diff --git a/CHANGES.md b/CHANGES.md index 13fd394..4b622de 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -13,13 +13,14 @@ Swift-Pfade relativ zu `filius-ipad/ios/FiliusPad/TopologyEditor/` (Stand | `src/model/link.ts`, `src/model/graph.ts` | `Model/TopologyLink.swift`, `Model/TopologyGraph.swift` | übertragen, bisher nur die Daten (Abfragen folgen mit dem Editor) | | `src/model/documentation.ts` | `Model/TopologyDocumentation.swift` | übertragen; FNV-Kennung mit BigInt, gegen die IDs aus dem Swift-Import geprüft | | `src/runtime/config.ts` | `State/TopologyEditorState.swift` (Laufzeit-Konfigurationen, WLAN eines Rechners, DHCP, Portweiterleitung, Remote Link ohne LAN-Transport, Programme und ihre Konfiguration, Firewall, DNS-Einträge aus `State/TopologyDNSResolver.swift`, E-Mail-Konten und -Nachrichten aus `State/TopologyEmail.swift`); dazu Echo-Server- und Client-Konfiguration, die Swift nicht speichert | übertragen; Java-Beschriftungen der Oberfläche weggelassen | -| `src/runtime/engine.ts` | `State/TopologyNetworkRuntimeEngine.swift` Z. ~313–3585, ~4472–5187 (UDP), ~4753–4850 | übertragen: Warteschlange, Uhr, Ethernet, Switch, ARP, IPv4, ICMP, Routing, Firewall, UDP-Sockets (binden, freie Ports nach Javas Zufall, senden samt Broadcast, zustellen, empfangen mit Wartezeit, schließen), TCP (Z. ~5187–5913: Server- und Client-Sockets, Handschlag mit Ergebnis, Segmente zu 1460 Byte bis zum PSH, höchstens drei Versuche, Abbau über alle Java-Zustände samt `TIME_WAIT`; seit F2.3c nach Javas `TCPSocket` an Java-Filius gemessen: je Versuch und für `TIME_WAIT` 3 RTT nach der Geschwindigkeit (8250 ms bei 90 %, Swift fest 7500 bzw. 2500 ms), der Zeitablauf zählt ab der Übergabe des Segments, vor ARP; ein Segment beendet `TIME_WAIT`; die Gegenseite schließt beim FIN von selbst; nicht bestätigte Daten schließen mit FIN statt sofort; der angenommene Socket hat die Startnummer des Listeners, der Listener eine neue. seit F2.3e wie Java: SYN+ACK und FIN gehen nie ein zweites Mal hinaus; der Server gibt einen Handschlag nach 3 RTT auf und schließt mit FIN; nach dem FIN wartet ein Socket höchstens fünfmal 3 RTT, jedes Segment beendet eine Wartezeit, dann CLOSED (Java lässt den Zustand stehen). Abweichend von Java: drei SYN statt einem, weil Javas Wiederholungsschleife nach dem ersten Zeitablauf abbricht, und ein wiederholtes SYN in `SYN_RCVD` bekommt das SYN+ACK noch einmal, statt den Socket zu schließen), DHCP (Z. ~5913–6694: Server mit festen Zuordnungen, Adressbereich, Angeboten, Leases und Sperrliste; Client seit F2.3b nach Javas `DHCPClient` neu gebaut und an Java-Filius gemessen: je Versuch eine Nachricht, eine Antwort, die nicht passt, wird gelesen und verworfen; die ARP-Prüfung wartet eine RTT, eine Antwort für die Adresse beendet sie sofort, dann DECLINE; nach einem Zeitablauf wiederholt der Zustand seine Nachricht, nach dem fünften nimmt der Client eine Link-Local-Adresse `169.254.1.x/16` (ARP-Probe, ARP-Reply an alle) und gibt keine alte Adresse zurück; Swift sendete doppelt, wartete nicht auf ARP und kehrte nach zehn Versuchen zur alten Adresse zurück. Abweichend von Java: Nach fünf belegten Link-Local-Adressen gibt der Client auf (Java sucht endlos), und ein ARP-Paket für eine andere Adresse beendet die Prüfung nicht. Seit F2.3d befördert ein Kabel einen Frame nach dem anderen wie Javas `SimplexVerbindung` (ein Frame wartet im Ausgangspuffer, bis der vorige angekommen ist, und erscheint im Protokoll, wenn er losgeht); Swift schickt alle zugleich, die Option `swiftCables` behält das für den Swift-Vergleich. Die RTT der DHCP-Zeiten (Warten, Angebote, Sperrliste) folgt wie in Java der Geschwindigkeit (50 Kabel, 2750 ms bei 90 %); Swift rechnet fest mit 2500 ms. ARP seit F2.4b nach Javas `holeARPTabellenEintrag`, an Java-Filius gemessen: eine Auflösung fragt, wartet eine RTT, fragt ein zweites Mal und gibt nach einer weiteren RTT auf; dann „Host unreachable" beim Absender selbst oder vom Router zurück (bei ICMP nur für Echo-Anfragen); ein wartender Absender wacht nach den übrigen Ereignissen desselben Zeitpunkts auf; der Ping wartet danach eine RTT auf die Antwort. Swift schickt in der Ereignisverarbeitung beide Anfragen zugleich und lässt das Paket ohne Ende warten, wenn die Adresse irgendwo im Netz vorkommt (Wissen, das kein Knoten hat), und blockiert direkte Aufrufe ohne Wartezeit; die Option `swiftArp` behält das für den Swift-Vergleich. Seit F2.4b-2 kehrt ein Senden wie in Java sofort zurück, die Frames reisen, während die Uhr läuft (Swift: der Aufruf kehrt erst zurück, wenn alle Frames angekommen sind; die Option `swiftSends` behält das für den Swift-Vergleich), und UDP und TCP senden über Javas Transport-Thread je Knoten und Protokoll: ein Segment nach dem anderen; solange IP auf ARP wartet, blockiert das nächste `senden`. Wartende Absender kommen in der Reihenfolge an die Reihe, in der sie kamen (Javas Sperre überlässt das dem Zufall). Seit F2.4b-3 geht jedes ankommende Paket wie in Java durch den IP-Thread (UDP, TCP) oder den ICMP-Thread (ICMP) seines Knotens: zustellen, Echo-Reply, weiterleiten, eins nach dem anderen; solange ARP wartet, warten die folgenden. Abweichend von Java weckt eine ARP-Antwort alle, die auf die Adresse warten (Javas `notify` weckt einen beliebigen). DNS seit F2.4a nach Javas `DNSServer`/`Resolver`, an Java-Filius gemessen: Server auf Port 53 mit Einträgen aus dem Modell (die Antwort wiederholt die Frage nicht, RCODE immer 0, ein Verweis mit NS und A im Antwortteil), iterativer Resolver mit 5 RTT je Anfrage, der nur die Server behält, an die er verwiesen wurde; seit F2.4c auf den Ereignissen statt blockierend und mit rekursivem Server nach `DNSServer.answerWithRemoteData` (Nameserver der Zone, dann der eigene DNS-Server, sonst Verweis), abweichend von Java fragt er sich nie selbst (Java endlos). Gateway-NAT seit F2.6 (Z. ~3585–3900) nach Javas `filius.software.nat`, an Java-Filius gemessen: die Übersetzung vor dem IP-Thread (wie Javas NAT-Threads zwischen Karte und Ethernet), ausgehend WAN-Adresse und der Port des Eintrags (ICMP behält die Kennung), eingehend nach Gegenstelle, Port und Protokoll, sonst nach der Portweiterleitung (legt einen dynamischen Eintrag an), ein Ping an die WAN-Adresse beantwortet der Heimrouter, Pakete von außen an das LAN verschwinden, beide Seiten durch die Firewall des Heimrouters, ausgehend TTL 1 bekommt „Zeit überschritten“; dynamische Einträge verfallen nach 300 s mal Javas Verzögerungsfaktor (Swift fest 300 s), aufgefrischt nur eingehend, seit 01.10.2026 genau in diesem Alter (Java findet sie erst bei seiner sekündlichen Prüfung, bis zu 1 s später; so auch der Switch: Javas `checkSAT` prüft jede Sekunde, der Kern verfällt genau zur Lernzeit); der Heimrouter leitet weiter wie ein Router. Abweichend von Java: ein LAN-Endpunkt bekommt für jede neue Gegenstelle einen Eintrag auf demselben WAN-Port (Java behält nur den für die erste, die Antworten weiterer bleiben am Heimrouter hängen). RIP seit F2.5a (Z. ~4700–5090) nach Javas `filius.software.rip`, seit F2.5b an Java-Filius gemessen (die Pause in Javas `float`-Rechnung): eine Route mit 0 Hops je eigenem Netz, die nie verfällt; der erste Beacon nach einer Sekunde, dann alle 25,2–35,2 s aus einem Zufall je Router (Java: ein ungesetzter `Random` je Router; der Kern setzt ihn aus Szenario und Router-ID, `ripSeed`; Swift: ein Zufall für alle); eine Nachricht je Schnittstelle ohne die Routen über sie (Split Horizon); eine neue Route oder mehr Hops vom selben Router senden sofort; eine gelernte Route wird genau nach ihren 75 s auf 16 gesetzt und sofort gemeldet (Java erst beim nächsten eigenen Beacon, bis zu gut 30 s später; Swift bei jedem Ereignis; seit 01.10.2026, vorher wie Java); Nachrichten von jedem Quellport (Swift: nur 521); ein RIP-Router leitet nur nach seiner Tabelle weiter, wenige Hops vor langer Maske. `receiveUdp` kehrt wie Javas `empfangen` zurück, sobald ein Datagramm da ist. Seit der Abnahme F2 nach Javas `ARPThread`: ein Eintrag entsteht nur aus einer Anfrage nach der eigenen Adresse oder aus einer Antwort (Swift: aus jedem Paket; `swiftArp` behält das), ein Paket von der Netzadresse wird verworfen; ein Rechner leitet weiter, wenn seine IP-Weiterleitung an ist (`ipForwardingByNodeId`). Seit F2.8b nach Javas Tabellen gemessen: eine ARP-Anfrage trägt als Ziel-MAC die Broadcast-Adresse (Swift: Nullen; `swiftArp` behält sie), eine ICMP-Fehlermeldung Identifier und Sequenznummer 0 (RFC 792, Java; Swift kopiert die des Echos, ein Ping erkennt die Meldung am eingebetteten Echo), und „Host nicht erreichbar“ vom Router trägt das Paket, wie er es weitergeleitet hat (TTL gesenkt). Die Broadcast-Adresse schreibt sie immer groß (Java in der Antwort an 0.0.0.0 klein). Den Mitschnitt je Karte (`capture.ts`) schreibt sie seit F2.8a dort, wo Java ihn schreibt: beim Abgang auf das Kabel und bei der Ankunft an der Karte. Seit F3.2b starten Router und Heimrouter ihren Webserver auf Port 80 mit Javas Seiten (Javas Server lauscht wegen eines Wettlaufs in `setAktiv` manchmal nie, der Kern immer; `swiftRouters` lässt ihn für den Swift-Vergleich weg), die Firewall führt ein Protokoll je Knoten (Regeltreffer bei TCP und UDP, verworfenes ICMP), das wie Javas Protokollseite einen Neustart überlebt, eine RIP-Route kennt die öffentliche Adresse des meldenden Routers (`hopPublicIp`), und TCP zählt Sequenznummern und Segmentgröße wie Java in Zeichen (UTF-16-Einheiten) statt in Bytes, ohne ein Zeichenpaar zu zerreißen; Bytes, die kein Text sind, zählen als Bytes. Seit F3.2a schließt ein Programm wie Javas `schliessen()` nur auf Bitte (`requestTcpClose`): Das FIN geht zur selben Zeit, nach dem, was der Programm-Thread noch tut. Seit F3.1 laufen Verbinden, Senden, Empfangen und Annehmen auch als Schritte eines Programm-Threads (`connectTcpSteps`, `sendTcpSteps`, `receiveTcpSteps`, `acceptTcpSteps`, `resolveHostSteps`); die blockierenden Aufrufe sind nur noch eine Hülle darum. Abweichend von Java: Ein Verbindungsaufbau ohne Route scheitert sofort (Javas Socket-Thread stirbt an der `RouteNotFoundException`, `verbinden` wartet ewig), eine Nachricht, die vor dem Schließen ankam, wird noch ausgegeben (Java verwirft sie), und Senden unterscheidet wie Java „nicht verbunden", „unterbrochen" und „Zeitüberschreitung". WLAN seit F2.7 an Java-Filius gemessen: zur Laufzeit ist ein Funkkabel ein Kabel wie jedes andere, und eine SSID verbindet nichts (nach ihr legt nur Javas Editor das Funkkabel, `JHostKonfiguration.updateWifiConnection`); Swifts Verbindung über die SSID zur Laufzeit, auch ohne Kabel (`wirelessAssociations`), nicht übernommen. Klasse statt Werttyp. Noch nicht übertragen (wirft `NotPortedError`): Remote Link | +| `src/runtime/engine.ts` | `State/TopologyNetworkRuntimeEngine.swift` Z. ~313–3585, ~4472–5187 (UDP), ~4753–4850 | übertragen: Warteschlange, Uhr, Ethernet, Switch, ARP, IPv4, ICMP, Routing, Firewall, UDP-Sockets (binden, freie Ports nach Javas Zufall, senden samt Broadcast, zustellen, empfangen mit Wartezeit, schließen), TCP (Z. ~5187–5913: Server- und Client-Sockets, Handschlag mit Ergebnis, Segmente zu 1460 Byte bis zum PSH, höchstens drei Versuche, Abbau über alle Java-Zustände samt `TIME_WAIT`; seit F2.3c nach Javas `TCPSocket` an Java-Filius gemessen: je Versuch und für `TIME_WAIT` 3 RTT nach der Geschwindigkeit (8250 ms bei 90 %, Swift fest 7500 bzw. 2500 ms), der Zeitablauf zählt ab der Übergabe des Segments, vor ARP; ein Segment beendet `TIME_WAIT`; die Gegenseite schließt beim FIN von selbst; nicht bestätigte Daten schließen mit FIN statt sofort; der angenommene Socket hat die Startnummer des Listeners, der Listener eine neue. seit F2.3e wie Java: SYN+ACK und FIN gehen nie ein zweites Mal hinaus; der Server gibt einen Handschlag nach 3 RTT auf und schließt mit FIN; nach dem FIN wartet ein Socket höchstens fünfmal 3 RTT, jedes Segment beendet eine Wartezeit, dann CLOSED (Java lässt den Zustand stehen). Abweichend von Java: drei SYN statt einem, weil Javas Wiederholungsschleife nach dem ersten Zeitablauf abbricht, und ein wiederholtes SYN in `SYN_RCVD` bekommt das SYN+ACK noch einmal, statt den Socket zu schließen), DHCP (Z. ~5913–6694: Server mit festen Zuordnungen, Adressbereich, Angeboten, Leases und Sperrliste; Client seit F2.3b nach Javas `DHCPClient` neu gebaut und an Java-Filius gemessen: je Versuch eine Nachricht, eine Antwort, die nicht passt, wird gelesen und verworfen; die ARP-Prüfung wartet eine RTT, eine Antwort für die Adresse beendet sie sofort, dann DECLINE; nach einem Zeitablauf wiederholt der Zustand seine Nachricht, nach dem fünften nimmt der Client eine Link-Local-Adresse `169.254.1.x/16` (ARP-Probe, ARP-Reply an alle) und gibt keine alte Adresse zurück; Swift sendete doppelt, wartete nicht auf ARP und kehrte nach zehn Versuchen zur alten Adresse zurück. Abweichend von Java: Nach fünf belegten Link-Local-Adressen gibt der Client auf (Java sucht endlos), und ein ARP-Paket für eine andere Adresse beendet die Prüfung nicht. Seit F2.3d befördert ein Kabel einen Frame nach dem anderen wie Javas `SimplexVerbindung` (ein Frame wartet im Ausgangspuffer, bis der vorige angekommen ist, und erscheint im Protokoll, wenn er losgeht); Swift schickt alle zugleich, die Option `swiftCables` behält das für den Swift-Vergleich. Die RTT der DHCP-Zeiten (Warten, Angebote, Sperrliste) folgt wie in Java der Geschwindigkeit (50 Kabel, 2750 ms bei 90 %); Swift rechnet fest mit 2500 ms. ARP seit F2.4b nach Javas `holeARPTabellenEintrag`, an Java-Filius gemessen: eine Auflösung fragt, wartet eine RTT, fragt ein zweites Mal und gibt nach einer weiteren RTT auf; dann „Host unreachable" beim Absender selbst oder vom Router zurück (bei ICMP nur für Echo-Anfragen); ein wartender Absender wacht nach den übrigen Ereignissen desselben Zeitpunkts auf; der Ping wartet danach eine RTT auf die Antwort. Swift schickt in der Ereignisverarbeitung beide Anfragen zugleich und lässt das Paket ohne Ende warten, wenn die Adresse irgendwo im Netz vorkommt (Wissen, das kein Knoten hat), und blockiert direkte Aufrufe ohne Wartezeit; die Option `swiftArp` behält das für den Swift-Vergleich. Seit F2.4b-2 kehrt ein Senden wie in Java sofort zurück, die Frames reisen, während die Uhr läuft (Swift: der Aufruf kehrt erst zurück, wenn alle Frames angekommen sind; die Option `swiftSends` behält das für den Swift-Vergleich), und UDP und TCP senden über Javas Transport-Thread je Knoten und Protokoll: ein Segment nach dem anderen; solange IP auf ARP wartet, blockiert das nächste `senden`. Wartende Absender kommen in der Reihenfolge an die Reihe, in der sie kamen (Javas Sperre überlässt das dem Zufall). Seit F2.4b-3 geht jedes ankommende Paket wie in Java durch den IP-Thread (UDP, TCP) oder den ICMP-Thread (ICMP) seines Knotens: zustellen, Echo-Reply, weiterleiten, eins nach dem anderen; solange ARP wartet, warten die folgenden. Abweichend von Java weckt eine ARP-Antwort alle, die auf die Adresse warten (Javas `notify` weckt einen beliebigen). DNS seit F2.4a nach Javas `DNSServer`/`Resolver`, an Java-Filius gemessen: Server auf Port 53 mit Einträgen aus dem Modell (die Antwort wiederholt die Frage nicht, RCODE immer 0, ein Verweis mit NS und A im Antwortteil), iterativer Resolver mit 5 RTT je Anfrage, der nur die Server behält, an die er verwiesen wurde; seit F2.4c auf den Ereignissen statt blockierend und mit rekursivem Server nach `DNSServer.answerWithRemoteData` (Nameserver der Zone, dann der eigene DNS-Server, sonst Verweis), abweichend von Java fragt er sich nie selbst (Java endlos). Gateway-NAT seit F2.6 (Z. ~3585–3900) nach Javas `filius.software.nat`, an Java-Filius gemessen: die Übersetzung vor dem IP-Thread (wie Javas NAT-Threads zwischen Karte und Ethernet), ausgehend WAN-Adresse und der Port des Eintrags (ICMP behält die Kennung), eingehend nach Gegenstelle, Port und Protokoll, sonst nach der Portweiterleitung (legt einen dynamischen Eintrag an), ein Ping an die WAN-Adresse beantwortet der Heimrouter, Pakete von außen an das LAN verschwinden, beide Seiten durch die Firewall des Heimrouters, ausgehend TTL 1 bekommt „Zeit überschritten“; dynamische Einträge verfallen nach 300 s mal Javas Verzögerungsfaktor (Swift fest 300 s), aufgefrischt nur eingehend, seit 01.10.2026 genau in diesem Alter (Java findet sie erst bei seiner sekündlichen Prüfung, bis zu 1 s später; so auch der Switch: Javas `checkSAT` prüft jede Sekunde, der Kern verfällt genau zur Lernzeit); der Heimrouter leitet weiter wie ein Router. Abweichend von Java: ein LAN-Endpunkt bekommt für jede neue Gegenstelle einen Eintrag auf demselben WAN-Port (Java behält nur den für die erste, die Antworten weiterer bleiben am Heimrouter hängen). RIP seit F2.5a (Z. ~4700–5090) nach Javas `filius.software.rip`, seit F2.5b an Java-Filius gemessen (die Pause in Javas `float`-Rechnung): eine Route mit 0 Hops je eigenem Netz, die nie verfällt; der erste Beacon nach einer Sekunde, dann alle 25,2–35,2 s aus einem Zufall je Router (Java: ein ungesetzter `Random` je Router; der Kern setzt ihn aus Szenario und Router-ID, `ripSeed`; Swift: ein Zufall für alle); eine Nachricht je Schnittstelle ohne die Routen über sie (Split Horizon); eine neue Route oder mehr Hops vom selben Router senden sofort; eine gelernte Route wird genau nach ihren 75 s auf 16 gesetzt und sofort gemeldet (Java erst beim nächsten eigenen Beacon, bis zu gut 30 s später; Swift bei jedem Ereignis; seit 01.10.2026, vorher wie Java); Nachrichten von jedem Quellport (Swift: nur 521); ein RIP-Router leitet nur nach seiner Tabelle weiter, wenige Hops vor langer Maske. `receiveUdp` kehrt wie Javas `empfangen` zurück, sobald ein Datagramm da ist. Seit der Abnahme F2 nach Javas `ARPThread`: ein Eintrag entsteht nur aus einer Anfrage nach der eigenen Adresse oder aus einer Antwort (Swift: aus jedem Paket; `swiftArp` behält das), ein Paket von der Netzadresse wird verworfen; ein Rechner leitet weiter, wenn seine IP-Weiterleitung an ist (`ipForwardingByNodeId`). Seit F2.8b nach Javas Tabellen gemessen: eine ARP-Anfrage trägt als Ziel-MAC die Broadcast-Adresse (Swift: Nullen; `swiftArp` behält sie), eine ICMP-Fehlermeldung Identifier und Sequenznummer 0 (RFC 792, Java; Swift kopiert die des Echos, ein Ping erkennt die Meldung am eingebetteten Echo), und „Host nicht erreichbar“ vom Router trägt das Paket, wie er es weitergeleitet hat (TTL gesenkt). Die Broadcast-Adresse schreibt sie immer groß (Java in der Antwort an 0.0.0.0 klein). Den Mitschnitt je Karte (`capture.ts`) schreibt sie seit F2.8a dort, wo Java ihn schreibt: beim Abgang auf das Kabel und bei der Ankunft an der Karte. Seit F3.2c ändert die Seite `konfig` der Router und Heimrouter die Firewall zur Laufzeit; die Änderung steht im Schnappschuss (`firewallConfiguration`), aus dem sie zurück ins Projekt geht. Seit F3.2b starten Router und Heimrouter ihren Webserver auf Port 80 mit Javas Seiten (Javas Server lauscht wegen eines Wettlaufs in `setAktiv` manchmal nie, der Kern immer; `swiftRouters` lässt ihn für den Swift-Vergleich weg), die Firewall führt ein Protokoll je Knoten (Regeltreffer bei TCP und UDP, verworfenes ICMP), das wie Javas Protokollseite einen Neustart überlebt, eine RIP-Route kennt die öffentliche Adresse des meldenden Routers (`hopPublicIp`), und TCP zählt Sequenznummern und Segmentgröße wie Java in Zeichen (UTF-16-Einheiten) statt in Bytes, ohne ein Zeichenpaar zu zerreißen; Bytes, die kein Text sind, zählen als Bytes. Seit F3.2a schließt ein Programm wie Javas `schliessen()` nur auf Bitte (`requestTcpClose`): Das FIN geht zur selben Zeit, nach dem, was der Programm-Thread noch tut. Seit F3.1 laufen Verbinden, Senden, Empfangen und Annehmen auch als Schritte eines Programm-Threads (`connectTcpSteps`, `sendTcpSteps`, `receiveTcpSteps`, `acceptTcpSteps`, `resolveHostSteps`); die blockierenden Aufrufe sind nur noch eine Hülle darum. Abweichend von Java: Ein Verbindungsaufbau ohne Route scheitert sofort (Javas Socket-Thread stirbt an der `RouteNotFoundException`, `verbinden` wartet ewig), eine Nachricht, die vor dem Schließen ankam, wird noch ausgegeben (Java verwirft sie), und Senden unterscheidet wie Java „nicht verbunden", „unterbrochen" und „Zeitüberschreitung". WLAN seit F2.7 an Java-Filius gemessen: zur Laufzeit ist ein Funkkabel ein Kabel wie jedes andere, und eine SSID verbindet nichts (nach ihr legt nur Javas Editor das Funkkabel, `JHostKonfiguration.updateWifiConnection`); Swifts Verbindung über die SSID zur Laufzeit, auch ohne Kabel (`wirelessAssociations`), nicht übernommen. Klasse statt Werttyp. Noch nicht übertragen (wirft `NotPortedError`): Remote Link | | `src/runtime/threads.ts` | Javas Threads der Programme (`Anwendung extends Thread`, `ServerMitarbeiter`) | neu (F3.1): ein Programm-Thread als Generator, der liefert, worauf er wartet (Bedingung, Zeit oder beides); die Engine setzt nach jedem Ereignis fort, wessen Warten vorbei ist, in der Reihenfolge, in der die Threads begannen; nichts blockiert die Engine. Abweichend von Java: ein Thread wacht sofort, wenn seine Bedingung gilt (Java sieht oft nur alle 100 ms nach) | | `src/runtime/apps/program.ts` | Java `filius.software.Anwendung` | neu (F3.1): die Zeilen im Fenster eines Programms (strukturiert, damit der Editor sie übersetzt) und der Befehls-Thread (`ausfuehren`) | | `src/runtime/apps/server.ts` | Java `ServerAnwendung`, `ServerMitarbeiter` | neu (F3.2a, aus `echo.ts` herausgelöst): was jeder Server teilt — ein Thread nimmt Verbindungen an, solange er eingeschaltet ist, je Verbindung einer beantwortet jede Nachricht; ausgeschaltet schließt er Socket und Verbindungen; Port belegt → er schaltet sich aus | -| `src/runtime/apps/web.ts` | Java `filius.software.www` (`WebServer`, `WebServerMitarbeiter`, `WebBrowser`), die Adresszeile aus `GUIApplicationWebBrowserWindow.erzeugeURL` | neu nach Java (F3.2a): Webserver (Dateien unter `/webserver`, `index.html` für `/`, virtuelle Hosts aus `/www.conf/vhosts`, fünf Zeilen, ohne Rücksicht auf Groß- und Kleinschreibung, Inhaltsart nach dem Dateinamen, Bilder und Binärdateien in Javas Base64) und Browser (immer Port 80, Seite, dann ihre Bilder nacheinander über dieselbe Verbindung, dann schließen; Link ohne Host geht an den letzten). An Java-Filius gemessen. Abweichend von Java: nichts außerhalb von `/webserver` (Java löst `/../` auf und liefert jede Datei des Rechners), 400/501 statt eines stummen Abbruchs bei unlesbaren Anfragen, eine Anfrage ohne Version gilt als HTTP/1.1, der Browser zeigt „Server nicht erreichbar“, wenn keine Antwort kommt (Java nichts). Noch nicht: die Seiten der Router (Javas Plug-ins) | +| `src/runtime/apps/web.ts` | Java `filius.software.www` (`WebServer`, `WebServerMitarbeiter`, `WebBrowser`), die Adresszeile aus `GUIApplicationWebBrowserWindow.erzeugeURL` | neu nach Java (F3.2a): Webserver (Dateien unter `/webserver`, `index.html` für `/`, virtuelle Hosts aus `/www.conf/vhosts`, fünf Zeilen, ohne Rücksicht auf Groß- und Kleinschreibung, Inhaltsart nach dem Dateinamen, Bilder und Binärdateien in Javas Base64) und Browser (immer Port 80, Seite, dann ihre Bilder nacheinander über dieselbe Verbindung, dann schließen; Link ohne Host geht an den letzten). An Java-Filius gemessen. Abweichend von Java: nichts außerhalb von `/webserver` (Java löst `/../` auf und liefert jede Datei des Rechners), 400/501 statt eines stummen Abbruchs bei unlesbaren Anfragen, eine Anfrage ohne Version gilt als HTTP/1.1, der Browser zeigt „Server nicht erreichbar“, wenn keine Antwort kommt (Java nichts). Seit F3.2c wie Java: Eine Methode, die nicht genau `GET` oder `POST` heißt (`get`), wird gelesen und mit 501 beantwortet (vorher die Seite) | | `src/runtime/apps/routerPages.ts` | Java `VermittlungsrechnerBetriebssystem`, `GatewayFirmware`, `FirewallWebLog`, `VermittlungWeb`, `FirewallRule.toString`, Vorlagen `tmpl/vermittlung_index`, `gateway_index`, `routing` (de, en) | neu nach Java (F3.2b): die Seiten der Router und Heimrouter in der Sprache des Projekts — Index, `routes` (Weiterleitungs- oder RIP-Tabelle mit Javas Farben, Gültigkeit in ganzen Sekunden) und `log` (Firewall-Protokoll); die Vorlagen per Skript aus Javas Ressourcen übernommen (Zeilen wie Javas `readLine` mit `\n`). Abweichend von Java: `` statt Javas `` auf der deutschen Protokollseite | -| `src/runtime/http.ts` | Java `HTTPNachricht`, Spring `UriUtils.encodePath`/`decode` | neu nach Java (F3.2a): Anfragen und Antworten in Javas Textform, Javas Statustexte, Pfade kodiert wie `UriUtils` | +| `src/runtime/apps/firewallSettings.ts` | Java `FirewallWebKonfig`, Vorlage `tmpl/firewall_konfig_webseite` (de, en), `EingabenUeberpruefung` (`musterPort`, `isValidSubnetmask`) | neu nach Java (F3.2c): die Seite `konfig` der Router und Heimrouter — allgemeine Einstellungen, Standardaktion, Regeln verschieben, löschen, hinzufügen; Fehlerliste und wieder gefülltes Formular, wenn eine Regel nicht passt; Vorlagen per Skript aus Javas Ressourcen. An Java-Filius gemessen (`KonfigCases`, `RouterWebRun`). Abweichend von Java: ein Feld wird erst gegen die anderen geprüft, wenn alle gelesen sind (Java prüft die IP gegen die noch ungelesene Maske und umgekehrt und nimmt so keine Regel mit Adresse an); ein Fehler steht nur auf der Antwort auf das gescheiterte Hinzufügen (Java zeigt ihn auf jeder späteren Seite); bei mehreren Knöpfen kein Fehler ohne Hinzufügen (Java schreibt die nackte Liste); Text aus dem Formular wird maskiert (Java schreibt ihn roh, ein „$“ ließ die Seite scheitern); die Daten werden zerlegt, bevor sie dekodiert werden (Java dekodiert zuerst, ein getipptes „&“ zerriss das Formular), ein Feld ohne gültige URL-Kodierung gilt, wie es kam (Javas Dekodierer wirft, keine Seite kommt); Regel 0 nach unten tut nichts (Java wirft) | +| `src/runtime/http.ts` | Java `HTTPNachricht`, Spring `UriUtils.encodePath`/`decode`, `java.net.URLDecoder` | neu nach Java (F3.2a): Anfragen und Antworten in Javas Textform, Javas Statustexte, Pfade kodiert wie `UriUtils`; seit F3.2c `javaUrlDecode` für Formulardaten wie `URLDecoder.decode` (UTF-8, `+` als Leerzeichen, scheitert, wo Java wirft) | | `src/util/javaBase64.ts` | Java `filius.rahmenprogramm.Base64` (iHarder) | aus `packages/fls` (`exportProject.ts`) in den Kern gezogen (F3.2a), dazu der Leser, der Leerraum überspringt | | `src/runtime/apps/echo.ts` | Java `filius.software.clientserver` (`ServerBaustein`, `ServerBausteinMitarbeiter`, `ClientAnwendung`, `ClientBaustein`) | neu nach Java statt nach Swift (F3.1): Echo-Server (auf `server.ts`, sendet jede Nachricht zurück) und einfacher Client (verbinden über Adresse oder Namen, senden, empfangen, trennen), mit Javas Fensterzeilen. An Java-Filius gemessen. Abweichend von Java: Der Server merkt das Ausschalten, der Client die Verbindung sofort (Java alle 100 ms); ohne Route scheitert der Client sofort (Java wartet ewig ohne Meldung); ausgeschaltet bestätigt der Server noch das FIN seiner Verbindungen (Java gibt den Port frei, das FIN bleibt unbeantwortet) | | `src/runtime/dns.ts` | Java `filius.software.dns.DNSNachricht`, `Query`, `ResourceRecord` | neu nach Java statt nach Swift (Swift ersetzt Javas Textnachrichten durch `FILIUS-DNS-TYPED/1`): Kopfzeile `ID=… QR=… RCODE=… QDCOUNT=… …`, Frage- und Eintragszeilen, Suche nach Namen ohne Rücksicht auf Groß- und Kleinschreibung, NS der längsten Zone, sonst der Wurzel | @@ -45,9 +46,10 @@ Swift-Pfade relativ zu `filius-ipad/ios/FiliusPad/TopologyEditor/` (Stand | `test/javaRun.ts` (`expectSameCaptures`) | — | seit F2.8a: der Mitschnitt jeder Karte gegen Javas Liste dieser Karte (dieselben Frames, dieselbe Folge, dieselbe Zeit), in den Vergleichen für ARP, WLAN, DNS, TCP, NAT, RIP und DHCP mit einem Client; seit F2.8b für jeden dieser Frames auch Javas Tabellenzeilen in beiden Ansichten (Wörter und Zahlen wie Javas deutsches Gebietsschema) | | `test/echoJava.test.ts`, `test/scenarios/echo-java-*.java.json` | — | neu (F3.1): acht Abläufe mit Echo-Server und einfachem Client gegen Java-Filius (`EchoRun`): je Karte Frames, Zeiten und Tabellenzeilen, dazu die Fensterzeilen beider Programme auf Deutsch wie Java (Zeilen, die Java erst bei seinem 100-ms-Blick schreibt, dürfen dort bis zu 100 ms später kommen); drei benannte Java-Fehler (`JAVA_BUGS`: keine Route, nur ein SYN, das unbeantwortete FIN nach dem Ausschalten) | | `test/webJava.test.ts`, `test/scenarios/web-lan.scenario.json`, `test/scenarios/web-java-*.java.json`, `test/programLines.ts` | — | neu (F3.2a): elf Abläufe mit Webserver und Browser gegen Java-Filius (`WebRun`, mit den Dateien des Servers): je Karte Frames, Zeiten, Tabellen, die Fensterzeilen des Servers, Seiten und Bilder des Browsers (Fehlerseiten nach Status); Javas Threads hinken bei langen Übertragungen bis zu 130 ms nach, verglichen auf 200 ms; drei benannte Java-Fehler (`JAVA_BUGS`: `/../` liefert fremde Dateien, `HALLO` beendet die Verbindung stumm, nur ein SYN). `programLines.ts`: die Fensterzeilen der Programme auf Deutsch, geteilt mit `echoJava.test.ts` | -| `test/routerWebJava.test.ts`, `test/scenarios/router-web.scenario.json`, `test/scenarios/routerweb-java-*.java.json` | — | neu (F3.2b): sechs Abläufe mit den Seiten der Router und Heimrouter gegen Java-Filius (`RouterWebRun`): Index, Routen (Weiterleitung und RIP), Protokoll nach verworfenem Ping und Regeltreffern, Heimrouter von innen und außen; Startnummern ohne die Million (Javas Router-Server lauscht nicht immer), die Gültigkeit der RIP-Routen als Platzhalter (Javas versetzter Start); ein benannter Java-Fehler (``) | -| `test/routerPages.test.ts` | — | neu (F3.2b): Farben und Hops der Routen-Seite, RIP bei 16 Hops und Sekunden, Index in beiden Sprachen, Regeltexte, UDP im Protokoll und das Protokoll über einen Neustart, Server beim Start und `swiftRouters`, öffentliche Adresse bei kürzerem Weg, TCP in Zeichen | -| `test/web.test.ts` | — | neu (F3.2a): HTTP-Form, Pfadkodierung, Base64, Adresszeile, Bildersuche; am Server 400/501, Durchgriff, Ordner, Inhaltsarten, Binärdateien, virtuelle Hosts (fünf Zeilen, Schalter ohne Datei); am Browser Seite und Bilder, Link ohne Host, nur HTML sucht Bilder, keine Adresse, keine Antwort | +| `test/routerWebJava.test.ts`, `test/scenarios/router-web.scenario.json`, `test/scenarios/routerweb-java-*.java.json` | — | neu (F3.2b): sechs Abläufe mit den Seiten der Router und Heimrouter gegen Java-Filius (`RouterWebRun`): Index, Routen (Weiterleitung und RIP), Protokoll nach verworfenem Ping und Regeltreffern, Heimrouter von innen und außen; seit F3.2c drei mit `konfig`: die Seite, „ICMP filtern“ aus und der Ping kommt durch, eine Regel angelegt und nach oben geschoben sperrt den Browser aus (benannter Java-Fehler: nur ein SYN); Startnummern ohne die Million (Javas Router-Server lauscht nicht immer), die Gültigkeit der RIP-Routen als Platzhalter (Javas versetzter Start); ein benannter Java-Fehler (``) | +| `test/routerPages.test.ts` | — | neu (F3.2b): Farben und Hops der Routen-Seite, RIP bei 16 Hops und Sekunden, Index in beiden Sprachen, Regeltexte, UDP im Protokoll und das Protokoll über einen Neustart, Server beim Start und `swiftRouters`, öffentliche Adresse bei kürzerem Weg, TCP in Zeichen; seit F3.2c `konfig` über das Netz: Änderung in den Schnappschuss, eine Seite ohne Daten ändert nichts, Englisch, Heimrouter | +| `test/firewallSettings.test.ts`, `test/firewall-settings.cases.txt`, `test/firewall-settings.{de,en}.java.json` | — | neu (F3.2c): 25 Fälle der Seite `konfig` gegen Java-Filius (`KonfigCases`), je Schritt Seite und Firewall, Deutsch und Englisch, darunter die Formulardaten, wie Javas Browserfenster (Swing) sie schickt; zehn benannte Java-Fehler (`JAVA_BUGS`), die erwartete Seite jeweils aus einem Java-Lauf mit demselben Zustand; dazu `javaUrlDecode` | +| `test/web.test.ts` | — | neu (F3.2a): HTTP-Form, Pfadkodierung, Base64, Adresszeile, Bildersuche; am Server 400/501 (seit F3.2c auch für `get` und `Post`), Durchgriff, Ordner, Inhaltsarten, Binärdateien, virtuelle Hosts (fünf Zeilen, Schalter ohne Datei); am Browser Seite und Bilder, Link ohne Host, nur HTML sucht Bilder, keine Adresse, keine Antwort | | `test/apps.test.ts` | — | neu (F3.1): wie Threads aufwachen (nach dem Ereignis, nach einer Pause hinter den anderen, ein Weckruf nur für sein Warten, Reihenfolge des Beginns, kein Warten auf schon Geltendes), und was die Java-Abläufe nicht zeigen: belegter Port, Name über DNS und ohne DNS, keine Route, unbestätigtes Senden, Neustart, eine Nachricht vor dem Schließen | | `test/captureRows.test.ts` | — | neu (F2.8b): die Regeln der Tabelle, die kein Java-Lauf zeigt (GNT, POP3, SMTP, HTTP, Javas `trim`, ICMP-Fehler mit eingebettetem ICMP, Ansicht ohne Enden) | | `test/wlanJava.test.ts`, `test/scenarios/wlan-lan.scenario.json`, `test/scenarios/wlan-java-*.java.json` | — | neu: vier Pings gegen Java-Filius (`WlanRun`): über Funkkabel, über ein Kabel und an ein Notebook mit der SSID des Switches, aber ohne Kabel (ARP scheitert in Java wie im Kern); Frames, Abstände, Ergebnis und Dauer | @@ -64,7 +66,7 @@ Swift-Pfade relativ zu `filius-ipad/ios/FiliusPad/TopologyEditor/` (Stand | `src/archive.ts` | ebenda, Archiv-Teil von Import und Export | übertragen, ohne die XML-Ebene | | `src/javabeans.ts`, `src/javaDefaults.json` | — | neu: XMLEncoder-Leser nach den Regeln von `java.beans.XMLDecoder` (Swift liest elementweise und verliert geteilte Werte); Getter-Standardwerte und statische Konstanten mit `tools/java-oracle` gemessen; merkt sich den Java-Typ jedes Primitivs an Settern, Konstruktor- und Aufrufargumenten und welche Eigenschaften ein eigener Getter angelegt hat (für `beanCapture.ts`) | | `src/importProject.ts` | `Persistence/TopologyProjectStore.swift` (Knoten, Ports, Kabel, IP-Konfiguration, Switch/WLAN, Routen, RIP, Firewall, DHCP, Portweiterleitung, Modem, Dateisysteme, Programme, Doku-Elemente des Imports) | übertragen, Eingabe ist Javas Sicht: Name und Port-Anzahl wie Java, abgelehnte Adresse → Swift-Standard, Router-Standardgateway wie Java (Swift verliert es), jede Router-Firewall eingetragen, Konfigurationstexte wie in Swift getrimmt (`swiftTrim`), Rechner ohne Dateisystem leer wie in Java (Swift: Demo-Dateien), alle Programme bleiben (Swift verwirft sechs), Webserver-Dateien bleiben in `/webserver` (Swift: `/www`), keine versteckten Zustandsdateien im Dateisystem, DNS-Einträge so, wie Javas Server sie aus `/dns/hosts` beantwortet, WLAN eines Rechners eingeschaltet nach Javas Funk-Merkmal der Karte (auch ohne SSID; Swift: jede SSID); der Webserver behält Javas Schalter für virtuelle Hosts (Swift: aus); gegen Swifts importiertes Modell auf 13 Dateien geprüft; seit der Abnahme F2 die IP-Weiterleitung eines Knotens, wo sie vom Standard seiner Art abweicht (`ipForwardingByNodeId`; Java `ipForwardingEnabled`, übersehen bis das Firewall-Beispiel lief) | -| `test/importProject.test.ts` | — | neu: Swifts importiertes Modell (13 Dateien, begründete Abweichungen; im Dateisystem ausgenommen nur Swifts versteckte Zustandsdateien), Vollständigkeit aller 23, Pings im Kern (über einen Router; über drei Router mit manuellen Routen und Router-Gateways; seit F2.7 über Funkkabel); seit der Abnahme F2 IP-Weiterleitung und eingeschaltete DNS-Server im Schnappschuss | +| `test/importProject.test.ts` | — | neu: Swifts importiertes Modell (13 Dateien, begründete Abweichungen; im Dateisystem ausgenommen nur Swifts versteckte Zustandsdateien), Vollständigkeit aller 23, Pings im Kern (über einen Router; über drei Router mit manuellen Routen und Router-Gateways; seit F2.7 über Funkkabel); seit der Abnahme F2 IP-Weiterleitung und eingeschaltete DNS-Server im Schnappschuss; seit F3.2c eine Firewall, über `konfig` im Lauf geändert, gespeichert und wieder geöffnet (`internetwork_komplett.fls`) | | `src/systemSoftware.ts` | Java `SwitchFirmware`, `Betriebssystem`, `VermittlungsrechnerBetriebssystem`, `GatewayFirmware`, `Weiterleitungstabelle`, `Firewall`, `FirewallRule`, `DHCPServer`, `ModemFirmware`, `Dateisystem`, `Datei` | neu nach Java: SSID, Lernzeit, RIP, manuelle Routen, Router-Firewall (an allen Stellen, an denen die Datei sie erreicht), DHCP (ein kaputter statischer Eintrag fällt allein weg, Java verliert alle folgenden), statische NAT, Modem, Dateisystem (bei Router und Heimrouter das, was die Datei zu den Vorlagen des Konstruktors hinzufügt, oder eine eigene Wurzel, die sie ersetzt), installierte Programme von Rechner und Notebook (eigene Anwendungen eines Projekts als erfasste Bean, `beanCapture.ts`); `Character.isWhitespace` am JDK gemessen; gegen Java geprüft; seit der Abnahme F2 `ipForwardingEnabled` jedes Knotens mit IP-Stapel, mit Javas Standard der Klasse (Router und Heimrouter an) | | `src/javaIp.ts` | Java `IP.inetAton`/`ipCheck` | neu nach Java; an 46 Fällen mit Java gemessen; seit F2.5a in `packages/core/src/util/javaIp.ts` (der Kern liest damit RIP-Nachrichten) | | `src/dnsHosts.ts` | Java `DNSServer.leseRecordListe`, `ResourceRecord`, `Dateisystem.holeDatei`; Swift `State/TopologyDNSResolver.swift` (`TopologyDNSHostsFileCodec`) als Vergleich | neu nach Java: Felder nur an einzelnen Leerzeichen, keine Kommentare, ungültige TTL → 3600, Doppelte bleiben; ins Modell kommt nur, was Java beantwortet (Typ A/MX/NS, Name nicht leer); Javas Fehler nicht übernommen: Label mit Ziffer vorn erlaubt, kein Backslash, letztes Label nicht rein numerisch (RFC 1123/3696), Typ in jeder Schreibung (RFC 4343), negative TTL ungültig (RFC 2181); an 76 Fällen mit Java und Swift gemessen | @@ -76,7 +78,7 @@ Swift-Pfade relativ zu `filius-ipad/ios/FiliusPad/TopologyEditor/` (Stand | `src/beanCapture.ts` | — | neu: eine decodierte Bean zurück in die Form des Schreibers, mit Javas Zahlentypen; der Verweis auf das Betriebssystem des Knotens als Marke; was das Format nicht sagen kann (Unaufgelöstes, `Field`, Fabrikmethode, ein anderswo per Getter erreichtes Objekt), wird abgelehnt, nicht geraten; Rundlauf-Tests in `test/beanCapture.test.ts` | | `src/javaBeansWriter.ts` | — | neu: Schreiber für das `XMLDecoder`-Format, Gegenstück zu `javabeans.ts`; ausdrücklich typisierte Eingabe, geteilte Objekte über `id`/`idref`, was XML nicht fassen kann (und CR) als ``; von Java selbst geprüft (`BeansDump`) | | `test/javaBeansWriter.test.ts`, `test/beans/` | — | neu: 11 Dateien des Schreibers, von Javas `XMLDecoder` gelesen und beschrieben; Erwartungen von Hand | -| `src/projectSnapshot.ts` | Swift `TopologyNetworkRuntimeTopologySnapshot(editorState:)` | neu (Abnahme F2): das importierte Projekt als Schnappschuss des Kerns; nur die Kabel verbinden (Swifts Verbindung über die SSID nicht übernommen), nur eingeschaltete DNS-Server laufen; seit F3.1 jeder installierte Echo-Server (ein oder aus, er lässt sich zur Laufzeit schalten) und einfache Client; seit F3.2a jeder Webserver und Browser und die Dateisysteme | +| `src/projectSnapshot.ts` | Swift `TopologyNetworkRuntimeTopologySnapshot(editorState:)` | neu (Abnahme F2): das importierte Projekt als Schnappschuss des Kerns; nur die Kabel verbinden (Swifts Verbindung über die SSID nicht übernommen), nur eingeschaltete DNS-Server laufen; seit F3.1 jeder installierte Echo-Server (ein oder aus, er lässt sich zur Laufzeit schalten) und einfache Client; seit F3.2a jeder Webserver und Browser und die Dateisysteme; seit F3.2c der Rückweg `projectWithSimulationChanges`: die Firewalls aus dem Schnappschuss des Laufs ins Projekt, wie Java sie beim Speichern hat | | `test/examplesJava.test.ts`, `test/examples/*.java.json` | — | neu (Abnahme F2): fünf Beispiele von Filius (`internetwork_komplett`, `einfaches_rechnernetz_komplett`, `dns_server`, `nat_with_mapped_port`, `Internet_Komplett_…_DE`) mit dem eigenen Leser eingelesen und im Kern gespielt, gegen Java-Filius (`ExampleRun`): je Karte Frames, Zeiten und Tabellenzeilen, die Aufrufe, die Adressen am Ende; gleichzeitig startende DHCP-Clients je Client; zwei benannte Java-Fehler (`JAVA_BUGS`: Ping ohne Gateway wirft eine `NullPointerException`; NAT-Eintrag nur für die erste Gegenstelle) | | `src/topologyWriter.ts` | Java `SzenarioVerwaltung.netzwerkSpeichern`, Konstruktoren von `NetzwerkInterface`, `Port`, `GUIKabelItem` und der Systemsoftware | neu nach Java: `konfiguration.xml` aus Javas Sicht — Geräte, Schnittstellen (vom Konstruktor angelegte über Getter, weitere per `add`), Ports über Getter-Verweise, Kabel samt Zeichen-Enden (`kabelpanel`), Doku-Elemente; Systemsoftware über ihre Setter: SSID, Lernzeit, RIP, manuelle Routen, DHCP-Client und -Server, statische NAT, Modem, Router-Firewall (über das `konfig`-Plug-in des Webservers, wie XMLEncoder sie erreicht); eigene Anwendungen eines Projekts, wie die Datei sie hatte; Dateisysteme (an die Wurzel des Konstruktors angehängt wie bei XMLEncoder, beim Router hinter dessen Vorlagen); installierte Programme nach den Dateien (Webserver, Tauschbörse und E-Mail-Server legen ihre Ordner nur an, wo sie fehlen; der DNS-Server liest `/dns/hosts` beim Installieren), je unter ihrem Schlüssel mit der Systemsoftware wie `installApp`, samt Einstellungen und persönlicher Firewall; E-Mail: Domain und Bean-Konten des Servers samt Postfächern, Ordner und Adressbuch des Clients (sein Konto steht in `/konten.txt`, einer Datei); Javas Fehler nicht übernommen: ein Empfänger, den eine ältere Datei als Zeichenkette hält, wird als der `AddressEntry` geschrieben, den Javas `AddressEntry(String)` daraus macht (Java legt die Zeichenkette ungeprüft in die typisierte Liste, sein E-Mail-Fenster scheitert daran), ein `null`-Empfänger fällt weg; Kopf „Filius version: 2.14.0 (mdg-filius)“; seit der Abnahme F2 `ipForwardingEnabled`, wo es vom Standard der Klasse abweicht | | `test/topologyWriter.test.ts`, `test/written.java.json` | — | neu: alle 23 Korpus-Dateien gelesen und neu geschrieben, von Java geladen — Topologie, Systemsoftware, Dateisysteme und Programme samt E-Mail wie beim Original (bis auf die benannte Abweichung bei Empfängern als Zeichenkette, nur in `man-in-the-middle.fls`) (Java gegen Java); dazu eine künstliche Topologie mit dem, was der Korpus nicht hat (u. a. eingeschaltete Router-Firewall mit Regeln jedes Protokolls, alle Firewall-Schalter abseits der Vorgabe, Modem mit eigenem Port und Ziel, verschachtelter Dateibaum mit umbenannter Wurzel, namenlosem Ordner, Datei ohne Typ und Inhalt mit CR/CRLF und Zeichen jenseits der BMP, Heimrouter mit eigener Wurzel, jedes Filius-Programm mit Einstellungen abseits der Vorgabe samt persönlicher Firewall, von Java angelegte Ordner `/peer2peer` und `/mailserver`, E-Mail-Server und -Client mit Konto, Postfach, drei Ordnern, Adressbuch und Empfängern aller Formen) | diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts index e4fcc5c..5976c74 100644 --- a/packages/core/src/index.ts +++ b/packages/core/src/index.ts @@ -23,6 +23,7 @@ export * from './runtime/apps/server.js'; export * from './runtime/apps/echo.js'; export * from './runtime/apps/web.js'; export * from './runtime/apps/routerPages.js'; +export * from './runtime/apps/firewallSettings.js'; export * from './runtime/http.js'; export * from './util/equal.js'; export * from './util/javaBase64.js'; diff --git a/packages/core/src/runtime/apps/firewallSettings.ts b/packages/core/src/runtime/apps/firewallSettings.ts new file mode 100644 index 0000000..d63c89e --- /dev/null +++ b/packages/core/src/runtime/apps/firewallSettings.ts @@ -0,0 +1,239 @@ +// The firewall settings page of routers and home routers (FirewallWebKonfig, +// the web server's plug-in konfig), written as Java writes it: from its +// template (tmpl/firewall_konfig_webseite) and the texts of its message +// bundle, in the project's language. A form posted to it changes the +// firewall: the general settings, the default action, the order of the +// rules, a rule deleted or added. +// +// Departures from Java (firewallSettings.test.ts names each): +// - a field is checked against the others once all are read. Java checks +// the source IP against a mask not read yet, and the mask against an IP +// not read yet, whatever their order; it takes no rule with a source or +// destination address. +// - an error shows on the answer to the add that failed, not on later pages +// (Java keeps it), and only when adding was the action (with several +// buttons Java writes the bare list). +// - what the form sent is escaped on the page (Java writes it as it is; a +// "$" made Java's page fail). +// - the data is split into its fields before they are decoded: an "&" or +// "=" typed into a field stays there (Java decodes first, and so splits +// the field); a field that is no URL encoding is read as it came, as Java +// means to (its decoder throws and no page comes). +// - moving rule 0 down does nothing (Java throws). + +import { ALL_PORTS, firewallRule, type FirewallAction, type FirewallConfiguration } from '../config.js'; +import { javaTrim, javaUrlDecode } from '../http.js'; +import { firewallActionText, type PageLanguage } from './routerPages.js'; +import { IP_ADDRESS_PATTERN } from './web.js'; + +/** Java's template as WebServerPlugIn.textDateiEinlesen reads it: each line ended by "\n". */ +const TEMPLATE: Record = { + de: "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n:errorMsg:\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n:firewallActivate:\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n:dropICMP:\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n:onlySYN:\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n:ruleset:\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n:errorMsg:\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + en: "\n \n Router Firewall Configuration\n \n\n \n:errorMsg:\n
\n

