", package.seeall)
+
+local ut = require "luci.util"
+local ip = require "luci.ip"
+local nx = require "nixio"
+
+local translate, translatef = luci.i18n.translate, luci.i18n.translatef
+
+local function tr(...)
+	return tostring(translate(...))
+end
+
+function fmt_neg(x)
+	if type(x) == "string" then
+		local v, neg = x:gsub("^ *! *", "")
+		if neg > 0 then
+			return v, "%s " % tr("not")
+		else
+			return x, ""
+		end
+	end
+	return x, ""
+end
+
+function fmt_mac(x)
+	if x and #x > 0 then
+		local m, n
+		local l = { tr("MAC"), " " }
+		for m in ut.imatch(x) do
+			m, n = fmt_neg(m)
+			l[#l+1] = "<var>%s%s</var>" %{ n, m }
+			l[#l+1] = ", "
+		end
+		if #l > 1 then
+			l[#l] = nil
+			if #l > 3 then
+				l[1] = tr("MACs")
+			end
+			return table.concat(l, "")
+		end
+	end
+end
+
+function fmt_port(x, d)
+	if x and #x > 0 then
+		local p, n
+		local l = { tr("port"), " " }
+		for p in ut.imatch(x) do
+			p, n = fmt_neg(p)
+			local a, b = p:match("(%d+)%D+(%d+)")
+			if a and b then
+				l[1] = tr("ports")
+				l[#l+1] = "<var>%s%d-%d</var>" %{ n, a, b }
+			else
+				l[#l+1] = "<var>%s%d</var>" %{ n, p }
+			end
+			l[#l+1] = ", "
+		end
+		if #l > 1 then
+			l[#l] = nil
+			if #l > 3 then
+				l[1] = tr("ports")
+			end
+			return table.concat(l, "")
+		end
+	end
+	return d and "<var>%s</var>" % d
+end
+
+function fmt_ip(x, d)
+	if x and #x > 0 then
+		local l = { tr("IP"), " " }
+		local v, a, n
+		for v in ut.imatch(x) do
+			v, n = fmt_neg(v)
+			a, m = v:match("(%S+)/(%d+%.%S+)")
+			a = a or v
+			a = a:match(":") and ip.IPv6(a, m) or ip.IPv4(a, m)
+			if a and (a:is6() and a:prefix() < 128 or a:prefix() < 32) then
+				l[1] = tr("IP range")
+				l[#l+1] = "<var title='%s - %s'>%s%s</var>" %{
+					a:minhost():string(),
+					a:maxhost():string(),
+					n, a:string()
+				}
+			else
+				l[#l+1] = "<var>%s%s</var>" %{
+					n,
+					a and a:string() or v
+				}
+			end
+			l[#l+1] = ", "
+		end
+		if #l > 1 then
+			l[#l] = nil
+			if #l > 3 then
+				l[1] = tr("IPs")
+			end
+			return table.concat(l, "")
+		end
+	end
+	return d and "<var>%s</var>" % d
+end
+
+function fmt_zone(x, d)
+	if x == "*" then
+		return "<var>%s</var>" % tr("any zone")
+	elseif x and #x > 0 then
+		return "<var>%s</var>" % x
+	elseif d then
+		return "<var>%s</var>" % d
+	end
+end
+
+function fmt_icmp_type(x)
+	if x and #x > 0 then
+		local t, v, n
+		local l = { tr("type"), " " }
+		for v in ut.imatch(x) do
+			v, n = fmt_neg(v)
+			l[#l+1] = "<var>%s%s</var>" %{ n, v }
+			l[#l+1] = ", "
+		end
+		if #l > 1 then
+			l[#l] = nil
+			if #l > 3 then
+				l[1] = tr("types")
+			end
+			return table.concat(l, "")
+		end
+	end
+end
+
+function fmt_proto(x, icmp_types)
+	if x and #x > 0 then
+		local v, n
+		local l = { }
+		local t = fmt_icmp_type(icmp_types)
+		for v in ut.imatch(x) do
+			v, n = fmt_neg(v)
+			if v == "tcpudp" then
+				l[#l+1] = "TCP"
+				l[#l+1] = ", "
+				l[#l+1] = "UDP"
+				l[#l+1] = ", "
+			elseif v ~= "all" then
+				local p = nx.getproto(v)
+				if p then
+					-- ICMP
+					if (p.proto == 1 or p.proto == 58) and t then
+						l[#l+1] = translatef(
+							"%s%s with %s",
+							n, p.aliases[1] or p.name, t
+						)
+					else
+						l[#l+1] = "%s%s" %{
+							n,
+							p.aliases[1] or p.name
+						}
+					end
+					l[#l+1] = ", "
+				end
+			end
+		end
+		if #l > 0 then
+			l[#l] = nil
+			return table.concat(l, "")
+		end
+	end
+end
+
+function fmt_limit(limit, burst)
+	burst = tonumber(burst)
+	if limit and #limit > 0 then
+		local l, u = limit:match("(%d+)/(%w+)")
+		l = tonumber(l or limit)
+		u = u or "second"
+		if l then
+			if u:match("^s") then
+				u = tr("second")
+			elseif u:match("^m") then
+				u = tr("minute")
+			elseif u:match("^h") then
