diff --git a/CHANGELOG b/CHANGELOG
index 678fc48..a2c4ddd 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,8 @@
2.00 Alpha 3 -
- - (Hopefully) Resolved UDP reply issue with conntracking and default DROP
+ - Give people knobs to tinker with regarding state matching. Kills
+ multiple birds with one stone.
+ - forward.conf
+
2.00 Alpha 2 - 04/12/2014
diff --git a/bin/srfirewall b/bin/srfirewall
index e17aace..c30bc41 100755
--- a/bin/srfirewall
+++ b/bin/srfirewall
@@ -19,7 +19,7 @@
# along with this program. If not, see .
# Static config options, normally do not need to change
-FW_VERSION="2.0 Alpha 2"
+FW_VERSION="2.0 Alpha 3"
# Important directory locations
FWPREFIX="/usr/local"
diff --git a/etc/ipv4/acl.conf b/etc/ipv4/acl.conf
index c50c1e8..7aa227c 100644
--- a/etc/ipv4/acl.conf
+++ b/etc/ipv4/acl.conf
@@ -2,7 +2,7 @@
# Use this file to set up more complex access control lists.
# Use tabs or single space to separate
#
-#
+#
#
# Direction: Required ( IN | OUT )
# Action: Required (ACCEPT | DROP)
@@ -13,9 +13,11 @@
# Dst Port: Optional ( destination port, 1 - 65535, Requires Protocol )
# Protocol: Optional, Required if port is specified ( tcp | udp )
# Syn: Optional, only match (not) syn packets (syn | notsyn )
+# State: Optional, set the connection tracking states ( comma separated list )
+
# You can use '-' for optional fields
#============================================================
-#
+#
#IN ACCEPT eth0 10.0.0.1 22 - - tcp -
#IN DROP - - - - 22 tcp syn
diff --git a/etc/ipv4/forward.conf b/etc/ipv4/forward.conf
index 15af94e..12554bd 100644
--- a/etc/ipv4/forward.conf
+++ b/etc/ipv4/forward.conf
@@ -2,7 +2,7 @@
# Use this file to set up network address translation rules
# Use tabs or single space to separate
#
-#
+#
#
# Action: Required ( ACCEPT | DROP )
# Source Interface: Optional ( interface name, aka eth0 )
@@ -16,12 +16,14 @@
# Destination Port: Optional ( destination port number, or range 1:65535 )
# Protocol: Optional, required if port numbers specified ( tcp | udp )
# Syn: Optional, only match (not) syn packets (syn | notsyn )
+# State: Optional, set the connection tracking states ( comma separated list )
#
# You can use '-' for optional fields
#============================================================
-#
+#
#ACCEPT eth0 - eth1 - yes
#DROP eth1 192.168.2.0/24 eth0 0/0 no
-#DROP eth0 - eth1 192.168.0.0/24 no - 1:1024 tcp syn
+#DROP eth0 - eth1 192.168.0.0/24 no - 1:1024 tcp syn NEW
+#ACCEPT eth1 - eth0 - no - - udp - NEW,ESTABLISHED,RELATED
diff --git a/etc/ipv6/acl.conf b/etc/ipv6/acl.conf
index 6c595e8..dc5aa7f 100644
--- a/etc/ipv6/acl.conf
+++ b/etc/ipv6/acl.conf
@@ -2,7 +2,7 @@
# Use this file to set up more complex access control lists.
# Use tabs or single space to separate
#
-#
+#
#
# Direction: Required ( IN | OUT )
# Action: Required (ACCEPT | DROP)
@@ -13,9 +13,11 @@
# Dst Port: Optional ( destination port, 1 - 65535, Requires Protocol )
# Protocol: Optional, Required if port is specified ( tcp | udp )
# Syn: Optional, only match (not) syn packets (syn | notsyn )
+# State: Optional, set the connection tracking states ( comma separated list )
+#
# You can use '-' for optional fields
#============================================================
-#
+#
#IN ACCEPT eth0 2002:dead:beef::/64 22 - - tcp -
#IN DROP - - - - 22 tcp syn
diff --git a/etc/ipv6/forward.conf b/etc/ipv6/forward.conf
index d0dada4..eff38bc 100644
--- a/etc/ipv6/forward.conf
+++ b/etc/ipv6/forward.conf
@@ -2,7 +2,7 @@
# Use this file to set up network address translation rules
# Use tabs or single space to separate
#
-#
+#
#
# Action: Required ( ACCEPT | DROP )
# Source Interface: Optional ( interface name, aka eth0 )
@@ -16,10 +16,12 @@
# Destination Port: Optional ( destination port number, or range 1:65535 )
# Protocol: Optional, required if port numbers specified ( tcp | udp )
# Syn: Optional, only match (not) syn packets (syn | notsyn )
+# State: Optional, set the connection tracking states ( comma separated list )
#
# You can use '-' for optional fields
#============================================================
-#
+#
#ACCEPT eth0 - eth1 - yes
#DROP eth1 2002::/64 eth0 2001::/3 no
-#DROP eth0 2001::/3 eth1 2002:dead:beef::/64 no - 1:1024 tcp syn
\ No newline at end of file
+#DROP eth0 2001::/3 eth1 2002:dead:beef::/64 no - 1:1024 tcp syn