Router Firewall Configuration

\n \n \n \n \n \n
\n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
\n:firewallActivate:\n Activate firewall
\n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
\n:dropICMP:\n Filter ICMP packets
\n All ICMP packets, e.g., ping requests, will be dropped.\n
\n:onlySYN:\n \n\t only drop SYN packets\n\t
\n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
\n
\n\n
\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Firewall rules:


\n The rules are evaluated from top to bottom.
\n If a rule matches, the given action will be followed.\n
\n If no rule applies, the following default policy is used:
\n \n \n
\n \n \n \n \n \n \n \n \n \n \n \n \n\n:ruleset:\n\n
no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
\n \n
\n Action for selected rule:\n
\n \n \n \n
\n\n
\n\n:errorMsg:\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Create new rule


\n All fields are optional and will be
-- if empty --
ignored for filtering.\n
source IP:
source subnet mask:
dest. IP:
dest. subnet mask:
protocol: \n \n
port:
action: \n \n
\n \n
\n
\n
\n \n\n", +}; + +/** What is wrong with a rule to add (firewallwebkonfig_msg2 to msg7). */ +export type FirewallSettingsError = 'sourceIPAddress' | 'sourceSubnetMask' | 'destinationIPAddress' | 'destinationSubnetMask' | 'port' | 'maskWithoutAddress'; + +const ERROR_TEXTS: Record> = { + de: { + heading: 'Fehlerhafte Eingabe(n):', + sourceIPAddress: 'Quell-IP ungültig', + sourceSubnetMask: 'Quell-Subnetzmaske leer oder ungültig', + destinationIPAddress: 'Ziel-IP ungültig', + destinationSubnetMask: 'Ziel-Subnetzmaske leer oder ungültig', + port: 'Port ungültig', + maskWithoutAddress: 'Subnetzmaske angegeben, aber keine IP', + }, + en: { + heading: 'Erroneous input(s):', + sourceIPAddress: 'Source IP invalid', + sourceSubnetMask: 'Source subnet mask empty or invalid', + destinationIPAddress: 'Dest. IP invalid', + destinationSubnetMask: 'Dest. subnet mask empty or invalid', + port: 'Port invalid', + maskWithoutAddress: 'Subnet mask available, but no IP given', + }, +}; + +/** A rule that could not be added: the form's fields as they came, and what is wrong. */ +export interface RejectedFirewallRule { + readonly sourceIPAddress: string; + readonly sourceSubnetMask: string; + readonly destinationIPAddress: string; + readonly destinationSubnetMask: string; + readonly protocol: 'all' | 'tcp' | 'udp'; + readonly portText: string; + readonly action: FirewallAction; + readonly errors: readonly FirewallSettingsError[]; +} + +export interface FirewallSettingsResult { + readonly configuration: FirewallConfiguration; + readonly rejected?: RejectedFirewallRule; +} + +/** Java's String.split on a character: trailing empty pieces dropped (for "" Java keeps one; nothing here tells them apart). */ +function javaSplit(text: string, separator: string): string[] { + const pieces = text.split(separator); + while (pieces.length > 0 && pieces[pieces.length - 1] === '') pieces.pop(); + return pieces; +} + +/** + * Integer.parseInt for ASCII digits: undefined where Java throws. Beyond + * Java's int it reads on; no number that large passes any check here. + */ +function javaParseInt(text: string): number | undefined { + return /^[+-]?[0-9]+$/.test(text) ? Number.parseInt(text, 10) : undefined; +} + +/** EingabenUeberpruefung.musterPort. */ +const PORT_PATTERN = /^([1-9]|[1-9][0-9]{1,3}|[1-5][0-9]{1,4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$/; + +/** EingabenUeberpruefung.isValidSubnetmask: four numbers of 0 to 255 whose bits are ones, then zeros (at least one one). */ +function isValidSubnetMask(text: string): boolean { + const pieces = javaSplit(text, '.'); + if (pieces.length !== 4) return false; + let bits = ''; + for (const piece of pieces) { + const value = javaParseInt(piece); + if (value === undefined || value < 0 || value > 255) return false; + bits += value.toString(2).padStart(8, '0'); + } + return /^11*0*$/.test(bits); +} + +/** + * FirewallWebKonfig.processParameters: what a form posted to the page does + * to the firewall. A browser posts every field of the form, in its order, + * and the button pressed. The data's pairs are read in order (the last of a + * name counts); of the buttons, the first in Java's order acts: save the general + * settings, set the default action, move the chosen rule up or down, delete + * it, add a rule. No data (a GET) changes nothing, nor do data without a + * button. + */ +export function applyFirewallSettings(configuration: FirewallConfiguration, postData: string | undefined): FirewallSettingsResult { + if (postData === undefined) return { configuration }; + const decoded = (text: string) => javaTrim(javaUrlDecode(text) ?? text); + const pairs = javaSplit(postData, '&').map((piece) => { + const parts = javaSplit(piece, '='); + return [decoded(parts[0] ?? ''), decoded(parts[1] ?? '')] as const; + }); + const last = (name: string) => pairs.findLast(([each]) => each === name)?.[1] ?? ''; + const has = (name: string) => pairs.some(([each]) => each === name); + + const sourceIPAddress = last('srcIP'); + const sourceSubnetMask = last('srcMask'); + const destinationIPAddress = last('destIP'); + const destinationSubnetMask = last('destMask'); + const errors: FirewallSettingsError[] = []; + let radioRule = -1; + let port = ALL_PORTS; + for (const [name, value] of pairs) { + if (name === 'srcIP' && value !== '') { + if (!IP_ADDRESS_PATTERN.test(value)) errors.push('sourceIPAddress'); + if (!isValidSubnetMask(sourceSubnetMask)) errors.push('sourceSubnetMask'); + } else if (name === 'srcMask' && value !== '') { + if (!isValidSubnetMask(value)) errors.push('sourceSubnetMask'); + if (sourceIPAddress === '') errors.push('maskWithoutAddress'); + } else if (name === 'destIP' && value !== '') { + if (!IP_ADDRESS_PATTERN.test(value)) errors.push('destinationIPAddress'); + if (!isValidSubnetMask(destinationSubnetMask)) errors.push('destinationSubnetMask'); + } else if (name === 'destMask' && value !== '') { + if (!isValidSubnetMask(value)) errors.push('destinationSubnetMask'); + if (destinationIPAddress === '') errors.push('maskWithoutAddress'); + } else if (name === 'port') { + const parsed = javaParseInt(value); + if (parsed !== undefined) { + port = parsed; + if (port !== ALL_PORTS && !PORT_PATTERN.test(value)) errors.push('port'); + } else if (value !== '') { + errors.push('port'); + } + } else if (name === 'radioRule') { + radioRule = javaParseInt(value) ?? radioRule; + } + } + const protocolText = last('protocol'); + const protocol = protocolText === 'TCP' ? 'tcp' : protocolText === 'UDP' ? 'udp' : 'all'; + const action: FirewallAction = last('action') === 'accept' ? 'accept' : 'drop'; + + const rules = [...configuration.rules]; + if (has('btnSave')) { + return { configuration: { ...configuration, isActive: has('firewallActivate'), dropIcmp: has('dropICMP'), filterSynSegmentsOnly: has('onlySYN') } }; + } + if (has('defPolSet')) return { configuration: { ...configuration, defaultPolicy: last('defaultPolicy') === 'accept' ? 'accept' : 'drop' } }; + if (has('moveup')) { + if (radioRule > 1 && radioRule <= rules.length) rules.splice(radioRule - 2, 0, ...rules.splice(radioRule - 1, 1)); + return { configuration: { ...configuration, rules } }; + } + if (has('movedown')) { + if (radioRule >= 1 && radioRule < rules.length) rules.splice(radioRule, 0, ...rules.splice(radioRule - 1, 1)); + return { configuration: { ...configuration, rules } }; + } + if (has('delrule')) { + if (radioRule >= 1 && radioRule <= rules.length) rules.splice(radioRule - 1, 1); + return { configuration: { ...configuration, rules } }; + } + if (!has('addrule')) return { configuration }; + if (errors.length > 0) { + const portText = last('port'); + return { configuration, rejected: { sourceIPAddress, sourceSubnetMask, destinationIPAddress, destinationSubnetMask, protocol, portText, action, errors } }; + } + rules.push(firewallRule({ sourceIPAddress, sourceSubnetMask, destinationIPAddress, destinationSubnetMask, port, protocol, action })); + return { configuration: { ...configuration, rules } }; +} + +/** Text from the form or the rules, as it may stand in the page. */ +function escaped(text: string): string { + return text.replaceAll('&', '&').replaceAll('<', '<').replaceAll('>', '>').replaceAll('"', '"'); +} + +function checkbox(name: string, checked: boolean): string { + return `\t\t`; +} + +/** + * FirewallWebKonfig.konfigSeiteErstellen: the page with the firewall's + * settings and rules; after a rule that could not be added, what is wrong + * and the form's fields as they came. + */ +export function firewallSettingsPage(configuration: FirewallConfiguration, language: PageLanguage, rejected?: RejectedFirewallRule): string { + const ruleTable = configuration.rules + .map((rule, index) => { + const protocol = rule.protocol === 'tcp' ? 'TCP' : rule.protocol === 'udp' ? 'UDP' : ''; + return ( + ` ${index + 1}` + + `${escaped(rule.sourceIPAddress)}${escaped(rule.sourceSubnetMask)}${escaped(rule.destinationIPAddress)}${escaped(rule.destinationSubnetMask)}` + + `${protocol}${rule.port >= 0 ? rule.port : ''}${firewallActionText(rule.action, language)}` + ); + }) + .join(''); + const texts = ERROR_TEXTS[language]; + const selected = (yes: boolean) => (yes ? ' selected' : ''); + const fields: Record = { + ':action_pfad:': 'konfig', + ':firewallActivate:': checkbox('firewallActivate', configuration.isActive), + ':dropICMP:': checkbox('dropICMP', configuration.dropIcmp), + ':onlySYN:': checkbox('onlySYN', configuration.filterSynSegmentsOnly), + ':defPolDropSelected:': configuration.defaultPolicy === 'accept' ? '' : ' selected="selected"', + ':defPolAcceptSelected:': configuration.defaultPolicy === 'accept' ? ' selected="selected"' : '', + ':ruleset:': ruleTable, + ':errorMsg:': + rejected === undefined + ? '' + : `${texts.heading}
    ${rejected.errors.map((error) => `
  • ${texts[error]}
    • `).join('')}

`, + ':srcIP:': escaped(rejected?.sourceIPAddress ?? ''), + ':srcMask:': escaped(rejected?.sourceSubnetMask ?? ''), + ':destIP:': escaped(rejected?.destinationIPAddress ?? ''), + ':destMask:': escaped(rejected?.destinationSubnetMask ?? ''), + ':port:': escaped(rejected?.portText ?? ''), + ':optionProtAll:': selected(rejected?.protocol === 'all'), + ':optionProtTCP:': selected(rejected?.protocol === 'tcp'), + ':optionProtUDP:': selected(rejected?.protocol === 'udp'), + ':optionActionDrop:': selected(rejected?.action === 'drop'), + ':optionActionAccept:': selected(rejected?.action === 'accept'), + }; + return TEMPLATE[language].replace(/:[A-Za-z_]+:/g, (placeholder) => fields[placeholder] ?? placeholder); +} diff --git a/packages/core/src/runtime/apps/routerPages.ts b/packages/core/src/runtime/apps/routerPages.ts index 3073480..7e17dfb 100644 --- a/packages/core/src/runtime/apps/routerPages.ts +++ b/packages/core/src/runtime/apps/routerPages.ts @@ -81,6 +81,11 @@ const TEXTS: Record = { }, }; +/** jfirewalldialog_msg33, msg34: a rule's action as the pages name it. */ +export function firewallActionText(action: 'accept' | 'drop', language: PageLanguage): string { + return action === 'accept' ? TEXTS[language].accept : TEXTS[language].drop; +} + /** The index page a router or home router keeps in /webserver (WebServer.erzeugeIndexDatei). */ export function routerIndexPage(kind: 'router' | 'gateway', language: PageLanguage): string { return TEMPLATES[kind === 'router' ? 'routerIndex' : 'gatewayIndex'][language]; @@ -114,7 +119,7 @@ export function firewallLogText(entry: FirewallLogEntry, language: PageLanguage) if (entry.kind === 'icmpDropped') { return `${texts.icmpDropped} ${entry.senderIPAddress} -> ${entry.receiverIPAddress} (code: ${entry.code}, type: ${entry.type})`; } - return `${texts.ruleMatched} #${entry.ruleNumber} (${firewallRuleText(entry.rule, entry.firstInterface)}) -> ${entry.accepted ? texts.accept : texts.drop}`; + return `${texts.ruleMatched} #${entry.ruleNumber} (${firewallRuleText(entry.rule, entry.firstInterface)}) -> ${firewallActionText(entry.accepted ? 'accept' : 'drop', language)}`; } /** FirewallWebLog.holeHtmlSeite: the log since the engine was made. */ diff --git a/packages/core/src/runtime/apps/web.ts b/packages/core/src/runtime/apps/web.ts index 221b2d5..8fb9c2b 100644 --- a/packages/core/src/runtime/apps/web.ts +++ b/packages/core/src/runtime/apps/web.ts @@ -129,6 +129,8 @@ export class WebServer extends TcpServerProgram { }); const parsed = parseHttpRequest(message); if (parsed.type === 'invalid') return response(parsed.statusCode); + // HTTPNachricht reads the method in any case; the server answers only GET and POST as written. + if (parsed.request.method !== HTTP_GET && parsed.request.method !== HTTP_POST) return response(501); const path = httpPath(parsed.request.path); let file = path === '/' ? 'index.html' : path.startsWith('/') ? path.slice(1) : path; let folder = this.virtualHostFolder(parsed.request.host); @@ -189,7 +191,7 @@ function javaSplit(text: string, separator: string): string[] { /** EingabenUeberpruefung.musterDomain and musterIpAdresse. */ const DOMAIN_PATTERN = /^([a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9]){0,1}(\.[a-zA-Z]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9]){0,1})*){0,1}\.{0,1}$/; -const IP_ADDRESS_PATTERN = +export const IP_ADDRESS_PATTERN = /^(0*([1-9]?[0-9]?|1[0-9]{1,2}|2[0-4]?[0-9]|25[0-5]))\.((0*(1?[0-9]{1,2}|2[0-4]?[0-9]|25[0-5]))\.){2}(0*(1?[0-9]{1,2}|2[0-4]?[0-9]|25[0-5]))$/; function isHostName(text: string): boolean { diff --git a/packages/core/src/runtime/engine.ts b/packages/core/src/runtime/engine.ts index a97be87..cb377e3 100644 --- a/packages/core/src/runtime/engine.ts +++ b/packages/core/src/runtime/engine.ts @@ -116,6 +116,7 @@ import { ApplicationThreads, waitUntil, type Steps, type Wait } from './threads. import { EchoServer, SimpleClient } from './apps/echo.js'; import { WebBrowser, WebServer, type WebServerPage } from './apps/web.js'; import { firewallLogPage, forwardingTablePage, ripTablePage, routerIndexPage } from './apps/routerPages.js'; +import { applyFirewallSettings, firewallSettingsPage } from './apps/firewallSettings.js'; import { VirtualFileSystem } from '../model/virtualFileSystem.js'; import { PRODUCTION_TRACE_RETENTION, @@ -1152,7 +1153,17 @@ export class NetworkRuntimeEngine { const files = new VirtualFileSystem(); files.createDirectory('/webserver', true); files.writeTextFile('/webserver/index.html', routerIndexPage(kind, language)); - const pages = new Map([['log', () => firewallLogPage(this.firewallLog(nodeId), language)]]); + const pages = new Map([ + ['log', () => firewallLogPage(this.firewallLog(nodeId), language)], + [ + 'konfig', + (postData) => { + const result = applyFirewallSettings(this.firewallConfiguration(nodeId), postData); + if (result.configuration !== this.firewallConfiguration(nodeId)) this.setFirewallConfiguration(nodeId, result.configuration); + return firewallSettingsPage(result.configuration, language, result.rejected); + }, + ], + ]); if (kind === 'router') { pages.set('routes', () => { const rip = this.ripTable(nodeId); @@ -5096,6 +5107,11 @@ export class NetworkRuntimeEngine { // ── Firewall ───────────────────────────────────────────────────────────── + /** The node's firewall as it is now: changed at run time (the page konfig), it is in the snapshot, and so in the project saved from it. */ + firewallConfiguration(nodeId: Id): FirewallConfiguration { + return this.stateValue.topologySnapshot.firewallConfigurationsByNodeId.get(nodeId) ?? firewallConfiguration(); + } + setFirewallConfiguration(nodeId: Id, configuration: FirewallConfiguration): void { const configurations = new Map(this.stateValue.topologySnapshot.firewallConfigurationsByNodeId); configurations.set(nodeId, configuration); @@ -5111,8 +5127,7 @@ export class NetworkRuntimeEngine { * recorded, including "firewall inactive". */ evaluateFirewall(packet: IPv4Packet, nodeId: Id, incomingInterfaceId?: Id, frameIdentity?: number): FirewallDecision { - const configuration = - this.stateValue.topologySnapshot.firewallConfigurationsByNodeId.get(nodeId) ?? firewallConfiguration(); + const configuration = this.firewallConfiguration(nodeId); const decide = (accepted: boolean, ruleIndex: number | undefined, detail: string): FirewallDecision => this.recordFirewallDecision(packet, frameIdentity, nodeId, incomingInterfaceId, accepted, ruleIndex, detail); diff --git a/packages/core/src/runtime/http.ts b/packages/core/src/runtime/http.ts index 2d0e5ff..6ed90c3 100644 --- a/packages/core/src/runtime/http.ts +++ b/packages/core/src/runtime/http.ts @@ -41,7 +41,7 @@ function words(line: string): string[] { } /** Java's String.trim. */ -function javaTrim(text: string): string { +export function javaTrim(text: string): string { let start = 0; let end = text.length; while (start < end && text.charCodeAt(start) <= 0x20) start += 1; @@ -211,3 +211,37 @@ export function decodeUriPath(path: string): string | undefined { } return new TextDecoder().decode(new Uint8Array(bytes)); } + +/** + * URLDecoder.decode(text, "UTF-8"), as a form's data is read: "+" a space, + * each run of "%xy" the characters of those UTF-8 bytes; undefined where + * Java throws (an escape cut off or not hexadecimal; Java's parseInt also + * takes a sign there, and refuses only a negative value). + */ +export function javaUrlDecode(text: string): string | undefined { + let decoded = ''; + let index = 0; + while (index < text.length) { + const character = text[index]!; + if (character === '+') { + decoded += ' '; + index += 1; + } else if (character === '%') { + const bytes: number[] = []; + while (index + 2 < text.length && text[index] === '%') { + const hex = text.slice(index + 1, index + 3); + if (!/^[+-]?[0-9A-Fa-f]+$/.test(hex)) return undefined; + const value = Number.parseInt(hex, 16); + if (value < 0) return undefined; + bytes.push(value); + index += 3; + } + if (index < text.length && text[index] === '%') return undefined; + decoded += new TextDecoder().decode(new Uint8Array(bytes)); + } else { + decoded += character; + index += 1; + } + } + return decoded; +} diff --git a/packages/core/test/firewall-settings.cases.txt b/packages/core/test/firewall-settings.cases.txt new file mode 100644 index 0000000..c181051 --- /dev/null +++ b/packages/core/test/firewall-settings.cases.txt @@ -0,0 +1,90 @@ +# Cases for tools/java-oracle's KonfigCases: FILIUS' firewall settings page +# (konfig) fed with what a browser posts. Read by firewallSettings.test.ts. +case getEmpty empty +GET +case getThree three +GET +POST +case deactivate three +POST btnSave=speichern +POST firewallActivate=1&dropICMP=1&onlySYN=1&btnSave=speichern +case defaultPolicy three +POST defaultPolicy=accept&defPolSet=speichern +POST defaultPolicy=xyz&defPolSet=speichern +POST defaultPolicy=accept +POST defaultPolicy=accept&defPolSet=speichern +POST defPolSet=speichern +case moveUp three +POST radioRule=2&moveup=rauf +POST radioRule=1&moveup=rauf +POST radioRule=4&moveup=rauf +POST moveup=rauf +POST radioRule=3&radioRule=2&moveup=rauf +POST radioRule=2&radioRule=abc&moveup=rauf +POST radioRule=%2B3&moveup=rauf +case moveDown three +POST radioRule=1&movedown=runter +POST radioRule=3&movedown=runter +POST movedown=runter +case moveDownZero three +POST radioRule=0&movedown=runter +case delete three +POST radioRule=2&delrule=l%C3%B6schen +POST radioRule=0&delrule=l%C3%B6schen +POST radioRule=abc&delrule=l%C3%B6schen +POST radioRule=9&delrule=l%C3%B6schen +case addEmpty empty +POST srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&addrule=hinzuf%C3%BCgen +POST srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=80&action=accept&addrule=hinzuf%C3%BCgen +POST srcIP=&srcMask=&destIP=&destMask=&protocol=UDP&port=-1&action=drop&addrule=hinzuf%C3%BCgen +POST srcIP=&srcMask=&destIP=&destMask=&protocol=tcp&port=+53+&action=ACCEPT&addrule=hinzuf%C3%BCgen +POST addrule=x +case addSource empty +POST srcIP=10.0.0.0&srcMask=255.255.255.0&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen +case addSourceMaskFirst empty +POST srcMask=255.255.255.0&srcIP=10.0.0.0&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen +case sourceRule sourceRule +GET +case addDestination empty +POST srcIP=&srcMask=&destIP=20.0.0.0&destMask=255.0.0.0&protocol=UDP&port=&action=accept&addrule=hinzuf%C3%BCgen +case addDestinationMaskFirst empty +POST srcIP=&srcMask=&destMask=255.0.0.0&destIP=20.0.0.0&protocol=UDP&port=&action=accept&addrule=hinzuf%C3%BCgen +case destinationRule destinationRule +GET +case errors three +POST srcIP=10.0.0.300&srcMask=&destIP=&destMask=255.0.255.0&protocol=UDP&port=abc&action=accept&addrule=hinzuf%C3%BCgen +GET +POST radioRule=1&moveup=rauf +POST srcIP=10.0.0.1&srcMask=1.2.3.4&destIP=&destMask=255.0.0.0&protocol=TCP&port=0&action=drop&addrule=hinzuf%C3%BCgen +POST srcIP=&srcMask=0.0.0.0&destIP=1.2.3.4&destMask=0.0.0.0&protocol=*&port=65536&action=drop&addrule=hinzuf%C3%BCgen +POST srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=080&action=drop&addrule=hinzuf%C3%BCgen +POST srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=%2B80&action=drop&addrule=hinzuf%C3%BCgen +POST srcIP=&srcMask=255.255.255.0.&destIP=&destMask=255.255.255&protocol=*&port=65535&action=drop&addrule=hinzuf%C3%BCgen +case errorAndSave three +POST srcIP=1.2.3&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&btnSave=speichern&addrule=hinzuf%C3%BCgen +case markup empty +POST srcIP=%3Cb%3E%22&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&addrule=hinzuf%C3%BCgen +case dollar empty +POST srcIP=%241&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&addrule=hinzuf%C3%BCgen +case encoding empty +POST srcIP=+&srcMask=&destIP=&destMask=&protocol=%2A&port=%38&action=drop&addrule=hinzuf%C3%BCgen +POST \u000abtnSave=speichern&firewallActivate=1 +POST BTNSAVE=x&firewallActivate=1 +POST =x&btnSave +case masks empty +POST srcIP=&srcMask=%2B255.255.255.0&destIP=1.2.3&destMask=255.255.255.255.0&protocol=TCP&protocol=UDP&port=&action=drop&addrule=hinzuf%C3%BCgen +POST srcIP=&srcMask=255.255.255.256&destIP=&destMask=255.255.255.255&protocol=*&port=&action=accept&action=drop&addrule=hinzuf%C3%BCgen +case portZero portZero +GET +case ampersand empty +POST srcIP=%26&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&addrule=hinzuf%C3%BCgen +# What Java's browser window posts (Swing's form: every field, the button pressed). +case browserForm three +POST firewallActivate=1&onlySYN=1&btnSave=speichern&defaultPolicy=drop&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop +POST onlySYN=1&defaultPolicy=accept&defPolSet=speichern&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop +POST firewallActivate=1&onlySYN=1&defaultPolicy=drop&radioRule=3&moveup=rauf&srcIP=10.0.0.0&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop +POST firewallActivate=1&onlySYN=1&defaultPolicy=drop&srcIP=&srcMask=&destIP=&destMask=&protocol=UDP&port=53&action=accept&addrule=hinzuf%C3%BCgen +POST firewallActivate=1&onlySYN=1&defaultPolicy=drop&radioRule=1&delrule=l%C3%B6schen&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop +case malformed three +POST radioRule=2&moveup=rauf&x=%zz +POST radioRule=2&moveup=rauf&x=% diff --git a/packages/core/test/firewall-settings.de.java.json b/packages/core/test/firewall-settings.de.java.json new file mode 100644 index 0000000..56fe62f --- /dev/null +++ b/packages/core/test/firewall-settings.de.java.json @@ -0,0 +1,2147 @@ +[ + { + "name": "getEmpty", + "start": "empty", + "steps": [ + { + "post": null, + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "getThree", + "start": "three", + "steps": [ + { + "post": null, + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "deactivate", + "start": "three", + "steps": [ + { + "post": "btnSave=speichern", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": false, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "firewallActivate=1&dropICMP=1&onlySYN=1&btnSave=speichern", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": true, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "defaultPolicy", + "start": "three", + "steps": [ + { + "post": "defaultPolicy=accept&defPolSet=speichern", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "accept", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "defaultPolicy=xyz&defPolSet=speichern", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "defaultPolicy=accept", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "defaultPolicy=accept&defPolSet=speichern", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "accept", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "defPolSet=speichern", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "moveUp", + "start": "three", + "steps": [ + { + "post": "radioRule=2&moveup=rauf", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 2TCP80akzeptieren
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=1&moveup=rauf", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 2TCP80akzeptieren
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=4&moveup=rauf", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 2TCP80akzeptieren
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "moveup=rauf", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 2TCP80akzeptieren
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=3&radioRule=2&moveup=rauf", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=2&radioRule=abc&moveup=rauf", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 2TCP80akzeptieren
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=%2B3&moveup=rauf", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 210.0.0.0255.0.0.0verwerfen
 3TCP80akzeptieren
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ] + ] + } + } + ] + }, + { + "name": "moveDown", + "start": "three", + "steps": [ + { + "post": "radioRule=1&movedown=runter", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 2TCP80akzeptieren
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=3&movedown=runter", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 2TCP80akzeptieren
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "movedown=runter", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 2TCP80akzeptieren
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "moveDownZero", + "start": "three", + "steps": [ + { + "post": "radioRule=0&movedown=runter", + "page": "!ArrayIndexOutOfBoundsException", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "delete", + "start": "three", + "steps": [ + { + "post": "radioRule=2&delrule=l%C3%B6schen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 210.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=0&delrule=l%C3%B6schen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 210.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=abc&delrule=l%C3%B6schen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 210.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=9&delrule=l%C3%B6schen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 210.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "addEmpty", + "start": "empty", + "steps": [ + { + "post": "srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=80&action=accept&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1verwerfen
 2TCP80akzeptieren
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + -1, + "all", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ] + ] + } + }, + { + "post": "srcIP=&srcMask=&destIP=&destMask=&protocol=UDP&port=-1&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1verwerfen
 2TCP80akzeptieren
 3UDPverwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + -1, + "all", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "", + "", + "", + "", + -1, + "udp", + "drop" + ] + ] + } + }, + { + "post": "srcIP=&srcMask=&destIP=&destMask=&protocol=tcp&port=+53+&action=ACCEPT&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1verwerfen
 2TCP80akzeptieren
 3UDPverwerfen
 453verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + -1, + "all", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "", + "", + "", + "", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 53, + "all", + "drop" + ] + ] + } + }, + { + "post": "addrule=x", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1verwerfen
 2TCP80akzeptieren
 3UDPverwerfen
 453verwerfen
 5verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + -1, + "all", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "", + "", + "", + "", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 53, + "all", + "drop" + ], + [ + "", + "", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "addSource", + "start": "empty", + "steps": [ + { + "post": "srcIP=10.0.0.0&srcMask=255.255.255.0&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \nFehlerhafte Eingabe(n):
  • Quell-Subnetzmaske leer oder ungültig

