From 21582f8755204b691c5d32cedf1c69c3f43b1910 Mon Sep 17 00:00:00 2001 From: Vadim Kurland Date: Tue, 10 Aug 2010 02:02:24 +0000 Subject: [PATCH] updated copyright years and translations --- build_num | 2 +- src/gui/aboutdialog_q.ui | 2 +- src/gui/fwbuilder_en.ts | 6948 +++++++++++++++++++++---------------- src/gui/fwbuilder_ja.qm | Bin 130033 -> 132747 bytes src/gui/fwbuilder_ja.ts | 6960 ++++++++++++++++++++++---------------- src/gui/fwbuilder_ru.qm | Bin 239990 -> 237631 bytes src/gui/fwbuilder_ru.ts | 6810 ++++++++++++++++++++++--------------- 7 files changed, 12138 insertions(+), 8584 deletions(-) diff --git a/build_num b/build_num index 8f06503a1..42e590f83 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 3223 +#define BUILD_NUM 3224 diff --git a/src/gui/aboutdialog_q.ui b/src/gui/aboutdialog_q.ui index b029bdd59..19e23dfde 100644 --- a/src/gui/aboutdialog_q.ui +++ b/src/gui/aboutdialog_q.ui @@ -593,7 +593,7 @@ p, li { white-space: pre-wrap; } - Copyright 2002-2009 NetCitadel, LLC + Copyright 2002-2010 NetCitadel, LLC Qt::AlignCenter diff --git a/src/gui/fwbuilder_en.ts b/src/gui/fwbuilder_en.ts index af1b649d3..29d5b1f3b 100644 --- a/src/gui/fwbuilder_en.ts +++ b/src/gui/fwbuilder_en.ts @@ -60,12 +60,12 @@ and special characters. - + Emulation of terminating behavior for MARK and CLASSIFY targets is currently ON, rule will be terminating - + Emulation of terminating behavior for MARK and CLASSIFY targets is currently OFF, rule will not be terminating @@ -289,14 +289,14 @@ object properties dialog. AddressRangeDialog - - + + Illegal IP address '%1' - - + + &Continue @@ -475,12 +475,12 @@ object properties dialog. - + FWBuilder API error: %1 - + &Continue @@ -676,17 +676,17 @@ p, li { white-space: pre-wrap; } CompareObjectsDialog - + Next - + The following two objects have the same internal ID but different attributes: - + Skip the rest but build report @@ -879,82 +879,82 @@ Preferences dialog, tab "Objects" DiscoveryDruid - + Hosts file parsing ... - + DNS zone transfer ... - + Network discovery using SNMP ... - + Import configuration from file ... - - - + + + Discovery error - + Could not open file %1 - - + + Adding objects ... - - - - - + + + + + Cancel - + Prepare objects ... - - + + Copying results ... - + Incomlete network specification. - + Empty community string - + Some discovered interfaces have been rearranged in fwbuilder objects and recreated as subinterfaces to reflect VLANs, bonding and bridging configurations. The algorithm used to guess correct relationship between interfaces and subinterfaces is imperfect because of the limited information provided by SNMP daemon. Pelase review created objects to make sure generated configuration is accurate. The program expects MAC addresses of bonding, bridge and vlan interfaces to be the same. It is especially important to review and fix generated objects if you use MAC address spoofing. - + &Continue @@ -962,413 +962,418 @@ The program expects MAC addresses of bonding, bridge and vlan interfaces to be t DiscoveryDruid_q - + TextLabel - + Choose discovery method used to collect information about network objects from the list below and click 'Next' to continue. - + Discovery method: - + Read file in hosts format - + Import DNS zone - + Perform network discovery using SNMP - + Import configuration of a firewall or a router - + Enter full path and file name below or click "Browse" to find it: - + File in hosts format - + Browse ... - + All objects created during import will be placed in the library currently opened in the tree. - + Policy import tries to parse given configuration file and preserve its logic as close as possible. However, very often target firewall configuration allows for more commands, options and their combinations than importer can understand. Rules that importer could not parse exactly are colored red in the rule sets it creates. Always inspect firewall policy created by the importer and compare it with the original. Manual changes and corrections may be required. Comments in the rules that could not be parsed show fragments of the original configuration parser did not understand. - + Import from file: - + Browse... - + Cisco IOS - + iptables - + Platform: - + textLabel1 - + + Firewall name: + + + + This discovery method creates objects for all 'A' records found in DNS domain. You will later have a chance to accept only those objects you wish and ignore others. Please enter the domain name below: - + Domain name - + Objects created using this method may have long or short names. long name consists of the host name and full domain name (this is called <i>Fully Qualified Domain Name</i>). Short name consists of only host name. Check in the box below if you wish to use long name, then click next to continue: - + Use long names - + DNS zone information has to be transferred from the name server authoritative for the domain. Pick the name server: - + Name server - + choose name server from the list below - + server name or its IP address here if you wish to use different one: - + DNS Query options - + Timeout (sec) - + Retries - + This discovery method scans networks looking for hosts or gateways responding to SNMP queries. It pulls host's ARP table and uses all the entries found in it to create objects. Scan starts from the host called "seed". Enter "seed" host name or address below: - + 'Seed' host - + Enter a valid host name or address. - + The scanner process can be confined to a certain network, so it won't discover hosts on adjacent networks. If you leave these fields blank, scanner will visit all networks it can find: - + Confine scan to this network: - + Netmask: - + Address: - + The scanner process can repeat its algorithm recursively using each new host it finds as a new "seed". This allows it to find as many objects on your network as possible. On the other hand, it takes more time and may find some objects you do not really need. You can turn recursive scanning on below: - + Run network scan recursively - + The scanner process can find nodes beyond the boundaries of your network by following point-to-point links connecting it to the Internet or other parts of WAN. - + Follow point-to-point links - + The scanner process normally ignores interfaces that have no IP addresses; checking this option makes it create such interfaces as "Unnumbered" - + Include interfaces with no ip addresses - + Analysis of ARP table yields IP addresses for hosts on your network. In order to determine their names, scanner can run reverse name lookup queries using your name servers (DNS): - + Run reverse name lookup DNS queries to determine host names - + Enter parameters for SNMP and DNS reverse lookup queries below. (If unsure, just leave default values): - + SNMP query parameters: - + SNMP 'read' community string: - - + + number of retries: - + timeout (sec): - + public - + DNS parameters: - + timeout (sec) : - + Number of threads: - + Process name - + Stop - + Save scan log to file - + Process log: - + These are the networks found by the scanner process. Choose the ones you wish to use from the list below, then click 'Next': - - - - - + + + + + Select All - - - + + + Filter ... - - - - - + + + + + Unselect All - - - + + + Remove Filter - - + + -> - - + + <- - + Choose objects you wish to use, then click 'Next': - + Change type of selected objects: - + Address - + Host - + Firewall - + Object - + Interfaces - + Type - + Here you can change type of the objects to be created for each address discovered by the scanner. By default, an "Address" object is created for the host with just one interface with single IP address and "Host" object is created for the host with multiple interfaces, however you can change their types on this page. - + Select target library - + Adding new objects to library ... - + < &Back - + &Next > - + &Finish - + &Cancel @@ -1385,586 +1390,531 @@ Please enter the domain name below: Using Firewall Builder API %1 - - - Evaluation (found invalid license file) - - - - - Registered - - - - - Evaluation - - FWBMainWindow_q - + Firewall Builder - + Output - + Find - + Editor - + Help - + &Edit - + Object - + Tools - + &Help - - + + Tutorial + + + + + Rules - + &File - + Open Recent - + Window - + View - - + + Undo Stack - + &New Object File - - + + New Object File - + &Open... - - - + + + Open - + Ctrl+O - + &Save - - - + + + Save - + Ctrl+S - + Save &As... - + Save As - + &Print... - + Print - + Ctrl+P - + E&xit - + Exit - + &Cut - + Cut - + Ctrl+X - + C&opy - + Copy - + Ctrl+C - + &Paste - + Paste - + Ctrl+V - - + + Ctrl+F - + &Contents... - + Contents - + &Index... - + Index - + &About - + About - - + + New - + &Close - + Close - - - - Compile - - - - Compile rules of all firewall and cluster objects + Compile - - - Install + + + + Compile rules of all firewall and cluster objects - - Install firewall policy of all firewall and cluster objects + Install - - - Back + + + + Install firewall policy of all firewall and cluster objects + Back + + + + + Move back to the previous object - + &New Object - + New Object - + Create New Object - + Ctrl+N - + &Find Object - + Find Object - - + + Find object in the tree - + P&references... - + Preferences... - + Edit Preferences - - - Insert Rule + + + Object Discovery - - - Move Rule Up - - - - - - Move Rule Down - - - - - - Add Rule Below - - - - - - Remove Rule - - - - - Ctrl+Del - - - - - - Copy Rule - - - - - - Cut Rule - - - - - - Paste Rule Above - - - - - - Paste Rule Below - - - - - Add File to &RCS - - - - - Add File to RCS - - - - - - Delete - - - - - &Export Library - - - - - Export Library To a File - - - - - Import &Library - - - - - Import Library From a File - - - - - &Debug - - - - - Debug - - - - - - Propert&ies - - - - - Show File Properties - - - - - Ctrl+I - - - - - - Move Selected Rules - - - - - &Discard - - - - - Discard - - - - - Discard Changes and Overwrite With Clean Copy Of The Head Revision From RCS - - - - - Co&mmit - - - - - Commit - - - - - Commit Opened File to RCS and Continue Editing - - - - - - Lock - - - - - - Unlock - - - - - - Discovery Druid - - - - - new item + Summary of features - + Getting started + + + + + Inspect + + + + + Add File to &RCS + + + + + Add File to RCS + + + + + + Delete + + + + + &Export Library + + + + + Export Library To a File + + + + + Import &Library + + + + + Import Library From a File + + + + + &Debug + + + + + Debug + + + + + + Propert&ies + + + + + Show File Properties + + + + + Ctrl+I + + + + + &Discard + + + + + Discard + + + + + Discard Changes and Overwrite With Clean Copy Of The Head Revision From RCS + + + + + Co&mmit + + + + + Commit + + + + + Commit Opened File to RCS and Continue Editing + + + + + + Lock + + + + + + Unlock + + + + + + new item + + + + + Find Conflicting Objects in Two Files - + Import Po&licy - + Import Policy - + Firewall Builder Help - + Clear Menu - + Release Notes - + Object Tree - + + Ctrl+T + + + + Editor Panel @@ -1972,27 +1922,27 @@ Please enter the domain name below: FWObjectDropArea - + Drop object here. - + Show in the tree - + Edit - + Paste - + Delete @@ -2008,53 +1958,63 @@ Please enter the domain name below: FWWindow - + Ctrl+Z - + Ctrl+Y - + Shift+Ctrl+Z - + Open File - + + File '%1' does not exist or is not readable + + + + A new version of Firewall Builder is available at http://www.fwbuilder.org - + + Print configuration of %1 + + + + Printing... - - + + Printing aborted - + &Continue - + Printing completed - + Printing cancelled @@ -2203,54 +2163,54 @@ Please enter the domain name below: FindObjectWidget - + Search hit the end of the policy rules. - - + + &Continue at top - - + + &Stop - + Search hit the end of the object tree. - + Search object is missing. - + Replace object is missing. - + Cannot replace object with itself. - + Search and Replace objects are incompatible. - + Replaced %1 objects. - + Policy of firewall ' @@ -2288,44 +2248,67 @@ Please enter the domain name below: + + FirewallCodeViewer_q + + + Firewall code viewer + + + + + Firewall / ruleset + + + + + File: + + + + + Close + + + FirewallDialog - + The name of the object '%1' has changed. The program can also rename IP address objects that belong to this object, using standard naming scheme 'host_name:interface_name:ip'. This makes it easier to distinguish what host or a firewall given IP address object belongs to when it is used in the policy or NAT rule. The program also renames MAC address objects using scheme 'host_name:interface_name:mac'. Do you want to rename child IP and MAC address objects now? (If you click 'No', names of all address objects that belong to %2 will stay the same.) - + &Yes - + &No - + Platform setting can not be empty - - - - + + + + &Continue - + Host OS setting can not be empty - - + + FWBuilder API error: %1 @@ -2333,74 +2316,74 @@ Please enter the domain name below: FirewallDialog_q - + Firewall - + Name: - + Platform: - + Version: - + Host OS: - + Modified: - - - + + + TextLabel - + Compiled: - + Installed: - + Host OS Settings ... - + Comment: - + Firewall Settings ... - + Skip this firewall for batch compile and install operations - + Inactive firewall @@ -2408,17 +2391,17 @@ Please enter the domain name below: FirewallInstaller - + Generated script file %1 not found. - + &Continue - + Copying %1 -> %2:%3 @@ -2482,32 +2465,32 @@ Please enter the domain name below: GroupObjectDialog - + Open - + Edit - + Copy - + Cut - + Paste - + Delete @@ -2558,17 +2541,17 @@ Please enter the domain name below: HelpView_q - - MainWindow + + Help - + Object Name - + Close @@ -2763,28 +2746,28 @@ Please enter the domain name below: IPv4Dialog - + Illegal IP address '%1' - - + + &Continue - + Illegal netmask '%1' - + DNS lookup failed for both names of the address object '%1' and the name of the host '%2'. - + DNS lookup failed for name of the address object '%1'. @@ -2792,32 +2775,32 @@ Please enter the domain name below: IPv4Dialog_q - + IPv4 - + Name: - + Address: - + Netmask: - + DNS Lookup... - + Comment: @@ -2825,28 +2808,28 @@ Please enter the domain name below: IPv6Dialog - + Illegal IP address '%1' - - + + &Continue - + Illegal netmask '%1' - + DNS lookup failed for both names of the address object '%1' and the name of the host '%2'. - + DNS lookup failed for name of the address object '%1'. @@ -2854,32 +2837,32 @@ Please enter the domain name below: IPv6Dialog_q - + IPv6 - + Name: - + Address: - + Network (bit length) - + DNS Lookup... - + Comment: @@ -2887,44 +2870,39 @@ Please enter the domain name below: InterfaceDialog - + Group: - + Network: - - Interface name can not contain white space and '-' - - - - - - + + + &Continue - + The name of the interface '%1' has changed. The program can also rename IP address objects that belong to this interface, using standard naming scheme 'host_name:interface_name:ip'. This makes it easier to distinguish what host or a firewall given IP address object belongs to when it is used in the policy or NAT rule. The program also renames MAC address objects using scheme 'host_name:interface_name:mac'. Do you want to rename child IP and MAC address objects now? (If you click 'No', names of all address objects that belong to interface '%2' will stay the same.) - + &Yes - + &No - + FWBuilder API error: %1 @@ -3044,68 +3022,69 @@ If network zone for this interface consists of only one subnet, you can simply c - + Label: - + Comment: - - MAC: - - - - + Type: - + Regular interface - + Dynamic address - + Unnumbered interface - + + MAC address: + + + + Protocol: - + Address - + Netmask - + Type - - + + Remove - + + Add address @@ -3115,28 +3094,33 @@ If network zone for this interface consists of only one subnet, you can simply c - + Failover protocol %1 does not require IP address for interface %2 - + Failover protocol %1 requires an IP address for interface %2 - - Empty addrres or netmask field + + Empty address or netmask field - + + Add another address + + + + Invalid address '%1/%2' - - + + Invalid netmask '%1/%2' @@ -3329,26 +3313,26 @@ If network zone for this interface consists of only one subnet, you can simply c NetworkDialog - + Illegal IP address '%1' - - - - + + + + &Continue - - + + Illegal netmask '%1' - + Network object should not have netmask '0.0.0.0' @@ -3356,18 +3340,18 @@ If network zone for this interface consists of only one subnet, you can simply c NetworkDialogIPv6 - + Illegal IPv6 address '%1' - - + + &Continue - + Illegal netmask '%1' @@ -3431,35 +3415,35 @@ If network zone for this interface consists of only one subnet, you can simply c ObjConflictResolutionDialog - + Keep current object - + Replace with this object - - + + Object '%1' has been deleted - - + + Delete - + Object '%1' in the objects tree - - + + Object '%1' in file %2 @@ -3467,39 +3451,39 @@ If network zone for this interface consists of only one subnet, you can simply c ObjConflictResolutionDialog_q - + Conflict Resolution - + There is a conflict between an object in your tree and object in the file you are trying to open. Choose which version of this object you want to use: - + Current Object - + Keep current object - - + + Always choose this object if there is a conflict - + New Object - + Replace with this object @@ -3592,13 +3576,18 @@ object if there is a conflict - - + + Inspect + + + + + Transfer - + Lock @@ -3613,27 +3602,27 @@ object if there is a conflict - + New &Library - + Create and add to group - + Cluster host OS %1 does not support state synchronization - + State Sync Group - + Failover group @@ -3715,12 +3704,12 @@ p, li { white-space: pre-wrap; } ObjectTreeView - + Object - + Attributes @@ -3751,32 +3740,32 @@ p, li { white-space: pre-wrap; } PrefsDialog - + Find working directory - + Find Secure Shell utility - + Find SCP utility - + A new version of Firewall Builder is available at http://www.fwbuilder.org - + Your version of Firewall Builder is up to date. - + Error checking for software updates: %1 @@ -3808,176 +3797,229 @@ p, li { white-space: pre-wrap; } ProjectPanel - + No firewalls defined - + Untitled - + (read-only) - + + Cancel + + + + + Compile and Inspect files + + + + + + and + + + + + Firewall objects %1 have been modified and need to be recompiled. + + + + + Firewall object "%1" has been modified and needs to be recompiled. + + + + + %1 firewall objects have been modified and need to be recompiled. + + + + + Can not read generated files for the firewall objects %1. You need to compile them to create the files. + + + + + Can not read generated files for the firewall objects %1. You need to compile it to create the files. + + + + + Can not read generated files for the %1 firewall objects. You need to compile then to create the files. + + + + + <b>Multiple firewalls</b> + + + + Searching for firewalls affected by the change... - + + &Save - + &Discard - - + + + &Cancel - + FWB Files (*.fwb);;All Files (*) - - + + Choose name and location for the new file - + Choose name and location for the file - + This operation discards all changes that have been saved into the file so far, closes it and replaces it with a clean copy of its head revision from RCS. All changes will be lost if you do this. - + &Discard changes - + File %1 has been added to RCS. - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + &Continue - + Error adding file to RCS: %1 - + Choose a file to import - + This operation inspects two data files (either .fwb or .fwl) and finds conflicting objects. Conflicting objects have the same internal ID but different attributes. Two data files can not be merged, or one imported into another, if they contain such objects. This operation also helps identify changes made to objects in two copies of the same data file.<br><br>This operation does not find objects present in one file but not in the other, such objects present no problem for merge or import operations.<br><br>This operation works with two external files, neither of which needs to be opened in the program. Currently opened data file is not affected by this operation and objects in the tree do not change.<br><br>Do you want to proceed ? - + Choose the first file - + Choose the second file - - + + Error loading file %1: %2 - + Total number of conflicting objects: %1. Do you want to generate report? - + Choose name and location for the report file - + TXT Files (*.txt);;All Files (*) - + Can not open report file for writing. File '%1' - + Unexpected error comparing files %1 and %2: %3 - + Please select a library you want to export. - + The file %1 already exists. Do you want to overwrite it ? - + &Yes - + &No - + A library that you are trying to export contains references to objects in the other libraries and can not be exported. The following objects need to be moved outside of it or @@ -3985,42 +4027,42 @@ objects that they refer to moved in it: - - + + (Long error message was truncated) - + The program encountered error trying to load file %1. The file has not been loaded. Error: %2 - - + + Loading system objects... - + Error loading file: %1 - + Reading and parsing data file... - + Merging with system objects... - + Firewall Builder uses file extension '.fwb' and needs to rename old data file '%1' to '%2', but file '%3' already exists. @@ -4028,72 +4070,72 @@ Choose a different name for the new file. - + Load operation cancelled and data file revertedto original version. - + Firewall Builder uses file extension '.fwb'. Your datafile '%1' has been renamed '%2' - + Exception: %1 - + Failed transformation : %1 - + XML element : %1 - - + + The program encountered error trying to load data file. The file has not been loaded. Error: %1 - + Building object tree... - + Indexing... - + Checking file %1 in RCS - + Error checking in file %1: %2 - + Saving data to file %1 - + File is read-only - + Error saving file %1: %2 @@ -4101,32 +4143,48 @@ The file has not been loaded. Error: ProjectPanel_q - + Form - - - + + + Compile this firewall - - + + + + ... - - - + + + + Insert rule + + + + + + Compile and install this firewall - + + + + Inspect generated files + + + + Firewall / ruleset @@ -4134,25 +4192,25 @@ The file has not been loaded. Error: QObject - - - - + + + + Support module for %1 is not available - + Firewall Builder can import Cisco IOS access lists from the router configuration saved using 'show run' or any other command that saves running config. The name of the created firewall object, all of its interfaces and their addresses will be configured automatically if this information can be found in the configuration file. - + Firewall Builder can import iptables rules from a file in iptables-save format. Firewall name and addresses of its interfaces need to be configured manually because iptables-save file does not have this information. - + Working directory %1 does not exist and could not be created. Ignoring this setting. @@ -4164,310 +4222,310 @@ because of incompatible type. - - + + New Library - + Library - + Firewall - + Cluster - + Host - + - - + + Interface - + Network - + Network IPv6 - + Address - + Address IPv6 - + DNS Name - + Address Table - + Address Range - + Object Group - + Custom Service - + IP Service - + ICMP Service - + ICMP6 Service - + TCP Service - + UDP Service - + TagService - + User Service - + Service Group - - + + Time Interval - + MAC Address - + Policy Rule Set - + NAT Rule Set - + Routing Rule Set - + Failover group - + State synchronization group - + New Firewall - + New Cluster - + New Host - + New Interface - + New Network - + New Network IPv6 - + New Address - + New Address IPv6 - + New DNS Name - + New Address Table - + New Address Range - + New Object Group - + New Custom Service - + New IP Service - + New ICMP Service - + New ICMP6 Service - + New TCP Service - + New UDP Service - + New TagService - + New User Service - + New Service Group - + New MAC Address - + New Policy Rule Set - + New NAT Rule Set - + New Routing Rule Set - + New failover group - + New state synchronization group - + Add object to group @@ -4477,18 +4535,18 @@ because of incompatible type. - + Edit - + Rename object - - Edit rule options + + Edit protocol parameters @@ -4502,430 +4560,439 @@ because of incompatible type. - + insert rule - + delete rules - + delete rules from group - + change rule(s) color - + move rule up - + move rule down - + negate rule element - + remove object(s) from group - + create new group - + add to group above - + add to group below - + Edit Rule Action - + Edit Rule Comment - + Edit Rule Options - + Negate - - - + + type: - - + objects - - + + protocol: %1 - - + + type: %1 - - + + code: %1 - + DNS record: - + Address Table: - - Group member - - - - + <b>Library:</b> - + <b>Object Id:</b> - + <b>Object Type:</b> - + <b>Object Name:</b> - + <b>DNS record:</b> - - + + Run-time - - + + Compile-time - + <b>Table file:</b> - + type: %1<br> - + Group member %1:%2<br> - + %1 objects<br> - + protocol - + code: - - - Pattern: "%1" - - - - - User id: "%1" - - - - - <b>Action :</b> %1<br> - - - - - <b>Parameter:</b> - - - - - <b>Log prefix :</b> - - - - - <b>Log Level :</b> - - - - - <b>Netlink group :</b> - - - - - <b>Limit value :</b> - - - <b>Limit burst :</b> + Stateless - - <b>connlimit value :</b> + + Stateful - - <b>Part of Any</b> + + + Log prefix: - - <b>Stateless</b> + + Log Level: - - <b>Log facility:</b> - - - - - - <b>Log level :</b> - - - - - <li><b>Send 'unreachable'</b></li> - - - - - - - <li><b>Stateless</b></li> + + Netlink group: - <li><b>Keep information on fragmented packets</b></li> + connlimit value: - - <b>Log prefix :</b> + + Part of Any - - <b>Max state :</b> + + Log facility: - - <li><b>Force 'keep-state'</b></li> - - - - - <li><b>no-sync</b></li> - - - - - <li><b>pflow</b></li> - - - - - <li><b>sloppy-tracker</b></li> + + + Log level: - <li><b>Source tracking</b></li> + Send 'unreachable' - - <b>Max src nodes :</b> + + Keep information on fragmented packets - - <b>Max src states:</b> + + Max state: - - <u><b>Ver:%1</b></u><br> - + + Force 'keep-state' - - <b>Log interval :</b> + + Source tracking + + + + + Max src nodes: - <li><b>Disable logging for this rule</b></li> + Max src states: - - use SNAT instead of MASQ<br> + + Add mirrored rule - - - random<br> - - - - - persistent<br> - - - - - bitmask<br> + + Version: + Log interval: + + + + + Disable logging for this rule + + + + + + Pattern: "%1" + + + + + + Type: + + + + + Members: + + + + + %1 objects + + + + + Label: %1 + + + + + Addresses: + + + + + Address: + + + + + + User id: "%1" + + + + + <b>Action :</b> %1<br> + + + + + <b>Parameter:</b> + + + + + use SNAT instead of MASQ<br> + + + + + + random<br> + + + + + persistent<br> + + + + + bitmask<br> + + + + source-hash<br> - + round-robin<br> - + static-port<br> - + Replace object - + No firewalls assigned to cluster '%1' - + Type '%1': new object can not be created because corresponding branch is missing in the object tree. Please repair the tree using command 'fwbedit checktree -f file.fwb'. - + Create new %1 - + Create library - + Create new Firewall - + Create new Cluster - + Create new Host - - - + + + Paste object - + + Lock object + + + + + Unlock object + + + + Create new group @@ -4990,44 +5057,46 @@ Please repair the tree using command 'fwbedit checktree -f file.fwb'.< - - Library %1: Firewall '%2' (global policy rule #%3) uses object '%4' from library '%5' + + Library %1: Firewall '%2' (%3 rule #%4) uses object '%5' from library '%6' - - Library %1: Firewall '%2' (NAT rule #%3) uses object '%4' from library '%5' - - - - + Library %1: Group '%2' uses object '%3' from library '%4' - + File is read-only - + Error saving file %1: %2 - + + + + RCS tools are unavailable + + + + Fatal error during initial RCS checkin of file %1 : %2 Exit status %3 - + Fatal error running rlog for %1 - + Fatal error running rcsdiff for file %1 @@ -5039,12 +5108,12 @@ Exit status %3 - + - + - + On @@ -5052,40 +5121,40 @@ Exit status %3 - + - + - + Off - + ERROR - + OK - + - + - + No change - + Compiling rule sets for firewall: %1 @@ -5096,578 +5165,600 @@ Exit status %3 - + Summary: - + * Running as user : %1 - + * Firewall name : %1 - + * Installer uses user name : %1 - + * Management address : %1 - + * Platform : %1 - + * Host OS : %1 - + * Loading configuration from file %1 - + * Configuration diff will be saved in file %1 - + * Commands will not be executed on the firewall - + Only one interface of the firewall '%1' must be marked as management interface. - + One of the interfaces of the firewall '%1' must be marked as management interface. - + Management interface does not have IP address, can not communicate with the firewall. - + + 0 - System Unusable - + + 1 - Take Immediate Action - + + 2 - Critical Condition - + + 3 - Error Message - + + 4 - Warning Message - + + 5 - Normal but significant condition - + + 6 - Informational - + + 7 - Debug Message - - - - + + + + + %1 advanced settings - + + on top of the script - + + after interface configuration - + + after policy reset - + Aggressive - + Conservative - + For high latency - + Normal - + Bound to interfaces - + Floating - + in the activation shell script - + in the pf rule file, at the very top - + in the pf rule file, after set comamnds - + in the pf rule file, after scrub comamnds - + in the pf rule file, after table definitions - + alert - + crit - + error - + warning - + notice - + info - + debug - + kern - + user - + mail - + daemon - + auth - + syslog - + lpr - + news - + uucp - + cron - + authpriv - + ftp - + local0 - + local1 - + local2 - + local3 - + local4 - + local5 - + local6 - + local7 - + ICMP admin prohibited - + ICMP host prohibited - + ICMP host unreachable - + ICMP net prohibited - + ICMP net unreachable - + ICMP port unreachable - + ICMP protocol unreachable - + TCP RST - - + + None - + Route through - + Route reply through - + Route a copy through - + Bitmask - + Random - + Source Hash - + Round Robin - + /day - + /hour - + /minute - + /second - + - any - - + 1.2.5 or earlier - + 1.2.6 to 1.2.8 - + 1.2.9 to 1.2.11 - + 1.3.x - + 1.4.0 or later - + + 1.4.1.1 or later + + + + 1.4.3 or later - + 3.x - + 3.7 to 3.9 - + 4.0 to 4.2 - + 4.3 - + 4.5 - - 4.6 and later + + 4.6 - + + 4.7 and later + + + + Source - - + + Destination - + Service - + Time - + Original Src - + Original Dst - + Original Srv - + Translated Src - + Translated Dst - + Translated Srv - + Gateway - + Direction - + Action - + Options - + Metric - + Comment @@ -5677,96 +5768,140 @@ Exit status %3 - + Executing: - + Using transfer agent '%1' - + Appending fw object name to tarball - + Could not transfer %1 config to '%2' - + Impossible to apply changes because object is located in read-only part of the tree or data file was opened read-only - - + + &Continue - + Object with name '%1' already exists, please choose different name. + + + Compiler for firewall platform %1 not found + + + + + Original rule combines match of tcp/udp/icmp +protocols with two or more module matches, such as +module 'mark', 'recent' or 'length'. Use additional +branches to implement this complex match. + + + + + Unknown parameter of target REJECT: %1. + + + + + Can not reproduce default action in table 'mangle' chain 'FORWARD'. + + + + + Can not reproduce default action in table 'mangle' chain 'INPUT'. + + + + + + A single interface belonging to this firewall is expected in this field. + + + + + A single ip address is expected here. You may also insert a host or a network adapter leading to a single ip adress. + + + + + A single ip adress is expected here. You may also insert a host or a network adapter leading to a single ip adress. + + RCS - - - + + + Error checking file out: %1 - - - - - + + + + + &Continue - + Error creating temporary file - + Error writing to temporary file - + File is opened and locked by %1. You can only open it read-only. - + Revision %1 of this file has been checked out and locked by you earlier. The file may be opened in another copy of Firewall Builder or was left opened after the program crashed. - + Open &read-only - + &Open and continue editing - + &Cancel @@ -5896,434 +6031,454 @@ after the program crashed. RuleOptionsDialog_q - + Rule Options for ipt - - + + General - + Assume firewall is part of "any" for this rule only: - + Follow global setting - + On - + Off - - + + Normally policy compiler uses stateful inspection in each rule. Activating this option makes this rule stateless. - - - + + + Stateless rule - - - + + + Logging - + alert - + crit - + error - + warning - + notice - + info - + debug - - + + Log prefix: - - - + + + Log level: - + Netlink group (if using ULOG): - + limit - + Module limit - + Rate (rule matches if it hits this often or less): - - + + /day - - + + /hour - - + + /minute - - + + /second - - + + Negate - - + + Burst: - + connlimit - + Module connlimit - + Match if the number of existing connections is above this (translates into option --connlimit-above) - + per network with netmask of - + bit - + hashlimit - + Module hashlimit - + Name: - + On some older systems this module has name 'dstlimit'. Check here if you need to use this name. - + Rate: - + Mode: - + srcip - + dstip - + srcport - + dstport - + Options below control size of the hash table and expiration time. They will be omitted from the generated script if set to zero. - + htable-size: - + The number of buckets of the hash table (omit this option in generated script if set to 0) - + htable-max: - + Maximum number of entries in the hash (omit this option in generated script if set to 0) - + htable-expire: - + After how many milliseconds do hash entries expire (omit this option in the generated script if set to 0) - + htable-gcinterval: - + How many milliseconds between garbage collection intervals (omit this option in generated script if set to 0) - - + + Normally policy compiler uses stateful inspection in each rule. Activating next option makes this rule stateless. - + Send ICMP 'unreachable' packet masquerading as being from the original destination - + Keep information on fragmented packets, to be applied to later fragments - + Log facility: - + State Tracking - + Force "keep state" to make the rule stateful regardless of the default. - - + + Available in OpenBSD 4.5 and later - + Prevent state changes for states created by this rule from appearing on the pfsync interface. - + States created by this rule are exported on the pflow interface. - + When this option is checked, the number of states per source IP is tracked - + Activate source tracking. - + Maximum number of source addresses which can simultaneously have state table entries (max-src-nodes): - + Maximum number of simultaneous state entries that a single source address can create with this rule (max-src-states): - + Limits - + Maximum number of concurrent states this rule may create. Unlimited if set to zero (option 'max'). - + When this limit is reached, further packets matching the rule that would create state are dropped, until existing states time out. - + Maximum number of simultaneous TCP connections that a single host can make (max-src-conn): - + The limit of new connections over a time interval (max-src-conn-rate): - + / - + sec - + overload table: - + flush - + global - + TCP - + Modulate state - + synproxy - + Use sloppy TCP state tracker for this rule - + These options are only valid for PIX running software v6.3 or later - + completely disable logging for this rule - + Logging interval: - + + Compiler can automatically create a rule with mirrored source and destination addresses and service fields. This can be used to match "reply" packets using address and service parameters matched by this rule. The action of the mirrored rule is the same as that of this one. Firewall Builder recognizes the following services and creates "mirrored" versions as follows: + + + + + * UDP service: mirrored service has source and destination port ranges reversed + * TCP service: mirrored service has source and destination port ranges reversed and "established" flag inverted. If TCP service used in this rule does not have "established" flag, the mirrored service gets it, and the other way around. This is designed to simplify creating ACL rules to permit "reply" TCP packets + * ICMP service: ICMP echo request is recognized, mirrored service becomes ICMP echo reply. Other ICMP types are simply copied to the mirrored service + * ICMPv6 service: like with ICMP, ICMP echo request is recognized and other ICMPv6 types are just copied + * IP service: mirrored service is a copy + + + + + + Add mirror rule + + + + There are no options for this firewall platform @@ -6331,12 +6486,12 @@ after the program crashed. RuleSetDialog - + Rule set name '%1' is invalid. Only '[a-z][A-Z][0-9]_-+=@%^' characters are allowed. - + &Continue @@ -6389,7 +6544,7 @@ after the program crashed. - + On iptables "top" rule set goes into the built-in chains INPUT, OUTPUT, FORWARD; if this flag is unchecked, @@ -6399,14 +6554,14 @@ the rule set. - + If this flag is unchecked, rules go into anchor with the name the same as the name of the rule set. - + If this flag is unchecked, generated access list will not be assigned to interfaces with "ip access-group" @@ -6419,270 +6574,272 @@ access access lists generated for it. RuleSetView - + Compile rule - - + + Move Rule up - - + + Move Rule down - + Parameters - + Inbound - + Outbound - + Both - - - - + + + + Edit - + Rule Options - + Logging On - + Logging Off - + Copy - + Cut - + Paste - + Delete - + Where used - + Reveal in tree - + Negate - - + + Insert Rule - + Add new rule on top - + Add new rule at the bottom - + Paste Rule - + Rename group - + Change color - + No color - + Remove from the group - + New group - - + Add to the group - + Add Rule Below - + + Remove Rule - + Remove Rules - + Move Rules up - + Move Rules down - + Copy Rule - + Cut Rule - + Paste Rule Above - + Paste Rule Below - + + Enable Rule - + Enable Rules - + + Disable Rule - + Disable Rules - - + + Enter group name: - + Enable rule - + Disable rule - + New Group - + Change direction - + Change action - + Change logging - + delete - + Copy object '%1' to clipboard' - + cut - + Move object @@ -6690,22 +6847,32 @@ access access lists generated for it. RuleSetViewDelegate - + + log + + + + + (options) + + + + Any - + Original - + Default - + All @@ -6754,12 +6921,12 @@ access access lists generated for it. - + Rule %1 - + End @@ -6800,7 +6967,17 @@ access access lists generated for it. - + + Stopping background process + + + + + Background process is still running. Will wait %1 sec + + + + SSH session terminated, exit status: %1 @@ -6808,38 +6985,38 @@ access access lists generated for it. SSHUnx - + *** Fatal error : - + Logged in - + New RSA key - + Yes - + No - + Done - + Error in SSH @@ -6924,27 +7101,46 @@ access access lists generated for it. StartTipDialog_q - + Welcome to Firewall Builder - + + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> +<html><head><meta name="qrichtext" content="1" /><style type="text/css"> +p, li { white-space: pre-wrap; } +</style></head><body style=" font-family:'Sans Serif'; font-size:9pt; font-weight:400; font-style:normal;"> +<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><span style=" font-family:'Lucida Grande'; font-size:28pt;">Firewall Builder %1</span></p></body></html> + + + + + Watch Getting Started Tutorial + + + + + Summary of features + + + + Do not show this again - + Previous Tip - + Next Tip - + Close @@ -7157,6 +7353,34 @@ by the target firewall platform + + TutorialDialog_q + + + Tutorial + + + + + Reset + + + + + Previous + + + + + Next + + + + + Close + + + UDPServiceDialog_q @@ -7220,6 +7444,32 @@ by the target firewall platform + + WorkflowIcons_q + + + Form + + + + + Create new +firewall + + + + + Import existing +configuration + + + + + Watch "Getting +Started" tutorial + + + askRuleNumberDialog_q @@ -7331,84 +7581,84 @@ by the target firewall platform clusterMembersDialog_q - + cluster member configuration - + Help - + &OK - + &Cancel - + Cluster - + Manage member firewalls for this Cluster. Firewalls are considered valid members if they have the same host OS and platform as the Cluster object. They also need to have at minimum one physical interface attached. - + Available Firewalls: - + Tree of potential cluster members. Select an interface to assign to the cluster. - + Firewall - - + + Interface - + Label - - + + ... - + Selected as Cluster-Members: - + Table of already selected member firewalls with their assigned cluster interfaces. - + Name - + Master @@ -7459,12 +7709,12 @@ by the target firewall platform conntrackOptionsDialog - + Invalid IP address '%1' - + &Continue @@ -7472,32 +7722,37 @@ by the target firewall platform conntrackOptionsDialog_q - + conntrack protocol settings - + &OK - + &Cancel - + conntrack Parameters - + + Use unicast address for conntrackd + + + + Address: - + Port number (udp): @@ -7826,97 +8081,97 @@ by the target firewall platform freebsdAdvancedDialog_q - + FreeBSD: advanced settings - + Options - - + + Packet forwarding - - - - + + + + No change - - - - + + + + On - - - - + + + + Off - + Forward source routed packets - + Generate ICMP redirects - + Path - + Specify directory path and a file name for the following utilities on the OS your firewall machine is running. Leave these empty if you want to use default values. - + ipfw: - + pfctl: - + ipf: - + ipnat: - + sysctl: - + &OK - + &Cancel @@ -7995,55 +8250,120 @@ will add policy rules to permit these automatically. instDialog - + There are no firewalls to process. - - <p align="center"><b><font size="+2">Select firewalls to compile.</font></b></p> + + Select firewalls to compile. - + + No files were generated, there is nothing to show. + + + + + <b>Multiple firewalls</b> + + + + Policy installer uses Secure Shell to communicate with the firewall. Please configure directory path to the secure shell utility installed on your machine using Preferences dialog - - - - - + + + + + &Continue - + Error: Failed to start program - + + Last error: + + + + + The process failed to start + + + + + The process crashed some time after starting successfully. + + + + + The last waitFor...() function timed out. Elapsed time: %1 ms + + + + + An error occurred when attempting to write to the process. + + + + + An error occurred when attempting to read from the process. + + + + + An unknown error occurred. + + + + + Current state of QProcess: + + + + + The process is not running. + + + + + The process is starting, but the program has not yet been invoked. + + + + + The process is running and is ready for reading and writing. + + + + Compiling rule sets for firewall: - + Compiling ... - - + + Stop - + Firewall platform is not specified in this object. Can't compile firewall policy. @@ -8061,27 +8381,38 @@ Can't compile firewall policy. - + Failure - + Success - + + Error - + Cancelled - + + <b>You are trying to compile policy for a firewall object that is a member of a cluster, however you requested compilation of only this member firewall and not the cluster it belongs to. Assuming firewall is standalone and not cluster member. Rules and parts of the script specific for the cluster configuration will not be generated.</b> + + + + + Firewall '%1' is member of cluster '%2' + + + + Running command '%1' @@ -8090,121 +8421,129 @@ Can't compile firewall policy. instDialog_q - + TextLabel - + <p align="center"><b><font size="+2">Select firewalls to compile and install.</font></b></p> - - All + + + warning text goes here - - None + + Select all - - - + + Select none + + + + + Firewall - - + Compile - - + Install - + Last Modified - + Last Compiled - + Last Installed - + Stop - + Progress - + Firewalls: - + firewall - + current operation here - + Process log - + Save log to file - + + Inspect generated files + + + + Perform batch install - + Check this option if you want to install all selected firewalls automatically. This only works if you use the same user name and password to authenticate to all these firewalls. - + < &Back - + &Next > - + &Finish - + &Cancel @@ -8212,7 +8551,7 @@ Can't compile firewall policy. instOptionsDialog - + Install options for firewall '%1' @@ -8220,32 +8559,32 @@ Can't compile firewall policy. instOptionsDialog_q - + Install options - + <p align="center"><b><font size="+2">Install options for firewall '%1'</font></b></p> - + User name: - + Password or passphrase: - + Enable password: - + Remember passwords for the duration of the session (passwords are never stored permanently). To enable this option turn it on in Preferences and configure user name used to authenticate to @@ -8253,97 +8592,102 @@ the firewall in the "advanced" settings dialog of the firewall object. - + Remember passwords - + Write configuration to standby PIX - + Store configuration diff in a file - + Make a backup copy of the firewall configuration in this file: - + Address that will be used to communicate with the firewall: - + Dry run (commands won't be executed on the firewall) - + Quiet install: do not print anything as commands are executed on the firewall - + Verbose: print all commands as they are executed on the firewall - + Remove comments from configuration - + Compress script - + Store a copy of fwb file on the firewall - + min - + Test run: run the script on the firewall but do not store it permanently. - + Rebooting the firewall will restore its original policy. To cancel reboot, install the policy with "test run" option turned off - + Schedule reboot in - + If you install the policy in test mode, it will not be saved permanently, so you can revert to the last working configuration by rebooting the firewall - + Cancel reboot if policy activation was successfull - - OK + + Install - + + Cancel All + + + + Cancel @@ -8351,32 +8695,32 @@ the firewall in the "advanced" settings dialog of the firewall object. iosAdvancedDialog_q - + IOS Advanced Configuration Options - + OK - + Cancel - + General - + Set router name using object's name - + Generate commands to configure addresses for interfaces @@ -8384,8 +8728,8 @@ the firewall in the "advanced" settings dialog of the firewall object. iosaclAdvancedDialog - - + + Script Editor @@ -8393,22 +8737,22 @@ the firewall in the "advanced" settings dialog of the firewall object. iosaclAdvancedDialog_q - + IOS ACL Firewall Settings - + Compiler Options - + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") - + Compiler creates multiple access lists from the same policy, two for each interface: one for inbound and another for outbound. If the policy is written in a such way that no rule @@ -8420,273 +8764,273 @@ rules are designed. - + Generate separate access list for each interface - + Compiler creates one access list and assigns it to all interfaces. - + Create one access list and attach it to all interfaces - + Policy Compiler Options - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! - + Ignore empty groups in rules - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. - + Detect rule shadowing in the policy - + Use object-group statements (requires IOS v12.4(20)T and later) - + Always permit ssh access from the management workstation with this address: - + Script Options - - + + Insert comments into generated IOSACL configuration file - + Comment the code - + Use ACL remarks - + Group IOSACL commands in the script so that similar commands appear next to each other, just like IOSACL does it when you use 'show config' - + Group similar commands together - + Clear all access lists then install new ones. This method may interrupt access to the firewall if you manage it remotely via IPSEC tunnel. This is the way access lists were generated in older versions of Firewall Builder for IOSACL. - + Do not clear access lists and object group, just generate IOSACL commands for the new ones. Use this option if you have your own policy installation scripts. - + "Safety net" method: First, create temporary access list to permit connections from the management subnet specified below to the firewall and assign it to outside interface. This temporary ACL helps maintain session between management station and the firewall while access lists are reloaded in case connection comes over IPSEC tunnel. Then clear permanent lists, recreate them and assign to interfaces. This method ensures that remote access to the firewall is maintained without interruption at a cost of slightly larger configuration. - + Temporary access list should permit access from this address or subnet (use prefix notation to specify subnet, e.g. 192.0.2.0/24): - + Installer - + Built-in installer - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + Additional command line parameters for ssh - + Additional command line parameters for scp - + Instead of running generated configuration on the router line by line, installer can use scp to copy the file and then "copy file running-config" command to activate it. Ssh v2 and scp servers should be configured on the router for this to work. This method works for IOS v12.4 or later and is much faster than running configuration line by line. - + Copy generated configuration file to the router using scp - + File system on the router where configuration file should be saved if it is copied with scp. Examples: "flash:", "disk0:". Should end with a colon ":". If this input field is left blank, installer uses "nvram:": - + External install script - + Policy install script (using built-in installer if this field is blank): - + Command line options for the script: - + Prolog/Epilog - - + + Edit - + The following commands will be added verbatim on top of generated configuration - + The following commands will be added verbatim after generated configuration - + Logging - + Generate logging commands - + Syslog - + Syslog host (name or IP address): - + syslog facility: - + syslog level ('logging trap'): - + The logging timestamp command requires that the clock command be set. - + Enable logging timestamps on syslog file - + Other logging destinations and levels: - + Internal buffer - + Console - + IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 - + IPv6 before IPv4 - + OK - + Cancel @@ -8694,8 +9038,8 @@ First, create temporary access list to permit connections from the management su ipcopAdvancedDialog - - + + Script Editor @@ -8703,296 +9047,296 @@ First, create temporary access list to permit connections from the management su ipcopAdvancedDialog_q - + ipcop advanced settings - + Compiler - + Compiler: - + Command line options for the compiler: - + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") - + rc.firewall.local - + Assume firewall is part of 'any' - + Accept TCP sessions opened prior to firewall restart - + Bridging firewall - + Detect shadowing in policy rules - + Ignore empty groups in rules - + Enable support for NAT of locally originated connections - + Make Tag and Classify actions terminating - + Default action on 'Reject': - + Always permit ssh access from the management workstation with this address: - + Installer - + Built-in installer - + Directory on the firewall where script should be installed - + /etc/rc.d/ - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + admin - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') - + /etc/rc.d/rc.firewall - + Additional command line parameters for ssh - + Additional command line parameters for scp - + External install script - + Policy install script (using built-in installer if this field is blank): - + Command line options for the script: - + Prolog/Epilog - - + + Edit - + The following commands will be added verbatim after generated configuration - + The following commands will be added verbatim on top of generated configuration - + Logging - + use ULOG - + use LOG - + log TCP seq. numbers - + log IP options - + use numeric syslog levels - + Log level: - + log TCP options - + cprange - + queue threshold: - + netlink group: - + Log prefix: - + Logging limit: - + Activate logging in all rules (overrides rule options, use for debugging) - + Script - + These options enable auxiliary sections in the generated shell script. - + Turn debugging on in generated script - + Verify interfaces before loading firewall policy - + IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 - + IPv6 before IPv4 - + Help - + &OK - + &Cancel @@ -9000,258 +9344,258 @@ with this address: ipcoposAdvancedDialog_q - + IPCOP: advanced settings - + Options - + IPv4 Packet forwarding - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + No change - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + On - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + Off - + IPv6 Packet forwarding - + Kernel anti-spoofing protection - + Ignore broadcast pings - + Ignore all pings - + Accept source route - + Accept ICMP redirects - + Ignore bogus ICMP errors - + Allow dynamic addresses - + Log martians - + whats this text whats this comment - + TCP - + These parameters make sense for connections to or from the firewall host - + TCP sack - + TCP window scaling - + TCP ECN - + TCP SYN cookies - + TCP keepalive time (sec) - + TCP fack - + TCP timestamps - + TCP FIN timeout (sec) - + Path - + Specify directory path and a file name for each utility on your firewall machine. Leave these empty if you want to use default values. - + iptables: - + :ip6tables - + ip: - + vconfig - + brctl - + ifenslave - + logger: - + modprobe: - + lsmod - + iptables-restore: - + :ip6tables-restore - + Help - + &OK - + &Cancel @@ -9268,326 +9612,325 @@ with this address: ipfAdvancedDialog_q - + ipf: advanced settings - + &OK - + &Cancel - + Compiler - + Compiler: - + Command line options for the compiler: - + Output file name. If left blank, the file name is constructed of the firewall object name and extension ".fw" - + Generated script (.fw file) and configuration (.conf) files can be copied to the firewall machine under different names. If these fields are left blank, the file name does not change. - + Script (.fw) file name on the firewall - + ipf.conf file name on the firewall - + nat.conf file name on the firewall - + + Always permit ssh access from the management + workstation with this address: + + + + Accept TCP sessions opened prior to firewall restart - + Find and eliminate duplicate rules - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. - + Detect rule shadowing in policy - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! - + Ignore empty groups in rules - + Default action on 'Reject': - + Masquerade returned icmp as being from original packet's destination - - Always permit ssh access from -the management workstation -with this address: - - - - + Protocol Helpers - + Use raudio proxy in NAT rules - + Use h323 proxy in NAT rules - + Use ipsec proxy in NAT rules - + Use ftp proxy in NAT rules - + Use rcmd proxy in NAT rules - + Use Kerberos rcmd proxy in NAT rules - + Use Kerberos ekshell proxy in NAT rules - + Use PPTP proxy in NAT rules - + Use IRC proxy in NAT rules for DCC - + Some protocols involve multiple associated network connections. Firewall can keep track of such connections automatically if you activate one or all of the following options: - + Installer - + Built-in installer - + Directory on the firewall where configuration files should be installed - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') - + Additional command line parameters for ssh - + Additional command line parameters for scp - + External install script - + Policy install script (using built-in installer if this field is blank): - + Command line options for the script: - + Prolog/Epilog - - + + Edit - + The following commands will be added verbatim on top of generated configuration - + The following commands will be added verbatim after generated configuration - + Logging - + Log facility: - + Log level: - + Log packet body - + Block if can not log - + Script Options - + Add virtual addresses for NAT - + Configure Interfaces of the firewall machine - + Turn debugging on in generated script - + If this option is on, policy compiler adds virtual addresses to the interfaces to make the firewall answer to ARP queries for addresses used in NAT rules. - + Optimization - + These options enable auxiliary sections in the generated shell script. - + Determine addresses of dynamic interfaces at run time - + IPv6 - + Enable IPv6 support - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 - + IPv6 before IPv4 @@ -9604,201 +9947,201 @@ with this address: ipfwAdvancedDialog_q - + ipfw: advanced settings - + &OK - + &Cancel - + Compiler - + Compiler: - + Command line options for the compiler: - + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") - + Generated script can be copied to the firewall machine under different name. If this field is left blank, the file name does not change. - + Script name on the firewall - + Add rule to accept packets matching dynamic rules created for known sessions on top of the policy (action 'check-state') - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. - + Detect rule shadowing in policy - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! - + Ignore empty groups in rules - + Always permit ssh access from the management workstation with this address: - + Installer - + Built-in installer - + Directory on the firewall where script should be installed - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') - + Additional command line parameters for ssh - + Additional command line parameters for scp - + External install script - + Policy install script (using built-in installer if this field is blank): - + Command line options for the script: - + Prolog/Epilog - - + + Edit - + The following commands will be added verbatim after generated configuration - + The following commands will be added verbatim on top of generated configuration - + Script Options - + Add virtual addresses for NAT - + Configure Interfaces of the firewall machine - + Turn debugging on in generated script - + These options enable auxiliary sections in the generated shell script. - + IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 - + IPv6 before IPv4 @@ -9806,8 +10149,8 @@ with this address: iptAdvancedDialog - - + + Script Editor @@ -9820,83 +10163,88 @@ with this address: - + Compiler - + Compiler: - - Command line options for the compiler: - - - - - Output file name. If left blank, the file name is constructed of the firewall object name and extension ".fw" - - - - + Generated script can be copied to the firewall machine under different name. If this field is left blank, the file name does not change. - + Script name on the firewall: - - Assume firewall is part of 'any' + + Compiler command line options: + + + + + Output file name: + If output file name is left blank, the file name is constructed of the firewall object name and extension ".fw" + + + + + Assume firewall is part of 'any' + + + + Accept TCP sessions opened prior to firewall restart - + Accept ESTABLISHED and RELATED packets before the first rule - + Drop packets that are associated with no known connection - + and log them - + Bridging firewall - + Detect shadowing in policy rules - + Ignore empty groups in rules - + Enable support for NAT of locally originated connections - + This adds a rule on top of the policy with iptables target TCPMSS and option --clamp-mss-to-pmtu. Generation of this command is version-dependent and also depends on the setting of ip or ipv6 forwarding @@ -9905,317 +10253,322 @@ in host settings dialog. - + Clamp MSS to MTU - + Make Tag and Classify actions terminating - + Compiler will automatically generate rules to permit ICMP6 packets used in IPv6 Neighbor Discovery after the rules that accept ESTABLISHED,RELATE and before the rule that drops packets in state INVALID. - - Add rules to accept IPv6 Neighbor Discovery packets to IPv6 policies - - - - + Default action on 'Reject': - + + Add rules to accept IPv6 Neighbor Discovery +packets to IPv6 policies + + + + + Use module "set" for run-time Address Table objects (module is only available in iptables v 1.4.1.1 and later) + + + + Always permit ssh access from the management workstation with this address: - - Install the rule for ssh access from the management workstation when the firewall -is stopped + + Install the rule for ssh access from the management workstation when the firewall script is run with the "block" command - + Installer - + Built-in installer - + Directory on the firewall where script should be installed - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') - + Additional command line parameters for ssh - + Additional command line parameters for scp - + External install script - + Policy install script (using built-in installer if this field is blank): - + Command line options for the script: - + Prolog/Epilog - - + + Edit - + The following commands will be added verbatim after generated configuration - + The following commands will be added verbatim on top of generated configuration - + Insert prolog script - + on top of the script - + after interface configuration - + after policy reset - + Logging - + use ULOG - + use LOG - + log TCP seq. numbers - + log IP options - + use numeric syslog levels - + Log level: - + log TCP options - + cprange - + queue threshold: - + netlink group: - + Log prefix: - + Logging limit: - + Activate logging in all rules (overrides rule options, use for debugging) - + Script - + Load iptables modules - + If debugging is turned on, the script will run with shell option "-x" that makes it print every command it executes. Warning: this produces a lot of debugging output. - + Turn debugging on in generated script - + Managing interfaces and addresses - + Verify interfaces before loading firewall policy - + Configure Interfaces of the firewall machine - + Clear ip addresses and bring down interfaces not configured in fwbuilder - + Configure VLAN Interfaces - + Configure bridge Interfaces - + Configure bonding Interfaces - + Add virtual addresses for NAT - + Generated script can load rules one by one by calling iptables command line utility, or activate them all at once using iptables-restore. In both cases you just run the script with command line parameter "start" to activate the policy, the script will use iptables-restore automatically if this checkbox is on - + iptables-restore replaces firewall policy in one atomic transaction - + Use iptables-restore to activate policy - + IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 - + IPv6 before IPv4 - + Help - + &OK - + &Cancel @@ -10223,77 +10576,77 @@ is stopped linksysAdvancedDialog_q - + Linksys/Sveasoft: advanced settings - + &OK - + &Cancel - + Path - + Specify directory path and a file name for each utility on your firewall machine. Leave these empty if you want to use default values. - + iptables: - + ip: - + logger: - + modprobe: - + lsmod - + vconfig - + brctl - + ifenslave - + Prompts - + Policy installer relies on the shell prompt on the firewall to execute commands. Installer tries both prompt string patterns configured here; it assumes that the firewall is ready to accept a command if either prompt matches. You should only need to change these string patterns if Sveasoft changes the shell prompt in the future releases of the software. <br> <br> @@ -10301,17 +10654,17 @@ The default strings work for Sveasoft Alchemy pre-5.1 and pre-5.2 - + Use default prompts - + prompt 2 - + prompt 1 @@ -10319,289 +10672,292 @@ The default strings work for Sveasoft Alchemy pre-5.1 and pre-5.2 linux24AdvancedDialog_q - + Linux 2.4: advanced settings - + Options - + IPv4 Packet forwarding - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + No change - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + On - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + Off - + IPv6 Packet forwarding - + Kernel anti-spoofing protection - + Ignore broadcast pings - + Ignore all pings - + Accept source route - + Accept ICMP redirects - + Ignore bogus ICMP errors - + Allow dynamic addresses - + Log martians - + whats this text whats this comment - + TCP - + These parameters make sense for connections to or from the firewall host - + TCP sack - + TCP window scaling - + TCP ECN - + TCP SYN cookies - + TCP keepalive time (sec) - + TCP fack - + TCP timestamps - + TCP FIN timeout (sec) - + Path - + Specify directory path and a file name for each utility on your firewall machine. Leave these empty if you want to use default values. - + iptables: - + :ip6tables - + ip: - + logger: - - vconfig + + vconfig: - - brctl + + brctl: - - ifenslave + + ifenslave: - + + lsmod: + + + + + ipset: + + + + + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> +<html><head><meta name="qrichtext" content="1" /><style type="text/css"> +p, li { white-space: pre-wrap; } +</style></head><body> +<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;">These parameters allow you to tune performance of<br />conntrack module (netfilter state tracking). This<br />should only be necessary for large firewalls with a lot<br />of traffic and many stateful rules.