+				u = tr("hour")
+			elseif u:match("^d") then
+				u = tr("day")
+			end
+			if burst and burst > 0 then
+				return translatef("<var>%d</var> pkts. per <var>%s</var>, \
+				    burst <var>%d</var> pkts.", l, u, burst)
+			else
+				return translatef("<var>%d</var> pkts. per <var>%s</var>", l, u)
+			end
+		end
+	end
+end
+
+function fmt_target(x, dest)
+	if dest and #dest > 0 then
+		if x == "ACCEPT" then
+			return tr("Accept forward")
+		elseif x == "REJECT" then
+			return tr("Refuse forward")
+		elseif x == "NOTRACK" then
+			return tr("Do not track forward")
+		else --if x == "DROP" then
+			return tr("Discard forward")
+		end
+	else
+		if x == "ACCEPT" then
+			return tr("Accept input")
+		elseif x == "REJECT" then
+			return tr("Refuse input")
+		elseif x == "NOTRACK" then
+			return tr("Do not track input")
+		else --if x == "DROP" then
+			return tr("Discard input")
+		end
+	end
+end
+
+
+function opt_enabled(s, t, ...)
+	if t == luci.cbi.Button then
+		local o = s:option(t, "__enabled")
+		function o.render(self, section)
+			if self.map:get(section, "enabled") ~= "0" then
+				self.title      = tr("Rule is enabled")
+				self.inputtitle = tr("Disable")
+				self.inputstyle = "reset"
+			else
+				self.title      = tr("Rule is disabled")
+				self.inputtitle = tr("Enable")
+				self.inputstyle = "apply"
+			end
+			t.render(self, section)
+		end
+		function o.write(self, section, value)
+			if self.map:get(section, "enabled") ~= "0" then
+				self.map:set(section, "enabled", "0")
+			else
+				self.map:del(section, "enabled")
+			end
+		end
+		return o
+	else
+		local o = s:option(t, "enabled", ...)
+		o.default = "1"
+		return o
+	end
+end
+
+function opt_name(s, t, ...)
+	local o = s:option(t, "name", ...)
+
+	function o.cfgvalue(self, section)
+		return self.map:get(section, "name") or
+			self.map:get(section, "_name") or "-"
+	end
+
+	function o.write(self, section, value)
+		if value ~= "-" then
+			self.map:set(section, "name", value)
+			self.map:del(section, "_name")
+		else
+			self:remove(section)
+		end
+	end
+
+	function o.remove(self, section)
+		self.map:del(section, "name")
+		self.map:del(section, "_name")
+	end
+
+	return o
+end
diff --git a/applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm b/applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm
new file mode 100644
index 000000000..3726f643d
--- /dev/null
+++ b/applications/luci-app-firewall/luasrc/view/firewall/cbi_addforward.htm
@@ -0,0 +1,115 @@
+<%-
+	local fw = require "luci.model.firewall".init()
+	local izl = { }
+	local ezl = { }
+	local _, z
+	for _, z in ipairs(fw:get_zones()) do
+		if z:name() ~= "wan" then
+			izl[#izl+1] = z
+		elseif z:name() ~= "lan" then
+			ezl[#ezl+1] = z
+		end
+	end
+-%>
+<div class="cbi-section-create cbi-tblsection-create">
+	<br />
+	<table class="cbi-section-table" style="width:810px; margin-left:5px">
+		<tr class="cbi-section-table-titles">
+			<th class="cbi-section-table-cell" colspan="8"><%:New port forward%>:</th>
+		</tr>
+		<tr class="cbi-section-table-descr">
+			<th class="cbi-section-table-cell"><%:Name%></th>
+			<th class="cbi-section-table-cell"><%:Protocol%></th>
+			<th class="cbi-section-table-cell"><%:External zone%></th>
+			<th class="cbi-section-table-cell"><%:External port%></th>
+			<th class="cbi-section-table-cell"><%:Internal zone%></th>
+			<th class="cbi-section-table-cell"><%:Internal IP address%></th>
+			<th class="cbi-section-table-cell"><%:Internal port%></th>
+			<th class="cbi-section-table-cell"></th>
+		</tr>
+		<tr class="cbi-section-table-row">
+			<td class="cbi-section-table-cell">
+				<input type="text" class="cbi-input-text" id="_newfwd.name" name="_newfwd.name" placeholder="<%:New port forward%>" />