\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\nFehlerhafte Eingabe(n):
  • Quell-Subnetzmaske leer oder ungültig

\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "addSourceMaskFirst", + "start": "empty", + "steps": [ + { + "post": "srcMask=255.255.255.0&srcIP=10.0.0.0&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \nFehlerhafte Eingabe(n):
  • Subnetzmaske angegeben, aber keine IP

\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\nFehlerhafte Eingabe(n):
  • Subnetzmaske angegeben, aber keine IP

\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "sourceRule", + "start": "sourceRule", + "steps": [ + { + "post": null, + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 110.0.0.0255.255.255.0TCP80verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "10.0.0.0", + "255.255.255.0", + "", + "", + 80, + "tcp", + "drop" + ] + ] + } + } + ] + }, + { + "name": "addDestination", + "start": "empty", + "steps": [ + { + "post": "srcIP=&srcMask=&destIP=20.0.0.0&destMask=255.0.0.0&protocol=UDP&port=&action=accept&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \nFehlerhafte Eingabe(n):
  • Ziel-Subnetzmaske leer oder ungültig

\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\nFehlerhafte Eingabe(n):
  • Ziel-Subnetzmaske leer oder ungültig

\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "addDestinationMaskFirst", + "start": "empty", + "steps": [ + { + "post": "srcIP=&srcMask=&destMask=255.0.0.0&destIP=20.0.0.0&protocol=UDP&port=&action=accept&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \nFehlerhafte Eingabe(n):
  • Subnetzmaske angegeben, aber keine IP

\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\nFehlerhafte Eingabe(n):
  • Subnetzmaske angegeben, aber keine IP

\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "destinationRule", + "start": "destinationRule", + "steps": [ + { + "post": null, + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 120.0.0.0255.0.0.0UDPakzeptieren
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "accept" + ] + ] + } + } + ] + }, + { + "name": "errors", + "start": "three", + "steps": [ + { + "post": "srcIP=10.0.0.300&srcMask=&destIP=&destMask=255.0.255.0&protocol=UDP&port=abc&action=accept&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \nFehlerhafte Eingabe(n):
  • Quell-IP ungültig
  • Quell-Subnetzmaske leer oder ungültig
  • Ziel-Subnetzmaske leer oder ungültig
  • Subnetzmaske angegeben, aber keine IP
  • Port ungültig

\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\nFehlerhafte Eingabe(n):
  • Quell-IP ungültig
  • Quell-Subnetzmaske leer oder ungültig
  • Ziel-Subnetzmaske leer oder ungültig
  • Subnetzmaske angegeben, aber keine IP
  • Port ungültig

\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": null, + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \nFehlerhafte Eingabe(n):
  • Quell-IP ungültig
  • Quell-Subnetzmaske leer oder ungültig
  • Ziel-Subnetzmaske leer oder ungültig
  • Subnetzmaske angegeben, aber keine IP
  • Port ungültig

\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\nFehlerhafte Eingabe(n):
  • Quell-IP ungültig
  • Quell-Subnetzmaske leer oder ungültig
  • Ziel-Subnetzmaske leer oder ungültig
  • Subnetzmaske angegeben, aber keine IP
  • Port ungültig

\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=1&moveup=rauf", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "srcIP=10.0.0.1&srcMask=1.2.3.4&destIP=&destMask=255.0.0.0&protocol=TCP&port=0&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \nFehlerhafte Eingabe(n):
  • Quell-Subnetzmaske leer oder ungültig
  • Quell-Subnetzmaske leer oder ungültig
  • Subnetzmaske angegeben, aber keine IP
  • Port ungültig

\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\nFehlerhafte Eingabe(n):
  • Quell-Subnetzmaske leer oder ungültig
  • Quell-Subnetzmaske leer oder ungültig
  • Subnetzmaske angegeben, aber keine IP
  • Port ungültig

\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "srcIP=&srcMask=0.0.0.0&destIP=1.2.3.4&destMask=0.0.0.0&protocol=*&port=65536&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \nFehlerhafte Eingabe(n):
  • Quell-Subnetzmaske leer oder ungültig
  • Subnetzmaske angegeben, aber keine IP
  • Ziel-Subnetzmaske leer oder ungültig
  • Ziel-Subnetzmaske leer oder ungültig
  • Port ungültig

\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\nFehlerhafte Eingabe(n):
  • Quell-Subnetzmaske leer oder ungültig
  • Subnetzmaske angegeben, aber keine IP
  • Ziel-Subnetzmaske leer oder ungültig
  • Ziel-Subnetzmaske leer oder ungültig
  • Port ungültig

\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=080&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \nFehlerhafte Eingabe(n):
  • Port ungültig

\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\nFehlerhafte Eingabe(n):
  • Port ungültig

\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=%2B80&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \nFehlerhafte Eingabe(n):
  • Port ungültig

\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\nFehlerhafte Eingabe(n):
  • Port ungültig

\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "srcIP=&srcMask=255.255.255.0.&destIP=&destMask=255.255.255&protocol=*&port=65535&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \nFehlerhafte Eingabe(n):
  • Subnetzmaske angegeben, aber keine IP
  • Ziel-Subnetzmaske leer oder ungültig
  • Subnetzmaske angegeben, aber keine IP

\n
\n\t

Firewall-Konfiguration

\n \n \n\t \n \n \n
\n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
\n\t\t\n Firewall aktivieren
\n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
\n\t\t\t \n\t ICMP-Pakete filtern
\n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
\n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
\n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
\n
\n\n
\n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
\n

Firewall-Regeln:


\n\t Die Regeln werden von oben nach unten geprüft.
\n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
\n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
\n\t \n\t \n\t
\n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
 1TCP80akzeptieren
 2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
 310.0.0.0255.0.0.0verwerfen
\n \n\t
\n\t Aktion für ausgewählte Regel:\n\t
\n \n \n \n
\n\n
\nFehlerhafte Eingabe(n):
  • Subnetzmaske angegeben, aber keine IP
  • Ziel-Subnetzmaske leer oder ungültig
  • Subnetzmaske angegeben, aber keine IP

\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\n

Neue Regel erstellen


\n\t Alle Felder sind optional und werden
-- falls leer gelassen --
für die Filterung nicht verwendet.\n
Quell-IP:
Quell-Subnetzmaske:
Ziel-IP:
Ziel-Subnetzmaske:
Protokoll: \n\t \n\t
Port:
Aktion: \n\t \n\t
\n \n
\n
\n
\n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "errorAndSave", + "start": "three", + "steps": [ + { + "post": "srcIP=1.2.3&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&btnSave=speichern&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n
  • Quell-IP ungültig
  • Quell-Subnetzmaske leer oder ungültig
    • \n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     1TCP80akzeptieren
     2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
     310.0.0.0255.0.0.0verwerfen
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \n
  • Quell-IP ungültig
  • Quell-Subnetzmaske leer oder ungültig
    • \n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": false, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "markup", + "start": "empty", + "steps": [ + { + "post": "srcIP=%3Cb%3E%22&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \nFehlerhafte Eingabe(n):
    • Quell-IP ungültig
    • Quell-Subnetzmaske leer oder ungültig

    \n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \nFehlerhafte Eingabe(n):
    • Quell-IP ungültig
    • Quell-Subnetzmaske leer oder ungültig

    \n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP: \"\">
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "dollar", + "start": "empty", + "steps": [ + { + "post": "srcIP=%241&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&addrule=hinzuf%C3%BCgen", + "page": null, + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "encoding", + "start": "empty", + "steps": [ + { + "post": "srcIP=+&srcMask=&destIP=&destMask=&protocol=%2A&port=%38&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     18verwerfen
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 8, + "all", + "drop" + ] + ] + } + }, + { + "post": "\nbtnSave=speichern&firewallActivate=1", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     18verwerfen
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": false, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 8, + "all", + "drop" + ] + ] + } + }, + { + "post": "BTNSAVE=x&firewallActivate=1", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     18verwerfen
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": false, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 8, + "all", + "drop" + ] + ] + } + }, + { + "post": "=x&btnSave", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     18verwerfen
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": false, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 8, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "masks", + "start": "empty", + "steps": [ + { + "post": "srcIP=&srcMask=%2B255.255.255.0&destIP=1.2.3&destMask=255.255.255.255.0&protocol=TCP&protocol=UDP&port=&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \nFehlerhafte Eingabe(n):
    • Subnetzmaske angegeben, aber keine IP
    • Ziel-IP ungültig
    • Ziel-Subnetzmaske leer oder ungültig
    • Ziel-Subnetzmaske leer oder ungültig

    \n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \nFehlerhafte Eingabe(n):
    • Subnetzmaske angegeben, aber keine IP
    • Ziel-IP ungültig
    • Ziel-Subnetzmaske leer oder ungültig
    • Ziel-Subnetzmaske leer oder ungültig

    \n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + }, + { + "post": "srcIP=&srcMask=255.255.255.256&destIP=&destMask=255.255.255.255&protocol=*&port=&action=accept&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \nFehlerhafte Eingabe(n):
    • Quell-Subnetzmaske leer oder ungültig
    • Subnetzmaske angegeben, aber keine IP
    • Subnetzmaske angegeben, aber keine IP

    \n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \nFehlerhafte Eingabe(n):
    • Quell-Subnetzmaske leer oder ungültig
    • Subnetzmaske angegeben, aber keine IP
    • Subnetzmaske angegeben, aber keine IP

    \n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "portZero", + "start": "portZero", + "steps": [ + { + "post": null, + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     10akzeptieren
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 0, + "icmp", + "accept" + ] + ] + } + } + ] + }, + { + "name": "ampersand", + "start": "empty", + "steps": [ + { + "post": "srcIP=%26&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     1verwerfen
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "browserForm", + "start": "three", + "steps": [ + { + "post": "firewallActivate=1&onlySYN=1&btnSave=speichern&defaultPolicy=drop&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     1TCP80akzeptieren
     2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
     310.0.0.0255.0.0.0verwerfen
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "onlySYN=1&defaultPolicy=accept&defPolSet=speichern&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     1TCP80akzeptieren
     2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
     310.0.0.0255.0.0.0verwerfen
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "accept", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "firewallActivate=1&onlySYN=1&defaultPolicy=drop&radioRule=3&moveup=rauf&srcIP=10.0.0.0&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     1TCP80akzeptieren
     210.0.0.0255.0.0.0verwerfen
     3999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "accept", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ] + ] + } + }, + { + "post": "firewallActivate=1&onlySYN=1&defaultPolicy=drop&srcIP=&srcMask=&destIP=&destMask=&protocol=UDP&port=53&action=accept&addrule=hinzuf%C3%BCgen", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     1TCP80akzeptieren
     210.0.0.0255.0.0.0verwerfen
     3999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
     4UDP53akzeptieren
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "accept", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 53, + "udp", + "accept" + ] + ] + } + }, + { + "post": "firewallActivate=1&onlySYN=1&defaultPolicy=drop&radioRule=1&delrule=l%C3%B6schen&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop", + "page": "\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\t

    Firewall-Konfiguration

    \n \n \n\t \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n\t \n
    \n\t\t\n Firewall aktivieren
    \n\t Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\t\tBei deaktivierter Firewall findet keine Filterung statt.\n
    \n\t\t\t \n\t ICMP-Pakete filtern
    \n\t Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\t
    \n\t\t\t\n\t \n\t nur SYN-Pakete verwerfen\n\t
    \n\t Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\t\tDer Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\t
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\t\n\t \n\t\n \n \n \n
    \n

    Firewall-Regeln:


    \n\t Die Regeln werden von oben nach unten geprüft.
    \n\t Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\t Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\t \n\t \n\t
    \n\t \n \n \n\t\t\n \n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.0.0.0verwerfen
     2999.999.999.99920.0.0.0255.0.0.0UDPverwerfen
     3UDP53akzeptieren
    \n     \n\t
    \n\t Aktion für ausgewählte Regel:\n\t
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\t\n\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\t Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\t \n\t
    Port:
    Aktion: \n\t \n\t
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "accept", + "rules": [ + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 53, + "udp", + "accept" + ] + ] + } + } + ] + }, + { + "name": "malformed", + "start": "three", + "steps": [ + { + "post": "radioRule=2&moveup=rauf&x=%zz", + "page": "!IllegalArgumentException", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=2&moveup=rauf&x=%", + "page": "!IllegalArgumentException", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + } +] diff --git a/packages/core/test/firewall-settings.en.java.json b/packages/core/test/firewall-settings.en.java.json new file mode 100644 index 0000000..e2361e6 --- /dev/null +++ b/packages/core/test/firewall-settings.en.java.json @@ -0,0 +1,2147 @@ +[ + { + "name": "getEmpty", + "start": "empty", + "steps": [ + { + "post": null, + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "getThree", + "start": "three", + "steps": [ + { + "post": null, + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "deactivate", + "start": "three", + "steps": [ + { + "post": "btnSave=speichern", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": false, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "firewallActivate=1&dropICMP=1&onlySYN=1&btnSave=speichern", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": true, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "defaultPolicy", + "start": "three", + "steps": [ + { + "post": "defaultPolicy=accept&defPolSet=speichern", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "accept", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "defaultPolicy=xyz&defPolSet=speichern", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "defaultPolicy=accept", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "defaultPolicy=accept&defPolSet=speichern", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "accept", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "defPolSet=speichern", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "moveUp", + "start": "three", + "steps": [ + { + "post": "radioRule=2&moveup=rauf", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1999.999.999.99920.0.0.0255.0.0.0UDPdrop
     2TCP80accept
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=1&moveup=rauf", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1999.999.999.99920.0.0.0255.0.0.0UDPdrop
     2TCP80accept
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=4&moveup=rauf", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1999.999.999.99920.0.0.0255.0.0.0UDPdrop
     2TCP80accept
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "moveup=rauf", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1999.999.999.99920.0.0.0255.0.0.0UDPdrop
     2TCP80accept
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=3&radioRule=2&moveup=rauf", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=2&radioRule=abc&moveup=rauf", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1999.999.999.99920.0.0.0255.0.0.0UDPdrop
     2TCP80accept
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=%2B3&moveup=rauf", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1999.999.999.99920.0.0.0255.0.0.0UDPdrop
     210.0.0.0255.0.0.0drop
     3TCP80accept
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ] + ] + } + } + ] + }, + { + "name": "moveDown", + "start": "three", + "steps": [ + { + "post": "radioRule=1&movedown=runter", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1999.999.999.99920.0.0.0255.0.0.0UDPdrop
     2TCP80accept
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=3&movedown=runter", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1999.999.999.99920.0.0.0255.0.0.0UDPdrop
     2TCP80accept
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "movedown=runter", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1999.999.999.99920.0.0.0255.0.0.0UDPdrop
     2TCP80accept
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "moveDownZero", + "start": "three", + "steps": [ + { + "post": "radioRule=0&movedown=runter", + "page": "!ArrayIndexOutOfBoundsException", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "delete", + "start": "three", + "steps": [ + { + "post": "radioRule=2&delrule=l%C3%B6schen", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     210.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=0&delrule=l%C3%B6schen", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     210.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=abc&delrule=l%C3%B6schen", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     210.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=9&delrule=l%C3%B6schen", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     210.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "addEmpty", + "start": "empty", + "steps": [ + { + "post": "srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=80&action=accept&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1drop
     2TCP80accept
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + -1, + "all", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ] + ] + } + }, + { + "post": "srcIP=&srcMask=&destIP=&destMask=&protocol=UDP&port=-1&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1drop
     2TCP80accept
     3UDPdrop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + -1, + "all", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "", + "", + "", + "", + -1, + "udp", + "drop" + ] + ] + } + }, + { + "post": "srcIP=&srcMask=&destIP=&destMask=&protocol=tcp&port=+53+&action=ACCEPT&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1drop
     2TCP80accept
     3UDPdrop
     453drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + -1, + "all", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "", + "", + "", + "", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 53, + "all", + "drop" + ] + ] + } + }, + { + "post": "addrule=x", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1drop
     2TCP80accept
     3UDPdrop
     453drop
     5drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + -1, + "all", + "drop" + ], + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "", + "", + "", + "", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 53, + "all", + "drop" + ], + [ + "", + "", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "addSource", + "start": "empty", + "steps": [ + { + "post": "srcIP=10.0.0.0&srcMask=255.255.255.0&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \nErroneous input(s):
    • Source subnet mask empty or invalid

    \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\nErroneous input(s):
    • Source subnet mask empty or invalid

    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "addSourceMaskFirst", + "start": "empty", + "steps": [ + { + "post": "srcMask=255.255.255.0&srcIP=10.0.0.0&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \nErroneous input(s):
    • Subnet mask available, but no IP given

    \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\nErroneous input(s):
    • Subnet mask available, but no IP given

    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "sourceRule", + "start": "sourceRule", + "steps": [ + { + "post": null, + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     110.0.0.0255.255.255.0TCP80drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "10.0.0.0", + "255.255.255.0", + "", + "", + 80, + "tcp", + "drop" + ] + ] + } + } + ] + }, + { + "name": "addDestination", + "start": "empty", + "steps": [ + { + "post": "srcIP=&srcMask=&destIP=20.0.0.0&destMask=255.0.0.0&protocol=UDP&port=&action=accept&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \nErroneous input(s):
    • Dest. subnet mask empty or invalid

    \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\nErroneous input(s):
    • Dest. subnet mask empty or invalid

    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "addDestinationMaskFirst", + "start": "empty", + "steps": [ + { + "post": "srcIP=&srcMask=&destMask=255.0.0.0&destIP=20.0.0.0&protocol=UDP&port=&action=accept&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \nErroneous input(s):
    • Subnet mask available, but no IP given