<br />Explanation of these parameters can be found on</p> +<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;">the Internet if you search for &quot;netfilter conntrack performance&quot;<br /><br />Set both to zero to use default values</p></body></html> + + + + modprobe: - - lsmod - - - - + iptables-restore: - + :ip6tables-restore - + conntrack - + CONNTRACK_MAX - + CONNTRACK_MAX is the maximum number of "sessions" (connection tracking entries) that can be handled simultaneously by netfilter in kernel memory. - + HASHSIZE - + the size of the hash table storing the lists of conntrack entries - - These parameters allow you to tune performance of<br> -conntrack module (netfilter state tracking). This<br> -should only be necessary for large firewalls with a lot<br> -of traffic and many stateful rules.<br> -Explanation of these parameters can be found at<br> -<a href="http://www.wallfire.org/misc/netfilter_conntrack_perf.txt">http://www.wallfire.org/misc/netfilter_conntrack_perf.txt</a><br> -<br> -Set both to zero to use default values - - - - + This parameter is used if you run conntrackd in state <br> synchronization mode for a firewall cluster and have<br> kernel &lt;2.6.22<br> @@ -10611,22 +10967,22 @@ Explanation of this parameter can be found at<br> - + Disable TCP window tracking ("ip_conntrack_tcp_be_liberal") - + Help - + &OK - + &Cancel @@ -10745,17 +11101,17 @@ Explanation of this parameter can be found at<br> longTextDialog_q - + longTextDialog_q - + Continue - + this is the error text @@ -10847,37 +11203,37 @@ Explanation of this parameter can be found at<br> - + Depending on the failover protocol, cluster interface may or may not need an IP address. <b>VRRP</b>, <b>CARP</b>, <b>heartbeat</b> interfaces should have their own unique IP addresses different from the member firewall interfaces. Other failover protocols such as the one used in <b>Cisco ASA (PIX) firewall</b> do not require additional IP address.<br><br>List of available failover protocols depends on the firewall platform. - + regular - + dynamic - + unnumbered - + with address: - + with addresses: - + You should select at least one firewall to create a cluster @@ -10885,68 +11241,68 @@ Explanation of this parameter can be found at<br> newClusterDialog_q - + TextLabel - + < &Back - + &Next > - + &Finish - + &Cancel - + Enter the name of the new object - + Select member firewall objects to use with the new cluster. One member firewall should be marked as master. You can choose to copy policy and NAT rules from the rule sets of one of the members to the new cluster later. - + Firewall - + Use in cluster - + Master - - + + Tab 1 - + Choose which member's policy and NAT rules should be used to create policy and nat rules of the cluster. First, each member firewall object will be copied with the name "<firewall>-bak" (where <firewall> is the name of the member) for backup, then rules from the chosen member will be copied to the new cluster and finally all policy and NAT rules will be deleted in both members. Backup firewall objects ensure that you do not lose your configuration and can always revert back if necessary. You can delete backup objects or move them to a separate library for archival later. - + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <html><head><meta name="qrichtext" content="1" /><style type="text/css"> p, li { white-space: pre-wrap; } @@ -10955,32 +11311,32 @@ p, li { white-space: pre-wrap; } - + Name: - + Firewalls used in this cluster - + Master firewall: - + Cluster interfaces - + Policy and NAT rules will be copied from firewall: - + Click Finish to create this cluster. @@ -10988,76 +11344,77 @@ p, li { white-space: pre-wrap; } newFirewallDialog - + FWBuilder template files - + FWBuilder template files (*.xml *.fwb *.fwl) - + Missing SNMP community string. - + + Address of %1 could not be obtained via DNS - + Please select template - - + + &Continue - + Dynamic interface gets its IP address by means of DHCP or PPP protocol and does not require an address here. Regular interface has statically configured IP address which should be entered on this page. Interface can have several IPv4 and IPv6 addresses. - + Error loading template library: %1 - + Here you can change IP address of the template interface to match addresses used on your network. Interface can have several IPv4 and IPv6 addresses. - + Interface: %1 (%2) - + Dynamic address - + Unnumbered interface - - - + + + Invalid address '%1/%2' - + Can not find interface %1 in the interface editor data @@ -11065,152 +11422,147 @@ p, li { white-space: pre-wrap; } newFirewallDialog_q - + TextLabel - + Enter the name of the new object below: - + Choose firewall software it is running: - + Choose OS the new firewall runs on: - + Use preconfigured template firewall objects - + Template file: - + Browse - + Use standard template library - + Next step is to add interfaces to the new firewall. There are two ways to do it: using SNMP query or manually. Adding them using SNMP query is fast and automatic, but is only possible if firewall runs SNMP agent and you know SNMP community string 'read'. - + Configure interfaces manually - + Use SNMP to discover interfaces of the firewall - + Discover Interfaces using SNMP - + SNMP 'read' community string: - - - Here you can add or edit interfaces manually. 'Name' corresponds to the name of the physical interface, such as 'eth0', 'fxp0', 'ethernet0' etc. 'Label' is used to mark interface to reflect network topology, e.g. 'outside' or 'inside'. Label is mandatory for PIX firewall. + + Firewall IP address: - - Click 'Next' when done. + + + 'Name' corresponds to the name of the physical interface, such as 'eth0', 'fxp0', 'ethernet0' etc. 'Label' is used to mark interface to reflect network topology, e.g. 'outside' or 'inside'. Label is mandatory for PIX firewall. - - - Tab 1 - - - - - up - - - - - down - - - - - Name - - - - - Label - - - - - Address - - - - - Security Level - - - - - Click 'Finish' when done. - - - - - In order to be able to build firewall policy properly, Firewall Builder needs information about 'security level' of the firewall's interfaces. Interface that connects it to the Internet is considered 'insecure' and has security level '0', while interface connected to the internal network is supposed to be 'secure' (security level '100'). You can arrange interfaces in the order of their security level below. - - - - + Choose template object in the list and click 'Next' when ready. -You can change intrface names and their IP addresses on the next page. Template firewall object comes with a basic policy and NAT rules that implement policy described in its comment. If you change IP addresses of its interfaces, policy and NAT rules will be automatically corrected to reflect this change. However you should always inspect the rules and adjust them to suite your security policy. Template objects are designed to be a starting point, a way to jump-start your configuration and most likely require changes to be useful in your environment. +You can change interface names and their IP addresses on the next page. Template firewall object comes with basic policy and NAT rules that implement policy described in its comment. If you change IP addresses of its interfaces, policy and NAT rules will be automatically corrected to reflect this change. However you should always inspect the rules and adjust them to suite your security policy. Template objects are designed to be a starting point, a way to jump-start your configuration and most likely require changes to be useful in your environment. - + + + Tab 1 + + + + + up + + + + + down + + + + + Name + + + + + Label + + + + + Address + + + + + Security Level + + + + + In order to be able to build firewall policy properly, Firewall Builder needs information about 'security level' of the firewall's interfaces. Interface that connects it to the Internet is considered 'insecure' and has security level '0', while interface connected to the internal network is supposed to be 'secure' (security level '100'). You can arrange interfaces in the order of their security level below. + + + + < &Back - + &Next > - + &Finish - + &Cancel @@ -11271,24 +11623,24 @@ You can change intrface names and their IP addresses on the next page. Template - + Interface: %1 (%2) - + Dynamic address - + Unnumbered interface - - - + + + Illegal address '%1/%2' @@ -11296,107 +11648,107 @@ You can change intrface names and their IP addresses on the next page. Template newHostDialog_q - + TextLabel - + Enter the name of the new object below: - + Use preconfigured template host objects - + Template file: - + Browse - + Use standard template library - + Next step is to add interfaces to the new host. There are two ways to do it: using SNMP query or manually. Adding them using SNMP query is fast and automatic, but is only possible if the host runs SNMP agent and you know SNMP community string 'read'. - + Configure interfaces manually - + Use SNMP to discover interfaces of the host - + Discover Interfaces using SNMP - + SNMP 'read' community string: - + Here you can add or edit interfaces manually. 'Name' corresponds to the name of the physical interface, such as 'eth0', 'fxp0', 'ethernet0' etc. 'Label' is used to mark interface to reflect network topology, e.g. 'outside' or 'inside'. - + Check option 'Unnumbered interface' for the interface that does not have an IP address. Examples of interfaces of this kind are those used to terminate PPPoE or VPN tunnels. - + Check option 'dynamic address' for the interface that gets its IP address dynamically via DHCP or PPP protocol. - + Click 'Next' when done. - + Tab 2 - + Choose template object in the list and click 'Finish' when ready. Template objects use generic interface names that will be iherited by the firewall object you create. You may need to rename them later to reflect real names of interfaces on your firewall machine. - + < &Back - + &Next > - + &Finish - + &Cancel @@ -11450,7 +11802,7 @@ You can change intrface names and their IP addresses on the next page. Template openbsdAdvancedDialog_q - + OpenBSD: advanced settings @@ -11517,27 +11869,27 @@ You can change intrface names and their IP addresses on the next page. Template - + pfctl: - + sysctl: - + Specify directory path and a file name for the following utilities on the OS your firewall machine is running. Leave these empty if you want to use default values. - + &OK - + &Cancel @@ -11646,8 +11998,8 @@ You can change intrface names and their IP addresses on the next page. Template pfAdvancedDialog - - + + Script Editor @@ -11655,605 +12007,620 @@ You can change intrface names and their IP addresses on the next page. Template pfAdvancedDialog_q - + pf: advanced settings - + Compiler - + Compiler: - + Command line options for the compiler: - - Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") - - - - + Generated script (.fw file) and configuration (.conf) file can be copied to the firewall machine under different names. If these fields are left blank, the file name does not change. - + Script (.fw) file name on the firewall - + .conf file name on the firewall - + Accept TCP sessions opened prior to firewall restart - + Modulate state for all stateful rules (applies only to TCP services) - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. - + Detect rule shadowing in policy - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! - + Ignore empty groups in rules - + Optimization: - + State policy: - + States can be bound to interfaces or match packets on any interface. The latter can be useful in case of an assymmetric routing. - + Always permit ssh access from the management workstation with this address: - + Scrub - + Clears the don't fragment bit from the IP packet header. - + Clear DF bit - + Replaces the IP identification field of outgoing packets with random values to compensate for operating systems that use predictable values. - + Use random ID - + Enforce Minimum TTL: - + Enforces a minimum Time To Live (TTL) in IP packet headers. - + Enforce Maximum MSS: - + Enforces a maximum Maximum Segment Size (MSS) in TCP packet headers. - + Reassemble fragments - - Buffers incoming packet fragments and reassembles them into a complete packet before passing them to the filter engine. - - - - + Buffer and reassemble fragments (default) - - Causes duplicate fragments to be dropped and any overlaps to be cropped. - - - - + Drop duplicate fragments, do not buffer and reassemble - - Similar to 'Drop duplicate fragments' except that all duplicate or overlapping fragments will be dropped as well as any further corresponding fragments. - - - - + Drop duplicate and subsequent fragments - + Limits - + maximum number of entries in the memory pool used for packet reassembly - + table-entries - + maximum number of addresses that canbe stored in tables - + maximum number of entries in the memory pool used for state table entries - + state table size: - + reassembly pool: - + maximum number of entries in the memory pool used for tracking source IP addresses - + maximum number of tables that can exist in the memory simultaneously - + tables - + src-nodes - + Timeouts - + When a packet matches a stateful connection, the seconds to live for the connection will be updated to the value which corresponds to the connection state. - + TCP - - - - + + + + first - - - - - - + + + + + + The state after the first packet. - + opening - + The state before the destination host ever sends a packet. - + established - + The fully established state. - + The state after the first FIN has been sent. - + closing - + The state after both FINs have been exchanged and the connection is closed. - + finwait - + The state after one endpoint sends an RST. - + closed - + UDP - - + + single - + The state if the source host sends more than one packet but the destination host has never sent one back. - - + + multiple - + The state if both hosts have sent packets. - + ICMP - + The state after an ICMP error came back in response to an ICMP packet. - + error - + Other Protocols - + Fragments - + reassembly timeout - + state expiration timeout - + seconds between purges of expired states and packet fragments. - + seconds before an unassembled fragment is expired. - + Adaptive scaling - + + (if left blank, the file name is constructed of the firewall object name and extension ".fw") + + + + + Output file name: + + + + + Buffers incoming packet fragments and reassembles them into a complete packet before passing them to the filter engine. In PF 4.5 and earlier. + + + + + Causes duplicate fragments to be dropped and any overlaps to be cropped. In PF 4.5 and earlier. + + + + + Similar to 'Drop duplicate fragments' except that all duplicate or overlapping fragments will be dropped as well as any further corresponding fragments. In PF 4.5 and earlier. + + + + + Statefully normalises TCP connections. + + + + + Reassemble TCP + + + + Timeout values can be reduced adaptively as the number of state table entries grows (see man page pf.conf(5) for details) - + adaptive start - + When the number of state entries exceeds this value, adaptive scaling begins. - + adaptive end - + When reaching this number of state entries, all timeout val- ues become zero, effectively purging all state entries imme- diately. - + Activate adaptive timeout scaling - + Installer - + Built-in installer - + Directory on the firewall where script should be installed - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') - + Additional command line parameters for ssh - + Additional command line parameters for scp - + External install script - + Policy install script (using built-in installer if this field is blank): - + Command line options for the script: - + Prolog/Epilog - - + + Edit - + The following commands will be added verbatim after generated configuration - + The following commands will be added verbatim on top of generated configuration - + Insert prolog and epilog scripts - + in the activation shell script (.fw file) - + in the pf rule file (.conf file) - + Logging - + Log Prefix - + Fallback "deny all" rule should log blocked packets - + Script - + These options enable auxiliary sections in the generated shell script. - + Turn debugging on in generated script - + Configure Interfaces of the firewall machine - + Configure CARP Interfaces - + Configure pfsync Interfaces - + Configure VLAN Interfaces - + Add virtual addresses for NAT - + Flush pf states after reloading rules - + IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 - + IPv6 before IPv4 - + Help - + &OK - + &Cancel @@ -12294,8 +12661,8 @@ with this address: pixAdvancedDialog - - + + Script Editor @@ -12303,827 +12670,831 @@ with this address: pixAdvancedDialog_q - + PIX Firewall Settings - + OK - + Cancel - + Compiler - + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") - + Policy Compiler Options - + Generate rules assuming the firewall is part of "Any". This makes a difference in rules that use services 'ssh' and 'telnet' since PIX uses special commands to control ssh and telnet access to the firewall machine - + Assume firewall is part of 'any' - + PIX inspects packets with ACLs before it does NAT, while many other firewalls do NAT first and then apply ACLs. Policy compiler can emulate the latter behaviour if this options is turned on. - + Replace NAT'ted objects with their translations in policy rules - - + Normally PIX does not support ouotbound ACL, however policy compiler can emulate them if this option is turned on - + Emulate outbound ACLs - + Generate outbound ACLs - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! - + Ignore empty groups in rules - + In nat rules where network zone object is used in OSrc, ODst and OSrv are 'any' and TSrc defines a global pool for the translation, replace object in OSrc with 'any' to produce PIX command "nat (interface) N 0.0.0.0 0.0.0.0" - + Optimize 'default nat' rules - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. - + Detect rule shadowing in the policy - + Verification of NAT rules - + Check for duplicate nat rules - + Check for overlapping global pools - + Check for overlapping statics - + Check for overlapping global pools and statics - + Always permit ssh access from the management workstation with this address: - + Installer - + Built-in installer - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + Additional command line parameters for ssh - + Additional command line parameters for scp - + Instead of running generated configuration on the firewall line by line, installer can use scp to copy the file and then "copy file running-config" command to activate it. Ssh v2 and scp servers should be configured on the firewall for this to work. This method works for PIX v7 or later and is much faster than running configuration line by line. - + Copy generated configuration file to the firewall using scp - + File system on the firewall where configuration file should be saved if it is copied with scp. Examples: "flash:", "disk0:". Should end with a colon ":". If this input field is left blank, installer uses "flash:": - + External install script - - Policy install script : - - - - + Command line options for the script: - - Built-in installer will be used if policy install script field is blank. - - - - + Prolog/Epilog - - + + Edit - + The following commands will be added verbatim on top of generated configuration - + The following commands will be added verbatim after generated configuration - + Timeouts - + xlate - + conn - + udp - + rpc - + h323 - - + + sip - + sip&media - + unauth - + telnet - + ssh - + ss - + mm - + hh - + half-closed - + Inactivity - + Absolute - + Set all to defaults.. - + Inspect - + Policy compiler generates 'fixup' commands for PIX v6.1-6.3 and FWSM v2.3. For PIX 7.0 it generates 'class-map' and 'inspect' commands assigned to the 'policy-map' under either default or custom inspection classes. - + ctiqbe - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + skip - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + enable - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + disable - + Computer Telephony Interface Quick Buffer Encoding (CTIQBE) protocol inspection module that supports NAT, PAT, and bi-directional NAT. - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + port: - + dns - + Based on this maximum-length configured by the user, the DNS fixup checks to see if the DNS packet length is within this limit. Every UDP DNS packet (request/response) undergoes the above check. - + max length: - + esp ike - + Enables PAT for Encapsulating Security Payload (ESP), single tunnel. - + ftp - + strict: - + Activated support for FTP protocol and allows to change the ftp control connection port number. - + h323 h225 - + Specifies to use H.225, the ITU standard that governs H.225.0 session establishment and packetization, with H.323 - - - - - - - - + + + + + + + + -- - + h323 ras - + Specifies to use RAS with H.323 to enable dissimilar communication devices to communicate with each other. - + http - + The default port for HTTP is 80. Use the port option to change the HTTP port, or specify a range of HTTP ports. - + icmp error - + Enables NAT of ICMP error messages. This creates translations for intermediate hops based on the static or network address translation configuration on the firewall. - + ils - + Provides NAT support for Microsoft NetMeeting, SiteServer, and Active Directory products that use LightWeight Directory Access Protocol (LDAP) to exchange directory information with an for Internet Locator Service (ILS) server. - + mgcp - + Enables the Media Gateway Control Protocol (MGCP) fixup. - + Gateway Port: - + Call Agent port: - + pptp - + Enables Point-to-Point Tunneling Protocol (PPTP) application inspection. - + rsh - + Enables inspection of RSH protocol. - + rtsp - + Lets PIX Firewall pass Real Time Streaming Protocol (RTSP) packets. RTSP is used by RealAudio, RealNetworks, Apple QuickTime 4, RealPlayer, and Cisco IP/TV connections. - + Enable or change the port assignment for the Session Initiation Protocol (SIP) for Voice over IP TCP connections. - + sip udp - + Enable SIP-over-UDP application inspection. - + skinny - + Enable SCCP application inspection. SCCP protocol supports IP telephony and can coexist in an H.323 environment. An application layer ensures that all SCCP signaling and media packets can traverse the PIX Firewall and interoperate with H.323 terminals. - + smtp - + Enables the Mail Guard feature, which only lets mail servers receive the RFC 821, section 4.5.1, commands of HELO, MAIL, RCPT, DATA, RSET, NOOP, and QUIT. All other commands are translated into X's which are rejected by the internal server. - + sqlnet - + Enables support for SQL*Net protocol. - + tftp - + Enable TFTP application inspection. - + Enable all protocols - + Disable all protocols - + Skip all protocols - + Logging - - Syslog host (name or IP address): - - - - + Syslog message queue size (messages): - + syslog facility: - + syslog level ('logging trap'): - + PIX Firewall Version 6.3 introduces support for EMBLEM format, which is required when using the CiscoWorks Resource Manager Essentials (RME) syslog analyzer. - + Use 'EMBLEM' format for syslog messages - + Set device id for syslog messages (v6.3 and later): - + use hostname - + use address of interface - + use text string - + The logging timestamp command requires that the clock command be set. - + Enable logging timestamps on syslog file - + Other logging destinations and levels: - + Internal buffer - + Console - + Script - + Clear all access lists then install new ones. This method may interrupt access to the firewall if you manage it remotely via IPSEC tunnel. This is the way access lists were generated in older versions of Firewall Builder for PIX. - + Do not clear access lists and object group, just generate PIX commands for the new ones. Use this option if you have your own policy installation scripts. - + "Safety net" method: First, create temporary access list to permit connections from the management subnet specified below to the firewall and assign it to outside interface. This temporary ACL helps maintain session between management station and the firewall while access lists are reloaded in case connection comes over IPSEC tunnel. Then clear permanent lists, recreate them and assign to interfaces. This method ensures that remote access to the firewall is maintained without interruption at a cost of slightly larger configuration. - + Temporary access list should permit access from this address or subnet (use prefix notation to specify subnet, e.g. 192.0.2.0/24): - + + Normally PIX does not support outbound ACL, however policy compiler can emulate them if this option is turned on + + + + + Policy install script (built-in installer will be used if blank): + + + + + Syslog host (IP address): + + + + + Script (additional) + + + + Compiler can generate PIX configuration without commands that configures interfaces, timeouts and inspectors. These parts of configuration change rarely so it makes no sense to execute the same commands again and again. In addition, runnig the same commands on configuration reload cause errors. Use this option to generate shortened configuration to avoid errors and make update faster. - + Generate only access-list, access-group, telnet, ssh, nat, global and static commands - + Insert comments into generated PIX configuration file - + Comment the code - + Use ACL remarks to relate ACL commands and policy rules in the GUI - + Use ACL remarks - + Group PIX commands in the script so that similar commands appear next to each other, just like PIX does it when you use 'show config' - + Group similar commands together - + Use manual ACL commit on FWSM - + PIX Options - + Actively reset inbound TCP connections with RST - + Actively reset inbound TCP connections with RST on outside interface - + Force each TCP connection to linger in a shortened TIME&WAIT - + Alt+W - + Enable the IP Frag Guard feature (deprecated in v6.3 and later). - + Enable TCP resource control for AAA Authentication Proxy - + Specify that when an incoming packet does a route lookup, the incoming interface is used to determine which interface the packet should go to, and which is the next hop @@ -13131,62 +13502,62 @@ the packet should go to, and which is the next hop - + Disable inbound embedded DNS A record fixups - + Disable outbound DNS A record replies - + The following parameters are used for all NAT rules: - + maximum number of simultaneous TCP and UDP connections - + Specifies the maximum number of simultaneous TCP and UDP connections for the entire subnet. The default is 0, which means unlimited connections. (Idle connections are closed after the idle timeout specified by the timeout conn command.) - + maximum number of embryonic connections per host - + Specifies the maximum number of embryonic connections per host. An embryonic connection is a connection request that has not finished the necessary handshake between source and destination. Set a small value for slower systems, and a higher value for faster systems. The default is 0, which means unlimited embryonic connections. - + (The default for both parameters is 0, which means unlimited number of connections.) - + IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 - + IPv6 before IPv4 @@ -13235,141 +13606,141 @@ the packet should go to, and which is the next hop pixosAdvancedDialog_q - + PIX Advanced Configuration Options - + General - + Set PIX host name using object's name - + Generate commands to configure addresses for interfaces - + NTP - + NTP Servers: - + Server 1: - + Server 2: - + Server 3: - + Preffered: - - + + IP address: - + SNMP - + Disable SNMP Agent - + Set SNMP communities using data from the firewall object dialog - + SNMP servers - - + + Poll - - + + Poll and Traps - - + + Traps - + Enable: - + SNMP Server 1: - + SNMP Server 2: - + Enable sending log messages as SNMP trap notifications - + Options - + Change TCP MSS to - + bytes - + OK - + Cancel @@ -13423,352 +13794,367 @@ the packet should go to, and which is the next hop prefsDialog_q - + Preferences - + General - + Working directory: - - - + + + Browse... - + Software Updates: - + Check Now - + Check for updates automatically - + Use http proxy while checking for updates (host:port) - + No identifiable information will be sent to the server during update check - + Do not show tips on startup - + Objects - - Enable object tooltips - - - - + Tooltip delay: - + Show deleted objects - + Show object attributes in the tree - + Clip comments in rules - - Properties of specific object types - - - - + DNS Name - - + + Create new objects in "Compile Time" mode by default - - + + Create new objects in "Run Time" mode by default - + Use object name for the DNS record in all objects of this type - + Address Table - + Data File - + Periodically save data to file every - + minutes - + Do not ask for the log record when checking in new file revision. - + Enable compression of the data file - + Installer - + A full path to the Secure Shell utility (remote command execution; for example ssh on Unix or plink.exe on Windows): - + A full path to the SCP utility (file copy over ssh; for example scp on Unix or pscp.exe on Windows): - + Built-in policy installer can remember passwords for the duration of the session. Passwords are never stored permanently, they are only kept in memory. In order to use this feature, you also need to configure user name used to authenticate to the firewall in the "advanced" settings dialog of the firewall object. - + Warning: using this feature creates certain risk if working Firewall Builder GUI is left unattended on the unlocked workstation. Someone may walk up to the machine and make changes to the firewall using cached password of the administrator who used the same GUI session before. Always lock the screen or exit Firewall Builder GUI when leaving computer. - + Enable password caching for the duration of the session (passwords are never stored permanently) - + Enable password caching - + Download plink.exe and pscp.exe from the web site at - - <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> -<html><head><meta name="qrichtext" content="1" /><style type="text/css"> -p, li { white-space: pre-wrap; } -</style></head><body style=" font-family:'Lucida Grande'; font-size:13pt; font-weight:400; font-style:normal;"> -<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; font-size:8pt;"><a href="http://www.chiark.greenend.org.uk/~sgtatham/putty/"><span style=" text-decoration: underline; color:#0000ff;">http://www.chiark.greenend.org.uk/~sgtatham/putty/</span></a></p></body></html> + + Enable object tooltips in the tree and rule sets - + + Properties of specific object types: + + + + + Value for the ServerAliveInterval ssh configuration parameter. This parameter sets timeout interval in seconds after which if no data has been received from the server, ssh client will send a message through the encrypted channel to request a response from the server. This helps detect disconnects between fwbuilder policy installer and the firewall. If set to 0, these messages will not be sent to the server and loss of connectivity with the firewall will lead to hanging of the installer session. Scp uses different parameter for this, ConnectTimeout. Fwbuilder automatically calculates the value for this parameter using the same timeout value. Note that this only works with ssh protocol v2. + + + + + sec + + + + + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> +<html><head><meta name="qrichtext" content="1" /><style type="text/css"> +p, li { white-space: pre-wrap; } +</style></head><body style=" font-family:'Sans Serif'; font-size:9pt; font-weight:400; font-style:normal;"> +<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><a href="http://www.chiark.greenend.org.uk/~sgtatham/putty/"><span style=" font-family:'Lucida Grande'; font-size:8pt; text-decoration: underline; color:#0000ff;">http://www.chiark.greenend.org.uk/~sgtatham/putty/</span></a></p></body></html> + + + + Labels - + Use these labels to mark rules in the firewall policy - + Red - + Blue - + Yellow - + Orange - + Purple - + Green - + Gray - + Appearance - + Icons settings - + Choose font for rules sets - + Rules font - + rules font description - - + + Choose font for tree - + Tree font - + tree font description - + Compiler Output Panel font - + compiler output font description - + Show icons in rules - + Show text descriptions in columns "Direction", "Action" - + Icons size in rules: - + 16x16 - + 25x25 - + + Show text under toolbar icons + + + + Platforms and OS - + If you disable firewall platform or host OS here, it will not appear in the drop-down lists of platforms and host OS anywhere in the program. This helps avoid clutter in lists of platforms and OS if you only work with one or two of them. - + Supported firewall platforms - + Supported host OS - + Platform - + Host OS - + &OK - + &Cancel @@ -13791,471 +14177,643 @@ p, li { white-space: pre-wrap; } + + procurveaclAdvancedDialog + + + + Script Editor + + + + + procurveaclAdvancedDialog_q + + + HP ProCurve ACL Firewall Settings + + + + + Compiler Options + + + + + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") + + + + + Compiler creates multiple access lists from the same policy, +two for each interface: one for inbound and another for +outbound. If the policy is written in a such way that no rule +can possibly be associated with an interface, this interface +gets no access list at all. Also, interfaces marked as +"unprotected" never get access list regardless of how the policy +rules are designed. + + + + + + Generate separate access list for each interface + + + + + Compiler creates one access list and assigns it to all +interfaces. + + + + + + Create one access list and attach it to all interfaces + + + + + Policy Compiler Options + + + + + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! + + + + + Ignore empty groups in rules + + + + + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. + + + + + Detect rule shadowing in the policy + + + + + Always permit ssh access from the management workstation with this address: + + + + + Script Options + + + + + Clear all access lists then install new ones. This method may interrupt access to the firewall if you manage it remotely via tunnel. + + + + + Do not clear access lists, just generate commands for the new ones. Use this option if you have your own policy installation scripts. + + + + + "Safety net" method: + +First, create temporary access list to permit connections from the management subnet specified below to the firewall and assign it to outside interface. This temporary ACL helps maintain session between management station and the firewall while access lists are reloaded in case connection comes over IPSEC tunnel. Then clear permanent lists, recreate them and assign to interfaces. This method ensures that remote access to the firewall is maintained without interruption at a cost of slightly larger configuration. + + + + + Temporary access list should permit access from this address or subnet (use prefix notation to specify subnet, e.g. 192.0.2.0/24): + + + + + + Insert comments into generated IOSACL configuration file + + + + + Comment the code + + + + + Use ACL remarks + + + + + Installer + + + + + Built-in installer + + + + + User name used to authenticate to the firewall (leave this empty if you use putty session): + + + + + Alternative name or address used to communicate with the firewall (also putty session name on Windows) + + + + + Additional command line parameters for ssh + + + + + Additional command line parameters for scp + + + + + Instead of running generated configuration on the router line by line, installer can use scp to copy the file and then "copy file running-config" command to activate it. Ssh v2 and scp servers should be configured on the router for this to work. This method is much faster than running configuration line by line. + + + + + Copy generated configuration file to the router using scp + + + + + File system on the router where configuration file should be saved if it is copied with scp. Examples: "flash:", "disk0:". Should end with a colon ":". If this input field is left blank, installer uses "nvram:": + + + + + External install script + + + + + Policy install script (using built-in installer if this field is blank): + + + + + Command line options for the script: + + + + + Prolog/Epilog + + + + + + Edit + + + + + The following commands will be added verbatim on top of generated configuration + + + + + The following commands will be added verbatim after generated configuration + + + + + Logging + + + + + Generate logging commands + + + + + Syslog + + + + + Syslog host (name or IP address): + + + + + syslog facility: + + + + + syslog level ('logging trap'): + + + + + The logging timestamp command requires that the clock command be set. + + + + + Enable logging timestamps on syslog file + + + + + Other logging destinations and levels: + + + + + Internal buffer + + + + + Console + + + + + IPv6 + + + + + The order in which ipv4 and ipv6 rules should be generated: + + + + + IPv4 before IPv6 + + + + + IPv6 before IPv4 + + + + + OK + + + + + Cancel + + + secuwallAdvancedDialog - - Select templates directory - - - - - URL is not valid: %1 - - - - - Could not open URL: %1 - - - - - Illegal address '%1' - - - - - Empty address found (position %1) - - - - - Illegal address '%1' (position %2) - - - - - Input not valid: %1 + + + Script Editor secuwallAdvancedDialog_q - - secunet wall: advanced settings + + iptables: advanced settings - + Help - + &OK - + &Cancel - - Management + + Compiler - - secunet wall Management settings + + Compiler: - - Specify secunet wall Management settings below. -Please use commas to separate a list of IP addresses. + + Command line options for the compiler: - - Management address + + Assume firewall is part of 'any' - - Enter the IP address of the secunet wall Management station + + Accept TCP sessions opened prior to firewall restart - - Syslog server + + Accept ESTABLISHED and RELATED packets before the first rule - - Enter IP address of the logging server + + Drop packets that are associated with +no known connection - - SNMP querier address + + and log them - - Enter IP address where SNMP requests to this firewall come from + + Bridging firewall - - RO-SNMP string + + Detect shadowing in policy rules - - Enter community string for read only SNMP access + + Ignore empty groups in rules - - NTP server IP address + + Enable support for NAT of locally originated connections - - Enter IP address of a NTP server + + This adds a rule on top of the policy with iptables target TCPMSS +and option --clamp-mss-to-pmtu. Generation of this command is +version-dependent and also depends on the setting of ip or ipv6 forwarding +in host settings dialog. + - - Nagios service IP + + Clamp MSS to MTU - - Enter IP address of the Nagios station here + + Make Tag and Classify actions terminating - - Local /var partition + + Default action on 'Reject': - - Enter name for partition that will be mounted to /var + + Always permit ssh access from the management workstation with this address: - - Local config partition + + Install the rule for ssh access from the management workstation when the firewall +is stopped - - Enter name for local config partition + + Installer - - DNS Client + + Built-in installer - - secunet wall DNS settings + + Additional command line parameters for ssh - - Specify secunet wall DNS client related settings below + + Additional command line parameters for scp - - DNS servers + + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - - Search domains - - - - - Enter DNS search domains here. One search domain per line - - - - - Hosts file - - - - - Enter Hosts entries here. One IP-Address/Name pair per line. These entries will be written to /etc/hosts file on the firewall - - - - - The resolution order defines how hostnames will be resolved on the firewall (nsswitch.conf). Default is "Hosts file first" - - - - - Resolution order - - - - - - - - - Hosts - - - - - - - - - DNS - - - - - - - - NIS + External install script - - - - - - NIS+ + + Policy install script (using built-in installer if this field is blank): - - - - - DB + Command line options for the script: + + + + + Prolog/Epilog + + + + + + Edit + + + + + The following commands will be added verbatim after generated configuration - Options + The following commands will be added verbatim on top of generated configuration - - Specify secunet wall advanced iptables/routing options below - - - - - IPv4 Packet forwarding + + Insert prolog script - - - - - - - - - - - - - - - - No change + on top of the script - - - - - - - - - - - - - - - - On + after interface configuration - - - - - - - - - - - - - - - - Off + after policy reset - - IPv6 Packet forwarding + + Logging - - Kernel anti-spoofing protection + + use ULOG - - Ignore broadcast pings + + use LOG - - Ignore all pings + + log TCP seq. numbers - - Accept source route + + log IP options - - Accept ICMP redirects + + use numeric syslog levels + + + + + Log level: + + + + + log TCP options + + + + + cprange + + + + + queue threshold: + + + + + netlink group: - Ignore bogus ICMP errors + Log prefix: - - Allow dynamic addresses + + Logging limit: - - Log martians + + Activate logging in all rules +(overrides rule options, use for debugging) - - whats this text - whats this comment + + Script - - TCP + + Allow reboot to load modules (only if needed) - - These parameters make sense for connections to or from the firewall host + + Turn debugging on in generated script - - TCP FIN timeout (sec) + + Managing interfaces and addresses - - TCP keepalive time (sec) + + Verify interfaces before loading firewall policy - - TCP window scaling + + Configure Interfaces of the running firewall machine - - TCP sack + + Add virtual addresses for NAT - - TCP fack + + Generated script can load rules one by one by calling iptables command line utility, or activate them all at once using iptables-restore. In both cases you just run the script with command line parameter "start" to activate the policy, the script will use iptables-restore automatically if this checkbox is on. - - TCP ECN + + iptables-restore replaces firewall policy in one atomic transaction - - TCP SYN cookies + + Use iptables-restore to activate policy - - TCP timestamps + + Warning: rebooting breaks the connectivity until the firewall is up again. The outage can be up to minutes, depending on how fast the machine restarts. - - Files + + If debugging is turned on, the script will run with shell option "-x" that makes it print every command it executes. Warning: this produces a lot of debugging output. - - Enable support for additional files here. Files in the selected templates directory will be added to the configuration of this Firewall. - - - - - Add additional files to firewall configuration - - - - - Template directory - - - - - Select templates directory for this Firewall - - - - - Browse - - - - - Open current path in file browser - - - - - Open + + Warning: this breaks the connectivity until all interfaces are 'up' again. The outage is typically < 10 seconds @@ -14319,96 +14877,569 @@ Please use commas to separate a list of IP addresses. - solarisAdvancedDialog_q + secuwallosAdvancedDialog - - Solaris: advanced settings + + Select templates directory - + + URL is not valid: %1 + + + + + Could not open URL: %1 + + + + + Empty address found (position %1) + + + + + Illegal address '%1' (position %2) + + + + + Input not valid: %1 + + + + + secuwallosAdvancedDialog_q + + + secunet wall: advanced settings + + + + + Help + + + + &OK - + &Cancel - + + Management + + + + + secunet wall Management settings + + + + + Specify secunet wall Management settings below. +Please use commas to separate a list of IP addresses. + + + + + Management access + + + + + Enter the IP addresses or networks of the secunet wall management zone + + + + + Syslog servers + + + + + Enter IP addresses of logging servers + + + + + SNMP access + + + + + Enter IP addresses or networks where SNMP requests to this firewall come from + + + + + RO-SNMP string + + + + + Enter community string for read only SNMP access + + + + + NTP servers + + + + + Enter IP addresses of NTP servers + + + + + Nagios access + + + + + Enter IP addresses or networks for Nagios access + + + + + Local /var partition + + + + + Enter name for partition that will be mounted to /var + + + + + Local config partition + + + + + Enter name for local config partition + + + + + Disable auto-generation of firewall rules for management services + + + + + Don't create firewall rules + + + + + DNS Client + + + + + secunet wall DNS settings + + + + + Specify secunet wall DNS client related settings below + + + + + DNS servers + + + + + Search domains + + + + + Enter DNS search domains here. One search domain per line + + + + + Hosts file + + + + + Enter Hosts entries here. One IP-Address/Name pair per line. These entries will be written to /etc/hosts file on the firewall + + + + + The resolution order defines how hostnames will be resolved on the firewall (nsswitch.conf). Default is "Hosts file first" + + + + + Resolution order + + + + + + + + + Hosts + + + + + + + + + DNS + + + + + + + + + NIS + + + + + + + + + NIS+ + + + + + + + + + DB + + + + Options - - Ignore ICMP redirects + + Specify secunet wall advanced iptables/routing options below - - - - - + + IPv4 Packet forwarding + + + + + + + + + + + + + + + + + + + No change - - - - - + + + + + + + + + + + + + + + + On - - - - - + + + + + + + + + + + + + + + + Off - + + IPv6 Packet forwarding + + + + + Kernel anti-spoofing protection + + + + + Ignore broadcast pings + + + + + Ignore all pings + + + + + Accept source route + + + + + Accept ICMP redirects + + + + + Ignore bogus ICMP errors + + + + + Allow dynamic addresses + + + + + Log martians + + + + + whats this text + whats this comment + + + + + TCP + + + + + These parameters make sense for connections to or from the firewall host + + + + + TCP FIN timeout (sec) + + + + + TCP keepalive time (sec) + + + + + TCP window scaling + + + + + TCP sack + + + + + TCP fack + + + + + TCP ECN + + + + + TCP SYN cookies + + + + + TCP timestamps + + + + + Files + + + + + Enable support for additional files here. Files in the selected templates directory will be added to the configuration of this Firewall. + + + + + Add additional files to firewall configuration + + + + + Template directory + + + + + Select templates directory for this Firewall + + + + + Browse + + + + + Open current path in file browser + + + + + Open + + + + + solarisAdvancedDialog_q + + + Solaris: advanced settings + + + + + &OK + + + + + &Cancel + + + + + Options + + + + + Ignore ICMP redirects + + + + + + + + + No change + + + + + + + + + On + + + + + + + + + Off + + + + Forward directed broadcasts - + Respond to echo broadcast - + Packet forwarding - + Forward source routed packets - + Path - + ipf: - + ipnat: - + Specify directory path and a file name for the following utilities on the OS your firewall machine is running. Leave these empty if you want to use default values. @@ -14416,32 +15447,38 @@ Please use commas to separate a list of IP addresses. transferDialog - + Transfer error: %1 - + + &Continue - + + No firewalls selected for transfer + + + + Waiting - + Error: Failed to start program - + Error: Waiting for program termination - + Error: Program returned failure status @@ -14449,12 +15486,12 @@ Please use commas to separate a list of IP addresses. transferDialog_q - + Config transfer options - + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <html><head><meta name="qrichtext" content="1" /><style type="text/css"> p, li { white-space: pre-wrap; } @@ -14463,78 +15500,78 @@ p, li { white-space: pre-wrap; } - + Select usbstick volume to start firewall config transfer: - + Select a portable disk volume to transfer firewall configs - + Device - + Size - + Mounted - + Mountpoint - + Filesystem - + Double click on a firewall in this tree to jump to the corresponding process log entry - + Firewall - + Progress - + Process log - + Save log to file - + Start the export! - + Transfer - - Cancel + + Close @@ -14587,7 +15624,7 @@ p, li { white-space: pre-wrap; } vrrpOptionsDialog - + Input not valid: %1 @@ -14615,17 +15652,22 @@ p, li { white-space: pre-wrap; } - + + Use IPsec AH protected VRRP + + + + VRRP Secret - + Virtual Router ID - + VRID diff --git a/src/gui/fwbuilder_ja.qm b/src/gui/fwbuilder_ja.qm index d0025949d4b16aa32f4748ea7eef096231e01c40..4c5cf15ada3bedd4f28f9e798ec3cfdfd416b42a 100644 GIT binary patch delta 15315 zcma*td0b8F+duH@-t)XoDVZ|Qlm_#dq7YFbA}W+24Mb==89K*pBFCF!Uz6H5&R5buSCMK>Urm6WwkOd%$qm z6V8T#M0b`DNxqXv*-a!h5IMRKnWV3fSVSbdM-&i4ByT~qu|Iol2zx`xzKXLclqyyq z$zJ@rb10Kq1xIe^qq>m<(Epd20XMDxe;18nWR<`>#w)YJ- z<_LQNPj5Z%^iUX0^y)N`qKL#2JczOtiKRGSxt7EVTvwS#BBB)v6c1+o$Ldq3e>Iyp z@j}Obe$4*!!lo#h#yaj}tMLbg^C3QNHh}H;H`_Uu4N|bZ#<3&cv(X#bxEXA`>E90| z;>zMq6#!)S)Wd<|8TZ1O3wOs z(( z#>`<)lweQ06ZM`%bYvcT2aOTOq7oXHReyYe)jzJWC*HwbM9-_)6k8S&^_hbDzqb;J zxkL{$ZHmb%qTqu>_Zz~GFo38pp8Eb;q7Yo*{z;+%M~VJQX0Meb8j6zf!g*E$QDQ^; z;21Y&wP!X_q>LyZr97-BiNzI&MrYKgt!Y7X5Zqa}rKFSf5dBKpCRA zSfVUkJnjbx1@gzD#NOZr#)Xks76TWo(ZujH2$oe8(V7&>-K?d-GH4?o}GEY#ED(K*#l`L%SV~r z(y$NClk6P6*u4VD&Ub*BZ0s!d?Gg6VN0MEcMWn}#Sq+`a&cb!9$B%I1*PIZQ3v7xc zEyi>gXagXHg@reJP=aE38Y1V^{>rL`b?ilrkvqib= z`&gS|;6svk`9M^{gMCn$o^c}iWG52q#*uvSF`|~9Y==`M-yBL*a|-)&l}#ZnN%HM@ zpv-3M{X~-IMG)0;g(f7t>Tt%u*CaoA1dXKyDN@l*w&jvygC7aYcv5UaBitUx9&>^H zalDKad#nNFF1&+L&Pa;=ZHY!VA;mx2F&gHRQg#l3W;lENBPkV2@xbmj#o2PCG*y_5 z6BdxN$u|TTe~g}K2t*r5+2tXQ$B{At7h2Yel*^F6>=G#vW5n`zq+Eym71c?(1+M%~ zO6!g9Izq}*Y4ABIU(_YB;1!jw@ScROYWxv;bC(BgvXk*hTZ>z zTDJL0G_4W4yaTn2l#)p#53nV~q9NpU1#zv>Vd}UjA2+a`I^IRaxox6O9`A8uUD+4e zHbwkuhzstW3Nc^_|BF^KIsg$-E2_Li{0JK6pUHuOCkQHqV4 z#17leCfs84QrJR0ds}7GM0cGz<6bQLP_U1T6f|Q!QHy45>$7aPT5SA$_Iy?9H8%j~ zZD3!mq+auUhzi`P_Y6GP;XLYd1S4t7G88-vL8|FXHukku6N!1z6ddnDG-!fN(U*_K zpaL8>M*a?)Vt8)~PM?6NSe}imY*UDMR`!DW4t6DK zn){f-U#`IH=m_Q{3lK|YLlYAD4m9)_77DxOQUw zE`UUpGZbgCCVU%ELS!O>iHZ_YVszp#C556ZP8>p}+UrTAEu_?o-$+PfDfKS|CEZoF z@?zH4mt8)SeR{&CpdV~sXZGw@nzi8)iH0?4u3ApCVKABIm9r*lkYy6rLOQ-!ozG?+7RgPf5*5D`n>BdC(L=S3ZVc`d5MU!2w3kr-VlZbVim8rhZ|l_K6e--+uEWIqV;vCtWljm2HX zw^ulE(lGJe+!GPhTOt{kPeK$)WL-a!$Viqr&Ram@On}7kqc0x+rljh|$t0$kB(?RA zalu;b`^FO2m*`EIvn8(IH^2`NGvLgFk|v?Jex8@4*=+>UGgBokDn^nB4Yi8?AGKN1 zD&sGrw)Z67M{vPpM~TnbrkLRdO8k=1eR_P8bc;d$AFh%fcdL^aQ&SRf%!0|n6G_0M zUPO_BlE6VvNjUv$&m2B3)Jj6{;PXA(O2VE?F=wbQi3+QVIlvdm$igfB%RtP%ujtJ-Un=ST9-mV=Km{{gU;qj}fgo zB-v;k)9RL&WLU?Zx+B;Ze@HT{@uOa4$(DBb{JQ6o-J{PFy~~p9u}0JepCyO(Z6w;g zT5`;E2i>GjxTMhO9Z}gIl1q8Tm`se8T#-qME_h3>h8AM-F--E{&RZOxk`%v6LMV-v z6o14GsFtvc%h(j@?<5~o?&w8>C13x<7l+?uSG!9k7x93zj8dHpOS9d@(h?VNz4d8Q zQ-wz;fxk9LosK)9dp(fWc0WoK+SI1#SBV{*Dy^M53e$y5_RTJ-OZ`AhC_74BQ(=P$ zX-hrg#CECFQyxmR@PyR=9=e(LSZQDfJaL&m?2?x@MaDI0$SuryBsJHDf1LV&_+9v%}a!-=v{VcZg!0q{H@OI?>cgI_Jg=60+6O zg`Y1G&DsXEZi|)g80m!>2yjno zO0Tpp#>8rv^nPC-qL}-YZloMYlzyiHr8DGa1 z#z~f?Zo?>=(?vEbISn(lMfS2;Z;qn>%GsVn*^@c4IfKwj7Y&gu_Q8az#7@?(fc31$ z4tm0xF0wh}*=w%s^>H?ZtR|~i#j4Ig6J}@;k(@DoJGIwxI*6#CfnRz5EfP z_!6?sv)>anmdG}nW`9DWDKgMX8;^uP;5zsd-jHp^77w}N19Q+eT)m+JPJk-76RHt8 z{U91y+ljKw`si*Y-m-3;*wzlL-!gW1cQ)p&%w+q(>Ep7@rz z7Oixf>`)(15{uT#3gqY=Q})PCH9bW%u(s^f6FlKCH9Nc&n&#}j+5kX=lQ!W?*&?CJy5{fJ(&JN8Cwy`DD79<`f7qMASJT+BA_#U?zHJsTcJ zv|^9!&GFS}&40_@wYx#Wp)uQT6r0yn_Pz8$^qRY}pRLg?*VUGnIQW%BT{n4IBSN%C zPxkE#_T4CXS^se)dYF#Lt7SgGLT9tQ+ATQ0tGw3CzcHRm*pMk~=stO^RCLG8weotm zIuNZk%IiHsmF#aXcW#@7fJHWiX{X%z-9=pQtK8Ka>yoA;V_n=pd?TuUBO+gd`=^8Ov&s0B4w+Y;1$ z6+5a0JLaBz(1Hl;$7HihcFKoNxr_x+woS1`VGgmcWb$|=kH>YWK_z)YS+vD_)#MW_ zHE`Nnn_^3(d?J=T!t_x7XXg;?O?$E#-R0Bo9>a4?lBZf%r~~)PQ_V0rRz6p|7Li#Z zpPO?Oajuzs?%ujYpTl4zc58;fhnV42vuP5U7vzgKjl^i}FJC%09!=vF+x{Q+kJapg z{%qb?`G$IF2!OZc8w${yH>>37v(Q93e3GZee?YO7}z#>p6?7hR#wF=KYFB zo3;~WR8=?!RkeN~U*Y^9m&A}}il)Vwd)6Glx~bV#-t2fcMe|DS&^hWUTD`*sqdgR@ z|3s&A>aA$o4^=Ve1bd*7`9QhWCg0Ku&%-yc#13ZtPq95_vjNT6Uj5i$9UG!&2Yh40 z*RxUH?65>OVGVooDtmJZd*`!FER6?o#)B^G!&{1uia{6(ce6Dfv976X%TsLPK6a*H z50qDQY#WVmH%`%`oB7n`|QXV_Us%*UxB&~+Mx&^=!n4fND)yB{a-d+G29x78{{g6cW;7eg@Yp6 zsS+abPDSFmLc9bysTi+7;7qr$U&q@N74Na#@3TR1RpZ@hzJ_ zh&{2BJ-w7YzeX`J_5zlM6BN@s@rkM6sgSUfM6*Du@-8uv)W){>T;kibUYK`oF zdMjp?_#2J*E;J$0>bPR=Rt<>~3)z)kie(!R0Oq`A4-8VQbV20W@Ra>>-KMD6n(f|( z?LC~0>A@a9&z}0CSR1*E#N=ef`gFvP?RJU{m`akiv|@wFn&|AT*qGlRe>kextelF4 z%r-@4K?U^BX^O2Gfrwxcirw!pJI^|&*sp4iA)>4ze_Rc0f_7CL)9=Rnr?-j|9)5UH zlBy_F1<{VE_Jo8;iRQ{n&v8k`()qPJao|m&-da}nVE8a;GNlXe*Dmx`&BP89X zIP0%e|B3a^WM^dsr_n@hNLh6ON^pP!JIKkV2w7(0#Lx%I8X5T{B=wZFaxki1%~96* z5rsiAoINnfta!FJP$v^A4;D`816T1R{HkFd?GxZ9cfSoZCi*c zS+m*vJ{zeHsu_?O92f%OPx+vKsP((F7vyJrY{FiL3~hKIN-Q_orOeoLxc zC|N^vbftxWSn(tWZ{?=))kyeMRBleicwN2~+b)zHaFn%dW8cna-+i+w z`oBT*g?6qL>|7VuF^Ul)2`;qot+xv?QDT^XW(>LUAfy4MH+Wp zx%;9QT77-x{u3CtE6irQE@DTmVUIg1ZNv4hp~`%`S`e!SDGMs^B&sq@d2$>Y>sX_* z(9=|!gx53Wxz$*4eHgF2kcc|0AHX&(&3d}B$xD@&W_#i#NJ-_jO@(Nji`awNHidl- z+xBnvP>%9e>Lq;9Q03j57!7@ID<7#aDok9dEb8x$-Y`n}#x$)tmVl>}Z>)OHV~_l! z{5Z%=V*YgHC+p<4esASZFBI{bPO36?a-#l8?7#?>V+I=S<3p;-p}4VA&Z?S6%42hH zBHJU0Jy};(YrZxAFx#^_doo64at*tL$?HEVj|PZ<)BCHM)1zxoq8<=3zBnqQc z4~s@(hv%v4b?r(B<^5H~A$76wGDr0>2~EY%TlGWWLKmN?<^7WI8pcH}-;B|D`!}_= zDHd{)_Uz)9@E^=Y53B9gU?_R*rFJ+HhBkjxU2Y1tLx${BS1dyO6MfW9wJ?ROebp*@ z>5g{lYEw}43tiN8rD)WXgu0>i1M;2hW@okAgS|wR{M7D8ALG4EsJeB@qu78Q!VbQm zZqwY0=-Lf+yR;wpy+jMOuRuvHc&_$s^%`#zUa0*rQ>1e>ZHmD?)cvesW=aEfh?@yT zcJlxd@WE7d|LJJ6k|pf9k?Qc6cGzRz2HV3o>XEh!^;M60gUEhplRD-JBKXlh>iGF> z@q>)B>e1<+Npviwo`5f)TP@VdTTvDBm#JrD`(jD_S)Ce>2W+`tJvRh5xFtY6&(sx( zOo@8l2`mR@OjoB>#GP*Wp-x+bpC-&HrCzP_B&sk)z5eCj`1MDB^#(6gk^MV$78W|R z!d<=VNker16!rcL+`yt-HOH+dY}eQ9sK43cqtyr7qgPKlsXln_58P0U+H}M^!MXHJ zedOc}ZO6&rr zX-0j(6P@p-iOoMql#-ws*Uyne6))CjJsXg&N!r&Id*nyiVH(YhF^}+K=x@zppXGSK zKiCNeZJKDeCui*SW*=Q(pWJ7k`m@gq*w1U&e>So|-`W%<2e6J~*{b|`;cVjLW=?F! zY_@YFtLXoMM>wNb6E?Ud8}gow^k7HsV57s?IKE*K@6N{wg?4VGeulHGBTPCOvsRCQch!`zCCiQLM)Sw(UgL6wl6E!)8XYdoHkt zTr^p&G4nI|YI4pxVqO!Y$uU_Iz3OmApX+Rtjvdy4U7X6kXwQDDVpBxd(&R3GPxSM+ zX8(}q*hy+^Q`Fg}*`FGKQ2bMKAQ0VAzm%Q-mCe4UIdBzir$lRw$(C4AtT`-N<7Xwk zG>4PW?`wEyju#@J++CtOJp$3}2B>2KjMVjm5q=&S zamVYvYl^+M;(f__&8L?*Uh_orJsG3lxR;ur8jPNEH)-XO&LrAaWe;A^s>gX@-SbSV zUYw8Xj?t=@qI=it!%j3c)T%RP5dBl#rs(sHjgxCN@51mCrE6N_${N^qJfSU>a|6R} zflV=}G&}5#w%(f=cpdqj9X?&_9+*e;V~e(>;V%+eIcqnVt#zAqufdvHhj3!TOLmT# z-CdSFa9P`G^HS8Ym$u6%M7VMvZ3^ng2Jd3~k6E(yC zK%lyMEsF!<@G++oK*^@R!bM>mB@>Axh_TGYN0FKIrP4tb-Zd zTV1`pW*FUdx(1=R`~{<~u_Kz4dna8B32J1@bzR5#g=ou(I-d*oh^mI_d|yArAlq5j zc~2s0Xx1=Y_nR2*&(zfQxEYIh^o*T%pUrmAg*-3{+?X0XvW zbdy>h!<*|Ry6F?prmNJ~EqIS1VeKB>LgRP5WT>KBWY-flK2T@TRso|>%NHb{oI zmJQgC4!UioX&6-R>$bmsj@`u3x~x>xY?V!H?}qHKySm(Cm?n&vr#o0F0Apgl?r
