6 files changed, 219 insertions, 0 deletions
diff --git a/applications/luci-fw/Makefile b/applications/luci-fw/Makefile
new file mode 100644
index 000000000..81a96f6a8
--- /dev/null
+++ b/applications/luci-fw/Makefile
@@ -0,0 +1,2 @@
+include ../../build/config.mk
+include ../../build/module.mk
+\ No newline at end of file
diff --git a/applications/luci-fw/root/etc/config/luci_fw b/applications/luci-fw/root/etc/config/luci_fw
new file mode 100644
index 000000000..c7dec7f2c
--- /dev/null
+++ b/applications/luci-fw/root/etc/config/luci_fw
@@ -0,0 +1,2 @@
+
+ 
+\ No newline at end of file
diff --git a/applications/luci-fw/root/etc/init.d/luci_fw b/applications/luci-fw/root/etc/init.d/luci_fw
new file mode 100644
index 000000000..e98b3f729
--- /dev/null
+++ b/applications/luci-fw/root/etc/init.d/luci_fw
@@ -0,0 +1,124 @@
+#!/bin/sh /etc/rc.common
+START=46
+
+apply_portfw() {
+	local cfg="$1"
+	config_get proto "$cfg" proto
+	config_get dport "$cfg" dport
+	config_get iface "$cfg" iface
+	config_get to    "$cfg" to
+
+	ports=$(echo $to | cut -sd: -f2)
+	if [ -n "$ports" ]; then
+		ports="--dport $(echo $ports | sed -e 's/-/:/')"
+	else
+		ports="--dport $dport"
+	fi
+
+	ip=$(echo $to | cut -d: -f1)
+	
+	if ([ "$proto" == "tcpudp" ] || [ "$proto" == "tcp" ]); then
+		iptables -t nat -A luci_fw_prerouting -i "$iface" -p tcp --dport "$dport" -j DNAT --to "$to"
+		iptables -A luci_fw_forward -i "$iface" -p tcp -d "$ip" $ports -j ACCEPT
+	fi
+
+	if ([ "$proto" == "tcpudp" ] || [ "$proto" == "udp" ]); then
+		iptables -t nat -A luci_fw_prerouting -i "$iface" -p udp --dport "$dport" -j DNAT --to "$to"
+		iptables -A luci_fw_forward -i "$iface" -p udp -d "$ip" $ports -j ACCEPT
+	fi
+}
+
+apply_rule() {
+	local cfg="$1"
+	local cmd=""
+
+	config_get chain "$cfg" chain
+	[ -n "$chain" ] || return 0
+	[ "$chain" == "forward" ] && cmd="$cmd -A luci_fw_forward"
+	[ "$chain" == "input" ] && cmd="$cmd -A luci_fw_input"
+	[ "$chain" == "output" ] && cmd="$cmd -A luci_fw_output"
+	[ "$chain" == "prerouting" ] && cmd="$cmd -t nat -A luci_fw_prerouting"
+	[ "$chain" == "postrouting" ] && cmd="$cmd -t nat -A luci_fw_postrouting"
+	
+	config_get iface "$cfg" iface
+	[ -n "$iface" ] && cmd="$cmd -i $iface"	
+
+	config_get oface "$cfg" oface
+	[ -n "$oface" ] && cmd="$cmd -o $oface"	
+
+	config_get proto "$cfg" proto
+	[ -n "$proto" ] && cmd="$cmd -p $proto"	
+
+	config_get source "$cfg" source
+	[ -n "$source" ] && cmd="$cmd -s $source"	
+
+	config_get destination "$cfg" destination
+	[ -n "$destination" ] && cmd="$cmd -d $destination"	
+
+	config_get sport "$cfg" sport
+	[ -n "$sport" ] && cmd="$cmd --sport $sport"	
+
+	config_get dport "$cfg" dport
+	[ -n "$dport" ] && cmd="$cmd --dport $dport"	
+	
+	config_get todest "$cfg" todest
+	[ -n "$todest" ] && cmd="$cmd --to-destination $todest"	
+
+	config_get tosrc "$cfg" tosrc
+	[ -n "$tosrc" ] && cmd="$cmd --to-source $tosrc"	
+	
+	config_get mac "$cfg" mac
+	[ -n "$mac" ] && cmd="$cmd -m mac --mac-source $mac"
+
+	config_get jump "$cfg" jump
+	[ -n "$jump" ] && cmd="$cmd -j $jump"	
+
+	config_get command "$cfg" command
+	[ -n "$command" ] && cmd="$cmd $command"	
+
+	iptables $cmd
+}
+
+start() {
+	### Create subchains
+	iptables -N luci_fw_input
+	iptables -N luci_fw_output
+	iptables -N luci_fw_forward
+	iptables -t nat -N luci_fw_prerouting
+	iptables -t nat -N luci_fw_postrouting
+	
+	### Hook in the chains
+	iptables -A input_rule -j luci_fw_input
+	iptables -A output_rule -j luci_fw_output
+	iptables -A forwarding_rule -j luci_fw_forward
+	iptables -t nat -A prerouting_rule -j luci_fw_prerouting
+	iptables -t nat -A postrouting_rule -j luci_fw_postrouting
+	
+	### Read chains from config
+	config_load luci_fw
+	config_foreach apply_portfw portfw
+	config_foreach apply_rule rule
+}
+
+stop() {
+	### Hook out the chains
+	iptables -D input_rule -j luci_fw_input
+	iptables -D output_rule -j luci_fw_output
+	iptables -D forwarding_rule -j luci_fw_forward
+	iptables -t nat -D prerouting_rule -j luci_fw_prerouting
+	iptables -t nat -D postrouting_rule -j luci_fw_postrouting	
+	
+	### Clear subchains
+	iptables -F luci_fw_input
+	iptables -F luci_fw_output
+	iptables -F luci_fw_forward
+	iptables -t nat -F luci_fw_prerouting
+	iptables -t nat -F luci_fw_postrouting
+	
+	### Delete subchains
+	iptables -X luci_fw_input
+	iptables -X luci_fw_output
+	iptables -X luci_fw_forward
+	iptables -t nat -X luci_fw_prerouting
+	iptables -t nat -X luci_fw_postrouting
+}
diff --git a/applications/luci-fw/src/model/cbi/admin_network/firewall.lua b/applications/luci-fw/src/model/cbi/admin_network/firewall.lua
new file mode 100644
index 000000000..4ff15db53
--- /dev/null
+++ b/applications/luci-fw/src/model/cbi/admin_network/firewall.lua
@@ -0,0 +1,63 @@
+-- ToDo: Translate, Add descriptions and help texts
+m = Map("luci_fw", "Firewall", [[Mit Hilfe der Firewall können Zugriffe auf das Netzwerk
+erlaubt, verboten oder umgeleitet werden.]])