    \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\nErroneous input(s):
    • Subnet mask available, but no IP given

    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "destinationRule", + "start": "destinationRule", + "steps": [ + { + "post": null, + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     120.0.0.0255.0.0.0UDPaccept
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "accept" + ] + ] + } + } + ] + }, + { + "name": "errors", + "start": "three", + "steps": [ + { + "post": "srcIP=10.0.0.300&srcMask=&destIP=&destMask=255.0.255.0&protocol=UDP&port=abc&action=accept&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \nErroneous input(s):
    • Source IP invalid
    • Source subnet mask empty or invalid
    • Dest. subnet mask empty or invalid
    • Subnet mask available, but no IP given
    • Port invalid

    \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\nErroneous input(s):
    • Source IP invalid
    • Source subnet mask empty or invalid
    • Dest. subnet mask empty or invalid
    • Subnet mask available, but no IP given
    • Port invalid

    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": null, + "page": "\n \n Router Firewall Configuration\n \n\n \nErroneous input(s):
    • Source IP invalid
    • Source subnet mask empty or invalid
    • Dest. subnet mask empty or invalid
    • Subnet mask available, but no IP given
    • Port invalid

    \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\nErroneous input(s):
    • Source IP invalid
    • Source subnet mask empty or invalid
    • Dest. subnet mask empty or invalid
    • Subnet mask available, but no IP given
    • Port invalid

    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=1&moveup=rauf", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "srcIP=10.0.0.1&srcMask=1.2.3.4&destIP=&destMask=255.0.0.0&protocol=TCP&port=0&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \nErroneous input(s):
    • Source subnet mask empty or invalid
    • Source subnet mask empty or invalid
    • Subnet mask available, but no IP given
    • Port invalid

    \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\nErroneous input(s):
    • Source subnet mask empty or invalid
    • Source subnet mask empty or invalid
    • Subnet mask available, but no IP given
    • Port invalid

    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "srcIP=&srcMask=0.0.0.0&destIP=1.2.3.4&destMask=0.0.0.0&protocol=*&port=65536&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \nErroneous input(s):
    • Source subnet mask empty or invalid
    • Subnet mask available, but no IP given
    • Dest. subnet mask empty or invalid
    • Dest. subnet mask empty or invalid
    • Port invalid

    \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\nErroneous input(s):
    • Source subnet mask empty or invalid
    • Subnet mask available, but no IP given
    • Dest. subnet mask empty or invalid
    • Dest. subnet mask empty or invalid
    • Port invalid

    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=080&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \nErroneous input(s):
    • Port invalid

    \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\nErroneous input(s):
    • Port invalid

    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=%2B80&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \nErroneous input(s):
    • Port invalid

    \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\nErroneous input(s):
    • Port invalid

    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "srcIP=&srcMask=255.255.255.0.&destIP=&destMask=255.255.255&protocol=*&port=65535&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \nErroneous input(s):
    • Subnet mask available, but no IP given
    • Dest. subnet mask empty or invalid
    • Subnet mask available, but no IP given

    \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\nErroneous input(s):
    • Subnet mask available, but no IP given
    • Dest. subnet mask empty or invalid
    • Subnet mask available, but no IP given

    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "errorAndSave", + "start": "three", + "steps": [ + { + "post": "srcIP=1.2.3&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&btnSave=speichern&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \n
  • Source IP invalid
  • Source subnet mask empty or invalid
    • \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n
  • Source IP invalid
  • Source subnet mask empty or invalid
    • \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": false, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "markup", + "start": "empty", + "steps": [ + { + "post": "srcIP=%3Cb%3E%22&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \nErroneous input(s):
    • Source IP invalid
    • Source subnet mask empty or invalid

    \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\nErroneous input(s):
    • Source IP invalid
    • Source subnet mask empty or invalid

    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP: \"\">
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "dollar", + "start": "empty", + "steps": [ + { + "post": "srcIP=%241&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&addrule=hinzuf%C3%BCgen", + "page": null, + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "encoding", + "start": "empty", + "steps": [ + { + "post": "srcIP=+&srcMask=&destIP=&destMask=&protocol=%2A&port=%38&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     18drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 8, + "all", + "drop" + ] + ] + } + }, + { + "post": "\nbtnSave=speichern&firewallActivate=1", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     18drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": false, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 8, + "all", + "drop" + ] + ] + } + }, + { + "post": "BTNSAVE=x&firewallActivate=1", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     18drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": false, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 8, + "all", + "drop" + ] + ] + } + }, + { + "post": "=x&btnSave", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     18drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": false, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 8, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "masks", + "start": "empty", + "steps": [ + { + "post": "srcIP=&srcMask=%2B255.255.255.0&destIP=1.2.3&destMask=255.255.255.255.0&protocol=TCP&protocol=UDP&port=&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \nErroneous input(s):
    • Subnet mask available, but no IP given
    • Dest. IP invalid
    • Dest. subnet mask empty or invalid
    • Dest. subnet mask empty or invalid

    \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\nErroneous input(s):
    • Subnet mask available, but no IP given
    • Dest. IP invalid
    • Dest. subnet mask empty or invalid
    • Dest. subnet mask empty or invalid

    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + }, + { + "post": "srcIP=&srcMask=255.255.255.256&destIP=&destMask=255.255.255.255&protocol=*&port=&action=accept&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \nErroneous input(s):
    • Source subnet mask empty or invalid
    • Subnet mask available, but no IP given
    • Subnet mask available, but no IP given

    \n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\nErroneous input(s):
    • Source subnet mask empty or invalid
    • Subnet mask available, but no IP given
    • Subnet mask available, but no IP given

    \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [] + } + } + ] + }, + { + "name": "portZero", + "start": "portZero", + "steps": [ + { + "post": null, + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     10accept
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 0, + "icmp", + "accept" + ] + ] + } + } + ] + }, + { + "name": "ampersand", + "start": "empty", + "steps": [ + { + "post": "srcIP=%26&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": false, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + }, + { + "name": "browserForm", + "start": "three", + "steps": [ + { + "post": "firewallActivate=1&onlySYN=1&btnSave=speichern&defaultPolicy=drop&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "onlySYN=1&defaultPolicy=accept&defPolSet=speichern&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     310.0.0.0255.0.0.0drop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "accept", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "firewallActivate=1&onlySYN=1&defaultPolicy=drop&radioRule=3&moveup=rauf&srcIP=10.0.0.0&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     210.0.0.0255.0.0.0drop
     3999.999.999.99920.0.0.0255.0.0.0UDPdrop
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "accept", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ] + ] + } + }, + { + "post": "firewallActivate=1&onlySYN=1&defaultPolicy=drop&srcIP=&srcMask=&destIP=&destMask=&protocol=UDP&port=53&action=accept&addrule=hinzuf%C3%BCgen", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     1TCP80accept
     210.0.0.0255.0.0.0drop
     3999.999.999.99920.0.0.0255.0.0.0UDPdrop
     4UDP53accept
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "accept", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 53, + "udp", + "accept" + ] + ] + } + }, + { + "post": "firewallActivate=1&onlySYN=1&defaultPolicy=drop&radioRule=1&delrule=l%C3%B6schen&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop", + "page": "\n \n Router Firewall Configuration\n \n\n \n\n
    \n

    Router Firewall Configuration

    \n \n \n \n \n \n
    \n \n \n \n \n \n \n \n \n\t \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n
    \n\t\t\n Activate firewall
    \n Firewall rules will only be applied, if the firewall is activated. \n\t\tIn the case of a not activated firewall no packet filtering will take place.\n
    \n\t\t\n Filter ICMP packets
    \n All ICMP packets, e.g., ping requests, will be dropped.\n
    \n\t\t\n \n\t only drop SYN packets\n\t
    \n New connection requests to blocked ports will be dropped.\n\t\tBack channels for allowed connection requests will be accepted.\n\t
    \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Firewall rules:


    \n The rules are evaluated from top to bottom.
    \n If a rule matches, the given action will be followed.\n
    \n If no rule applies, the following default policy is used:
    \n \n \n
    \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n
    no.source IPsource subnet maskdest. IPdest. subnet maskprotocolportaction
     110.0.0.0255.0.0.0drop
     2999.999.999.99920.0.0.0255.0.0.0UDPdrop
     3UDP53accept
    \n     \n
    \n Action for selected rule:\n
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Create new rule


    \n All fields are optional and will be
    -- if empty --
    ignored for filtering.\n
    source IP:
    source subnet mask:
    dest. IP:
    dest. subnet mask:
    protocol: \n \n
    port:
    action: \n \n
    \n \n
    \n
    \n
    \n \n\n", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "accept", + "rules": [ + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "", + "", + "", + "", + 53, + "udp", + "accept" + ] + ] + } + } + ] + }, + { + "name": "malformed", + "start": "three", + "steps": [ + { + "post": "radioRule=2&moveup=rauf&x=%zz", + "page": "!IllegalArgumentException", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + }, + { + "post": "radioRule=2&moveup=rauf&x=%", + "page": "!IllegalArgumentException", + "firewall": { + "isActive": true, + "dropIcmp": false, + "filterSynSegmentsOnly": true, + "defaultPolicy": "drop", + "rules": [ + [ + "", + "", + "", + "", + 80, + "tcp", + "accept" + ], + [ + "999.999.999.999", + "", + "20.0.0.0", + "255.0.0.0", + -1, + "udp", + "drop" + ], + [ + "10.0.0.0", + "255.0.0.0", + "", + "", + -1, + "all", + "drop" + ] + ] + } + } + ] + } +] diff --git a/packages/core/test/firewallSettings.test.ts b/packages/core/test/firewallSettings.test.ts new file mode 100644 index 0000000..37f86ed --- /dev/null +++ b/packages/core/test/firewallSettings.test.ts @@ -0,0 +1,163 @@ +// The firewall settings page of routers and home routers (konfig, +// apps/firewallSettings.ts) against Java FILIUS' own: tools/java-oracle's +// KonfigCases fed Java's page with the steps of firewall-settings.cases.txt +// (firewall-settings..java.json). Each step's page and the firewall +// after it must be Java's, in both languages, except where Java errs. + +import { readFileSync } from 'node:fs'; +import { dirname, join } from 'node:path'; +import { fileURLToPath } from 'node:url'; +import { describe, expect, it } from 'vitest'; +import { + applyFirewallSettings, + firewallConfiguration, + firewallRule, + firewallSettingsPage, + javaUrlDecode, + type FirewallConfiguration, + type FirewallRule, + type PageLanguage, +} from '../src/index.js'; + +const here = dirname(fileURLToPath(import.meta.url)); + +type JavaRule = [string, string, string, string, number, string, string]; + +interface JavaFirewall { + isActive: boolean; + dropIcmp: boolean; + filterSynSegmentsOnly: boolean; + defaultPolicy: string; + rules: JavaRule[]; +} + +interface JavaStep { + post: string | null; + page: string | null; + firewall: JavaFirewall; +} + +interface JavaCase { + name: string; + start: string; + steps: JavaStep[]; +} + +function javaRule(rule: FirewallRule): JavaRule { + return [rule.sourceIPAddress, rule.sourceSubnetMask, rule.destinationIPAddress, rule.destinationSubnetMask, rule.port, rule.protocol, rule.action]; +} + +function asJava(configuration: FirewallConfiguration): JavaFirewall { + return { + isActive: configuration.isActive, + dropIcmp: configuration.dropIcmp, + filterSynSegmentsOnly: configuration.filterSynSegmentsOnly, + defaultPolicy: configuration.defaultPolicy, + rules: configuration.rules.map(javaRule), + }; +} + +/** KonfigCases' start states. */ +const STARTS: Record = { + empty: firewallConfiguration(), + three: firewallConfiguration({ + isActive: true, + rules: [ + firewallRule({ port: 80, protocol: 'tcp', action: 'accept' }), + firewallRule({ sourceIPAddress: '999.999.999.999', destinationIPAddress: '20.0.0.0', destinationSubnetMask: '255.0.0.0', protocol: 'udp', action: 'drop' }), + firewallRule({ sourceIPAddress: '10.0.0.0', sourceSubnetMask: '255.0.0.0', protocol: 'all', action: 'drop' }), + ], + }), + sourceRule: firewallConfiguration({ rules: [firewallRule({ sourceIPAddress: '10.0.0.0', sourceSubnetMask: '255.255.255.0', port: 80, protocol: 'tcp', action: 'drop' })] }), + portZero: firewallConfiguration({ rules: [firewallRule({ port: 0, protocol: 'icmp', action: 'accept' })] }), + destinationRule: firewallConfiguration({ rules: [firewallRule({ destinationIPAddress: '20.0.0.0', destinationSubnetMask: '255.0.0.0', protocol: 'udp', action: 'accept' })] }), +}; + +type Cases = Record; + +const step = (cases: Cases, name: string, index: number) => cases[name]!.steps[index]!; + +/** A step as Java means it: another step's page and firewall, which Java answers for the same state. */ +const asStep = + (name: string, index: number) => + (cases: Cases, measured: JavaStep): JavaStep => ({ ...step(cases, name, index), post: measured.post }); + +/** + * Where Java errs, each step as Java means it (the core's departures, see + * firewallSettings.ts). + */ +const JAVA_BUGS: Record JavaStep>> = { + // Java checks the source IP against the mask not read yet, and the mask + // against the IP not read yet: it refuses every rule with an address, + // whichever field comes first. The core takes the rule. + addSource: { 0: asStep('sourceRule', 0) }, + addSourceMaskFirst: { 0: asStep('sourceRule', 0) }, + addDestination: { 0: asStep('destinationRule', 0) }, + addDestinationMaskFirst: { 0: asStep('destinationRule', 0) }, + // Java keeps the error of a failed add for every later page. + errors: { 1: asStep('getThree', 0) }, + // Save and add at once: Java saves, but writes the add's errors as a bare + // list and fills the form in. The core answers the saved firewall. + errorAndSave: { 0: asStep('deactivate', 0) }, + // Java writes the form's text into the page as it came. + markup: { 0: (_, measured) => ({ ...measured, page: measured.page!.replace('value="""', 'value="<b>""') }) }, + // A "$" in the form's text: Java's replaceAll reads it as a group, throws, + // and the page fails (500). The core answers as for any other bad address. + dollar: { 0: (cases, measured) => ({ ...measured, page: step(cases, 'markup', 0).page!.replace('value="""', 'value="$1"') }) }, + // An "&" typed into a field: Java decodes the data before it splits it, + // reads an empty source and adds a rule. The core keeps the "&" in its + // field and answers as for any other bad address. + ampersand: { 0: (cases) => ({ ...step(cases, 'markup', 0), page: step(cases, 'markup', 0).page!.replace('value="""', 'value="&"') }) }, + // Moving rule 0 down: Java throws (its worker thread ends, no page comes). + moveDownZero: { 0: asStep('getThree', 0) }, + // An escape that is not one: Java's decoder throws. The core reads the + // data as it came, as Java's code means to. + malformed: { 0: asStep('moveUp', 0), 1: asStep('getThree', 0) }, +}; + +function javaCases(language: PageLanguage): Cases { + const list = JSON.parse(readFileSync(join(here, `firewall-settings.${language}.java.json`), 'utf8')) as JavaCase[]; + return Object.fromEntries(list.map((each) => [each.name, each])); +} + +describe('the firewall settings page as Java FILIUS answers it', () => { + for (const language of ['de', 'en'] as const) { + const cases = javaCases(language); + + it(`corrects Java only where it errs (${language})`, () => { + for (const [name, steps] of Object.entries(JAVA_BUGS)) { + for (const [index, correct] of Object.entries(steps)) { + const measured = step(cases, name, Number(index)); + expect(correct(cases, measured), `${name} ${index}`).not.toEqual(measured); + } + } + }); + + for (const [name, javaCase] of Object.entries(cases)) { + it(`${name} (${language})`, () => { + let configuration = STARTS[javaCase.start]!; + for (const [index, measured] of javaCase.steps.entries()) { + const expected = JAVA_BUGS[name]?.[index]?.(cases, measured) ?? measured; + const result = applyFirewallSettings(configuration, measured.post ?? undefined); + configuration = result.configuration; + expect(asJava(configuration), `step ${index}: the firewall`).toEqual(expected.firewall); + expect(firewallSettingsPage(configuration, language, result.rejected), `step ${index}: the page`).toBe(expected.page); + } + }); + } + } +}); + +describe("a form's data as Java's URLDecoder reads it", () => { + it('turns + into spaces and runs of escapes into UTF-8 characters', () => { + expect(javaUrlDecode('a+b%C3%BC%E2%82%AC%41')).toBe('a bü€A'); + expect(javaUrlDecode('%+f%-0x')).toBe('\u000f\u0000x'); + }); + + it('fails where Java throws: an escape cut off, not hexadecimal, or negative', () => { + expect(javaUrlDecode('%zz')).toBeUndefined(); + expect(javaUrlDecode('%4')).toBeUndefined(); + expect(javaUrlDecode('%41%')).toBeUndefined(); + expect(javaUrlDecode('%-1')).toBeUndefined(); + }); +}); diff --git a/packages/core/test/routerPages.test.ts b/packages/core/test/routerPages.test.ts index 223f0e8..e151895 100644 --- a/packages/core/test/routerPages.test.ts +++ b/packages/core/test/routerPages.test.ts @@ -9,6 +9,7 @@ import { firewallLogPage, firewallRule, firewallRuleText, + firewallSettingsPage, forwardingTablePage, interfaceKey, javaTextLength, @@ -140,6 +141,42 @@ describe("a router's firewall log", () => { }); }); +describe("a router's settings page (konfig)", () => { + const pageOf = (engine: NetworkRuntimeEngine) => { + const pages = engine.webBrowser(LEFT)!.log.all.flatMap((line) => (line.kind === 'page' ? [line] : [])); + return pages[pages.length - 1]; + }; + const ask = (engine: NetworkRuntimeEngine, data?: string) => { + engine.webBrowser(LEFT)!.open('10.0.0.1/konfig', data); + engine.handle({ type: 'advance', toMilliseconds: engine.state.currentTimeMilliseconds + 5_000 }); + return pageOf(engine); + }; + + it('changes the firewall at run time, into the snapshot; a page without data changes nothing', () => { + const engine = startedEngine({ ...network(), webBrowserNodeIds: new Set([LEFT]) }); + const before = engine.state.topologySnapshot; + expect(ask(engine)).toMatchObject({ statusCode: 200, contentType: 'text/html' }); + expect(engine.state.topologySnapshot).toBe(before); + const page = ask(engine, 'firewallActivate=1&btnSave=speichern&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop'); + expect(engine.state.topologySnapshot.firewallConfigurationsByNodeId.get(ROUTER)).toEqual( + firewallConfiguration({ isActive: true, defaultPolicy: 'accept', filterSynSegmentsOnly: false, rules: [firewallRule({ protocol: 'udp', port: 7, action: 'drop' })] }), + ); + // The browser reads the answer as HTTPNachricht does: without its last empty lines. + expect(page?.body).toBe(firewallSettingsPage(engine.firewallConfiguration(ROUTER), 'de').replace(/\n+$/, '')); + }); + + it("answers in the project's language, and on a home router as on a router", () => { + const gateway = network({ language: 'en', webBrowserNodeIds: new Set([LEFT]) }); + const engine = startedEngine({ ...gateway, nodes: gateway.nodes.map((node) => (node.id === ROUTER ? { ...node, kind: 'gateway' as const } : node)) }); + const page = ask(engine, 'srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=22&action=accept&addrule=add'); + expect(page?.body).toContain('Router Firewall Configuration'); + expect(engine.firewallConfiguration(ROUTER).rules).toEqual([firewallRule({ protocol: 'udp', port: 7, action: 'drop' }), firewallRule({ protocol: 'tcp', port: 22, action: 'accept' })]); + const rejected = ask(engine, 'srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=0&action=accept&addrule=add'); + expect(rejected?.body).toContain('Erroneous input(s):
    • Port invalid