    gCrkOP?}CuRe$pd_7ZN z@)fFLWea^7Ll3-e8Nx=iW3QRn8*Vm*(nD{uo+wI|<&3IJS?4Bf)9Y-4JDW0+-7$mB z9jLc|^%1X8`svF}K_}@ohYfC{cU+A&zV?y6e#l8IA71GjRBM8Ff_3ywlD#m^NYOX# z^%R~m>D!&_N22rsw#6=XU$NeM1!mDfkMv!y?ndOb)AucEj=5@ieLws-kUH&PQ?vBZ z)*p;4nV^q;@)}jRSRc~`=c&r+|43SjsbYYBIyU=gcPX}Dw0_1J+|UYzes-E4u4@X` z&v8>DWEbi!H4$$Nk!;^!9?qO>({P%kDpJxWjk-wZ#iBLC3%T$ zHkaL7OTRM*ac4--e`kU@(8<#e*S5x)320S34N@PpFV5?`cjs4k{YMUl8 z&XY5y8`zz<+5MgMkNXAVha^AskC*(7S@=1Fuq-56x5XgV%*H~g&>&IuMKWV6&f}cA%2HO<0fDL}f_RnM^9~$bFK8{_7@rH&2g7AL#hQVcdT@<~7 ztr5$*mV+kzp=BS=Nc3fA_!!zuMnCUxpFRA-(CK76(U>U)|Ktt`AUZ?O_m}Vk6emOP zgS)X#2{MFP$DCTBhLOgF=yAuShU#D>{vpT8LrSi?bL_#~X6D;x+3`d&7}@4IuiW4(MV~muR^OIbH?ag8P~1W!|0qE z1?`Qk?_dlW^2ucM_3aH1b_?*=`HiF-?q-htVw?>@to~xZ<7uJ!3)=K6m>y`_R>B>Yjo~TEm!n6eVpj z$&K@?PQae_KDOo#wo470LfV||yOs^}VTWH}N6#`YPJK>du)T4s5jPfb+qiT6R4lZn zu(KlBU2~1Q%k?4(y219D!L}KCoD-3Ij0Njr@VkykIyOI)0@F1Zyo%o5?%CFan9y8F+GP=2_YE}%fGmjhDIBQb$6Jh=olaX~jHd1G{OL4R-;~g0r zkuY%haL?%Qh@i-bgoxMyG3Gf(I+gxE{$h5S*C1=C>8jEkG`w6^qm*+-^QTUZS$>xL zCHV`dZgR+S-n3I^nQ}~2G)H8WGRJ>tnN?}e{*t1$dDe-F6$y$A~jL153X12)MaG{AXPhDLl>-@!Rm1SXfQA72g z`>>qvF6x8;rf8V}}hM z9-ZJ57Cka9dv!%2sgQl9nOGvS=d=*hB(|!z#J3UUEOxC$x9s_?#Ul^Poc^L;cBe67 zyhHYn*}_?y{bi}>E-b-Sgk$!~6~fUi+x4P2ZkOGwNUWDF{36O&~Akc8DUXp z31@Y=QL)isqhrTJSW?=G1a zoACKH&(Shxkf{D^o`Xfi4acB*(0iPs)V1Y$ti2yaLQWxoVw$OCRz9f-(f90&f7gswC7Zb#Q%J@ zTcW7Jc}U64PG73D^!j{l4SR|%oHut4?kDwwc&~PhiwGNSjg^+eJw>Bm5A7|v0cc&n zoMLY&8z|cUn&)7->n9w3&9k?h%|t7F`$o9_AAe}^UwJ$3p@;Pg5|#fe?~fqS;Mc?Q zmJ-FHzlyTv Oq)D~2k9`&OCI1f@cR_Uk delta 15728 zcma*u1z1#D+c)rgP4`%cVvQKsj)937n5d|zs8}G30#X8^Sfkj8i8}Vd02FLg#11g9 z+hcck>oLCn%4GU0_$Ddn2JQTm`$s zldvbz{VPP0A0%c65lIb1E_H~k(wEp+NF=*MApHA$}8n7?&T)++vhXaT<>dETZIC7SE{P^ZjxY`pQK*FyyJ0Ouw zh-UXZVh`PiQAF>?5-FaLSh=4_*^I<$DO^n=Z8tnXBK$cD6gOu7WB2(v_C;$eZ@k{i zen&~*1VPK#;x@M2RW>%N2aM2XqY?>vOR)H z_4fs4J>}2qkW2fCn>MqXXR*6}XXwCW{(LZ=J+g&8x∨HE08NJK8e{yLV&zcV=T1 ztksIf)Sx%f{CuMJsHZFM9SS*$)H@H25mjNgD=ug^_8NN*chq@0(L-dk`y3KkJ&1as zP9G-0qeM-&q0Jp3+VG4$g7fX4f8ZDtt}za+q9^XyzGDDduHA%Y>>d=k{qrG|K=1KH zN6)bLGaQNv?O8w6IgX3zQ`o)95Q)FK=uqrH8|pI&8M^`J5IvdcP$Z!W{r92%AE7n+ ze}wah`fi7JiTdLLkCj9N52F3K+sohDEi7Ko1m?ZmgBbqF>V-nka z0!gg)1N{?uM{G0J`kkcysN1=X*+V*#8Ij-tACgU7idb}=9r2cADJZd*%N>d>{v=z7 zyE^-bWa$Y+bsTZ?wJ_XSyHJ5WqFLP)k7Mb{Ds>~{T=jT^-N#!ba4beX-l2aM{V0@4~jO!1|tI z`#xYtN3xTrv73JHx9*<7I}Yq&k31pSr!_?7F0tM3v#W2C+zAbH&{dMV$03$SL9~S? z-Pz%-NZ#HZgO!$j8ODC8;829lC3&Y0M1>lV+z(YQ%X4U@_3IrQLfL}kgZB}6tYEt- z*?1pz9}>cGv9~12L(s^6ZgnUs6k~mOzwn#Ep9eN%N3~=RFD3az6N&Y!NWLha$n&0E z^#69qX;uJHBKcn)5qiXgzP<;VaJ6nmUMmef>t~H4XEvTBk7t~0l>TOYn zPY+XddtKIwW~~KO-CmXLXR#kvQ7sv&Z0#a4Uv5k^_A}Klj=?UaHr2o0mc-^9w?BKxgFKplC7Sw-UDc92LZu{<^z4c`)aG&mN<>NR7Um%XY1HmEGVGp8 z?HjyD#(uJILL7=QT_CQ9XxqNQ529xc;V%+ntdppHLnVnhlc|FjT7SDr)FHeWifR~n zS6Yl1oYlU+ z{eA`YuqT+eHASxVw01sBJtpF#?zBy(dCc~+u>+s8K?Zh6O*VWf8*ze7 zIKt-Vvu8T8_u4wN(t}9e@o+Qy_#XS@4f!Rd5j8WiEhE@&?ri)R_EG@#n$rW}K*zr8 zLcQj8AUYLGy_0ZbM}AVDLx*uZoBW4=0q`ur3aqbSUB! zsErL+u$qQu5xhp>sCwGr&z|scC}yNlgnA8$ zLN=BVXFSwCrRNxOT=wgj{Lx*lX*`mzurTRBSm>ok$mSK2;*7KuTZ z*yzf%XZ0$g)=6|6VMgRc(z#|i$Y2y*>xepE6GJ!qx53nMD&4;9LUeTid!roP>s${B zC)1A)1Bhm{q@R73kw8rR6{f+o^psHa!{kha6fD=|#e1eZw2Rk?ij3B4Fo364{X=xNbh~w5qVQ!BlWV2{B~d5~8;^ zMA%?7Qo}G276LDxW?$72qk8@%YVk;nwj$1zQ?Z@)i_r(}lc*md#;iqxhTS5u;bfvu z%SDz3H)I{rO>ArOlxW|0u`~E6#;8z-V!&(mu&>w|iz2+bP81}rCb8qHIIVXgF?OW5 z7FrSW-o9+iD)IW+R$RCU`(>;6Sb#{sVx;)~66YmW7C%zDW9r#fB1y<2p*Sp&b^b_J zu{BHLGIu_S!)GKeAH7LLOqaN3Oe8U@rlgAgA<@UH?C1NEdN0tOwpNzZ`;iWlVK(%W zGz>rj`4c6LZz52hKP+ilCX~eB^K48XNwdt0L|#@&+e5hC#7mM6ryF6)nj-N@%*6De z$6ZO6VK|WZO5%IFBJS*>q({CDgWDrXj|aW*C=e~_Ip{H_`<>W6mDv3@Nx&_1yPlOK zLC>U^E_9X*32i~N)Lk;<>l>m)L6Wc_SB&cAC6NW$B=YJ?#=i|By4F%MDFWvwtddN1 zv!-AcT~9J~@CTyz`I700$BD*_l`MR42{{drtoXSRW6n28nrA)+!CsOK`&d=2lqAzW zq*RMw-_(_4+T%y{a*_=#@%_w1$@bxAi9QEQcGx3m&CinkyE8C5xGl-Qg9$nViKVvmz_RT`X@#YSX2p`|zeReu z^kjVgAw9NnBZ-tv(t@r_NEFLqm(P9-Xqd%WB$mI6cyK|sSf8rJDw3V#%I~h@wOjh|`BGKe7vIf2>B$|zqH4d$XP<>R^ zyww6ClT6mK@k9ik8?v^caHd4obAubklufchQ#)bMY9NbPQx?ld&NF4vgPV{j`HZdZ z%r-i}wu)mD*T{wyAU#}6Yn=oqbO_I$_Ohudc zESvcnZK~pTw)Z7=e_Pq?L1>Ii+Q}Am*n|FGXsdk#gU>OxO#y2W?A~1V<}mhFjzgiY z#%dR``aCwmnVma;T^GydmS^)@%NBP=iF95jTO4UcQK@cYV*!ca0(RI**|O2~G4*RF zTef5r(V+{nKk&p(nYps`2L9+~^JM9*Q3dApvbCiS5e@$)%bN9`sP07g34VlVl=Z5^ zpD+;qf;L&!Y=WmC+CY7&EXz7ufsMx4p@LCRP1NcoL}T(QEn8m$-Ko$U*1b8~B8Tm| zj*T43#%bB}GTHiN2F&uW$hK+GOPWlU?da=+6`mckT|?1mm$j4aS-cv9S%A#CzmFG* z6(?oKZva?N40&P8H z=f{O%nc$}E%00A!s2JHTXCsm1r0hY|M)iB+67}+uoG@D7p_J`MB(tC%WUh1M))qzLKb2U0&RXP~6a){kV+%TwY$hTLOvR zwdEDo-@|jtV0ncbcDKphW_-i2Enx?SvV*Lta<^o3zwOoJ)o-*W%FxNHKS13a94|Mw z$R;}M=}=4!kk@OA$BD)kd4mi*67FatZ~PXmdwCOi(W#uD^qp>~=l#j7h z!uMA?6x-j($Kp9hOr0yA*0Dd9m%Z3cPvp~Y=VNtmpFG+A=oxfLo}6M|KA2QfK1aJ6 zu{ugVXXjzW<`42YyQ&d=F9t)gVlx2V#}sV0L$STLe9^i{tm;YROXkF(tvq1chp^MT zu*-Dv^y;aIgg52s$I#6;r^?sPM4M^1K)yDwJeCox^33U0^zZv|*nm&`<(pUcLX00J z-<%VNLF9vc=iwDtkr^*P&>GY5bw%U{LJnZ{_K`f_zH-yTnT_8hKl>CVl3!1LGi)55 z{#(oMbR2@?UF45H%kdPlO#Zewx}nQ{`DedTn8@5@`|OZ^x7NdnuVwP@Q0%NH|Jf0- z-khTl4bVTo_$nmz(fZ}X+08{1>Xr|P&TLVrSHiP8g>fPVCr!Sh=ziRQbgRPopg?H8 zrYLza4HK4Yic*=iaNWy_vSV?*rdow*s0$Wo8z?IJZ6q>YS6Cezw_Ye}21X*{jaAe# zOGzvZQ`BC!nP}54h1u2q1&P9ZFPB8*V@0F4n0!|EV;d9ODw|Ebr)W~PB_6>ZDVn`Q z6%FgA@SKM3XX>qJ(GOKHH<3LQq3}9*4HK8ll>ROatewj9$8I5P_swjNSk|vB+ovVl z_bof%9UFL;9ejWd4`d@2unEcR87KD6A@+g0Lp%eg@{Y$f*(ZAy?G$+UFS(wrcAafB zk!{t8O$=q{ZBn#r5rue{pztkeK!v?l^c;t%veK&X+mwXGh*}E&F^CSWYb*Q@7R9>m zN`?PxCp>o@x0|xKl#8|H6W-OaH0!gL?Q(?es$zRBV*S0@{zcfZZtT!{?6^DZ>( zW3zs-n@h5Le}D172mXB6i9KpkjEy;mMq5lV<;0&v6@wI0zG{ek9x7(6NB3*{UNPfX zRT3SHie!7JPZElmg}$LNUxrp}c-2$P*{C7ml+30_Dwd`r4$NK09!gcLsDsG0-pc++ zawuHg*`Dj!0maw^V)w+chhi10L${HbVOFHAMI71QU6GDCC25N)(yjK5&Yp^lya8Bv z5Q;42WIWMaRjfZ&8vS&NVq<1cM6e%%~Qe1m-6svfv6*t%HB4JyixScbR#I|gO^=?r- z^=9NN?%BWahnM1hZwx{w_9&iuuOKRQ-=WwtN%8Wo7YS1e+wB0m>y+Z1WE6>M5~Z^J zD6E9^aVYXmD%I2Qq%-Ncvb1S9UQhg?bhW=H3;4kXH+3k2ysW$tJx5t7GmnH)p>*4c z;r7NSW!0Zy7>08kiqcVRt(R=us>4_y#c@ z~DksLpWj+iqEet=uyM`*o+4b0tk8sKN>q3rPBJQ|ai(z`b%6ybjC@I6YuO$%`R zHhXfBvX^s3Os~5t`>ij8^~hXhpjTC7sHQR`2))L)j50j)8%o6HP>dR`jLyzPmCR92 z?tvTo8m^pD1B0KnaAV#mRlwGgvrW6PZECVp4zi1OD;>jYXjf(O85`bBNtFvEtMG2S zigIDQ`*#D|4^=y_rbI0U1i3+!&nEH6|2lx zaG0n{PvzSBsDiW!%5|kG;6h2ttmOM>1I<{kUu@u7cKJ2-qZj*mgF_LVqFiskPWlVw z`UkkfN$->!3mrhhSC#frmU2fbx3;fKw4k_?}tFJYb=SHE*>U3nAX`mH5+Nbi4r1r`Sv%K)4qlxnBx&k!5j}ArYO>EmC${WcS z@XF9vdHXs>xlYfO4^)WulRGJ&3~(n3?5TV`r3oJC4zV47DnAZNA+e;P@{@hiTBEn} zR~wXQ#vN5LCpmgUkgAx~z7aHD<&ufk_$*pgE&v%gn5C+Gs1zQd;@Do#*?oIdZu9K> zce1_bvipUqUeEEW$rhd3D@KlpUq& zJkNl}dQoNVS{EU)!gN(HGwyg_zG_&S6#dy#72}Ku82^;La!?iPTZqW!u1f5HiA9C6 ztltNA?;%xUuZwu&6RJuc-iUF(iYHt*qM6q8dW%7`A9C>w1Ol{9d);^el`8 zR$o=_C&kybhS9+VePr$hnE?s9Qd!WS>+gW~X3qsiQiX9*kwQiK^4l z)A8=Bn(FkAN?2~oQJwGRiG@n5>Us@??ga^|JNwZ1dbU>G%R~c^Lm^ zTvzw6k0QMD7yEdydcbtFX614=|AjhuSW6OJOT$*MpE}ZUp~dRx*NEkLkJZB-A!Hx3 zspICgz>jgV)x+0*Ceg{N9)mzccN5f!8&Ng$CF-OcZ#@03RVT;cMw|Cl&*^VP4!0gs z&+QDiEK$!rihz{dT0PInUgTTUsb!GkY!7wn!k;7-9#F4Tc@dSKq)vPB4Zqx&s!nf% zs&js)&c=fbt*)!y_NW%(!UFZ4Ok`xqVl@Y_n{4;K?8vq3o>J<4)>i2EiIdd(&P+hg zT-Ar{Gnqe|s1F^VkNN&6bzZm0Sd7}F&I>~oJnf)9_Qz%{v2;=&KZ6W!9h95AK#70l`$wU4KFs0R}YT~@~)#`K6&q!D%sNZdzgyH>@Mlu>9c}<|kD)|F- zm{L)rbjAGLSb;6xnZ4zwQH6HL<8!*ElsksoeI+%eIwGNoUo>S}BW{=@H0Amt;7sbE zaUFRJuUr~C6dhJ;sw_gu^g7M@kJr?_iW})(lD+**Q-4YtiEMYPra>xJr)Gp|8W%xb zM(@?M`dSaaT`8jJ^fZ#FWF1X6?~1r^l0)H5nqF7lU}f{3reBBdB#QiGmu}MZi^83k zjbl4*)%3q-#>(meO|VBXOl(SMf}<@MTf*7cScgJx&CpoXsOvRSjV0Ye!l+~CJ=cVg z53!)<|QU zg(|a6(=6(+3^z1^9k-UX?)trB|0Le=G?9Hik9{FwUnj8NyE_!ro0Y9(i~F(VqFA@9 ztb07`>CASn$aY=k&?@?d@s57C*?|w(prvf|@6YiA`SXY(?5Gdy==-d-Dm#nsOsxIL zpEpIan|rdme&4`>7WU8R{|D>wfg|DU(Se$^iStMlUcr{G#nu|aHr>XydB#q4Wfym4 zx4qS5dtxd#p}uD4X%|djhOvDNY~OusxEr+MgouH>?`CgiX zKwNlmL37N8ZmBP!IcBwQ46MdG(yy>D-e`{HV85c5reJ(5mSn22e+|=|?Ya|+b|L4upcYyM1-;@$Qo&GqWuByyf>UX??)U4K<$eN_%Q z-cVWdw(Ul|*+|oTdV$YbM$L~zjBcYZYkp}kI?fB$%0ta0+RWCf6WZXxqli|$C=VBm z(5jc9dsgqmT1#lvnMs)SUUDb~u3<-IYc=nJ@Ux*aTH}gJSSP%vEwb|(M$=mjT!kKui?6CW1c@H+Vf5uzX=)4*{mI5%Eb>fCTd62#IU<+ zk2aykHN=l!thLJ}-tfPw9W@C>pW~*T8jnbLw2pR~Y7`!~-)NKUgG!0M+F9ca2tbRp zvwmV;P&Ze*yzEpGTXMCjUss^SqS#^Iw5xAmwp;0?HdBMA-WpBW#uM0yf!Zwl^-mPl zZg$SZdw_eNw1?-T&ZHl-XCL>&!)Su`(((%!9v5maV^S+3ytVgpQ6#?O z?Rw&Ay17oCm6r0hhKqGvFm8Mbfwb~-G`;>%1*6-d2V^O*CKXbh|aX}7Jiy= zR%g0C4zHyObmfBrh-|xcRgYK2BrZ!={Xk>9c0Q`B8GxibN3oYX>*~6o*)?dcYbrsd zB~R70n^!<0bG5F+xjQHW*8rXOtNZ8&ak`E>Q0TKO>$+aYh<-j;=X*T{q38~~c($(p zBNyCT37sW%G8XPHvgc0f#;&bT6q&{j`=}f5k&oBU-n!{y(C*9E(9M63(O{jAZh`R! z-XwVF7CLoDt03?9#(PE;`)~y}pEUk35K1DHyd8=C@P})9Gx>eD`(c#wWR?SDD z&RM2g7ljUY@w+Z7@e<}V&vcsx$v0sntHd&`&iJ_cs^Q&iAAq>}LCubr9>sbGy zY{WNRZaxP7;mvjX%36D1{5z;S*avs)*;to%Bo!}9GjwO(pjEt&*PUI8BH!OxcYaw> zyw7^AyClVh6-9J64@pUE->UAA``bOV-zYwAweSzULhc7qcz9vJ)oiK82YO3+L-TT}O!O5U=|Zhzo?D*8K`k z!D{gdy=?0oyz4lsmtV!iJlRRF-iMNV@1ZaJG9NeANMFq0i+3qQ*dhJco9EcuF?y^0 z1fi?x*ddDRS+}{Ydo8xvS$5ogc6MpK^UIG|CH_laauPadpE$N(MZL>PwC{Ce^fme) z#}mR!ea#9D@dADUdv=JvVImr5vli^7e5<}uugBOijlHbaw>;C2M2Q(}i!6QH<#||$ zOV)S3vK`A(XZ3xbG{H2ql)hhFFxJf@^-=a;dHj)}k9zb9Rd-oGtP_r_O6n(!L#zw_ zuAh#DI@;BhJ(aCbI)#j_mg;Av`XIPlo%FNos}aQu^tQ?fK}7@D+V|O}AJ}&D*=bYs z%bf<}mBSnT>QxvY%ROeh71M7xQj$dR0@ib?e(O%eywMhYPB2CdLkv4FRG%A+Dm}Ye zzbAJD-i7us==1(Som%qsdB;33&}tnD?MXKC8oRBI{_^7K2tl*;*CwO&W?#@>cSoDJ z`k1{@puaKj9tr(0w!}TQ>T0%Od$uL9jwl`Syd2cAOdoYPYy;+wRY|WZ%lX$juPj>R} zLYN2eSLTt+;?1V4u+|P#Q6YalS@%AyaKOTpl zO-CBKCAKCJx69D|{RI+RI~aQJ+m1&Ht0BlfthfajB8>~spHH$!${A*dBVd)zGo%zm zVzRZ?u<-DBR8c9z@^J{!ds-MWo}inqjx%g}auUy29}U}{pT_vvz>vG~7oN4w8xC3R zKW!}kz;HVLAR=6O!v%C_${J(%GamhS;Bv$5N_rCFq2W;)eqK^xAKS~F-6u1APQ`4m zRcUtAT*Eh4G`dMs3_toHa1~!~l)iJu^YSyJG8dsZL1)wlpxdT*GU_*9!kfhDMys*e zCcLpD=s|S9x>?3} zMLmpWYU7A;_}={*?2}?fYuBmxF-M*;`7nxn$wT8j*D+WV+09no!unY2IW~mKlMU?1 zhJ9w^tnApP#zo19{So=bjYec_$QR?*w8@x+jb;}(8@HG2g?~J-pY0pPhTUa{o--b; zhqkeBw(;1SVfYb7hVj;Ov<eL+&KHW`;%HVi}`5HL(R|4-|=_e>>s|V=04^bDzqNL+jTOu3=TH= z4iC4OT3N!QMx?Y1b4h8NRXqDyuwG&d6QXiT@o=Y<&x5TM3XvDZQ4EFSUk|k=3x)r4 z4V711OnCLymhhC7A(gTdhg=XQ11IRKG$(bxY)<-@Q-{adlS?Ta?vmXz^pecBLMkdc z(&!TzTD8#M`LyRb;V<7y|9sKVIV#@58EqXkA~NNmrDXMD|D3Jiv;XbRbpP{>p3(O6 z8cwwm`+5OjM>$00~|57-6#?gF{{rY%uk+Qd-auH{bL7tsLBSPa$ zgNDb%#+gi}lshM!TT~3_R~lRY1}#Nfc7(D2Z>1mvPvxnKD6Ux|c9##v(G z1CfqBrzued%6k8i&HwBA;lH!^pLZFQwy0*(ivO>>jE=Dk4juXXF3Z(M5&iS!|1ITW zzwhk#*BqJtyW~3ujx@!_1es#v0^=;Pe;+d1zv4J#-_7^gy2|guJY_y?K8AvPZ{CEu zv3JBP$o2o0u)S7%EOFtXkwZ;GVxopeI|?jYeqxsB-U3$(r%==)*K>Dsdek1|=}{YdOb8~V?AB#a z7#hEj;)C~pB&i!x&DV^dGgqPE6p2V+p+E|v5d41-60uNKv)(*!jxf*o@8th!6Ry7# z?{0|JrQqoTNNVN;x#-9$WS zV7oI!^tTO-5hZP#{Y5`p?r2fMb}~eih3T9vR3wF*~ThiRf@PGpiWYt@y_y0NW% zrkLm1=KdkvTuOR{hXxHbxwQ?A42=zOGmQwbM4E!5A}zIS6BdXvwxmCVch2MmB2>7^ zs3|r5`{qTV_LdlnDIsdODJU?~6o}y~D#m094vn*&T_B2CYnj}90wXMLrl6>p7)xw) zRAg|hDK5$s7h*9*;(#e?uwy$qBq2652tmmaoe;zA1q#F^bpmbf4!(J63{CEU#v8fzLJi-7{yj|hwzifdUA>g*S@??TkE4bTjvYjNAbw`d(My+w7~$9JNvZS#1vhIX&9 z)&HAl!TXvgidMY!%NwmG={=6#NfS+Ny+87n%GM%X)Z>qH(uK)!^1=)uv+bLV25G-A zJ~{C^wf=`_%UhvSMFZaY)kA1(N2a2gIZnn$ zH{MF0hV&ijOcR=g(}g={W@ax@%jWk9$ - Copyright 2002-2009 NetCitadel, LLC + Copyright 2002-2010 NetCitadel, LLC + Copyright 2002-2009 NetCitadel, LLC Copyright 2002-2006 NetCitadel, LLC {2002-2009 ?} @@ -59,12 +60,12 @@ and special characters. - + Emulation of terminating behavior for MARK and CLASSIFY targets is currently ON, rule will be terminating - + Emulation of terminating behavior for MARK and CLASSIFY targets is currently OFF, rule will not be terminating @@ -293,14 +294,14 @@ object properties dialog. AddressRangeDialog - - + + Illegal IP address '%1' 不当な IP アドレス '%1' - - + + &Continue 続ける(&C) @@ -479,12 +480,12 @@ object properties dialog. - + FWBuilder API error: %1 FWBuilder API エラー: %1 - + &Continue 続ける(&C) @@ -686,17 +687,17 @@ p, li { white-space: pre-wrap; } CompareObjectsDialog - + Next 次へ - + The following two objects have the same internal ID but different attributes: - + Skip the rest but build report @@ -917,82 +918,82 @@ Preferences dialog, tab "Objects" DiscoveryDruid - + Hosts file parsing ... hosts ファイルを解析しています ... - + DNS zone transfer ... DNS ゾーン転送 ... - + Network discovery using SNMP ... SNMP を用いたネットワーク検出 ... - + Import configuration from file ... ファイルから構成のインポート ... - - - + + + Discovery error 検出エラー - + Could not open file %1 ファイル %1 を開くことが出来ません - - + + Adding objects ... オブジェクトを追加しています ... - - - - - + + + + + Cancel 取り消し - + Prepare objects ... オブジェクトの準備 ... - - + + Copying results ... 結果をコピーしています ... - + Incomlete network specification. ネットワークの指定が完了していません。 - + Empty community string コミュニティ文字列が空です - + Some discovered interfaces have been rearranged in fwbuilder objects and recreated as subinterfaces to reflect VLANs, bonding and bridging configurations. The algorithm used to guess correct relationship between interfaces and subinterfaces is imperfect because of the limited information provided by SNMP daemon. Pelase review created objects to make sure generated configuration is accurate. The program expects MAC addresses of bonding, bridge and vlan interfaces to be the same. It is especially important to review and fix generated objects if you use MAC address spoofing. - + &Continue 続ける(&C) @@ -1000,203 +1001,208 @@ The program expects MAC addresses of bonding, bridge and vlan interfaces to be t DiscoveryDruid_q - + TextLabel テキストラベル - + Choose discovery method used to collect information about network objects from the list below and click 'Next' to continue. - + Discovery method: 検出方法: - + Read file in hosts format hosts 形式のファイルを読み込む - + Import DNS zone DNS ゾーンをインポートをする - + Perform network discovery using SNMP SNMP を用いてネットワークの検出を実行する - + Import configuration of a firewall or a router ファイアウォールもしくはルーターの設定のインポート - + Enter full path and file name below or click "Browse" to find it: 下にフルパスとファイル名を入力し、「参照」ボタンをクリックして検索してください: - + File in hosts format hosts 形式のファイル - + Browse ... 参照 ... - + All objects created during import will be placed in the library currently opened in the tree. - + Policy import tries to parse given configuration file and preserve its logic as close as possible. However, very often target firewall configuration allows for more commands, options and their combinations than importer can understand. Rules that importer could not parse exactly are colored red in the rule sets it creates. Always inspect firewall policy created by the importer and compare it with the original. Manual changes and corrections may be required. Comments in the rules that could not be parsed show fragments of the original configuration parser did not understand. - + Import from file: ファイルからインポート: - + Browse... 参照... - + Cisco IOS Cisco IOS - + iptables iptables - + Platform: プラットフォーム: - + textLabel1 テキストラベル 1 - + + Firewall name: + + + + This discovery method creates objects for all 'A' records found in DNS domain. You will later have a chance to accept only those objects you wish and ignore others. Please enter the domain name below: - + Domain name ドメイン名 - + Objects created using this method may have long or short names. long name consists of the host name and full domain name (this is called <i>Fully Qualified Domain Name</i>). Short name consists of only host name. Check in the box below if you wish to use long name, then click next to continue: - + Use long names 長い名前を使う - + DNS zone information has to be transferred from the name server authoritative for the domain. Pick the name server: - + Name server ネームサーバー - + choose name server from the list below 下の一覧からネームサーバーを選択する - + server name or its IP address here if you wish to use different one: - + DNS Query options DNS 問い合わせオプション - + Timeout (sec) タイムアウト (秒) - + Retries 再実行 - + This discovery method scans networks looking for hosts or gateways responding to SNMP queries. It pulls host's ARP table and uses all the entries found in it to create objects. Scan starts from the host called "seed". Enter "seed" host name or address below: - + 'Seed' host - + Enter a valid host name or address. 正しいホスト名かアドレスを入力してください。 - + The scanner process can be confined to a certain network, so it won't discover hosts on adjacent networks. If you leave these fields blank, scanner will visit all networks it can find: - + Confine scan to this network: - + Netmask: ネットマスク: - + Address: アドレス: - + The scanner process can repeat its algorithm recursively using each new host it finds as a new "seed". This allows it to find as many objects on your network as possible. On the other hand, it takes more time and may find some objects you do not really need. You can turn recursive scanning on below: - + Run network scan recursively ネットワークの再起スキャンを実行する - + The scanner process can find nodes beyond the boundaries of your network by following point-to-point links connecting it to the Internet or other parts of WAN. - + Follow point-to-point links @@ -1205,212 +1211,212 @@ Please enter the domain name below: バーチャルアドレスを含む - + Analysis of ARP table yields IP addresses for hosts on your network. In order to determine their names, scanner can run reverse name lookup queries using your name servers (DNS): - + Run reverse name lookup DNS queries to determine host names - + Enter parameters for SNMP and DNS reverse lookup queries below. (If unsure, just leave default values): - + SNMP query parameters: SNMP 問い合わせパラメーター: - + SNMP 'read' community string: SNMP 'read' コミュニティ文字列: - - + + number of retries: 再実行の回数: - + timeout (sec): タイムアウト (秒): - + public - + DNS parameters: DNS パラメーター: - + timeout (sec) : タイムアウト (秒) : - + Number of threads: スレッドの数: - + Process name 処理名 - + Stop 停止 - + Save scan log to file スキャンログをファイルに保存する - + Process log: 処理ログ: - + These are the networks found by the scanner process. Choose the ones you wish to use from the list below, then click 'Next': - - - - - + + + + + Select All すべて選択する - - - + + + Filter ... フィルター ... - - - - - + + + + + Unselect All すべて選択を解除する - - - + + + Remove Filter フィルターを削除する - - + + -> → - - + + <- ← - + Choose objects you wish to use, then click 'Next': - + Change type of selected objects: 選択されたオブジェクトの種類の変更: - + Address アドレス - + Host ホスト - + Firewall ファイアウォール - + Object オブジェクト - + Interfaces インターフェース - + Type 種類 - + Here you can change type of the objects to be created for each address discovered by the scanner. By default, an "Address" object is created for the host with just one interface with single IP address and "Host" object is created for the host with multiple interfaces, however you can change their types on this page. - + Select target library ターゲットライブラリーを選択する - + Adding new objects to library ... ライブラリーに新しいオブジェクトを追加しています ... - + < &Back < 戻る(&B) - + &Next > 次へ(&N) > - + &Finish 終了(&F) - + &Cancel 取り消し(&C) - + The scanner process normally ignores interfaces that have no IP addresses; checking this option makes it create such interfaces as "Unnumbered" - + Include interfaces with no ip addresses @@ -1426,21 +1432,6 @@ Please enter the domain name below: Using Firewall Builder API %1 使用中のファイアウォールビルダー API %1 - - - Evaluation (found invalid license file) - - - - - Registered - - - - - Evaluation - - Build: %1 @@ -1450,126 +1441,146 @@ Please enter the domain name below: FWBMainWindow_q - + Firewall Builder ファイアウォールビルダー - + &Edit 編集(&E) - + Object オブジェクト - + Tools ツール - + &Help ヘルプ(&H) - - + + Tutorial + + + + + Rules ルール - + &File ファイル(&F) - + Window ウィンドウ - + &New Object File 新規オブジェクトファイル(&N) - - + + New Object File 新規オブジェクトファイル - + &Open... 開く(&O)... - - - + + + Open 開く - + Ctrl+O Ctrl+O - + &Save 保存(&S) - - - + + + Save 保存 - + Ctrl+S Ctrl+S - + Save &As... 名前を付けて保存(&A)... - + Save As 名前を付けて保存 - + &Print... 印刷(&P)... - + Print 印刷 - + Ctrl+P Ctrl+P - + E&xit 終了(&X) - + Exit 終了 + + + Summary of features + + + + + Getting started + + + + + Inspect + 監査 + &Undo 取り消し(&U) @@ -1595,105 +1606,105 @@ Please enter the domain name below: Ctrl+Y - + &Cut 切り取り(&C) - + Cut 切り取り - + Ctrl+X Ctrl+X - + C&opy コピー(&O) - + Copy コピー - + Ctrl+C Ctrl+C - + &Paste 貼り付け(&P) - + Paste 貼り付け - + Ctrl+V Ctrl+V - - + + Ctrl+F Ctrl+F - + &Contents... 内容(&C)... - + Contents 内容 - + &Index... インデックス(&I)... - + Index インデックス - + &About ファイアウォールビルダーについて(&A) - + About ファイアウォールビルダーについて - - + + New 新規 - + &Close 閉じる(&C) - + Close 閉じる - - + + Compile コンパイル @@ -1702,8 +1713,8 @@ Please enter the domain name below: コンパイルルール - - + + Install インストール @@ -1712,287 +1723,260 @@ Please enter the domain name below: ファイアウォールポリシーのインストール - - + + Back 戻る - - + + Move back to the previous object 前のオブジェクトに戻る - + &New Object 新規オブジェクト(&N) - + New Object 新規オブジェクト - + Create New Object 新規オブジェクト作成 - + Ctrl+N Ctrl+N - + &Find Object オブジェクト検索(&F) - + Find Object オブジェクト検索 - - + + Find object in the tree ツリー中のオブジェクトを検索する - + P&references... 設定(&E)... - + Preferences... 設定... - + Edit Preferences 設定の編集 - - Insert Rule - ルール挿入 + ルール挿入 - - Move Rule Up - ルールを上に移動する + ルールを上に移動する - - Move Rule Down - ルールを下に移動 + ルールを下に移動 - - Add Rule Below - 下にルールを追加する + 下にルールを追加する - - Remove Rule - ルール削除 + ルール削除 - Ctrl+Del - Ctrl+Del + Ctrl+Del - - Copy Rule - ルールのコピー + ルールのコピー - - Cut Rule - ルール切り取り + ルール切り取り - - Paste Rule Above - 上にルールを貼り付け + 上にルールを貼り付け - - Paste Rule Below - 下にルールを貼り付け + 下にルールを貼り付け - + Add File to &RCS RCS にファイルを追加する(&R) - + Add File to RCS RCS にファイルを追加する - - + + Delete 削除 - + &Export Library ライブラリーのエクスポート(&E) - + Export Library To a File ファイルへライブラリーをエクスポートする - + Import &Library ライブラリーをインポートする(&L) - + Import Library From a File ファイルからライブラリーをインポート - + &Debug デバッグ(&D) - + Debug デバッグ - - + + Propert&ies プロパティ(&I) - + Show File Properties ファイルのプロパティの表示 - + Ctrl+I Ctrl+I - - Move Selected Rules - 選択したルールを移動する + 選択したルールを移動する - + &Discard 破棄する(&D) - + Discard 破棄する - + Discard Changes and Overwrite With Clean Copy Of The Head Revision From RCS - + Co&mmit コミットする(&M) - + Commit コミットする - + Commit Opened File to RCS and Continue Editing 開いているファイルを RCS にコミットして編集を続ける - - + + Lock ロックする - - + + Unlock ロック解除する - - - Discovery Druid - - - - - + + new item 新規項目 - - + + Find Conflicting Objects in Two Files ふたつのファイルから衝突したオブジェクトを検索する - + Import Po&licy ポリシーのインポート(&L) - + Import Policy ポリシーをインポートする - + Open Recent - + Firewall Builder Help - + Clear Menu - + Find 検索 - + Editor @@ -2001,52 +1985,63 @@ Please enter the domain name below: 適用する - + Help ヘルプ - + View - + Release Notes - + Object Tree - + Output - - + + Undo Stack - - + + Compile rules of all firewall and cluster objects - - + + Install firewall policy of all firewall and cluster objects - + + + Object Discovery + + + + + Ctrl+T + + + + Editor Panel @@ -2054,27 +2049,27 @@ Please enter the domain name below: FWObjectDropArea - + Drop object here. ここにオブジェクトをドロップします。 - + Show in the tree ツリーの中を表示する - + Edit 編集 - + Paste 貼り付け - + Delete 削除 @@ -2090,7 +2085,7 @@ Please enter the domain name below: FWWindow - + A new version of Firewall Builder is available at http://www.fwbuilder.org ファイアウォールビルダーの新しいバージョンを利用できます http://www.fwbuilder.org @@ -2111,52 +2106,62 @@ Please enter the domain name below: 空 - + + Print configuration of %1 + + + + Printing... - - + + Printing aborted 印刷を中断しました - + &Continue 続ける(&C) - + Printing completed 印刷を完了しました - + Printing cancelled Printing <ed - + Open File ファイルを開く - + Ctrl+Z Ctrl+Z - + Ctrl+Y Ctrl+Y - + Shift+Ctrl+Z + + + File '%1' does not exist or is not readable + + FilterDialog @@ -2302,24 +2307,24 @@ Please enter the domain name below: FindObjectWidget - + Search hit the end of the policy rules. 検索のヒットがオブジェクトツリーの最後です。 - - + + &Continue at top 続ける(&C) - - + + &Stop 停止(&S) - + Search hit the end of the object tree. 検索のヒットがオブジェクトツリーの最後です。 @@ -2328,33 +2333,33 @@ Please enter the domain name below: 自分自身でオブジェクトを置換できません。 - + Search and Replace objects are incompatible. オブジェクトの検索と置換は互換性がありません。 - + Replaced %1 objects. %1 個のオブジェクトを置換しました。 - + Policy of firewall ' ファイアウォールのポリシー - + Search object is missing. - + Replace object is missing. - + Cannot replace object with itself. @@ -2412,44 +2417,67 @@ Please enter the domain name below: + + FirewallCodeViewer_q + + + Firewall code viewer + + + + + Firewall / ruleset + ファイアウォール / ルールセット + + + + File: + + + + + Close + 閉じる + + FirewallDialog - - + + FWBuilder API error: %1 FWBuilder API エラー: %1 - - - - + + + + &Continue 続ける(&C) - + The name of the object '%1' has changed. The program can also rename IP address objects that belong to this object, using standard naming scheme 'host_name:interface_name:ip'. This makes it easier to distinguish what host or a firewall given IP address object belongs to when it is used in the policy or NAT rule. The program also renames MAC address objects using scheme 'host_name:interface_name:mac'. Do you want to rename child IP and MAC address objects now? (If you click 'No', names of all address objects that belong to %2 will stay the same.) - + &Yes はい(&Y) - + &No いいえ(&N) - + Platform setting can not be empty - + Host OS setting can not be empty @@ -2457,74 +2485,74 @@ Please enter the domain name below: FirewallDialog_q - + Firewall ファイアウォール - + Name: 名前: - + Platform: プラットフォーム: - + Version: バージョン: - + Host OS: ホスト OS: - + Host OS Settings ... ホスト OS 設定 ... - + Comment: コメント: - + Firewall Settings ... ファイアウォール設定 ... - + Skip this firewall for batch compile and install operations - + Inactive firewall 新規ファイアウォール - + Modified: - - - + + + TextLabel テキストラベル - + Compiled: - + Installed: @@ -2532,17 +2560,17 @@ Please enter the domain name below: FirewallInstaller - + Generated script file %1 not found. 生成したスクリプトファイル %1 が見つかりません。 - + &Continue 続ける(&C) - + Copying %1 -> %2:%3 コピーしています %1 → %2:%3 @@ -2623,32 +2651,32 @@ Please enter the domain name below: GroupObjectDialog - + Open 開く - + Edit 編集 - + Copy コピー - + Cut 切り取り - + Paste 貼り付け - + Delete 削除 @@ -2699,17 +2727,17 @@ Please enter the domain name below: HelpView_q - - MainWindow - + + Help + ヘルプ - + Object Name オブジェクト名 - + Close 閉じる @@ -2921,28 +2949,28 @@ Please enter the domain name below: IPv4Dialog - + Illegal IP address '%1' 不当な IP アドレス 「%1」 - - + + &Continue 続ける(&C) - + Illegal netmask '%1' 不当なネットマスク 「%1」 - + DNS lookup failed for both names of the address object '%1' and the name of the host '%2'. - + DNS lookup failed for name of the address object '%1'. アドレスオブジェクト「%1」の名前のDNS 問い合わせに失敗しました。 @@ -2950,7 +2978,7 @@ Please enter the domain name below: IPv4Dialog_q - + IPv4 IPv4 @@ -2959,27 +2987,27 @@ Please enter the domain name below: アドレス - + Name: 名前: - + Address: アドレス: - + Netmask: ネットマスク: - + DNS Lookup... DNS 問い合わせ... - + Comment: コメント: @@ -2987,28 +3015,28 @@ Please enter the domain name below: IPv6Dialog - + Illegal IP address '%1' 不当な IP アドレス「%1」 - - + + &Continue 続ける(&C) - + Illegal netmask '%1' 不当なネットマスク 「%1」 - + DNS lookup failed for both names of the address object '%1' and the name of the host '%2'. - + DNS lookup failed for name of the address object '%1'. アドレスオブジェクト「%1」の名前のDNS 問い合わせに失敗しました。 @@ -3016,7 +3044,7 @@ Please enter the domain name below: IPv6Dialog_q - + IPv6 IPv6 @@ -3025,27 +3053,27 @@ Please enter the domain name below: IPv6 アドレス - + Name: 名前: - + Address: アドレス: - + Network (bit length) ネットワーク (ビット長) - + DNS Lookup... DNS 問い合わせ... - + Comment: コメント: @@ -3053,44 +3081,39 @@ Please enter the domain name below: InterfaceDialog - + Group: グループ: - + Network: ネットワーク: - - Interface name can not contain white space and '-' - - - - - - + + + &Continue 続ける(&C) - + The name of the interface '%1' has changed. The program can also rename IP address objects that belong to this interface, using standard naming scheme 'host_name:interface_name:ip'. This makes it easier to distinguish what host or a firewall given IP address object belongs to when it is used in the policy or NAT rule. The program also renames MAC address objects using scheme 'host_name:interface_name:mac'. Do you want to rename child IP and MAC address objects now? (If you click 'No', names of all address objects that belong to interface '%2' will stay the same.) - + &Yes はい(&Y) - + &No いいえ(&N) - + FWBuilder API error: %1 FWBuilder API エラー: %1 @@ -3213,34 +3236,39 @@ If network zone for this interface consists of only one subnet, you can simply c - - + + Remove 削除 - + Failover protocol %1 does not require IP address for interface %2 - + Failover protocol %1 requires an IP address for interface %2 - - Empty addrres or netmask field + + Empty address or netmask field - + + Add another address + + + + Invalid address '%1/%2' - - + + Invalid netmask '%1/%2' @@ -3255,62 +3283,67 @@ If network zone for this interface consists of only one subnet, you can simply c 名前: - + Label: ラベル: - + Comment: コメント: - MAC: - MAC: + MAC: - + Type: - + Regular interface レギュラーインターフェース - + Dynamic address ダイナミックアドレス - + Unnumbered interface アンナンバードインターフェース - + + MAC address: + + + + Protocol: - + Address アドレス - + Netmask ネットマスク - + Type 種類 - + + Add address @@ -3507,26 +3540,26 @@ If network zone for this interface consists of only one subnet, you can simply c NetworkDialog - + Illegal IP address '%1' 不当な IP アドレス「%1」 - - - - + + + + &Continue 続ける(&C) - - + + Illegal netmask '%1' 不当なネットマスク 「%1」 - + Network object should not have netmask '0.0.0.0' @@ -3534,18 +3567,18 @@ If network zone for this interface consists of only one subnet, you can simply c NetworkDialogIPv6 - + Illegal IPv6 address '%1' 不当な IPv6 アドレス「%1」 - - + + &Continue 続ける(&C) - + Illegal netmask '%1' 不当なネットマスク 「%1」 @@ -3609,35 +3642,35 @@ If network zone for this interface consists of only one subnet, you can simply c ObjConflictResolutionDialog - + Keep current object 現在のオブジェクトを保持する - + Replace with this object このオブジェクトと置換する - - + + Object '%1' has been deleted オブジェクト「%1」を削除しました - - + + Delete 削除 - + Object '%1' in the objects tree オブジェクトツリー中のオブジェクト「%1」 - - + + Object '%1' in file %2 ファイル %2 中の オブジェクト「%1」 @@ -3645,39 +3678,39 @@ If network zone for this interface consists of only one subnet, you can simply c ObjConflictResolutionDialog_q - + Conflict Resolution 衝突の解決 - + There is a conflict between an object in your tree and object in the file you are trying to open. Choose which version of this object you want to use: - + Current Object 現在のオブジェクト - + Keep current object 現在のオブジェクトを保持する - - + + Always choose this object if there is a conflict 衝突する場合、常にこのオブジェクトを選んでください - + New Object 新規オブジェクト - + Replace with this object このオブジェクトと置換する @@ -3715,7 +3748,7 @@ Do you want to save it ? オブジェクトマニピュレーター - + New &Library 新規ライブラリー(&L) @@ -3943,7 +3976,12 @@ Do you still want to delete library %1? インストール - + + Inspect + 監査 + + + Lock ロックする @@ -3962,28 +4000,28 @@ Do you still want to delete library %1? 変更に影響したファイアウォールを検索しています... - - + + Transfer - + Create and add to group - + Cluster host OS %1 does not support state synchronization - + State Sync Group - + Failover group @@ -4082,12 +4120,12 @@ p, li { white-space: pre-wrap; } ObjectTreeView - + Object オブジェクト - + Attributes @@ -4122,32 +4160,32 @@ p, li { white-space: pre-wrap; } PrefsDialog - + Find working directory 作業ディレクトリの検索 - + Find Secure Shell utility セキュアシェルユーティリティの検索 - + Find SCP utility SCP ユーティリティの検索 - + Your version of Firewall Builder is up to date. ファイアウォールビルダーのバージョンは最新です。 - + A new version of Firewall Builder is available at http://www.fwbuilder.org ファイアウォールビルダーの新しいバージョンを利用できます http://www.fwbuilder.org - + Error checking for software updates: %1 ソフトウェアの更新の確認中にエラー: @@ -4180,48 +4218,101 @@ p, li { white-space: pre-wrap; } ProjectPanel - + No firewalls defined ファイアウォールは未定義です - + Untitled 名称未設定 - + (read-only) (読み込み専用) + + + Cancel + 取り消し + + + + Compile and Inspect files + + + + + + and + + + + + Firewall objects %1 have been modified and need to be recompiled. + + + + + Firewall object "%1" has been modified and needs to be recompiled. + + + + + %1 firewall objects have been modified and need to be recompiled. + + + + + Can not read generated files for the firewall objects %1. You need to compile them to create the files. + + + + + Can not read generated files for the firewall objects %1. You need to compile it to create the files. + + + + + Can not read generated files for the %1 firewall objects. You need to compile then to create the files. + + + + + <b>Multiple firewalls</b> + + Building policy view... ポリシービューを構築しています... - + + &Save 保存(&S) - + &Discard 破棄する(&D) - - + + + &Cancel 取り消し(&C) - + FWB Files (*.fwb);;All Files (*) FWB ファイル (*.fwb);;すべてのファイル (*) - - + + Choose name and location for the new file 新規ファイルの名前とフォルダーを選択する @@ -4234,127 +4325,127 @@ p, li { white-space: pre-wrap; } ファイルにデータを保存しています... - + Choose name and location for the file ファイルの名前とフォルダーを選択する - + &Discard changes 変更を破棄する(&D) - + File %1 has been added to RCS. ファイル %1 を RCS に追加しました。 - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + &Continue 続ける(&C) - + Error adding file to RCS: %1 RCS へのファイルの追加エラー: %1 - + Choose a file to import インポートするファイルを選んでください - + This operation inspects two data files (either .fwb or .fwl) and finds conflicting objects. Conflicting objects have the same internal ID but different attributes. Two data files can not be merged, or one imported into another, if they contain such objects. This operation also helps identify changes made to objects in two copies of the same data file.<br><br>This operation does not find objects present in one file but not in the other, such objects present no problem for merge or import operations.<br><br>This operation works with two external files, neither of which needs to be opened in the program. Currently opened data file is not affected by this operation and objects in the tree do not change.<br><br>Do you want to proceed ? - + Choose the first file 1 つ目のファイルを選んでください - + Choose the second file 2 つ目のファイルを選んでください - - + + Error loading file %1: %2 ファイル %1 の読み込み中のエラー: %2 - + Total number of conflicting objects: %1. Do you want to generate report? 衝突オブジェクトの総数: %1 報告を生成しますか? - + Choose name and location for the report file 報告ファイルの場所と名前を選んでください - + TXT Files (*.txt);;All Files (*) テキストファイル (*.txt);;すべてのファイル (*) - + Can not open report file for writing. File '%1' 報告ファイルを書き込むために開けません。ファイル「%1」 - + Unexpected error comparing files %1 and %2: %3 %1 と %2 のファイル比較で予期せぬエラー: %3 - + Please select a library you want to export. エクスポートしたいライブラリーを選択してください。 - + The file %1 already exists. Do you want to overwrite it ? ファイル %1 は既に存在します。 上書きしますか? - + &Yes はい(&Y) - + &No いいえ(&N) - + A library that you are trying to export contains references to objects in the other libraries and can not be exported. The following objects need to be moved outside of it or @@ -4362,38 +4453,38 @@ objects that they refer to moved in it: - - + + (Long error message was truncated) (長いエラーメッセージを切り詰めました) - + The program encountered error trying to load file %1. The file has not been loaded. Error: %2 - - + + Loading system objects... システムオブジェクトを読み込んでいます... - + Error loading file: %1 ファイルの読み込み中のエラー: %1 - + Reading and parsing data file... データファイルの読み込みと解析をしています... - + Merging with system objects... システムオブジェクトと結合しています... @@ -4408,7 +4499,7 @@ Choose a different name for the new file. 新しいファイルのための違う名前を選んでください。 - + Load operation cancelled and data file revertedto original version. 読み込み操作を取り消し、データファイルをオリジナルバージョンに戻しました。 @@ -4419,71 +4510,71 @@ has been renamed '%2' データファイル「%1」の名前を「%2」に変える必要があります - + Exception: %1 例外: %1 - + Failed transformation : %1 変換に失敗しました : %1 - + XML element : %1 XML 要素 : %1 - - + + The program encountered error trying to load data file. The file has not been loaded. Error: %1 - + Building object tree... オブジェクトツリーを構築しています... - + Indexing... インデックスを作成しています... - + Checking file %1 in RCS RCS にファイル %1 をチェックインしています - + Error checking in file %1: %2 ファイル %1 の検査中のエラー:%2 - + Saving data to file %1 - + File is read-only ファイルは読み込み専用です - + Error saving file %1: %2 ファイル %1 の保存中のエラー: %2 - + Searching for firewalls affected by the change... 変更に影響したファイアウォールを検索しています... - + Firewall Builder uses file extension '.fwb' and needs to rename old data file '%1' to '%2', but file '%3' already exists. @@ -4491,13 +4582,13 @@ Choose a different name for the new file. - + Firewall Builder uses file extension '.fwb'. Your datafile '%1' has been renamed '%2' - + This operation discards all changes that have been saved into the file so far, closes it and replaces it with a clean copy of its head revision from RCS. All changes will be lost if you do this. @@ -4507,7 +4598,7 @@ All changes will be lost if you do this. ProjectPanel_q - + Form フォーム @@ -4520,175 +4611,324 @@ All changes will be lost if you do this. 閉じる - + Firewall / ruleset ファイアウォール / ルールセット - - - + + + Compile this firewall - - + + + + Insert rule + + + + + + + ... - - - + + + Compile and install this firewall + + + + + Inspect generated files + + QObject - - - - + + + + Support module for %1 is not available %1 のサポートモジュールは利用できません - + Firewall Builder can import Cisco IOS access lists from the router configuration saved using 'show run' or any other command that saves running config. The name of the created firewall object, all of its interfaces and their addresses will be configured automatically if this information can be found in the configuration file. - + Firewall Builder can import iptables rules from a file in iptables-save format. Firewall name and addresses of its interfaces need to be configured manually because iptables-save file does not have this information. - + Working directory %1 does not exist and could not be created. Ignoring this setting. 作業ディレクトリ %1 が存在しない上に作成できませんでした。 この設定は無効になります。 - - + + New Library 新規ライブラリー - + DNS record: DNS レコード: - + Address Table: アドレステーブル: - - + objects オブジェクト - - + + protocol: %1 プロトコル: %1 - - + + type: %1 種類: %1 - - + + code: %1 コード: %1 - + + + Type: + 種類: + + + + Members: + + + + + %1 objects + + + + + Label: %1 + + + + + Addresses: + + + + + Address: + アドレス: + + + <b>Library:</b> <b>ライブラリー:</b> - + <b>Object Id:</b> <b>オブジェクト ID:</b> - + <b>Object Type:</b> <b>オブジェクトの種類:</b> - + <b>Object Name:</b> <b<>オブジェクト名:</b> - + <b>DNS record:</b> <b>DNS レコード:</b> - - + + Run-time ランタイム - - + + Compile-time コンパイル時間 - + <b>Table file:</b> <b<>テーブルファイル:</b> - + %1 objects<br> %1 オブジェクト<br> + + + Stateless + + + + + Stateful + + + + + + Log prefix: + ログ接頭語: + + + + Log Level: + + + + + Netlink group: + + + + + connlimit value: + + + + + Part of Any + + + + + Log facility: + + + + + + Log level: + ログレベル: + + + + Send 'unreachable' + + + + + Keep information on fragmented packets + + + + + Max state: + + + + + Force 'keep-state' + + + + + Source tracking + + + + + Max src nodes: + + + + + Max src states: + + + + + Add mirrored rule + + + + + Version: + バージョン: + + + + Log interval: + + + + + Disable logging for this rule + + <b>Path:</b> <b>パス:</b> - + protocol プロトコル - - - + + type: 種類: - + code: コード: - + + Pattern: "%1" パターン: 「%1」 - + + User id: "%1" ユーザー ID: 「%1」 @@ -4697,177 +4937,105 @@ Ignoring this setting. <b>操作 :</b> - + <b>Parameter:</b> <b>パラメーター:</b> - <b>Log prefix :</b> - <b>ログ接頭語 :</b> + <b>ログ接頭語 :</b> - <b>Log Level :</b> - <b>ログレベル :</b> + <b>ログレベル :</b> - <b>Netlink group :</b> - <b>ネットリンクグループ :</b> + <b>ネットリンクグループ :</b> <b>Limit Value :</b> <b>制限値 :</b> - <b>Limit burst :</b> - <b>ライブラリー:</b> + <b>ライブラリー:</b> - - - <li><b>Stateless</b></li> - <li><b>ステートレス</b></li> + <li><b>ステートレス</b></li> - <b>Log facility:</b> - <b>ログファシリティ:</b> + <b>ログファシリティ:</b> - - <b>Limit value :</b> - - - - - <b>connlimit value :</b> - - - - - <b>Part of Any</b> - - - - - <b>Stateless</b> - - - - - <b>Log level :</b> - <b>ログレベル :</b> + <b>ログレベル :</b> - <li><b>Send 'unreachable'</b></li> - <li><b>「未到達(unreachable)」を送る</b></li> + <li><b>「未到達(unreachable)」を送る</b></li> - - <li><b>Keep information on fragmented packets</b></li> - - - - <b>Log prefix :</b> - <b>ログ接頭語 :</b> + <b>ログ接頭語 :</b> - <b>Max state :</b> - <b>ライブラリー:</b> + <b>ライブラリー:</b> - - <li><b>Force 'keep-state'</b></li> - - - - - <li><b>no-sync</b></li> - - - - - <li><b>pflow</b></li> - - - - - <li><b>sloppy-tracker</b></li> - - - - <li><b>Source tracking</b></li> - <li><b>送信元の追跡</b></li> + <li><b>送信元の追跡</b></li> - - <b>Max src nodes :</b> - - - - <b>Max src states:</b> - <b>ライブラリー:</b> + <b>ライブラリー:</b> - <u><b>Ver:%1</b></u><br> - <u><b>バージョン:%1</b></u><br> + <u><b>バージョン:%1</b></u><br> - - <b>Log interval :</b> - - - - <li><b>Disable logging for this rule</b></li> - <li><b>このルールのログ記録をの無効化</b></li> + <li><b>このルールのログ記録をの無効化</b></li> - + use SNAT instead of MASQ<br> - - + + random<br> - + persistent<br> - + bitmask<br> - + source-hash<br> - + round-robin<br> - + static-port<br> @@ -4892,19 +5060,19 @@ Ignoring this setting. 静的ポート - + Firewall ファイアウォール - + Host ホスト - + Address @@ -4916,15 +5084,15 @@ Ignoring this setting. アドレス範囲 - + - - + + Interface インターフェース - + Network ネットワーク @@ -4935,258 +5103,258 @@ Ignoring this setting. オブジェクトのグループ - + Library ライブラリー - + Cluster - + Network IPv6 - + Address IPv6 IPv6 アドレス - + DNS Name DNS 名 - + Address Table アドレステーブル - + Address Range - + Object Group - + Custom Service カスタムサービス - + IP Service IP サービス - + ICMP Service ICMP サービス - + ICMP6 Service - + TCP Service TCP サービス - + UDP Service UDP サービス - + TagService - + User Service - + Service Group - + MAC Address - + Policy Rule Set - + NAT Rule Set - + Routing Rule Set - + Failover group - + State synchronization group - + New Firewall 新規ファイアウォール - + New Cluster - + New Host 新規ホスト - + New Interface 新規インターフェース - + New Network 新規ネットワーク - + New Network IPv6 新規 IPv6 ネットワーク - + New Address 新規アドレス - + New Address IPv6 新規 IPv6 アドレス - + New DNS Name 新規 DNS 名 - + New Address Table 新規アドレステーブル - + New Address Range - + New Object Group 新規オブジェクトグループ - + New Custom Service 新規カスタムサービス - + New IP Service 新規 IP サービス - + New ICMP Service 新規 ICMP サービス - + New ICMP6 Service 新規 ICMP6 サービス - + New TCP Service 新規 TCP サービス - + New UDP Service 新規 UDP サービス - + New TagService - + New User Service 新規ユーザーサービス - + New Service Group 新規サービスグループ - + New MAC Address - + New Policy Rule Set - + New NAT Rule Set - + New Routing Rule Set - + New failover group - + New state synchronization group @@ -5196,8 +5364,8 @@ Ignoring this setting. サービスのグループ - - + + Time Interval 時間間隔 @@ -5246,44 +5414,46 @@ because of incompatible type. - - Library %1: Firewall '%2' (global policy rule #%3) uses object '%4' from library '%5' + + Library %1: Firewall '%2' (%3 rule #%4) uses object '%5' from library '%6' - - Library %1: Firewall '%2' (NAT rule #%3) uses object '%4' from library '%5' - - - - + Library %1: Group '%2' uses object '%3' from library '%4' - + File is read-only ファイルは読み込み専用です - + Error saving file %1: %2 ファイル %1 の保存中にエラー: %2 - + + + + RCS tools are unavailable + + + + Fatal error during initial RCS checkin of file %1 : %2 Exit status %3 - + Fatal error running rlog for %1 %1 の rlog を実行中に致命的なエラー - + Fatal error running rcsdiff for file %1 ファイル %1 のrcsdiff を実行中に致命的なエラー @@ -5292,12 +5462,12 @@ Exit status %3 ファイル %1 を開くことができません - + ERROR エラー - + OK OK @@ -5307,12 +5477,12 @@ Exit status %3 - + - + - + No change 変更なし @@ -5320,12 +5490,12 @@ Exit status %3 - + - + - + On オン @@ -5333,18 +5503,18 @@ Exit status %3 - + - + - + Off オフ - + Compiling rule sets for firewall: %1 @@ -5396,104 +5566,112 @@ Exit status %3 * ファイル %1 からせって意を読み込んでいます - + * Running as user : %1 - + * Firewall name : %1 - + * Installer uses user name : %1 - + * Management address : %1 - + * Platform : %1 - + * Host OS : %1 - + Only one interface of the firewall '%1' must be marked as management interface. - + One of the interfaces of the firewall '%1' must be marked as management interface. - + Management interface does not have IP address, can not communicate with the firewall. - + + 0 - System Unusable 0 - システム未使用 - + + 1 - Take Immediate Action 1 - すぐさま処理をする - + + 2 - Critical Condition 2 - 危険な状態 - + + 3 - Error Message 3 - エラーメッセージ - + + 4 - Warning Message 4 - 警告メッセージ - + + 5 - Normal but significant condition - + + 6 - Informational 6 - 情報 - + + 7 - Debug Message 7 - デバッグメッセージ - - + + &Continue 続ける(&C) @@ -5512,348 +5690,361 @@ Exit status %3 ダイナミック - + Aggressive アグレッシブ - + Conservative コンサバティブ - + For high latency - + Normal 通常 - + alert alert - + crit crit - + error error - + warning warning - + notice notice - + info info - + debug debug - + kern kern - + user user - + mail mail - + daemon daemon - + auth auth - + syslog syslog - + lpr lpr - + news news - + uucp uucp - + cron cron - + authpriv authpriv - + ftp ftp - + local0 local0 - + local1 local1 - + local2 local2 - + local3 local3 - + local4 local4 - + local5 local5 - + local6 local6 - + local7 local7 - + ICMP admin prohibited ICMP 管理は禁止されました - + ICMP host prohibited ICMP ホストは禁止されました - + ICMP host unreachable ICMP ホストに到達しません - + ICMP net prohibited ICMP ネットは禁止されました - + ICMP net unreachable ICMP ネットに到達しません - + ICMP port unreachable ICMP ポートに到達しません - + ICMP protocol unreachable ICMP プロトコルに到達しません - + TCP RST TCP RST - - + + None なし - + Route through - + Route reply through - + Route a copy through - + Random ランダム - + Source Hash ソースハッシュ - + Round Robin ラウンドロビン - + + 1.4.1.1 or later + 1.3.0 以上 {1.4.1.1 ?} + + + 4.3 - + 200% {4.3?} - + 4.5 + 200% {4.5?} + + + + 4.6 + 200% {4.6?} + + + + 4.7 and later - - 4.6 and later - - - - + + on top of the script - + + after interface configuration インターフェース設定の後 - + + after policy reset ポリシーリセットの後 - + in the activation shell script - + in the pf rule file, at the very top - + in the pf rule file, after set comamnds - + in the pf rule file, after scrub comamnds - + in the pf rule file, after table definitions - + /day /日 - + /hour /時 - + /minute /分 - + /second /秒 - + - any - - 任意 - - + 1.2.5 or earlier 1.2.5 以上 - + 1.2.6 to 1.2.8 1.2.6 から 1.2.8 - + 1.2.9 to 1.2.11 1.2.9 から 1.2.11 - + 1.3.x 4.x {1.3.?} - + 1.4.0 or later 1.3.0 以上 {1.4.0 ?} - + 3.x 3.x - + 3.7 to 3.9 3.7 から 3.9 @@ -5935,7 +6126,7 @@ Exit status %3 ページ %1 - + Object with name '%1' already exists, please choose different name. オブジェクト名「%1」は既に存在します。別の名前を選択してください。 @@ -5960,115 +6151,110 @@ Exit status %3 空 - + Source ソース - - + + Destination ディスティネーション - + Service サービス - + Time 時間 - + Original Src オリジナルソース - + Original Dst オリジナルディスティネーション - + Original Srv オリジナルサービス - + Translated Src 転送元ソース - + Translated Dst 転送先 - + Translated Srv 転送サービス - + Gateway ゲートウェイ - + Direction 方向 - + Action 操作 - + Options オプション - + Metric サービス - + Comment コメント - - Group member - - - - + type: %1<br> - + Group member %1:%2<br> - + No firewalls assigned to cluster '%1' - + Type '%1': new object can not be created because corresponding branch is missing in the object tree. Please repair the tree using command 'fwbedit checktree -f file.fwb'. - + Summary: @@ -6093,7 +6279,7 @@ Please repair the tree using command 'fwbedit checktree -f file.fwb'.< * ホスト OS: %1 - + * Loading configuration from file %1 * ファイル %1 から設定を読み込んでいます @@ -6102,175 +6288,176 @@ Please repair the tree using command 'fwbedit checktree -f file.fwb'.< * インクリメンタルインストール - + * Configuration diff will be saved in file %1 * 設定の差分をファイル %1 に保存するでしょう - + * Commands will not be executed on the firewall * コマンドはファイアウォール上で実行されないでしょう - - - - + + + + + %1 advanced settings - + Bitmask ビットマスク - + 1.4.3 or later 1.3.0 以上 {1.4.3 ?} - + Executing: - + Using transfer agent '%1' - + Appending fw object name to tarball - + Could not transfer %1 config to '%2' - + Edit - + Rename object - - Edit rule options + + Edit protocol parameters - + Edit Rule Action - + Edit Rule Options - + Edit Rule Comment - + insert rule - + delete rules - + delete rules from group - + change rule(s) color - + move rule up - + move rule down - + negate rule element - + remove object(s) from group - + create new group - + add to group above - + add to group below - + Negate 否定 - + <b>Action :</b> %1<br> - + Replace object - + Create new %1 - + Create library - + Create new Firewall - + Create new Cluster - + Create new Host @@ -6280,29 +6467,29 @@ Please repair the tree using command 'fwbedit checktree -f file.fwb'.< - + Bound to interfaces - + Floating - + 4.0 to 4.2 3.7 から 4.2 {4.0 ?} - + Impossible to apply changes because object is located in read-only part of the tree or data file was opened read-only - + Add object to group @@ -6322,72 +6509,126 @@ part of the tree or data file was opened read-only - - - + + + Paste object - + + Lock object + + + + + Unlock object + + + + Create new group + + + Compiler for firewall platform %1 not found + + + + + Original rule combines match of tcp/udp/icmp +protocols with two or more module matches, such as +module 'mark', 'recent' or 'length'. Use additional +branches to implement this complex match. + + + + + Unknown parameter of target REJECT: %1. + + + + + Can not reproduce default action in table 'mangle' chain 'FORWARD'. + + + + + Can not reproduce default action in table 'mangle' chain 'INPUT'. + + + + + + A single interface belonging to this firewall is expected in this field. + + + + + A single ip address is expected here. You may also insert a host or a network adapter leading to a single ip adress. + + + + + A single ip adress is expected here. You may also insert a host or a network adapter leading to a single ip adress. + + RCS - - - + + + Error checking file out: %1 ファイル取り出しの確認中のエラー: %1 - - - - - + + + + + &Continue 続ける(&C) - + Error creating temporary file 一時ファイルの作成に失敗しました - + Error writing to temporary file 一時ファイルの書き込みに失敗しました - + File is opened and locked by %1. You can only open it read-only. ファイルは %1 により開かれ、ロックされています 読み込み専用でのみ開くことができます。 - + Revision %1 of this file has been checked out and locked by you earlier. The file may be opened in another copy of Firewall Builder or was left opened after the program crashed. - + Open &read-only 読み込み専用で開く(&O) - + &Open and continue editing 読み込んで編集を続ける(&O) - + &Cancel 取り消し(&C) @@ -6517,272 +6758,272 @@ after the program crashed. RuleOptionsDialog_q - + Rule Options for ipt ipt 用ルールオプション - - + + General 一般 - - - + + + Stateless rule ステートレスルール - - + + Normally policy compiler uses stateful inspection in each rule. Activating next option makes this rule stateless. - - - + + + Logging ログ記録 - + alert alert - + crit crit - + error error - + warning warning - + notice notice - + info info - + debug debug - - + + Log prefix: ログ接頭語: - - - + + + Log level: ログレベル: - + Netlink group (if using ULOG): ネットリンクグループ (ULOG を使う場合): - + limit 制限 - + Rate (rule matches if it hits this often or less): - + Module limit モジュール制限 - - + + Burst: バースト: - - + + /day /日 - - + + /hour /時 - - + + /minute /分 - - + + /second /秒 - + connlimit 接続制限 - + bit ビット - + per network with netmask of - + Module connlimit モジュールの接続制限 - + hashlimit ハッシュ制限 - + Module hashlimit モジュールのハッシュ制限 - + On some older systems this module has name 'dstlimit'. Check here if you need to use this name. - + Rate: 日付: - + Name: 名前: - - + + Negate 否定 - + Match if the number of existing connections is above this (translates into option --connlimit-above) - + Mode: モード: - + htable-size: - + The number of buckets of the hash table (omit this option in generated script if set to 0) - + htable-max: - + Maximum number of entries in the hash (omit this option in generated script if set to 0) - + htable-expire: - + After how many milliseconds do hash entries expire (omit this option in the generated script if set to 0) - + htable-gcinterval: - + How many milliseconds between garbage collection intervals (omit this option in generated script if set to 0) - + Options below control size of the hash table and expiration time. They will be omitted from the generated script if set to zero. - + srcip 接続元 IP - + dstip 接続先 IP - + srcport 接続元ポート - + dstport 接続先ポート - + Send ICMP 'unreachable' packet masquerading as being from the original destination - + Keep information on fragmented packets, to be applied to later fragments - + Log facility: ログファシリティ: @@ -6795,7 +7036,7 @@ after the program crashed. 