+			</td>
+			<td class="cbi-section-table-cell" style="width:110px">
+				<select class="cbi-input-select" id="_newfwd.proto" name="_newfwd.proto">
+					<option value="tcp udp">TCP+UDP</option>
+					<option value="tcp">TCP</option>
+					<option value="udp">UDP</option>
+					<option value="other"><%:Other...%></option>
+				</select>
+			</td>
+			<td class="cbi-section-table-cell" style="width:55px">
+				<select class="cbi-input-select" id="_newfwd.extzone" name="_newfwd.extzone">
+					<% for _, z in ipairs(ezl) do -%><option value="<%=z:name()%>"><%=z:name()%></option><%- end %>
+				</select>
+			</td>
+			<td class="cbi-section-table-cell" style="width:110px">
+				<input type="text" class="cbi-input-text" id="_newfwd.extport" name="_newfwd.extport" />
+			</td>
+			<td class="cbi-section-table-cell" style="width:55px">
+				<select class="cbi-input-select" id="_newfwd.intzone" name="_newfwd.intzone">
+					<% for _, z in ipairs(izl) do -%><option value="<%=z:name()%>"><%=z:name()%></option><%- end %>
+				</select>
+			</td>
+			<td class="cbi-section-table-cell" style="width:110px">
+				<input type="text" class="cbi-input-text" id="_newfwd.intaddr" name="_newfwd.intaddr" />
+			</td>
+			<td class="cbi-section-table-cell" style="width:110px">
+				<input type="text" class="cbi-input-text" id="_newfwd.intport" name="_newfwd.intport" />
+			</td>
+			<td class="cbi-section-table-cell">
+				<input type="submit" class="cbi-button cbi-button-add" name="cbi.cts.<%=self.config%>.<%=self.sectiontype%>.<%=section%>" value="<%:Add%>" />
+			</td>
+		</tr>
+	</table>
+
+	<script type="text/javascript">//<![CDATA[
+		cbi_validate_field('_newfwd.extport', true, 'portrange');
+		cbi_validate_field('_newfwd.intaddr', true, 'host');
+		cbi_validate_field('_newfwd.intport', true, 'portrange');
+
+		cbi_combobox_init('_newfwd.intaddr', {
+			<% first = true; luci.sys.net.ipv4_hints(function(ip, name) %>
+				<%- if first then first = false else %>,<% end -%>'<%=ip%>': '<%=ip%> (<%=name%>)'
+			<%- end) %> }, '', '<%: -- custom -- %>');
+
+		cbi_bind(document.getElementById('_newfwd.extport'), 'blur',
+			function() {
+				var n = document.getElementById('_newfwd.name');
+				var p = document.getElementById('_newfwd.proto');
+				var i = document.getElementById('_newfwd.intport');
+				var hints = {
+				/*  port    name     0=both, 1=tcp, 2=udp, 3=other */
+					21:   [ 'FTP',   1 ],
+					22:   [ 'SSH',   1 ],
+					53:   [ 'DNS',   0 ],
+					80:   [ 'HTTP',  1 ],
+					443:  [ 'HTTPS', 1 ],
+					3389: [ 'RDP',   1 ],
+					5900: [ 'VNC',   1 ],
+				};
+
+				if (!this.className.match(/invalid/))
+				{
+					if (!i.value) i.value = this.value;
+
+					var hint = hints[this.value || 0] || hints[i.value || 0];
+					if (hint)
+					{
+						p.selectedIndex = hint[1];
+
+						if (!n.value)
+							n.value = hint[0];
+					}
+					else if (!n.value)
+					{
+						n.value = 'Forward' + this.value;
+					}
+				}
+			});
+
+
+		cbi_validate_field('cbi.cts.<%=self.config%>.<%=self.sectiontype%>.<%=section%>', true, 'uciname');
+	//]]></script>
+</div>
diff --git a/applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm b/applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm
new file mode 100644
index 000000000..463b2e05f
--- /dev/null
+++ b/applications/luci-app-firewall/luasrc/view/firewall/cbi_addrule.htm
@@ -0,0 +1,112 @@
+<%
+	local fw = require "luci.model.firewall".init()
+	local wz = fw:get_zone("wan")
+	local lz = fw:get_zone("lan")
+%>
+
+<div class="cbi-section-create cbi-tblsection-create">
+	<% if wz and lz then %>
+		<br />
+		<table class="cbi-section-table" style="margin-left:5px">
+			<tr class="cbi-section-table-titles">