    '); + expect(engine.firewallConfiguration(ROUTER).rules).toHaveLength(2); + }); +}); + describe("a RIP route's public address (hopPublicIp)", () => { it('is the telling router\'s, also when a shorter way replaces the route', () => { const engine = startedEngine(network({ ripEnabledByNodeId: new Map([[ROUTER, true]]), firewallConfigurationsByNodeId: new Map() })); diff --git a/packages/core/test/routerWebJava.test.ts b/packages/core/test/routerWebJava.test.ts index 8435ee3..0a1bab3 100644 --- a/packages/core/test/routerWebJava.test.ts +++ b/packages/core/test/routerWebJava.test.ts @@ -11,7 +11,9 @@ // not compared. Java's router server sometimes never listens (setAktiv wakes // its thread only when it already waits), and takes no initial sequence // number then; the engine's always listens: sequence numbers are compared -// below the millions. The settings page (konfig) comes with F3.2c. +// below the millions. The settings page (konfig) changes the firewall at run +// time: a ping passes once "drop ICMP" is saved off; a rule moved above the +// one that accepts the browser shuts it out. import { readFileSync } from 'node:fs'; import { dirname, join } from 'node:path'; @@ -46,15 +48,53 @@ const open = engine.webBrowser(browser)!.open(typed); }; +const post = + (typed: string, data: string) => + (engine: NetworkRuntimeEngine, browser: string): void => { + engine.webBrowser(browser)!.open(typed, data); + }; + +const ping = (engine: NetworkRuntimeEngine, browser: string): void => { + engine.sendIcmpEcho(browser, '20.0.0.2', { sequenceNumber: 1 }); +}; + +/** The form as Java's browser window posts it: every field, then the button pressed. */ +const FORM = { + saveWithoutIcmp: 'firewallActivate=1&onlySYN=1&btnSave=speichern&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop', + addTcpDrop: 'firewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen', + moveSecondUp: 'firewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&radioRule=2&moveup=rauf&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop', +}; + const STORIES: Record = { routerIndex: { scenario: 'router-web', browser: id(301), router: id(302), acts: [[500, open('10.0.0.1')]] }, routerRoutes: { scenario: 'router-web', browser: id(301), router: id(302), acts: [[500, open('10.0.0.1/routes')]] }, + routerKonfig: { scenario: 'router-web', browser: id(301), router: id(302), acts: [[500, open('10.0.0.1/konfig')]] }, + konfigIcmp: { + scenario: 'router-web', + browser: id(301), + router: id(302), + acts: [ + [500, ping], + [3500, post('10.0.0.1/konfig', FORM.saveWithoutIcmp)], + [7000, ping], + ], + }, + konfigBlock: { + scenario: 'router-web', + browser: id(301), + router: id(302), + acts: [ + [500, post('10.0.0.1/konfig', FORM.addTcpDrop)], + [4000, post('10.0.0.1/konfig', FORM.moveSecondUp)], + [8000, open('10.0.0.1')], + ], + }, routerLog: { scenario: 'router-web', browser: id(301), router: id(302), acts: [ - [500, (engine, browser) => engine.sendIcmpEcho(browser, '20.0.0.2', { sequenceNumber: 1 })], + [500, ping], [3500, open('10.0.0.1')], [7000, open('10.0.0.1/log')], ], @@ -78,12 +118,21 @@ const withoutInitialNumbers = (text: string) => .replace(/(seq|ack)=(\d+)/g, (_, name: string, value: string) => `${name}=${Number(value) % 1_000_000}`) .replace(/(SEQ|ACK): \d+\.(\d{3}\.\d{3})/g, '$1: n.$2'); +/** Java's wait for a SYN's answer (TCPSocket: three times 2.75 s, its timeout here). */ +const JAVA_TIMEOUT_MILLISECONDS = 3 * 2_750; + /** * Where Java errs: its run corrected, as Java means it. routerLog: the * German log page closes its title with (sw_firewallweblog_msg1); - * the engine writes . + * the engine writes . konfigBlock: the browser's SYN, dropped by the + * firewall, goes once in Java, not three times (webJava.test.ts, noServer); + * the page "server not reachable" comes two attempts later in the engine. */ const JAVA_BUGS: Record JavaRun> = { + konfigBlock: (java) => ({ + ...java, + events: java.events.map(([time, who, text]) => (who === 'browser' && text.startsWith('page 0') ? [time + 2 * JAVA_TIMEOUT_MILLISECONDS, who, text] : [time, who, text])), + }), routerLog: (java) => { const fixed = (text: string | null) => text?.replace('', '') ?? null; const rows = (byCard: Record | undefined) => @@ -103,6 +152,11 @@ const PAGE_PLACEHOLDERS: Record string> = { ripRoutes: (text) => text.replace(/-?\d+<\/td>([\d.]+<\/td>validity$1'), }; +/** Where the frames are compared only up to a time (Java's). konfigBlock: the engine's second SYN, which Java does not send. */ +const UNTIL: Record number> = { + konfigBlock: (java) => java.events.find(([, who, text]) => who === 'browser' && text.startsWith('page 0'))![0] - 250, +}; + type Lines = Record; function javaLines(java: JavaRun): Lines { @@ -162,6 +216,7 @@ describe('the pages of routers and home routers as Java FILIUS serves them', () cell: (text) => placeholders(withoutInitialNumbers(text)), tables: java, from: firstCall, + until: UNTIL[name]?.(measured), starts: { java: 0, engine: 0 }, }); diff --git a/packages/core/test/scenarios/routerweb-java-konfigBlock.java.json b/packages/core/test/scenarios/routerweb-java-konfigBlock.java.json new file mode 100644 index 0000000..2850049 --- /dev/null +++ b/packages/core/test/scenarios/routerweb-java-konfigBlock.java.json @@ -0,0 +1,4933 @@ +{ + "frames": { + "00000000-0000-0000-0000-000000000301": [ + { + "time": 519, + "source": "02:00:00:00:03:11", + "destination": "FF:FF:FF:FF:FF:FF", + "arp": 1, + "senderIp": "10.0.0.2", + "targetIp": "10.0.0.1" + }, + { + "time": 756, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "arp": 2, + "senderIp": "10.0.0.1", + "targetIp": "10.0.0.2" + }, + { + "time": 759, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": null, + "tcpFlags": "S", + "sequence": 2000000, + "acknowledgement": 0 + }, + { + "time": 988, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 50999, + "payload": null, + "tcpFlags": "SA", + "sequence": 1000000, + "acknowledgement": 2000001 + }, + { + "time": 988, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000001, + "acknowledgement": 1000001 + }, + { + "time": 1044, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen", + "tcpFlags": "P", + "sequence": 2000001, + "acknowledgement": 0 + }, + { + "time": 1267, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 50999, + "payload": null, + "tcpFlags": "A", + "sequence": 1000001, + "acknowledgement": 2000190 + }, + { + "time": 1323, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 50999, + "payload": "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n", + "tcpFlags": "", + "sequence": 1001461, + "acknowledgement": 0 + }, + { + "time": 1547, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000190, + "acknowledgement": 1002921 + }, + { + "time": 1770, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 50999, + "payload": "\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
     2TCP80verwerfen
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n ", + "tcpFlags": "", + "sequence": 1002921, + "acknowledgement": 0 + }, + { + "time": 1771, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000190, + "acknowledgement": 1004381 + }, + { + "time": 1993, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 50999, + "payload": " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n", + "tcpFlags": "P", + "sequence": 1004381, + "acknowledgement": 0 + }, + { + "time": 1994, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000190, + "acknowledgement": 1005524 + }, + { + "time": 2049, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": null, + "tcpFlags": "F", + "sequence": 2000190, + "acknowledgement": 0 + }, + { + "time": 2272, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 50999, + "payload": null, + "tcpFlags": "A", + "sequence": 1005524, + "acknowledgement": 2000191 + }, + { + "time": 2328, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 50999, + "payload": null, + "tcpFlags": "F", + "sequence": 1005524, + "acknowledgement": 0 + }, + { + "time": 2328, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000191, + "acknowledgement": 1005525 + }, + { + "time": 4001, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": null, + "tcpFlags": "S", + "sequence": 4000000, + "acknowledgement": 0 + }, + { + "time": 4224, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 52289, + "payload": null, + "tcpFlags": "SA", + "sequence": 3000000, + "acknowledgement": 4000001 + }, + { + "time": 4224, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 4000001, + "acknowledgement": 3000001 + }, + { + "time": 4301, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&radioRule=2&moveup=rauf&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop", + "tcpFlags": "P", + "sequence": 4000001, + "acknowledgement": 0 + }, + { + "time": 4523, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 52289, + "payload": null, + "tcpFlags": "A", + "sequence": 3000001, + "acknowledgement": 4000186 + }, + { + "time": 4579, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 52289, + "payload": "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n", + "tcpFlags": "", + "sequence": 3001461, + "acknowledgement": 0 + }, + { + "time": 4802, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 4000186, + "acknowledgement": 3002921 + }, + { + "time": 5024, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 52289, + "payload": "\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     1TCP80verwerfen
     210.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n ", + "tcpFlags": "", + "sequence": 3002921, + "acknowledgement": 0 + }, + { + "time": 5024, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 4000186, + "acknowledgement": 3004381 + }, + { + "time": 5247, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 52289, + "payload": " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n", + "tcpFlags": "P", + "sequence": 3004381, + "acknowledgement": 0 + }, + { + "time": 5247, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 4000186, + "acknowledgement": 3005524 + }, + { + "time": 5303, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": null, + "tcpFlags": "F", + "sequence": 4000186, + "acknowledgement": 0 + }, + { + "time": 5525, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 52289, + "payload": null, + "tcpFlags": "A", + "sequence": 3005524, + "acknowledgement": 4000187 + }, + { + "time": 5580, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 52289, + "payload": null, + "tcpFlags": "F", + "sequence": 3005524, + "acknowledgement": 0 + }, + { + "time": 5581, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 4000187, + "acknowledgement": 3005525 + }, + { + "time": 8001, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 64828, + "destinationPort": 80, + "payload": null, + "tcpFlags": "S", + "sequence": 6000000, + "acknowledgement": 0 + } + ], + "00000000-0000-0000-0000-000000000302": [ + { + "time": 643, + "source": "02:00:00:00:03:11", + "destination": "FF:FF:FF:FF:FF:FF", + "arp": 1, + "senderIp": "10.0.0.2", + "targetIp": "10.0.0.1" + }, + { + "time": 644, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "arp": 2, + "senderIp": "10.0.0.1", + "targetIp": "10.0.0.2" + }, + { + "time": 873, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": null, + "tcpFlags": "S", + "sequence": 2000000, + "acknowledgement": 0 + }, + { + "time": 876, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 50999, + "payload": null, + "tcpFlags": "SA", + "sequence": 1000000, + "acknowledgement": 2000001 + }, + { + "time": 1100, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000001, + "acknowledgement": 1000001 + }, + { + "time": 1155, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen", + "tcpFlags": "P", + "sequence": 2000001, + "acknowledgement": 0 + }, + { + "time": 1156, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 50999, + "payload": null, + "tcpFlags": "A", + "sequence": 1000001, + "acknowledgement": 2000190 + }, + { + "time": 1212, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 50999, + "payload": "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n", + "tcpFlags": "", + "sequence": 1001461, + "acknowledgement": 0 + }, + { + "time": 1658, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000190, + "acknowledgement": 1002921 + }, + { + "time": 1659, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 50999, + "payload": "\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
     2TCP80verwerfen
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n ", + "tcpFlags": "", + "sequence": 1002921, + "acknowledgement": 0 + }, + { + "time": 1882, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000190, + "acknowledgement": 1004381 + }, + { + "time": 1882, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 50999, + "payload": " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n", + "tcpFlags": "P", + "sequence": 1004381, + "acknowledgement": 0 + }, + { + "time": 2105, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000190, + "acknowledgement": 1005524 + }, + { + "time": 2161, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": null, + "tcpFlags": "F", + "sequence": 2000190, + "acknowledgement": 0 + }, + { + "time": 2161, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 50999, + "payload": null, + "tcpFlags": "A", + "sequence": 1005524, + "acknowledgement": 2000191 + }, + { + "time": 2216, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 50999, + "payload": null, + "tcpFlags": "F", + "sequence": 1005524, + "acknowledgement": 0 + }, + { + "time": 2439, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 50999, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000191, + "acknowledgement": 1005525 + }, + { + "time": 4112, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": null, + "tcpFlags": "S", + "sequence": 4000000, + "acknowledgement": 0 + }, + { + "time": 4112, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 52289, + "payload": null, + "tcpFlags": "SA", + "sequence": 3000000, + "acknowledgement": 4000001 + }, + { + "time": 4335, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 4000001, + "acknowledgement": 3000001 + }, + { + "time": 4412, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&radioRule=2&moveup=rauf&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop", + "tcpFlags": "P", + "sequence": 4000001, + "acknowledgement": 0 + }, + { + "time": 4412, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 52289, + "payload": null, + "tcpFlags": "A", + "sequence": 3000001, + "acknowledgement": 4000186 + }, + { + "time": 4468, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 52289, + "payload": "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n", + "tcpFlags": "", + "sequence": 3001461, + "acknowledgement": 0 + }, + { + "time": 4913, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 4000186, + "acknowledgement": 3002921 + }, + { + "time": 4913, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 52289, + "payload": "\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     1TCP80verwerfen
     210.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n ", + "tcpFlags": "", + "sequence": 3002921, + "acknowledgement": 0 + }, + { + "time": 5135, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 4000186, + "acknowledgement": 3004381 + }, + { + "time": 5136, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 52289, + "payload": " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n", + "tcpFlags": "P", + "sequence": 3004381, + "acknowledgement": 0 + }, + { + "time": 5358, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 4000186, + "acknowledgement": 3005524 + }, + { + "time": 5414, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": null, + "tcpFlags": "F", + "sequence": 4000186, + "acknowledgement": 0 + }, + { + "time": 5414, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 52289, + "payload": null, + "tcpFlags": "A", + "sequence": 3005524, + "acknowledgement": 4000187 + }, + { + "time": 5469, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 52289, + "payload": null, + "tcpFlags": "F", + "sequence": 3005524, + "acknowledgement": 0 + }, + { + "time": 5692, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 52289, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 4000187, + "acknowledgement": 3005525 + }, + { + "time": 8112, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 64828, + "destinationPort": 80, + "payload": null, + "tcpFlags": "S", + "sequence": 6000000, + "acknowledgement": 0 + } + ], + "00000000-0000-0000-0000-000000000302#1": [], + "00000000-0000-0000-0000-000000000303": [] + }, + "rows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "10.0.0.1:80", + "10.0.0.2:50999", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + "10.0.0.2:50999", + "10.0.0.1:80", + "HTTP", + "Anwendung", + "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen" + ], + [ + "7", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "10.0.0.1:80", + "10.0.0.2:50999", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.190" + ], + [ + "8", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "10.0.0.1:80", + "10.0.0.2:50999", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + "10.0.0.1:80", + "10.0.0.2:50999", + "HTTP", + "Anwendung", + "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n" + ], + [ + "11", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.190, ACK: 1.002.921" + ], + [ + "12", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "10.0.0.1:80", + "10.0.0.2:50999", + "TCP", + "Transport", + "SEQ: 1.002.921" + ], + [ + "12", + "10.0.0.1:80", + "10.0.0.2:50999", + "HTTP", + "Anwendung", + "\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
     2TCP80verwerfen
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n " + ], + [ + "13", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.190, ACK: 1.004.381" + ], + [ + "14", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "14", + "10.0.0.1:80", + "10.0.0.2:50999", + "TCP", + "Transport", + "SEQ: 1.004.381" + ], + [ + "14", + "10.0.0.1:80", + "10.0.0.2:50999", + "HTTP", + "Anwendung", + " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + "15", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "15", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.190, ACK: 1.005.524" + ], + [ + "16", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "16", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "16", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.190" + ], + [ + "17", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "17", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "17", + "10.0.0.1:80", + "10.0.0.2:50999", + "TCP", + "Transport", + "SEQ: 1.005.524, ACK: 2.000.191" + ], + [ + "18", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "18", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "18", + "10.0.0.1:80", + "10.0.0.2:50999", + "TCP", + "Transport", + "FIN, SEQ: 1.005.524" + ], + [ + "19", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "19", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "19", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.191, ACK: 1.005.525" + ], + [ + "20", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "20", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "20", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "SYN, SEQ: 4.000.000" + ], + [ + "21", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "21", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "21", + "10.0.0.1:80", + "10.0.0.2:52289", + "TCP", + "Transport", + "SYN, SEQ: 3.000.000, ACK: 4.000.001" + ], + [ + "22", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "22", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "22", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 4.000.001, ACK: 3.000.001" + ], + [ + "23", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "23", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "23", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 4.000.001" + ], + [ + "23", + "10.0.0.2:52289", + "10.0.0.1:80", + "HTTP", + "Anwendung", + "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&radioRule=2&moveup=rauf&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop" + ], + [ + "24", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "24", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "24", + "10.0.0.1:80", + "10.0.0.2:52289", + "TCP", + "Transport", + "SEQ: 3.000.001, ACK: 4.000.186" + ], + [ + "25", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "25", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "25", + "10.0.0.1:80", + "10.0.0.2:52289", + "TCP", + "Transport", + "SEQ: 3.000.001" + ], + [ + "25", + "10.0.0.1:80", + "10.0.0.2:52289", + "HTTP", + "Anwendung", + "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n" + ], + [ + "28", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "28", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "28", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 4.000.186, ACK: 3.002.921" + ], + [ + "29", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "29", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "29", + "10.0.0.1:80", + "10.0.0.2:52289", + "TCP", + "Transport", + "SEQ: 3.002.921" + ], + [ + "29", + "10.0.0.1:80", + "10.0.0.2:52289", + "HTTP", + "Anwendung", + "\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     1TCP80verwerfen
     210.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n " + ], + [ + "30", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "30", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "30", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 4.000.186, ACK: 3.004.381" + ], + [ + "31", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "31", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "31", + "10.0.0.1:80", + "10.0.0.2:52289", + "TCP", + "Transport", + "SEQ: 3.004.381" + ], + [ + "31", + "10.0.0.1:80", + "10.0.0.2:52289", + "HTTP", + "Anwendung", + " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + "32", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "32", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "32", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 4.000.186, ACK: 3.005.524" + ], + [ + "33", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "33", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "33", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "FIN, SEQ: 4.000.186" + ], + [ + "34", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "34", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "34", + "10.0.0.1:80", + "10.0.0.2:52289", + "TCP", + "Transport", + "SEQ: 3.005.524, ACK: 4.000.187" + ], + [ + "35", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "35", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "35", + "10.0.0.1:80", + "10.0.0.2:52289", + "TCP", + "Transport", + "FIN, SEQ: 3.005.524" + ], + [ + "36", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "36", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "36", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 4.000.187, ACK: 3.005.525" + ], + [ + "37", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "37", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "37", + "10.0.0.2:64828", + "10.0.0.1:80", + "TCP", + "Transport", + "SYN, SEQ: 6.000.000" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "10.0.0.1:80", + "10.0.0.2:50999", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + "10.0.0.2:50999", + "10.0.0.1:80", + "HTTP", + "Anwendung", + "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen" + ], + [ + "7", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "10.0.0.1:80", + "10.0.0.2:50999", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.190" + ], + [ + "8", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "10.0.0.1:80", + "10.0.0.2:50999", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + "10.0.0.1:80", + "10.0.0.2:50999", + "HTTP", + "Anwendung", + "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n" + ], + [ + "11", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.190, ACK: 1.002.921" + ], + [ + "12", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "10.0.0.1:80", + "10.0.0.2:50999", + "TCP", + "Transport", + "SEQ: 1.002.921" + ], + [ + "12", + "10.0.0.1:80", + "10.0.0.2:50999", + "HTTP", + "Anwendung", + "\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
     2TCP80verwerfen
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n " + ], + [ + "13", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.190, ACK: 1.004.381" + ], + [ + "14", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "14", + "10.0.0.1:80", + "10.0.0.2:50999", + "TCP", + "Transport", + "SEQ: 1.004.381" + ], + [ + "14", + "10.0.0.1:80", + "10.0.0.2:50999", + "HTTP", + "Anwendung", + " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + "15", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "15", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.190, ACK: 1.005.524" + ], + [ + "16", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "16", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "16", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.190" + ], + [ + "17", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "17", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "17", + "10.0.0.1:80", + "10.0.0.2:50999", + "TCP", + "Transport", + "SEQ: 1.005.524, ACK: 2.000.191" + ], + [ + "18", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "18", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "18", + "10.0.0.1:80", + "10.0.0.2:50999", + "TCP", + "Transport", + "FIN, SEQ: 1.005.524" + ], + [ + "19", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "19", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "19", + "10.0.0.2:50999", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.191, ACK: 1.005.525" + ], + [ + "20", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "20", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "20", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "SYN, SEQ: 4.000.000" + ], + [ + "21", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "21", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "21", + "10.0.0.1:80", + "10.0.0.2:52289", + "TCP", + "Transport", + "SYN, SEQ: 3.000.000, ACK: 4.000.001" + ], + [ + "22", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "22", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "22", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 4.000.001, ACK: 3.000.001" + ], + [ + "23", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "23", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "23", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 4.000.001" + ], + [ + "23", + "10.0.0.2:52289", + "10.0.0.1:80", + "HTTP", + "Anwendung", + "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&radioRule=2&moveup=rauf&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop" + ], + [ + "24", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "24", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "24", + "10.0.0.1:80", + "10.0.0.2:52289", + "TCP", + "Transport", + "SEQ: 3.000.001, ACK: 4.000.186" + ], + [ + "25", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "25", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "25", + "10.0.0.1:80", + "10.0.0.2:52289", + "TCP", + "Transport", + "SEQ: 3.000.001" + ], + [ + "25", + "10.0.0.1:80", + "10.0.0.2:52289", + "HTTP", + "Anwendung", + "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n" + ], + [ + "28", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "28", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "28", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 4.000.186, ACK: 3.002.921" + ], + [ + "29", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "29", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "29", + "10.0.0.1:80", + "10.0.0.2:52289", + "TCP", + "Transport", + "SEQ: 3.002.921" + ], + [ + "29", + "10.0.0.1:80", + "10.0.0.2:52289", + "HTTP", + "Anwendung", + "\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     1TCP80verwerfen
     210.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n " + ], + [ + "30", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "30", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "30", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 4.000.186, ACK: 3.004.381" + ], + [ + "31", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "31", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "31", + "10.0.0.1:80", + "10.0.0.2:52289", + "TCP", + "Transport", + "SEQ: 3.004.381" + ], + [ + "31", + "10.0.0.1:80", + "10.0.0.2:52289", + "HTTP", + "Anwendung", + " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + "32", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "32", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "32", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 4.000.186, ACK: 3.005.524" + ], + [ + "33", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "33", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "33", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "FIN, SEQ: 4.000.186" + ], + [ + "34", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "34", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "34", + "10.0.0.1:80", + "10.0.0.2:52289", + "TCP", + "Transport", + "SEQ: 3.005.524, ACK: 4.000.187" + ], + [ + "35", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "35", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "35", + "10.0.0.1:80", + "10.0.0.2:52289", + "TCP", + "Transport", + "FIN, SEQ: 3.005.524" + ], + [ + "36", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "36", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "36", + "10.0.0.2:52289", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 4.000.187, ACK: 3.005.525" + ], + [ + "37", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "37", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "37", + "10.0.0.2:64828", + "10.0.0.1:80", + "TCP", + "Transport", + "SYN, SEQ: 6.000.000" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [], + "00000000-0000-0000-0000-000000000303": [] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "50999", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "50999", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "50999", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "50999", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + null, + null, + "HTTP", + "Anwendung", + "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen" + ], + [ + "7", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "80", + "50999", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.190" + ], + [ + "8", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "80", + "50999", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + null, + null, + "HTTP", + "Anwendung", + "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n" + ], + [ + "11", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "50999", + "80", + "TCP", + "Transport", + "SEQ: 2.000.190, ACK: 1.002.921" + ], + [ + "12", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "80", + "50999", + "TCP", + "Transport", + "SEQ: 1.002.921" + ], + [ + "12", + null, + null, + "HTTP", + "Anwendung", + "\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
     2TCP80verwerfen
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n " + ], + [ + "13", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "50999", + "80", + "TCP", + "Transport", + "SEQ: 2.000.190, ACK: 1.004.381" + ], + [ + "14", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "14", + "80", + "50999", + "TCP", + "Transport", + "SEQ: 1.004.381" + ], + [ + "14", + null, + null, + "HTTP", + "Anwendung", + " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + "15", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "15", + "50999", + "80", + "TCP", + "Transport", + "SEQ: 2.000.190, ACK: 1.005.524" + ], + [ + "16", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "16", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "16", + "50999", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.190" + ], + [ + "17", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "17", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "17", + "80", + "50999", + "TCP", + "Transport", + "SEQ: 1.005.524, ACK: 2.000.191" + ], + [ + "18", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "18", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "18", + "80", + "50999", + "TCP", + "Transport", + "FIN, SEQ: 1.005.524" + ], + [ + "19", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "19", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "19", + "50999", + "80", + "TCP", + "Transport", + "SEQ: 2.000.191, ACK: 1.005.525" + ], + [ + "20", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "20", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "20", + "52289", + "80", + "TCP", + "Transport", + "SYN, SEQ: 4.000.000" + ], + [ + "21", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "21", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "21", + "80", + "52289", + "TCP", + "Transport", + "SYN, SEQ: 3.000.000, ACK: 4.000.001" + ], + [ + "22", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "22", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "22", + "52289", + "80", + "TCP", + "Transport", + "SEQ: 4.000.001, ACK: 3.000.001" + ], + [ + "23", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "23", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "23", + "52289", + "80", + "TCP", + "Transport", + "SEQ: 4.000.001" + ], + [ + "23", + null, + null, + "HTTP", + "Anwendung", + "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&radioRule=2&moveup=rauf&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop" + ], + [ + "24", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "24", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "24", + "80", + "52289", + "TCP", + "Transport", + "SEQ: 3.000.001, ACK: 4.000.186" + ], + [ + "25", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "25", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "25", + "80", + "52289", + "TCP", + "Transport", + "SEQ: 3.000.001" + ], + [ + "25", + null, + null, + "HTTP", + "Anwendung", + "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n" + ], + [ + "28", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "28", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "28", + "52289", + "80", + "TCP", + "Transport", + "SEQ: 4.000.186, ACK: 3.002.921" + ], + [ + "29", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "29", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "29", + "80", + "52289", + "TCP", + "Transport", + "SEQ: 3.002.921" + ], + [ + "29", + null, + null, + "HTTP", + "Anwendung", + "\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     1TCP80verwerfen
     210.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n " + ], + [ + "30", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "30", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "30", + "52289", + "80", + "TCP", + "Transport", + "SEQ: 4.000.186, ACK: 3.004.381" + ], + [ + "31", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "31", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "31", + "80", + "52289", + "TCP", + "Transport", + "SEQ: 3.004.381" + ], + [ + "31", + null, + null, + "HTTP", + "Anwendung", + " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + "32", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "32", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "32", + "52289", + "80", + "TCP", + "Transport", + "SEQ: 4.000.186, ACK: 3.005.524" + ], + [ + "33", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "33", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "33", + "52289", + "80", + "TCP", + "Transport", + "FIN, SEQ: 4.000.186" + ], + [ + "34", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "34", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "34", + "80", + "52289", + "TCP", + "Transport", + "SEQ: 3.005.524, ACK: 4.000.187" + ], + [ + "35", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "35", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "35", + "80", + "52289", + "TCP", + "Transport", + "FIN, SEQ: 3.005.524" + ], + [ + "36", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "36", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "36", + "52289", + "80", + "TCP", + "Transport", + "SEQ: 4.000.187, ACK: 3.005.525" + ], + [ + "37", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "37", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "37", + "64828", + "80", + "TCP", + "Transport", + "SYN, SEQ: 6.000.000" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "3", + "50999", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "4", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "80", + "50999", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "5", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "50999", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "6", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "50999", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "6", + null, + null, + "HTTP", + "Anwendung", + "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen" + ], + [ + "7", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "80", + "50999", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.190" + ], + [ + "8", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "80", + "50999", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "8", + null, + null, + "HTTP", + "Anwendung", + "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n" + ], + [ + "11", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "50999", + "80", + "TCP", + "Transport", + "SEQ: 2.000.190, ACK: 1.002.921" + ], + [ + "12", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "12", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "12", + "80", + "50999", + "TCP", + "Transport", + "SEQ: 1.002.921" + ], + [ + "12", + null, + null, + "HTTP", + "Anwendung", + "\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
     2TCP80verwerfen
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n " + ], + [ + "13", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "13", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "13", + "50999", + "80", + "TCP", + "Transport", + "SEQ: 2.000.190, ACK: 1.004.381" + ], + [ + "14", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "14", + "80", + "50999", + "TCP", + "Transport", + "SEQ: 1.004.381" + ], + [ + "14", + null, + null, + "HTTP", + "Anwendung", + " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + "15", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "15", + "50999", + "80", + "TCP", + "Transport", + "SEQ: 2.000.190, ACK: 1.005.524" + ], + [ + "16", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "16", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "16", + "50999", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.190" + ], + [ + "17", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "17", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "17", + "80", + "50999", + "TCP", + "Transport", + "SEQ: 1.005.524, ACK: 2.000.191" + ], + [ + "18", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "18", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "18", + "80", + "50999", + "TCP", + "Transport", + "FIN, SEQ: 1.005.524" + ], + [ + "19", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "19", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "19", + "50999", + "80", + "TCP", + "Transport", + "SEQ: 2.000.191, ACK: 1.005.525" + ], + [ + "20", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "20", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "20", + "52289", + "80", + "TCP", + "Transport", + "SYN, SEQ: 4.000.000" + ], + [ + "21", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "21", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "21", + "80", + "52289", + "TCP", + "Transport", + "SYN, SEQ: 3.000.000, ACK: 4.000.001" + ], + [ + "22", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "22", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "22", + "52289", + "80", + "TCP", + "Transport", + "SEQ: 4.000.001, ACK: 3.000.001" + ], + [ + "23", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "23", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "23", + "52289", + "80", + "TCP", + "Transport", + "SEQ: 4.000.001" + ], + [ + "23", + null, + null, + "HTTP", + "Anwendung", + "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&radioRule=2&moveup=rauf&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop" + ], + [ + "24", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "24", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "24", + "80", + "52289", + "TCP", + "Transport", + "SEQ: 3.000.001, ACK: 4.000.186" + ], + [ + "25", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "25", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "25", + "80", + "52289", + "TCP", + "Transport", + "SEQ: 3.000.001" + ], + [ + "25", + null, + null, + "HTTP", + "Anwendung", + "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n" + ], + [ + "28", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "28", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "28", + "52289", + "80", + "TCP", + "Transport", + "SEQ: 4.000.186, ACK: 3.002.921" + ], + [ + "29", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "29", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "29", + "80", + "52289", + "TCP", + "Transport", + "SEQ: 3.002.921" + ], + [ + "29", + null, + null, + "HTTP", + "Anwendung", + "\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     1TCP80verwerfen
     210.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n " + ], + [ + "30", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "30", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "30", + "52289", + "80", + "TCP", + "Transport", + "SEQ: 4.000.186, ACK: 3.004.381" + ], + [ + "31", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "31", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "31", + "80", + "52289", + "TCP", + "Transport", + "SEQ: 3.004.381" + ], + [ + "31", + null, + null, + "HTTP", + "Anwendung", + " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + "32", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "32", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "32", + "52289", + "80", + "TCP", + "Transport", + "SEQ: 4.000.186, ACK: 3.005.524" + ], + [ + "33", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "33", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "33", + "52289", + "80", + "TCP", + "Transport", + "FIN, SEQ: 4.000.186" + ], + [ + "34", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "34", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "34", + "80", + "52289", + "TCP", + "Transport", + "SEQ: 3.005.524, ACK: 4.000.187" + ], + [ + "35", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "35", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "35", + "80", + "52289", + "TCP", + "Transport", + "FIN, SEQ: 3.005.524" + ], + [ + "36", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "36", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "36", + "52289", + "80", + "TCP", + "Transport", + "SEQ: 4.000.187, ACK: 3.005.525" + ], + [ + "37", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "37", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "37", + "64828", + "80", + "TCP", + "Transport", + "SYN, SEQ: 6.000.000" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [], + "00000000-0000-0000-0000-000000000303": [] + }, + "events": [ + [ + 208, + "browser", + "update" + ], + [ + 209, + "server", + "null" + ], + [ + 211, + "server", + "Annahme von Verbindungsanfragen gestartet" + ], + [ + 500, + "browser", + "call holeWebseite 10.0.0.1/konfig firewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen" + ], + [ + 1117, + "server", + "Verbindung zu 10.0.0.2:50999 hergestellt" + ], + [ + 1156, + "server", + ">>POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen" + ], + [ + 2017, + "browser", + "page 200 text/html\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
     2TCP80verwerfen
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n" + ], + [ + 2105, + "server", + "<\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
     2TCP80verwerfen
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + 2161, + "server", + "Socket zu 10.0.0.2:50999 geschlossen" + ], + [ + 4000, + "browser", + "call holeWebseite 10.0.0.1/konfig firewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&radioRule=2&moveup=rauf&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop" + ], + [ + 4420, + "server", + "Verbindung zu 10.0.0.2:52289 hergestellt" + ], + [ + 4420, + "server", + ">>POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&radioRule=2&moveup=rauf&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop" + ], + [ + 5250, + "browser", + "page 200 text/html\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     1TCP80verwerfen
     210.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n" + ], + [ + 5358, + "server", + "<\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     1TCP80verwerfen
     210.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + 5414, + "server", + "Socket zu 10.0.0.2:52289 geschlossen" + ], + [ + 8000, + "browser", + "call holeWebseite 10.0.0.1" + ], + [ + 16307, + "browser", + "page 0 null\nFehler

