Firewall Builder Release Notes

Version 1.0.9

Summary

For those who wish to build from source, instructions are outlined in the document "Install and Build instructions" on our web site here

What's new

• General improvements:
  • added support for unnumbered interfaces in all policy compilers. Feature req. #546881: "Unnumbered Interfaces cause bad compile".
  • added support for physAddress (MAC address) as a separate object in the GUI and compilers.
  • moved user's preferences from the file $HOME/.fwbuilder.xml to $HOME/.fwbuilder/prefs.xml
  • Firewall Builder compiles and works on Mac OS X. We can build fink packages now.
  • changed term 'shading' to 'shadowing' everywhere.
  • Added a page to the "New Firewall" druid that allows administrator to assign security levels to interfaces. This should reduce risk of user error or misunderstanding and ensure that new firewall object is created with all necessary information.
  • "New Firewall" druid can discover interfaces of the new firewall using SNMP.
  
  
• Improvements in policy compiler for iptables:
  • implemented feature Req. #651268: network rules should include firewall. fwb_ipt now generates commands for INPUT/OUTPUT chains for rules using network to which interface of the firewall belongs.
  
  
  
• Improvements in policy compiler for pf:
  • Compiler puts NAT and policy rules into the same file with extension .conf. Just copy this file to the firewall machine as /etc/pf.conf to load firewall policy from the standard rc scripts.
  • "Scrub" option is now processed through the global firewall option (checkbox in "Firewall" tab of the Firewall object dialog).
  • Added support for "fragment" option for IP service objects with "short_fragment" or "fragment" options.

Bugs fixed in the GUI:

• fixed bug#617904: snmp does not get multiple addresses. The crawler and the tool that discovers host's interfaces using SNMP finds and creates appropriate IPv4 objects for interfaces that have multiple addresses.
• fixed bug #659782: Wrong netmask in standard object net-192.168.0.0
• fixed bug #637154: seg fault on snmp get / undo.
• fixed bug #673261: Printouts do not show negation. Printing transformations should show negated objects and skip disabled rules.

Bugs fixed in iptables policy compiler fwb_ipt:

• fixed bug #645127: DNAT with MAC address. Now compiler for iptables supports MAC address matching in NAT rules.
• implemented fix suggested in bug report #653250: Order of match option in ULOG target (target -j ULOG put in the output script after limit options).
• fixed bug #659201: Problems with "busybox modprobe". Generated script should check if netfilter module is already loaded before calling modprobe to load it.
• fixed bug #662465: problem in rules with negation if fw has dynamic interface. fwb_ipt generated incorrect code for rules where firewall object was part of the rule element with negation and one of the firewall's interfaces had dynamic address. The new algorithm properly handles this situation using OUTPUT/INPUT chains, although it generates slightly redundand code.
• fixed bug #663506: wrong chain if address range includes firewall interface. Compiler used to chose wrong chain if address range object was used in source or destination of the rule and address range started with the address of the interface of the firewall. The generated code was also incorrect if range did not start with the address of the firewall, but included it in the middle.
• improved fix for bug #662465 - rules where firewall object used with negation now use combination of INPUT/OUTPUT and FORWARD chains and do not use firewall's addresses at all.
• fixed bug #664810: Compiler generates wrong multiport list. Compiler used to add extra comma at the end of the list of port numbers for module multiport if objects "Any UDP" or "Any TCP" were used.
• fixed bug #662132: ver 1.0.8 does not create the virtual ip for the nats. Now compiler creates virtual addresses using all Address objects of the firewall interfaces in addition to addresses used in the NAT rules. If the address it is trying to add already exists, it just skips it.
• fixed bug #676828: Missing "NONE" keyword in rules built for TCP objects matching on packets with no TCP flags.

Bugs fixed in iptables policy compiler fwb_ipf:

• fixed bug #671623: bad syntax for NAT proxies. Ipfilter does not like destination port specification when it is given together with proxy specification.

Bugs fixed in iptables policy compiler fwb_pf:

• fixed bug #649195: "name of dynamic interfce appears in rules". In order to fix this bug, we have introduced a new type of the interface - an unnumbered interface. Unnumbered interface can never have IP address and won't appear in the policy rules, however it can have a policy associated with it.