Firewall Builder Release Notes


Version 1.0.2


GUI v1.0.2 requires API library libfwbuilder version 0.10.6

Summary

This version incorporated fixes for bugs filed in April of 2002, as well as few new features. In particular, this version comes with new experimental policy compiler for iptables (fwb_ipt).

New policy compiler for iptables

This compiler comes in the package called fwbuilder-ipt. There are multiple reasons why it is the time to rewrite the compiler, so fwbuilder-ipt is a complete rewrite. For once, I have been asked to add support for ip aliases (in other words, support virtual ip addresses on interfaces), but this feature could not be implementd with the old compiler. New compiler, on the other hand, will have support for it in the future. New compiler is based on libfwbuilder API, just like compilers for ipfilter and OpenBSD pf, this makes code maintenance easier. In addition, I could reuse certain pieces of code for all three compilers.

I consider fwbuilder-ipt beta quality at this time and I am asking for lots of testing. Please run it on your data sets and see what comes out.

I would like to switch to the new policy compiler as soon as possible, hopefully in a span of two versions. I stop fixing bugs in the old policy compiler fwbuilder-iptables now to free up cycles to support the new one and work on other features. I have already made sure that bugs currently opened against fwbuilder-iptables do not exist in fwbuilder-ipt. In fact, as of version 1.0.2 fwbuilder-iptables is in freeze mode and will be retired as of 1.0.4. This means I won't release RPM with fwbuilder-iptables when I release version 1.0.4, will remove it from CVS repository and will stop running test builds. Please see project roadmap on the web site http://www.fwbuilder.org/pages/documents.html

Version 1.0.2 still comes preconifgured to call the old policy compiler for iptables firewall objects. Those who want to test new compiler should follow instructions below. As of version 1.0.3 GUI will be preconfigured to use new compiler by default.

In order to test new compiler, download and install package fwbuilder-ipt-1.0.2. This package installs compiler's binary /usr/bin/fwb_ipt and man page fwb_ipt(1). New compiler can be used either from command line prompt or with fwbuilder GUI. In the latter case type "fwb_ipt" in the entry field called "Compiler (if different from default)" in the tab "Compile/Install" in firewall dialog, apply and then save changes to the file. See man page for command line options.

Porting Firewall Builder to win32 platform

Work is still being done on Windows port of Firewall Builder, however we ran into problems and it is going to take some time to get this port done.

What is new in the API library

What is new in the GUI

What is new in iptables compiler

What is new in the standard objects database




Bugs fixed in GUI:



Bugs fixed in iptables policy compiler fwb_iptables:



The following bugs were fixed and feature request were implemented in the new policy compiler for iptables (fwb_ipt)



Bugs fixed in OpenBSD PF policy compiler (fwb_pf):



Bugs fixed in ipfilter policy compiler (fwb_ipf):