    Server konnte nicht erreicht werden!

    " + ] + ] +} diff --git a/packages/core/test/scenarios/routerweb-java-konfigIcmp.java.json b/packages/core/test/scenarios/routerweb-java-konfigIcmp.java.json new file mode 100644 index 0000000..e66f350 --- /dev/null +++ b/packages/core/test/scenarios/routerweb-java-konfigIcmp.java.json @@ -0,0 +1,3107 @@ +{ + "frames": { + "00000000-0000-0000-0000-000000000301": [ + { + "time": 506, + "source": "02:00:00:00:03:11", + "destination": "FF:FF:FF:FF:FF:FF", + "arp": 1, + "senderIp": "10.0.0.2", + "targetIp": "10.0.0.1" + }, + { + "time": 741, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "arp": 2, + "senderIp": "10.0.0.1", + "targetIp": "10.0.0.2" + }, + { + "time": 745, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "icmp": 8, + "icmpCode": 0, + "sourceIp": "10.0.0.2", + "destinationIp": "20.0.0.2", + "sequence": 1 + }, + { + "time": 3513, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": null, + "tcpFlags": "S", + "sequence": 2000000, + "acknowledgement": 0 + }, + { + "time": 3741, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 54970, + "payload": null, + "tcpFlags": "SA", + "sequence": 1000000, + "acknowledgement": 2000001 + }, + { + "time": 3741, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000001, + "acknowledgement": 1000001 + }, + { + "time": 3809, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&onlySYN=1&btnSave=speichern&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop", + "tcpFlags": "P", + "sequence": 2000001, + "acknowledgement": 0 + }, + { + "time": 4033, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 54970, + "payload": null, + "tcpFlags": "A", + "sequence": 1000001, + "acknowledgement": 2000169 + }, + { + "time": 4088, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 54970, + "payload": "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 ", + "tcpFlags": "", + "sequence": 1000001, + "acknowledgement": 0 + }, + { + "time": 4089, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000169, + "acknowledgement": 1001461 + }, + { + "time": 4315, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 54970, + "payload": " \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n \n \n \n \n \n \n", + "tcpFlags": "", + "sequence": 1002921, + "acknowledgement": 0 + }, + { + "time": 4539, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000169, + "acknowledgement": 1004381 + }, + { + "time": 4762, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 54970, + "payload": " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n", + "tcpFlags": "P", + "sequence": 1004381, + "acknowledgement": 0 + }, + { + "time": 4762, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000169, + "acknowledgement": 1005330 + }, + { + "time": 4818, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": null, + "tcpFlags": "F", + "sequence": 2000169, + "acknowledgement": 0 + }, + { + "time": 5040, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 54970, + "payload": null, + "tcpFlags": "A", + "sequence": 1005330, + "acknowledgement": 2000170 + }, + { + "time": 5096, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 54970, + "payload": null, + "tcpFlags": "F", + "sequence": 1005330, + "acknowledgement": 0 + }, + { + "time": 5096, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000170, + "acknowledgement": 1005331 + }, + { + "time": 7001, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "icmp": 8, + "icmpCode": 0, + "sourceIp": "10.0.0.2", + "destinationIp": "20.0.0.2", + "sequence": 1 + }, + { + "time": 7446, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "icmp": 0, + "icmpCode": 0, + "sourceIp": "20.0.0.2", + "destinationIp": "10.0.0.2", + "sequence": 1 + } + ], + "00000000-0000-0000-0000-000000000302": [ + { + "time": 628, + "source": "02:00:00:00:03:11", + "destination": "FF:FF:FF:FF:FF:FF", + "arp": 1, + "senderIp": "10.0.0.2", + "targetIp": "10.0.0.1" + }, + { + "time": 630, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "arp": 2, + "senderIp": "10.0.0.1", + "targetIp": "10.0.0.2" + }, + { + "time": 859, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "icmp": 8, + "icmpCode": 0, + "sourceIp": "10.0.0.2", + "destinationIp": "20.0.0.2", + "sequence": 1 + }, + { + "time": 3626, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": null, + "tcpFlags": "S", + "sequence": 2000000, + "acknowledgement": 0 + }, + { + "time": 3629, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 54970, + "payload": null, + "tcpFlags": "SA", + "sequence": 1000000, + "acknowledgement": 2000001 + }, + { + "time": 3853, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000001, + "acknowledgement": 1000001 + }, + { + "time": 3921, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&onlySYN=1&btnSave=speichern&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop", + "tcpFlags": "P", + "sequence": 2000001, + "acknowledgement": 0 + }, + { + "time": 3921, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 54970, + "payload": null, + "tcpFlags": "A", + "sequence": 1000001, + "acknowledgement": 2000169 + }, + { + "time": 3977, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 54970, + "payload": "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 ", + "tcpFlags": "", + "sequence": 1000001, + "acknowledgement": 0 + }, + { + "time": 4200, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000169, + "acknowledgement": 1001461 + }, + { + "time": 4200, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 54970, + "payload": " \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n \n \n \n \n \n \n", + "tcpFlags": "", + "sequence": 1002921, + "acknowledgement": 0 + }, + { + "time": 4650, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000169, + "acknowledgement": 1004381 + }, + { + "time": 4650, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 54970, + "payload": " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n", + "tcpFlags": "P", + "sequence": 1004381, + "acknowledgement": 0 + }, + { + "time": 4873, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000169, + "acknowledgement": 1005330 + }, + { + "time": 4929, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": null, + "tcpFlags": "F", + "sequence": 2000169, + "acknowledgement": 0 + }, + { + "time": 4929, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 54970, + "payload": null, + "tcpFlags": "A", + "sequence": 1005330, + "acknowledgement": 2000170 + }, + { + "time": 4985, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "sourceIp": "10.0.0.1", + "destinationIp": "10.0.0.2", + "protocol": 6, + "sourcePort": 80, + "destinationPort": 54970, + "payload": null, + "tcpFlags": "F", + "sequence": 1005330, + "acknowledgement": 0 + }, + { + "time": 5208, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "sourceIp": "10.0.0.2", + "destinationIp": "10.0.0.1", + "protocol": 6, + "sourcePort": 54970, + "destinationPort": 80, + "payload": null, + "tcpFlags": "A", + "sequence": 2000170, + "acknowledgement": 1005331 + }, + { + "time": 7112, + "source": "02:00:00:00:03:11", + "destination": "02:00:00:00:03:21", + "icmp": 8, + "icmpCode": 0, + "sourceIp": "10.0.0.2", + "destinationIp": "20.0.0.2", + "sequence": 1 + }, + { + "time": 7335, + "source": "02:00:00:00:03:21", + "destination": "02:00:00:00:03:11", + "icmp": 0, + "icmpCode": 0, + "sourceIp": "20.0.0.2", + "destinationIp": "10.0.0.2", + "sequence": 1 + } + ], + "00000000-0000-0000-0000-000000000302#1": [ + { + "time": 7112, + "source": "02:00:00:00:03:22", + "destination": "FF:FF:FF:FF:FF:FF", + "arp": 1, + "senderIp": "20.0.0.1", + "targetIp": "20.0.0.2" + }, + { + "time": 7223, + "source": "02:00:00:00:03:13", + "destination": "02:00:00:00:03:22", + "arp": 2, + "senderIp": "20.0.0.2", + "targetIp": "20.0.0.1" + }, + { + "time": 7224, + "source": "02:00:00:00:03:22", + "destination": "02:00:00:00:03:13", + "icmp": 8, + "icmpCode": 0, + "sourceIp": "10.0.0.2", + "destinationIp": "20.0.0.2", + "sequence": 1 + }, + { + "time": 7335, + "source": "02:00:00:00:03:13", + "destination": "02:00:00:00:03:22", + "icmp": 0, + "icmpCode": 0, + "sourceIp": "20.0.0.2", + "destinationIp": "10.0.0.2", + "sequence": 1 + } + ], + "00000000-0000-0000-0000-000000000303": [ + { + "time": 7168, + "source": "02:00:00:00:03:22", + "destination": "FF:FF:FF:FF:FF:FF", + "arp": 1, + "senderIp": "20.0.0.1", + "targetIp": "20.0.0.2" + }, + { + "time": 7168, + "source": "02:00:00:00:03:13", + "destination": "02:00:00:00:03:22", + "arp": 2, + "senderIp": "20.0.0.2", + "targetIp": "20.0.0.1" + }, + { + "time": 7279, + "source": "02:00:00:00:03:22", + "destination": "02:00:00:00:03:13", + "icmp": 8, + "icmpCode": 0, + "sourceIp": "10.0.0.2", + "destinationIp": "20.0.0.2", + "sequence": 1 + }, + { + "time": 7279, + "source": "02:00:00:00:03:13", + "destination": "02:00:00:00:03:22", + "icmp": 0, + "icmpCode": 0, + "sourceIp": "20.0.0.2", + "destinationIp": "10.0.0.2", + "sequence": 1 + } + ] + }, + "rows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "5", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "10.0.0.1:80", + "10.0.0.2:54970", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "6", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "7", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "7", + "10.0.0.2:54970", + "10.0.0.1:80", + "HTTP", + "Anwendung", + "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&onlySYN=1&btnSave=speichern&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop" + ], + [ + "8", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "10.0.0.1:80", + "10.0.0.2:54970", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.169" + ], + [ + "9", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "10.0.0.1:80", + "10.0.0.2:54970", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "9", + "10.0.0.1:80", + "10.0.0.2:54970", + "HTTP", + "Anwendung", + "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 " + ], + [ + "10", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.169, ACK: 1.001.461" + ], + [ + "11", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "10.0.0.1:80", + "10.0.0.2:54970", + "TCP", + "Transport", + "SEQ: 1.001.461" + ], + [ + "11", + "10.0.0.1:80", + "10.0.0.2:54970", + "HTTP", + "Anwendung", + " \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n \n \n \n \n \n \n" + ], + [ + "14", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "14", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.169, ACK: 1.004.381" + ], + [ + "15", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "15", + "10.0.0.1:80", + "10.0.0.2:54970", + "TCP", + "Transport", + "SEQ: 1.004.381" + ], + [ + "15", + "10.0.0.1:80", + "10.0.0.2:54970", + "HTTP", + "Anwendung", + " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + "16", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "16", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "16", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.169, ACK: 1.005.330" + ], + [ + "17", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "17", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "17", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.169" + ], + [ + "18", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "18", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "18", + "10.0.0.1:80", + "10.0.0.2:54970", + "TCP", + "Transport", + "SEQ: 1.005.330, ACK: 2.000.170" + ], + [ + "19", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "19", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "19", + "10.0.0.1:80", + "10.0.0.2:54970", + "TCP", + "Transport", + "FIN, SEQ: 1.005.330" + ], + [ + "20", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "20", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "20", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.170, ACK: 1.005.331" + ], + [ + "21", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "21", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "22", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "22", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "5", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "10.0.0.1:80", + "10.0.0.2:54970", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "6", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "7", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "7", + "10.0.0.2:54970", + "10.0.0.1:80", + "HTTP", + "Anwendung", + "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&onlySYN=1&btnSave=speichern&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop" + ], + [ + "8", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "10.0.0.1:80", + "10.0.0.2:54970", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.169" + ], + [ + "9", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "10.0.0.1:80", + "10.0.0.2:54970", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "9", + "10.0.0.1:80", + "10.0.0.2:54970", + "HTTP", + "Anwendung", + "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 " + ], + [ + "10", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.169, ACK: 1.001.461" + ], + [ + "11", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "10.0.0.1:80", + "10.0.0.2:54970", + "TCP", + "Transport", + "SEQ: 1.001.461" + ], + [ + "11", + "10.0.0.1:80", + "10.0.0.2:54970", + "HTTP", + "Anwendung", + " \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n \n \n \n \n \n \n" + ], + [ + "14", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "14", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.169, ACK: 1.004.381" + ], + [ + "15", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "15", + "10.0.0.1:80", + "10.0.0.2:54970", + "TCP", + "Transport", + "SEQ: 1.004.381" + ], + [ + "15", + "10.0.0.1:80", + "10.0.0.2:54970", + "HTTP", + "Anwendung", + " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + "16", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "16", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "16", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.169, ACK: 1.005.330" + ], + [ + "17", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "17", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "17", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.169" + ], + [ + "18", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "18", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "18", + "10.0.0.1:80", + "10.0.0.2:54970", + "TCP", + "Transport", + "SEQ: 1.005.330, ACK: 2.000.170" + ], + [ + "19", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "19", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "19", + "10.0.0.1:80", + "10.0.0.2:54970", + "TCP", + "Transport", + "FIN, SEQ: 1.005.330" + ], + [ + "20", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "20", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "20", + "10.0.0.2:54970", + "10.0.0.1:80", + "TCP", + "Transport", + "SEQ: 2.000.170, ACK: 1.005.331" + ], + [ + "21", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "21", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "22", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "22", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "2", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "3", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000303": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "2", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "3", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ] + }, + "layeredRows": { + "00000000-0000-0000-0000-000000000301": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "54970", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "5", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "80", + "54970", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "6", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "54970", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "7", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "54970", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "7", + null, + null, + "HTTP", + "Anwendung", + "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&onlySYN=1&btnSave=speichern&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop" + ], + [ + "8", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "80", + "54970", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.169" + ], + [ + "9", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "80", + "54970", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "9", + null, + null, + "HTTP", + "Anwendung", + "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 " + ], + [ + "10", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "54970", + "80", + "TCP", + "Transport", + "SEQ: 2.000.169, ACK: 1.001.461" + ], + [ + "11", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "80", + "54970", + "TCP", + "Transport", + "SEQ: 1.001.461" + ], + [ + "11", + null, + null, + "HTTP", + "Anwendung", + " \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n \n \n \n \n \n \n" + ], + [ + "14", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "14", + "54970", + "80", + "TCP", + "Transport", + "SEQ: 2.000.169, ACK: 1.004.381" + ], + [ + "15", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "15", + "80", + "54970", + "TCP", + "Transport", + "SEQ: 1.004.381" + ], + [ + "15", + null, + null, + "HTTP", + "Anwendung", + " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + "16", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "16", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "16", + "54970", + "80", + "TCP", + "Transport", + "SEQ: 2.000.169, ACK: 1.005.330" + ], + [ + "17", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "17", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "17", + "54970", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.169" + ], + [ + "18", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "18", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "18", + "80", + "54970", + "TCP", + "Transport", + "SEQ: 1.005.330, ACK: 2.000.170" + ], + [ + "19", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "19", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "19", + "80", + "54970", + "TCP", + "Transport", + "FIN, SEQ: 1.005.330" + ], + [ + "20", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "20", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "20", + "54970", + "80", + "TCP", + "Transport", + "SEQ: 2.000.170, ACK: 1.005.331" + ], + [ + "21", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "21", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "22", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "22", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000302": [ + [ + "1", + "02:00:00:00:03:11", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "10.0.0.2", + "10.0.0.1", + "ARP", + "Vermittlung", + "Suche nach MAC für 10.0.0.1 [op=REQUEST, sender=02:00:00:00:03:11|10.0.0.2, target=FF:FF:FF:FF:FF:FF|10.0.0.1]" + ], + [ + "2", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "10.0.0.1", + "10.0.0.2", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:21 [op=REPLY, sender=02:00:00:00:03:21|10.0.0.1, target=02:00:00:00:03:11|10.0.0.2]" + ], + [ + "3", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "4", + "54970", + "80", + "TCP", + "Transport", + "SYN, SEQ: 2.000.000" + ], + [ + "5", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "5", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "5", + "80", + "54970", + "TCP", + "Transport", + "SYN, SEQ: 1.000.000, ACK: 2.000.001" + ], + [ + "6", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "6", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "6", + "54970", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001, ACK: 1.000.001" + ], + [ + "7", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "7", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "7", + "54970", + "80", + "TCP", + "Transport", + "SEQ: 2.000.001" + ], + [ + "7", + null, + null, + "HTTP", + "Anwendung", + "POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&onlySYN=1&btnSave=speichern&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop" + ], + [ + "8", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "8", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "8", + "80", + "54970", + "TCP", + "Transport", + "SEQ: 1.000.001, ACK: 2.000.169" + ], + [ + "9", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "9", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "9", + "80", + "54970", + "TCP", + "Transport", + "SEQ: 1.000.001" + ], + [ + "9", + null, + null, + "HTTP", + "Anwendung", + "HTTP/1.1 200 OK\nContent-type: text/html\n\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 " + ], + [ + "10", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "10", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "10", + "54970", + "80", + "TCP", + "Transport", + "SEQ: 2.000.169, ACK: 1.001.461" + ], + [ + "11", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "11", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "11", + "80", + "54970", + "TCP", + "Transport", + "SEQ: 1.001.461" + ], + [ + "11", + null, + null, + "HTTP", + "Anwendung", + " \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n \n \n \n \n \n \n" + ], + [ + "14", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "14", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "14", + "54970", + "80", + "TCP", + "Transport", + "SEQ: 2.000.169, ACK: 1.004.381" + ], + [ + "15", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "15", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "15", + "80", + "54970", + "TCP", + "Transport", + "SEQ: 1.004.381" + ], + [ + "15", + null, + null, + "HTTP", + "Anwendung", + " \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + "16", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "16", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "16", + "54970", + "80", + "TCP", + "Transport", + "SEQ: 2.000.169, ACK: 1.005.330" + ], + [ + "17", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "17", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "17", + "54970", + "80", + "TCP", + "Transport", + "FIN, SEQ: 2.000.169" + ], + [ + "18", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "18", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "18", + "80", + "54970", + "TCP", + "Transport", + "SEQ: 1.005.330, ACK: 2.000.170" + ], + [ + "19", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "19", + "10.0.0.1", + "10.0.0.2", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "19", + "80", + "54970", + "TCP", + "Transport", + "FIN, SEQ: 1.005.330" + ], + [ + "20", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "20", + "10.0.0.2", + "10.0.0.1", + "IP", + "Vermittlung", + "Protokoll: 6, TTL: 64" + ], + [ + "20", + "54970", + "80", + "TCP", + "Transport", + "SEQ: 2.000.170, ACK: 1.005.331" + ], + [ + "21", + "02:00:00:00:03:11", + "02:00:00:00:03:21", + "", + "Netzzugang", + "0x800" + ], + [ + "21", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 64, Identifier: 1, Seq.-No.: 1" + ], + [ + "22", + "02:00:00:00:03:21", + "02:00:00:00:03:11", + "", + "Netzzugang", + "0x800" + ], + [ + "22", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 63, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000302#1": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "2", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "3", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ], + "00000000-0000-0000-0000-000000000303": [ + [ + "1", + "02:00:00:00:03:22", + "FF:FF:FF:FF:FF:FF", + "", + "Netzzugang", + "0x806" + ], + [ + "1", + "20.0.0.1", + "20.0.0.2", + "ARP", + "Vermittlung", + "Suche nach MAC für 20.0.0.2 [op=REQUEST, sender=02:00:00:00:03:22|20.0.0.1, target=FF:FF:FF:FF:FF:FF|20.0.0.2]" + ], + [ + "2", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x806" + ], + [ + "2", + "20.0.0.2", + "20.0.0.1", + "ARP", + "Vermittlung", + "MAC ist 02:00:00:00:03:13 [op=REPLY, sender=02:00:00:00:03:13|20.0.0.2, target=02:00:00:00:03:22|20.0.0.1]" + ], + [ + "3", + "02:00:00:00:03:22", + "02:00:00:00:03:13", + "", + "Netzzugang", + "0x800" + ], + [ + "3", + "10.0.0.2", + "20.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Request (ping), TTL: 63, Identifier: 1, Seq.-No.: 1" + ], + [ + "4", + "02:00:00:00:03:13", + "02:00:00:00:03:22", + "", + "Netzzugang", + "0x800" + ], + [ + "4", + "20.0.0.2", + "10.0.0.2", + "ICMP", + "Vermittlung", + "ICMP Echo Reply (pong), TTL: 64, Identifier: 1, Seq.-No.: 1" + ] + ] + }, + "events": [ + [ + 208, + "browser", + "update" + ], + [ + 209, + "server", + "null" + ], + [ + 210, + "server", + "Annahme von Verbindungsanfragen gestartet" + ], + [ + 501, + "ping", + "call sendProbe 20.0.0.2" + ], + [ + 3496, + "ping", + "returned null" + ], + [ + 3500, + "browser", + "call holeWebseite 10.0.0.1/konfig firewallActivate=1&onlySYN=1&btnSave=speichern&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop" + ], + [ + 3920, + "server", + "Verbindung zu 10.0.0.2:54970 hergestellt" + ], + [ + 3921, + "server", + ">>POST /konfig HTTP/1.1\nHost: 10.0.0.1\n\nfirewallActivate=1&onlySYN=1&btnSave=speichern&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop" + ], + [ + 4783, + "browser", + "page 200 text/html\n\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n" + ], + [ + 4873, + "server", + "<\n \n Konfiguration der Firewall auf dem Vermittlungsrechner\n \n\n \n\n
    \n\u0009

