From 1a1e8caff0afd2fee34a59bfa31f17596480accb Mon Sep 17 00:00:00 2001
From: Eduardo Silva <eduardo@eth0.com.br>
Date: Fri, 1 Mar 2024 19:08:32 -0300
Subject: [PATCH] Display automatic rules

---
 firewall/views.py                          |  4 +
 templates/firewall/firewall_nav_tabs.html  |  8 +-
 templates/firewall/firewall_rule_list.html | 92 +++++++++++++++++++++-
 templates/firewall/redirect_rule_list.html |  4 +-
 4 files changed, 104 insertions(+), 4 deletions(-)

diff --git a/firewall/views.py b/firewall/views.py
index c5f78b4..6a85caa 100644
--- a/firewall/views.py
+++ b/firewall/views.py
@@ -60,6 +60,7 @@ def manage_redirect_rule(request):
 
 def view_firewall_rule_list(request):
     wireguard_instances = WireGuardInstance.objects.all().order_by('instance_id')
+    firewall_settings, firewall_settings_created = FirewallSettings.objects.get_or_create(name='global')
     current_chain = request.GET.get('chain', 'forward')
     if current_chain not in ['forward', 'portforward', 'postrouting']:
         current_chain = 'forward'
@@ -72,6 +73,9 @@ def view_firewall_rule_list(request):
         'pending_changes_warning': pending_changes_warning,
         'firewall_rule_list': FirewallRule.objects.filter(firewall_chain=current_chain).order_by('sort_order'),
         'current_chain': current_chain,
+        'port_forward_list': RedirectRule.objects.all().order_by('port'),
+        'firewall_settings': firewall_settings,
+        'wireguard_instances': wireguard_instances,
         }
     return render(request, 'firewall/firewall_rule_list.html', context=context)
 
diff --git a/templates/firewall/firewall_nav_tabs.html b/templates/firewall/firewall_nav_tabs.html
index 63956fe..83d2858 100644
--- a/templates/firewall/firewall_nav_tabs.html
+++ b/templates/firewall/firewall_nav_tabs.html
@@ -9,5 +9,11 @@
     <li class="nav-item">
         <a class="nav-link {% if current_chain == "portforward" %}active{% endif %}" href="/firewall/port_forward/" role="tab">Port Forward</a>
     </li>
+    {% if current_chain == 'forward' %}
+    <li class="nav-item ml-auto">
+        <a class="nav-link" role="">Default Policy: <b>{{ firewall_settings.get_default_forward_policy_display }}</b></a>
+    </li>
+    {% endif %}
     
-</ul>
\ No newline at end of file
+</ul>
+
diff --git a/templates/firewall/firewall_rule_list.html b/templates/firewall/firewall_rule_list.html
index f3deb2d..4a42c2b 100644
--- a/templates/firewall/firewall_rule_list.html
+++ b/templates/firewall/firewall_rule_list.html
@@ -17,6 +17,10 @@
         display: none;
         width: 100%;
       }
+
+      .fw_automatic_rule {
+        display: none;
+      }
       
       
    