追跡 - + When this option is checked, the number of states per source IP is tracked @@ -6804,159 +7045,179 @@ after the program crashed. ソース追跡を有効にする - + State Tracking - + Force "keep state" to make the rule stateful regardless of the default. - - + + Available in OpenBSD 4.5 and later - + Prevent state changes for states created by this rule from appearing on the pfsync interface. - + States created by this rule are exported on the pflow interface. - + Activate source tracking. - + Maximum number of source addresses which can simultaneously have state table entries (max-src-nodes): - + Maximum number of simultaneous state entries that a single source address can create with this rule (max-src-states): - + Limits 制限 - + Maximum number of concurrent states this rule may create. Unlimited if set to zero (option 'max'). - + When this limit is reached, further packets matching the rule that would create state are dropped, until existing states time out. - + Maximum number of simultaneous TCP connections that a single host can make (max-src-conn): - + The limit of new connections over a time interval (max-src-conn-rate): - + / / - + sec 秒 - + overload table: - + flush flush - + global global - + TCP TCP - + Modulate state - + synproxy synproxy - + These options are only valid for PIX running software v6.3 or later これらのオプションは実行中の PIX ソフトウェアバージョン 6.3 以上で有効です - + completely disable logging for this rule このルールのログ記の無効化を完了しました - + Logging interval: ログ記録間隔: - + + Compiler can automatically create a rule with mirrored source and destination addresses and service fields. This can be used to match "reply" packets using address and service parameters matched by this rule. The action of the mirrored rule is the same as that of this one. Firewall Builder recognizes the following services and creates "mirrored" versions as follows: + + + + + * UDP service: mirrored service has source and destination port ranges reversed + * TCP service: mirrored service has source and destination port ranges reversed and "established" flag inverted. If TCP service used in this rule does not have "established" flag, the mirrored service gets it, and the other way around. This is designed to simplify creating ACL rules to permit "reply" TCP packets + * ICMP service: ICMP echo request is recognized, mirrored service becomes ICMP echo reply. Other ICMP types are simply copied to the mirrored service + * ICMPv6 service: like with ICMP, ICMP echo request is recognized and other ICMPv6 types are just copied + * IP service: mirrored service is a copy + + + + + + Add mirror rule + + + + There are no options for this firewall platform このファイアウォールプラットフォームでそのオプションはありません - + Use sloppy TCP state tracker for this rule - + Assume firewall is part of "any" for this rule only: - + Follow global setting - + On オン - + Off オフ - - + + Normally policy compiler uses stateful inspection in each rule. Activating this option makes this rule stateless. @@ -6964,12 +7225,12 @@ after the program crashed. RuleSetDialog - + Rule set name '%1' is invalid. Only '[a-z][A-Z][0-9]_-+=@%^' characters are allowed. ルールセット名「%1」は正しくありません。英数字と一部の記号(「_」「-」「+」「=」「@」「%」のみ許可しています。 - + &Continue 続ける(&C) @@ -6977,7 +7238,7 @@ after the program crashed. RuleSetDialog_q - + On iptables "top" rule set goes into the built-in chains INPUT, OUTPUT, FORWARD; if this flag is unchecked, @@ -6987,14 +7248,14 @@ the rule set. - + If this flag is unchecked, rules go into anchor with the name the same as the name of the rule set. - + If this flag is unchecked, generated access list will not be assigned to interfaces with "ip access-group" @@ -7076,35 +7337,34 @@ access access lists generated for it. どれか - - + + Enter group name: グループ名の入力: - - + + Insert Rule ルール挿入 - + Paste Rule ルール貼り付け - + New group 新規グループ - - + Add to the group グループに追加する - + Remove from the group グループから削除する @@ -7113,17 +7373,17 @@ access access lists generated for it. 上にルールの挿入 - + Rename group グループ名を変更する - + Change color 色変更 - + No color 色なし @@ -7156,115 +7416,115 @@ access access lists generated for it. 灰色 - + Parameters パラメーター - + Inbound 内向き - + Outbound 外向き - + Both 両方 - + Rule Options ルールオプション - + Logging On 記録する - + Logging Off 記録しない - - - - + + + + Edit 編集 - + Copy コピー - + Cut 切り取り - + Paste 貼り付け - + Delete 削除 - + Where used 使うとき - + Reveal in tree ツリーから検索 - + Negate 否定 - + Change direction - + Change action - + Change logging - + delete - + Copy object '%1' to clipboard' - + cut - + Move object @@ -7277,17 +7537,18 @@ access access lists generated for it. ルール %1 - + Add Rule Below 下にルール追加 - + + Remove Rule ルールの削除 - + Remove Rules 複数ルールの削除 @@ -7300,94 +7561,96 @@ access access lists generated for it. 複数ルール移動 - + Copy Rule ルールのコピー - + Cut Rule ルールの切り取り - + Paste Rule Above 上にルールを貼り付け - + Paste Rule Below 下にルールを貼り付け - + + Enable Rule ルール有効 - + Enable Rules ルール有効 - + + Disable Rule ルール無効 - + Disable Rules ルール無効 - + Compile rule - - + + Move Rule up - + Move Rules up - - + + Move Rule down - + Move Rules down - + Enable rule - + Disable rule - + New Group 新規グループ - + Add new rule on top - + Add new rule at the bottom @@ -7395,22 +7658,32 @@ access access lists generated for it. RuleSetViewDelegate - + + log + + + + + (options) + + + + Any - + Original オリジナル - + Default - + All すべて @@ -7461,12 +7734,12 @@ access access lists generated for it. - + Rule %1 ルール %1 - + End @@ -7570,7 +7843,17 @@ access access lists generated for it. ssh の開始に失敗しました - + + Stopping background process + + + + + Background process is still running. Will wait %1 sec + + + + SSH session terminated, exit status: %1 SSH 接続が切断しました。終了ステータス: %1 @@ -7578,39 +7861,39 @@ access access lists generated for it. SSHUnx - + *** Fatal error : *** 致命的なエラー : - + Logged in ログイン - + New RSA key 新規 RSA 鍵 - + Yes はい - + No いいえ - + Done 終了しました - + Error in SSH SSH のエラー @@ -7695,27 +7978,46 @@ access access lists generated for it. StartTipDialog_q - + Do not show this again - + Close 閉じる - + Welcome to Firewall Builder - + + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> +<html><head><meta name="qrichtext" content="1" /><style type="text/css"> +p, li { white-space: pre-wrap; } +</style></head><body style=" font-family:'Sans Serif'; font-size:9pt; font-weight:400; font-style:normal;"> +<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><span style=" font-family:'Lucida Grande'; font-size:28pt;">Firewall Builder %1</span></p></body></html> + + + + + Watch Getting Started Tutorial + + + + + Summary of features + + + + Previous Tip - + Next Tip @@ -7940,6 +8242,34 @@ by the target firewall platform コメント: + + TutorialDialog_q + + + Tutorial + + + + + Reset + + + + + Previous + + + + + Next + 次へ + + + + Close + 閉じる + + UDPServiceDialog_q @@ -8007,6 +8337,32 @@ by the target firewall platform コメント: + + WorkflowIcons_q + + + Form + フォーム + + + + Create new +firewall + + + + + Import existing +configuration + + + + + Watch "Getting +Started" tutorial + + + askRuleNumberDialog_q @@ -8118,84 +8474,84 @@ by the target firewall platform clusterMembersDialog_q - + cluster member configuration - + Help ヘルプ - + &OK &OK - + &Cancel 取り消し(&C) - + Cluster - + Manage member firewalls for this Cluster. Firewalls are considered valid members if they have the same host OS and platform as the Cluster object. They also need to have at minimum one physical interface attached. - + Available Firewalls: - + Tree of potential cluster members. Select an interface to assign to the cluster. - + Firewall ファイアウォール - - + + Interface インターフェース - + Label ラベル - - + + ... - + Selected as Cluster-Members: - + Table of already selected member firewalls with their assigned cluster interfaces. - + Name 名前 - + Master @@ -8246,12 +8602,12 @@ by the target firewall platform conntrackOptionsDialog - + Invalid IP address '%1' - + &Continue 続ける(&C) @@ -8259,32 +8615,37 @@ by the target firewall platform conntrackOptionsDialog_q - + conntrack protocol settings - + &OK &OK - + &Cancel 取り消し(&C) - + conntrack Parameters - + + Use unicast address for conntrackd + + + + Address: アドレス: - + Port number (udp): @@ -8637,97 +8998,97 @@ by the target firewall platform freebsdAdvancedDialog_q - + FreeBSD: advanced settings FreeBSD: 高度な設定 - + &OK &OK - + &Cancel 取り消し(&C) - + Options オプション - - + + Packet forwarding パケット転送 - - - - + + + + No change 変更なし - - - - + + + + On オン - - - - + + + + Off オフ - + Forward source routed packets - + Generate ICMP redirects ICMP リダイレクト生成 - + Path パス - + Specify directory path and a file name for the following utilities on the OS your firewall machine is running. Leave these empty if you want to use default values. - + ipnat: ipnat: - + sysctl: sysctl: - + ipf: ipf: - + ipfw: ipfw: - + pfctl: pfctl: @@ -8806,7 +9167,7 @@ will add policy rules to permit these automatically. instDialog - + There are no firewalls to process. @@ -8815,50 +9176,115 @@ will add policy rules to permit these automatically. 不明な操作です。 - - <p align="center"><b><font size="+2">Select firewalls to compile.</font></b></p> + + Select firewalls to compile. - + + No files were generated, there is nothing to show. + + + + + <b>Multiple firewalls</b> + + + + Policy installer uses Secure Shell to communicate with the firewall. Please configure directory path to the secure shell utility installed on your machine using Preferences dialog - - - - - + + + + + &Continue 続ける(&C) - + + Last error: + + + + + The process failed to start + + + + + The process crashed some time after starting successfully. + + + + + The last waitFor...() function timed out. Elapsed time: %1 ms + + + + + An error occurred when attempting to write to the process. + + + + + An error occurred when attempting to read from the process. + + + + + An unknown error occurred. + + + + + Current state of QProcess: + + + + + The process is not running. + + + + + The process is starting, but the program has not yet been invoked. + + + + + The process is running and is ready for reading and writing. + + + + Compiling rule sets for firewall: - + Compiling ... コンパイル中... - - + + Stop 停止 - + Error: Failed to start program エラー: プログラムの開始に失敗しました - + Firewall platform is not specified in this object. Can't compile firewall policy. ファイアウォールプラットフォームがこのオブジェクトで指定されていません。 @@ -8877,22 +9303,33 @@ Can't compile firewall policy. - + Failure 失敗 - + Success 成功 - + + <b>You are trying to compile policy for a firewall object that is a member of a cluster, however you requested compilation of only this member firewall and not the cluster it belongs to. Assuming firewall is standalone and not cluster member. Rules and parts of the script specific for the cluster configuration will not be generated.</b> + + + + + Firewall '%1' is member of cluster '%2' + + + + + Error エラー - + Cancelled 取り消しました @@ -8905,7 +9342,7 @@ Can't compile firewall policy. 詳細を隠す - + Running command '%1' コマンド '%1' を実行しています @@ -8923,41 +9360,59 @@ Can't compile firewall policy. instDialog_q - + TextLabel テキストラベル - + <p align="center"><b><font size="+2">Select firewalls to compile and install.</font></b></p> - + + + warning text goes here + + + + + Select all + + + + + Select none + + + + + Inspect generated files + + + + Perform batch install - + Check this option if you want to install all selected firewalls automatically. This only works if you use the same user name and password to authenticate to all these firewalls. - - + Compile コンパイル - - + Install インストール - - - + + Firewall ファイアウォール @@ -8966,56 +9421,54 @@ Can't compile firewall policy. ライブラリー - + Last Modified 最終更新日時 - + Last Compiled 最終コンパイル日時 - + Last Installed 最終インストール日時 - All - すべて + すべて - None - なし + なし Show selected 選択の表示 - + Stop 停止 - + Progress 処理中 - + Firewalls: ファイアウォール: - + firewall ファイアウォール - + current operation here @@ -9024,32 +9477,32 @@ Can't compile firewall policy. 詳細を表示する - + Process log 処理ログ - + Save log to file ファイルにログを保存する - + < &Back < 戻る(&B) - + &Next > 次へ(&N) > - + &Finish 終了(&F) - + &Cancel 取り消し(&C) @@ -9057,7 +9510,7 @@ Can't compile firewall policy. instOptionsDialog - + Install options for firewall '%1' ファイアウォール「%」のオプションをインストールする @@ -9065,32 +9518,31 @@ Can't compile firewall policy. instOptionsDialog_q - + Install options インストールのオプション - + <p align="center"><b><font size="+2">Install options for firewall '%1'</font></b></p> - OK - OK + OK - + Cancel 取り消し - + min 最小 - + Remember passwords for the duration of the session (passwords are never stored permanently). To enable this option turn it on in Preferences and configure user name used to authenticate to @@ -9098,97 +9550,107 @@ the firewall in the "advanced" settings dialog of the firewall object. - + Test run: run the script on the firewall but do not store it permanently. - + Rebooting the firewall will restore its original policy. To cancel reboot, install the policy with "test run" option turned off - + Schedule reboot in - + If you install the policy in test mode, it will not be saved permanently, so you can revert to the last working configuration by rebooting the firewall - + Cancel reboot if policy activation was successfull - + + Install + インストール + + + + Cancel All + + + + Quiet install: do not print anything as commands are executed on the firewall - + Verbose: print all commands as they are executed on the firewall - + Remove comments from configuration 設定からコメントを削除する - + Compress script スクリプト圧縮 - + Store a copy of fwb file on the firewall - + Address that will be used to communicate with the firewall: - + Write configuration to standby PIX - + Dry run (commands won't be executed on the firewall) - + Store configuration diff in a file - + Make a backup copy of the firewall configuration in this file: - + Password or passphrase: パスワードかパスフレーズ: - + User name: ユーザー名: - + Enable password: 有効なパスワード: - + Remember passwords @@ -9196,32 +9658,32 @@ the firewall in the "advanced" settings dialog of the firewall object. iosAdvancedDialog_q - + IOS Advanced Configuration Options - + General 一般 - + Set router name using object's name - + Generate commands to configure addresses for interfaces - + OK OK - + Cancel 取り消し @@ -9229,8 +9691,8 @@ the firewall in the "advanced" settings dialog of the firewall object. iosaclAdvancedDialog - - + + Script Editor スクリプトエディター @@ -9238,256 +9700,256 @@ the firewall in the "advanced" settings dialog of the firewall object. iosaclAdvancedDialog_q - + IOS ACL Firewall Settings - + OK OK - + Cancel 取り消し - + Compiler Options コンパイラーオプション - + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") - + Policy Compiler Options コンパイラーオプションのポリシー - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! - + Ignore empty groups in rules ルールのからグループを無視する - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. - + Detect rule shadowing in the policy - + Script Options スクリプトオプション - - + + Insert comments into generated IOSACL configuration file - + Comment the code コメントコード - + Group IOSACL commands in the script so that similar commands appear next to each other, just like IOSACL does it when you use 'show config' - + Group similar commands together - + Clear all access lists then install new ones. This method may interrupt access to the firewall if you manage it remotely via IPSEC tunnel. This is the way access lists were generated in older versions of Firewall Builder for IOSACL. - + "Safety net" method: First, create temporary access list to permit connections from the management subnet specified below to the firewall and assign it to outside interface. This temporary ACL helps maintain session between management station and the firewall while access lists are reloaded in case connection comes over IPSEC tunnel. Then clear permanent lists, recreate them and assign to interfaces. This method ensures that remote access to the firewall is maintained without interruption at a cost of slightly larger configuration. - + Temporary access list should permit access from this address or subnet (use prefix notation to specify subnet, e.g. 192.0.2.0/24): - + Installer インストーラー - + Built-in installer 組み込みインストーラー - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + Additional command line parameters for ssh ssh の追加コマンドラインパラメーター - + Additional command line parameters for scp scp の追加コマンドラインパラメーター - + Instead of running generated configuration on the router line by line, installer can use scp to copy the file and then "copy file running-config" command to activate it. Ssh v2 and scp servers should be configured on the router for this to work. This method works for IOS v12.4 or later and is much faster than running configuration line by line. - + Copy generated configuration file to the router using scp - + File system on the router where configuration file should be saved if it is copied with scp. Examples: "flash:", "disk0:". Should end with a colon ":". If this input field is left blank, installer uses "nvram:": - + External install script 外部インストールスクリプト - + Policy install script (using built-in installer if this field is blank): インストールスクリプトのポリシー (この項目が空の場合に使用する組み込みインストーラー): - + Command line options for the script: スクリプトのコマンドラインオプション: - + Prolog/Epilog - - + + Edit 編集 - + The following commands will be added verbatim on top of generated configuration - + The following commands will be added verbatim after generated configuration - + Logging ログ記録 - + Generate logging commands - + Syslog Syslog - + Syslog host (name or IP address): Syslog ホスト (名前か IP アドレス): - + syslog facility: syslog ファシリティ: - + syslog level ('logging trap'): syslog レベル ('logging trap'): - + The logging timestamp command requires that the clock command be set. - + Enable logging timestamps on syslog file syslog ファイルで日付の記録を有効にする - + Other logging destinations and levels: その他のログ記録先とレベル: - + Internal buffer 内部バッファ - + Console コンソール - + IPv6 IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 IPv4 の前に IPv6 - + IPv6 before IPv4 IPv6 の前に IPv4 - + Compiler creates multiple access lists from the same policy, two for each interface: one for inbound and another for outbound. If the policy is written in a such way that no rule @@ -9499,39 +9961,39 @@ rules are designed. - + Generate separate access list for each interface - + Compiler creates one access list and assigns it to all interfaces. - + Create one access list and attach it to all interfaces - + Use object-group statements (requires IOS v12.4(20)T and later) - + Always permit ssh access from the management workstation with this address: - + Use ACL remarks - + Do not clear access lists and object group, just generate IOSACL commands for the new ones. Use this option if you have your own policy installation scripts. @@ -9539,8 +10001,8 @@ interfaces. ipcopAdvancedDialog - - + + Script Editor スクリプトエディター @@ -9548,297 +10010,297 @@ interfaces. ipcopAdvancedDialog_q - + ipcop advanced settings - + Compiler コンパイラー - + Compiler: コンパイラー: - + Command line options for the compiler: コンパイラーのコマンドラインオプション: - + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") - + rc.firewall.local - + Assume firewall is part of 'any' - + Accept TCP sessions opened prior to firewall restart - + Bridging firewall ブリッジ中のファイアウォール - + Detect shadowing in policy rules - + Ignore empty groups in rules ルールのからグループを無視する - + Enable support for NAT of locally originated connections - + Make Tag and Classify actions terminating タグと分類の設定操作を中断しました - + Default action on 'Reject': - + Always permit ssh access from the management workstation with this address: - + Installer インストーラー - + Built-in installer 組み込みインストーラー - + Directory on the firewall where script should be installed - + /etc/rc.d/ - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + admin - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') - + /etc/rc.d/rc.firewall - + Additional command line parameters for ssh ssh の追加コマンドラインパラメーター - + Additional command line parameters for scp scp の追加コマンドラインパラメーター - + External install script 外部インストールスクリプト - + Policy install script (using built-in installer if this field is blank): - + Command line options for the script: - + Prolog/Epilog - - + + Edit 編集 - + The following commands will be added verbatim after generated configuration - + The following commands will be added verbatim on top of generated configuration - + Logging ログ記録 - + use ULOG - + use LOG - + log TCP seq. numbers - + log IP options IP オプションをログ記録する - + use numeric syslog levels 使用する syslog レベルの数値 - + Log level: ログレベル: - + log TCP options - + cprange - + queue threshold: キュー閾値: - + netlink group: ネットリンクグループ: - + Log prefix: ログ接頭語: - + Logging limit: ログ記録制限: - + Activate logging in all rules (overrides rule options, use for debugging) すべてのルールのログを記録する (ルールオプションを上書きします。デバッグで使います) - + Script スクリプト - + These options enable auxiliary sections in the generated shell script. - + Turn debugging on in generated script - + Verify interfaces before loading firewall policy - + IPv6 IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 IPv4 の前に IPv6 - + IPv6 before IPv4 IPv6 の前に IPv4 - + Help ヘルプ - + &OK &OK - + &Cancel 取り消し(&C) @@ -9846,258 +10308,258 @@ with this address: ipcoposAdvancedDialog_q - + IPCOP: advanced settings - + Options オプション - + IPv4 Packet forwarding IPv4 パケット転送 - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + No change 変更なし - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + On オン - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + Off オフ - + IPv6 Packet forwarding IPv6 パケット転送 - + Kernel anti-spoofing protection - + Ignore broadcast pings - + Ignore all pings - + Accept source route - + Accept ICMP redirects ICMP リダイレクトの受理 - + Ignore bogus ICMP errors - + Allow dynamic addresses ダイナミックアドレス群の許可 - + Log martians - + whats this text whats this comment このテキストは何 - + TCP TCP - + These parameters make sense for connections to or from the firewall host - + TCP sack TCP sack - + TCP window scaling TCP ウィンドウスケーリング - + TCP ECN TCP ECN - + TCP SYN cookies TCP SYN クッキー - + TCP keepalive time (sec) - + TCP fack TCP fack - + TCP timestamps TCP タイムスタンプ - + TCP FIN timeout (sec) TCP FIN タイムアウト(秒) - + Path パス - + Specify directory path and a file name for each utility on your firewall machine. Leave these empty if you want to use default values. - + iptables: iptables: - + :ip6tables :ip6tables - + ip: ip: - + vconfig - + brctl - + ifenslave - + logger: logger: - + modprobe: modprobe: - + lsmod lsmod - + iptables-restore: iptables-restore: - + :ip6tables-restore :ip6tables-restore - + Help ヘルプ - + &OK &OK - + &Cancel 取り消し(&C) @@ -10114,326 +10576,325 @@ with this address: ipfAdvancedDialog_q - + ipf: advanced settings ipf: 高度な設定 - + &OK &OK - + &Cancel 取り消し(&C) - + Protocol Helpers プロトコルヘッダー - + Use raudio proxy in NAT rules NAT ルールで raudio を使用する - + Use h323 proxy in NAT rules NAT ルールで h323 プロキシーを使う - + Use ipsec proxy in NAT rules NAT ルールで ipsec プロキシーを使う - + Use ftp proxy in NAT rules NAT ルール中で ftp プロキシーを使用する - + Use rcmd proxy in NAT rules NAT ルールで rcmd プロキシーを使う - + Use PPTP proxy in NAT rules NAT ルールで PPTP プロキシーを使う - + Use IRC proxy in NAT rules for DCC DCC 用の NAT ルールで IRC プロキシーを使う - + Some protocols involve multiple associated network connections. Firewall can keep track of such connections automatically if you activate one or all of the following options: - + Compiler コンパイラー - + Compiler: コンパイラー: - + Masquerade returned icmp as being from original packet's destination - + Accept TCP sessions opened prior to firewall restart - + Find and eliminate duplicate rules - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. - + Detect rule shadowing in policy ポリシー中の隠れたルールを検出する - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! - + Ignore empty groups in rules ルールのからグループを無視する - - Always permit ssh access from -the management workstation -with this address: - - - - + Default action on 'Reject': 「Reject(拒否)」標準動作: - + Command line options for the compiler: コンパイラーのコマンドラインオプション: - + + Always permit ssh access from the management + workstation with this address: + + + + Installer インストーラー - + Built-in installer 組み込みインストーラー - + Directory on the firewall where configuration files should be installed - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') - + Additional command line parameters for ssh ssh の追加コマンドラインパラメーター - + Additional command line parameters for scp scp の追加コマンドラインパラメーター - + External install script 外部インストールスクリプト - + Policy install script (using built-in installer if this field is blank): ポリシーインストールスクリプト (もしこのフィールドがブランクの時に使用する組み込みインストーラー) - + Command line options for the script: スクリプトのコマンドラインオプション: - + Prolog/Epilog - - + + Edit 編集 - + The following commands will be added verbatim on top of generated configuration - + The following commands will be added verbatim after generated configuration - + Logging ログ記録 - + Log facility: ログファシリティ: - + Log level: ログレベル: - + Log packet body ログパケット本体 - + Block if can not log - + Script Options スクリプトオプション - + Add virtual addresses for NAT NAT 用バーチャルアドレスの追加 - + Configure Interfaces of the firewall machine ファイアウォールマシンのインターフェース構成 - + Turn debugging on in generated script 生成スクリプトでデバッグに切り替え - + If this option is on, policy compiler adds virtual addresses to the interfaces to make the firewall answer to ARP queries for addresses used in NAT rules. - + Optimization 最適化 - + These options enable auxiliary sections in the generated shell script. - + Determine addresses of dynamic interfaces at run time - + IPv6 IPv6 - + Enable IPv6 support - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 IPv4 の前に IPv6 - + IPv6 before IPv4 IPv6 の前に IPv4 - + Use Kerberos rcmd proxy in NAT rules - + Use Kerberos ekshell proxy in NAT rules - + Output file name. If left blank, the file name is constructed of the firewall object name and extension ".fw" - + Generated script (.fw file) and configuration (.conf) files can be copied to the firewall machine under different names. If these fields are left blank, the file name does not change. - + Script (.fw) file name on the firewall - + ipf.conf file name on the firewall - + nat.conf file name on the firewall @@ -10450,201 +10911,201 @@ with this address: ipfwAdvancedDialog_q - + ipfw: advanced settings ipfw: 高度な設定 - + &OK &OK - + &Cancel 取り消し(&C) - + Compiler コンパイラー - + Compiler: コンパイラー: - + Command line options for the compiler: コンパイラーのコマンドラインオプション: - + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") - + Add rule to accept packets matching dynamic rules created for known sessions on top of the policy (action 'check-state') - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. - + Detect rule shadowing in policy ポリシー中の隠れたルールを検出する - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! - + Ignore empty groups in rules ルールのからグループを無視する - + Always permit ssh access from the management workstation with this address: - + Installer インストーラー - + Built-in installer 組み込みインストーラー - + Directory on the firewall where script should be installed - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') - + Additional command line parameters for ssh ssh の追加コマンドラインパラメーター - + Additional command line parameters for scp scp の追加コマンドラインパラメーター - + External install script 外部インストールスクリプト - + Policy install script (using built-in installer if this field is blank): インストールスクリプトのポリシー (この項目が空の場合に使用する組み込みインストーラー): - + Command line options for the script: スクリプトのコマンドラインオプション: - + Prolog/Epilog - - + + Edit 編集 - + The following commands will be added verbatim after generated configuration - + The following commands will be added verbatim on top of generated configuration - + Script Options スクリプトオプション - + Add virtual addresses for NAT NAT 用バーチャルアドレス群の追加 - + Configure Interfaces of the firewall machine ファイアウォールマシンのインターフェース構成 - + Turn debugging on in generated script 生成スクリプトでデバッグに切り替え - + These options enable auxiliary sections in the generated shell script. - + IPv6 IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 IPv4 の前に IPv6 - + IPv6 before IPv4 IPv6 の前に IPv4 - + Generated script can be copied to the firewall machine under different name. If this field is left blank, the file name does not change. - + Script name on the firewall @@ -10652,8 +11113,8 @@ with this address: iptAdvancedDialog - - + + Script Editor スクリプトエディター @@ -10666,289 +11127,277 @@ with this address: iptables: 高度な設定 - + Compiler コンパイラー - Command line options for the compiler: - コンパイラーのコマンドラインオプション: + コンパイラーのコマンドラインオプション: - + Accept ESTABLISHED and RELATED packets before the first rule - + Bridging firewall ブリッジ中のファイアウォール - + Detect shadowing in policy rules - + Assume firewall is part of 'any' - + Accept TCP sessions opened prior to firewall restart - + Enable support for NAT of locally originated connections - + Compiler: コンパイラー: - + Drop packets that are associated with no known connection - + and log them - + Clamp MSS to MTU - + Ignore empty groups in rules ルールのからグループを無視する - + Default action on 'Reject': 「Reject(拒否)」の標準動作: - + Make Tag and Classify actions terminating タグと分類の設定操作を中断しました - + Compiler will automatically generate rules to permit ICMP6 packets used in IPv6 Neighbor Discovery after the rules that accept ESTABLISHED,RELATE and before the rule that drops packets in state INVALID. - - Add rules to accept IPv6 Neighbor Discovery packets to IPv6 policies - - - - + Always permit ssh access from the management workstation with this address: - - Install the rule for ssh access from the management workstation when the firewall -is stopped - - - - + Installer インストーラー - + Built-in installer 組み込みインストーラー - + Directory on the firewall where script should be installed - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') - + Additional command line parameters for ssh ssh の追加コマンドラインパラメーター - + Additional command line parameters for scp scp の追加コマンドラインパラメーター - + External install script 外部インストールスクリプト - + Policy install script (using built-in installer if this field is blank): ポリシーインストールスクリプト (もしこのフィールドがブランクの時に使用する組み込みインストーラー) - + Command line options for the script: スクリプトのコマンドラインオプション: - + Prolog/Epilog - - + + Edit 編集 - + The following commands will be added verbatim after generated configuration - + The following commands will be added verbatim on top of generated configuration - + Insert prolog script prolog スクリプトの挿入 - + on top of the script - + after interface configuration インターフェース設定の後 - + after policy reset ポリシーリセットの後 - + Logging ログ記録 - + use ULOG ULOG を使う - + use LOG LOG を使う - + log TCP seq. numbers TCP シーケンス番号を記録する - + log IP options IP オプションをログ記録する - + use numeric syslog levels 使用する syslog レベルの数値 - + Log level: ログレベル: - + log TCP options TCP オプションを記録する - + cprange - + queue threshold: キュー閾値: - + netlink group: ネットリンクグループ: - + Log prefix: ログ接頭語: - + Logging limit: ログ記録制限: - + Activate logging in all rules (overrides rule options, use for debugging) すべてのルールのログを記録する (ルールオプションを上書きします。デバッグで使います) - + Script スクリプト - + iptables-restore replaces firewall policy in one atomic transaction - + Use iptables-restore to activate policy - + Add virtual addresses for NAT NAT 用バーチャルアドレス群の追加 @@ -10957,82 +11406,113 @@ is stopped モジュール読み込み - + Verify interfaces before loading firewall policy ファイアウォールポリシーを読み込む前にインターフェースの確認 - + Turn debugging on in generated script 生成スクリプトでデバッグに切り替え - + + Compiler command line options: + + + + + Output file name: + + + + + If output file name is left blank, the file name is constructed of the firewall object name and extension ".fw" + + + + + Add rules to accept IPv6 Neighbor Discovery +packets to IPv6 policies + + + + + Use module "set" for run-time Address Table objects (module is only available in iptables v 1.4.1.1 and later) + + + + + Install the rule for ssh access from the management workstation when the firewall script is run with the "block" command + + + + Load iptables modules - + If debugging is turned on, the script will run with shell option "-x" that makes it print every command it executes. Warning: this produces a lot of debugging output. - + Managing interfaces and addresses - + Configure Interfaces of the firewall machine ファイアウォールマシンのインターフェース構成 - + Clear ip addresses and bring down interfaces not configured in fwbuilder - + Generated script can load rules one by one by calling iptables command line utility, or activate them all at once using iptables-restore. In both cases you just run the script with command line parameter "start" to activate the policy, the script will use iptables-restore automatically if this checkbox is on - + IPv6 IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 IPv4 の前に IPv6 - + IPv6 before IPv4 IPv6 の前に IPv4 - + Help ヘルプ - + &OK &OK - + &Cancel 取り消し(&C) - + This adds a rule on top of the policy with iptables target TCPMSS and option --clamp-mss-to-pmtu. Generation of this command is version-dependent and also depends on the setting of ip or ipv6 forwarding @@ -11041,32 +11521,27 @@ in host settings dialog. - - Output file name. If left blank, the file name is constructed of the firewall object name and extension ".fw" - - - - + Generated script can be copied to the firewall machine under different name. If this field is left blank, the file name does not change. - + Script name on the firewall: - + Configure VLAN Interfaces - + Configure bridge Interfaces - + Configure bonding Interfaces @@ -11074,62 +11549,62 @@ in host settings dialog. linksysAdvancedDialog_q - + Linksys/Sveasoft: advanced settings Linksys/Sveasoft: 高度な設定 - + &OK &OK - + &Cancel 取り消し(&C) - + Path パス - + modprobe: modprobe: - + logger: logger: - + ip: ip: - + lsmod lsmod - + iptables: iptables: - + Specify directory path and a file name for each utility on your firewall machine. Leave these empty if you want to use default values. - + Prompts プロンプト - + Policy installer relies on the shell prompt on the firewall to execute commands. Installer tries both prompt string patterns configured here; it assumes that the firewall is ready to accept a command if either prompt matches. You should only need to change these string patterns if Sveasoft changes the shell prompt in the future releases of the software. <br> <br> @@ -11137,32 +11612,32 @@ The default strings work for Sveasoft Alchemy pre-5.1 and pre-5.2 - + Use default prompts 標準プロンプトを使う - + prompt 2 プロンプト2 - + prompt 1 プロンプト1 - + vconfig - + brctl - + ifenslave @@ -11170,248 +11645,260 @@ The default strings work for Sveasoft Alchemy pre-5.1 and pre-5.2 linux24AdvancedDialog_q - + Linux 2.4: advanced settings Linux 2.4: 高度な設定 - + Options オプション - + IPv4 Packet forwarding IPv4 パケット転送 - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + No change 変更なし - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + On オン - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + Off オフ - + IPv6 Packet forwarding IPv6 パケット転送 - + Kernel anti-spoofing protection カーネルの spoofing 対策防御 - + Ignore broadcast pings ブロードキャスト ping の無視 - + Ignore all pings すべての ping の無視 - + Accept source route ソースルートの受理 - + Accept ICMP redirects ICMP リダイレクトの受理 - + Ignore bogus ICMP errors bogus ICMP エラーの無視 - + Allow dynamic addresses ダイナミックアドレス群の許可 - + Log martians - + whats this text whats this comment このテキストは何 - + TCP TCP - + These parameters make sense for connections to or from the firewall host - + TCP sack TCP sack - + TCP window scaling TCP ウィンドウスケーリング - + TCP ECN TCP ECN - + TCP SYN cookies TCP SYN クッキー - + TCP keepalive time (sec) TCP キープアライブ (秒) - + TCP fack TCP fack - + TCP timestamps TCP タイムスタンプ - + TCP FIN timeout (sec) TCP FIN タイムアウト(秒) - + Path パス - + Specify directory path and a file name for each utility on your firewall machine. Leave these empty if you want to use default values. - + iptables: iptables: - + :ip6tables :ip6tables - + ip: ip: - + logger: logger: - + + vconfig: + + + + + brctl: + + + + + ifenslave: + + + + modprobe: modprobe: - - lsmod - lsmod + + lsmod: + - + + ipset: + + + + lsmod + lsmod + + + iptables-restore: iptables-restore: - + :ip6tables-restore :ip6tables-restore - - These parameters allow you to tune performance of<br> -conntrack module (netfilter state tracking). This<br> -should only be necessary for large firewalls with a lot<br> -of traffic and many stateful rules.<br> -Explanation of these parameters can be found at<br> -<a href="http://www.wallfire.org/misc/netfilter_conntrack_perf.txt">http://www.wallfire.org/misc/netfilter_conntrack_perf.txt</a><br> -<br> -Set both to zero to use default values - - - - + This parameter is used if you run conntrackd in state <br> synchronization mode for a firewall cluster and have<br> kernel &lt;2.6.22<br> @@ -11421,63 +11908,58 @@ Explanation of this parameter can be found at<br> - + Help ヘルプ - + &OK &OK - + &Cancel 取り消し(&C) - - vconfig - - - - - brctl - - - - - ifenslave - - - - + conntrack - + CONNTRACK_MAX - + CONNTRACK_MAX is the maximum number of "sessions" (connection tracking entries) that can be handled simultaneously by netfilter in kernel memory. - + HASHSIZE - + the size of the hash table storing the lists of conntrack entries - + + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> +<html><head><meta name="qrichtext" content="1" /><style type="text/css"> +p, li { white-space: pre-wrap; } +</style></head><body> +<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;">These parameters allow you to tune performance of<br />conntrack module (netfilter state tracking). This<br />should only be necessary for large firewalls with a lot<br />of traffic and many stateful rules.<br />Explanation of these parameters can be found on</p> +<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;">the Internet if you search for &quot;netfilter conntrack performance&quot;<br /><br />Set both to zero to use default values</p></body></html> + + + + Disable TCP window tracking ("ip_conntrack_tcp_be_liberal") @@ -11596,17 +12078,17 @@ that can be handled simultaneously by netfilter in kernel memory. longTextDialog_q - + longTextDialog_q - + Continue 続ける - + this is the error text これはエラーテキストです @@ -11714,38 +12196,38 @@ that can be handled simultaneously by netfilter in kernel memory. - + Depending on the failover protocol, cluster interface may or may not need an IP address. <b>VRRP</b>, <b>CARP</b>, <b>heartbeat</b> interfaces should have their own unique IP addresses different from the member firewall interfaces. Other failover protocols such as the one used in <b>Cisco ASA (PIX) firewall</b> do not require additional IP address.<br><br>List of available failover protocols depends on the firewall platform. Depending on the failover protocol, cluster interface may or may not need an IP address. <b>VRRP</b> and <b>CARP</b> interfaces should have their own unique IP addresses different from the member firewall interfaces. Other failover protocols such as <b>heartbeat</b> or <b>OpenAIS</b> do not create new interface and therefore do not require additional IP address. <br><br>List of available failover protocols depends on the firewall platform. - + regular - + dynamic - + unnumbered - + with address: - + with addresses: - + You should select at least one firewall to create a cluster @@ -11753,12 +12235,12 @@ that can be handled simultaneously by netfilter in kernel memory. newClusterDialog_q - + TextLabel テキストラベル - + Enter the name of the new object @@ -11815,58 +12297,58 @@ that can be handled simultaneously by netfilter in kernel memory. 追加 - + < &Back < 戻る(&B) - + &Next > 次へ(&N) > - + &Finish 終了(&F) - + &Cancel 取り消し(&C) - + Select member firewall objects to use with the new cluster. One member firewall should be marked as master. You can choose to copy policy and NAT rules from the rule sets of one of the members to the new cluster later. - + Firewall ファイアウォール - + Use in cluster - + Master - - + + Tab 1 タブ 1 - + Choose which member's policy and NAT rules should be used to create policy and nat rules of the cluster. First, each member firewall object will be copied with the name "<firewall>-bak" (where <firewall> is the name of the member) for backup, then rules from the chosen member will be copied to the new cluster and finally all policy and NAT rules will be deleted in both members. Backup firewall objects ensure that you do not lose your configuration and can always revert back if necessary. You can delete backup objects or move them to a separate library for archival later. - + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <html><head><meta name="qrichtext" content="1" /><style type="text/css"> p, li { white-space: pre-wrap; } @@ -11875,32 +12357,32 @@ p, li { white-space: pre-wrap; } - + Name: - + Firewalls used in this cluster - + Master firewall: - + Cluster interfaces - + Policy and NAT rules will be copied from firewall: - + Click Finish to create this cluster. @@ -11908,7 +12390,7 @@ p, li { white-space: pre-wrap; } newFirewallDialog - + FWBuilder template files ファイアウォールビルダー用テンプレートファイル @@ -11917,27 +12399,28 @@ p, li { white-space: pre-wrap; } ファイアウォールビルダー用テンプレートファイル (*.xml *.fwb) - + Missing SNMP community string. SNMP コミュニティ文字列が足りません。 - + + Address of %1 could not be obtained via DNS - + Interface: %1 (%2) インターフェース: %1 (%2) - + Dynamic address ダイナミックアドレス - + Unnumbered interface アンナンバードインターフェース @@ -11950,46 +12433,46 @@ p, li { white-space: pre-wrap; } 不当なアドレス 「%1/%2」 - + FWBuilder template files (*.xml *.fwb *.fwl) - + Please select template - - + + &Continue 続ける(&C) - + Dynamic interface gets its IP address by means of DHCP or PPP protocol and does not require an address here. Regular interface has statically configured IP address which should be entered on this page. Interface can have several IPv4 and IPv6 addresses. - + Error loading template library: %1 - + Here you can change IP address of the template interface to match addresses used on your network. Interface can have several IPv4 and IPv6 addresses. - - - + + + Invalid address '%1/%2' - + Can not find interface %1 in the interface editor data @@ -11997,93 +12480,101 @@ p, li { white-space: pre-wrap; } newFirewallDialog_q - + TextLabel テキストラベル - + Enter the name of the new object below: 新しいオブジェクトの名前を入力してください: - + Choose firewall software it is running: 実行中のファイアウォールソフトウェアの選択してください: - + Choose OS the new firewall runs on: 新規ファイアウォールを実行する OS を選択してください: - + Use preconfigured template firewall objects あらかじめ設定されたテンプレートオブジェクトを使用する - + Template file: テンプレートファイル: - + Browse 参照 - + Use standard template library 標準テンプレートライブラリーを使う - + Next step is to add interfaces to the new firewall. There are two ways to do it: using SNMP query or manually. Adding them using SNMP query is fast and automatic, but is only possible if firewall runs SNMP agent and you know SNMP community string 'read'. - + Configure interfaces manually インターフェースを手動設定する - + Use SNMP to discover interfaces of the firewall SNMP を使用し、ファイアウォールのインターフェースを検出する - + Discover Interfaces using SNMP SNMP を用いてインターフェースを検出する - + SNMP 'read' community string: SNMP「read」コミュニティ文字列: - - + + Firewall IP address: + + + + + + 'Name' corresponds to the name of the physical interface, such as 'eth0', 'fxp0', 'ethernet0' etc. 'Label' is used to mark interface to reflect network topology, e.g. 'outside' or 'inside'. Label is mandatory for PIX firewall. + + + Here you can add or edit interfaces manually. 'Name' corresponds to the name of the physical interface, such as 'eth0', 'fxp0', 'ethernet0' etc. 'Label' is used to mark interface to reflect network topology, e.g. 'outside' or 'inside'. Label is mandatory for PIX firewall. - ;; + ;; - Click 'Next' when done. - 「次へ」をクリックすると処理します。 + 「次へ」をクリックすると処理します。 - + Name 名前 - + Label ラベル - + Address アドレス @@ -12148,64 +12639,63 @@ p, li { white-space: pre-wrap; } 追加 - + up 上 - + down 下 - + Security Level セキュリティレベル - Click 'Finish' when done. - 「終了を」をクリックすると処理します。 + 「終了を」をクリックすると処理します。 - + In order to be able to build firewall policy properly, Firewall Builder needs information about 'security level' of the firewall's interfaces. Interface that connects it to the Internet is considered 'insecure' and has security level '0', while interface connected to the internal network is supposed to be 'secure' (security level '100'). You can arrange interfaces in the order of their security level below. - + + Choose template object in the list and click 'Next' when ready. + +You can change interface names and their IP addresses on the next page. Template firewall object comes with basic policy and NAT rules that implement policy described in its comment. If you change IP addresses of its interfaces, policy and NAT rules will be automatically corrected to reflect this change. However you should always inspect the rules and adjust them to suite your security policy. Template objects are designed to be a starting point, a way to jump-start your configuration and most likely require changes to be useful in your environment. + + + + + < &Back < 戻る(&B) - + &Next > 次へ(&N) > - + &Finish 終了(&F) - + &Cancel 取り消し(&C) - - + + Tab 1 タブ 1 - - - Choose template object in the list and click 'Next' when ready. - -You can change intrface names and their IP addresses on the next page. Template firewall object comes with a basic policy and NAT rules that implement policy described in its comment. If you change IP addresses of its interfaces, policy and NAT rules will be automatically corrected to reflect this change. However you should always inspect the rules and adjust them to suite your security policy. Template objects are designed to be a starting point, a way to jump-start your configuration and most likely require changes to be useful in your environment. - - - newGroupDialog_q @@ -12263,24 +12753,24 @@ You can change intrface names and their IP addresses on the next page. Template - + Interface: %1 (%2) インターフェース: %1 (%2) - + Dynamic address ダイナミックアドレス - + Unnumbered interface アンナンバードインターフェース - - - + + + Illegal address '%1/%2' 不当なアドレス 「%1/%2」 @@ -12288,77 +12778,77 @@ You can change intrface names and their IP addresses on the next page. Template newHostDialog_q - + TextLabel テキストラベル - + Enter the name of the new object below: 新しいオブジェクトの名前を入力してください: - + Use preconfigured template host objects 事前定義されたホストオブジェクトテンプレートを使う - + Template file: テンプレートファイル: - + Browse 参照 - + Use standard template library 標準テンプレートライブラリーを使う - + Next step is to add interfaces to the new host. There are two ways to do it: using SNMP query or manually. Adding them using SNMP query is fast and automatic, but is only possible if the host runs SNMP agent and you know SNMP community string 'read'. - + Configure interfaces manually インターフェースを手動設定する - + Use SNMP to discover interfaces of the host SNMP を使用し、ホストのインターフェースを検出する - + Discover Interfaces using SNMP SNMP を用いてインターフェースを検出する - + SNMP 'read' community string: SNMP「read」コミュニティ文字列: - + Here you can add or edit interfaces manually. 'Name' corresponds to the name of the physical interface, such as 'eth0', 'fxp0', 'ethernet0' etc. 'Label' is used to mark interface to reflect network topology, e.g. 'outside' or 'inside'. - + Check option 'Unnumbered interface' for the interface that does not have an IP address. Examples of interfaces of this kind are those used to terminate PPPoE or VPN tunnels. - + Check option 'dynamic address' for the interface that gets its IP address dynamically via DHCP or PPP protocol. - + Click 'Next' when done. 「次へ」をクリックすると処理します。 @@ -12427,32 +12917,32 @@ You can change intrface names and their IP addresses on the next page. Template 削除 - + Choose template object in the list and click 'Finish' when ready. Template objects use generic interface names that will be iherited by the firewall object you create. You may need to rename them later to reflect real names of interfaces on your firewall machine. - + < &Back < 戻る(&B) - + &Next > 次へ(&N) > - + &Finish 終了(&F) - + &Cancel 取り消し(&C) - + Tab 2 タブ 2 @@ -12506,17 +12996,17 @@ You can change intrface names and their IP addresses on the next page. Template openbsdAdvancedDialog_q - + OpenBSD: advanced settings OpenBSD: 高度な設定 - + &OK &OK - + &Cancel 取り消し(&C) @@ -12583,17 +13073,17 @@ You can change intrface names and their IP addresses on the next page. Template パス - + pfctl: pfctl: - + sysctl: sysctl: - + Specify directory path and a file name for the following utilities on the OS your firewall machine is running. Leave these empty if you want to use default values. @@ -12722,8 +13212,8 @@ You can change intrface names and their IP addresses on the next page. Template pfAdvancedDialog - - + + Script Editor スクリプトエディター @@ -12731,605 +13221,620 @@ You can change intrface names and their IP addresses on the next page. Template pfAdvancedDialog_q - + pf: advanced settings pf: 高度な設定 - + Compiler コンパイラー - + Compiler: コンパイラー: - + Command line options for the compiler: コンパイラーのコマンドラインオプション: - - Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") - - - - + Accept TCP sessions opened prior to firewall restart - + Modulate state for all stateful rules (applies only to TCP services) - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. - + Detect rule shadowing in policy ポリシー中の隠れたルールを検出する - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! - + Ignore empty groups in rules ルールのからグループを無視する - + Optimization: 最適化: - + Always permit ssh access from the management workstation with this address: - + Scrub - + Clears the don't fragment bit from the IP packet header. - + Clear DF bit DF ビット解除 - + Replaces the IP identification field of outgoing packets with random values to compensate for operating systems that use predictable values. - + Use random ID ランダム ID を使う - + Enforce Minimum TTL: TTL 最小値の強化: - + Enforces a minimum Time To Live (TTL) in IP packet headers. - + Enforce Maximum MSS: MSS 最大値の強化: - + Enforces a maximum Maximum Segment Size (MSS) in TCP packet headers. - + Reassemble fragments - - Buffers incoming packet fragments and reassembles them into a complete packet before passing them to the filter engine. - - - - + Buffer and reassemble fragments (default) - - Causes duplicate fragments to be dropped and any overlaps to be cropped. - - - - + Drop duplicate fragments, do not buffer and reassemble - - Similar to 'Drop duplicate fragments' except that all duplicate or overlapping fragments will be dropped as well as any further corresponding fragments. - - - - + Drop duplicate and subsequent fragments - + + Statefully normalises TCP connections. + + + + + Reassemble TCP + + + + Limits 制限 - + maximum number of entries in the memory pool used for packet reassembly - + table-entries テーブルエントリー - + maximum number of addresses that canbe stored in tables - + maximum number of entries in the memory pool used for state table entries - + state table size: ステートテーブルの大きさ: - + reassembly pool: - + maximum number of entries in the memory pool used for tracking source IP addresses - + maximum number of tables that can exist in the memory simultaneously - + tables テーブル - + src-nodes - + Timeouts タイムアウト - + When a packet matches a stateful connection, the seconds to live for the connection will be updated to the value which corresponds to the connection state. - + TCP TCP - - - - + + + + first first - - - - - - + + + + + + The state after the first packet. - + opening opening - + The state before the destination host ever sends a packet. - + established 確立済み - + The fully established state. 完全な確立状態です。 - + The state after the first FIN has been sent. - + closing closing - + The state after both FINs have been exchanged and the connection is closed. - + finwait finwait - + The state after one endpoint sends an RST. - + closed closed - + UDP UDP - - + + single single - + The state if the source host sends more than one packet but the destination host has never sent one back. - - + + multiple multiple - + The state if both hosts have sent packets. - + ICMP ICMP - + The state after an ICMP error came back in response to an ICMP packet. - + error error - + Other Protocols その他のプロトコル - + Fragments フラグメント - + reassembly timeout 組み換えのタイムアウト - + state expiration timeout - + seconds between purges of expired states and packet fragments. - + seconds before an unassembled fragment is expired. - + Adaptive scaling - + + (if left blank, the file name is constructed of the firewall object name and extension ".fw") + + + + + Output file name: + + + + + Buffers incoming packet fragments and reassembles them into a complete packet before passing them to the filter engine. In PF 4.5 and earlier. + + + + + Causes duplicate fragments to be dropped and any overlaps to be cropped. In PF 4.5 and earlier. + + + + + Similar to 'Drop duplicate fragments' except that all duplicate or overlapping fragments will be dropped as well as any further corresponding fragments. In PF 4.5 and earlier. + + + + Timeout values can be reduced adaptively as the number of state table entries grows (see man page pf.conf(5) for details) - + adaptive start - + When the number of state entries exceeds this value, adaptive scaling begins. - + adaptive end - + When reaching this number of state entries, all timeout val- ues become zero, effectively purging all state entries imme- diately. - + Activate adaptive timeout scaling - + Installer インストーラー - + Built-in installer 組み込みインストーラー - + Directory on the firewall where script should be installed - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') - + Additional command line parameters for ssh ssh の追加コマンドラインパラメーター - + Additional command line parameters for scp scp の追加コマンドラインパラメーター - + External install script 外部インストールスクリプト - + Policy install script (using built-in installer if this field is blank): インストールスクリプトのポリシー (この項目が空の場合に使用する組み込みインストーラー): - + Command line options for the script: スクリプトのコマンドラインオプション: - + Prolog/Epilog - - + + Edit 編集 - + The following commands will be added verbatim after generated configuration - + The following commands will be added verbatim on top of generated configuration - + Insert prolog and epilog scripts - + in the activation shell script (.fw file) - + in the pf rule file (.conf file) - + Logging ログ記録 - + Log Prefix ログ接頭語 - + Fallback "deny all" rule should log blocked packets - + Script スクリプト - + Add virtual addresses for NAT NAT 用バーチャルアドレス群の追加 - + Configure Interfaces of the firewall machine ファイアウォールマシンのインターフェース構成 - + Turn debugging on in generated script 生成スクリプトでデバッグに切り替え - + These options enable auxiliary sections in the generated shell script. - + IPv6 IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 IPv4 の前に IPv6 - + IPv6 before IPv4 IPv6 の前に IPv4 - + Help ヘルプ - + &OK &OK - + &Cancel 取り消し(&C) - + Flush pf states after reloading rules - + Generated script (.fw file) and configuration (.conf) file can be copied to the firewall machine under different names. If these fields are left blank, the file name does not change. - + Script (.fw) file name on the firewall - + .conf file name on the firewall - + Configure CARP Interfaces - + Configure pfsync Interfaces - + Configure VLAN Interfaces - + State policy: - + States can be bound to interfaces or match packets on any interface. The latter can be useful in case of an assymmetric routing. @@ -13374,8 +13879,8 @@ with this address: コンパイラーエラー - - + + Script Editor スクリプトエディター @@ -13383,148 +13888,147 @@ with this address: pixAdvancedDialog_q - + PIX Firewall Settings PIX ファイアウォール設定 - + OK OK - + Cancel 取り消し - + Compiler コンパイラー - + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") - + Policy Compiler Options ポリシーコンパイラーオプション - + Generate rules assuming the firewall is part of "Any". This makes a difference in rules that use services 'ssh' and 'telnet' since PIX uses special commands to control ssh and telnet access to the firewall machine - + Assume firewall is part of 'any' - + PIX inspects packets with ACLs before it does NAT, while many other firewalls do NAT first and then apply ACLs. Policy compiler can emulate the latter behaviour if this options is turned on. - - + Normally PIX does not support ouotbound ACL, however policy compiler can emulate them if this option is turned on - + Emulate outbound ACLs - + Generate outbound ACLs - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! - + Ignore empty groups in rules ルールのからグループを無視する - + In nat rules where network zone object is used in OSrc, ODst and OSrv are 'any' and TSrc defines a global pool for the translation, replace object in OSrc with 'any' to produce PIX command "nat (interface) N 0.0.0.0 0.0.0.0" - + Optimize 'default nat' rules 「default nat」ルールを最適化する - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. - + Detect rule shadowing in the policy - + Verification of NAT rules NAT ルールの検証中 - + Check for duplicate nat rules 複製 NAT ルールを確認する - + Check for overlapping global pools - + Check for overlapping statics - + Installer インストーラー - + Built-in installer 組み込みインストーラー - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + Additional command line parameters for ssh ssh の追加コマンドラインパラメーター - + Additional command line parameters for scp scp の追加コマンドラインパラメーター - + External install script 外部インストールスクリプト @@ -13533,184 +14037,174 @@ with this address: インストールスクリプトのポリシー (この項目が空の場合に使用する組み込みインストーラー): - + Command line options for the script: スクリプトのコマンドラインオプション: - + Prolog/Epilog - - + + Edit 編集 - + The following commands will be added verbatim on top of generated configuration - + The following commands will be added verbatim after generated configuration - + Timeouts タイムアウト - + Set all to defaults.. すべてを標準に設定します。 - + xlate xlate - + Replace NAT'ted objects with their translations in policy rules - + Check for overlapping global pools and statics - + Always permit ssh access from the management workstation with this address: - + Instead of running generated configuration on the firewall line by line, installer can use scp to copy the file and then "copy file running-config" command to activate it. Ssh v2 and scp servers should be configured on the firewall for this to work. This method works for PIX v7 or later and is much faster than running configuration line by line. - + Copy generated configuration file to the firewall using scp - + File system on the firewall where configuration file should be saved if it is copied with scp. Examples: "flash:", "disk0:". Should end with a colon ":". If this input field is left blank, installer uses "flash:": - - Policy install script : - - - - - Built-in installer will be used if policy install script field is blank. - - - - + conn conn - + udp udp - + rpc rpc - + h323 h323 - - + + sip sip - + sip&media sip&media - + unauth unauth - + telnet telnet - + ssh ssh - + ss ss - + mm mm - + hh hh - + half-closed - + Inactivity - + Absolute - + Inspect 監査 - + Policy compiler generates 'fixup' commands for PIX v6.1-6.3 and FWSM v2.3. For PIX 7.0 it generates 'class-map' and 'inspect' commands assigned to the 'policy-map' under either default or custom inspection classes. - + Enable all protocols すべてのプロトコルを有効にする - + Disable all protocols すべてのプロトコルを無効にする - + Skip all protocols すべてのプロトコルを飛ばします @@ -13719,495 +14213,514 @@ with this address: 生成されたコマンドを表示する - + ctiqbe ctiqbe - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + skip 飛ばす - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + enable 有効 - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + disable 無効 - + Computer Telephony Interface Quick Buffer Encoding (CTIQBE) protocol inspection module that supports NAT, PAT, and bi-directional NAT. - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + port: ポート: - + dns dns - + Based on this maximum-length configured by the user, the DNS fixup checks to see if the DNS packet length is within this limit. Every UDP DNS packet (request/response) undergoes the above check. - + max length: 最大長: - + esp ike - + Enables PAT for Encapsulating Security Payload (ESP), single tunnel. - + ftp ftp - + strict: - + Activated support for FTP protocol and allows to change the ftp control connection port number. - + h323 h225 h323 h225 - + Specifies to use H.225, the ITU standard that governs H.225.0 session establishment and packetization, with H.323 - - - - - - - - + + + + + + + + -- -- - + h323 ras h323 ras - + Specifies to use RAS with H.323 to enable dissimilar communication devices to communicate with each other. - + http http - + The default port for HTTP is 80. Use the port option to change the HTTP port, or specify a range of HTTP ports. - + icmp error ICMP エラー - + Enables NAT of ICMP error messages. This creates translations for intermediate hops based on the static or network address translation configuration on the firewall. - + ils ils - + Provides NAT support for Microsoft NetMeeting, SiteServer, and Active Directory products that use LightWeight Directory Access Protocol (LDAP) to exchange directory information with an for Internet Locator Service (ILS) server. - + mgcp mgcp - + Enables the Media Gateway Control Protocol (MGCP) fixup. - + Gateway Port: ゲートウェイポート: - + Call Agent port: エージェントポートを呼ぶ: - + pptp pptp - + Enables Point-to-Point Tunneling Protocol (PPTP) application inspection. - + rsh rsh - + Enables inspection of RSH protocol. RSH プロトコルの監査を可能にします。 - + rtsp rtsp - + Lets PIX Firewall pass Real Time Streaming Protocol (RTSP) packets. RTSP is used by RealAudio, RealNetworks, Apple QuickTime 4, RealPlayer, and Cisco IP/TV connections. - + Enable or change the port assignment for the Session Initiation Protocol (SIP) for Voice over IP TCP connections. - + sip udp sip udp - + Enable SIP-over-UDP application inspection. SIP オーバー UDP アプリケーションの監査を有効にします。 - + skinny skinny - + Enable SCCP application inspection. SCCP protocol supports IP telephony and can coexist in an H.323 environment. An application layer ensures that all SCCP signaling and media packets can traverse the PIX Firewall and interoperate with H.323 terminals. - + smtp smtp - + Enables the Mail Guard feature, which only lets mail servers receive the RFC 821, section 4.5.1, commands of HELO, MAIL, RCPT, DATA, RSET, NOOP, and QUIT. All other commands are translated into X's which are rejected by the internal server. - + sqlnet sqlnet - + Enables support for SQL*Net protocol. SQL*Net プロトコルのサポートを有効にします。 - + tftp tftp - + Enable TFTP application inspection. TFTP アプリケーションの監査を有効にします。 - + Logging ログ記録 - Syslog host (name or IP address): - Syslog ホスト (名前か IP アドレス): + Syslog ホスト (名前か IP アドレス): - + syslog facility: syslog ファシリティ: - + syslog level ('logging trap'): syslog レベル ('logging trap'): - + Syslog message queue size (messages): Syslog メッセージキューの大きさ(メッセージ): - + PIX Firewall Version 6.3 introduces support for EMBLEM format, which is required when using the CiscoWorks Resource Manager Essentials (RME) syslog analyzer. - + Use 'EMBLEM' format for syslog messages syslog で「EMBLEM「」形式 を使用する - + Set device id for syslog messages (v6.3 and later): syslog メッセージのデバイス ID 設定 (v6.3 以上): - + use address of interface インターフェースのアドレスを使用する - + use text string テキスト文字列を使用する - + use hostname ホスト名を使用する - + The logging timestamp command requires that the clock command be set. - + Enable logging timestamps on syslog file syslog ファイルで日付の記録を有効にする - + Other logging destinations and levels: その他のログ記録先とレベル: - + Internal buffer 内部バッファ - + Console コンソール - + Script スクリプト - + Insert comments into generated PIX configuration file - + Comment the code コメントコード - + Use ACL remarks to relate ACL commands and policy rules in the GUI - + Use ACL remarks - + Group PIX commands in the script so that similar commands appear next to each other, just like PIX does it when you use 'show config' - + Group similar commands together - + Use manual ACL commit on FWSM - + Clear all access lists then install new ones. This method may interrupt access to the firewall if you manage it remotely via IPSEC tunnel. This is the way access lists were generated in older versions of Firewall Builder for PIX. - + "Safety net" method: First, create temporary access list to permit connections from the management subnet specified below to the firewall and assign it to outside interface. This temporary ACL helps maintain session between management station and the firewall while access lists are reloaded in case connection comes over IPSEC tunnel. Then clear permanent lists, recreate them and assign to interfaces. This method ensures that remote access to the firewall is maintained without interruption at a cost of slightly larger configuration. - + Temporary access list should permit access from this address or subnet (use prefix notation to specify subnet, e.g. 192.0.2.0/24): - + + Normally PIX does not support outbound ACL, however policy compiler can emulate them if this option is turned on + + + + + Policy install script (built-in installer will be used if blank): + + + + + Syslog host (IP address): + + + + + Script (additional) + + + + Compiler can generate PIX configuration without commands that configures interfaces, timeouts and inspectors. These parts of configuration change rarely so it makes no sense to execute the same commands again and again. In addition, runnig the same commands on configuration reload cause errors. Use this option to generate shortened configuration to avoid errors and make update faster. - + Generate only access-list, access-group, telnet, ssh, nat, global and static commands - + PIX Options PIX オプション - + Actively reset inbound TCP connections with RST - + Actively reset inbound TCP connections with RST on outside interface - + Force each TCP connection to linger in a shortened TIME&WAIT - + Alt+W Alt+W - + Enable the IP Frag Guard feature (deprecated in v6.3 and later). IP フラグガード機能を有効にします(バージョン 6.3 以上では非推奨です)。 - + Enable TCP resource control for AAA Authentication Proxy - + Specify that when an incoming packet does a route lookup, the incoming interface is used to determine which interface the packet should go to, and which is the next hop @@ -14215,67 +14728,67 @@ the packet should go to, and which is the next hop - + Disable inbound embedded DNS A record fixups - + Disable outbound DNS A record replies - + maximum number of simultaneous TCP and UDP connections - + maximum number of embryonic connections per host - + Specifies the maximum number of simultaneous TCP and UDP connections for the entire subnet. The default is 0, which means unlimited connections. (Idle connections are closed after the idle timeout specified by the timeout conn command.) - + Specifies the maximum number of embryonic connections per host. An embryonic connection is a connection request that has not finished the necessary handshake between source and destination. Set a small value for slower systems, and a higher value for faster systems. The default is 0, which means unlimited embryonic connections. - + The following parameters are used for all NAT rules: - + (The default for both parameters is 0, which means unlimited number of connections.) - + IPv6 IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 IPv4 の前に IPv6 - + IPv6 before IPv4 IPv6 の前に IPv4 - + Do not clear access lists and object group, just generate PIX commands for the new ones. Use this option if you have your own policy installation scripts. @@ -14324,141 +14837,141 @@ the packet should go to, and which is the next hop pixosAdvancedDialog_q - + PIX Advanced Configuration Options PIX 高度な設定オプション - + General 一般 - + Set PIX host name using object's name オブジェクト名を使用して PIX ホスト名を設定する - + Generate commands to configure addresses for interfaces - + NTP NTP - + NTP Servers: NTP サーバー: - + Server 1: サーバー 1: - + Server 2: サーバー 2: - + Server 3: サーバー 3: - + Preffered: - - + + IP address: IP アドレス: - + SNMP SNMP - + Disable SNMP Agent SNMP エージェントを無効にする - + Set SNMP communities using data from the firewall object dialog - + SNMP servers SNMP サーバー - - + + Poll - - + + Poll and Traps - - + + Traps トラップ - + Enable: 有効: - + SNMP Server 1: SNMP サーバー1: - + SNMP Server 2: SNMP サーバー2: - + Enable sending log messages as SNMP trap notifications ログメッセージを SNMP トラップ通知で送信を有効にする - + Options オプション - + Change TCP MSS to - + bytes バイト - + OK OK - + Cancel 取り消し @@ -14512,94 +15025,103 @@ the packet should go to, and which is the next hop prefsDialog_q - + Preferences 設定 - + General 一般 - + Working directory: 作業ディレクトリ－: - - - + + + Browse... 参照... - + Software Updates: ソフトウェアの更新: - + Check for updates automatically 自動的に更新を確認する - + Check Now 今すぐ確認する - + Use http proxy while checking for updates (host:port) - + Objects オブジェクト - Enable object tooltips - オブジェクトツールチップスを有効にする + オブジェクトツールチップスを有効にする - + Tooltip delay: ツールチップ遅延: - + Show deleted objects 削除されたオブジェクトを表示する - + Clip comments in rules - + Data File データファイル - + + Enable object tooltips in the tree and rule sets + + + + + Properties of specific object types: + + + + Periodically save data to file every - + minutes 分 - + Do not ask for the log record when checking in new file revision. - + Enable compression of the data file データファイルの圧縮を有効にする @@ -14608,57 +15130,76 @@ the packet should go to, and which is the next hop SSH - + A full path to the Secure Shell utility (remote command execution; for example ssh on Unix or plink.exe on Windows): - + A full path to the SCP utility (file copy over ssh; for example scp on Unix or pscp.exe on Windows): - + + Value for the ServerAliveInterval ssh configuration parameter. This parameter sets timeout interval in seconds after which if no data has been received from the server, ssh client will send a message through the encrypted channel to request a response from the server. This helps detect disconnects between fwbuilder policy installer and the firewall. If set to 0, these messages will not be sent to the server and loss of connectivity with the firewall will lead to hanging of the installer session. Scp uses different parameter for this, ConnectTimeout. Fwbuilder automatically calculates the value for this parameter using the same timeout value. Note that this only works with ssh protocol v2. + + + + + sec + 秒 + + + + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> +<html><head><meta name="qrichtext" content="1" /><style type="text/css"> +p, li { white-space: pre-wrap; } +</style></head><body style=" font-family:'Sans Serif'; font-size:9pt; font-weight:400; font-style:normal;"> +<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><a href="http://www.chiark.greenend.org.uk/~sgtatham/putty/"><span style=" font-family:'Lucida Grande'; font-size:8pt; text-decoration: underline; color:#0000ff;">http://www.chiark.greenend.org.uk/~sgtatham/putty/</span></a></p></body></html> + + + + Labels ラベル - + Use these labels to mark rules in the firewall policy - + Red 赤色 - + Blue 青色 - + Yellow 黄色 - + Orange オレンジ色 - + Purple 紫色 - + Green 緑色 - + Gray 灰色 @@ -14667,17 +15208,17 @@ the packet should go to, and which is the next hop アイコン - + Icons settings アイコンの設定 - + Show icons in rules ルールのアイコンを表示する - + Show text descriptions in columns "Direction", "Action" @@ -14686,12 +15227,12 @@ the packet should go to, and which is the next hop アイコンの大きさ: - + 16x16 16×16 - + 25x25 25×25 @@ -14700,180 +15241,171 @@ the packet should go to, and which is the next hop フォント - + Choose font for rules sets ルールセットのフォントを選んでください - + Rules font ルールのフォント - + rules font description ルールフォントの説明 - - + + Choose font for tree ツリーのフォントを選んでください - + Tree font ツリーのフォント - + tree font description ツリーフォントの説明 - + &OK &OK - + &Cancel 取り消し(&C) - + No identifiable information will be sent to the server during update check - + Do not show tips on startup - + Show object attributes in the tree - - Properties of specific object types - - - - + DNS Name DNS 名 - - + + Create new objects in "Compile Time" mode by default - - + + Create new objects in "Run Time" mode by default - + Use object name for the DNS record in all objects of this type - + Address Table アドレステーブル - + Installer インストーラー - + Built-in policy installer can remember passwords for the duration of the session. Passwords are never stored permanently, they are only kept in memory. In order to use this feature, you also need to configure user name used to authenticate to the firewall in the "advanced" settings dialog of the firewall object. - + Warning: using this feature creates certain risk if working Firewall Builder GUI is left unattended on the unlocked workstation. Someone may walk up to the machine and make changes to the firewall using cached password of the administrator who used the same GUI session before. Always lock the screen or exit Firewall Builder GUI when leaving computer. - + Download plink.exe and pscp.exe from the web site at - - <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> -<html><head><meta name="qrichtext" content="1" /><style type="text/css"> -p, li { white-space: pre-wrap; } -</style></head><body style=" font-family:'Lucida Grande'; font-size:13pt; font-weight:400; font-style:normal;"> -<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; font-size:8pt;"><a href="http://www.chiark.greenend.org.uk/~sgtatham/putty/"><span style=" text-decoration: underline; color:#0000ff;">http://www.chiark.greenend.org.uk/~sgtatham/putty/</span></a></p></body></html> - - - - + Appearance - + Compiler Output Panel font - + compiler output font description - + Icons size in rules: - + + Show text under toolbar icons + + + + Platforms and OS - + If you disable firewall platform or host OS here, it will not appear in the drop-down lists of platforms and host OS anywhere in the program. This helps avoid clutter in lists of platforms and OS if you only work with one or two of them. - + Supported firewall platforms - + Supported host OS - + Platform - + Host OS - + Enable password caching for the duration of the session (passwords are never stored permanently) - + Enable password caching @@ -14896,472 +15428,722 @@ are never stored permanently) テキストラベル 1 + + procurveaclAdvancedDialog + + + + Script Editor + スクリプトエディター + + + + procurveaclAdvancedDialog_q + + + HP ProCurve ACL Firewall Settings + + + + + Compiler Options + コンパイラーオプション + + + + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") + + + + + Compiler creates multiple access lists from the same policy, +two for each interface: one for inbound and another for +outbound. If the policy is written in a such way that no rule +can possibly be associated with an interface, this interface +gets no access list at all. Also, interfaces marked as +"unprotected" never get access list regardless of how the policy +rules are designed. + + + + + + Generate separate access list for each interface + + + + + Compiler creates one access list and assigns it to all +interfaces. + + + + + + Create one access list and attach it to all interfaces + + + + + Policy Compiler Options + + + + + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! + + + + + Ignore empty groups in rules + ルールのからグループを無視する + + + + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. + + + + + Detect rule shadowing in the policy + + + + + Always permit ssh access from the management workstation with this address: + + + + + Script Options + スクリプトオプション + + + + Clear all access lists then install new ones. This method may interrupt access to the firewall if you manage it remotely via tunnel. + + + + + Do not clear access lists, just generate commands for the new ones. Use this option if you have your own policy installation scripts. + + + + + "Safety net" method: + +First, create temporary access list to permit connections from the management subnet specified below to the firewall and assign it to outside interface. This temporary ACL helps maintain session between management station and the firewall while access lists are reloaded in case connection comes over IPSEC tunnel. Then clear permanent lists, recreate them and assign to interfaces. This method ensures that remote access to the firewall is maintained without interruption at a cost of slightly larger configuration. + + + + + Temporary access list should permit access from this address or subnet (use prefix notation to specify subnet, e.g. 192.0.2.0/24): + + + + + + Insert comments into generated IOSACL configuration file + + + + + Comment the code + コメントコード + + + + Use ACL remarks + + + + + Installer + インストーラー + + + + Built-in installer + 組み込みインストーラー + + + + User name used to authenticate to the firewall (leave this empty if you use putty session): + + + + + Alternative name or address used to communicate with the firewall (also putty session name on Windows) + + + + + Additional command line parameters for ssh + ssh の追加コマンドラインパラメーター + + + + Additional command line parameters for scp + scp の追加コマンドラインパラメーター + + + + Instead of running generated configuration on the router line by line, installer can use scp to copy the file and then "copy file running-config" command to activate it. Ssh v2 and scp servers should be configured on the router for this to work. This method is much faster than running configuration line by line. + + + + + Copy generated configuration file to the router using scp + + + + + File system on the router where configuration file should be saved if it is copied with scp. Examples: "flash:", "disk0:". Should end with a colon ":". If this input field is left blank, installer uses "nvram:": + + + + + External install script + 外部インストールスクリプト + + + + Policy install script (using built-in installer if this field is blank): + + + + + Command line options for the script: + + + + + Prolog/Epilog + + + + + + Edit + 編集 + + + + The following commands will be added verbatim on top of generated configuration + + + + + The following commands will be added verbatim after generated configuration + + + + + Logging + ログ記録 + + + + Generate logging commands + + + + + Syslog + Syslog + + + + Syslog host (name or IP address): + Syslog ホスト (名前か IP アドレス): + + + + syslog facility: + + + + + syslog level ('logging trap'): + + + + + The logging timestamp command requires that the clock command be set. + + + + + Enable logging timestamps on syslog file + syslog ファイルで日付の記録を有効にする + + + + Other logging destinations and levels: + その他のログ記録先とレベル: + + + + Internal buffer + 内部バッファ + + + + Console + コンソール + + + + IPv6 + IPv6 + + + + The order in which ipv4 and ipv6 rules should be generated: + + + + + IPv4 before IPv6 + IPv4 の前に IPv6 + + + + IPv6 before IPv4 + IPv6 の前に IPv4 + + + + OK + OK + + + + Cancel + 取り消し + + secuwallAdvancedDialog - - Select templates directory - - - - - URL is not valid: %1 - - - - - Could not open URL: %1 - - - - Illegal address '%1' - 不当なアドレス 「%1/%2」 {1'?} + 不当なアドレス 「%1/%2」 {1'?} - - Empty address found (position %1) - - - - - Illegal address '%1' (position %2) - - - - - Input not valid: %1 - + + + Script Editor + スクリプトエディター secuwallAdvancedDialog_q - - secunet wall: advanced settings - + + iptables: advanced settings + iptables: 高度な設定 - + Help ヘルプ - + &OK &OK - + &Cancel 取り消し(&C) - - Management + + Compiler + コンパイラー + + + + Compiler: + コンパイラー: + + + + Command line options for the compiler: + コンパイラーのコマンドラインオプション: + + + + Assume firewall is part of 'any' - - secunet wall Management settings + + Accept TCP sessions opened prior to firewall restart - - Specify secunet wall Management settings below. -Please use commas to separate a list of IP addresses. + + Accept ESTABLISHED and RELATED packets before the first rule - - Management address + + Drop packets that are associated with +no known connection - - Enter the IP address of the secunet wall Management station + + and log them - - Syslog server + + Bridging firewall + ブリッジ中のファイアウォール + + + + Detect shadowing in policy rules - - Enter IP address of the logging server + + Ignore empty groups in rules + ルールのからグループを無視する + + + + Enable support for NAT of locally originated connections - - SNMP querier address + + This adds a rule on top of the policy with iptables target TCPMSS +and option --clamp-mss-to-pmtu. Generation of this command is +version-dependent and also depends on the setting of ip or ipv6 forwarding +in host settings dialog. + - - Enter IP address where SNMP requests to this firewall come from + + Clamp MSS to MTU - - RO-SNMP string + + Make Tag and Classify actions terminating + タグと分類の設定操作を中断しました + + + + Default action on 'Reject': - - Enter community string for read only SNMP access + + Always permit ssh access from the management workstation with this address: - - NTP server IP address + + Install the rule for ssh access from the management workstation when the firewall +is stopped - - Enter IP address of a NTP server + + Installer + インストーラー + + + + Built-in installer + 組み込みインストーラー + + + + Additional command line parameters for ssh + ssh の追加コマンドラインパラメーター + + + + Additional command line parameters for scp + scp の追加コマンドラインパラメーター + + + + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - - Nagios service IP - - - - - Enter IP address of the Nagios station here - - - - - Local /var partition - - - - - Enter name for partition that will be mounted to /var - - - - - Local config partition - - - - - Enter name for local config partition - - - - - DNS Client - - - - - secunet wall DNS settings - - - - - Specify secunet wall DNS client related settings below - - - - - DNS servers - - - - - Search domains - - - - - Enter DNS search domains here. One search domain per line - - - - - Hosts file - - - - - Enter Hosts entries here. One IP-Address/Name pair per line. These entries will be written to /etc/hosts file on the firewall - - - - - The resolution order defines how hostnames will be resolved on the firewall (nsswitch.conf). Default is "Hosts file first" - - - - - Resolution order - - - - - - - - - Hosts - - - - - - - - - DNS - - - - - - - - NIS + External install script + 外部インストールスクリプト + + + + Policy install script (using built-in installer if this field is blank): - - - - - - NIS+ - - - - - - - - DB + Command line options for the script: + + + + + Prolog/Epilog + + + + + + Edit + 編集 + + + + The following commands will be added verbatim after generated configuration - Options - オプション - - - - Specify secunet wall advanced iptables/routing options below + The following commands will be added verbatim on top of generated configuration - - IPv4 Packet forwarding - IPv4 パケット転送 + + Insert prolog script + prolog スクリプトの挿入 - - - - - - - - - - - - - - - - No change - 変更なし + on top of the script + - - - - - - - - - - - - - - - - On - オン + after interface configuration + インターフェース設定の後 - - - - - - - - - - - - - - - - Off - オフ + after policy reset + ポリシーリセットの後 - - IPv6 Packet forwarding - IPv6 パケット転送 + + Logging + ログ記録 - - Kernel anti-spoofing protection + + use ULOG - - Ignore broadcast pings + + use LOG - - Ignore all pings + + log TCP seq. numbers - - Accept source route + + log IP options + IP オプションをログ記録する + + + + use numeric syslog levels + 使用する syslog レベルの数値 + + + + Log level: + ログレベル: + + + + log TCP options - - Accept ICMP redirects - ICMP リダイレクトの受理 + + cprange + + + + + queue threshold: + キュー閾値: + + + + netlink group: + ネットリンクグループ: - Ignore bogus ICMP errors + Log prefix: + ログ接頭語: + + + + Logging limit: + ログ記録制限: + + + + Activate logging in all rules +(overrides rule options, use for debugging) + すべてのルールのログを記録する +(ルールオプションを上書きします。デバッグで使います) + + + + Script + スクリプト + + + + Allow reboot to load modules (only if needed) - + + Turn debugging on in generated script + + + + + Managing interfaces and addresses + + + + + Verify interfaces before loading firewall policy + + + + + Configure Interfaces of the running firewall machine + + + + + Add virtual addresses for NAT + + + + + Generated script can load rules one by one by calling iptables command line utility, or activate them all at once using iptables-restore. In both cases you just run the script with command line parameter "start" to activate the policy, the script will use iptables-restore automatically if this checkbox is on. + + + + + iptables-restore replaces firewall policy in one atomic transaction + + + + + Use iptables-restore to activate policy + + + + + Warning: rebooting breaks the connectivity until the firewall is up again. The outage can be up to minutes, depending on how fast the machine restarts. + + + + + If debugging is turned on, the script will run with shell option "-x" that makes it print every command it executes. Warning: this produces a lot of debugging output. + + + + + Warning: this breaks the connectivity until all interfaces are 'up' again. The outage is typically < 10 seconds + + + + Options + オプション + + + IPv4 Packet forwarding + IPv4 パケット転送 + + + No change + 変更なし + + + On + オン + + + Off + オフ + + + IPv6 Packet forwarding + IPv6 パケット転送 + + + Accept ICMP redirects + ICMP リダイレクトの受理 + + Allow dynamic addresses - ダイナミックアドレス群の許可 + ダイナミックアドレス群の許可 - - Log martians - - - - whats this text whats this comment - このテキストは何 + このテキストは何 - TCP - TCP + TCP - - These parameters make sense for connections to or from the firewall host - - - - TCP FIN timeout (sec) - TCP FIN タイムアウト(秒) + TCP FIN タイムアウト(秒) - - TCP keepalive time (sec) - - - - TCP window scaling - TCP ウィンドウスケーリング + TCP ウィンドウスケーリング - TCP sack - TCP sack + TCP sack - TCP fack - TCP fack + TCP fack - TCP ECN - TCP ECN + TCP ECN - TCP SYN cookies - TCP SYN クッキー + TCP SYN クッキー - TCP timestamps - TCP タイムスタンプ + TCP タイムスタンプ - - Files - - - - - Enable support for additional files here. Files in the selected templates directory will be added to the configuration of this Firewall. - - - - - Add additional files to firewall configuration - - - - - Template directory - - - - - Select templates directory for this Firewall - - - - - Browse - - - - - Open current path in file browser - - - - Open - 開く + 開く @@ -15423,97 +16205,570 @@ Please use commas to separate a list of IP addresses. + + secuwallosAdvancedDialog + + + Select templates directory + + + + + URL is not valid: %1 + + + + + Could not open URL: %1 + + + + + Empty address found (position %1) + + + + + Illegal address '%1' (position %2) + + + + + Input not valid: %1 + + + + + secuwallosAdvancedDialog_q + + + secunet wall: advanced settings + + + + + Help + ヘルプ + + + + &OK + &OK + + + + &Cancel + 取り消し(&C) + + + + Management + + + + + secunet wall Management settings + + + + + Specify secunet wall Management settings below. +Please use commas to separate a list of IP addresses. + + + + + Management access + + + + + Enter the IP addresses or networks of the secunet wall management zone + + + + + Syslog servers + + + + + Enter IP addresses of logging servers + + + + + SNMP access + + + + + Enter IP addresses or networks where SNMP requests to this firewall come from + + + + + RO-SNMP string + + + + + Enter community string for read only SNMP access + + + + + NTP servers + + + + + Enter IP addresses of NTP servers + + + + + Nagios access + + + + + Enter IP addresses or networks for Nagios access + + + + + Local /var partition + + + + + Enter name for partition that will be mounted to /var + + + + + Local config partition + + + + + Enter name for local config partition + + + + + Disable auto-generation of firewall rules for management services + + + + + Don't create firewall rules + + + + + DNS Client + + + + + secunet wall DNS settings + + + + + Specify secunet wall DNS client related settings below + + + + + DNS servers + + + + + Search domains + + + + + Enter DNS search domains here. One search domain per line + + + + + Hosts file + + + + + Enter Hosts entries here. One IP-Address/Name pair per line. These entries will be written to /etc/hosts file on the firewall + + + + + The resolution order defines how hostnames will be resolved on the firewall (nsswitch.conf). Default is "Hosts file first" + + + + + Resolution order + + + + + + + + + Hosts + + + + + + + + + DNS + + + + + + + + + NIS + + + + + + + + + NIS+ + + + + + + + + + DB + + + + + Options + オプション + + + + Specify secunet wall advanced iptables/routing options below + + + + + IPv4 Packet forwarding + IPv4 パケット転送 + + + + + + + + + + + + + + + + + + + No change + 変更なし + + + + + + + + + + + + + + + + + + + On + オン + + + + + + + + + + + + + + + + + + + Off + オフ + + + + IPv6 Packet forwarding + IPv6 パケット転送 + + + + Kernel anti-spoofing protection + + + + + Ignore broadcast pings + + + + + Ignore all pings + + + + + Accept source route + + + + + Accept ICMP redirects + ICMP リダイレクトの受理 + + + + Ignore bogus ICMP errors + + + + + Allow dynamic addresses + ダイナミックアドレス群の許可 + + + + Log martians + + + + + whats this text + whats this comment + このテキストは何 + + + + TCP + TCP + + + + These parameters make sense for connections to or from the firewall host + + + + + TCP FIN timeout (sec) + TCP FIN タイムアウト(秒) + + + + TCP keepalive time (sec) + + + + + TCP window scaling + TCP ウィンドウスケーリング + + + + TCP sack + TCP sack + + + + TCP fack + TCP fack + + + + TCP ECN + TCP ECN + + + + TCP SYN cookies + TCP SYN クッキー + + + + TCP timestamps + TCP タイムスタンプ + + + + Files + + + + + Enable support for additional files here. Files in the selected templates directory will be added to the configuration of this Firewall. + + + + + Add additional files to firewall configuration + + + + + Template directory + + + + + Select templates directory for this Firewall + + + + + Browse + + + + + Open current path in file browser + + + + + Open + 開く + + solarisAdvancedDialog_q - + Solaris: advanced settings Solaris: 高度な設定 - + &OK &OK - + &Cancel 取り消し(&C) - + Options オプション - + Ignore ICMP redirects ICMP リダイレクトを無視する - - - - - + + + + + No change 変更なし - - - - - + + + + + On オン - - - - - + + + + + Off オフ - + Forward directed broadcasts ダイレクトブロードキャストの転送 - + Respond to echo broadcast エコーブロードキャストへの応答 - + Packet forwarding パケット転送 - + Forward source routed packets - + Path パス - + ipf: ipf: - + ipnat: ipnat: - + Specify directory path and a file name for the following utilities on the OS your firewall machine is running. Leave these empty if you want to use default values. @@ -28643,32 +29898,38 @@ Can't compile firewall policy. transferDialog - + Transfer error: %1 - + + &Continue 続ける(&C) - + + No firewalls selected for transfer + + + + Waiting - + Error: Failed to start program - + Error: Waiting for program termination - + Error: Program returned failure status @@ -28676,12 +29937,12 @@ Can't compile firewall policy. transferDialog_q - + Config transfer options - + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <html><head><meta name="qrichtext" content="1" /><style type="text/css"> p, li { white-space: pre-wrap; } @@ -28690,79 +29951,83 @@ p, li { white-space: pre-wrap; } - + Select usbstick volume to start firewall config transfer: - + Select a portable disk volume to transfer firewall configs - + Device - + Size - + Mounted - + Mountpoint - + Filesystem - + Double click on a firewall in this tree to jump to the corresponding process log entry - + Firewall ファイアウォール - + Progress 処理中 - + Process log 処理ログ - + Save log to file ファイルにログを保存する - + Start the export! - + Transfer - + + Close + 閉じる + + Cancel - 取り消し + 取り消し @@ -28814,7 +30079,7 @@ p, li { white-space: pre-wrap; } vrrpOptionsDialog - + Input not valid: %1 @@ -28842,17 +30107,22 @@ p, li { white-space: pre-wrap; } - + + Use IPsec AH protected VRRP + + + + VRRP Secret - + Virtual Router ID - + VRID diff --git a/src/gui/fwbuilder_ru.qm b/src/gui/fwbuilder_ru.qm index dd843ab0ce4a6b6a324a28cdbf4708560de5c40d..d0a29ce6a1bd719563d1ee21fad805272138a174 100644 GIT binary patch delta 14479 zcma*td0b7~8#w-Ftv#Ii9Ar$=MIt1cWTt39#-vixM4{3kg$|V|NrYs~OvsRAOjJ|| z<(e|juHnjf4dwT=*XQ&5{qE=c&-cDw_x0Xq=bXLw+G{<}v)0~UtF&i}wCPRt5dhEy zAl?}5hB~6%fpqJR4g%umgAN5Uc^2vdkXnWgM?ayXfcQ5@$Djkzv1lmj4kX|J0IdUh z))j!$;vt%%@6b2^{t>{cDF8wrAbOP@+nCs&>6^d|zbHw6{F3DCwxA<{c%MVP0p_Zi z`3|Tr5OpPU!5@;e`%z|}DCRVONiL`}8V)3)6M*;%^ql!%09ilax>=yxf$NS3lobIT zRgP!d2d@VILrKDM=HYziz4Oc;t0ZZgWM=0~roG6VdYc)(ff*x{1(-G#xK8+a#vvfB@TyU+ zvkoA_3OMtRXm6lqcp?qj4g-ja1Y-CT^bl1KWGnu_Y`n6_Vt}{+>g|{JUjOfH`=e9?yUVzX$k73p58?bm9i=`S@GSMl+KqGShHSH0yjk82XkHk@HdwOG{4Q% zA34Z2UiOnDQ>uZ#Z33`jsw7QW1pG_v`R&#-*VUtI@$)t2ra_WquOBn_2D7L!^VJba zs`|l9Il+9}SyInUxD5QOrP!1?lH5?dg10yXr@de<_mL#iY?-<1n1_}~QdJSNixbl> zml@uknKD9>>$jKbBQht?Z?Iwfb8N>nY?`k-0Qx2})35~^KGz3=U=xiUEd#|q5VnbV z=>iDOHrO$@OOm+$lGJrS2*W=E7@A9xptT^39|E8#lqAYOK?p9ykr06DabwvHX$LX2 z17Rw5qC`%T8joXIc4zh-!<;@zk_%RWFsmzYy|O__G6BwhJ_zed0V10)=i&jk3c!Wl z0b!pXfYTF6vJ6iQKa&i+F#RDLAWe3I&|uJL5Q>5TJT^1ubz&ZQ31TXqSc?=8cew#) zb`-?D*hyOsW)5{nF$c5^1#w?BaP5zPcnsq~=Yi-04CQM;JUtMg@*;@Oe*sz51jL^> zY|UqZUdCU=fYApeo!)~?Tn{AKS&|Eh0+~@7{yhL>cKF5CCYUO+f$RDMWW%50XZ&}u z_(R>YK(+z*TXYB6HjEG5-9WYj_jgYN*@1@ma0q1O=Ybf#1KFi)AZ?m~?2S2aic2P7 zVDt%SR}NbEm;nS>fMKVOKt}8XlS~VsTUuwt$jtQKV1CUMz?TE_>yAJZYQemri~25t zE<;O!OdSke8XDfujd>>nx->L+f|n$TasvxK2#8n=mN)GIZiRw%bIcfT*MN1+P~iGI zg3Tp&GzM(Gp2z4DAW6Edg}wv6V~~Dq#5R6@fW9Fd(49vmxpt*6|f%hP|o+tpAVg)u zp9bn017l9(7selhu}lBLxR(uMQ`X_&ybR+SPRQ=hj3J7S`o+s&Tv7_aa${!ND`t8J z=Bf;4Ru|@`Fy^6e%!2>?z0ik!K3mGHGLs~eZ!-heGlN<&gNtB%%1&&sh-cCUMBiqn zs+m{hl4PVijDH*plrbIYp9$e}oAscpd#@;JNn*(6zPTc^)&?%o^~ThCwB) z1@ls0N&4j?ctv9t%xf)4rvP~EnXAWt=-aRXaA~0=Nv{U)U@Q=#oWXlZ6mb1)z;`b8 z{PJ}$*#`S?-3IW#j9n+}Aq1?%!r@IlrvBA9<|i>7-^0{WEJ%$`L8!7AzaI&qc*jZ0 zA|{6IX;}D>p+zt~OOIWk#CF z=RoHA?Lclmg$?f-;gNK(iz;9puDxZwsflWAur= z4Epj-SO_+o1CmSHqh7!bI|SGJ72uh6hr7e@p8p;M_kFMk=>G^F-ZaF*@D4|HX!y^ zSh)49A#O`v10DE=Iqo7E)4T%9XB*y_- z{5fz#?vTKqrNH&PPJ)KK2cp_Sg6blH>T46plr0HB?|P9bdoiJe`;gFJ940LqlhCO> zvGi?2;@$B~qi2yhdJL#WN6DNbOel8>Nuu3CAhU8v+D|vE-CfCsEqJe2ec46-k6J8Zf&^Cq^HBr`l{PD75HSWOQM zDhDF>rU%z!lW%-P^JA_7nQcRlVeE%Ve^UL~Q@gRssHEp^V3XZCL5l-ifmolRr4I}- zK>wf>CO9QBYeB1vYO!j$PH*xYkkQTPEx!ujy0oW{F;^pfnM9f(JE|-I~_SS-x!DEP_EJS4?q;% zID_)#KwHF0a+9`kEjIb#@bTn~o?#P?oynP8Fu@b(!g|nZ-Tqm1i9JZ^N;}l${ z)Cimh{+1+>-?<)L-Eo5Yh_gyXC+VHIz8Y*|w^GhQ@B{eRlyf%1!s%ETH~LY3ENBGI z-4UCrLto~%jgp+>G|uOqIZ(6jOuLSp&!ZMVdN?x6HIh{GlbK$_{O1+tXM&@w{5Cha zW-pHal_R)mr?GOH{+nAeHVjDh8s?XolC*I!bAz2E*Y+`&=8=Tsd>OamE~ekL&$)Ex zWT4OMxb)jYfby@nHJASZP$x-}Mm@RAPz#{lMsS;IFm4RL&u!i`8Q^LlmpwQP^rU<~ zx8u-bTqJ1E?e5YNi2EXL_Zf_IT@P?av#}54C3E>pO@SsCazz{SF&BL1&Zk8I?H$M! z8({!~8(i^m99D&$xU$?_pf`VU754`MtiH=#`cMh9Wg|(>kK-<9TL9i&%Ikd3OJ|7-1|SQfVSGhecs{(^z~ux9|f-cylTe_4a3fD6|Y)| zEoC#B*IarJ^mZ1nd86-u#s4>6d*B|nz-GSj8~j5~Ip1RE6X0Bj^R0(rJm@RqjXq+* zajq9{Y}XG+mjb@ylSF{~-+9|HIBdVC^7bJXxGvC|@6+Z7kZT?J0fX1z^em4bWS<12 zrjQ>Rg10PhC_n5QwisE^(%)VT1osAV@=xaTAW15=V=kD_&#b^8ub3YY8 z9>>qxi?{s8QC=T^$QR(#T|Uv`8F1Foe9Bl%n=jruQ^041VbdEJNK%Kk%<(yr z+~gvDbLQ`Y`p-E-Q#yT;yw0%!tZH~6PwGs_cn83G?9Y6`0@a4`A1`BXPk19q z?RzmpawWNd5Wdc!5QpnW{&#;I1+sHOqr&f4f0bnmO-@Ncg!cE)ce4evWj_E8c?)K#_S2eKUz-I&*Ngo!hnVfMQ#_&Ql* zwpz<9ZO*(_A^5Kj!j&y+<~K)SYVx00EBZ-tPP>JvspIef8-)N~)pnp=4+!bUiveDS>4o%@ z=GbX^qam0DjnJpKa6Da-bBYkw?ZvDZX(MbsyBAFmc9pFG(%4DZvmE=%+;763l0R?? z*GR}&isL$9FmuXO;dt?8TzU-^iX3rO)UaQ8X!rUb`nY(R>-3CdbUxi60W_r z#v(FUsCilmbo>+HerN)&y9^W_4Z{gZRH^Xtn*eZPzVM+U0qCM4p|<%0fG#_PZ{zX6 zhb~A`+xfyTt0_Qc7)f$&zQV7GSlrf+7V3v#r@OpCB(^w=^}Y%#bR!10mT;v50^IZ14F13QO za~w~k^#rlQ_*{Ti<&wm=t=Mfcw%o!OVz-m;u@k=(EiAD}g=Ep91mj7?BC-44LokeJ zzl*(Uv9p~rVm?10NyQN6f(xSkX=5OR!o}XkgK)Sxi~T-^0Tka72TsIL`&XJI>2@V! zgkeX0a;@la?k=v2I5E@Am@7<}E5|U`jbv_2Wgfi2ENH|mY{ophfO-9)B=K9!3~c=$ zZ!?3gi$nMftY;SX7M(=QNhen_pPNWh;Q@0&KhbGmIL5msqDvoNfHfY>tY_kwR@kuG zK+!z`!$;==(F>OyAl60nI%j|jvcs}MDTbTi4XU^y&Jl5nNYuY@16?pll6L>d>~n}Yy`3ayca<45MVxC;4|LKq zabDzgAX+nV(WN`s1-->Z-<1GMqs3+Wv5U>M5to%=v}oolrea`)CuhXvjecOysgR_y z7Gk5*?A%E8nqr^(Kc~+i7$@!RpLI`LY#2D68D!GVV@r(=H|F#REQJx`5z;22KHV& zxx6WWd8K$--WzB0%fvJ9J_F4iDxUdS4CL%gu_VqExK69ZQcXUPVFltvTQ|)5O0hzL zS2};SSpC`t%ZMyy`?uoVR~G?p{v+PsaT4f@$Ku03ECB3Bi4O~sfE)T=d~ATT{GKEA z;**9ie$|OjCt%2TnkK$>-HcCcsQB)&1JKSD;zt?}bXAy)2Dtz?e6mdDjNv2slq46j zPbSByA(cInDVE^G>;6JnyVa!tM@C4}L06dWTVB{-QrDKk5s1;kq~>s%j-IZdC> zHp;vtsb;#Y%Wa%#-T5rDoZyZRX!B$}t+Df*+$8IH1jCKxBbiMmPPAGrLu=6!=tuM= zin-3P8H!UIDurv9| z#vfdRw?!kT(E(G4S~hWiBV2aqDVrLAz1`eNHucDDAlVtR(7AQMnf8-S&-no~ zY=m#tZ9pb1m92Gp3bey1+4`CFxOg^LmhFb~o?|w$ zZGtDR&^MLsu`WT+%l5Wz547WF*}l}LI8W-&jBU{%j{nc&q#Y#cH*UW-DZ6Hd<5p!MyB^;G$e(MO-=ZaHlUU}?PqOMX2VBQg%5Lwiz)tm3l4_2~ z?sWCUbLbiTc0 z|9ty`t8S&TA9tQ&0Tmh8WWP^favbU)mo?rDw6s9pv>7JZ!wckwIoR2zewVlP z!xQm8ChvH@HCBL`ahGCLzHdyXBXfr;=9WO}>4oY&Pa^*v<<8adaNIqhf7U1qs`KX@Q zQVwSFQ7#y8`sKmFO)F20!8NDdRm=k#=CRStN8XZ@gfrv!GtXa>>r8R=ZoRx}bbo+Haq^n37-BzE$?sp-4P0MG`J+PYQ{6tw zpT5HKqvnkKMHRN_W+VB_!{p2Kojj6(>_&Jaf zeu_ca^_b0`DO~cN1N~g3a3vU8YyVJ;__i8gfr-KmXA#70vm_nUL@^PED?RvF;bV<~ z$FGtZ+*0AYv>G1`UY6uS?G=GD2jS}fX>>3?rSGg%MEs2*vzJye^94r0fxe39RRi%w zmTQWbJ>P&D1uA0qRRWD}p-9ZdCVp3?NGWi|mEXpS)Mz~M$PJ2gAG}3P$0$~gK%1B= zR$j!o@=UK-bua;_DbKW=qR4K8C*1U_!h=!#jaj|;_Cvl6}yJu zt?1;f$iu1|>b5G5zOVpTn54+h%f&BbD^BO&iG8wA6b{DWS#wlTcy$3zG3O}G^S(g6 zEfpoB7vc)f4n_G@JdsA%6_*WDfa|>kQhdx!#_YIHN#_&+XR%sIw-f`t-cu=Shb3l< zFU*cZCCS9IN_ogw+&@Oy)b1)SQ#4k#w!wAH4zW%AU6u;zPJJNixY^X}xGCu2pSU z+Gd+!ADE%EZ-Sw=xRr8XJN#ZtKS|=#NjdmC){246mBU|SB<%cEuN?8k062&1%F(VE zVw=B|q|HA`a+6vqJ#JyTZ97Fd(Pb=fG)XxzJO?ADPU&;E0-uAdQwH{Jio@@wGB6?t zi%tt>*&|7^;=3}i{u9u{yOlwTY@CdzDuXs&#Fp5r4B8ch>!^BvZ6aqXhQqE4!#|71DW!ywVT)#ZRw0)>dI5iNcV?EP%w{lGYu4AZn zND^Iua_tXXVC8lw*STy2xIJ2uvzJ?$3iAMS1*3Ly;SxJYj;7QY=@V z*oc+VvdPMmt#Mmpq_Vla#eXbMa|{hw`HXuFoF($$TtIQre0+$DLVxSo!rW ze&6<%vMv!*%8l#F-%3nLZ;q&h5KExy(~_Le5S1cs2o~Y(REl+2B~00-QmpTQfzC(O zuz`K7Sf$8G!Q%M4B<+8d8TLe_{1|`>MNTTsl3rK<-B#%~ z`65Yf!U*QX6jk4qIM+_>BT4%%WlqnON)p{Al}8)Ag0HzMkNvN3PMWClI-UgZeUB<~Huk+)4ywpEuYs6U zt7aX%fzt|ORjkPgAanbwV!L6I{Ix|D*Yz&us2HZ*6jgjO-lAdMREuX}s_N&gS|Y~) ztz4nfFKvPaR7{F0r6E;xdap`L(Bf3jR+Z_2gJg?dwaIuf&SwUxvcF@+=Cf0^{T{Bd zJK3mml%0W`9>9DtQIaM`srDbjrgpfbI=Ed6G~YsXs6`IG{JC0HygCI3&q&p^mlFXN zw^day^#ac1qh9srriLW=NOcqEQFOGm>gfp!yjMl4XDv?xv6`uRfwveoe^tHwiIZP$ zF|)L->TM++;OueLyU6xH<{L^<`)ABhZ&j^zJua_=s6JxyCA6{X%b4o`-Y%*yK4b9( z)Ela={>^X!O0QRg3Ws0Q4kR zJ8j4%bsvh6`^Y7=)2a&K^fsH-F4rI7E43fguJ51XF!WUqJBIh>Wwv@$&31f%BdEvJ z;FII89%`Q#h5%kUYTtj-fNL>R9hAKg>!LpD8TCc@KHW6t_u=Y!dvJUgl`>1Vs^|B` z3taSAomAitkRPI6Iu}P%KLhm|T^$xs`9!@ISDeY54eGV`@WB0J)tQ<)Tmt*1&K!-; zRg7AwGd&FeGECI#3EqpP2I|c(4T0EtskcSM;CQZ5Z(EH``#M>@Hym@I+e7uf#6NLf z!>e<@-vM&?8S~yp=8todG{#1K(4WTz;aFY62A;qu^+Ek2oc-WPn2T$Fcs9N^DyFh=Bf+vjWqbZQGL#HJKlng>f)xZ0AGF7B^R>sx$9bW zS*RP(#fR19pRmd8&DB>wV4Rs5uD-TGkL5zgr|PPWI0`cRsQ={f!0E~ATRm_M?T_Q? zyGb~XyCc2AcaHYtASvyMoNsd{1 z)qF`VO06g%C0Or#V>MwfSLFYGCe_4wwFc}-wUqemsg$^tA*BT7L zdVlpllktm%8`Zz3X8_T!)9~l9vt8e$5pD>YsO0uNia|-+|@ZYKCsY>bqBxX2h+0TuSxlxe~WaR0o+ns9{x@C`KKFW%!lzNDEs9QQYAriovNCzhG6S&)FGqJy_)DK46k zHvO0`C7P5gc!G6-nzU>;Oj7z`nibXxOhTJAD_0u>Rm_s)ymx3aJ7O=tWX$~gx+K*; zU}iMZtnXnX3drw$nuC)AfLbJKjvU93e8Wgn5I6*1 ztMJvFK7sS0v^AP@scv{nt5Vp;=O9Vi$eX#onvV4h_WUj%MYN{pM(lAaawN&nl`M>iFZKI7i<=2du%kvVfY)>kym_7kp44F0K|P?!%~pE+9p-pN3Y7BcHENz&O` zZ9qfz^thr8(_u?w2-+|`Zg8Qqv|%L{Kp)K4&YWO~OTQnr(Z=tAl-$!U>arall{;$} zdtwtd2JMRJ7>avZX)`LqaCDs3uDNW970w6k+T!_`CC_L#B_!Z<H^N0*IqMugL$B6e zZF&vYnvZI)b^DAje$3Tgi^otqdX%;rhdEIsY46O!fO9BA`_NQ_$;DUuBsdB1UTRai3hq79)_G!0&mOzW)E^*e~qSqgQ{t_{R-U#V*uQx7z|MrRB--uE?^ z;!H82~lZ>e{`E1v<`G*Ksedc^kFYb$o*@XRlZ4I`4|Y z_p8iwUFA4FBRzCo<6Z#CdZg=h`H+7b6F(M9rptDR3MQ7;xV++6)2VMUMm}XDe z>xORj0w{g2b9KQa^T<~>{5!_}r83>f>XrC9dnhw`F>~`6oyVisc)=Q-|Bj;=;%AlV z0`Fl{zPHp(_10kIQ|hK(#y;xuIRRoyNDPjt^FU9L`p z`TzK7-I1LO@m-uWU4APMfXoBT4fV{^cFZ%Ab!9td;tQ@Ox=ZV9aec#HcRlMg9^j_# z!5i#ker3An5Ajw+KhV8ROv9J{dg^K&%rQM1>S_05@$rhmFX? z$jpD{P=kyPHg;SOu*~qaaiBdc^S0X@^~$@Do+#$+$n3ynwAzr7QM6H=_j$ukk}+yk z%e=ZxCrHNe?525k*}wVBFN3+B8GH6L%j{@L8)e4cAli)WI|K6UclW0mRyl=v{r9bJ zoN3#ZOg3mbG$b-8cJlP;4&i}8<3oaCgCa8qe74FcJ<~L=<(Y1Z%m@3(9}1;&(DaCg zzh*vOM_cE4URd8xI!2~INsIsQAO($i67vVK&KzV)j5>n}%z++Y0oM3`gFSH10GNk! zYAk#4|3*D5tSx$2^eC8aN=8t9bLfdt(GpChFE)J1>RPV6sWo$d$CbOj{(G*N^Cyt{tdW|$yG#VEZ9Ud7nd3wfZ=e`AZcads*^JQ2Y ztO*=< zC@_CX!{--tn##TDlDRpFGs!Gn#u*gcSk3K`XUiRsY?<-EqxJvnD$sl&0px#nN|Z;~htslu?Wh}pSN)%_Oj^cu%G|ewGtP_{Nyq$muk=Gz?)3P7cj$(4icAwv z8us5E(!bd4NvHj5M;9;Z@UI;uUbOzdJGR`Tip*BNbkKiyNXPzb3)ePNyNI?|7)AvJ d#59b;%*G#aKuKfnfA$^NL)sN|$>xSB{vUAJ@FoBN delta 17127 zcmb8W2Ut}}w!giq_C7hOhyjH@Du`mjfB}&f1Qi1+W(-Xhlq5mKz%fURsK+d}8N1aM z6?5C>oKu@~&aut^-`QpN%-rwZd7f`(oOhp{s%q6rwQBSGF7vz7=BXuZFNmlbQBFEo z1DpfaBG#xr7(gsB25e3&X($*%H1%h&4R{P}Pb}FL3yS6R97NO$vNTq-jD@@KtaLNiA1{yNE}- zqqmJQ8vF-j6T$>{6bL>%s*r2u3s&w-}ju(Sh4iVLcNFSV5$OfPT^}7+h#0XnfC)PVqa85cYfGB(EiT}O_Q`bRoTz$c5s{|LH5ImA7c(ocyftcQQS4j#VPxRD| z`Nsik6ic!N4cBuedF(u*s9Az%oJr2xNG!{wPzoPT@~oA_xt^dA4vy>;eDg&iFa4c!M~mN&E0Vl- z5d1)M!L-gKpTGG49>mk8o31%+`<0cNVO}LsOv((;X?&CO(k_MI#y{Ksh5Y6)HIsZwpGwV_YhJ$7}gVnFL&=x z>eXjR@{1((CWoCr2d@#2dO_;#O^Hr>lKSpvVhc5-{sgmZ=0O_y1pGjtV8^$lQO_kd z<(5Jz&5JbUC*yiw(lo$xo}Tdd`EdEG$fjv?8z)Y|1YFj zit{a-kmgsg)lZ~3w3}F!H>5d|PpoQr(meJeslsEj^sPy}b7gWW|C)HCRaCl{CsFhV za;Z|8Soig0wc~nGW2(3p_Fp2NDup$JH+0Y2s3~nbOkO8Fh=3;2nyNYGVZ>U6Eaw5$lw*mNcthUj8xdVPO!Z13AUuCd^)5Fj zsmp8fIntS=uI}XXZa2Kn9)+yY0`mLu12po^5aocW_K{zLM103tg;L`T3O)}n6LpYU zV6rLVFKTh!Vf4<_vi@sg85IPxJr(j1mB0_g>PCQHa6KISMtnp!YS};=SR`q8>UMhvGpO#vMPe3HOMy;{}iSbd?YD*Dv5lfI|rID@5GLqV~ zr3qJGktFS;+|%$Ki>6bq|Jlz(4F^-MgX4=SWNL50dEaQ#@-xKl8Y!=BHnGL8Xy*1D zV)?0LpSy(E?WcKH4Q{r6!)R?Y%uJ6E+Bjn}@pe@N`wXJ(OW=EkRG>o(oRC@!7M%D6 z3@0h(DV=IkL{jT(bg6YGV!BdvwHG3MtNV2QybH3u=Ynx5bgOM$bYlVCui2HDc{#mo zum)M=Tzd7#WT+4~()$C~h}~SLkV}&Uw|=27Z+a8mFHK*&&nF&Pp1$>k&zi9i2G^a) z6v@;*`w$h|D>(Os;G$r`-?Ny0%R*v4tC@KujJ@7sR%!_zy&c9%Egea$>}GHlRLDio zN^L}7EE~nj`-US|bz&8-I1_yx#VQY+K{RGFt6u*r(TY{9j{h)XUN2a^bbn&ge`Ss8 zB0H;dnT3vfNIdkYV4sRCtkhxT!agj#Y%}5wQ(5mW(1iQl6>?Q&!3r}$TLCh%cFGCK ze-ew>e3zu&<5*0ceGu(178{H#uk=Y4`z4Je-OsGgq8#F{2C+V?5LO1gXMN*fB&Cb9 zzVUV7U5ePC&gkgCBW$n@?$axr4c>*Qa_=A;(O@*O5kYM7C*;_)Y9M4wXG%>o$XpZD0^5nqYbsLP%|T2E})d1g}% zM$chy4|@}R+s8gX#S5<$urGNXi6Xafp1qgYf~uTDS@`W>F1LM4QqMBn>Df-=n=5jc zX)};HeB>@~TVbtqiB~b*#f$v~N6qGSpTOFGXwB<>Sx(Fhc|XjAl|WyVCrDrq~I))?$f+Q<3_}%*5)C{8zO)G!b3+CAZ-lh?fTy(y8a7q zzbzc1ea6GCyF)T-dB>|;5#l=YPW$W#tP^>sJ6(x(T?5BQvAlSwM`kT3kY2BFZ-m-+8QZ0^Zd1Rysm zA@LQCP-^QL$_pGJujgciY~V{?;0STO0{O22hlrKTf>6 zHZO#NMK}P1j!M05lqS}swcz>E3VFH3g3Gojl!|Mm2rJC**l;QGGFEuYt4aN~BY#RM zCXMTuOzg%Yg`5u-{J|(#*j1s_aH=%9>qx8|??_W@mk@=2z9da;Ig0pKS83|SVB*DJ zNi&cBMPwYQkd=>??2fe3_qDX(G8{^`JJP}hk?OE99>01q)^=l-%meoqzR2`fyo}JU9n+ zFZFdfYHS;X*Fkd9Qa9M^3pq8;m)L>pg0E5(a;JlWvwF+@55vw^Tjk8FxkTD*dBCch z#N_evpmn_wHN)f)HSdtrwvs%dBckf-cM5r_QiAsD^2C*}uC_}R+IZ|7Ik)jvqL~45 z?pkD6-cItQ5&1+P+RKxkHlqaNAIo#vLd4a2$#aq+dM77^yaNd)s1!UB)l&!@0!rX|Pz^o+wODny$-h*GBPmx>Fu^Q1aJt|WZ^6A@ zg2!4YWL+o7zsxtoQF+N54DcJNf61GAgc9G-M=r8CcO*Xhj=Z%W%UT##*!6WsJfIl*%W%MTONQKK-(&kJPY zF@^H;{fl88N90!lmxz}yDZe@jE0{1^A#YJuaEMN!lxUT|IPE0*Gfe*G59@Gxr7E@) z3&C>*suEl4k`#JGRmy^>m-t#CvwgIQgOMXtr8;C24;ZepRspShRh53ZMf9SMs?rq) z2dX?Lek9r;t2}e@qKLt&YFFS`Otn0pn5tE$VMJfL zs#;%MMl3u@)pjfrhq^CSp>L5BHeaF&D~Q3mq^zn--Vj8yI;t+$eBgj8sk$4M5>*Hn z^lvJdo-KGzuj-lPOstea)w@MKOi|h`ad7Z=!Lwefs2Q0c>ip<1YNl=pEZB#4wR=|?4w5nh{>^vnzFuk5?^PYv+qWE34D+ntw zr-iCr@wU|e9xP6;K9#mQNxo#gwWRpUv&pg%Vo;yh@)nE0s zHI(hoWolL*W;@zRE&YxqY4tj4%g8mvRvcG5{XPiW4A<4A1J4iz-B6eQgAr5JQo}*DV06^Ofo*uab!l3{yAl3D^7dnL^g+Y+kTSW!tzT>SljjLb;=Y z;Ixy1(+>&G_#`;*FTs2t!NQ?}Tek@Qu~Tr5m*BY{6|%(1f~gh1^SWUF1?pfq54q~p zv+5RV#Ha)F1Ydb6rWP&Vl;~j8liB zNAJ?F4x&aoIaZvQy;pES2f^PP3hrtzc=@j2 z;}C_cYQEsKAaxIh6YVcM+@f zRJ|OjCQTTkUa_|~tbLApwPrMm!glp92g^g}!_;dEI>RdzsBIfxrDCP_R=ssnNg}V~ z>g`%zEdM8}cRYPVe1DvJ$EQ8Sjt*Au&GsNEpqYA~X(M*EcB&854@G&sulleKBOUcn zedeJL(uz5Pm7b_CJve}BX*c!NrCW)AW9sV_Y7#YSufAS15}~G=`lb`A0u2JDI2_C-vyZ5IdU zVifXnB{bD89wNHhN#otEGg0$GO`UpBo}JA#b=Jf0c;C?Y*s=2Rm=3-KcY&|KXCPu; zhw&LRRJMqRhDM(beLuLEY0vsMZ_m2Yesj%$j4-A##CPd`#&3~9I%h$74ouY z1(!xBlyoIEN^IIGX>w0s`Cl?qGn4;Jtlw14tQNP4*NN23?f;d?BT$nciUrZ}&YGW9 z-LW{{qgh#RFY5dKHLJ>1B3^Hd-$lD*#{Ni{) zD-X>tca{)ea8t9U*e>EHOqz8|P<5-)SF^q)N=2`_Yu0xjk3CwOW}{10DCGvt#?!%Y zKwA~EF1t0`dLcF3S6<_YX{^d@&7QY!h=wlE?9FxT(X`sDIrzhRq9$E5hq5up=k{w3 zH*+Fh#Z_}+u@R!Gra9>e`!&?moEqd#>{h-)F6RhZT?KbKY0gY;MpFANnv1IrW6jGI z@^alYe^&2~a_TnCm0ZNE^K~`XFJtbp9)QPg?IRIH1)7B&^E7^jm7j0ZQJQ)Sj%#4`#O+N zGf!>%5ICHWjoPl>kU;HA+WyNVnD14kQB+(=|*RkbT8 z%q8AwnPC6j+FzS`5mjm-IMKFPyJZj@$E|RMjQ^(HdKV+$ZrbhlS77OA(;o1ID<1t+ zdt^!;e7sJ3bUAX=`De7pQ=xP%25FCfftgVW?dcBwsKoxMy<8nG_H|wD)%`0->hxNB zV<&W}@oeqw2S`I+U)A0_4M`Rh*WUjPQPno&j`mpCHkwJ&?2XYK>EZ*%gn%~ehN zB_N&X>@gi>XQ3pl(($Bx6weZMs-8KBW;r_5>INhwc!m6@{#OA6-B`?0nKrT}UB(xAB#(6@#mNJwn&^{S2bfnYvJ{Dp>e3 zg*+xn*AwQ;4>Db^dXP}!Il=ySbiK!)!3N_W4q}f!?S(F;e*p3NQD7jrPM7)|E;Ptl z*Z&?oVw+f9#`LE6tR-8Qx$-?qzf^-6r0GVifyiH+)=emCg%#dvU2X;jFyMu5 zYA;NgwYzRwThOhCZrTC(nfupu)14u~_w#kr*CI8oQvlj<;BV69<0}VdeWuHw^_BPs zPu;R7A7RI&Ti);-@e8wc%Y!jRReI(l*&(A z4Ry>13&6X&qw$^5^I5v1yTh?UyQ(`@0}mM1=uV|RBHrPG?m;vhRVS71W!@_6wDeoS%FPwB`2BiqLPwkr)7wfmIDw6rUHWo9 zD2#glr7zbS<}&xN-qo>&{nJ(N8U(wJ_S65+1AbzjkG|r-Ys4z{SIFIq>8s3!WafGZ zE}WsSb8$4$v<3=UzoztC? ziA+4EZ}SkYvFba0+qX_AiVxFwXa$#B@tH#IK1bj60>W>#WPQ(&jwHD((f3R#fUDl9 z?}e>dnh~In@hb^)4AsY^#uCMR5Ij0wA)B{DAM^D!@k0mnvATRL%59PQ*!c%A@^$*y z<*}%^j?l-G2GzG+`uOM(#7Y$EQ{Q0jdKBu@_U?{xAQg9I&dHf^|Iv z(-#R&a1z{+BKUBsLavDv^m;5<|Epm0Rf2=w2oB#NIJSyHsmn~kzMu3fM@)Cb|C7oA z`&33DcR41w^r=G0Tt~kqa52*Oc7ktTD&&g}E0pA+`i*A~!5{ph-}DjDa_Lt6=Ho7i z^BIEk_6X*a;2$FdcfZna{;2PS?6-t|i`9cjeMrA$K2oSzpY&VHE<@7TTfe=}BjjjF zg6Ev|+a0U)9b3Q*?8dFs@96vp(eku@#|7m5A?@@#8~c;wHac&Tr<<*CkN%(?Mq~U- zf3OIC%KS!uco-b2+Y*Ir+$R0W_M3^k!WA-mErqdBilqfoBb_Sv84=buv_l*^2tjT|sVtLOEer5#m4VOV14z`vQCyvU3Z-W%_GU7(Qpr82tWx2s`8rI&E z&MD-r`U>W}QYfXm8rr;ryYQN>klCXZ^0r=r?OO}RPcw9=eTUfL)rL;C_v4VClr(e# zS-H=KuCB-NvE*?>*IyoBje5ZlzIh}uX{aG>AXIMnRYTh2hs3I1G7MOI7R!tthAitA zVq?!6vTC5Zpw2L4SHFbNR8BCsrD4!0OifH*!`K0DknglJjMKs)>!%pTmp~ph+}&WC z;0O^_o*5?RnBg{N876;4S`fF;VDAbeS)E~6;5HWPoEL`t4+|mM3xcU+SaJn5`4&Eg z0)16the8Bj$0_9Y4u)UWLDcO|8`dr{6F(MeSXa6LpN7se?CF7R7E`ui&x{GMrFJ&M z$@@LA1pHt)Gd`T8MvD#S79cog`54Y)p~j=97;bN=No+>A;ZB*Y#C{xTxQD5ypBEYK zf5IZU*fhbbKN_AKM?)7b8lI+AA~tb@Lf&GZ;E+v*m-W69sS*sY5R{qWp5blSDQvyl zHXGjdf`@i~V|W+kj8fH9BN4xUuRXWdFB| z8*4-a!?9-GRt{LtGsZeD(C&U$jEy-w{NcyO7Sj)-Zrauua_R;?#C>6G_3So+uF2SX z6Xx(S8QWh*l<#IVhF!)EwK>b!>z)e|rUGN{zb2DZYnm}Oe>5uB6BV+qfySh-yYQ7> zNrge?qrJNm@}NV;xeRla`_#Dbz6-IyNaN3` znOK|;H~u^WqJMJ7xGDwq&%*B+SC2S{1(IxB^WjfoJN^`W_*o&>91$El)wniF#)j`I z!7-1FYi(mtM%ZFp_v{fodXlj)w*VcTE4aWYxM!7d%RZzTgL)XZ7s5k!Ut`?q)`^&| zzwwXmwk4ROrN+Jc5oIG57!URhB|d+O@z86CzQdo!6EEPHhU$zbQT}9g9vM&1huJLg zHlCBv;QW@x3$;;$^X+52G!k}SYn1WQPVBAsyJo!H7-n4aC*#%K5=oIejJK|pCpOM% zd}J>qcF9%nYq;?>@^<8yna0uV*l)HS}l43|B!$oN+zp5Gm8{FaypE2v|V*H1+eG2A5YhEhJafUR{SaET6@t{(j10Ox-5k(zQ17K^@2NG1Rwe;Mhq&|wkoFNBAghZHl^rP$jHu_ zQtmy2E}S;?Z-etCoK1sfqsL1|n}+8g9&1OP4p zo5`Dq&1qw1_L4ptMh&r`_T#tXKeAQ*qtT+L}erl`nVZTVN+cgkG- z=~1GG1?HMRbwOq5gSqy6FO;Trf-mg~d5KqoGbae%ePXU%gbb@pGxLulCE}HjnOoWp zWe}bD#oY4sT%y|B%pFDq5zn4%?)dr)dRSoYwsRv^=U(P0Uo4z<6)NP0bAl5R%+Zc8 z-1V3_*#b!{{HRb$uVGH!Ta);^d~^S9E+{d-GH19wBX;VZc}%q>*rSg(kL?Z#y4E(^ zrX<2w*QsmHJDd!&*lwPA)ElYNd-JS4!w_cU%nNdIu#S0RUQ}2Kx!X+hiU)8knqB6# z502tv9&Y|^F?1$#vU$Vf<3x8ZnRh!rZf$bge4zS6lH$ggj}Q0*zP_&cM9Gt=X`eNp ztnmhWb=Ax#2f-D0Xm2y0f!Qhg4a_*L6dT?;cE zwcb)a`yR1n=PWhSwvbfyoyGeHc*?+Q7Vq4?@R)%~7Jo>9PA;+dUqcw)dCSs#Xew6U zWi8DYh7%pKTUv!6DE*aVY4ZWGV#Z=iyED`9RefKIejhhM{z#RAb6&=CE<_PSXkZ3v1IJKL{hhHmI3Oz_nizH)gCs0senlk4OEo95Mu@yff>qogV*Ei)k|uYX?IJkNzC3zskWCNry@ zjmH03MzFF<(@%aL&b;lX=Ce}vqEXDr?mn6ovzXha42ZRcWhTa2gHp1R^QPsOv!9;N zoE^7RG8zAMwR5WD?aWuaAYdVLVm|hOL9A>^C*`J&v5B$K8L=_SyV4!^7A7t6=l12J zScs!}$AP<}O%I2x@=_P6^J*+BpLcB8eEX8o%*`PtgDxyKNpvSKe`&eGgynOK+q25E z>V*ZH19W!N7+$i_d-vQX_Kg9&n0;-$q_Q9To$2hheayJA2}`I@q^`*7@}i6G>@e%p zko+i${N*xo1KIDp)S5sAd@$`lDvD7LXB*4jWL5s_hd+nI{bc=THcIHD z-9LPP>;Kg$<>7xCO8nj>(NN9r4Fv>pXN?fX|7a{VEjBJ;;NL@VvpepDYGIgV4UUd~ zzb<<6z28t(Z`fA=MD8ayll>s}W|)e`_ThF`hX4C;+C~nvrl&<)lT%`1)5UN~w-SB& zpD(d5?#D_M`)<(watqi(Lm4_*nUz-L{r9WVGa@r$)0O^|_Wi$K<%GX9{4UwD2IX1D zbKga(^Zx#zlRdv3FDJ$;rZqG+BQYVlpS4d~N@l9)ana9}*?#6U2+t%^0`y2|UkSOj z-G2n^uErqd?iiF%G6%(N|5CS_eu)YG(1f6b^vEdKBfL$Ygk)$%N}4qzJ|W$j1}pWe z73J?&D>1>|0g7W8_MffUQ=-{V?*FZg2H)GTw~k?zwg2%lTbuuUnd}Ci=`a*;c+7@4 zZUa$yes@0pibrjR>u^Wp`Trf)KSosXdy5@olVhx&naOFfkJWTv)Pj?f+;3togqU-}-lFQZmz`W33r!k5!?SHgh+&(;=)vNzs-|X`Dn;i<27@MB{_vn;~>gsStng6B~aNUY!v?E{gpxXcO z>c8(x!~Oby@j*x3LVrN1^yb;7+sLcu6f)!cBFlsy(s>FJ;ee z2xniL#^8+M5RThWm`RJ`&yePq{U`MCMH@vJ?eN`tAqx0Qnb}t$)j#n zYi2skIz^dXT(9S8jY~^OvL=3i+|$FyQ)s}yDZtMEV;HJ`jic26K92w1|A>F}zw>|T zf1kvZD7eOY|;BC z>~&tu8wjb=tE86Eo^Rh*6`*EX53Y1Ic z{TAbD?>L>8v}>oLy!+2ImTiVH_Op66Pe@KkkN31@#m6RFV^Wf1Yucw~aaViY={(Lp zBMU99naVA*gfpTjl zW;?=(4|EzSoPFqeUZF!nIT#n9%yM&FXe_su8~yu@%CY0sNSAQzFo(bWnIrFW-0OHY z2u(MZ+u&+b`^~8we@dGbm>Cxro0e`(NRCcPa`@m>IEvT|C~jn*q}b$)bSuVZg)2)> zk4=IvONWDwO~UONDb`3Uo=HuNMI8D5R8%a4;P{oE?s%7SD{cfKl|+PbYiu$+eQZsK z8I(x1cRPjIOv#m6+YjyKW!PkU+bul6$0|2;bQptl45$I*qqt;rJrwrdTFGl1X)SD7 z$qgNmv7NomLtdd}%Vv>^4aQ`qVzM0(?q35zN1|e_F=;8OsYu=&!-`DKwjv8lON>m# zxRlG$;V<` ztz6OJTO2*2>R=1U{DByYV^}Sizumf;JKOIMU}YL(KrjkNUS7vx9H3)Bz8I1>65iH| z;}4ZXFfgC*_X&~UUi+TS+|Nce|IzE&9g(>uMj~{kSUrQ#f9wA;dQWTY!06c249rDj zhSlM}{&f@d_PZ2Pl_>nr)Mq8&zJHflx-}~nry|o`6xqdPreSK+payAavFWKP$uW4| zKK~K-ESh+nCl9OC9670{~+_wqv#fs4DsXGqegF zv(u3rSmRTWlvYWOOp3Llvmx!Rkufo7F}Wei>O-jXxEkwXuP_|he%LUnMCre? zUw?