Edit port forwards and openings from the internet on the firewall page

Rules from wan are edited in their own table: protocol, ports, zone, host,
host port, allowed sources, port forward (NAT), hairpin, log and rate
limit, with the module's checks done up front.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/templates/firewall.html

@@ -65,13 +65,49 @@
     <p class="hint">Fill in the last row to add a rule. Addresses (several separated by commas) are IPv4 or IPv6, single or CIDR;
        to address is one address or network. Ports (tcp and udp only): <code>22, 443, 5000-5100</code>.</p>
   </fieldset>
+
+  <fieldset>
+    <legend>From the internet</legend>
+    <input type="hidden" name="forwards" value="{{len .Forwards}}">
+    <div class="scroll">
+    <table>
+      <tr><th>Protocol</th><th>Public port</th><th>To zone</th><th>To address</th><th>To port</th><th>Only from</th><th>Port forward</th><th>Hairpin</th><th>Log</th><th>Rate limit</th><th>Remove</th></tr>
+      {{range $i, $r := .Forwards}}
+      <tr>
+        <td><select name="fwd.{{$i}}.protocol">
+          {{range $p := list "tcp" "udp" "icmp"}}<option value="{{$p}}" {{if eq $p $r.Protocol}}selected{{end}}>{{$p}}</option>{{end}}
+        </select></td>
+        <td><input name="fwd.{{$i}}.ports" value="{{$r.Ports}}" size="10" placeholder="443"></td>
+        <td><select name="fwd.{{$i}}.to"><option value=""></option>
+          {{range $.Data.Zones}}<option value="{{.}}" {{if eq . $r.To}}selected{{end}}>{{.}}</option>{{end}}
+        </select></td>
+        <td><input name="fwd.{{$i}}.destination" value="{{$r.Destination}}" size="16" spellcheck="false" placeholder="192.168.10.5"></td>
+        <td><input name="fwd.{{$i}}.toport" value="{{$r.ToPort}}" size="6" placeholder="same"></td>
+        <td><input name="fwd.{{$i}}.sources" value="{{$r.Sources}}" size="14" spellcheck="false" placeholder="anywhere"></td>
+        <td><input type="checkbox" name="fwd.{{$i}}.nat" {{if $r.NAT}}checked{{end}}></td>
+        <td><input type="checkbox" name="fwd.{{$i}}.hairpin" {{if $r.Hairpin}}checked{{end}}></td>
+        <td><input type="checkbox" name="fwd.{{$i}}.log" {{if $r.Log}}checked{{end}}></td>
+        <td><input name="fwd.{{$i}}.ratelimit" value="{{$r.RateLimit}}" size="9" placeholder="none"></td>
+        <td>{{if or $r.Ports $r.Destination}}<input type="checkbox" name="fwd.{{$i}}.remove">{{end}}</td>
+      </tr>
+      {{range $f := list "protocol" "ports" "to" "destination" "toport" "sources" "hairpin" "ratelimit"}}{{with index $e (printf "fwd[%d].%s" $i $f)}}<tr><td colspan="11" class="field-error">{{$f}}: {{.}}</td></tr>{{end}}{{end}}
+      {{end}}
+    </table>
+    </div>
+    <p class="hint">Everything from the internet is blocked unless listed here. A <strong>port forward</strong> sends tcp or udp
+       traffic for the router's public IPv4 address to one host inside (to address is that host; to port only if it differs,
+       with a single public port); the sender's address is kept. Without it the rule just lets traffic through to an address
+       or network inside, for IPv6 or for a public range. <strong>Hairpin</strong> lets your LANs use the forward through the
+       router's public address. Rate limit caps new connections per sender, like <code>10/minute</code>.
+       Fill in the last row to add one.</p>
+  </fieldset>
   <button>Save</button>
 </form>
 
 {{if .Other}}
 <section>
   <h2>Other rules</h2>
-  <p class="muted">Port forwards and rules with more options are kept as they are; change them in <code>settings.json</code>.</p>
+  <p class="muted">Rules with options this page does not edit are kept as they are; change them in <code>settings.json</code>.</p>
   <ul>{{range .Other}}<li>{{.}}</li>{{end}}</ul>
 </section>
 {{end}}