Subject: If a rule in fwbuilder uses TCP Service and connlimit option and has multiple objects in src and dst, optimizer used to split it to minimize matches.

From: "Benny A. Sanchez" <[email-masked]>
Date: Thu, 7 Jun 2007 13:59:20 +0300

This allows you to mark some interfaces to be skipped by the compiler when it picks interfaces for ACL rules. For PF this action is translated into tag. If a rule in fwbuilder uses TCP Service and connlimit option and has multiple objects in src and dst, optimizer used to split it to minimize matches. Currently the following modules are supported: state multiport limit mark Importer creates firewall object with all interfaces.
We plan to run public beta for a few months and release final version in October.
This operation works with two external files, neither of which needs to be opened in the program. Compilers for iptables, ipfw, ipf and PIX generate bunch of rules matching each address read from the file. Rules that had chain INPUT in the imported script will have firewall object in "destination" in the corresponding fwbuilder rules. Since the result of this function depends on the OS, some port names may not convert on some systems. Compiler for iptables generates shell code to read the contents of the file when firewall configuration is activated.
Interface objects are created as parser finds them in the script.
Confirmation dialog that is shown when user tries to delete an object also shows all groups and rules that use it.
all recognized iptables rules are imported and interface and direction are set in all rules appropriately.
This service object is only supported by compilers for iptables and PF. This operation works with two external files, neither of which needs to be opened in the program. Currently the following modules are supported: state multiport limit mark Importer creates firewall object with all interfaces.
Since the result of this function depends on the OS, some port names may not convert on some systems. For PF this action is translated into an anchor with the name the same as the name of the branch defined by the administrator.
option "Assume firewall is part of 'any'" is off in the created firewall object. It can not assign object name for the firewall object nor add IP and MAC addresses to interfaces because this information is not present in iptables-save file.
Tag can later be inspected using service object TagService. igmp access lists are not parsed. NOTE: I can only provide very limited support for this feature, please direct your questions and bugreports to the author Global policy and interface policies have been merged. Rules are placed in INPUT,OUTPUT and FORWARD chain of the "mangle" table, this ensures that DNAT happens before rules placed in the mangle table see the packet.
Applied patch to make code compile on kFreeBSD. ACL names are automatically generated using abbreviated interface names and direction symbols to make it easy to figure out which ACL is which.