Released 05/08/2005
GUI and compilers v2.0.7 require API library libfwbuilder version 2.0.7
This is a bug fix release
For those who wish to build from source, instructions are outlined in the document "Install and Build instructions" on our web site here
User can specify additional command line parameters for ssh that built-in installer runs to access firewall. This allows for alternative ssh port or alternative ssh identity to be used when accessing firewall. Parameters can be added in the "Installer" tab of firewall settings dialog for all platforms.
Added support for dynamic addresses in ipfilter. Actual address of dynamic interface is now determined at run-time in the policy activation script <firewall_name>.fw generated by fwbuilder. If dynamic interface is used somewhere in the policy or nat rules, it will be replaced with its actual address by activation script before configuration is sent to ipf or ipnat for activation. This run-time substitution is done only if a checkbox is checked in the "Script options" tab of firewall settings dialog. Default behavior is to use "any". This is because ipfilter configuration files <firewall>-ipf.conf and <firewall>-nat.conf that rely on run-time substitution of dynamic interface address can not be loaded using standard activation scripts that come with FreeBSD.
Generated script uses function getaddr() to determine address of dynamic interface. This function falls back to 0.0.0.0/32 if dynamic interface has not been assigned an address yet or is down. Ipfilter policy using run-time substitution of dynamic interface addresses will be functional even if these interfaces are down or do not have IP address.
Generated iptables script sets default policies to DROP in all ipv6 filter chains. More detailed control can be implemented using prolog or epilog scripts.
Note that this changes behavior of the generated iptables script with respect to IPv6. Until now, the script just ignored IPv6 but some people felt this leaves a hole in the firewall and asked me to make the script close it. Generated shell code will check if ip6tables is installed on the system and if it actually works before setting default policies to DROP. This means it won't try to do it if ip6tables is not installed or if it is present, but IPv6 is not compiled into the kernel (so ip6tables does not work and generates errors).
Note that this changes behavior of the generated iptables script with respect to IPv6. Until now, the script just ignored IPv6 but some people felt this leaves a hole in the firewall and asked me to make the script close it. Generated shell code will check if ip6tables is installed on the system and if it actually works before setting default policies to DROP. This means it won't try to do it if ip6tables is not installed or if it is present, but IPv6 is not compiled into the kernel (so ip6tables does not work and generates errors).
This also fixes another problem in fwb_ipf where it generated rdr and nat commands with address 0.0.0.0/32 if dynamic interface was used in a NAT rule.