+				<th class="cbi-section-table-cell left" colspan="4"><%:Open ports on router%>:</th>
+			</tr>
+			<tr class="cbi-section-table-descr">
+				<th class="cbi-section-table-cell"><%:Name%></th>
+				<th class="cbi-section-table-cell"><%:Protocol%></th>
+				<th class="cbi-section-table-cell"><%:External port%></th>
+				<th class="cbi-section-table-cell"></th>
+			</tr>
+			<tr class="cbi-section-table-row">
+				<td class="cbi-section-table-cell" style="width:130px">
+					<input type="text" class="cbi-input-text" id="_newopen.name" name="_newopen.name" placeholder="<%:New input rule%>" />
+				</td>
+				<td class="cbi-section-table-cell" style="width:110px">
+					<select class="cbi-input-select" id="_newopen.proto" name="_newopen.proto">
+						<option value="tcp udp">TCP+UDP</option>
+						<option value="tcp">TCP</option>
+						<option value="udp">UDP</option>
+						<option value="other"><%:Other...%></option>
+					</select>
+				</td>
+				<td class="cbi-section-table-cell" style="width:110px">
+					<input type="text" class="cbi-input-text" id="_newopen.extport" name="_newopen.extport" />
+				</td>
+				<td class="cbi-section-table-cell left">
+					<input type="submit" class="cbi-button cbi-button-add" name="_newopen.submit" value="<%:Add%>" />
+				</td>
+			</tr>
+		</table>
+
+		<table class="cbi-section-table" style="margin-left:5px">
+			<tr class="cbi-section-table-titles">
+				<th class="cbi-section-table-cell left" colspan="6"><br /><%:New forward rule%>:</th>
+			</tr>
+			<tr class="cbi-section-table-descr">
+				<th class="cbi-section-table-cell"><%:Name%></th>
+				<th class="cbi-section-table-cell"><%:Source zone%></th>
+				<th class="cbi-section-table-cell"><%:Destination zone%></th>
+				<th class="cbi-section-table-cell"></th>
+			</tr>
+			<tr class="cbi-section-table-row">
+				<td class="cbi-section-table-cell" style="width:130px">
+					<input type="text" class="cbi-input-text" id="_newfwd.name" name="_newfwd.name" placeholder="<%:New forward rule%>" />
+				</td>
+				<td class="cbi-section-table-cell" style="width:110px">
+					<select class="cbi-input-text" id="_newfwd.src" name="_newfwd.src">
+						<% local k, v; for k, v in ipairs(fw:get_zones()) do -%>
+							<option<%=ifattr(v:name() == "lan", "selected", "selected")%> value="<%=v:name()%>"><%=v:name()%></option>
+						<%- end %>
+					</select>
+				</td>
+				<td class="cbi-section-table-cell" style="width:110px">
+					<select class="cbi-input-text" id="_newfwd.dest" name="_newfwd.dest">
+						<% local k, v; for k, v in ipairs(fw:get_zones()) do -%>
+							<option<%=ifattr(v:name() == "wan", "selected", "selected")%> value="<%=v:name()%>"><%=v:name()%></option>
+						<%- end %>
+					</select>
+				</td>
+				<td class="cbi-section-table-cell left">
+					<input type="submit" class="cbi-button cbi-button-link" name="_newfwd.submit" value="<%:Add and edit...%>" />
+				</td>
+			</tr>
+		</table>
+
+		<script type="text/javascript">//<![CDATA[
+			cbi_validate_field('_newopen.extport', true, 'list(neg(portrange))');
+			cbi_bind(document.getElementById('_newopen.extport'), 'blur',
+				function() {
+					var n = document.getElementById('_newopen.name');
+					var p = document.getElementById('_newopen.proto');
+					var hints = {
+					/*  port    name     0=both, 1=tcp, 2=udp, 3=other */
+						22:   [ 'SSH',   1 ],
+						53:   [ 'DNS',   0 ],
+						80:   [ 'HTTP',  1 ],
+						443:  [ 'HTTPS', 1 ],
+					};
+
+					if (!this.className.match(/invalid/))
+					{
+						var hint = hints[this.value || 0];
+						if (hint)
+						{
+							p.selectedIndex = hint[1];
+
+							if (!n.value)
+								n.value = hint[0];
+						}
+						else if (!n.value && this.value)
+						{
+							n.value = 'Open' + this.value;
