firewall-local v1.8.0-ui

[1.8.0-ui] - 2026-06-14

Company Block module. Block all networks belonging to named companies by resolving
company name → ASN → CIDRs via libloc at firewall start. Two O(1) REJECT rules on
CUSTOMFORWARD and CUSTOMOUTPUT (dst match). Managed via new company-block.cgi with
add/enable/disable/delete/edit per company. Concept: Shellshock (IPFire forum); libloc
integration: ummeegge; firewall-local adaptation: H&M.

UI aligned with native IPFire icons + Edit function across all CGIs. All five module
CGIs (ip-rules, asn-block, smb-allow, company-block, location-allow) now use native IPFire
icons: per-row on.gif/off.gif toggle, edit.gif, delete.gif, addblue.gif (Add), floppy.gif
(Update). Edit pre-fills the Add form in-place and preserves entry state; description-only
edits skip firewall reload. Location Allow menu label corrected ("Location Block" → "Location Allow").

ASN Rules table: Organisation column. asn-block.cgi now shows the registered
organisation name alongside each AS number. A single batch location get-as call resolves
all ASNs on page load — no per-row subprocesses. Gracefully blank when libloc is absent.

Company Block module — key field design and constraints. The Company Key field is
passed verbatim to location search-as <key> at firewall start. It must be a substring of
the organisation name as libloc knows it (case-insensitive). Allowed characters: letters,
digits, spaces, hyphens (max 20). Special characters (&, @, . etc.) are stripped at
input because the key also forms the ipset name (comp_<key>_net with spaces converted to
hyphens) — ipset names cannot contain those characters. Consequence: for companies whose
names contain & (e.g. "AT&T"), the key must omit the special character (e.g. att).
Risk of false positives: location search-as returns every ASN whose name contains the
key as a substring — short or common keys may match unrelated organisations.
Verify with location search-as <key> on the IPFire shell before adding.
Large companies (Hetzner, Google, Amazon) may have thousands of CIDRs; load time and memory
use scale with CIDR count — test with location list-networks-by-as --family=ipv4 <asn> | wc -l
before enabling on low-memory hardware such as APU2.

Bug fix: ASN bypass rules in LOCATIONBLOCK landed after the terminal DROP.
process_asn_master_list() used iptables -A (append), so RETURN rules were added after
the DROP that location_allow() inserts — making them unreachable. Fixed to iptables -I
(insert at position 1). LOG+ACTION insertion order corrected so LOG fires before the
terminal action with -I semantics.

Bug fix: fw-chains-user.conf erased on every package update. The file was seeded
on first install but absent from the IPFire backup includes, so extract_files overwrote
it on every update.sh run — silently destroying any custom chain entries the operator
had added. Fixed by adding it to generate_backup_includes() in make-package.sh so the
pakfire backup/restore cycle preserves it across updates.

---

firewall-local v1.7.1-ui

[1.7.1-ui] - 2026-06-09

Maintenance: corrected navigation path in Outgoing Location Block CGI and USAGE.md
(Firewall › Firewall Groups › Location Groups); updated ASN Rules screenshot.
Code hygiene pass on firewall_functions and firewall.local (comment translations,
typo fixes, version bump).

---