Firewall Builder Release Notes
Version 1.0.3
GUI v1.0.3 requires API library libfwbuilder version 0.10.7
Summary
The main goal of this release is to incorporate fixes for bugs
discovered in the new policy compiler for iptables
(fwb_ipt). Firewall Builder GUI now comes preconfigured to call
fwb_ipt instead of the old compiler fwb_iptables. If you
have a reason to keep using the old compiler, you can do
so. You need to install package fwbuilder-iptables and then
type "fwb_iptables" in the entry field "Compiler (if different from
default)" in the tab "Compile/Install" in the firewall object
dialog. It is important to note though that per project road map I
will stop maintaining compatibility with the old compiler in the next
version (v1.0.4). Project roadmap can be found here:
http://www.fwbuilder.org/pages/documents.html
What is new in the API library
API library is in freeze until next release.
What is new in the GUI
-
Function that imports list of interfaces using SNMP query for
host or firewall has been corrected and now creates objects
only for interfaces that are "up".
-
GUI now supports multi-window mode. It is now possible to
open different objects from the same database in
different windows. This simplifies task of managing large
firewall policy since one does not have to close the policy to
edit objects. Drag-and-drop works across different windows.
-
Old feature of the GUI where the main window could be split
onto two windows, one with the tree and another with object
dialog, has been deprecated in favor of multi-window mode.
-
Minor enhancement: gui shows icon of a floppy on the status
bar as an indicator when data has been modified and requires
saving. Current objects database file name is shown on the
title bar of the main window.
-
Several memory leaks found and fixed.
What is new in iptables compiler fwb_ipt
- Support for time intervals
Bugs fixed in GUI:
-
bug #557899: GUI crashed on "Cut" operation on policy and NAT
rules
-
bug #562171: ICMP service dialog now provides widgets for
setting ICMP type and code both numerically and from the list
of predefined values. Any numeric value in the range 0-255 can
be used for both type and code.
-
bugs #559958 and #553299: Memory leak displaying large policies
Bugs fixed in iptables policy compiler fwb_ipt:
-
bug #556783: source and destination port ranges in
"original" part of NAT rules should use ':' as a separator
-
bug #556438: multiport does not accept source and
destination ports simultaneously
-
bug #557015: compiler crashed if it could not find
firewall object
-
bug #562173: compiler should be able to create DNAT rule even
if all external interfaces of the firewall have dynamic
address.
-
bug #551323: (iptables modules names have changed in v1.2.6
and later) Added support for predefined firewall platform
version numbers in firewall dialog. Policy compiler can now
distinguish between pre-1.2.6 and 1.2.6 and use different file
names when it generates code to load modules
-
bug #564037: compiler should place rules with destination
address 255.255.255.255 into INPUT chain
-
bug #564633: compiler should set (x) permission on the firewall
policy script
-
bug #566172: original dest. in DNAT rules can be any
Bugs fixed in ipfilter policy compiler (fwb_ipf):
-
bug #557033 ipf supports 'keep state' only for icmp/udp/tcp
protocols
-
bug #564633: compiler did not set (x) permission on the firewall
policy script
Bugs fixed in ipfilter policy compiler (fwb_pf):
-
bug #564633: compiler did not set (x) permission on the firewall
policy script
-
bug #569942: Syntax error while loading rules using icmp
service on OpenBSD