=*z!4dsN4|2yJl7$WN|g#uR??2|jyfYHB{3r*)qZoJRL1TTjqGPun&f1U7$C`Z zzkF8KJ|IhSDrzxU8mKLLG*aroIQiwhc содержать пробела или других специальных символов. - + Emulation of terminating behavior for MARK and CLASSIFY targets is currently ON, rule will be terminating - + Emulation of terminating behavior for MARK and CLASSIFY targets is currently OFF, rule will not be terminating @@ -3913,14 +3913,14 @@ tab of the firewall object properties dialog activates emulation. AddressRangeDialog - - + + Illegal IP address '%1' Некорректный IP адрес '%1' - - + + &Continue Продолжить @@ -4111,12 +4111,12 @@ tab of the firewall object properties dialog activates emulation. - + FWBuilder API error: %1 Ошибка API FWBuilder: %1 - + &Continue @@ -4322,17 +4322,17 @@ p, li { white-space: pre-wrap; } CompareObjectsDialog - + Next Следующий - + The following two objects have the same internal ID but different attributes: - + Skip the rest but build report @@ -4569,82 +4569,82 @@ Preferences dialog, tab "Objects" DiscoveryDruid - + Hosts file parsing ... Обработка файла узлов ... - + DNS zone transfer ... Получение зоны DNS ... - + Network discovery using SNMP ... Получение информации через SNMP ... - - + + Adding objects ... Добавление объектов ... - - - - - + + + + + Cancel Отмена - + Prepare objects ... Подготовка объектов ... - - + + Copying results ... Копирование результатов ... - - - + + + Discovery error Ошибка получения информации - + Incomlete network specification. Неполная сетевая спецификация. - + Empty community string Пустая строка SNMP community - + Import configuration from file ... Импортировать конфигурацию из файла ... - + Could not open file %1 Не удалось открыть файл %1 - + Some discovered interfaces have been rearranged in fwbuilder objects and recreated as subinterfaces to reflect VLANs, bonding and bridging configurations. The algorithm used to guess correct relationship between interfaces and subinterfaces is imperfect because of the limited information provided by SNMP daemon. Pelase review created objects to make sure generated configuration is accurate. The program expects MAC addresses of bonding, bridge and vlan interfaces to be the same. It is especially important to review and fix generated objects if you use MAC address spoofing. - + &Continue @@ -4652,17 +4652,17 @@ The program expects MAC addresses of bonding, bridge and vlan interfaces to be t DiscoveryDruid_q - + Object Объект - + Interfaces Интерфейсы - + Type Тип @@ -4671,42 +4671,42 @@ The program expects MAC addresses of bonding, bridge and vlan interfaces to be t Менеджер получения информации - + Choose discovery method used to collect information about network objects from the list below and click 'Next' to continue. Выберите метод получения информации о сетевых объектов ниже и нажмите 'Далее' для продолжения. - + Discovery method: Метод получения информации: - + Read file in hosts format Прочитать файл узлов (в формате /etc/hosts) - + Import DNS zone Импортировать зону DNS - + Perform network discovery using SNMP Метод получения информации - + Enter full path and file name below or click "Browse" to find it: Введите ниже полный путь и название файла или нажмите 'Просмотр' ниже для его поиска: - + File in hosts format Файл узлов (в формате /etc/hosts) - + Browse ... Выбрать... @@ -4715,94 +4715,94 @@ The program expects MAC addresses of bonding, bridge and vlan interfaces to be t Чтение файла узлов (в формате /etc/hosts) - + This discovery method creates objects for all 'A' records found in DNS domain. You will later have a chance to accept only those objects you wish and ignore others. Please enter the domain name below: Этот метод получения информации создает объекты согласно записи типа 'A' DNS указанного домена. На следующем шаге можно выбрать те объекты, которые вы хотите добавить (и соответственно не добавлять ненужные). Введите имя домена: - + Domain name Имя домена - + Objects created using this method may have long or short names. long name consists of the host name and full domain name (this is called <i>Fully Qualified Domain Name</i>). Short name consists of only host name. Check in the box below if you wish to use long name, then click next to continue: Объекты создаваемые этим методом могут иметь как длинные, так и короткие имена. Длинные имена состоят из имени узла и полного доменного имени (FQDN). Короткие имена состоят из имени узла. Поставьте отметку ниже, если вы хотите получить объекты с длинными именами и нажмите Далее: - + Use long names Использовать длинные имена - + DNS zone information has to be transferred from the name server authoritative for the domain. Pick the name server: Информация о зоне DNS будет получена от указанного DNS сервера: - + Name server DNS сервер - + choose name server from the list below выберите DNS сервер из списка ниже - + server name or its IP address here if you wish to use different one: альтернативное имя сервера или IP адрес: - + DNS Query options Опции DNS запроса - + Timeout (sec) Таймаут (сек) - + Retries Количество повторов - + This discovery method scans networks looking for hosts or gateways responding to SNMP queries. It pulls host's ARP table and uses all the entries found in it to create objects. Scan starts from the host called "seed". Enter "seed" host name or address below: Этот метод получения информации создает объекты согласно результатам опроса узлов и маршрутизаторов по протоколу SNMP. Он получает ARP таблицы узлов и использует все записи этих таблиц. Сканирование начинается с узла, называемого "seed". Введите имя или IP адрес узла "seed": - + 'Seed' host Узел "seed" - + Enter a valid host name or address. Введите имя или IP адрес узла. - + The scanner process can be confined to a certain network, so it won't discover hosts on adjacent networks. If you leave these fields blank, scanner will visit all networks it can find: Сканер может быть настроен на определенную подсеть и не использовать ненужные подсети. Если поля ниже будут пусты, то сканер будет использовать все подсети, которые сможет найти: - + Confine scan to this network: Сканировать только подсеть: - + Netmask: Маска подсети: - + Address: Адрес: @@ -4811,22 +4811,22 @@ Please enter the domain name below: Получение информации через SNMP - + The scanner process can repeat its algorithm recursively using each new host it finds as a new "seed". This allows it to find as many objects on your network as possible. On the other hand, it takes more time and may find some objects you do not really need. You can turn recursive scanning on below: Сканер может работать рекурсивно, то есть пытаться использовать каждый найденый узел как "seed" узел. С одной стороны, это позволяет получить информацию по максимуму объектов вашей сети, с другой - сканирование займет слишком много времени. Включить рекурсивное сканирование: - + Run network scan recursively Выполнять рекурсивное сканирование - + The scanner process can find nodes beyond the boundaries of your network by following point-to-point links connecting it to the Internet or other parts of WAN. Сканер может найти объекты за пределами вашей сети через каналы типа точка-точка, которые могут соединять вашу сеть как с Internet, так и с другими частями вашей сети. - + Follow point-to-point links Использовать каналы типа точка-точка @@ -4839,12 +4839,12 @@ Please enter the domain name below: Обрабатывать виртуальные адреса - + Analysis of ARP table yields IP addresses for hosts on your network. In order to determine their names, scanner can run reverse name lookup queries using your name servers (DNS): Получать DNS имена узлов для IP адресов, найденых в ARP таблицах. Для получения DNS имен сканер будет использовать обратные DNS запросы на ваши DNS серверы: - + Run reverse name lookup DNS queries to determine host names Получать DNS имена узлов для IP адресов через обратные DNS запросы @@ -4853,48 +4853,48 @@ Please enter the domain name below: Опции сканирования сети - + Enter parameters for SNMP and DNS reverse lookup queries below. (If unsure, just leave default values): Введите параметры для SNMP и DNS обратных запросов (вы можете не изменять это поле, чтобы использовать значения по-умолчанию): - + SNMP query parameters: Параметры SNMP запросов: - + SNMP 'read' community string: Строка SNMP community для чтения: - - + + number of retries: количество попыток: - + timeout (sec): таймаут (сек): - + public public - + DNS parameters: Параметры DNS: - + timeout (sec) : таймаут (сек): - + Number of threads: Количество потоков: @@ -4903,71 +4903,71 @@ Please enter the domain name below: Параметры для SNMP и DNS обратных запросов - + Process name Имя процесса - + Stop Стоп - + Save scan log to file Сохранить журнал сканирования в файл - + Process log: Выполняется получение информации - + These are the networks found by the scanner process. Choose the ones you wish to use from the list below, then click 'Next': Ниже перечислены найденые сканером подсети. Выберите те, которые вы будет использовать и нажмите 'Далее': - - - - - + + + + + Select All Выбрать все - - - + + + Filter ... Фильтр ... - - - - - + + + + + Unselect All Снять выбор со всех - - - + + + Remove Filter Удалить фильтр - - + + -> -> - - + + <- <- @@ -4976,7 +4976,7 @@ Please enter the domain name below: Подсети - + Choose objects you wish to use, then click 'Next': Выберите объект, который вы хотите использовать и нажмите 'Далее': @@ -4985,27 +4985,27 @@ Please enter the domain name below: Объекты - + Change type of selected objects: Изменить тип выбранных объектов: - + Address Адрес - + Host Узел - + Firewall Межсетевой экран - + Here you can change type of the objects to be created for each address discovered by the scanner. By default, an "Address" object is created for the host with just one interface with single IP address and "Host" object is created for the host with multiple interfaces, however you can change their types on this page. Сейчас вы можете изменить тип объекта для каждого адреса, найденного сканером. По-умолчанию для узлов с одним интерфейсом и IP-адресом создается объект типа 'Адрес', для узлов с несколькими интерфейсами создается объект типа 'Узел'. @@ -5014,12 +5014,12 @@ Please enter the domain name below: Изменить типы объектов - + Select target library Библиотека для объектов - + Adding new objects to library ... Добавление новых объектов в библиотеку ... @@ -5028,82 +5028,87 @@ Please enter the domain name below: Прочитать файл узлов (формата /etc/hosts) - + TextLabel - + Import configuration of a firewall or a router - + All objects created during import will be placed in the library currently opened in the tree. - + Policy import tries to parse given configuration file and preserve its logic as close as possible. However, very often target firewall configuration allows for more commands, options and their combinations than importer can understand. Rules that importer could not parse exactly are colored red in the rule sets it creates. Always inspect firewall policy created by the importer and compare it with the original. Manual changes and corrections may be required. Comments in the rules that could not be parsed show fragments of the original configuration parser did not understand. - + + Firewall name: + + + + Import from file: - + Browse... - + Cisco IOS - + iptables - + Platform: - + textLabel1 textLabel1 - + < &Back < Назад - + &Next > Дальше > - + &Finish Готово - + &Cancel - + The scanner process normally ignores interfaces that have no IP addresses; checking this option makes it create such interfaces as "Unnumbered" - + Include interfaces with no ip addresses @@ -5120,19 +5125,8 @@ Please enter the domain name below: Используется Firewall Builder API версии %1 - - Evaluation (found invalid license file) - - - - Registered - Зарегистрированая копия программы - - - - Evaluation - + Зарегистрированая копия программы Unregistered @@ -5147,7 +5141,7 @@ Please enter the domain name below: FWBMainWindow_q - + Firewall Builder Firewall Builder @@ -5168,28 +5162,28 @@ Please enter the domain name below: Межсетевые экраны: - + &File Проект - + &Edit Редактировать - + Object Объект - - + + Rules Правила - + &Help Помощь @@ -5198,82 +5192,82 @@ Please enter the domain name below: Панель инструментов - - + + New Object File Создать новый - + &New Object File Создать новый - - - + + + Open Открыть - + &Open... Открыть... - + Ctrl+O Ctrl-O - - - + + + Save Сохранить - + &Save Сохранить - + Ctrl+S Ctrl-S - + Save As Сохранить как - + Save &As... Сохранить как... - + Print Печать - + &Print... Печать... - + Ctrl+P Ctrl-P - + Exit Выход - + E&xit Выход @@ -5302,105 +5296,105 @@ Please enter the domain name below: Ctrl-Y - + Cut Вырезать - + &Cut Вырезать - + Ctrl+X Ctrl-X - + Copy Копировать - + C&opy Копировать - + Ctrl+C Ctrl-C - + Paste Вставить - + &Paste Вставить - + Ctrl+V Ctrl-V - - + + Ctrl+F Ctrl-F - + Contents Содержимое - + &Contents... Содержимое - + Index Содержание - + &Index... Содержание - + About О программе - + &About О программе - - + + New Создать - + Close Закрыть - + &Close Закрыть - - + + Compile Компилировать @@ -5409,8 +5403,8 @@ Please enter the domain name below: Компилировать правила - - + + Install Установить @@ -5419,140 +5413,121 @@ Please enter the domain name below: Установить набор правил - - + + Back Назад - - + + Move back to the previous object Вернуться к предидущему объекту - + New Object Создать объект - + &New Object Создать объект - + Create New Object Создать новый объект - + Ctrl+N Ctrl-N - + Find Object Найти объект - + &Find Object Найти объект... - - + + Find object in the tree Поиск объекта по дереву - + Preferences... Настройки... - + P&references... Настройки... - + Edit Preferences Редактировать настройки - - Insert Rule - Вставить правило + Вставить правило - - Move Rule Up - Переместить правило выше + Переместить правило выше - - Move Rule Down - Переместить правило ниже + Переместить правило ниже - - Add Rule Below - Добавить правило ниже + Добавить правило ниже - - Remove Rule - Удалить правило + Удалить правило - Ctrl+Del - Ctrl-Del + Ctrl-Del - - Copy Rule - Копировать правило + Копировать правило - - Cut Rule - Вырезать правило + Вырезать правило - - Paste Rule Above - Вставить правило выше + Вставить правило выше - - Paste Rule Below - Вставить правило ниже + Вставить правило ниже - + Add File to RCS Добавить файл в систему контроля версий - + Add File to &RCS Добавить файл в систему контроля версий - - + + Delete Удалить @@ -5561,17 +5536,17 @@ Please enter the domain name below: Del - + Export Library To a File Экспортировать библиотеку в файл - + &Export Library Экспортировать библиотеку - + Import Library From a File Импортировать библиотеку из файла @@ -5580,12 +5555,12 @@ Please enter the domain name below: Импортировать библиотеку - + Debug Отладка - + &Debug Отладка @@ -5594,23 +5569,21 @@ Please enter the domain name below: Свойства - - Move Selected Rules - Переместить выбранные правила + Переместить выбранные правила - + Discard Отменить изменения - + &Discard Отменить изменения - + Discard Changes and Overwrite With Clean Copy Of The Head Revision From RCS Отменить изменения и перезаписать копией из основной ветки системы контроля версий @@ -5619,164 +5592,193 @@ Please enter the domain name below: Применить - + Show File Properties Показать свойства файла - + Commit Принять изменения - + Commit Opened File to RCS and Continue Editing Принять изменения открытого файла в систему контроля версия и продолжить редактирование - - + + Lock Заблокировать - - + + Unlock Разблокировать - - Discovery Druid - Менеджер получения информации + Менеджер получения информации - - + + new item новый элемент - + Tools Утилиты - + Co&mmit Записать в систему контроля ревизий - - + + Find Conflicting Objects in Two Files Найти конфликтующие объекты в двух файлах - + Import Po&licy Импортировать правила из файла - + Window Окно - + Import &Library Импортировать библиотеку - - + + Propert&ies Свойства - + Ctrl+I - + Import Policy Импортировать правила из файла - + Open Recent - + Firewall Builder Help - + Clear Menu - + Find - + Editor - + Help Справка - + + Tutorial + + + + View - + + + Object Discovery + + + + Release Notes - + Object Tree - + + Summary of features + + + + + Getting started + + + + + Inspect + Инспектировать + + + Output - - + + Undo Stack - - + + Compile rules of all firewall and cluster objects - - + + Install firewall policy of all firewall and cluster objects - + + Ctrl+T + + + + Editor Panel @@ -5784,27 +5786,27 @@ Please enter the domain name below: FWObjectDropArea - + Drop object here. Поместить объект сюда. - + Paste Вставить - + Delete Удалить - + Show in the tree - + Edit @@ -5996,7 +5998,7 @@ shell utilities installed on your machine using Preferences dialog Определите в настройках программы пути к утилитам scp и ssh. - + &Continue Компилировать @@ -6036,18 +6038,23 @@ Do you want to recompile it before you install ? Объекты - + + Print configuration of %1 + + + + Printing... - - + + Printing aborted Печать отменена - + Printing completed Печать завершена @@ -6126,36 +6133,41 @@ objects that they refer to moved in it: Маршрутизация - + Printing cancelled Printing <ed - + A new version of Firewall Builder is available at http://www.fwbuilder.org Новая версия программы может быть загружена с http://www.fwbuilder.org - + Open File - + Ctrl+Z - + Ctrl+Y - + Shift+Ctrl+Z + + + File '%1' does not exist or is not readable + + FilterDialog @@ -6301,24 +6313,24 @@ objects that they refer to moved in it: FindObjectWidget - + Search hit the end of the policy rules. Поиск по набору правил завершен. - - + + &Continue at top Продолжить с начала - - + + &Stop ОК - + Search hit the end of the object tree. Поиск по дереву объектов завершен. @@ -6331,32 +6343,32 @@ objects that they refer to moved in it: Невозможно заменить объект на самого себя. - + Search and Replace objects are incompatible. Объекты для поиска и замены разных типов. - + Replaced %1 objects. Заменен объект %1. - + Policy of firewall ' Набор правил межесетевого экрана ' - + Search object is missing. - + Replace object is missing. - + Cannot replace object with itself. @@ -6414,44 +6426,67 @@ objects that they refer to moved in it: %1 "%2" / Правило %3 / %4 + + FirewallCodeViewer_q + + + Firewall code viewer + + + + + Firewall / ruleset + Межсетевой экран / набор правил + + + + File: + + + + + Close + + + FirewallDialog - - + + FWBuilder API error: %1 Ошибка API FWBuilder: %1 - - - - + + + + &Continue Продолжить - + The name of the object '%1' has changed. The program can also rename IP address objects that belong to this object, using standard naming scheme 'host_name:interface_name:ip'. This makes it easier to distinguish what host or a firewall given IP address object belongs to when it is used in the policy or NAT rule. The program also renames MAC address objects using scheme 'host_name:interface_name:mac'. Do you want to rename child IP and MAC address objects now? (If you click 'No', names of all address objects that belong to %2 will stay the same.) - + &Yes Да - + &No Нет - + Platform setting can not be empty - + Host OS setting can not be empty @@ -6459,7 +6494,7 @@ objects that they refer to moved in it: FirewallDialog_q - + Firewall Межсетевой экран @@ -6468,7 +6503,7 @@ objects that they refer to moved in it: Основное - + Name: Название: @@ -6477,32 +6512,32 @@ objects that they refer to moved in it: Библиотека: - + Comment: Комментарий: - + Firewall Settings ... Настройка параметров межсетевого экрана... - + Host OS Settings ... Настройка параметров операционной системы... - + Platform: Тип межсетевого экрана: - + Version: Версия межсетевого экрана: - + Host OS: Операционная система межсетевого экрана: @@ -6543,34 +6578,34 @@ objects that they refer to moved in it: Применить - + Inactive firewall Неактивный межсетевой экран - + Skip this firewall for batch compile and install operations Пропускать этот межсетевой экран при пакетной компиляции и/или установке - + Modified: - - - + + + TextLabel - + Compiled: - + Installed: @@ -6578,17 +6613,17 @@ objects that they refer to moved in it: FirewallInstaller - + Generated script file %1 not found. Сгенерированный компилятором файл %1 не найден. - + &Continue - + Copying %1 -> %2:%3 Копируется файл %1 -> %2:%3 @@ -6673,32 +6708,32 @@ objects that they refer to moved in it: Свойства - + Open Открыть - + Edit Редактировать - + Copy Копировать - + Cut Вырезать - + Paste Вставить - + Delete Удалить @@ -6757,17 +6792,17 @@ objects that they refer to moved in it: HelpView_q - - MainWindow - + + Help + Справка - + Object Name Название объекта - + Close @@ -7019,28 +7054,28 @@ objects that they refer to moved in it: IPv4Dialog - + Illegal IP address '%1' Некорректный IP адрес %1 - - + + &Continue Продолжить - + Illegal netmask '%1' Некорректная маска подсети %1 - + DNS lookup failed for both names of the address object '%1' and the name of the host '%2'. Не удалось получить данные используя DNS запрос как для адреса %1, так и для имени %2. - + DNS lookup failed for name of the address object '%1'. Не удалось получить имя используя DNS запрос для адреса %1. @@ -7048,12 +7083,12 @@ objects that they refer to moved in it: IPv4Dialog_q - + IPv4 IPv4 - + Name: Название: @@ -7062,17 +7097,17 @@ objects that they refer to moved in it: Библиотека: - + Comment: Комментарий: - + Address: Адрес: - + Netmask: Маска подсети: @@ -7081,7 +7116,7 @@ objects that they refer to moved in it: Применить - + DNS Lookup... Получить имя через DNS запрос... @@ -7093,28 +7128,28 @@ objects that they refer to moved in it: IPv6Dialog - + Illegal IP address '%1' Неверный IP адрес '%1' - - + + &Continue Продолжить - + Illegal netmask '%1' Неверная маска '%1' - + DNS lookup failed for both names of the address object '%1' and the name of the host '%2'. DNS запрос не сработал и для имени объекта '%1' и для имени хоста '%2'. - + DNS lookup failed for name of the address object '%1'. DNS запрос не сработал для имени объекта '%1'. @@ -7122,7 +7157,7 @@ objects that they refer to moved in it: IPv6Dialog_q - + IPv6 IPv6 @@ -7131,27 +7166,27 @@ objects that they refer to moved in it: Адрес IPv6 - + Name: Имя: - + Address: Адрес: - + Network (bit length) Сеть (длина в битах) - + DNS Lookup... Опеределить адрес при помощи DNS... - + Comment: Комментарий: @@ -7159,44 +7194,39 @@ objects that they refer to moved in it: InterfaceDialog - + Group: Группа: - + Network: Подсеть: - - Interface name can not contain white space and '-' - - - - - - + + + &Continue - + The name of the interface '%1' has changed. The program can also rename IP address objects that belong to this interface, using standard naming scheme 'host_name:interface_name:ip'. This makes it easier to distinguish what host or a firewall given IP address object belongs to when it is used in the policy or NAT rule. The program also renames MAC address objects using scheme 'host_name:interface_name:mac'. Do you want to rename child IP and MAC address objects now? (If you click 'No', names of all address objects that belong to interface '%2' will stay the same.) - + &Yes Да - + &No Нет - + FWBuilder API error: %1 Ошибка API FWBuilder: %1 @@ -7349,34 +7379,39 @@ Security level can be any number between 0 and 100, 0 being least secure and 100 - - + + Remove - + Failover protocol %1 does not require IP address for interface %2 - + Failover protocol %1 requires an IP address for interface %2 - - Empty addrres or netmask field + + Empty address or netmask field - + + Add another address + + + + Invalid address '%1/%2' - - + + Invalid netmask '%1/%2' @@ -7391,62 +7426,63 @@ Security level can be any number between 0 and 100, 0 being least secure and 100 - + Label: - + Comment: - - MAC: - - - - + Type: - + Regular interface - + Dynamic address - + Unnumbered interface - + + MAC address: + + + + Protocol: - + Address - + Netmask - + Type Тип - + + Add address @@ -7752,26 +7788,26 @@ objects that they refer to moved in it: NetworkDialog - + Illegal IP address '%1' Некорректный IP адрес %1 - - - - + + + + &Continue Продолжить - - + + Illegal netmask '%1' Некорректная маска подсети %1 - + Network object should not have netmask '0.0.0.0' @@ -7779,18 +7815,18 @@ objects that they refer to moved in it: NetworkDialogIPv6 - + Illegal IPv6 address '%1' Некорректный IPv6 адрес '%1' - - + + &Continue Продолжить - + Illegal netmask '%1' Некорректная маска подсети '%1' @@ -7862,18 +7898,18 @@ objects that they refer to moved in it: ObjConflictResolutionDialog - + Keep current object Сохранить текущий объект - + Replace with this object Заменить объектом - - + + Delete Удалить @@ -7886,19 +7922,19 @@ objects that they refer to moved in it: Объект <b> %1 </b> в файле %2 - - + + Object '%1' has been deleted Объект '%1' был удален - + Object '%1' in the objects tree Объект '%1' в дереве объектов - - + + Object '%1' in file %2 Объект '%1' в файле '%2' @@ -7906,40 +7942,40 @@ objects that they refer to moved in it: ObjConflictResolutionDialog_q - + Conflict Resolution Разрешение конфликта - + There is a conflict between an object in your tree and object in the file you are trying to open. Choose which version of this object you want to use: Версии объекта в дереве и в открываемом файле конфликтуют. Выберите, какую версию объекта следует использовать: - + Current Object Текущий объект - + Keep current object Сохранить текущий объект - - + + Always choose this object if there is a conflict Всегда выбирать этот объект в случае конфликта - + New Object Создать объект - + Replace with this object Заменить следующим объектом @@ -8008,7 +8044,7 @@ Do you want to save it ? Объектный манипулятор - + New &Library Новая библиотека @@ -8342,7 +8378,12 @@ Do you still want to delete library %1? Найти где этот объект используется - + + Inspect + Инспектировать + + + Lock Заблокировать @@ -8438,28 +8479,28 @@ Do you want to rename child IP and MAC address objects now? Добавить группу синхронизации состояния - - + + Transfer Перенос конфигурации - + Create and add to group - + Cluster host OS %1 does not support state synchronization Операционная система %1 кластера не поддерживает синхронизацию состояния - + State Sync Group Группа синхронизации состояния - + Failover group Группа отказоустойчивости @@ -8586,12 +8627,12 @@ p, li { white-space: pre-wrap; } ObjectTreeView - + Object Объект - + Attributes Атрибуты @@ -8673,7 +8714,7 @@ p, li { white-space: pre-wrap; } PrefsDialog - + Find working directory Определить рабочий каталог @@ -8682,7 +8723,7 @@ p, li { white-space: pre-wrap; } Определить утилиту scp - + Find Secure Shell utility Определить утилиту ssh @@ -8695,23 +8736,23 @@ p, li { white-space: pre-wrap; } Выберите цвет - + Your version of Firewall Builder is up to date. Вы используете послднюю версию программы. - + A new version of Firewall Builder is available at http://www.fwbuilder.org Новая версия программы может быть загружена с http://www.fwbuilder.org - + Error checking for software updates: %1 Произошла ошибка во время проверки версии программы: %1 - + Find SCP utility Найти утилиту scp @@ -8742,10 +8783,61 @@ p, li { white-space: pre-wrap; } ProjectPanel - + No firewalls defined Нет ни одного межсетевого экрана + + + Cancel + + + + + Compile and Inspect files + + + + + + and + + + + + Firewall objects %1 have been modified and need to be recompiled. + + + + + Firewall object "%1" has been modified and needs to be recompiled. + + + + + %1 firewall objects have been modified and need to be recompiled. + + + + + Can not read generated files for the firewall objects %1. You need to compile them to create the files. + + + + + Can not read generated files for the firewall objects %1. You need to compile it to create the files. + + + + + Can not read generated files for the %1 firewall objects. You need to compile then to create the files. + + + + + <b>Multiple firewalls</b> + + Building branch policy view '%1'... Строится представление ветки набора правил '%1' ... @@ -8763,45 +8855,47 @@ p, li { white-space: pre-wrap; } Строится представление маршрутизации ... - + + &Save Сохранить - + &Discard Отбросить изменения - - + + + &Cancel Отмена - + FWB Files (*.fwb);;All Files (*) - + The file %1 already exists. Do you want to overwrite it ? Файл %1 уже существует.\nПереписать ? - + &Yes Да - + &No Нет - - + + Choose name and location for the new file Выберите имя и папку для нового файла @@ -8810,7 +8904,7 @@ Do you want to overwrite it ? Данные записываются в файл... - + Choose name and location for the file Выберите имя и папку для размещения файла @@ -8825,64 +8919,64 @@ All changes will be lost if you do this. Эта операция отбрасывает все изменения сохраненные в файл\nданных до сих пор, закрывает его и заменяет его\nчистой копией самой последней ревизии из RCS.\n\nВсе изменения сделанные до сих пор будут потеряны. - + &Discard changes Отбросить изменения - + File %1 has been added to RCS. Файл %1 добавлен в систему контроля ревизий (RCS). - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + &Continue Продолжать - + Error adding file to RCS: %1 Произошла ошибка во время добавления файла в RCS: %1 - + (read-only) (только для чтения) - - + + Loading system objects... Загрузка системных объектов... - + Error loading file: %1 Произошла ошибка во время загрузки файла: %1 - + Reading and parsing data file... Чтение и обработка файла данных... - + Merging with system objects... Смешивание с системными объектами... @@ -8901,113 +8995,113 @@ Choose a different name for the new file. Операция открытия файла была отменена, поэтому файл не был изменен. - + Exception: %1 Ошибка: %1 - + Failed transformation : %1 Трансформации которые не сработали: %1 - + XML element : %1 Элемент XML: %1 - + Building object tree... Построение дерева объектов... - + Indexing... Индексация... - + Checking file %1 in RCS Добавление файла %1 в систему контроля версий - + Error checking in file %1: %2 Поиск ошибок в файле %1: %2 - + Saving data to file %1 - + File is read-only Файл только для чтения - + Error saving file %1: %2 Ошибка сохранения файла %1: %2 - - + + Error loading file %1: %2 Ошибка загрузки файла %1: %2 - + Choose a file to import Выберите файл для импорта - + This operation inspects two data files (either .fwb or .fwl) and finds conflicting objects. Conflicting objects have the same internal ID but different attributes. Two data files can not be merged, or one imported into another, if they contain such objects. This operation also helps identify changes made to objects in two copies of the same data file.<br><br>This operation does not find objects present in one file but not in the other, such objects present no problem for merge or import operations.<br><br>This operation works with two external files, neither of which needs to be opened in the program. Currently opened data file is not affected by this operation and objects in the tree do not change.<br><br>Do you want to proceed ? - + Choose the first file - + Choose the second file - + Total number of conflicting objects: %1. Do you want to generate report? - + Choose name and location for the report file - + TXT Files (*.txt);;All Files (*) - + Can not open report file for writing. File '%1' - + Unexpected error comparing files %1 and %2: %3 - + A library that you are trying to export contains references to objects in the other libraries and can not be exported. The following objects need to be moved outside of it or @@ -9015,48 +9109,48 @@ objects that they refer to moved in it: - + Please select a library you want to export. - + Untitled - - + + (Long error message was truncated) - + The program encountered error trying to load file %1. The file has not been loaded. Error: %2 - - + + The program encountered error trying to load data file. The file has not been loaded. Error: %1 - + Load operation cancelled and data file revertedto original version. - + Searching for firewalls affected by the change... Поиск межсетевых экранов, на которые повлияет изменение ... - + Firewall Builder uses file extension '.fwb' and needs to rename old data file '%1' to '%2', but file '%3' already exists. @@ -9064,13 +9158,13 @@ Choose a different name for the new file. - + Firewall Builder uses file extension '.fwb'. Your datafile '%1' has been renamed '%2' - + This operation discards all changes that have been saved into the file so far, closes it and replaces it with a clean copy of its head revision from RCS. All changes will be lost if you do this. @@ -9080,7 +9174,7 @@ All changes will be lost if you do this. ProjectPanel_q - + Form Форма @@ -9109,30 +9203,46 @@ All changes will be lost if you do this. Закрыть - + Firewall / ruleset Межсетевой экран / набор правил - - - + + + Compile this firewall Компилировать этот межсетевой экран - - + + + + Insert rule + + + + + + + ... ... - - - + + + Compile and install this firewall Компилировать и инсталлировать этот межсетевой экран + + + + + Inspect generated files + + QApplication @@ -9598,12 +9708,12 @@ Check path and filename. QObject - + - + - + No change Без изменений @@ -9611,12 +9721,12 @@ Check path and filename. - + - + - + On Включить @@ -9624,12 +9734,12 @@ Check path and filename. - + - + - + Off Выключить @@ -9648,56 +9758,187 @@ because of incompatible type. из-за несовместимости типов объектов. - - + + New Library Новая библиотека - - + objects объекты - - + + protocol: %1 протокол: %1 - - + + type: %1 тип: %1 - - + + code: %1 код: %1 - + + + Type: + Тип: + + + + Members: + + + + + %1 objects + + + + + Label: %1 + + + + + Addresses: + + + + + Address: + + + + %1 objects<br> %1 объекты<br> - + protocol протокол - - - + + Stateless + + + + + Stateful + + + + + + Log prefix: + + + + + Log Level: + + + + + Netlink group: + + + + + connlimit value: + + + + + Part of Any + + + + + Log facility: + + + + + + Log level: + + + + + Send 'unreachable' + + + + + Keep information on fragmented packets + + + + + Max state: + + + + + Force 'keep-state' + + + + + Source tracking + + + + + Max src nodes: + + + + + Max src states: + + + + + Add mirrored rule + + + + + Version: + + + + + Log interval: + + + + + Disable logging for this rule + + + + + type: тип: - + code: код: @@ -9730,7 +9971,7 @@ because of incompatible type. * операционная система межсетевого экрана: %1 - + * Loading configuration from file %1 * Загружаю конфигурацию из файла %1 @@ -9739,12 +9980,12 @@ because of incompatible type. * Последовательная установка - + * Configuration diff will be saved in file %1 * Различия в конфигурации будут сохранены в файле %1 - + * Commands will not be executed on the firewall * Команды не будут выполняться на межсетевом экране @@ -9765,31 +10006,34 @@ because of incompatible type. Не могу открыть файл %1 - Library %1: Firewall '%2' (global policy rule #%3) uses object '%4' from library '%5' - Библиотека %1: Межсетевой экран %2 (правило в наборе #%3) использует объект %4 из библиотеки %5 + Библиотека %1: Межсетевой экран %2 (правило в наборе #%3) использует объект %4 из библиотеки %5 Library %1: Firewall '%2' (interface %3 policy rule #%4) uses object '%5' from library '%6' Библиотека %1: Межсетевой экран %2 (правило интерфейса %3 в наборе #%4) использует объект %5 из библиотеки %6 - Library %1: Firewall '%2' (NAT rule #%3) uses object '%4' from library '%5' - Библиотека %1: Межсетевой экран %2 (правило NAT в наборе #%3) использует объект %4 из библиотеки %5 + Библиотека %1: Межсетевой экран %2 (правило NAT в наборе #%3) использует объект %4 из библиотеки %5 - + + Library %1: Firewall '%2' (%3 rule #%4) uses object '%5' from library '%6' + + + + Library %1: Group '%2' uses object '%3' from library '%4' Библиотека %1: Группа %2 использует объект %3 из библиотеки %4 - + File is read-only Файл доступен только для чтения - + Error saving file %1: %2 Ошибка сохранения файла %1: %2 @@ -9803,54 +10047,62 @@ because of incompatible type. - + + 0 - System Unusable 0 - System Unusable - + + 1 - Take Immediate Action 1 - Take Immediate Action - + + 2 - Critical Condition 2 - Critical Condition - + + 3 - Error Message 3 - Error Message - + + 4 - Warning Message 4 - Warning Message - + + 5 - Normal but significant condition 5 - Normal but significant condition - + + 6 - Informational 6 - Informational - + + 7 - Debug Message 7 - Debug Message - + - any - любая @@ -9859,7 +10111,14 @@ because of incompatible type. 1.2.9 или старше - + + + + RCS tools are unavailable + + + + Fatal error during initial RCS checkin of file %1 : %2 Exit status %3 @@ -9868,12 +10127,12 @@ Exit status %3 Код возврата %3 - + Fatal error running rlog for %1 Фатальная ошибка при выполнении rlog для %1 - + Fatal error running rcsdiff for file %1 Фатальная ошибка при выполнении rcsdiff для файла %1 @@ -9892,13 +10151,13 @@ part of the tee or data file was opened read-only в части или файле, доступных только для чтения - - + + &Continue Продолжить - + Object with name '%1' already exists, please choose different name. Объект с именем %1 уже существует. Выберите другое имя. @@ -9907,39 +10166,39 @@ part of the tee or data file was opened read-only Продолжить редактирование - + <b>Library:</b> <b>Библиотека:</b> - + <b>Object Id:</b> <b>Идентификатор объекта:</b> - + <b>Object Type:</b> <b>Тип объекта:</b> - + <b>Object Name:</b> <b>Имя Объекта:</b> - + Working directory %1 does not exist and could not be created. Ignoring this setting. Рабочий каталог %1 не существует и не может быть создан. Этот параметр будет проигнорирован. - + ERROR ОШИБКА - + OK OK @@ -9977,12 +10236,12 @@ Builder GUI and save back to file again. Дублированная библиотека %1 - + 1.2.5 or earlier 1.2.5 или младше - + 1.2.6 to 1.2.8 с 1.2.6 по 1.2.8 @@ -10033,19 +10292,19 @@ Are you sure you want to open it? Серый - + Firewall Межсетевой экран - + Host Узел - + Address @@ -10057,15 +10316,15 @@ Are you sure you want to open it? Диапазон адресов - + - - + + Interface Интерфейс - + Network Подсеть @@ -10076,258 +10335,258 @@ Are you sure you want to open it? Группа объектов - + Library - + Cluster - + Network IPv6 Сеть IPv6 - + Address IPv6 Адрес IPv6 - + DNS Name DNS имя - + Address Table Таблица адресов - + Address Range Диапазон адресов - + Object Group Группа объектов - + Custom Service Пользовательский сервис - + IP Service IP сервис - + ICMP Service ICMP сервис - + ICMP6 Service ICMPv6 сервис - + TCP Service TCP сервис - + UDP Service UDP сервис - + TagService Сервис ярлыков - + User Service Сервис имени пользователя - + Service Group Группа сервисов - + MAC Address MAC адрес - + Policy Rule Set - + NAT Rule Set - + Routing Rule Set - + Failover group Группа отказоустойчивости - + State synchronization group - + New Firewall Новый межсетевой экран - + New Cluster Новый кластер - + New Host - + New Interface Новый интерфейс - + New Network Новая подсеть - + New Network IPv6 Новая сеть IPv6 - + New Address Новый адрес - + New Address IPv6 Новый адрес IPv6 - + New DNS Name Новое DNS имя - + New Address Table Новая таблица адресов - + New Address Range Новый диапазон адресов - + New Object Group Новая группа объектов - + New Custom Service Новый пользовательский сервис - + New IP Service - + New ICMP Service - + New ICMP6 Service Новый сервис ICMPv6 - + New TCP Service - + New UDP Service - + New TagService Новый сервис пометок - + New User Service Новый сервис "имя пользователя" - + New Service Group Новая группа сервисов - + New MAC Address - + New Policy Rule Set - + New NAT Rule Set - + New Routing Rule Set - + New failover group - + New state synchronization group @@ -10337,8 +10596,8 @@ Are you sure you want to open it? Группа сервисов - - + + Time Interval Интервал времени @@ -10382,42 +10641,42 @@ Are you sure you want to open it? Сетевая трансляция адресов (NAT) - - - - + + + + Support module for %1 is not available Модуль поддержки %1 не доступен - + DNS record: DNS запись: - + Address Table: Таблица адресов: - + <b>DNS record:</b> <b>DNS запись:</b> - - + + Run-time Во время выполнения - - + + Compile-time Во время компиляции - + <b>Table file:</b> <b>Файл с таблицей:</b> @@ -10426,7 +10685,8 @@ Are you sure you want to open it? <b>Путь:</b> - + + Pattern: "%1" Образец: "%1" @@ -10435,24 +10695,21 @@ Are you sure you want to open it? <b>Действие :</b> - + <b>Parameter:</b> <b>Параметр:</b> - <b>Log prefix :</b> - <b>Log prefix :</b> + <b>Log prefix :</b> - <b>Log Level :</b> - <b>Log level :</b> + <b>Log level :</b> - <b>Netlink group :</b> - <b>Группа netlink :</b> + <b>Группа netlink :</b> <b>Limit Value :</b> @@ -10463,157 +10720,100 @@ Are you sure you want to open it? <b>Суффикс предела :</b> - <b>Limit burst :</b> - <b>Изменение предела </b> + <b>Изменение предела </b> <li><b>Part of Any</b></li> <li><b>Часть любого</b></li> - - - <li><b>Stateless</b></li> - <li><b>Без фильтрации по состоянию</b></li> + <li><b>Без фильтрации по состоянию</b></li> - <b>Log facility:</b> - <b>Log facility:</b> + <b>Log facility:</b> - - <b>Limit value :</b> - - - - - <b>connlimit value :</b> - - - - - <b>Part of Any</b> - - - - - <b>Stateless</b> - - - - - <b>Log level :</b> - <b>Log level :</b> + <b>Log level :</b> - <li><b>Send 'unreachable'</b></li> - <li><b>Отправить 'недоступен'</b></li> + <li><b>Отправить 'недоступен'</b></li> - <li><b>Keep information on fragmented packets</b></li> - <li><b>Хранить информацию по фрагментированным пакетам</b></li> + <li><b>Хранить информацию по фрагментированным пакетам</b></li> - <b>Log prefix :</b> - <b>Log prefix :</b> + <b>Log prefix :</b> - <b>Max state :</b> - <b>Максимум состояния :</b> + <b>Максимум состояния :</b> - - <li><b>Force 'keep-state'</b></li> - - - - - <li><b>no-sync</b></li> - - - - - <li><b>pflow</b></li> - - - - - <li><b>sloppy-tracker</b></li> - - - - <li><b>Source tracking</b></li> - <li><b>Отслеживание источника</b></li> + <li><b>Отслеживание источника</b></li> - <b>Max src nodes :</b> - <b>Максимум узлов источника :</b> + <b>Максимум узлов источника :</b> - <b>Max src states:</b> - <b>Максимум состояний источника:</b> + <b>Максимум состояний источника:</b> - <u><b>Ver:%1</b></u><br> - <u><b>Версия:%1</b></u><br> + <u><b>Версия:%1</b></u><br> - <b>Log interval :</b> - <b>Интервал журналирования :</b> + <b>Интервал журналирования :</b> - <li><b>Disable logging for this rule</b></li> - <li><b>Выключить протоколирование для этого правила</b></li> + <li><b>Выключить протоколирование для этого правила</b></li> - + use SNAT instead of MASQ<br> - - + + random<br> - + persistent<br> - + bitmask<br> - + source-hash<br> - + round-robin<br> - + static-port<br> @@ -10662,267 +10862,280 @@ Please repair the tree using command 'fwbedit -s -f file.fwb'. - + Aggressive Агрессивный - + Conservative Консервативный - + For high latency Для высокой латентности - + Normal Нормальный - + alert alert - + crit crit - + error error - + warning warning - + notice notice - + info info - + debug debug - + kern kern - + user user - + mail mail - + daemon daemon - + auth auth - + syslog syslog - + lpr lpr - + news news - + uucp uucp - + cron cron - + authpriv authpriv - + ftp ftp - + local0 local0 - + local1 local1 - + local2 local2 - + local3 local3 - + local4 local4 - + local5 local5 - + local6 local6 - + local7 local7 - + ICMP admin prohibited ICMP admin prohibited - + ICMP host prohibited ICMP host prohibited - + ICMP host unreachable ICMP host unreachable - + ICMP net prohibited ICMP net prohibited - + ICMP net unreachable - + ICMP port unreachable ICMP port unreachable - + ICMP protocol unreachable ICMP protocol unreachable - + TCP RST TCP RST - + Route through Маршрутизировать через - + Route reply through Маршрутизировать ответ через - + Route a copy through Маршрутизировать копию через - + + 1.4.1.1 or later + 1.4.0 и старше {1.4.1.1 ?} + + + 4.3 - + 200% {4.3?} - + 4.5 + 200% {4.5?} + + + + 4.6 + 200% {4.6?} + + + + 4.7 and later - - 4.6 and later - - - - + + on top of the script в начало скрипта - + + after interface configuration после конфигурирования интерфейсов - + + after policy reset после удаления страрого набора правил - + /day в день - + /hour в час - + /minute в минуту - + /second в секунду - + 1.2.9 to 1.2.11 с 1.2.9 по 1.2.11 @@ -11011,12 +11224,12 @@ Please repair the tree using command 'fwbedit -s -f file.fwb'.Маршрутизировать - + Firewall Builder can import Cisco IOS access lists from the router configuration saved using 'show run' or any other command that saves running config. The name of the created firewall object, all of its interfaces and their addresses will be configured automatically if this information can be found in the configuration file. - + Firewall Builder can import iptables rules from a file in iptables-save format. Firewall name and addresses of its interfaces need to be configured manually because iptables-save file does not have this information. @@ -11029,58 +11242,58 @@ Please repair the tree using command 'fwbedit -s -f file.fwb'.Некорректный диапазон определен для порта назначения. - - + + None Ничего - + Random Случайный - + Source Hash - + Round Robin - + in the activation shell script - + in the pf rule file, at the very top - + in the pf rule file, after set comamnds - + in the pf rule file, after scrub comamnds - + in the pf rule file, after table definitions - + 3.x 1.3.0 и старше {3.?} - + 3.7 to 3.9 с 3.7 по 3.9 @@ -11089,15 +11302,17 @@ Please repair the tree using command 'fwbedit -s -f file.fwb'.1.3.0 и старше {4.?} - + + User id: "%1" - + Compiling rule sets for firewall: %1 - + Компиляция наборов правил межсетевого экрана: %1 + @@ -11105,60 +11320,60 @@ Please repair the tree using command 'fwbedit -s -f file.fwb'. - + * Running as user : %1 - + * Firewall name : %1 - + * Installer uses user name : %1 - + * Management address : %1 - + * Platform : %1 - + * Host OS : %1 - + Only one interface of the firewall '%1' must be marked as management interface. - + One of the interfaces of the firewall '%1' must be marked as management interface. - + Management interface does not have IP address, can not communicate with the firewall. - + 1.3.x 1.3.0 и старше - + 1.4.0 or later 1.4.0 и старше @@ -11183,278 +11398,274 @@ Please repair the tree using command 'fwbedit -s -f file.fwb'.Пусто - + Source Источник - - + + Destination Назначение - + Service Сервис - + Time Время - + Original Src Оригинальный Источник - + Original Dst Оригинальное Назначение - + Original Srv Оригинальный Сервис - + Translated Src Транслированный Источник - + Translated Dst Транслированное Назначение - + Translated Srv Транслированный Сервис - + Gateway Маршрутизатор - + Direction Направление - + Action Действие - + Options Параметры - + Metric Метрика - + Comment Комментарий - - Group member - - - - + type: %1<br> - + Group member %1:%2<br> - + No firewalls assigned to cluster '%1' - + Type '%1': new object can not be created because corresponding branch is missing in the object tree. Please repair the tree using command 'fwbedit checktree -f file.fwb'. - + Summary: - - - - + + + + + %1 advanced settings - + Bitmask - + 1.4.3 or later 1.4.0 и старше {1.4.3 ?} - + Executing: - + Using transfer agent '%1' - + Appending fw object name to tarball - + Could not transfer %1 config to '%2' - + Edit - + Rename object - - Edit rule options + + Edit protocol parameters - + Edit Rule Action - + Edit Rule Options - + Edit Rule Comment - + insert rule - + delete rules - + delete rules from group - + change rule(s) color - + move rule up - + move rule down - + negate rule element - + remove object(s) from group - + create new group - + add to group above - + add to group below - + Negate - + <b>Action :</b> %1<br> - + Replace object - + Create new %1 - + Create library - + Create new Firewall - + Create new Cluster - + Create new Host @@ -11464,29 +11675,29 @@ Please repair the tree using command 'fwbedit checktree -f file.fwb'.< - + Bound to interfaces - + Floating - + 4.0 to 4.2 с 1.2.9 по 4.2 {4.0 ?} - + Impossible to apply changes because object is located in read-only part of the tree or data file was opened read-only - + Add object to group @@ -11506,17 +11717,71 @@ part of the tree or data file was opened read-only - - - + + + Paste object - + + Lock object + + + + + Unlock object + + + + Create new group + + + Compiler for firewall platform %1 not found + + + + + Original rule combines match of tcp/udp/icmp +protocols with two or more module matches, such as +module 'mark', 'recent' or 'length'. Use additional +branches to implement this complex match. + + + + + Unknown parameter of target REJECT: %1. + + + + + Can not reproduce default action in table 'mangle' chain 'FORWARD'. + + + + + Can not reproduce default action in table 'mangle' chain 'INPUT'. + + + + + + A single interface belonging to this firewall is expected in this field. + + + + + A single ip address is expected here. You may also insert a host or a network adapter leading to a single ip adress. + + + + + A single ip adress is expected here. You may also insert a host or a network adapter leading to a single ip adress. + + QProgressDialog @@ -11574,40 +11839,40 @@ part of the tree or data file was opened read-only RCS - - - + + + Error checking file out: %1 Ошибка при получении файла %1 из системы контроля версий - - - - - + + + + + &Continue Продолжить - + Error creating temporary file Ошибка при создании временного файла - + Error writing to temporary file Ошибка при записи во временный файл - + File is opened and locked by %1. You can only open it read-only. Файл уже открыт и заблокирован %1. Вы можете открыть его только для чтения. - + Revision %1 of this file has been checked out and locked by you earlier. The file may be opened in another copy of Firewall Builder or was left opened after the program crashed. @@ -11616,17 +11881,17 @@ after the program crashed. возможно остался открытым после краха предидущей копии программы. - + Open &read-only Открыть только для чтения - + &Open and continue editing Открыть и продолжить редактирование - + &Cancel Отмена @@ -11802,7 +12067,7 @@ and special characters. RuleOptionsDialog_q - + Rule Options for ipt Опции правила для ipt @@ -11815,43 +12080,43 @@ and special characters. Если действие правила установлено в 'Блокировать с уведомлением', то эта опция определяет ответ межсетевого экрана - - + + Log prefix: Log prefix: - + alert alert - + crit crit - + error error - + warning warning - + notice notice - + info info - + debug debug @@ -11862,9 +12127,9 @@ and special characters. (для ULOG): - - - + + + Log level: Log level: @@ -11901,8 +12166,8 @@ and special characters. TCP RST - - + + Normally policy compiler uses stateful inspection in each rule. Activating next option makes this rule stateless. Отключить фильтрацию по состоянию (stateful) для этого правила. @@ -11916,32 +12181,32 @@ for this rule) (только для этого правила) - - + + Burst: Верхняя граница нормы: - - + + /day в день - - + + /hour в час - - + + /minute в минуту - - + + /second в секунду @@ -11952,14 +12217,14 @@ or less: оно вызывается меньше чем: - - - + + + Stateless rule Правило без фильтрации по состоянию - + Log facility: Log facility: @@ -11981,7 +12246,7 @@ fragments последующими фрагментами - + When this limit is reached, further packets matching the rule that would create state are dropped, until existing states time out. По достижении этого ограничения, пакеты выполняющие условие правила и создающие новую запись в таблице состояний будут блокированы до тех пор, пока существующие записи в таблице состояний не будут удалены по таймауту. @@ -11994,7 +12259,7 @@ fragments Включить отслеживание источника (source tracking) - + When this option is checked, the number of states per source IP is tracked При включении этой опции будет отслеживаться количество состояний на каждый IP источника @@ -12007,7 +12272,7 @@ fragments Максимальное количество записей в таблице состояний на один адрес источника, которое может создать это правило: - + These options are only valid for PIX running software v6.3 or later Эти опции действительны только для межсетевого экрана Cisco PIX версии 6.3 или выше @@ -12017,7 +12282,7 @@ for this rule не протоколировать это правило - + Logging interval: Интервал журналирования: @@ -12034,45 +12299,45 @@ for this rule Считать межсетевой экран частью любого узла (только для этого правила) - - + + General Общие - + Netlink group (if using ULOG): Netlink group (для ULOG): - - - + + + Logging Запись в журнал (протоколирование) - + Rate (rule matches if it hits this often or less): Отношение (условие правила выполняется, если оно вызывается меньше или больше чем): - + Module limit Модуль limit - + limit limit - + bit бит - + per network with netmask of на подсеть с маской @@ -12081,32 +12346,32 @@ for this rule Количество разрешенных соединений на клиентский узел - + Module connlimit Модуль connlimit - + connlimit connlimit - + Module hashlimit Модуль hashlimit - + Rate: Отношение: - + dstip dstip - + srcip srcip @@ -12119,68 +12384,68 @@ for this rule srcip,srcport - + Mode: Режим: - + On some older systems this module has name 'dstlimit'. Check here if you need to use this name. На некоторых старых системах этот модуль имеет имя 'dstlimit'. Пометьте ниже, если вам нужно использовать это имя. - + hashlimit hashlimit - + Send ICMP 'unreachable' packet masquerading as being from the original destination Отправлять пакет ICMP unreachable так, словно он был отправлен оригинальным узлом назначения - + Keep information on fragmented packets, to be applied to later fragments Хранить информацию по фрагментированным пакетам для того, чтобы затем применять ее к следующим фрагментам - + State Tracking - + Force "keep state" to make the rule stateful regardless of the default. - - + + Available in OpenBSD 4.5 and later - + Prevent state changes for states created by this rule from appearing on the pfsync interface. - + States created by this rule are exported on the pflow interface. - + Activate source tracking. - + Maximum number of source addresses which can simultaneously have state table entries (max-src-nodes): Максимальное количество адресов источника, которые могут одновременно иметь записи в таблице состояний (max-src-nodes): - + Maximum number of simultaneous state entries that a single source address can create with this rule (max-src-states): Максимальное количество записей в таблице состояний на один адрес источника, которое может создать это правило (max-src-states): @@ -12189,174 +12454,194 @@ for this rule Отслеживание - + overload table: перегрузка таблицы: - + flush очистить - + Maximum number of simultaneous TCP connections that a single host can make (max-src-conn): Максимальное количество одновременных TCP соединений, которые может создать один узел (max-src-conn): - + global глобально - + The limit of new connections over a time interval (max-src-conn-rate): Максимальное число новых соединений в единицу времени (max-src-conn-rate): - + / в - + sec сек - + Maximum number of concurrent states this rule may create. Unlimited if set to zero (option 'max'). Максимальное число различных состояний, которое может создать это правило. 0 - неограниченно (max). - + Limits Ограничения - + completely disable logging for this rule полностью отключить протоколирование для этого правила - + Name: - - + + Negate - + Match if the number of existing connections is above this (translates into option --connlimit-above) - + htable-size: - + The number of buckets of the hash table (omit this option in generated script if set to 0) - + htable-max: - + Maximum number of entries in the hash (omit this option in generated script if set to 0) - + htable-expire: - + After how many milliseconds do hash entries expire (omit this option in the generated script if set to 0) - + htable-gcinterval: - + How many milliseconds between garbage collection intervals (omit this option in generated script if set to 0) - + Options below control size of the hash table and expiration time. They will be omitted from the generated script if set to zero. - + + Compiler can automatically create a rule with mirrored source and destination addresses and service fields. This can be used to match "reply" packets using address and service parameters matched by this rule. The action of the mirrored rule is the same as that of this one. Firewall Builder recognizes the following services and creates "mirrored" versions as follows: + + + + + * UDP service: mirrored service has source and destination port ranges reversed + * TCP service: mirrored service has source and destination port ranges reversed and "established" flag inverted. If TCP service used in this rule does not have "established" flag, the mirrored service gets it, and the other way around. This is designed to simplify creating ACL rules to permit "reply" TCP packets + * ICMP service: ICMP echo request is recognized, mirrored service becomes ICMP echo reply. Other ICMP types are simply copied to the mirrored service + * ICMPv6 service: like with ICMP, ICMP echo request is recognized and other ICMPv6 types are just copied + * IP service: mirrored service is a copy + + + + + + Add mirror rule + + + + There are no options for this firewall platform - + srcport - + dstport - + TCP - + Modulate state - + synproxy - + Use sloppy TCP state tracker for this rule - + Assume firewall is part of "any" for this rule only: - + Follow global setting - + On - + Off - - + + Normally policy compiler uses stateful inspection in each rule. Activating this option makes this rule stateless. @@ -12364,12 +12649,12 @@ for this rule RuleSetDialog - + Rule set name '%1' is invalid. Only '[a-z][A-Z][0-9]_-+=@%^' characters are allowed. - + &Continue @@ -12377,7 +12662,7 @@ for this rule RuleSetDialog_q - + On iptables "top" rule set goes into the built-in chains INPUT, OUTPUT, FORWARD; if this flag is unchecked, @@ -12387,14 +12672,14 @@ the rule set. - + If this flag is unchecked, rules go into anchor with the name the same as the name of the rule set. - + If this flag is unchecked, generated access list will not be assigned to interfaces with "ip access-group" @@ -12468,46 +12753,46 @@ access access lists generated for it. Исходный - - + + Insert Rule Вставить правило - + Paste Rule Вставить правило из буфера обмена - - - - + + + + Edit Редактировать - + Copy Копировать - + Cut Вырезать - + Paste Вставить из буфера обмена - + Delete Удалить - + Negate Отрицание @@ -12524,17 +12809,18 @@ access access lists generated for it. Цветовая метка: - + Add Rule Below Добавить правило ниже - + + Remove Rule Удалить правило - + Remove Rules Удалить правила @@ -12547,77 +12833,79 @@ access access lists generated for it. Переместить правила - + Copy Rule Копировать правило - + Cut Rule Вырезать правило - + Paste Rule Above Вставить правило выше - + Paste Rule Below Вставить правило ниже - + + Enable Rule Включить правило - + Enable Rules Включить правила - + + Disable Rule Отключить правило - + Disable Rules Отключить правила - + Change direction - + Change action - + Change logging - + delete - + Copy object '%1' to clipboard' - + cut - + Move object @@ -12646,32 +12934,32 @@ access access lists generated for it. Учитывать - + Inbound Входящее - + Outbound Исходящее - + Both Оба - + Rule Options Опции правила - + Logging On Включить протоколирование - + Logging Off Отключить протоколирование @@ -12684,106 +12972,105 @@ access access lists generated for it. Все - + Parameters Параметры - + Reveal in tree Показывать в дереве - + Where used Используется - + Change color - + No color - - + + Enter group name: - + New group - - + Add to the group - + Remove from the group - + Rename group - + Compile rule - - + + Move Rule up - + Move Rules up - - + + Move Rule down - + Move Rules down - + Enable rule - + Disable rule - + New Group Новая группа - + Add new rule on top - + Add new rule at the bottom @@ -12791,22 +13078,32 @@ access access lists generated for it. RuleSetViewDelegate - + + log + + + + + (options) + + + + Any Любой - + Original - + Default По-умолчанию - + All Все @@ -12856,12 +13153,12 @@ access access lists generated for it. - + Rule %1 - + End Конец @@ -13015,7 +13312,17 @@ Logged in Работа программы ssh была прервана, код возврата: %1 - + + Stopping background process + + + + + Background process is still running. Will wait %1 sec + + + + SSH session terminated, exit status: %1 SSH сессия прервалась, статус выхода: %1 @@ -13035,40 +13342,40 @@ Logged in - + New RSA key Новый RSA ключ - + Yes Да - + No Нет - + Error in SSH Вход произведен - + Done Завершено - + *** Fatal error : *** Критическая ошибка: - + Logged in Произведен вход @@ -13153,27 +13460,46 @@ Logged in StartTipDialog_q - + Do not show this again - + Close - + Welcome to Firewall Builder Добро пожаловать в Firewall Builder - + + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> +<html><head><meta name="qrichtext" content="1" /><style type="text/css"> +p, li { white-space: pre-wrap; } +</style></head><body style=" font-family:'Sans Serif'; font-size:9pt; font-weight:400; font-style:normal;"> +<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><span style=" font-family:'Lucida Grande'; font-size:28pt;">Firewall Builder %1</span></p></body></html> + + + + + Watch Getting Started Tutorial + + + + + Summary of features + + + + Previous Tip - + Next Tip @@ -13465,6 +13791,34 @@ by the target firewall platform + + TutorialDialog_q + + + Tutorial + + + + + Reset + + + + + Previous + + + + + Next + Следующий + + + + Close + + + UDPServiceDialog_q @@ -13540,6 +13894,32 @@ by the target firewall platform + + WorkflowIcons_q + + + Form + Форма + + + + Create new +firewall + + + + + Import existing +configuration + + + + + Watch "Getting +Started" tutorial + + + askRuleNumberDialog_q @@ -13651,84 +14031,84 @@ by the target firewall platform clusterMembersDialog_q - + cluster member configuration - + Help Справка - + &OK - + &Cancel - + Cluster - + Manage member firewalls for this Cluster. Firewalls are considered valid members if they have the same host OS and platform as the Cluster object. They also need to have at minimum one physical interface attached. - + Available Firewalls: - + Tree of potential cluster members. Select an interface to assign to the cluster. - + Firewall - - + + Interface - + Label - - + + ... ... - + Selected as Cluster-Members: - + Table of already selected member firewalls with their assigned cluster interfaces. - + Name - + Master @@ -13779,12 +14159,12 @@ by the target firewall platform conntrackOptionsDialog - + Invalid IP address '%1' - + &Continue @@ -13792,32 +14172,37 @@ by the target firewall platform conntrackOptionsDialog_q - + conntrack protocol settings - + &OK - + &Cancel - + conntrack Parameters - + + Use unicast address for conntrackd + + + + Address: - + Port number (udp): @@ -14201,97 +14586,97 @@ by the target firewall platform freebsdAdvancedDialog_q - + FreeBSD: advanced settings FreeBSD: расширенные настройки - + &OK OK - + &Cancel Отмена - + Options Опции - + Forward source routed packets Маршрутизировать пакеты с маршрутизацией источника - + Generate ICMP redirects Отправлять ICMP redirect-ы - - + + Packet forwarding Маршрутизация пакетов - - - - + + + + No change Без изменений - - - - + + + + On Включить - - - - + + + + Off Выключить - + Path Путь - + ipf: ipf: - + ipnat: ipnat: - + sysctl: sysctl: - + Specify directory path and a file name for the following utilities on the OS your firewall machine is running. Leave these empty if you want to use default values. Укажите полный путь к перечисленным утилитам в операционной системе этого межсетевого экрана. Для незаполненных полей будут использованы значения по-умолчанию. - + ipfw: ipfw: - + pfctl: @@ -14374,19 +14759,84 @@ will add policy rules to permit these automatically. Не найден файл %1. - - <p align="center"><b><font size="+2">Select firewalls to compile.