+						}
+					}
+				});
+
+
+			cbi_validate_field('cbi.cts.<%=self.config%>.<%=self.sectiontype%>.<%=section%>', true, 'uciname');
+		//]]></script>
+	<% else %>
+		<input type="submit" class="cbi-button cbi-button-add" name="cbi.cts.<%=self.config%>.<%=self.sectiontype%>.<%=section%>" value="<%:Add%>" />
+	<% end %>
+</div>
diff --git a/applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm b/applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm
new file mode 100644
index 000000000..4e1681c11
--- /dev/null
+++ b/applications/luci-app-firewall/luasrc/view/firewall/cbi_addsnat.htm
@@ -0,0 +1,66 @@
+<%
+	local fw = require "luci.model.firewall".init()
+	local nw = require "luci.model.network".init()
+	local wz = fw:get_zone("wan")
+	local lz = fw:get_zone("lan")
+%>
+
+<div class="cbi-section-create cbi-tblsection-create">
+	<% if wz and lz then %>
+		<br />
+		<table class="cbi-section-table" style="width:700px; margin-left:5px">
+			<tr class="cbi-section-table-titles">
+				<th class="cbi-section-table-cell left" colspan="6"><%:New source NAT%>:</th>
+			</tr>
+			<tr class="cbi-section-table-descr">
+				<th class="cbi-section-table-cell"><%:Name%></th>
+				<th class="cbi-section-table-cell"><%:Source zone%></th>
+				<th class="cbi-section-table-cell"><%:Destination zone%></th>
+				<th class="cbi-section-table-cell"><%:To source IP%></th>
+				<th class="cbi-section-table-cell"><%:To source port%></th>
+				<th class="cbi-section-table-cell"></th>
+			</tr>
+			<tr class="cbi-section-table-row">
+				<td class="cbi-section-table-cell">
+					<input type="text" class="cbi-input-text" id="_newsnat.name" name="_newsnat.name" placeholder="<%:New SNAT rule%>" />
+				</td>
+				<td class="cbi-section-table-cell" style="width:110px">
+					<select class="cbi-input-text" id="_newsnat.src" name="_newsnat.src">
+						<% local k, v; for k, v in ipairs(fw:get_zones()) do -%>
+							<option<%=ifattr(v:name() == "lan", "selected", "selected")%> value="<%=v:name()%>"><%=v:name()%></option>
+						<%- end %>
+					</select>
+				</td>
+				<td class="cbi-section-table-cell" style="width:110px">
+					<select class="cbi-input-text" id="_newsnat.dest" name="_newsnat.dest">
+						<% local k, v; for k, v in ipairs(fw:get_zones()) do -%>
+							<option<%=ifattr(v:name() == "wan", "selected", "selected")%> value="<%=v:name()%>"><%=v:name()%></option>
+						<%- end %>
+					</select>
+				</td>
+				<td class="cbi-section-table-cell" style="width:110px">
+					<input type="text" class="cbi-input-text" id="_newsnat.dip" name="_newsnat.dip" />
+				</td>
+				<td class="cbi-section-table-cell" style="width:110px">
+					<input type="text" class="cbi-input-text" id="_newsnat.dport" name="_newsnat.dport" placeholder="<%:Do not rewrite%>" />
+				</td>
+				<td class="cbi-section-table-cell">
+					<input type="submit" class="cbi-button cbi-button-link" name="_newsnat.submit" value="<%:Add and edit...%>" />
+				</td>
+			</tr>
+		</table>
+
+		<script type="text/javascript">//<![CDATA[
+			cbi_validate_field('_newsnat.dport', true, 'portrange');
+			cbi_validate_field('_newsnat.dip', true, 'ip4addr');
+			cbi_combobox_init('_newsnat.dip', {
+				<% local c, k, v = 0; for k, v in ipairs(nw:get_interfaces()) do -%>
+					<%- local a; for k, a in ipairs(v:ipaddrs()) do c = c + 1 -%>
+						<% if c > 1 then %>,<% end %>'<%=a:host():string()%>': '<%=a:host():string()%> (<%=v:shortname()%>)'
+					<%- end %>
+				<%- end %> }, '<%: -- Please choose -- %>', '<%: -- custom -- %>');
+		//]]></script>
+	<% else %>
+		<input type="submit" class="cbi-button cbi-button-add" name="cbi.cts.<%=self.config%>.<%=self.sectiontype%>.<%=section%>" value="<%:Add%>" />
+	<% end %>
+</div>