nixos-router/pkgs/router-webui/templates/firewall.html

{{define "content"}}
{{with .Data}}
{{$e := .Errors}}
<p class="hint">Every LAN and tunnel belongs to a zone. Traffic inside a zone is allowed; between zones it is denied
   unless a rule allows it. A rule works in one direction (replies are always allowed), so letting two zones talk
   to each other takes two rules.</p>
<form method="post" action="/firewall">
  <input type="hidden" name="csrf" value="{{$.CSRF}}">
  <fieldset>
    <legend>Zones</legend>
    <input type="hidden" name="members" value="{{len .Members}}">
    <table>
      <tr><th>Interface</th><th>Device</th><th>Zone</th></tr>
      {{range $i, $m := .Members}}
      <tr>
        <td>{{if eq $m.Kind "lan"}}LAN{{else}}Tunnel{{end}} <strong>{{$m.Name}}</strong>
          <input type="hidden" name="member.{{$i}}.kind" value="{{$m.Kind}}">
          <input type="hidden" name="member.{{$i}}.name" value="{{$m.Name}}">
          <input type="hidden" name="member.{{$i}}.device" value="{{$m.Device}}"></td>
        <td><code>{{$m.Device}}</code></td>
        <td><select name="member.{{$i}}.zone">
          {{range $.Data.Zones}}<option value="{{.}}" {{if eq . $m.Zone}}selected{{end}}>{{.}}</option>{{end}}
        </select></td>
      </tr>
      {{with index $e (printf "member[%d]" $i)}}<tr><td colspan="3" class="field-error">{{.}}</td></tr>{{end}}
      {{end}}
    </table>
    <p class="hint">Several interfaces can share a zone. The uplink is the zone <code>wan</code>; rules from it publish services.</p>
    {{range .Empty}}
    <p>Zone <strong>{{.}}</strong> has no interface. <label class="inline"><input type="checkbox" name="rmzone" value="{{.}}"> remove</label>
      {{with index $e (printf "zone.%s" .)}}<span class="field-error">{{.}}</span>{{end}}</p>
    {{end}}
    <label>New zones <input name="newzones" value="{{.New}}" size="24" placeholder="guests, iot"></label>
    {{with index $e "newzone"}}<span class="field-error">{{.}}</span>{{end}}
    <p class="hint">A new zone can be picked above (and in the rules) after saving.</p>
  </fieldset>

  <fieldset>
    <legend>Rules</legend>
    <input type="hidden" name="rows" value="{{len .Rows}}">
    <div class="scroll">
    <table>
      <tr><th>From zone</th><th>From address</th><th>From port</th><th>To zone</th><th>To address</th><th>To port</th><th>Protocol</th><th>Remove</th></tr>
      {{range $i, $r := .Rows}}
      <tr>
        <td><select name="rule.{{$i}}.from"><option value=""></option>
          {{range $.Data.Zones}}<option value="{{.}}" {{if eq . $r.From}}selected{{end}}>{{.}}</option>{{end}}
        </select></td>
        <td><input name="rule.{{$i}}.sources" value="{{$r.Sources}}" size="16" spellcheck="false" placeholder="any"></td>
        <td><input name="rule.{{$i}}.sourceports" value="{{$r.SourcePorts}}" size="8" placeholder="any"></td>
        <td><select name="rule.{{$i}}.to"><option value=""></option>
          {{range $.Data.Zones}}<option value="{{.}}" {{if eq . $r.To}}selected{{end}}>{{.}}</option>{{end}}
        </select></td>
        <td><input name="rule.{{$i}}.destination" value="{{$r.Destination}}" size="16" spellcheck="false" placeholder="whole zone"></td>
        <td><input name="rule.{{$i}}.ports" value="{{$r.Ports}}" size="10" placeholder="all"></td>
        <td><select name="rule.{{$i}}.protocol">
          {{range $p := list "any" "tcp" "udp" "icmp"}}<option value="{{$p}}" {{if eq $p $r.Protocol}}selected{{end}}>{{$p}}</option>{{end}}
        </select></td>
        <td>{{if or $r.From $r.To}}<input type="checkbox" name="rule.{{$i}}.remove">{{end}}</td>
      </tr>
      {{range $f := list "from" "sources" "sourcePorts" "to" "destination" "ports" "protocol"}}{{with index $e (printf "rule[%d].%s" $i $f)}}<tr><td colspan="8" class="field-error">{{$f}}: {{.}}</td></tr>{{end}}{{end}}
      {{end}}
    </table>
    </div>
    <p class="hint">Fill in the last row to add a rule. Addresses (several separated by commas) are IPv4 or IPv6, single or CIDR;
       to address is one address or network. Ports (tcp and udp only): <code>22, 443, 5000-5100</code>.</p>
  </fieldset>