@@ -43,9 +47,56 @@
                         <th>Port</th>
                         <th>State</th>
                         <th>Action</th>
-                        <th></th>
+                        <th><i class="far fa-edit"></i></th>
                     </thead>
                     <tbody>
+
+                        {% for rule in port_forward_list %}
+                            {% if rule.add_forward_rule and current_chain == 'forward' %}
+                                <tr class="fw_automatic_rule">  
+                                  <td>-</td>
+                                  <td><i class="fas fa-info-circle" title="Port forward automatic rule. {{ rule.description|default_if_none:'' }}"></i></td>
+                                  <td>{{ firewall_settings.wan_interface }}</td>
+                                  <td>wg{{ rule.wireguard_instance.instance_id }}</td>
+                                  <td></td>
+                                  <td>
+                                    {% if rule.ip_address %}
+                                      {{ rule.ip_address }}
+                                    {% elif rule.peer %}
+                                      {{ rule.peer }}
+                                    {% endif %}
+                                  </td>
+                                  <td>{{ rule.get_protocol_display }}</td>
+                                  <td>{{ rule.port }}</td>
+                                  <td></td>
+                                  <td>ACCEPT</td>
+                                  <td></td>
+                                </tr>
+                            {% elif rule.masquerade_source and current_chain == 'postrouting' %}
+                              <tr class="fw_automatic_rule">  
+                                <td>-</td>
+                                <td><i class="fas fa-info-circle" title="Port forward automatic rule. {{ rule.description|default_if_none:'' }}"></i></td>
+                                <td></td>
+                                <td>wg{{ rule.wireguard_instance.instance_id }}</td>
+                                <td></td>
+                                <td>
+                                  {% if rule.ip_address %}
+                                    {{ rule.ip_address }}
+                                  {% elif rule.peer %}
+                                    {{ rule.peer }}
+                                  {% endif %}
+                                </td>
+                                <td>{{ rule.get_protocol_display }}</td>
+                                <td>{{ rule.port }}</td>
+                                <td></td>
+                                <td>MASQUERADE</td>
+                                <td></td>
+                              </tr>
+                            {% endif %}
+
+
+                        {% endfor %}
+
                         {% for rule in firewall_rule_list %}
                             
                             <tr>
@@ -82,11 +133,50 @@
                             </tr>
                         {% endfor %}
                 
+                        {% if current_chain == 'forward' %}
+                        {% for wireguard_instance in wireguard_instances %}
+                            <tr class="fw_automatic_rule">
+                              <td>-</td>
+                              <td><i class="fas fa-info-circle" title="Automatic Rule: Firewall Settings Peer to Peer traffic"></i></td>
+                              <td>wg{{ wireguard_instance.instance_id }}</td>
+                              <td>wg{{ wireguard_instance.instance_id }}</td>
+                                <td></td>
+                                <td></td>
+                                <td></td>
+                                <td></td>
+                                <td></td>
+                                <td>
+                                  {% if firewall_settings.allow_peer_to_peer %}
+                                    ACCEPT
+                                  {% else %}
+                                    REJECT
+                                  {% endif %}
+                                </td>
+                                <td></td>
+                            </tr>
+                        {% endfor %}
+
+                        <tr class="fw_automatic_rule">
+                          <td>-</td>
+                          <td><i class="fas fa-info-circle" title="Automatic Rule: Firewall Settings Instance to Instance"></i></td>
+                          <td>wg+</td>
+                          <td>wg+</td>
+                            <td></td>
+                            <td></td>
+                            <td></td>
+                            <td></td>
+                            <td></td>
+                            <td>{% if firewall_settings.allow_instance_to_instance %}ACCEPT{% else %}REJECT{% endif %}</td>
+                            <td></td>
+                        </tr>
+                        {% endif %}
+
                     </tbody>
                 </table>
                 
                 <a href="/firewall/manage_firewall_rule/?chain={{ current_chain }}" class='btn btn-primary'>Create Firewall Rule</a>
                 <a href="/firewall/firewall_settings/?chain={{ current_chain }}" class='btn btn-outline-primary'>Firewall Settings</a>
+                <a class='btn btn-outline-primary' onclick=$('.fw_automatic_rule').slideToggle();>Display automatic rules</a>
             </div>
         </div>
     </div>
diff --git a/templates/firewall/redirect_rule_list.html b/templates/firewall/redirect_rule_list.html
index da2698d..95291b3 100644
--- a/templates/firewall/redirect_rule_list.html
+++ b/templates/firewall/redirect_rule_list.html
@@ -16,14 +16,14 @@
                             <th>Destination</th>
                             <th>Allow Forward</th>
                             <th>Masquerade Source</th>
-                            <th>Actions</th>
+                            <th><i class="far fa-edit"></i></th>
                         </tr>
                     </thead>
                     <tbody>
                         {% for redirect_rule in redirect_rule_list %}
                             <tr>
                                 <td>{{ redirect_rule.wireguard_instance }}</td>
-                                <td>{{ redirect_rule.protocol }}</td>
+                                <td>{{ redirect_rule.get_protocol_display }}</td>
                                 <td>{{ redirect_rule.port }}</td>
                                 <td>
                                     {% if redirect_rule.peer %}