+
+s = m:section(TypedSection, "rule")
+s.addremove = true
+s.anonymous = true
+
+chain = s:option(ListValue, "chain", "Kette")
+chain:value("forward", "Forward")
+chain:value("input", "Input")
+chain:value("output", "Output")
+chain:value("prerouting", "Prerouting")
+chain:value("postrouting", "Postrouting")
+
+s:option(Value, "iface", "Eingangsschnittstelle").optional = true
+s:option(Value, "oface", "Ausgangsschnittstelle").optional = true
+
+proto = s:option(ListValue, "proto", "Protokoll")
+proto.optional = true
+proto:value("")
+proto:value("tcp", "TCP")
+proto:value("udp", "UDP")
+
+s:option(Value, "source", "Quelladresse").optional = true
+s:option(Value, "destination", "Zieladresse").optional = true
+s:option(Value, "mac", "MAC-Adresse").optional = true
+
+sport = s:option(Value, "sport", "Quellport")
+sport.optional = true
+sport:depends("proto", "tcp")
+sport:depends("proto", "udp")
+
+dport = s:option(Value, "dport", "Zielport")
+dport.optional = true
+dport:depends("proto", "tcp")
+dport:depends("proto", "udp")
+
+tosrc = s:option(Value, "tosrc", "Neue Quelladresse [SNAT]")
+tosrc.optional = true
+tosrc:depends("jump", "SNAT")
+
+tosrc = s:option(Value, "todest", "Neue Zieladresse [DNAT]")
+tosrc.optional = true
+tosrc:depends("jump", "DNAT")
+
+jump = s:option(ListValue, "jump", "Aktion")
+jump.rmempty = true
+jump:value("", "")
+jump:value("ACCEPT", "annehmen (ACCEPT)")
+jump:value("REJECT", "zurückweisen (REJECT)")
+jump:value("DROP", "verwerfen (DROP)")
+jump:value("LOG", "protokollieren (LOG)")
+jump:value("DNAT", "Ziel umschreiben (DNAT) [nur Prerouting]")
+jump:value("MASQUERADE", "maskieren (MASQUERADE) [nur Postrouting]")
+jump:value("SNAT", "Quelle umschreiben (SNAT) [nur Postrouting]")
+
+
+add = s:option(Value, "command", "Eigener Befehl")
+add.size = 50
+add.rmempty = true
+
+return m
diff --git a/applications/luci-fw/src/model/cbi/admin_network/portfw.lua b/applications/luci-fw/src/model/cbi/admin_network/portfw.lua
new file mode 100644
index 000000000..96822b53a
--- /dev/null
+++ b/applications/luci-fw/src/model/cbi/admin_network/portfw.lua
@@ -0,0 +1,25 @@
+-- ToDo: Translate, Add descriptions and help texts
+require("ffluci.sys")
+m = Map("luci_fw", "Portweiterleitung", [[Portweiterleitungen ermöglichen es interne
+Netzwerkdienste von einem anderen externen Netzwerk aus erreichbar zu machen.]])
+
+s = m:section(TypedSection, "portfw")
+s.addremove = true
+s.anonymous = true
+
+iface = s:option(ListValue, "iface", "Externes Interface")
+iface:value("")
+for k,v in pairs(ffluci.sys.net.devices()) do
+	iface:value(v)
+end
+
+proto = s:option(ListValue, "proto", "Protokoll")
+proto:value("tcp", "TCP")
+proto:value("udp", "UDP")
+proto:value("tcpudp", "TCP + UDP")
+
+dport = s:option(Value, "dport", "Externer Port", "Port[:Endport]")
+
+to = s:option(Value, "to", "Interne Adresse", "IP-Adresse[:Zielport[-Zielendport]]")
+
+return m
diff --git a/applications/luci-fw/src/model/menu/50luci-fw.lua b/applications/luci-fw/src/model/menu/50luci-fw.lua
new file mode 100644
index 000000000..93aba2fab
--- /dev/null
+++ b/applications/luci-fw/src/model/menu/50luci-fw.lua
@@ -0,0 +1,3 @@
+sel("admin", "network")
+act("portfw", "Portweiterleitung")
+act("firewall", "Firewall")
+\ No newline at end of file