  <fieldset>
    <legend>From the internet</legend>
    <input type="hidden" name="forwards" value="{{len .Forwards}}">
    <div class="scroll">
    <table>
      <tr><th>Protocol</th><th>Public port</th><th>To zone</th><th>To address</th><th>To port</th><th>Only from</th><th>Port forward</th><th>Hairpin</th><th>Log</th><th>Rate limit</th><th>Remove</th></tr>
      {{range $i, $r := .Forwards}}
      <tr>
        <td><select name="fwd.{{$i}}.protocol">
          {{range $p := list "tcp" "udp" "icmp"}}<option value="{{$p}}" {{if eq $p $r.Protocol}}selected{{end}}>{{$p}}</option>{{end}}
        </select></td>
        <td><input name="fwd.{{$i}}.ports" value="{{$r.Ports}}" size="10" placeholder="443"></td>
        <td><select name="fwd.{{$i}}.to"><option value=""></option>
          {{range $.Data.Zones}}<option value="{{.}}" {{if eq . $r.To}}selected{{end}}>{{.}}</option>{{end}}
        </select></td>
        <td><input name="fwd.{{$i}}.destination" value="{{$r.Destination}}" size="16" spellcheck="false" placeholder="192.168.10.5"></td>
        <td><input name="fwd.{{$i}}.toport" value="{{$r.ToPort}}" size="6" placeholder="same"></td>
        <td><input name="fwd.{{$i}}.sources" value="{{$r.Sources}}" size="14" spellcheck="false" placeholder="anywhere"></td>
        <td><input type="checkbox" name="fwd.{{$i}}.nat" {{if $r.NAT}}checked{{end}}></td>
        <td><input type="checkbox" name="fwd.{{$i}}.hairpin" {{if $r.Hairpin}}checked{{end}}></td>
        <td><input type="checkbox" name="fwd.{{$i}}.log" {{if $r.Log}}checked{{end}}></td>
        <td><input name="fwd.{{$i}}.ratelimit" value="{{$r.RateLimit}}" size="9" placeholder="none"></td>
        <td>{{if or $r.Ports $r.Destination}}<input type="checkbox" name="fwd.{{$i}}.remove">{{end}}</td>
      </tr>
      {{range $f := list "protocol" "ports" "to" "destination" "toport" "sources" "hairpin" "ratelimit"}}{{with index $e (printf "fwd[%d].%s" $i $f)}}<tr><td colspan="11" class="field-error">{{$f}}: {{.}}</td></tr>{{end}}{{end}}
      {{end}}
    </table>
    </div>
    <p class="hint">Everything from the internet is blocked unless listed here. A <strong>port forward</strong> sends tcp or udp
       traffic for the router's public IPv4 address to one host inside (to address is that host; to port only if it differs,
       with a single public port); the sender's address is kept. Without it the rule just lets traffic through to an address
       or network inside, for IPv6 or for a public range. <strong>Hairpin</strong> lets your LANs use the forward through the
       router's public address. Rate limit caps new connections per sender, like <code>10/minute</code>.
       Fill in the last row to add one.</p>
  </fieldset>
  <button>Save</button>
</form>

{{if .Other}}
<section>
  <h2>Other rules</h2>
  <p class="muted">Rules with options this page does not edit are kept as they are; change them in <code>settings.json</code>.</p>
  <ul>{{range .Other}}<li>{{.}}</li>{{end}}</ul>
</section>
{{end}}
{{end}}
{{end}}