+#ACCEPT eth1 - eth0 - no - - udp - NEW,ESTABLISHED,RELATED
\ No newline at end of file
diff --git a/lib/iptables.inc b/lib/iptables.inc
index addb0eb..303d863 100644
--- a/lib/iptables.inc
+++ b/lib/iptables.inc
@@ -360,14 +360,12 @@ function enable_forwarding {
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading"
if [ -e "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" ]; then
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/forward.conf successful"
- while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional srcport dstport protocol syn; do
+ while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional srcport dstport protocol syn state; do
unset conntrack_state conntrack_udp_new revsrcaddress revdstaddress revdstinterface revsrcinterface revsrcport revdstport
- ([[ ${IP_VERSION} == "ipv4" ]] && [[ ${Enablev4ConnectionTracking} == "yes" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED"
- ([[ ${IP_VERSION} == "ipv6" ]] && [[ ${Enablev6ConnectionTracking} == "yes" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED"
[[ ${action} = \#* ]] && continue
[[ -z ${action} ]] && continue
([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \
- && ${display} RED "forward.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${bidirectional} ${srcport} ${dstport} ${protocol} ${syn}" && continue
+ && ${display} RED "forward.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${bidirectional} ${srcport} ${dstport} ${protocol} ${syn} ${state}" && continue
# Do some creative work with variables to make building the iptables rules fairly painless
@@ -378,6 +376,12 @@ function enable_forwarding {
[[ -z ${srcport} ]] && srcport="-"
[[ -z ${protocol} ]] && protocol="-"
[[ -z ${syn} ]] && syn="-"
+ [[ -z ${state} ]] && state="-"
+
+ ([[ ${IP_VERSION} == "ipv4" ]] && [[ ${Enablev4ConnectionTracking} == "yes" ]] && [[ ${state} == "-" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED"
+ ([[ ${IP_VERSION} == "ipv6" ]] && [[ ${Enablev6ConnectionTracking} == "yes" ]] && [[ ${state} == "-" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED"
+ ([[ ${IP_VERSION} == "ipv4" ]] && [[ ${Enablev4ConnectionTracking} == "yes" ]] && [[ ! ${state} == "-" ]]) && conntrack_state="${M_STATE} ${C_STATE} ${state}"
+ ([[ ${IP_VERSION} == "ipv6" ]] && [[ ${Enablev6ConnectionTracking} == "yes" ]] && [[ ! ${state} == "-" ]]) && conntrack_state="${M_STATE} ${C_STATE} ${state}"
([[ ${bidirectional} == "yes" ]] && [[ ${srcaddress} != "-" ]]) && revsrcaddress="-d ${srcaddress}"
([[ ${bidirectional} == "yes" ]] && [[ ${dstaddress} != "-" ]]) && revdstaddress="-s ${dstaddress}"
@@ -397,7 +401,7 @@ function enable_forwarding {
([[ ${bidirectional} == "yes" ]] && [[ ${dstport} != "-" ]]) && revdstport="--sport ${dstport}"
[[ ${protocol} != "-" ]] && protocol="-p ${protocol}"
- ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${bidirectional} ${srcport} ${dstport} ${protocol} ${syn}"
+ ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${bidirectional} ${srcport} ${dstport} ${protocol} ${syn} ${state}"
# Blank variables that we're not going to use.
[[ ${srcinterface} == "-" ]] && srcinterface=""
@@ -407,14 +411,15 @@ function enable_forwarding {
[[ ${dstport} == "-" ]] && dstport=""
[[ ${srcport} == "-" ]] && srcport=""
[[ ${syn} == "-" ]] && syn=""
+ [[ ${state} == "-" ]] && state=""
[[ ${protocol} == "-" ]] && protocol=""
[[ ${bidirectional} == "-" ]] && bidirectional="no"
[[ ${action} == "DROP" ]] && conntrack_state=""
- ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${srcinterface} ${srcaddress} ${srcport} ${syn} ${dstinterface} ${dstaddress} ${dstport} ${conntrack_state}${conntrack_udp_new} -j ${action}
- [[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${revsrcinterface} ${revsrcaddress} ${revsrcport} ${syn} ${revdstinterface} ${revdstaddress} ${revdstport} ${conntrack_state}${conntrack_udp_new} -j ${action}
+ ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${srcinterface} ${srcaddress} ${srcport} ${syn} ${dstinterface} ${dstaddress} ${dstport} ${conntrack_state} -j ${action}
+ [[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${revsrcinterface} ${revsrcaddress} ${revsrcport} ${syn} ${revdstinterface} ${revdstaddress} ${revdstport} ${conntrack_state} -j ${action}
done < "${FWCONFIGDIR}/ipv${IPVER}/forward.conf"
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done"
fi