    Firewall-Konfiguration

    \n \n \n\u0009 \n \n \n
    \n \n \n \n \n \n \n \n \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n\u0009 \n
    \n\u0009\u0009\n Firewall aktivieren
    \n\u0009 Erst durch Aktivieren der Firewall werden die Firewall-Regeln angewendet. \n\u0009\u0009Bei deaktivierter Firewall findet keine Filterung statt.\n
    \n\u0009\u0009\u0009 \n\u0009 ICMP-Pakete filtern
    \n\u0009 Alle ICMP Pakete, z.B. Ping-Anfragen, werden von der Firewall verworfen.\n\u0009
    \n\u0009\u0009\u0009\n\u0009 \n\u0009 nur SYN-Pakete verwerfen\n\u0009
    \n\u0009 Neue Verbindungsanfragen zu gesperrten Ports werden verworfen.\n\u0009\u0009Der Rückkanal für erlaubte Verbindungsanfragen wird akzeptiert.\n\u0009
    \n
    \n\n
    \n\n \n \n \n \n \n \n \n \n \n \n \n\u0009\n\u0009 \n\u0009\n \n \n \n
    \n

    Firewall-Regeln:


    \n\u0009 Die Regeln werden von oben nach unten geprüft.
    \n\u0009 Sobald eine Regel zutrifft, wird die angegebene Aktion ausgeführt.\n
    \n\u0009 Falls keine Regel zutrifft, wird folgende Standard-Aktion ausgeführt:
    \n\u0009 \n\u0009 \n\u0009
    \n\u0009 \n \n \n\u0009\u0009\n \n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n\u0009\u0009\n \n \n\n\n\n
    lfd. Nr.Quell-IPQuell-SubnetzmaskeZiel-IPZiel-SubnetzmaskeProtokollPortAktion
     110.0.0.0255.255.255.0TCP80akzeptieren
    \n     \n\u0009
    \n\u0009 Aktion für ausgewählte Regel:\n\u0009
    \n \n \n \n
    \n\n
    \n\n\n \n \n \n \n \n \n \n \n\u0009\n\u0009\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    \n

    Neue Regel erstellen


    \n\u0009 Alle Felder sind optional und werden
    -- falls leer gelassen --
    für die Filterung nicht verwendet.\n
    Quell-IP:
    Quell-Subnetzmaske:
    Ziel-IP:
    Ziel-Subnetzmaske:
    Protokoll: \n\u0009 \n\u0009
    Port:
    Aktion: \n\u0009 \n\u0009
    \n \n
    \n
    \n
    \n \n\n" + ], + [ + 4929, + "server", + "Socket zu 10.0.0.2:54970 geschlossen" + ], + [ + 7001, + "ping", + "call sendProbe 20.0.0.2" + ], + [ + 7446, + "ping", + "returned answer" + ] + ] +} diff --git a/packages/core/test/web.test.ts b/packages/core/test/web.test.ts index 026d87c..6d0da2e 100644 --- a/packages/core/test/web.test.ts +++ b/packages/core/test/web.test.ts @@ -137,6 +137,11 @@ describe('the web server', () => { expect(ask(engine, 'HALLO', 'GET', 'GET /')).toEqual(['HTTP/1.1 501 Not Implemented\n', 'HTTP/1.1 400 Bad Request\n', 'HTTP/1.1 200 OK\nContent-type: text/html\n\nStart']); }); + it('answers only GET and POST as Java writes them: a method in small letters is read, then answered 501 (WebServerMitarbeiter)', () => { + const engine = startedEngine(network(files({ '/webserver/index.html': 'Start' }))); + expect(ask(engine, 'get /', 'Post /\n\nx=1')).toEqual(['HTTP/1.1 501 Not Implemented\n', 'HTTP/1.1 501 Not Implemented\n']); + }); + it('serves nothing outside its document root (Java serves any file of the host), and no folder', () => { const engine = startedEngine(network(files({ '/geheim.txt': 'geheim', '/webserver/ordner/a.txt': 'a' }))); expect(ask(engine, 'GET /../geheim.txt HTTP/1.1', 'GET /ordner/../../geheim.txt HTTP/1.1', 'GET /ordner HTTP/1.1', 'GET /ordner/./a.txt?x HTTP/1.1')).toEqual([ diff --git a/packages/fls/src/projectSnapshot.ts b/packages/fls/src/projectSnapshot.ts index ae10c3d..c722871 100644 --- a/packages/fls/src/projectSnapshot.ts +++ b/packages/fls/src/projectSnapshot.ts @@ -8,6 +8,10 @@ // echo or web server is there either way, switched on or off (it can be // switched at run time). The programs read the nodes' files (a web server its // pages). +// +// Back the other way: what the simulation changes that Java keeps in the +// project (its objects are the project's), so a project saved after it holds +// it. That is a router's or home router's firewall, set on its page konfig. import { portSnapshot, topologySnapshot, type DnsServerConfiguration, type EchoServerSnapshot, type Id, type WebServerSnapshot, type TopologySnapshot } from '@mdg-filius/core'; import type { ImportedProject } from './importProject.js'; @@ -51,3 +55,8 @@ export function projectSnapshot(project: ImportedProject): TopologySnapshot { fileSystemsByNodeId: project.virtualFileSystems, }); } + +/** The project with what the simulation changed that Java keeps: the firewalls, as the run's snapshot holds them. */ +export function projectWithSimulationChanges(project: ImportedProject, snapshot: TopologySnapshot): ImportedProject { + return { ...project, firewallConfigurationsByNodeId: new Map(snapshot.firewallConfigurationsByNodeId) }; +} diff --git a/packages/fls/test/importProject.test.ts b/packages/fls/test/importProject.test.ts index 116d68a..e5a1f6a 100644 --- a/packages/fls/test/importProject.test.ts +++ b/packages/fls/test/importProject.test.ts @@ -12,6 +12,7 @@ import { defaultDisplayName, defaultSwitchConfiguration, firewallConfiguration, + firewallRule, FIREWALL_PROTOCOL, interfaceKey, deepEqual, @@ -28,8 +29,11 @@ import { import { decodeJavaBeans, importProject, + openProjectArchive, projectSnapshot, + projectWithSimulationChanges, readFlsArchive, + saveProjectArchive, readTopology, type FlsApplication, type JavaEmail, @@ -773,6 +777,30 @@ describe('importProject rules', () => { expect(snapshot.fileSystemsByNodeId).toBe(project.virtualFileSystems); }); + it("keeps a router's firewall set on its page konfig in the project saved after the run (projectWithSimulationChanges)", () => { + const project = openProjectArchive(new Uint8Array(readFileSync(join(corpusRoot, 'java-examples/internetwork_komplett.fls'))), counter()); + const node = (name: string) => project.graph.nodes.find((each) => each.displayName === name)!.id; + const router = project.graph.nodes.find((each) => each.kind === 'router' && project.deviceConfigurations.get(each.id)?.ipAddress === '141.99.1.1')!.id; + const notebook = node('Notebook 1.10'); + const engine = new NetworkRuntimeEngine(14); + engine.handle({ type: 'start', snapshot: { ...projectSnapshot(project), webBrowserNodeIds: new Set([notebook]) }, seed: 14, initialTimeMilliseconds: 0 }); + const form = 'srcIP=&srcMask=&destIP=&destMask=&protocol=UDP&port=53&action=accept'; + // Added first: once switched on, the firewall drops the browser too (by default). + engine.webBrowser(notebook)!.open('141.99.1.1/konfig', `onlySYN=1&defaultPolicy=drop&${form}&addrule=hinzuf%C3%BCgen`); + engine.handle({ type: 'advance', toMilliseconds: 5_000 }); + engine.webBrowser(notebook)!.open('141.99.1.1/konfig', `firewallActivate=1&onlySYN=1&btnSave=speichern&defaultPolicy=drop&${form}`); + engine.handle({ type: 'advance', toMilliseconds: 10_000 }); + const expected = firewallConfiguration({ isActive: true, rules: [firewallRule({ port: 53, protocol: 'udp', action: 'accept' })] }); + expect(engine.firewallConfiguration(router)).toEqual(expected); + // The project itself is as it was opened, until the run's changes go back into it. + expect(project.firewallConfigurationsByNodeId.get(router)).toEqual(firewallConfiguration()); + + const saved = saveProjectArchive(projectWithSimulationChanges(project, engine.state.topologySnapshot)).archive; + const reopened = openProjectArchive(saved, counter()); + const reopenedRouter = reopened.graph.nodes.find((each) => each.kind === 'router' && reopened.deviceConfigurations.get(each.id)?.ipAddress === '141.99.1.1')!.id; + expect(reopened.firewallConfigurationsByNodeId.get(reopenedRouter)).toEqual(expected); + }); + it("keeps a node's IP forwarding where it differs from its kind's: a host that forwards, a router that does not", () => { const system = (ipForwardingEnabled: boolean) => ({ manualRoutes: [], ipForwardingEnabled }); const project = importProject( diff --git a/scripts/code_language_allow.txt b/scripts/code_language_allow.txt index aa5bc1a..ad61e12 100644 --- a/scripts/code_language_allow.txt +++ b/scripts/code_language_allow.txt @@ -79,3 +79,5 @@ packages/core/test/programLines.ts::tcpsocket # Java's German firewall log page closes its title with the typo ; quoted where the core names the departure. packages/core/src/runtime/apps/routerPages.ts::titel packages/core/test/routerWebJava.test.ts::titel +# konfig: the path of Java's firewall settings plug-in (FirewallWebKonfig); the stories that use it are named after it, as in RouterWebRun. +packages/core/test/routerWebJava.test.ts::konfig diff --git a/tools/java-oracle/README.md b/tools/java-oracle/README.md index 372d3a7..6ec3380 100644 --- a/tools/java-oracle/README.md +++ b/tools/java-oracle/README.md @@ -646,3 +646,41 @@ Gemessen (01.10.2026): * Java zählt TCP-Sequenznummern und Segmente in Zeichen seiner Strings: Ein „ä“ auf der Routen-Seite ist eine Stelle, nicht zwei Bytes. + +## Firewall-Einstellungen der Router (F3.2c) + +`KonfigCases` füttert Javas Seite `konfig` (`FirewallWebKonfig`) direkt mit +den Schritten aus `packages/core/test/firewall-settings.cases.txt` (eine +Anfrage ohne Daten oder die Daten eines Formulars) und schreibt je Schritt +die Seite und die Firewall danach, auf Deutsch und auf Englisch +(`firewall-settings.{de,en}.java.json`; das Gebietsschema wird vor dem +ersten Lesen des Nachrichtenbündels gesetzt). Jeder Fall beginnt mit einem +neuen Router, ohne Regeln, mit drei oder mit der einen Regel, die ein Fall +anlegt (die Seite, die Java zeigen würde, hätte es sie angenommen). +`RouterWebRun` spielt dazu auf `router-web` `konfigIcmp` und `konfigBlock` +über das Netz. + +Gemessen (01.10.2026): + +* Javas Browserfenster (Swing, `FormSubmitEvent.getData`) schickt jedes Feld + des Formulars in seiner Reihenfolge, UTF-8-kodiert, angehakte Kästchen und + die gewählte Option, dazu nur den gedrückten Knopf. +* Java prüft die Felder beim Lesen: die Quell-IP gegen die Maske, die noch + nicht gelesen ist (also leer), die Maske gegen die IP, ebenso. Eine Regel + mit Quell- oder Zieladresse nimmt die Seite deshalb nie an, in keiner + Reihenfolge der Felder. +* Ein Fehler bleibt im Plug-in stehen und erscheint auf jeder späteren Seite, + auch ohne Daten. Mit zwei Knöpfen zugleich (Speichern und Hinzufügen) + speichert Java und schreibt die Fehler als nackte Liste. +* Java dekodiert die Daten, bevor es sie an `&` und `=` zerlegt: Ein + getipptes `&` zerreißt das Formular. Eine kaputte Kodierung (`%zz`, `%` am + Ende) wirft im Dekodierer, Regel 0 nach unten wirft + (`ArrayIndexOutOfBoundsException`), ein `$` im wieder gefüllten Formular + lässt `replaceAll` scheitern (die Seite ist `null`, also 500). +* Die Maske prüft `isValidSubnetmask`: vier Zahlen (eine leere am Ende fällt + bei Javas `split` weg), `parseInt` mit Vorzeichen, die Bits Einsen, dann + Nullen, mindestens eine Eins (0.0.0.0 ist keine Maske). +* Über das Netz: „ICMP filtern“ aus, und der nächste Ping kommt durch; eine + Regel „TCP 80 verwerfen“ über die erlaubende geschoben, und das SYN des + Browsers bleibt an der Firewall hängen. Javas Router-Server lauschte auch + hier in einem Lauf nie (`run.sh` wiederholt). diff --git a/tools/java-oracle/run.sh b/tools/java-oracle/run.sh index 8ded38d..994d084 100755 --- a/tools/java-oracle/run.sh +++ b/tools/java-oracle/run.sh @@ -21,7 +21,7 @@ if [ ! -f "$upstream/target/filius.jar" ]; then fi classpath="$upstream/target/filius.jar:$upstream/target/lib/*" mkdir -p "$here/.build" -javac -encoding UTF-8 -d "$here/.build" -cp "$classpath" "$here/src/FlsOracle.java" "$here/src/GetterDefaults.java" "$here/src/IpCheckCases.java" "$here/src/DnsHostsCases.java" "$here/src/EmailFileCases.java" "$here/src/BeansDump.java" "$here/src/Base64Cases.java" "$here/src/ScenarioNetwork.java" "$here/src/DhcpRun.java" "$here/src/TcpRun.java" "$here/src/DnsRun.java" "$here/src/ArpRun.java" "$here/src/RipRun.java" "$here/src/NatRun.java" "$here/src/WlanRun.java" "$here/src/ExampleRun.java" "$here/src/EchoRun.java" "$here/src/WebRun.java" "$here/src/RouterWebRun.java" +javac -encoding UTF-8 -d "$here/.build" -cp "$classpath" "$here/src/FlsOracle.java" "$here/src/GetterDefaults.java" "$here/src/IpCheckCases.java" "$here/src/DnsHostsCases.java" "$here/src/EmailFileCases.java" "$here/src/BeansDump.java" "$here/src/Base64Cases.java" "$here/src/ScenarioNetwork.java" "$here/src/DhcpRun.java" "$here/src/TcpRun.java" "$here/src/DnsRun.java" "$here/src/ArpRun.java" "$here/src/RipRun.java" "$here/src/NatRun.java" "$here/src/WlanRun.java" "$here/src/ExampleRun.java" "$here/src/EchoRun.java" "$here/src/WebRun.java" "$here/src/RouterWebRun.java" "$here/src/KonfigCases.java" # FILIUS writes its settings below $HOME; keep them out of the real one. mkdir -p "$here/.build/home" # Removed first: a crashed run must not leave the previous result standing. @@ -224,6 +224,7 @@ done # sometimes never listens (a race in setAktiv): a run without a page is # repeated. for run in router-web:routerIndex:6000 router-web:routerRoutes:6000 router-web:routerLog:12000 router-web:routerKonfig:6000 \ + router-web:konfigIcmp:12000 router-web:konfigBlock:30000 \ nat-home:gatewayIndex:9000 nat-home:gatewayFromWan:15000 rip-chain:ripRoutes:46000; do network="${run%%:*}"; rest="${run#*:}"; story="${rest%%:*}" output="$root/packages/core/test/scenarios/routerweb-java-$story.java.json" @@ -236,6 +237,16 @@ for run in router-web:routerIndex:6000 router-web:routerRoutes:6000 router-web:r test -s "$output" done +# The firewall settings page (konfig) fed with what a browser posts, in both +# languages (KonfigCases; packages/core/test/firewallSettings.test.ts). +for language in de en; do + output="$root/packages/core/test/firewall-settings.$language.java.json" + rm -f "$output" + HOME="$here/.build/home" xvfb-run -a java -cp "$classpath:$here/.build" KonfigCases "$language" \ + "$root/packages/core/test/firewall-settings.cases.txt" "$output" 2>&1 | grep -v 'logback\|^$' || true + test -s "$output" +done + # FILIUS' own examples as Java FILIUS runs them, opened and started as FILIUS # does (ExampleRun): the acceptance of F2 (packages/fls/test/examplesJava.test.ts). for run in internetwork_komplett:routing:12000 einfaches_rechnernetz_komplett:dhcp:20000 dns_server:dns:12000 \ diff --git a/tools/java-oracle/src/KonfigCases.java b/tools/java-oracle/src/KonfigCases.java new file mode 100644 index 0000000..6ccc8ce --- /dev/null +++ b/tools/java-oracle/src/KonfigCases.java @@ -0,0 +1,105 @@ +// Feeds FILIUS' firewall settings page (FirewallWebKonfig, the router's web +// server's plug-in konfig) with what a browser posts, step after step, and +// writes each page and the firewall after it: the reference for the core's +// konfig page (packages/core/src/runtime/apps/firewallSettings.ts). Each case +// starts from a new router; its firewall holds no rules ("empty"), three +// ("three"), one only a file can bring ("portZero": port 0, ICMP), or the +// one rule a case adds ("sourceRule", "destinationRule": +// the page Java would answer, had it taken the rule). The cases file is +// ASCII, with Java-style unicode escapes (backslash, u, four hex digits) for +// anything else: +// +// case +// GET the page without data (Java: holeHtmlSeite(null)) +// POST the page with the data a form posts ("POST" alone: empty) +// +// Usage: java -cp filius.jar:lib/*:classes KonfigCases + +import filius.hardware.knoten.Vermittlungsrechner; +import filius.rahmenprogramm.Information; +import filius.software.firewall.Firewall; +import filius.software.firewall.FirewallRule; +import filius.software.system.VermittlungsrechnerBetriebssystem; +import filius.software.www.WebServerPlugIn; + +import java.io.FileOutputStream; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.Path; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.LinkedHashMap; +import java.util.List; +import java.util.Locale; +import java.util.Map; + +public class KonfigCases { + + public static void main(String[] args) throws Exception { + // Before any class reads the message bundle (I18n.messages is read once). + Information.getInformation().setLocale(args[0].equals("en") ? new Locale("en", "GB") : Locale.GERMANY); + List cases = new ArrayList<>(); + Map current = null; + List steps = null; + WebServerPlugIn page = null; + Firewall firewall = null; + for (String line : Files.readAllLines(Path.of(args[1]), StandardCharsets.US_ASCII)) { + if (line.isEmpty() || line.startsWith("#")) continue; + if (line.startsWith("case ")) { + String[] words = line.split(" "); + current = new LinkedHashMap<>(); + steps = new ArrayList<>(); + current.put("name", words[1]); + current.put("start", words[2]); + current.put("steps", steps); + cases.add(current); + VermittlungsrechnerBetriebssystem os = (VermittlungsrechnerBetriebssystem) new Vermittlungsrechner().getSystemSoftware(); + firewall = os.holeFirewall(); + page = os.holeWebServer().holePlugin("konfig"); + if (words[2].equals("three")) { + firewall.setActivated(true); + firewall.addRule(new FirewallRule("", "", "", "", 80, FirewallRule.TCP, FirewallRule.ACCEPT)); + firewall.addRule(new FirewallRule("999.999.999.999", "", "20.0.0.0", "255.0.0.0", FirewallRule.ALL_PORTS, FirewallRule.UDP, FirewallRule.DROP)); + firewall.addRule(new FirewallRule("10.0.0.0", "255.0.0.0", "", "", FirewallRule.ALL_PORTS, FirewallRule.ALL_PROTOCOLS, FirewallRule.DROP)); + } else if (words[2].equals("portZero")) { + firewall.addRule(new FirewallRule("", "", "", "", 0, FirewallRule.ICMP, FirewallRule.ACCEPT)); + } else if (words[2].equals("sourceRule")) { + firewall.addRule(new FirewallRule("10.0.0.0", "255.255.255.0", "", "", 80, FirewallRule.TCP, FirewallRule.DROP)); + } else if (words[2].equals("destinationRule")) { + firewall.addRule(new FirewallRule("", "", "20.0.0.0", "255.0.0.0", FirewallRule.ALL_PORTS, FirewallRule.UDP, FirewallRule.ACCEPT)); + } + continue; + } + String post = line.equals("GET") ? null : line.equals("POST") ? "" : IpCheckCases.unescape(line.substring("POST ".length())); + Map step = new LinkedHashMap<>(); + step.put("post", post); + try { + step.put("page", page.holeHtmlSeite(post)); + } catch (RuntimeException error) { + step.put("page", "!" + error.getClass().getSimpleName()); + } + step.put("firewall", state(firewall)); + steps.add(step); + } + try (FileOutputStream out = new FileOutputStream(args[2])) { + out.write((FlsOracle.Json.write(cases, "") + "\n").getBytes(StandardCharsets.UTF_8)); + } + System.out.println("konfig cases (" + args[0] + "): " + cases.size()); + System.exit(0); + } + + static Map state(Firewall firewall) { + Map state = new LinkedHashMap<>(); + state.put("isActive", firewall.isActivated()); + state.put("dropIcmp", firewall.getDropICMP()); + state.put("filterSynSegmentsOnly", firewall.getFilterSYNSegmentsOnly()); + state.put("defaultPolicy", firewall.getDefaultPolicy() == FirewallRule.ACCEPT ? "accept" : "drop"); + List rules = new ArrayList<>(); + for (FirewallRule rule : firewall.getRuleset()) { + String protocol = rule.protocol == FirewallRule.TCP ? "tcp" : rule.protocol == FirewallRule.UDP ? "udp" : rule.protocol == FirewallRule.ICMP ? "icmp" : rule.protocol == FirewallRule.ALL_PROTOCOLS ? "all" : String.valueOf(rule.protocol); + rules.add(Arrays.asList(rule.srcIP, rule.srcMask, rule.destIP, rule.destMask, rule.port, protocol, rule.action == FirewallRule.ACCEPT ? "accept" : "drop")); + } + state.put("rules", rules); + return state; + } +} diff --git a/tools/java-oracle/src/RouterWebRun.java b/tools/java-oracle/src/RouterWebRun.java index e4025bf..084a32c 100644 --- a/tools/java-oracle/src/RouterWebRun.java +++ b/tools/java-oracle/src/RouterWebRun.java @@ -15,6 +15,11 @@ // routerLog a ping to 20.0.0.2 (dropped), the index, then // 10.0.0.1/log // routerKonfig 10.0.0.1/konfig +// konfigIcmp a ping to 20.0.0.2 (dropped), the settings saved +// without "drop ICMP" (the form as Java's browser window +// posts it), the ping again +// konfigBlock a rule added (TCP 80: drop), moved up above the rule +// that accepts the browser, then the index again // nat-home (home router 42.0.0.10/192.168.0.1): // gatewayIndex from the LAN PC 192.168.0.10: 192.168.0.1, then // 192.168.0.1/routes (no such page on a home router) @@ -61,6 +66,22 @@ public class RouterWebRun { browser.holeWebseite(new URL("http", parts[0], path.isEmpty() ? "/" : path)); } + /** What the browser window posts when a button of the settings form is pressed (Swing: every field, the button). */ + static void post(String typed, String data) throws Exception { + event("browser", "call holeWebseite " + typed + " " + data); + String[] parts = typed.split("/", 2); + browser.holeWebseite(new URL("http", parts[0], "/" + parts[1]), data); + } + + static void ping(InternetKnotenBetriebssystem host) { + Thread ping = new Thread(() -> { + event("ping", "call sendProbe 20.0.0.2"); + Object answer = host.holeICMP().sendProbe("20.0.0.2", 64, 1, 1); + event("ping", "returned " + (answer == null ? "null" : "answer")); + }); + ping.start(); + } + static String id(int suffix) { return String.format("00000000-0000-0000-0000-%012d", suffix); } @@ -124,12 +145,7 @@ public class RouterWebRun { open("10.0.0.1/routes"); break; case "routerLog": { - Thread ping = new Thread(() -> { - event("ping", "call sendProbe 20.0.0.2"); - Object answer = host.holeICMP().sendProbe("20.0.0.2", 64, 1, 1); - event("ping", "returned " + (answer == null ? "null" : "answer")); - }); - ping.start(); + ping(host); sleepUntil(3500); open("10.0.0.1"); sleepUntil(7000); @@ -139,6 +155,20 @@ public class RouterWebRun { case "routerKonfig": open("10.0.0.1/konfig"); break; + case "konfigIcmp": + ping(host); + sleepUntil(3500); + post("10.0.0.1/konfig", "firewallActivate=1&onlySYN=1&btnSave=speichern&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop"); + sleepUntil(7000); + ping(host); + break; + case "konfigBlock": + post("10.0.0.1/konfig", "firewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&srcIP=&srcMask=&destIP=&destMask=&protocol=TCP&port=80&action=drop&addrule=hinzuf%C3%BCgen"); + sleepUntil(4000); + post("10.0.0.1/konfig", "firewallActivate=1&dropICMP=1&onlySYN=1&defaultPolicy=accept&radioRule=2&moveup=rauf&srcIP=&srcMask=&destIP=&destMask=&protocol=*&port=&action=drop"); + sleepUntil(8000); + open("10.0.0.1"); + break; case "gatewayIndex": open("192.168.0.1"); sleepUntil(4000);