</font></b></p> + + Select firewalls to compile. - - - - - + + No files were generated, there is nothing to show. + + + + + <b>Multiple firewalls</b> + + + + + + + + &Continue Продолжить + + + Last error: + + + + + The process failed to start + + + + + The process crashed some time after starting successfully. + + + + + The last waitFor...() function timed out. Elapsed time: %1 ms + + + + + An error occurred when attempting to write to the process. + + + + + An error occurred when attempting to read from the process. + + + + + An unknown error occurred. + + + + + Current state of QProcess: + + + + + The process is not running. + + + + + The process is starting, but the program has not yet been invoked. + + + + + The process is running and is ready for reading and writing. + + Copying %1 -> %2 @@ -14452,12 +14902,13 @@ Copying %1 -> %2:%3 - + Success Успешно - + + Error Ошибка @@ -14468,12 +14919,12 @@ Copying %1 -> %2:%3 - + Error: Failed to start program Ошибка: не могу запустить программу - + Policy installer uses Secure Shell to communicate with the firewall. Please configure directory path to the secure shell utility installed on your machine using Preferences dialog @@ -14486,7 +14937,7 @@ installed on your machine using Preferences dialog Набор правил для межсетевого экрана не скомпилирован. - + Firewall platform is not specified in this object. Can't compile firewall policy. Не указан межесетевой экран для этого объекта. @@ -14507,14 +14958,14 @@ Can't compile firewall policy. Пропущен - + Compiling ... Компиляция ... - + Failure Ошибка @@ -14527,8 +14978,8 @@ Can't compile firewall policy. Пакетная компиляция набора правил - - + + Stop Остановить @@ -14556,22 +15007,32 @@ Can't compile firewall policy. Показать все - + There are no firewalls to process. - + Compiling rule sets for firewall: - + Cancelled - + + <b>You are trying to compile policy for a firewall object that is a member of a cluster, however you requested compilation of only this member firewall and not the cluster it belongs to. Assuming firewall is standalone and not cluster member. Rules and parts of the script specific for the cluster configuration will not be generated.</b> + + + + + Firewall '%1' is member of cluster '%2' + + + + Running command '%1' @@ -14668,7 +15129,7 @@ You can revert to the last working configuration by rebooting the firewall.Установка набора правил на межсетевой экран %1. - + Process log Журнал обработки @@ -14677,21 +15138,18 @@ You can revert to the last working configuration by rebooting the firewall.Запись конфигурации в запасной PIX - - + Compile Компилировать - - + Install Установить - - - + + Firewall Межсетевой экран @@ -14700,22 +15158,22 @@ You can revert to the last working configuration by rebooting the firewall.Библиотека - + Last Modified Последняя модификация - + Last Compiled Последняя компиляция - + Last Installed Последняя установка - + Progress Прогресс @@ -14728,46 +15186,44 @@ You can revert to the last working configuration by rebooting the firewall.Статус установки - + <p align="center"><b><font size="+2">Select firewalls to compile and install.</font></b></p> <p align="center"><b><font size="+2">Выберите межсетевые экраны для компиляции и установки.</font></b></p> - + Perform batch install Выполнить пакетную установку - + Check this option if you want to install all selected firewalls automatically. This only works if you use the same user name and password to authenticate to all these firewalls. Включите эту опцию для автоматической установки всех межсетевых экранов. Эта опция работает только в случае полного совпадения используемого имени пользователя и пароля для всех выбранных межсетевых экранов. - All - Все + Все - None - Ничего + Ничего Show selected Показать выбранные - + Stop Остановить - + Firewalls: Межсетевые экраны: - + firewall межсетевой экран @@ -14776,37 +15232,58 @@ You can revert to the last working configuration by rebooting the firewall.Показать подробности - + Save log to file Сохранить журнал в файл - + TextLabel - + + + warning text goes here + + + + + Select all + + + + + Select none + + + + + Inspect generated files + + + + < &Back < Назад - + &Next > Дальше > - + &Finish Готово - + &Cancel - + current operation here @@ -14814,7 +15291,7 @@ You can revert to the last working configuration by rebooting the firewall. instOptionsDialog - + Install options for firewall '%1' Опции установки межсетевого экрана '%1' @@ -14822,37 +15299,37 @@ You can revert to the last working configuration by rebooting the firewall. instOptionsDialog_q - + Install options Опции установки - + <p align="center"><b><font size="+2">Install options for firewall '%1'</font></b></p> Введите информацию для аутентификации ниже и нажмите 'Далее' - + Password or passphrase: Пароль: - + User name: Имя пользователя: - + Write configuration to standby PIX Записать конфигурацию в запасной PIX - + Dry run (commands won't be executed on the firewall) Проверка установки (команды не будут выполняться на межсетевом экране) - + Store configuration diff in a file Сохранить изменения конфигурации в файле @@ -14865,12 +15342,12 @@ You can revert to the last working configuration by rebooting the firewall.Найти изменения между текущей и генерируемой конфигурациями межесетевого экрана, после чего установить только те команды, которые обновят текущую конфигурацию до генерируемой - + Enable password: Введите пароль: - + Make a backup copy of the firewall configuration in this file: Создать резервную копию конфигурации межсетевого экрана в файле: @@ -14879,17 +15356,17 @@ You can revert to the last working configuration by rebooting the firewall.Альтернативный адрес для связи с межесетевым экраном: - + Schedule reboot in Отложить перезагрузку до - + Rebooting the firewall will restore its original policy. To cancel reboot, install the policy with "test run" option turned off После перезагрузки межсетевого экрана будет загружен старый набор правил, чтобы избежать этого произведите установку набора правил с отключенной опцией 'Тестовый запуск' - + min мин @@ -14898,17 +15375,17 @@ You can revert to the last working configuration by rebooting the firewall.Если вы устанавливаете набор правил в тестовом режиме, то вы можете восстановить последнюю рабочую конфигурацию путем перезагрузки межсетевого экрана - + Test run: run the script on the firewall but do not store it permanently. Тестовый запуск: запустить скрипт на межсетевом экране, не сохраняя его на нем. - + Quiet install: do not print anything as commands are executed on the firewall Обычная установка: не показывать команды по мере их выполнения на межсетевом экране - + Remember passwords for the duration of the session (passwords are never stored permanently). To enable this option turn it on in Preferences and configure user name used to authenticate to @@ -14916,56 +15393,61 @@ the firewall in the "advanced" settings dialog of the firewall object. - + Verbose: print all commands as they are executed on the firewall Подробная установка: показывать все команды по мере их выполнения на межсетевом экране - + Remove comments from configuration Удалить комментарии из конфигурации - + Compress script Сжимать скрипт - + Store a copy of fwb file on the firewall Сохранить копию fwb-файла на межсетевом экране + + + Install + + + + + Cancel All + + Ok OK - + Cancel Отмена - - OK - - - - + If you install the policy in test mode, it will not be saved permanently, so you can revert to the last working configuration by rebooting the firewall - + Cancel reboot if policy activation was successfull - + Address that will be used to communicate with the firewall: - + Remember passwords @@ -14973,32 +15455,32 @@ the firewall in the "advanced" settings dialog of the firewall object. iosAdvancedDialog_q - + IOS Advanced Configuration Options - + General - + Set router name using object's name - + Generate commands to configure addresses for interfaces - + OK - + Cancel @@ -15006,8 +15488,8 @@ the firewall in the "advanced" settings dialog of the firewall object. iosaclAdvancedDialog - - + + Script Editor @@ -15015,98 +15497,98 @@ the firewall in the "advanced" settings dialog of the firewall object. iosaclAdvancedDialog_q - + IOS ACL Firewall Settings - + OK - + Cancel - + Compiler Options - + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") Имя файла (по-умолчанию, если пустое, имя будет состоять из названия объекта межсетевого экрана и расширения '.fw') - + Policy Compiler Options - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! - + Ignore empty groups in rules - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. - + Detect rule shadowing in the policy - + Use object-group statements (requires IOS v12.4(20)T and later) - + Always permit ssh access from the management workstation with this address: - + Script Options - - + + Insert comments into generated IOSACL configuration file - + Comment the code - + Group IOSACL commands in the script so that similar commands appear next to each other, just like IOSACL does it when you use 'show config' - + Group similar commands together - + Clear all access lists then install new ones. This method may interrupt access to the firewall if you manage it remotely via IPSEC tunnel. This is the way access lists were generated in older versions of Firewall Builder for IOSACL. - + "Safety net" method: First, create temporary access list to permit connections from the management subnet specified below to the firewall and assign it to outside interface. This temporary ACL helps maintain session between management station and the firewall while access lists are reloaded in case connection comes over IPSEC tunnel. Then clear permanent lists, recreate them and assign to interfaces. This method ensures that remote access to the firewall is maintained without interruption at a cost of slightly larger configuration. @@ -15116,168 +15598,168 @@ First, create temporary access list to permit connections from the management su правил, временные списки доступа удаляются. Этот метод гарантирует удаленный доступ к межсетевому экрану без прерываний, за счет немного большего размера конфигурации. - + Temporary access list should permit access from this address or subnet (use prefix notation to specify subnet, e.g. 192.0.2.0/24): Временный список доступа должен разрешить доступ с указанного адреса узла или подсети (используйте нотацию с пркфикосм для указания подсети, например - 10.0.0.0/24): - + Installer - + Instead of running generated configuration on the router line by line, installer can use scp to copy the file and then "copy file running-config" command to activate it. Ssh v2 and scp servers should be configured on the router for this to work. This method works for IOS v12.4 or later and is much faster than running configuration line by line. - + Copy generated configuration file to the router using scp - + File system on the router where configuration file should be saved if it is copied with scp. Examples: "flash:", "disk0:". Should end with a colon ":". If this input field is left blank, installer uses "nvram:": - + External install script Внешний скрипт для установки - + Policy install script (using built-in installer if this field is blank): - + Command line options for the script: - + Built-in installer Встроенный установщик - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + Additional command line parameters for ssh Дполнительные опции командной строки для ssh - + Prolog/Epilog - - + + Edit - + The following commands will be added verbatim on top of generated configuration - + The following commands will be added verbatim after generated configuration - + Logging - + Syslog - + Syslog host (name or IP address): - + syslog facility: - + syslog level ('logging trap'): - + The logging timestamp command requires that the clock command be set. - + Enable logging timestamps on syslog file - + Other logging destinations and levels: - + Internal buffer - + Console - + Additional command line parameters for scp - + Generate logging commands - + IPv6 IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 - + IPv6 before IPv4 - + Compiler creates multiple access lists from the same policy, two for each interface: one for inbound and another for outbound. If the policy is written in a such way that no rule @@ -15289,29 +15771,29 @@ rules are designed. - + Generate separate access list for each interface - + Compiler creates one access list and assigns it to all interfaces. - + Create one access list and attach it to all interfaces - + Use ACL remarks - + Do not clear access lists and object group, just generate IOSACL commands for the new ones. Use this option if you have your own policy installation scripts. @@ -15319,8 +15801,8 @@ interfaces. ipcopAdvancedDialog - - + + Script Editor @@ -15328,296 +15810,296 @@ interfaces. ipcopAdvancedDialog_q - + ipcop advanced settings - + Compiler - + Compiler: - + Command line options for the compiler: - + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") Имя файла (по-умолчанию, если пустое, имя будет состоять из названия объекта межсетевого экрана и расширения '.fw') - + rc.firewall.local - + Assume firewall is part of 'any' - + Accept TCP sessions opened prior to firewall restart - + Bridging firewall - + Detect shadowing in policy rules - + Ignore empty groups in rules - + Enable support for NAT of locally originated connections - + Make Tag and Classify actions terminating - + Default action on 'Reject': - + Always permit ssh access from the management workstation with this address: - + Installer - + Built-in installer Встроенный установщик - + Directory on the firewall where script should be installed - + /etc/rc.d/ - + User name used to authenticate to the firewall (leave this empty if you use putty session): - + admin - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') - + /etc/rc.d/rc.firewall - + Additional command line parameters for ssh Дполнительные опции командной строки для ssh - + Additional command line parameters for scp - + External install script Внешний скрипт для установки - + Policy install script (using built-in installer if this field is blank): - + Command line options for the script: - + Prolog/Epilog - - + + Edit - + The following commands will be added verbatim after generated configuration - + The following commands will be added verbatim on top of generated configuration - + Logging - + use ULOG - + use LOG - + log TCP seq. numbers - + log IP options - + use numeric syslog levels - + Log level: - + log TCP options - + cprange - + queue threshold: - + netlink group: - + Log prefix: - + Logging limit: - + Activate logging in all rules (overrides rule options, use for debugging) - + Script - + These options enable auxiliary sections in the generated shell script. - + Turn debugging on in generated script - + Verify interfaces before loading firewall policy - + IPv6 IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 - + IPv6 before IPv4 - + Help Справка - + &OK - + &Cancel @@ -15625,258 +16107,258 @@ with this address: ipcoposAdvancedDialog_q - + IPCOP: advanced settings - + Options - + IPv4 Packet forwarding - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + No change - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + On - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + Off - + IPv6 Packet forwarding - + Kernel anti-spoofing protection - + Ignore broadcast pings - + Ignore all pings - + Accept source route - + Accept ICMP redirects - + Ignore bogus ICMP errors - + Allow dynamic addresses - + Log martians - + whats this text whats this comment - + TCP - + These parameters make sense for connections to or from the firewall host - + TCP sack - + TCP window scaling - + TCP ECN - + TCP SYN cookies - + TCP keepalive time (sec) - + TCP fack - + TCP timestamps - + TCP FIN timeout (sec) - + Path - + Specify directory path and a file name for each utility on your firewall machine. Leave these empty if you want to use default values. - + iptables: - + :ip6tables - + ip: - + vconfig - + brctl - + ifenslave - + logger: - + modprobe: - + lsmod - + iptables-restore: iptables-restore: - + :ip6tables-restore - + Help Справка - + &OK - + &Cancel @@ -15893,27 +16375,27 @@ with this address: ipfAdvancedDialog_q - + ipf: advanced settings ipf: расширенные настройки - + &OK OK - + &Cancel Отмена - + Compiler Компилятор - + Compiler: Компилятор: @@ -15922,7 +16404,7 @@ with this address: Компиляция правил глобальной политики может проходить двумя путями: или путем создания двух правил межсетевого экрана для входящих и исходящих пакетов соответственно для каждого правила политики или путем создания одного правила для входящих пакетов (в этом случае все исходящие пакеты будут разрешены). В первом случае вы лучше контролируете межсетевой экран, во втором - уменьшается создаваемый скрипт. - + Masquerade returned icmp as being from original packet's destination Отправлять ICMP пакеты используя маскарадинг, @@ -15938,46 +16420,45 @@ packet's destination Разрешить все исходящие - + Accept TCP sessions opened prior to firewall restart Не сбрасывать TCP сессии открытые до загрузки нового набора правил межсетевого экрана - + Find and eliminate duplicate rules Находить и упрощать все дублирующие правила - + Detect rule shadowing in policy Находить 'затенение' правил в наборе - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. Затенение происходит, когда одно правило идущее ранее делает одно или несколько следующующих правил не рабочими. Это происходит из-за того, что пакеты, которые должны попадать под условия следующих правил будут попадать под условие первого правило. - + Ignore empty groups in rules Игнорировать пустые группы в правилах - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! При выключении этой опции компилятор будет воспринимать пустые группы в наборе правил как ошибку, а при включении - будет удалять при компиляции пустые группы из всех правил. Во втором случае если после удаления группы правило окажется пустым в том месте, где была группа (окажется с полем любой), то такое правило будет игнорироваться. Используйте эту опцию очень внимательно и осторожно! - Always permit ssh access from the management workstation with this address: - Всегда разрешать доступ + Всегда разрешать доступ по протоколу SSH с управляющей рабочей станции с адресом: - + Default action on 'Reject': ICMP protocol unreachable @@ -16006,7 +16487,7 @@ with this address: TCP RST - + Command line options for the compiler: Опции командной строки для компилятора: @@ -16015,248 +16496,254 @@ with this address: Имя файла (по-умолчанию, если пустое, имя будет состоять из названия объекта межсетевого экрана и расширения '.fw') - + Protocol Helpers Расширенная поддержка протоколов - + Some protocols involve multiple associated network connections. Firewall can keep track of such connections automatically if you activate one or all of the following options: Некоторые протоколы допускают наличие нескольких взаимосвязанных соединений. Межсетевой экран может отслеживать такие соединения автоматически, если вы включите одну или несколько из следующих опций: - + Use raudio proxy in NAT rules Использовать raudio прокси для NAT правил - + Use h323 proxy in NAT rules Использовать h323 прокси для NAT правил - + Use ipsec proxy in NAT rules Использовать ipsec прокси для NAT правил - + Use ftp proxy in NAT rules Использовать ftp прокси для NAT правил - + Use rcmd proxy in NAT rules Использовать rcmd прокси для NAT правил - + Installer Установщик - + Command line options for the script: Опции командной строки для скрипта: - + Policy install script (using built-in installer if this field is blank): Скрипт установки набора правил (не заполняйте для использования встроенного скрипта установки): - + + Always permit ssh access from the management + workstation with this address: + + + + Directory on the firewall where configuration files should be installed Каталог на межсетевом экране, в который должны быть установлены файлы конфигурации - + User name used to authenticate to the firewall (leave this empty if you use putty session): Имя пользователя, используемое для аутентификации на межсетевом экране (не заполняйте, если используете putty сессию): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) Альтернативный адрес или имя межсетевого экрана для связи с ним (в Windows поддерживаются названия сессий putty) - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') Команда, используемая установщиком для загрузки нового набора правил (если это поле пустое, установщик будет выполнять скрипт межсетевого экрана в указанном выше каталоге, он также будет использовать sudo, если имя пользователя не root) - + Logging Запись в журнал (протоколирование) - + Log facility: Log facility: - + Log level: Log level: - + Log packet body Протоколировать тело пакета - + Block if can not log Блокировать при невозможности протоколировать - + Script Options Опции скрипта - + Add virtual addresses for NAT Добавлять виртуальные адреса для NAT - + Configure Interfaces of the firewall machine Конфигурировать интерфейсы межсетевого экрана - + Turn debugging on in generated script Включить режим отладки в генерируемом скрипте - + Optimization Оптимизация - + If this option is on, policy compiler adds virtual addresses to the interfaces to make the firewall answer to ARP queries for addresses used in NAT rules. При включении этой опции, компилятор добавит виртуальные адреса к интерфейсам межсетевого экрана для того, чтобы он отвечал на ARP-запросы адресов, используемых в правилах сетевой трансляции адресов (NAT). - + These options enable auxiliary sections in the generated shell script. Эти опции подключают внешние секции в генерируемом shell-скрипте. - + Prolog/Epilog Prolog/Epilog - - + + Edit Редактировать - + The following commands will be added verbatim on top of generated configuration Следующие команду будут добавлены в начало генерируемого скрипта конфигурации - + The following commands will be added verbatim after generated configuration Следующие команду будут добавлены в конец генерируемого скрипта конфигурации - + External install script Внешний скрипт для установки - + Built-in installer Встроенный установщик - + Additional command line parameters for ssh Дполнительные опции командной строки для ssh - + Determine addresses of dynamic interfaces at run time Определять адреса динамических интерфейсов во время запуска - + Use PPTP proxy in NAT rules Использовать pptp прокси для NAT правил - + Use IRC proxy in NAT rules for DCC Использовать irc прокси для DCC в NAT правилах - + Additional command line parameters for scp - + IPv6 IPv6 - + Enable IPv6 support - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 - + IPv6 before IPv4 - + Use Kerberos rcmd proxy in NAT rules - + Use Kerberos ekshell proxy in NAT rules - + Output file name. If left blank, the file name is constructed of the firewall object name and extension ".fw" - + Generated script (.fw file) and configuration (.conf) files can be copied to the firewall machine under different names. If these fields are left blank, the file name does not change. - + Script (.fw) file name on the firewall - + ipf.conf file name on the firewall - + nat.conf file name on the firewall @@ -16273,37 +16760,37 @@ with this address: ipfwAdvancedDialog_q - + ipfw: advanced settings ipfw: расширенные настройки - + &OK OK - + &Cancel Отмена - + Compiler Компилятор - + Command line options for the compiler: Опции командной строки для компилятора: - + Compiler: Компилятор: - + Always permit ssh access from the management workstation with this address: @@ -16312,37 +16799,37 @@ with this address: рабочей станции с адресом: - + Ignore empty groups in rules Игнорировать пустые группы в правилах - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! При выключении этой опции компилятор будет воспринимать пустые группы в наборе правил как ошибку, а при включении - будет удалять при компиляции пустые группы из всех правил. Во втором случае если после удаления группы правило окажется пустым в том месте, где была группа (окажется с полем любой), то такое правило будет игнорироваться. Используйте эту опцию очень внимательно и осторожно! - + Detect rule shadowing in policy Находить 'затенение' правил в наборе - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. Затенение происходит, когда одно правило идущее ранее делает одно или несколько следующующих правил не рабочими. Это происходит из-за того, что пакеты, которые должны попадать под условия следующих правил будут попадать под условие первого правило. - + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") Имя файла (по-умолчанию, если пустое, имя будет состоять из названия объекта межсетевого экрана и расширения '.fw') - + Installer Установщик - + Command line options for the script: Опции командной строки для скрипта: @@ -16351,129 +16838,129 @@ with this address: Каталог на межсетевом экране, в которые должны быть установлены файлы конфигурации - + User name used to authenticate to the firewall (leave this empty if you use putty session): Имя пользователя, используемое для аутентификации на межсетевом экране (не заполняйте, если используете putty сессию): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) Альтернативный адрес или имя межсетевого экрана для связи с ним (в Windows поддерживаются названия сессий putty) - + Policy install script (using built-in installer if this field is blank): Скрипт установки набора правил (не заполняйте для использования встроенного скрипта установки): - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') Команда, используемая установщиком для загрузки нового набора правил (если это поле пустое, установщик будет выполнять скрипт межсетевого экрана в указанном выше каталоге, он также будет использовать sudo, если имя пользователя не root) - + Script Options Опции скрипта - + Add virtual addresses for NAT Добавлять виртуальные адреса для NAT - + Configure Interfaces of the firewall machine Конфигурировать интерфейсы межсетевого экрана - + Turn debugging on in generated script Включить режим отладки в генерируемом скрипте - + These options enable auxiliary sections in the generated shell script. Эти опции подключают внешние секции в генерируемом shell-скрипте. - + Prolog/Epilog Prolog/Epilog - - + + Edit Редактировать - + The following commands will be added verbatim after generated configuration Следующие команду будут добавлены в конец генерируемого скрипта конфигурации - + The following commands will be added verbatim on top of generated configuration Следующие команду будут добавлены в начало генерируемого скрипта конфигурации - + External install script Внешний скрипт для установки - + Built-in installer Встроенный установщик - + Directory on the firewall where script should be installed Каталог на межсетевом экране, в которые должны быть установлены файлы конфигурации - + Additional command line parameters for ssh Дполнительные опции командной строки для ssh - + Add rule to accept packets matching dynamic rules created for known sessions on top of the policy (action 'check-state') - + Additional command line parameters for scp - + IPv6 IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 - + IPv6 before IPv4 - + Generated script can be copied to the firewall machine under different name. If this field is left blank, the file name does not change. - + Script name on the firewall @@ -16481,8 +16968,8 @@ known sessions on top of the policy (action 'check-state') iptAdvancedDialog - - + + Script Editor Редактор скриптов @@ -16495,24 +16982,23 @@ known sessions on top of the policy (action 'check-state') iptables: расширенные настройки - + &OK OK - + &Cancel Отмена - + Compiler Компилятор - Command line options for the compiler: - Опции командной строки для компилятора: + Опции командной строки для компилятора: Always permit ssh access from @@ -16523,52 +17009,52 @@ with this address: рабочей станции с адресом: - + Accept ESTABLISHED and RELATED packets before the first rule Добавить вначале набора скрытое правило для приема пакетов ссостоянием соедиения ESTABLISHED и RELATED - + Bridging firewall Поддержка режима моста - + Detect shadowing in policy rules Находить 'затенение' правил в наборе - + and log them и протоколировать их - + Assume firewall is part of 'any' Считать межсетевой экран частью 'любого' - + Accept TCP sessions opened prior to firewall restart Блокировать пакеты, которые не относятся к разрешенным соединениям - + Clamp MSS to MTU Выравнивать MSS до MTU - + Enable support for NAT of locally originated connections Разрешить NAT для локальных соединений - + Ignore empty groups in rules Игнорировать пустые группы в правилах - + Compiler: Компилятор: @@ -16609,77 +17095,108 @@ with this address: TCP RST - + Default action on 'Reject': Уведомление по-умолчанию для действия 'Блокировать с уведомлением': - + Installer Установщик - + Command line options for the script: Опции командной строки для скрипта: - + Directory on the firewall where script should be installed Каталог на межсетевом экране, в которые должны быть установлены файлы конфигурации - + User name used to authenticate to the firewall (leave this empty if you use putty session): Имя пользователя, используемое для аутентификации на межсетевом экране (не заполняйте, если используете putty сессию): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) Альтернативный адрес или имя межсетевого экрана для связи с ним (в Windows поддерживаются названия сессий putty) - + Policy install script (using built-in installer if this field is blank): Скрипт установки набора правил (не заполняйте для использования встроенного скрипта установки): - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') Команда, используемая установщиком для загрузки нового набора правил (если это поле пустое, установщик будет выполнять скрипт межсетевого экрана в указанном выше каталоге, он также будет использовать sudo, если имя пользователя не root) - + + Compiler command line options: + + + + + Output file name: + + + + + If output file name is left blank, the file name is constructed of the firewall object name and extension ".fw" + + + + + Add rules to accept IPv6 Neighbor Discovery +packets to IPv6 policies + + + + + Use module "set" for run-time Address Table objects (module is only available in iptables v 1.4.1.1 and later) + + + + + Install the rule for ssh access from the management workstation when the firewall script is run with the "block" command + + + + Logging Запись в журнал (протоколирование) - + use ULOG исользовать ULOG - + use LOG исользовать LOG - + log TCP seq. numbers протоколировать номера последовательностей TCP - + log IP options Протоколировать опции IP - + use numeric syslog levels использовать цифры-номера уровней syslog - + Log level: Log level: @@ -16712,32 +17229,32 @@ with this address: debug - + log TCP options Протоколировать опции TCP - + cprange cprange - + queue threshold: queue threshold: - + netlink group: группа netlink: - + Log prefix: Log prefix: - + Logging limit: Ограничение протоколирования: @@ -16758,7 +17275,7 @@ with this address: в секунду - + Activate logging in all rules (overrides rule options, use for debugging) Включить протоколирование для всех правил @@ -16773,22 +17290,22 @@ with this address: Эти опции подключают внешние секции в генерируемом shell-скрипте. - + Configure Interfaces of the firewall machine Конфигурировать интерфейсы межсетевого экрана - + Add virtual addresses for NAT Добавлять виртуальные адреса для NAT - + Turn debugging on in generated script Включить режим отладки в генерируемом скрипте - + Verify interfaces before loading firewall policy Проверять наличие необходимых интерфейсов межсетевого экрана перед загрузкой набора правил @@ -16797,168 +17314,157 @@ with this address: Загружать необходимые модули ядра - + Drop packets that are associated with no known connection Блокировать пакеты, которые не относятся к известным соединениям - + Compiler will automatically generate rules to permit ICMP6 packets used in IPv6 Neighbor Discovery after the rules that accept ESTABLISHED,RELATE and before the rule that drops packets in state INVALID. - - Add rules to accept IPv6 Neighbor Discovery packets to IPv6 policies - - - - + Always permit ssh access from the management workstation with this address: - - Install the rule for ssh access from the management workstation when the firewall -is stopped - - - - + Prolog/Epilog Prolog/Epilog - - + + Edit Редактировать - + The following commands will be added verbatim after generated configuration Следующие команду будут добавлены в конец генерируемого скрипта конфигурации - + The following commands will be added verbatim on top of generated configuration Следующие команду будут добавлены в начало генерируемого скрипта конфигурации - + Insert prolog script Вставить скрипт пролога - + on top of the script в начало скрипта - + after interface configuration после конфигурирования интерфейсов - + after policy reset после удаления страрого набора правил - + Load iptables modules - + If debugging is turned on, the script will run with shell option "-x" that makes it print every command it executes. Warning: this produces a lot of debugging output. - + Managing interfaces and addresses - + Clear ip addresses and bring down interfaces not configured in fwbuilder - + Generated script can load rules one by one by calling iptables command line utility, or activate them all at once using iptables-restore. In both cases you just run the script with command line parameter "start" to activate the policy, the script will use iptables-restore automatically if this checkbox is on - + Use iptables-restore to activate policy Использовать команду iptables-restore для включения набора правил - + iptables-restore replaces firewall policy in one atomic transaction iptables-restore заменяет набор правил межсетевого экрана единой атомарной транзакцией - + External install script Внешний скрипт для установки - + Built-in installer Встроенный установщик - + Additional command line parameters for ssh Дполнительные опции командной строки для ssh - + Make Tag and Classify actions terminating - + Additional command line parameters for scp - + Script - + IPv6 IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 - + IPv6 before IPv4 - + Help Справка - + This adds a rule on top of the policy with iptables target TCPMSS and option --clamp-mss-to-pmtu. Generation of this command is version-dependent and also depends on the setting of ip or ipv6 forwarding @@ -16967,32 +17473,27 @@ in host settings dialog. - - Output file name. If left blank, the file name is constructed of the firewall object name and extension ".fw" - - - - + Generated script can be copied to the firewall machine under different name. If this field is left blank, the file name does not change. - + Script name on the firewall: - + Configure VLAN Interfaces - + Configure bridge Interfaces - + Configure bonding Interfaces @@ -17000,62 +17501,62 @@ in host settings dialog. linksysAdvancedDialog_q - + Linksys/Sveasoft: advanced settings Linksys/Sveasoft: расширенные настройки - + &OK OK - + &Cancel Отмена - + Path Путь - + modprobe: modprobe: - + logger: logger: - + ip: ip: - + lsmod lsmod - + iptables: iptables: - + Specify directory path and a file name for each utility on your firewall machine. Leave these empty if you want to use default values. Укажите полный путь к перечисленным утилитам в операционной системе этого межсетевого экрана. Для незаполненных полей будут использованы значения по-умолчанию. - + Prompts Приглашения - + Policy installer relies on the shell prompt on the firewall to execute commands. Installer tries both prompt string patterns configured here; it assumes that the firewall is ready to accept a command if either prompt matches. You should only need to change these string patterns if Sveasoft changes the shell prompt in the future releases of the software. <br> <br> @@ -17066,32 +17567,32 @@ The default strings work for Sveasoft Alchemy pre-5.1 and pre-5.2 По-умолчанию строки приглашений командной строки настроены на Sveasoft Alchemy версий pre-5.1 и pre-5.2 - + prompt 1 приглашение 1 - + prompt 2 приглашение 2 - + Use default prompts Использовать приглашения по умолчанию - + vconfig - + brctl - + ifenslave @@ -17099,85 +17600,85 @@ The default strings work for Sveasoft Alchemy pre-5.1 and pre-5.2 linux24AdvancedDialog_q - + Linux 2.4: advanced settings Linux 2.4/2.6: расширенные настройки - + &OK OK - + &Cancel Отмена - + Options Опции - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + No change Без изменений - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + On Включить - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + Off Выключить @@ -17186,175 +17687,187 @@ The default strings work for Sveasoft Alchemy pre-5.1 and pre-5.2 Маршрутизация пакетов - + Kernel anti-spoofing protection Защита ядра от подмены адреса (anti-spoofing) - + Ignore broadcast pings Игнорировать широковещательные ICMP ping пакеты - + Ignore all pings Игнорировать все ICMP ping пакеты - + Accept source route Принимать пакеты ICMP source route - + Accept ICMP redirects Принимать пакеты ICMP redirect - + Ignore bogus ICMP errors Игнорировать пакеты ICMP со странными кодами ошибки - + Allow dynamic addresses Разрешить динамичнские адреса - + Log martians Записывать в журнал пакеты с подозрительными адресами - + TCP TCP - + These parameters make sense for connections to or from the firewall host Эти параметры влияют на соединения идущие с/на сам межсетевой экран - + TCP sack TCP sack - + TCP window scaling TCP window scaling - + TCP ECN TCP ECN - + TCP SYN cookies TCP SYN cookies - + TCP keepalive time (sec) TCP keepalive time (секунд) - + TCP fack TCP fack - + TCP timestamps TCP timestamps - + TCP FIN timeout (sec) TCP FIN таймаут (секунд) - + Path Путь - + + vconfig: + + + + + brctl: + + + + + ifenslave: + + + + modprobe: modprobe: - + logger: logger: - + ip: ip: - lsmod - lsmod + lsmod - + iptables: iptables: - + Specify directory path and a file name for each utility on your firewall machine. Leave these empty if you want to use default values. Укажите полный путь к перечисленным утилитам в операционной системе этого межсетевого экрана. Для незаполненных полей будут использованы значения по-умолчанию. - + iptables-restore: iptables-restore: - + IPv4 Packet forwarding - + IPv6 Packet forwarding - + whats this text whats this comment - + :ip6tables - + + lsmod: + + + + + ipset: + + + + :ip6tables-restore - - These parameters allow you to tune performance of<br> -conntrack module (netfilter state tracking). This<br> -should only be necessary for large firewalls with a lot<br> -of traffic and many stateful rules.<br> -Explanation of these parameters can be found at<br> -<a href="http://www.wallfire.org/misc/netfilter_conntrack_perf.txt">http://www.wallfire.org/misc/netfilter_conntrack_perf.txt</a><br> -<br> -Set both to zero to use default values - - - - + This parameter is used if you run conntrackd in state <br> synchronization mode for a firewall cluster and have<br> kernel &lt;2.6.22<br> @@ -17364,53 +17877,48 @@ Explanation of this parameter can be found at<br> - + Help Справка - - vconfig - - - - - brctl - - - - - ifenslave - - - - + conntrack - + CONNTRACK_MAX - + CONNTRACK_MAX is the maximum number of "sessions" (connection tracking entries) that can be handled simultaneously by netfilter in kernel memory. - + HASHSIZE - + the size of the hash table storing the lists of conntrack entries - + + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> +<html><head><meta name="qrichtext" content="1" /><style type="text/css"> +p, li { white-space: pre-wrap; } +</style></head><body> +<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;">These parameters allow you to tune performance of<br />conntrack module (netfilter state tracking). This<br />should only be necessary for large firewalls with a lot<br />of traffic and many stateful rules.<br />Explanation of these parameters can be found on</p> +<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;">the Internet if you search for &quot;netfilter conntrack performance&quot;<br /><br />Set both to zero to use default values</p></body></html> + + + + Disable TCP window tracking ("ip_conntrack_tcp_be_liberal") @@ -17529,17 +18037,17 @@ that can be handled simultaneously by netfilter in kernel memory. longTextDialog_q - + longTextDialog_q longTextDialog_q - + Continue Продолжить - + this is the error text минут @@ -17631,38 +18139,38 @@ that can be handled simultaneously by netfilter in kernel memory. - + Depending on the failover protocol, cluster interface may or may not need an IP address. <b>VRRP</b>, <b>CARP</b>, <b>heartbeat</b> interfaces should have their own unique IP addresses different from the member firewall interfaces. Other failover protocols such as the one used in <b>Cisco ASA (PIX) firewall</b> do not require additional IP address.<br><br>List of available failover protocols depends on the firewall platform. Depending on the failover protocol, cluster interface may or may not need an IP address. <b>VRRP</b> and <b>CARP</b> interfaces should have their own unique IP addresses different from the member firewall interfaces. Other failover protocols such as <b>heartbeat</b> or <b>OpenAIS</b> do not create new interface and therefore do not require additional IP address. <br><br>List of available failover protocols depends on the firewall platform. - + regular - + dynamic - + unnumbered - + with address: - + with addresses: - + You should select at least one firewall to create a cluster @@ -17670,12 +18178,12 @@ that can be handled simultaneously by netfilter in kernel memory. newClusterDialog_q - + TextLabel - + Enter the name of the new object @@ -17684,58 +18192,58 @@ that can be handled simultaneously by netfilter in kernel memory. Выбрать - + < &Back < Назад - + &Next > Дальше > - + &Finish Готово - + &Cancel - + Select member firewall objects to use with the new cluster. One member firewall should be marked as master. You can choose to copy policy and NAT rules from the rule sets of one of the members to the new cluster later. - + Firewall - + Use in cluster - + Master - - + + Tab 1 - + Choose which member's policy and NAT rules should be used to create policy and nat rules of the cluster. First, each member firewall object will be copied with the name "<firewall>-bak" (where <firewall> is the name of the member) for backup, then rules from the chosen member will be copied to the new cluster and finally all policy and NAT rules will be deleted in both members. Backup firewall objects ensure that you do not lose your configuration and can always revert back if necessary. You can delete backup objects or move them to a separate library for archival later. - + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <html><head><meta name="qrichtext" content="1" /><style type="text/css"> p, li { white-space: pre-wrap; } @@ -17744,32 +18252,32 @@ p, li { white-space: pre-wrap; } - + Name: - + Firewalls used in this cluster - + Master firewall: - + Cluster interfaces - + Policy and NAT rules will be copied from firewall: - + Click Finish to create this cluster. @@ -17777,27 +18285,28 @@ p, li { white-space: pre-wrap; } newFirewallDialog - + Missing SNMP community string. Не указана строка SNMP community. - + + Address of %1 could not be obtained via DNS Для имени %1 не может быть получен адрес при помощи DNS запроса - + Interface: %1 (%2) Интерфейс: %1 (%2) - + Dynamic address Динамический адрес - + Unnumbered interface Интерфейс без адреса @@ -17818,51 +18327,51 @@ p, li { white-space: pre-wrap; } Порт моста - + FWBuilder template files - + FWBuilder template files (*.xml *.fwb *.fwl) - + Please select template - - + + &Continue - + Dynamic interface gets its IP address by means of DHCP or PPP protocol and does not require an address here. Regular interface has statically configured IP address which should be entered on this page. Interface can have several IPv4 and IPv6 addresses. - + Error loading template library: %1 - + Here you can change IP address of the template interface to match addresses used on your network. Interface can have several IPv4 and IPv6 addresses. - - - + + + Invalid address '%1/%2' - + Can not find interface %1 in the interface editor data @@ -17874,47 +18383,47 @@ p, li { white-space: pre-wrap; } Новый межсетевой экран - + Enter the name of the new object below: Имя создаваемого объекта: - + Choose firewall software it is running: Тип межсетевого экрана: - + Choose OS the new firewall runs on: Операционная система межсетевого экрана: - + Use preconfigured template firewall objects Использовать шаблоны межсетевых экранов - + Next step is to add interfaces to the new firewall. There are two ways to do it: using SNMP query or manually. Adding them using SNMP query is fast and automatic, but is only possible if firewall runs SNMP agent and you know SNMP community string 'read'. Теперь необходимо добавить интерфейсы для создаваемого межсетевого экрана. Это можно сделать автоматически, используя SNMP запрос или вручную. SNMP запрос выполнится только для межсетевых экранов с включенным SNMP сервисом и правильно указанной строкой community (для чтения). - + Configure interfaces manually Сконфигурировать интерфейсы вручную - + Use SNMP to discover interfaces of the firewall Использовать SNMP запрос для получения конфигурации интерфейсов - + Discover Interfaces using SNMP Использовать SNMP запрос для получения конфигурации интерфейсов - + SNMP 'read' community string: SNMP строка community (для чтения): @@ -17927,9 +18436,8 @@ p, li { white-space: pre-wrap; } Включите опцию 'Динамический адрес' для интерфейсов получающих IP адрес динамически. Чаще всего это необходимо для интерфейсов, которые получают адрес через DHCP запрос или используют PPP. - Click 'Next' when done. - Для продолжения нажмите 'Далее'. + Для продолжения нажмите 'Далее'. Name: @@ -17952,17 +18460,17 @@ p, li { white-space: pre-wrap; } Это интерфейс без адреса, то есть он не имеет IP адреса. Включаите эту опцию для интерфейсов, которые используются для создания: PPPoE или VPN туннелей, мостов - + Name Название - + Label Метка - + Address Адрес @@ -18007,33 +18515,30 @@ p, li { white-space: pre-wrap; } Удалить - - Here you can add or edit interfaces manually. 'Name' corresponds to the name of the physical interface, such as 'eth0', 'fxp0', 'ethernet0' etc. 'Label' is used to mark interface to reflect network topology, e.g. 'outside' or 'inside'. Label is mandatory for PIX firewall. - Здесь вы можете редактировать интерфейсы вручную. 'Название' соответствует названию физического интерфейса, например: 'eth0' или 'fxp0'. Метка маркирует интерфейс для отражения сетевой топологии (например 'внешний' или 'внутренний'). Указание метки обязательно для межсетевого экрана PIX. + Здесь вы можете редактировать интерфейсы вручную. 'Название' соответствует названию физического интерфейса, например: 'eth0' или 'fxp0'. Метка маркирует интерфейс для отражения сетевой топологии (например 'внешний' или 'внутренний'). Указание метки обязательно для межсетевого экрана PIX. - + up вверх - + down вниз - + Security Level Уровень безопасности - Click 'Finish' when done. - Для продолжения нажмите 'Готово'. + Для продолжения нажмите 'Готово'. - + In order to be able to build firewall policy properly, Firewall Builder needs information about 'security level' of the firewall's interfaces. Interface that connects it to the Internet is considered 'insecure' and has security level '0', while interface connected to the internal network is supposed to be 'secure' (security level '100'). You can arrange interfaces in the order of their security level below. Каждому интерфейсу межсетевого экрана должен быть назначен уровень безопасности в диапазоне от 0 до 100. 0 означает меньшую безопасность, 100 - бОльшую. Нулевой уровень безопасности чаще всего присваивается интерфейсу, подключенному к сети Internet. Распределите интерфейсы в порядке их уровня безопасности ниже. @@ -18050,59 +18555,70 @@ p, li { white-space: pre-wrap; } Обычный интерфейс с адресом - + TextLabel - + + Firewall IP address: + + + + + + 'Name' corresponds to the name of the physical interface, such as 'eth0', 'fxp0', 'ethernet0' etc. 'Label' is used to mark interface to reflect network topology, e.g. 'outside' or 'inside'. Label is mandatory for PIX firewall. + + + + + Choose template object in the list and click 'Next' when ready. + +You can change interface names and their IP addresses on the next page. Template firewall object comes with basic policy and NAT rules that implement policy described in its comment. If you change IP addresses of its interfaces, policy and NAT rules will be automatically corrected to reflect this change. However you should always inspect the rules and adjust them to suite your security policy. Template objects are designed to be a starting point, a way to jump-start your configuration and most likely require changes to be useful in your environment. + + + + + < &Back < Назад - + &Next > Дальше > - + &Finish Готово - + &Cancel - + Template file: - + Browse Выбрать - + Use standard template library - - + + Tab 1 - - - Choose template object in the list and click 'Next' when ready. - -You can change intrface names and their IP addresses on the next page. Template firewall object comes with a basic policy and NAT rules that implement policy described in its comment. If you change IP addresses of its interfaces, policy and NAT rules will be automatically corrected to reflect this change. However you should always inspect the rules and adjust them to suite your security policy. Template objects are designed to be a starting point, a way to jump-start your configuration and most likely require changes to be useful in your environment. - - - newGroupDialog_q @@ -18150,24 +18666,24 @@ You can change intrface names and their IP addresses on the next page. Template Для имени %1 не может быть получен адрес при помощи DNS запроса - + Interface: %1 (%2) Интерфейс: %1 (%2) - + Dynamic address Динамический адрес - + Unnumbered interface Интерфейс без адреса - - - + + + Illegal address '%1/%2' Некорректный адрес %1/%2 @@ -18189,52 +18705,52 @@ You can change intrface names and their IP addresses on the next page. Template Новый узел - + Enter the name of the new object below: Имя создаваемого объекта: - + Use preconfigured template host objects Использовать шаблоны межсетевых экранов - + Next step is to add interfaces to the new host. There are two ways to do it: using SNMP query or manually. Adding them using SNMP query is fast and automatic, but is only possible if the host runs SNMP agent and you know SNMP community string 'read'. Теперь необходимо добавить интерфейсы для создаваемого межсетевого экрана. Это можно сделать автоматически, используя SNMP запрос или вручную. SNMP запрос выполнится только для межсетевых экранов с включенным SNMP сервисом и правильно указанной строкой community (для чтения). - + Configure interfaces manually Сконфигурировать интерфейсы вручную - + Use SNMP to discover interfaces of the host Использовать SNMP запрос для получения конфигурации интерфейсов - + Discover Interfaces using SNMP Использовать SNMP запрос для получения конфигурации интерфейсов - + SNMP 'read' community string: SNMP строка community (для чтения): - + Check option 'Unnumbered interface' for the interface that does not have an IP address. Examples of interfaces of this kind are those used to terminate PPPoE or VPN tunnels. Включите опцию 'Интерфейс без адреса' для интерфейсов не имеющих IP адреса. Чаще всего это необходимо для интерфейсов, которые используются для создания: PPPoE или VPN туннелей, мостов. - + Check option 'dynamic address' for the interface that gets its IP address dynamically via DHCP or PPP protocol. Включите опцию 'Динамический адрес' для интерфейсов получающих IP адрес динамически. Чаще всего это необходимо для интерфейсов, которые получают адрес через DHCP запрос или используют PPP. - + Click 'Next' when done. Для продолжения нажмите 'Далее'. @@ -18311,57 +18827,57 @@ You can change intrface names and their IP addresses on the next page. Template Удалить - + Here you can add or edit interfaces manually. 'Name' corresponds to the name of the physical interface, such as 'eth0', 'fxp0', 'ethernet0' etc. 'Label' is used to mark interface to reflect network topology, e.g. 'outside' or 'inside'. Здесь вы можете редактировать интерфейсы вручную. 