Subject: granola

From: "Emilia" <[email-masked]>
Date: Tue, 19 Jun 2007 17:14:58 +0100

It works on target platforms that provide suitable syntax and allow control to return to the higher level rule set if the branch can not make final decision about the packet.
Using iptables-restore is optional and is controlled by the checkbutton in the "Script options" tab of firewall settings dialog.
Importer creates firewall object with all interfaces firewall object name is assigned if "hostname" command is found in the configuration. For example, new action that created branch in rule set is called Chain for iptables firewalls and Anchor for PF fierwalls.
If the file is checked out and locked by a different user, it can only be opened read-only.
This utility will be incorporated into policy installer in the future to make policy updates simpler and faster, especially when small changes are made to the large set of access lists and nat rules. A command that permits ssh to the firewall from the given address is added on top of all other rules.
This is useful if the name of the obejct is not unique. We still have quite a bit of work to do though, particularly localization has only began.
This was available for PIX for some time, now it has been added for all platforms.
This operation also helps identify changes made to objects in two copies of the same data file.
Doing this only if original rule did not have negation and we do not add any virtual addresses for NAT. Compiler is more tolerant while processing Address Table object with empty address file or with a file with empty lines. GUI crash in a situation when one of the resource files was missing has been fixed, code compiles and works on Solaris and few minor bugs have been fixed in the compiler for iptables. Importer can properly interpret both formats.
Run-time AddressTable objects are only supported by compilers for iptables and PF. Ability to emulate terminating behavior for rules with actions Classify and Tag and improved shadowing detection for these rules have been added in compiler for iptables. Two data files can not be merged, or one imported into another, if they contain such objects. GUI has a built-in installer that uses external ssh client to communicate with firewall.
We plan to run public beta for a few months and release final version in October. Two modes of drag-and-drop of objects in policy and NAT rules: dragging of an object moves it; dragging of an object with Ctrl key pressed copies it Multiple objects can be selected in the tree. It is now possible to generate rules to mark packets in the OUTPUT chain of the mangle table.
Although importer can only interpret a subset of IOS configuration commands, other commands that it does not understand will be ignored and should not affect operation.
Compiler produces optimized code for iptables firewalls used on servers.
Rules are placed in INPUT,OUTPUT and FORWARD chain of the "mangle" table, this ensures that DNAT happens before rules placed in the mangle table see the packet.
It can not configure QoS and other features available there, but you can always use web interface for those. In all cases the goal is to make sure DNAT rules process the packet before, and SNAT rules process it after filtering and tagging rules. Tag can later be inspected using service object TagService. Currently opened data file is not affected by this operation and objects in the tree do not change. This replaced "help me build firewall" wizard. The problem must be corrected manually.