diff --git a/src/www/firewall_rules_edit.php b/src/www/firewall_rules_edit.php index b9ec3efa589..62510c4d9bd 100644 --- a/src/www/firewall_rules_edit.php +++ b/src/www/firewall_rules_edit.php @@ -318,6 +318,13 @@ function is_posnumericint($arg) { if (!empty($pconfig['floating']) && !empty($pconfig['gateway']) && (empty($pconfig['direction']) || $pconfig['direction'] == "any")) { $input_errors[] = gettext("You can not use gateways in Floating rules without choosing a direction."); + } elseif (empty($pconfig['floating']) && $pconfig['direction'] != "in" && !empty($pconfig['gateway'])) { + // XXX: Technically this is not completely true, but since you can only send to other destinations reachable + // from the selected interface in this case, it will likely be confusing for our users. + // Policy based routing rules on inbound traffic can use the correct outbound interface, which is the + // scenario that is most commonly used . + // For compatibilty reasons, we only apply this on non-floating rules. + $input_errors[] = gettext("Policy based routing (gateway setting) is only supported on inbound rules."); } if (!in_array($pconfig['protocol'], array("tcp","tcp/udp"))) { @@ -406,13 +413,13 @@ function is_posnumericint($arg) { // 1-on-1 copy of form values $copy_fields = array('type', 'interface', 'ipprotocol', 'tag', 'tagged', 'max', 'max-src-nodes' , 'max-src-conn', 'max-src-states', 'statetimeout', 'statetype', 'os', 'descr', 'gateway' - , 'sched', 'associated-rule-id', 'direction', 'quick' + , 'sched', 'associated-rule-id', 'direction' , 'max-src-conn-rate', 'max-src-conn-rates', 'category') ; foreach ($copy_fields as $fieldname) { if (!empty($pconfig[$fieldname])) { if (is_array($pconfig[$fieldname])) { - $filterent[$fieldname] = implode(",", $pconfig[$fieldname]); + $filterent[$fieldname] = implode(",", $pconfig[$fieldname]); } else { $filterent[$fieldname] = trim($pconfig[$fieldname]); } @@ -475,7 +482,9 @@ function is_posnumericint($arg) { if (isset($pconfig['prio']) && $pconfig['prio'] !== '') { $filterent['prio'] = $pconfig['prio']; } - + // XXX: Always store quick, so none existent can have a different functional meaning than an empty value. + // Not existent means previous defaults (empty + floating --> non quick, empty + non floating --> quick) + $filterent['quick'] = !empty($pconfig['quick']) ? 1 : 0; if ($pconfig['protocol'] != "any") { $filterent['protocol'] = $pconfig['protocol']; @@ -715,21 +724,30 @@ function is_posnumericint($arg) { - deselected, interface rule and not set --> selected + if (empty($pconfig['floating']) && $pconfig['quick'] == null){ + $is_quick = true; + } elseif (!empty($pconfig['floating']) && $pconfig['quick'] == null) { + $is_quick = false; + } else { + $is_quick = $pconfig['quick']; + } ?> - /> + /> - @@ -786,23 +804,28 @@ function is_posnumericint($arg) { + // XXX: for legacy compatibility we keep supporting "any" on floating rules, regular rules should choose + $direction_options = !empty($pconfig['floating']) ? array('in','out', 'any') : array('in','out');?> - + + -