'Название' соответствует названию физического интерфейса, например: 'eth0' или 'fxp0'. Метка маркирует интерфейс для отражения сетевой топологии (например 'внешний' или 'внутренний'). Указание метки обязательно для межсетевого экрана PIX. - + Choose template object in the list and click 'Finish' when ready. Template objects use generic interface names that will be iherited by the firewall object you create. You may need to rename them later to reflect real names of interfaces on your firewall machine. Выберите объект - шаблон и нажмите 'Готово'. После добавления шаблона необходимо проверить и при необходимости переименовать названия интерфейсов межсетевого экрана. - + TextLabel - + < &Back < Назад - + &Next > Дальше > - + &Finish Готово - + &Cancel - + Template file: - + Browse Выбрать - + Use standard template library - + Tab 2 Tab 2 @@ -18415,17 +18931,17 @@ You can change intrface names and their IP addresses on the next page. Template openbsdAdvancedDialog_q - + OpenBSD: advanced settings OpenBSD: расширенные настройки - + &OK OK - + &Cancel Отмена @@ -18486,17 +19002,17 @@ You can change intrface names and their IP addresses on the next page. Template Путь - + pfctl: pfctl: - + sysctl: sysctl: - + Specify directory path and a file name for the following utilities on the OS your firewall machine is running. Leave these empty if you want to use default values. Укажите полный путь к перечисленным утилитам в операционной системе этого межсетевого экрана. Для незаполненных полей будут использованы значения по-умолчанию. @@ -18635,8 +19151,8 @@ You can change intrface names and their IP addresses on the next page. Template pfAdvancedDialog - - + + Script Editor Редактор скриптов @@ -18644,37 +19160,37 @@ You can change intrface names and their IP addresses on the next page. Template pfAdvancedDialog_q - + pf: advanced settings pf: расширенные настройки - + &OK OK - + &Cancel Отмена - + Compiler Компилятор - + Compiler: Компилятор: - + Command line options for the compiler: Опции командной строки для компилятора: - + Always permit ssh access from the management workstation with this address: @@ -18699,7 +19215,7 @@ with this address: Нормальный - + Optimization: Оптимизация: @@ -18708,7 +19224,7 @@ with this address: размер таблицы состояний: - + maximum number of entries in the memory pool used for state table entries макисмальное количество записей в пуле памяти, используемого для записей таблицы состояний @@ -18717,44 +19233,43 @@ with this address: пересобирающий пул: - + maximum number of entries in the memory pool used for packet reassembly макисмальное количество записей в пуле памяти, используемого пересборки пакетов - + Accept TCP sessions opened prior to firewall restart Не сбрасывать TCP сессии открытые до загрузки нового набора правил межсетевого экрана - + Modulate state for all stateful rules (applies only to TCP services) Моделировать состояние для всех правил с фильтрацией по состоянию (только для TCP сервисов) - + Detect rule shadowing in policy Находить 'затенение' правил в наборе - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. Затенение происходит, когда одно правило идущее ранее делает одно или несколько следующующих правил не рабочими. Это происходит из-за того, что пакеты, которые должны попадать под условия следующих правил будут попадать под условие первого правило. - + Ignore empty groups in rules Игнорировать пустые группы в правилах - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! При выключении этой опции компилятор будет воспринимать пустые группы в наборе правил как ошибку, а при включении - будет удалять при компиляции пустые группы из всех правил. Во втором случае если после удаления группы правило окажется пустым в том месте, где была группа (окажется с полем любой), то такое правило будет игнорироваться. Используйте эту опцию очень внимательно и осторожно! - Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") - Имя файла (по-умолчанию, если пустое, имя будет состоять из названия объекта межсетевого экрана и расширения '.fw') + Имя файла (по-умолчанию, если пустое, имя будет состоять из названия объекта межсетевого экрана и расширения '.fw') Pass all outgoing @@ -18773,277 +19288,274 @@ with this address: Подчищать опции правил - + Enforce Minimum TTL: Задать минимальный TTL: - + Enforce Maximum MSS: Задать максимальный MSS: - + Enforces a maximum Maximum Segment Size (MSS) in TCP packet headers. Задает максимальный размер сегмента (MSS) в заголовках TCP пакетов. - + Enforces a minimum Time To Live (TTL) in IP packet headers. Задает минимальное время жизни (TTL) в заголовках IP пакетов. - + Reassemble fragments Пересобирать фрагменты - + Clear DF bit Очищать бит DF - + Clears the don't fragment bit from the IP packet header. Очищать бит не фрагментированный в заголовках IP-пакетов. - + Use random ID Использовать случайный ID - + Replaces the IP identification field of outgoing packets with random values to compensate for operating systems that use predictable values. Заменить значение поля идентификации исходящих IP пакетов на случайное значение для защиты от атак на операционные системы, использующие легко предсказуемые значения. - + Buffer and reassemble fragments (default) Буферизовать и пересобирать фрагменты (по-умолчанию) - Buffers incoming packet fragments and reassembles them into a complete packet before passing them to the filter engine. - Буферизовать входящие фрагменты пакетов и пересобирать их в целый пакет перед отправкой в фильтр межсетевого экрана. + Буферизовать входящие фрагменты пакетов и пересобирать их в целый пакет перед отправкой в фильтр межсетевого экрана. - + Drop duplicate fragments, do not buffer and reassemble Блокировать дубликаты фрагментов, не буферизовать и не пересобирать их - Causes duplicate fragments to be dropped and any overlaps to be cropped. - Блокировать дубликаты фрагментов и вырезать любые наложения фрагментов. + Блокировать дубликаты фрагментов и вырезать любые наложения фрагментов. - + Drop duplicate and subsequent fragments Блокировать дубликаты и последующие за ними фрагменты - Similar to 'Drop duplicate fragments' except that all duplicate or overlapping fragments will be dropped as well as any further corresponding fragments. - То же, что и Блокировать дубликаты фрагментов, но также будут блокироваться все накладывающиеся и все последующие за ними фрагменты. + То же, что и Блокировать дубликаты фрагментов, но также будут блокироваться все накладывающиеся и все последующие за ними фрагменты. - + Timeouts Таймауты - + When a packet matches a stateful connection, the seconds to live for the connection will be updated to the value which corresponds to the connection state. При соответствии пакета фильруемому по состоянию соединению, количество секунд жизни соединения будет обновлено и установлено в значение, которое соответствует состоянию соединения. - + TCP TCP - - - - + + + + first first - - - - - - + + + + + + The state after the first packet. Состояние после первого пакета. - + opening opening - + The state before the destination host ever sends a packet. Состояние перед тем, как узел назначения ответил на пакет. - + established established - + The fully established state. Состяние успешно установленного соединения. - + The state after the first FIN has been sent. Состояние после отправки первого пакета с установленным флагом FIN. - + closing closing - + The state after both FINs have been exchanged and the connection is closed. Состояние после отправки обоих пакетов с установленным флагом FIN и закрытия соединения. - + finwait finwait - + The state after one endpoint sends an RST. Состояние после отправки одной из сторон пакета с установленным флагом RST. - + closed closed - + UDP UDP - - + + single single - + The state if the source host sends more than one packet but the destination host has never sent one back. Состояние после отправики одной из сторон нескольких пакетов и неполучении от второй стороны ни одного пакета в ответ. - - + + multiple multiple - + The state if both hosts have sent packets. Состояние после отправки обеими сторонами пакетов. - + ICMP ICMP - + The state after an ICMP error came back in response to an ICMP packet. Состояние после получения ICMP сообщения об ошибке в ответ на отправленный ICMP пакет. - + error ошибка - + Other Protocols Другие протоколы - + Fragments Фрагменты - + reassembly timeout таймаут пересборки - + state expiration timeout таймаут для состояния соединения - + seconds between purges of expired states and packet fragments. количество секунд для таймаута очистки состояния соединения и фрагментов пакетов. - + seconds before an unassembled fragment is expired. количество секунд для таймаута несобранных фрагментов. - + Adaptive scaling Адаптивное масштабирование - + Timeout values can be reduced adaptively as the number of state table entries grows (see man page pf.conf(5) for details) Значения таймаутов могут изменяться адаптивно в зависимости от ситуации (количества записей в таблице состояний соединений, см. страницу руководства man pf.conf(5)) - + adaptive start начало адаптивного масштабирования - + When the number of state entries exceeds this value, adaptive scaling begins. Когда, количество записей в таблице соединений превысит это значение, включится адаптивное масштабирование. - + adaptive end конец адаптивного масштабирования - + When reaching this number of state entries, all timeout val- ues become zero, effectively purging all state entries imme- diately. Когда, количество записей в таблице соединений достигнет этого значения, все таймауты записей в таблице соединений установятся в ноль, таким образом произойдет немедленная и эффективная её очистка. - + Activate adaptive timeout scaling Включить адаптивное масштабирование таймаутов - + Installer Установщик - + Command line options for the script: Опции командной строки для скрипта: @@ -19052,37 +19564,37 @@ with this address: Каталог на межсетевом экране, в который должны быть установлены файлы конфигурации - + User name used to authenticate to the firewall (leave this empty if you use putty session): Имя пользователя, используемое для аутентификации на межсетевом экране (не заполняйте, если используете putty сессию): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) Альтернативный адрес или имя межсетевого экрана для связи с ним (в Windows поддерживаются названия сессий putty) - + Policy install script (using built-in installer if this field is blank): Скрипт установки набора правил (не заполняйте для использования встроенного скрипта установки): - + A command that installer should execute on the firewall in order to activate the policy (if this field is blank, installer runs firewall script in the directory specified above; it uses sudo if user name is not 'root') Команда, используемая установщиком для загрузки нового набора правил (если это поле пустое, установщик будет выполнять скрипт межсетевого экрана в указанном выше каталоге, он также будет использовать sudo, если имя пользователя не root) - + Logging Запись в журнал (протоколирование) - + Log Prefix Log prefix - + Fallback "deny all" rule should log blocked packets Записывать в журнал блокированные пакеты (только правилом по-умолчанию блокировать все) @@ -19091,208 +19603,243 @@ with this address: Опции скрипта - + Add virtual addresses for NAT Добавлять виртуальные адреса для NAT - + Configure Interfaces of the firewall machine Конфигурировать интерфейсы межсетевого экрана - + Turn debugging on in generated script Включить режим отладки в генерируемом скрипте - + These options enable auxiliary sections in the generated shell script. Эти опции подключают внешние секции в генерируемом shell-скрипте. - + Prolog/Epilog Prolog/Epilog - - + + Edit Редактировать - + The following commands will be added verbatim after generated configuration Следующие команду будут добавлены в конец генерируемого скрипта конфигурации - + The following commands will be added verbatim on top of generated configuration Следующие команду будут добавлены в начало генерируемого скрипта конфигурации - + External install script Внешний скрипт для установки - + Built-in installer Встроенный установщик - + Directory on the firewall where script should be installed Каталог на межсетевом экране, в которые должны быть установлены файлы конфигурации - + Additional command line parameters for ssh Дполнительные опции командной строки для ssh - + state table size: размер таблицы состояний: - + reassembly pool: пул пересборки: - + Limits Ограничения - + + (if left blank, the file name is constructed of the firewall object name and extension ".fw") + + + + + Output file name: + + + + + Buffers incoming packet fragments and reassembles them into a complete packet before passing them to the filter engine. In PF 4.5 and earlier. + + + + + Causes duplicate fragments to be dropped and any overlaps to be cropped. In PF 4.5 and earlier. + + + + + Similar to 'Drop duplicate fragments' except that all duplicate or overlapping fragments will be dropped as well as any further corresponding fragments. In PF 4.5 and earlier. + + + + + Statefully normalises TCP connections. + + + + + Reassemble TCP + + + + table-entries - + maximum number of addresses that canbe stored in tables - + maximum number of entries in the memory pool used for tracking source IP addresses - + maximum number of tables that can exist in the memory simultaneously - + tables - + src-nodes - + Insert prolog and epilog scripts - + in the activation shell script (.fw file) - + in the pf rule file (.conf file) - + Scrub Чистить [SCRUB] - + Additional command line parameters for scp - + Script - + IPv6 IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 - + IPv6 before IPv4 - + Help Справка - + Flush pf states after reloading rules - + Generated script (.fw file) and configuration (.conf) file can be copied to the firewall machine under different names. If these fields are left blank, the file name does not change. - + Script (.fw) file name on the firewall - + .conf file name on the firewall - + Configure CARP Interfaces - + Configure pfsync Interfaces - + Configure VLAN Interfaces - + State policy: - + States can be bound to interfaces or match packets on any interface. The latter can be useful in case of an assymmetric routing. @@ -19333,8 +19880,8 @@ with this address: pixAdvancedDialog - - + + Script Editor Редактор скриптов @@ -19350,17 +19897,17 @@ with this address: pixAdvancedDialog_q - + PIX Firewall Settings Настройки межсетевого экрана PIX - + OK OK - + Cancel Отмена @@ -19377,22 +19924,22 @@ with this address: рабочей станции с адресом: - + Verification of NAT rules Проверка NAT правил - + Check for duplicate nat rules Проверять на наличие дублирующих правил сетевой трансляции адресов (NAT) - + Check for overlapping global pools Проверка наложений глобальных пулов - + Check for overlapping statics Проверка наложений глобальных пулов и статики @@ -19401,58 +19948,57 @@ with this address: Форматирование скрипта - + Comment the code Комментировать код - + Insert comments into generated PIX configuration file Вставить комментарии в генерируемый файл конфигурации межсетевого экрана PIX - + Use ACL remarks Использовать ремарки ACL - + Use ACL remarks to relate ACL commands and policy rules in the GUI Использовать ремарки ACL для задания отношений между командами скрипта и набором правил в GUI - + Group similar commands together Группировать схожие команды вместе - + Group PIX commands in the script so that similar commands appear next to each other, just like PIX does it when you use 'show config' Группировать команды в скрипте, так чтобы схожие команды шли друг за другом, подобно тому, как межсетевой экран PIX вывходит конфигурацию по команде show config - + Policy Compiler Options Опции компилятора набора правил - + Emulate outbound ACLs Эмулировать исходящие ACL - - + Normally PIX does not support ouotbound ACL, however policy compiler can emulate them if this option is turned on Обычно межсетевой экран не поддерживает исходящих ACL, однако компилятор набора правил может эмулировать их, если эта опция включена - + Assume firewall is part of 'any' Считать межсетевой экран частью 'любого' - + Generate rules assuming the firewall is part of "Any". This makes a difference in rules that use services 'ssh' and 'telnet' since PIX uses special commands to control ssh and telnet access to the firewall machine Генерировать правила считая межсетевой экран частью любого. Межсетевой экран PIX использует специальные команды для контроля доступа по протоколам ssh и telnet к самому межсетевому экрану @@ -19463,7 +20009,7 @@ translations in policy rules их трасляции (другие объекты) в наборе правил - + PIX inspects packets with ACLs before it does NAT, while many other firewalls do NAT first and then apply ACLs. Policy compiler can emulate the latter behaviour if this options is turned on. включите эту опцию, чтобы компилятор добавлял команды clear для удаления уже существующих ACL и NAT команд @@ -19472,52 +20018,52 @@ translations in policy rules Генерировать команды clear - + Optimize 'default nat' rules Оптимизировать правила default nat - + In nat rules where network zone object is used in OSrc, ODst and OSrv are 'any' and TSrc defines a global pool for the translation, replace object in OSrc with 'any' to produce PIX command "nat (interface) N 0.0.0.0 0.0.0.0" В правилах сетевой трансляции адресов, когда объект сетевая зона используется в OSrc, ODst и OSrv является любым и TSrc определяет глобальный пул для трасляции, заменять объект в OSrc на любой для формирования команды PIX "nat (interface) N 0.0.0.0 0.0.0.0" - + Ignore empty groups in rules Игнорировать пустые группы в правилах - + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! При выключении этой опции компилятор будет воспринимать пустые группы в наборе правил как ошибку, а при включении - будет удалять при компиляции пустые группы из всех правил. Во втором случае если после удаления группы правило окажется пустым в том месте, где была группа (окажется с полем любой), то такое правило будет игнорироваться. Используйте эту опцию очень внимательно и осторожно! - + Detect rule shadowing in the policy Находить 'затенение' правил в наборе - + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. Затенение происходит, когда одно правило идущее ранее делает одно или несколько следующующих правил не рабочими. Это происходит из-за того, что пакеты, которые должны попадать под условия следующих правил будут попадать под условие первого правило. - + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") Имя файла (по-умолчанию, если пустое, имя будет состоять из названия объекта межсетевого экрана и расширения '.fw') - + Installer Установщик - + User name used to authenticate to the firewall (leave this empty if you use putty session): Имя пользователя, используемое для аутентификации на межсетевом экране (не заполняйте, если используете putty сессию): - + Command line options for the script: Опции командной строки для скрипта: @@ -19526,119 +20072,129 @@ translations in policy rules Скрипт установки набора правил (не заполняйте для использования встроенного скрипта установки): - + Alternative name or address used to communicate with the firewall (also putty session name on Windows) Альтернативный адрес или имя межсетевого экрана для связи с ним (в Windows поддерживаются названия сессий putty) - + Prolog/Epilog Prolog/Epilog - - + + Edit Редактировать - + The following commands will be added verbatim on top of generated configuration Следующие команду будут добавлены в начало генерируемого скрипта конфигурации - + The following commands will be added verbatim after generated configuration Следующие команду будут добавлены в конец генерируемого скрипта конфигурации - + Timeouts Таймауты - + Set all to defaults.. Установить всё в значения по-умолчанию. - + xlate xlate - + + Normally PIX does not support outbound ACL, however policy compiler can emulate them if this option is turned on + + + + + Policy install script (built-in installer will be used if blank): + + + + conn conn - + udp udp - + rpc rpc - + h323 h323 - - + + sip sip - + sip&media sip&media - + unauth unauth - + telnet telnet - + ssh ssh - + ss секунд - + mm минут - + hh часов - + half-closed полузакрытое - + Inactivity Inactivity - + Absolute Absolute @@ -19647,327 +20203,327 @@ translations in policy rules Fixup - + ctiqbe ctiqbe - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + skip пропустить - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + enable включить - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + disable отключить - + Computer Telephony Interface Quick Buffer Encoding (CTIQBE) protocol inspection module that supports NAT, PAT, and bi-directional NAT. Инспекция протокола Computer Telephony Interface Quick Buffer Encoding (CTIQBE). Поддерживает NAT, PAT и двунаправленный NAT. - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + port: порт: - + dns dns - + Based on this maximum-length configured by the user, the DNS fixup checks to see if the DNS packet length is within this limit. Every UDP DNS packet (request/response) undergoes the above check. Указанная масимальная длина, определяет максимальный размер DNS пакета. Любой UDP DNS пакет будет проверяться на это условие исправлением DNS. - + max length: максимальная длина: - + esp ike esp ike - + Enables PAT for Encapsulating Security Payload (ESP), single tunnel. Включить PAT для одного туннеля Encapsulating Security Payload (ESP). - + ftp ftp - + strict: strict: - + Activated support for FTP protocol and allows to change the ftp control connection port number. Расширенная поддержка FTP протокола, позволяет изменять номер порта контролирующего соединения. - + h323 h225 h323 h225 - + Specifies to use H.225, the ITU standard that governs H.225.0 session establishment and packetization, with H.323 Использовать H.225 для H.323 (H.225 - ITU стандарт, который определяет управление сессиями и пакетами H.225.0) - - - - - - - - + + + + + + + + -- -- - + h323 ras h323 ras - + Specifies to use RAS with H.323 to enable dissimilar communication devices to communicate with each other. Использовать RAS с H.323 для разрешения связи различных устройств друг с другом. - + http http - + The default port for HTTP is 80. Use the port option to change the HTTP port, or specify a range of HTTP ports. Портом по-умолчанию для протокола HTTP является 80. Используйте опцию порт для изменения порта HTTP или указания диапазона HTTP портов. - + icmp error ошибка icmp - + Enables NAT of ICMP error messages. This creates translations for intermediate hops based on the static or network address translation configuration on the firewall. Включить NAT для ICMP сообщений об ошибках. Конфигурация создается исходя из уже заданных сетевых трансляций адресов для межсетевого экрана. - + ils ils - + Provides NAT support for Microsoft NetMeeting, SiteServer, and Active Directory products that use LightWeight Directory Access Protocol (LDAP) to exchange directory information with an for Internet Locator Service (ILS) server. Включить NAT для продуктов Microsoft NetMeeting, SiteServer и Active Directory, которые используют LightWeight Directory Access Protocol (LDAP) для обмена информацией со службой каталога с/для сервера Internet Locator Service (ILS). - + mgcp mgcp - + Enables the Media Gateway Control Protocol (MGCP) fixup. Включить исправление для Media Gateway Control Protocol (MGCP). - + Gateway Port: Порт маршрутизатора: - + Call Agent port: Порт вызывающего агента: - + pptp pptp - + Enables Point-to-Point Tunneling Protocol (PPTP) application inspection. Включить инспекцию соединений PPTP на уровне приложений OSI. - + rsh rsh - + Enables inspection of RSH protocol. Включить инспекцию соединений по протоколу RSH. - + rtsp rtsp - + Lets PIX Firewall pass Real Time Streaming Protocol (RTSP) packets. RTSP is used by RealAudio, RealNetworks, Apple QuickTime 4, RealPlayer, and Cisco IP/TV connections. Разрешить прохождение пакетов протоколов Real Time Streaming Protocol (RTSP). RTSP используется для соединений RealAudio, RealNetworks, Apple QuickTime 4, RealPlayer, и Cisco IP/TV. - + Enable or change the port assignment for the Session Initiation Protocol (SIP) for Voice over IP TCP connections. Включить или изменить назначение порта для Session Initiation Protocol (SIP) для TCP соединений VoIP. - + sip udp sip udp - + Enable SIP-over-UDP application inspection. Включить SIP-over-UDP инспекцию на уровне приложений. - + skinny skinny - + Enable SCCP application inspection. SCCP protocol supports IP telephony and can coexist in an H.323 environment. An application layer ensures that all SCCP signaling and media packets can traverse the PIX Firewall and interoperate with H.323 terminals. Включить SCCP инспекцию на уровне приложений. SCCP протокол поддерживает IP телефонию и может сосуществовать с имеющейся средой H.323. На уровне приложений проверяется, что управляющие и пакеты данных SCCP могут проходить через PIX и взаимодействовать с H.323 терминалами. - + smtp smtp - + Enables the Mail Guard feature, which only lets mail servers receive the RFC 821, section 4.5.1, commands of HELO, MAIL, RCPT, DATA, RSET, NOOP, and QUIT. All other commands are translated into X's which are rejected by the internal server. Включить режим Mail Guard, который разрешает почтовым серверам получать только команды, определенные в RFC821, секции 4.5.1: HELO, MAIL, RCPT, DATA, RSET, NOOP и QUIT. Все другие команды транслируются на внутренний сервер PIX, который их блокирует. - + sqlnet sqlnet - + Enables support for SQL*Net protocol. Включить поддержку протокола SQL *Net. - + tftp tftp - + Enable TFTP application inspection. Генерировать команды-исправления: - + Enable all protocols Включить все протоколы - + Skip all protocols Пропустить все протоколы - + Disable all protocols Отключить все протоколы - + Logging Запись в журнал (протоколирование) @@ -19976,167 +20532,161 @@ translations in policy rules Syslog - Syslog host (name or IP address): - Имя узла syslog (имя или IP-адрес): + Имя узла syslog (имя или IP-адрес): - + syslog facility: syslog facility: - + syslog level ('logging trap'): syslog level (logging trap): - + Syslog message queue size (messages): Размер очереди сообщений syslog (кол-во сообщений): - + Use 'EMBLEM' format for syslog messages Использовать формат EMBLEM для сообщений syslog - + PIX Firewall Version 6.3 introduces support for EMBLEM format, which is required when using the CiscoWorks Resource Manager Essentials (RME) syslog analyzer. Начиная с версии 6.3 межсетевого экрана PIX добавлена поддержка формата EMBLEM, который требуется для использования анализатора syslog из CiscoWorks Resource Manager Essentials (RME). - + Set device id for syslog messages (v6.3 and later): Установить идентификатор для сообщений syslog (для PIX версий 6.3 и выше): - + use address of interface использовать адрес для интерфейса - + use text string использовать тектовую строку - + use hostname использовать имя узла - + Replace NAT'ted objects with their translations in policy rules - + Check for overlapping global pools and statics test - + Always permit ssh access from the management workstation with this address: - + Instead of running generated configuration on the firewall line by line, installer can use scp to copy the file and then "copy file running-config" command to activate it. Ssh v2 and scp servers should be configured on the firewall for this to work. This method works for PIX v7 or later and is much faster than running configuration line by line. - + Copy generated configuration file to the firewall using scp - + File system on the firewall where configuration file should be saved if it is copied with scp. Examples: "flash:", "disk0:". Should end with a colon ":". If this input field is left blank, installer uses "flash:": - - Policy install script : - - - - - Built-in installer will be used if policy install script field is blank. - - - - + The logging timestamp command requires that the clock command be set. Команда записи в журнал времени протколирования требует установки команды clock. - + Enable logging timestamps on syslog file Включить запись в файл журнала syslog времени протоколирования - + Other logging destinations and levels: Другие назначения протоколирования и уровни: - + Internal buffer Внутренний буфер - + Console Консоль - + + Script (additional) + + + + Compiler can generate PIX configuration without commands that configures interfaces, timeouts and inspectors. These parts of configuration change rarely so it makes no sense to execute the same commands again and again. In addition, runnig the same commands on configuration reload cause errors. Use this option to generate shortened configuration to avoid errors and make update faster. - + Generate only access-list, access-group, telnet, ssh, nat, global and static commands - + PIX Options Опции PIX - + Actively reset inbound TCP connections with RST Активно сбрасывать входящие TCP соединения при помощи RST - + Actively reset inbound TCP connections with RST on outside interface Активно сбрасывать входящие TCP соединения при помощи RST на внешнем интерфейсе - + Force each TCP connection to linger in a shortened TIME&WAIT Установить каждое TCP соединение в медленное состояние TIME&WAIT - + Alt+W Alt+W - + Enable the IP Frag Guard feature (deprecated in v6.3 and later). Включить IP Frag Guard (запрещено в PIX версии 6.3 и выше). - + Enable TCP resource control for AAA Authentication Proxy Включить контроль TCP ресурсов для AAA аутентифицирующего прокси - + Specify that when an incoming packet does a route lookup, the incoming interface is used to determine which interface the packet should go to, and which is the next hop @@ -20148,42 +20698,42 @@ the packet should go to, and which is the next hop (запрещено в PIX версии 6.3 и выше). - + Disable inbound embedded DNS A record fixups Выключить исправления входящих вложенных DNS A записей - + Disable outbound DNS A record replies Выключить исходящие ответы с DNS A записями - + maximum number of simultaneous TCP and UDP connections макимальное число одновременных TCP и UDP соединений - + maximum number of embryonic connections per host макимальное число порождаемых соединений на узел - + Specifies the maximum number of simultaneous TCP and UDP connections for the entire subnet. The default is 0, which means unlimited connections. (Idle connections are closed after the idle timeout specified by the timeout conn command.) Указывает максимальное число одновременных TCP и UDP соединения для всей подсети. По-умолчанию равно 0, что означает неограниченное число соединений. (Проставивающие соединения закрываются после таймаута idle, указываемого в команде conn.) - + Specifies the maximum number of embryonic connections per host. An embryonic connection is a connection request that has not finished the necessary handshake between source and destination. Set a small value for slower systems, and a higher value for faster systems. The default is 0, which means unlimited embryonic connections. Указывает максимальное число порожденных соединений для узла. По-умолчанию равно 0, что означает неограниченное число соединений. Порожденным является соединение, которое не было установлено (выполнен необходимый обмен пакетами между сторонами). Установите маленькое значение для медленных систем и большое для быстрых. - + The following parameters are used for all NAT rules: Следующие параметры используются для всех правил NAT: - + (The default for both parameters is 0, which means unlimited number of connections.) (По-умолчанию оба параметра равны 0, что означает неограниченное число соединений.) @@ -20215,7 +20765,7 @@ Builder for PIX. он использовался в старых версиях Firewall Builder for PIX. - + Temporary access list should permit access from this address or subnet (use prefix notation to specify subnet, e.g. 192.0.2.0/24): Не очищать списки доступа и группы объектов, просто сгенерировать команды PIX для новых списков и групп. Эта опция полезна при использовании своих @@ -20243,27 +20793,27 @@ maintained without interruption at a cost of slightly larger configuration. - + External install script Внешний скрипт для установки - + Built-in installer Встроенный установщик - + Additional command line parameters for ssh Дполнительные опции командной строки для ssh - + Use manual ACL commit on FWSM Использовать ручное подтверждение ACL для FWSM - + Clear all access lists then install new ones. This method may interrupt access to the firewall if you manage it remotely via IPSEC tunnel. This is the way access lists were generated in older versions of Firewall Builder for PIX. Очистить все списки доступа и установить новые. Этот метод может нарушить доступ к межсетевому экрану если вы управляете им удаленно через IPSec, он использовался в старых версиях Firewall Builder for PIX. @@ -20272,7 +20822,7 @@ maintained without interruption at a cost of slightly larger configuration.Не очищать списки доступа и группы объектов, просто сгенерировать команды PIX для новых списков и групп. Эта опция полезна при использовании своих скриптов установки набора правил. - + "Safety net" method: First, create temporary access list to permit connections from the management subnet specified below to the firewall and assign it to outside interface. This temporary ACL helps maintain session between management station and the firewall while access lists are reloaded in case connection comes over IPSEC tunnel. Then clear permanent lists, recreate them and assign to interfaces. This method ensures that remote access to the firewall is maintained without interruption at a cost of slightly larger configuration. @@ -20282,7 +20832,7 @@ First, create temporary access list to permit connections from the management su правил, временные списки доступа удаляются. Этот метод гарантирует удаленный доступ к межсетевому экрану без прерываний, за счет немного большего размера конфигурации. - + Policy compiler generates 'fixup' commands for PIX v6.1-6.3 and FWSM v2.3. For PIX 7.0 it generates 'class-map' and 'inspect' commands assigned to the 'policy-map' under either default or custom inspection classes. Компилятор набора правил генерирует команды 'fixup' для PIX версий 6.1-6.3 и FWSM версии 2.3, для PIX версии 7.0 он генерирует команды 'class-map' и 'inspect' связанные с 'policy-map' либо через стандартные (по-умолчанию), либо через пользовательские классы инспекций. @@ -20291,52 +20841,57 @@ First, create temporary access list to permit connections from the management su Показывать генерируемые команды - + Inspect Инспектировать - + Generate outbound ACLs - + Compiler - + Additional command line parameters for scp - + + Syslog host (IP address): + + + + Script - + IPv6 IPv6 - + The order in which ipv4 and ipv6 rules should be generated: - + IPv4 before IPv6 - + IPv6 before IPv4 - + Do not clear access lists and object group, just generate PIX commands for the new ones. Use this option if you have your own policy installation scripts. @@ -20385,141 +20940,141 @@ First, create temporary access list to permit connections from the management su pixosAdvancedDialog_q - + PIX Advanced Configuration Options Раширенные настройки конфигурации PIX - + General Общие - + Set PIX host name using object's name Установить имя узла межсетевого экрана PIX в название объекта - + Generate commands to configure addresses for interfaces Конфигурировать интерфейсы межсетевого экрана - + NTP NTP - + NTP Servers: NTP серверы: - + Server 1: Сервер 1: - + Server 2: Сервер 2: - + Server 3: Сервер 3: - + Preffered: Предпочтительный: - - + + IP address: IP адрес: - + SNMP SNMP - + Disable SNMP Agent Отключить SNMP агента - + Set SNMP communities using data from the firewall object dialog Установить SNMP строки community из диалога объекта межсетевой экран - + SNMP servers SNMP серверы - - + + Poll Poll - - + + Poll and Traps Poll and Traps - - + + Traps Ловушки - + Enable: Включить: - + SNMP Server 1: SNMP сервер 1: - + SNMP Server 2: SNMP сервер 2: - + Enable sending log messages as SNMP trap notifications Включить протоколирование оповещением SNMP ловушек - + Options Опции - + Change TCP MSS to Установить TCP MSS в - + bytes байт - + OK OK - + Cancel Отмена @@ -20573,34 +21128,44 @@ First, create temporary access list to permit connections from the management su prefsDialog_q - + Preferences Настройки - + + Enable object tooltips in the tree and rule sets + + + + + Properties of specific object types: + + + + &OK OK - + &Cancel Отмена - + General Общие - + Working directory: Рабочий каталог: - - - + + + Browse... Выбрать... @@ -20621,7 +21186,7 @@ First, create temporary access list to permit connections from the management su Раскрыть все дерево объектов - + Tooltip delay: Задержка всплывающей подсказки: @@ -20630,22 +21195,21 @@ First, create temporary access list to permit connections from the management su Автоматически сохранять данные в диалогах при переключении между объектами - + Periodically save data to file every Периодически сохранять данные в файл, каждые - + minutes минут - Enable object tooltips - Включить всплывающие подсказки для объектов + Включить всплывающие подсказки для объектов - + Show deleted objects Показывать удаленные объекты @@ -20654,7 +21218,7 @@ First, create temporary access list to permit connections from the management su Управление версиями (ревизиями) - + Do not ask for the log record when checking in new file revision. Всегда помещать файл в систему контроля версий с пустой записью в журнал. @@ -20703,47 +21267,47 @@ First, create temporary access list to permit connections from the management su Путь к файлу - + Labels Метки - + Use these labels to mark rules in the firewall policy Использовать эти метки для маркировки правил в наборе - + Green Зеленый - + Purple Пурпурный - + Red Красный - + Orange Оранжевый - + Blue Синий - + Gray Серый - + Yellow Желтый @@ -20768,7 +21332,7 @@ First, create temporary access list to permit connections from the management su Иконки - + Show icons in rules Показывать иконки в правилах @@ -20777,22 +21341,22 @@ First, create temporary access list to permit connections from the management su Размер иконок: - + 25x25 25x25 - + 16x16 16x16 - + Clip comments in rules Обрезать в правилах комментарии по размеру ячейки - + Icons settings Настройки иконок @@ -20801,23 +21365,23 @@ First, create temporary access list to permit connections from the management su Шрифты - + Choose font for rules sets Выберите шрифт для правил - + Rules font Шрифт правил - - + + Choose font for tree Выберите шрифт для дерева - + Tree font Шрифт дерева @@ -20830,199 +21394,209 @@ First, create temporary access list to permit connections from the management su Шрифт интерфейса - + Software Updates: Проверка наличия новых версий программы: - + Check for updates automatically Проверять автоматически - + Check Now Проверить сейчас - + Use http proxy while checking for updates (host:port) Использовать http proxy при проверке на наличие новых версий (host:port) - + Show text descriptions in columns "Direction", "Action" Показывать текстовые пояснения в колонках "Направление" и "Действие" - + rules font description описание шрифта для правил - + tree font description описание шрифта для дерева объектов - + A full path to the Secure Shell utility (remote command execution; for example ssh on Unix or plink.exe on Windows): Полный путь к утилите SSH (исполнение команд на другом компьютере; наример ssh на Unix или plink.exe на Windows): - + A full path to the SCP utility (file copy over ssh; for example scp on Unix or pscp.exe on Windows): Полный путь к утилите SCP (копирование файлов на другой компьютер; наример scp на Unix или pscp.exe на Windows): - + Objects Объекты - + Data File Файл данных - + Enable compression of the data file Включить сжатие файла данных - + No identifiable information will be sent to the server during update check - + Do not show tips on startup - + Show object attributes in the tree - - Properties of specific object types - - - - + DNS Name DNS имя - - + + Create new objects in "Compile Time" mode by default - - + + Create new objects in "Run Time" mode by default - + Use object name for the DNS record in all objects of this type - + Address Table Таблица адресов - + Installer - + + Value for the ServerAliveInterval ssh configuration parameter. This parameter sets timeout interval in seconds after which if no data has been received from the server, ssh client will send a message through the encrypted channel to request a response from the server. This helps detect disconnects between fwbuilder policy installer and the firewall. If set to 0, these messages will not be sent to the server and loss of connectivity with the firewall will lead to hanging of the installer session. Scp uses different parameter for this, ConnectTimeout. Fwbuilder automatically calculates the value for this parameter using the same timeout value. Note that this only works with ssh protocol v2. + + + + + sec + сек + + + + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> +<html><head><meta name="qrichtext" content="1" /><style type="text/css"> +p, li { white-space: pre-wrap; } +</style></head><body style=" font-family:'Sans Serif'; font-size:9pt; font-weight:400; font-style:normal;"> +<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><a href="http://www.chiark.greenend.org.uk/~sgtatham/putty/"><span style=" font-family:'Lucida Grande'; font-size:8pt; text-decoration: underline; color:#0000ff;">http://www.chiark.greenend.org.uk/~sgtatham/putty/</span></a></p></body></html> + + + + Built-in policy installer can remember passwords for the duration of the session. Passwords are never stored permanently, they are only kept in memory. In order to use this feature, you also need to configure user name used to authenticate to the firewall in the "advanced" settings dialog of the firewall object. - + Warning: using this feature creates certain risk if working Firewall Builder GUI is left unattended on the unlocked workstation. Someone may walk up to the machine and make changes to the firewall using cached password of the administrator who used the same GUI session before. Always lock the screen or exit Firewall Builder GUI when leaving computer. - + Download plink.exe and pscp.exe from the web site at - - <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> -<html><head><meta name="qrichtext" content="1" /><style type="text/css"> -p, li { white-space: pre-wrap; } -</style></head><body style=" font-family:'Lucida Grande'; font-size:13pt; font-weight:400; font-style:normal;"> -<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; font-size:8pt;"><a href="http://www.chiark.greenend.org.uk/~sgtatham/putty/"><span style=" text-decoration: underline; color:#0000ff;">http://www.chiark.greenend.org.uk/~sgtatham/putty/</span></a></p></body></html> - - - - + Appearance - + Compiler Output Panel font - + compiler output font description - + Icons size in rules: - + + Show text under toolbar icons + + + + Platforms and OS - + If you disable firewall platform or host OS here, it will not appear in the drop-down lists of platforms and host OS anywhere in the program. This helps avoid clutter in lists of platforms and OS if you only work with one or two of them. - + Supported firewall platforms - + Supported host OS - + Platform - + Host OS - + Enable password caching for the duration of the session (passwords are never stored permanently) - + Enable password caching @@ -21045,472 +21619,656 @@ are never stored permanently) textLabel1 + + procurveaclAdvancedDialog + + + + Script Editor + + + + + procurveaclAdvancedDialog_q + + + HP ProCurve ACL Firewall Settings + + + + + Compiler Options + + + + + Output file name (if left blank, the file name is constructed of the firewall object name and extension ".fw") + Имя файла (по-умолчанию, если пустое, имя будет состоять из названия объекта межсетевого экрана и расширения '.fw') + + + + Compiler creates multiple access lists from the same policy, +two for each interface: one for inbound and another for +outbound. If the policy is written in a such way that no rule +can possibly be associated with an interface, this interface +gets no access list at all. Also, interfaces marked as +"unprotected" never get access list regardless of how the policy +rules are designed. + + + + + + Generate separate access list for each interface + + + + + Compiler creates one access list and assigns it to all +interfaces. + + + + + + Create one access list and attach it to all interfaces + + + + + Policy Compiler Options + + + + + If the option is deactivated, compiler treats empty groups as an error and aborts processing the policy. If this option is activated, compiler removes all empty groups from all rule elements. If rule element becomes 'any' after the last empty group has been removed, the whole rule will be ignored. Use this option only if you fully understand how it works! + + + + + Ignore empty groups in rules + + + + + Shadowing happens because a rule is a superset of a subsequent rule and any packets potentially matched by the subsequent rule have already been matched by the prior rule. + + + + + Detect rule shadowing in the policy + + + + + Always permit ssh access from the management workstation with this address: + + + + + Script Options + + + + + Clear all access lists then install new ones. This method may interrupt access to the firewall if you manage it remotely via tunnel. + + + + + Do not clear access lists, just generate commands for the new ones. Use this option if you have your own policy installation scripts. + + + + + "Safety net" method: + +First, create temporary access list to permit connections from the management subnet specified below to the firewall and assign it to outside interface. This temporary ACL helps maintain session between management station and the firewall while access lists are reloaded in case connection comes over IPSEC tunnel. Then clear permanent lists, recreate them and assign to interfaces. This method ensures that remote access to the firewall is maintained without interruption at a cost of slightly larger configuration. + "Безопасный метод": + +Сначала создаются временные списки доступа для разрешения соединений с управляющего узла или подсети, указанных ниже. Это необходимо для создания и поддержания временного доступа управляющей рабочей станции к межсетевому экрану во время установки набора правил (особенно в случае, если управляющее соединение идет через IPSec). После установки набора +правил, временные списки доступа удаляются. Этот метод гарантирует удаленный доступ к межсетевому экрану без прерываний, за счет немного большего размера конфигурации. + + + + Temporary access list should permit access from this address or subnet (use prefix notation to specify subnet, e.g. 192.0.2.0/24): + + + + + + Insert comments into generated IOSACL configuration file + + + + + Comment the code + + + + + Use ACL remarks + + + + + Installer + + + + + Built-in installer + Встроенный установщик + + + + User name used to authenticate to the firewall (leave this empty if you use putty session): + + + + + Alternative name or address used to communicate with the firewall (also putty session name on Windows) + + + + + Additional command line parameters for ssh + Дполнительные опции командной строки для ssh + + + + Additional command line parameters for scp + + + + + Instead of running generated configuration on the router line by line, installer can use scp to copy the file and then "copy file running-config" command to activate it. Ssh v2 and scp servers should be configured on the router for this to work. This method is much faster than running configuration line by line. + + + + + Copy generated configuration file to the router using scp + + + + + File system on the router where configuration file should be saved if it is copied with scp. Examples: "flash:", "disk0:". Should end with a colon ":". If this input field is left blank, installer uses "nvram:": + + + + + External install script + Внешний скрипт для установки + + + + Policy install script (using built-in installer if this field is blank): + + + + + Command line options for the script: + + + + + Prolog/Epilog + + + + + + Edit + + + + + The following commands will be added verbatim on top of generated configuration + + + + + The following commands will be added verbatim after generated configuration + + + + + Logging + + + + + Generate logging commands + + + + + Syslog + + + + + Syslog host (name or IP address): + + + + + syslog facility: + + + + + syslog level ('logging trap'): + + + + + The logging timestamp command requires that the clock command be set. + + + + + Enable logging timestamps on syslog file + + + + + Other logging destinations and levels: + + + + + Internal buffer + + + + + Console + + + + + IPv6 + IPv6 + + + + The order in which ipv4 and ipv6 rules should be generated: + + + + + IPv4 before IPv6 + + + + + IPv6 before IPv4 + + + + + OK + + + + + Cancel + + + secuwallAdvancedDialog - - Select templates directory - - - - - URL is not valid: %1 - - - - - Could not open URL: %1 - - - - Illegal address '%1' - Некорректный адрес %1/%2 {1'?} + Некорректный адрес %1/%2 {1'?} - - Empty address found (position %1) - - - - - Illegal address '%1' (position %2) - - - - - Input not valid: %1 + + + Script Editor secuwallAdvancedDialog_q - - secunet wall: advanced settings + + iptables: advanced settings - + Help Справка - + &OK - + &Cancel - - Management + + Compiler - - secunet wall Management settings + + Compiler: - - Specify secunet wall Management settings below. -Please use commas to separate a list of IP addresses. + + Command line options for the compiler: - - Management address + + Assume firewall is part of 'any' - - Enter the IP address of the secunet wall Management station + + Accept TCP sessions opened prior to firewall restart - - Syslog server + + Accept ESTABLISHED and RELATED packets before the first rule - - Enter IP address of the logging server + + Drop packets that are associated with +no known connection + Блокировать пакеты, которые не относятся +к известным соединениям + + + + and log them + и протоколировать их + + + + Bridging firewall - - SNMP querier address + + Detect shadowing in policy rules - - Enter IP address where SNMP requests to this firewall come from + + Ignore empty groups in rules - - RO-SNMP string + + Enable support for NAT of locally originated connections - - Enter community string for read only SNMP access + + This adds a rule on top of the policy with iptables target TCPMSS +and option --clamp-mss-to-pmtu. Generation of this command is +version-dependent and also depends on the setting of ip or ipv6 forwarding +in host settings dialog. + - - NTP server IP address + + Clamp MSS to MTU - - Enter IP address of a NTP server + + Make Tag and Classify actions terminating - - Nagios service IP + + Default action on 'Reject': - - Enter IP address of the Nagios station here + + Always permit ssh access from the management workstation with this address: - - Local /var partition + + Install the rule for ssh access from the management workstation when the firewall +is stopped - - Enter name for partition that will be mounted to /var + + Installer - - Local config partition + + Built-in installer + Встроенный установщик + + + + Additional command line parameters for ssh + Дполнительные опции командной строки для ssh + + + + Additional command line parameters for scp - - Enter name for local config partition + + Alternative name or address used to communicate with the firewall (also putty session name on Windows) - - DNS Client - - - - - secunet wall DNS settings - - - - - Specify secunet wall DNS client related settings below - - - - - DNS servers - - - - - Search domains - - - - - Enter DNS search domains here. One search domain per line - - - - - Hosts file - - - - - Enter Hosts entries here. One IP-Address/Name pair per line. These entries will be written to /etc/hosts file on the firewall - - - - - The resolution order defines how hostnames will be resolved on the firewall (nsswitch.conf). Default is "Hosts file first" - - - - - Resolution order - - - - - - - - - Hosts - - - - - - - - - DNS - - - - - - - - NIS + External install script + Внешний скрипт для установки + + + + Policy install script (using built-in installer if this field is blank): - - - - - - NIS+ - - - - - - - - DB + Command line options for the script: + + + + + Prolog/Epilog + + + + + + Edit + + + + + The following commands will be added verbatim after generated configuration - Options + The following commands will be added verbatim on top of generated configuration - - Specify secunet wall advanced iptables/routing options below - - - - - IPv4 Packet forwarding - + + Insert prolog script + Вставить скрипт пролога - - - - - - - - - - - - - - - - No change - + on top of the script + в начало скрипта - - - - - - - - - - - - - - - - On - + after interface configuration + после конфигурирования интерфейсов - - - - - - - - - - - - - - - - Off + after policy reset + после удаления страрого набора правил + + + + Logging - - IPv6 Packet forwarding + + use ULOG - - Kernel anti-spoofing protection + + use LOG - - Ignore broadcast pings + + log TCP seq. numbers - - Ignore all pings + + log IP options - - Accept source route + + use numeric syslog levels - - Accept ICMP redirects + + Log level: + + + + + log TCP options + + + + + cprange + + + + + queue threshold: + + + + + netlink group: - Ignore bogus ICMP errors + Log prefix: - - Allow dynamic addresses + + Logging limit: - - Log martians + + Activate logging in all rules +(overrides rule options, use for debugging) - - whats this text - whats this comment + + Script - - TCP + + Allow reboot to load modules (only if needed) - - These parameters make sense for connections to or from the firewall host + + Turn debugging on in generated script - - TCP FIN timeout (sec) + + Managing interfaces and addresses - - TCP keepalive time (sec) + + Verify interfaces before loading firewall policy - - TCP window scaling + + Configure Interfaces of the running firewall machine - - TCP sack + + Add virtual addresses for NAT - - TCP fack + + Generated script can load rules one by one by calling iptables command line utility, or activate them all at once using iptables-restore. In both cases you just run the script with command line parameter "start" to activate the policy, the script will use iptables-restore automatically if this checkbox is on. - - TCP ECN + + iptables-restore replaces firewall policy in one atomic transaction + iptables-restore заменяет набор правил межсетевого экрана единой атомарной транзакцией + + + + Use iptables-restore to activate policy + Использовать команду iptables-restore для включения набора правил + + + + Warning: rebooting breaks the connectivity until the firewall is up again. The outage can be up to minutes, depending on how fast the machine restarts. - - TCP SYN cookies + + If debugging is turned on, the script will run with shell option "-x" that makes it print every command it executes. Warning: this produces a lot of debugging output. - - TCP timestamps + + Warning: this breaks the connectivity until all interfaces are 'up' again. The outage is typically < 10 seconds - - Files - - - - - Enable support for additional files here. Files in the selected templates directory will be added to the configuration of this Firewall. - - - - - Add additional files to firewall configuration - - - - - Template directory - - - - - Select templates directory for this Firewall - - - - Browse - Выбрать - - - - Open current path in file browser - - - - - Open - + Выбрать @@ -21572,97 +22330,570 @@ Please use commas to separate a list of IP addresses. + + secuwallosAdvancedDialog + + + Select templates directory + + + + + URL is not valid: %1 + + + + + Could not open URL: %1 + + + + + Empty address found (position %1) + + + + + Illegal address '%1' (position %2) + + + + + Input not valid: %1 + + + + + secuwallosAdvancedDialog_q + + + secunet wall: advanced settings + + + + + Help + Справка + + + + &OK + + + + + &Cancel + + + + + Management + + + + + secunet wall Management settings + + + + + Specify secunet wall Management settings below. +Please use commas to separate a list of IP addresses. + + + + + Management access + + + + + Enter the IP addresses or networks of the secunet wall management zone + + + + + Syslog servers + + + + + Enter IP addresses of logging servers + + + + + SNMP access + + + + + Enter IP addresses or networks where SNMP requests to this firewall come from + + + + + RO-SNMP string + + + + + Enter community string for read only SNMP access + + + + + NTP servers + + + + + Enter IP addresses of NTP servers + + + + + Nagios access + + + + + Enter IP addresses or networks for Nagios access + + + + + Local /var partition + + + + + Enter name for partition that will be mounted to /var + + + + + Local config partition + + + + + Enter name for local config partition + + + + + Disable auto-generation of firewall rules for management services + + + + + Don't create firewall rules + + + + + DNS Client + + + + + secunet wall DNS settings + + + + + Specify secunet wall DNS client related settings below + + + + + DNS servers + + + + + Search domains + + + + + Enter DNS search domains here. One search domain per line + + + + + Hosts file + + + + + Enter Hosts entries here. One IP-Address/Name pair per line. These entries will be written to /etc/hosts file on the firewall + + + + + The resolution order defines how hostnames will be resolved on the firewall (nsswitch.conf). Default is "Hosts file first" + + + + + Resolution order + + + + + + + + + Hosts + + + + + + + + + DNS + + + + + + + + + NIS + + + + + + + + + NIS+ + + + + + + + + + DB + + + + + Options + + + + + Specify secunet wall advanced iptables/routing options below + + + + + IPv4 Packet forwarding + + + + + + + + + + + + + + + + + + + + No change + + + + + + + + + + + + + + + + + + + + On + + + + + + + + + + + + + + + + + + + + Off + + + + + IPv6 Packet forwarding + + + + + Kernel anti-spoofing protection + + + + + Ignore broadcast pings + + + + + Ignore all pings + + + + + Accept source route + + + + + Accept ICMP redirects + + + + + Ignore bogus ICMP errors + + + + + Allow dynamic addresses + + + + + Log martians + + + + + whats this text + whats this comment + + + + + TCP + + + + + These parameters make sense for connections to or from the firewall host + + + + + TCP FIN timeout (sec) + + + + + TCP keepalive time (sec) + + + + + TCP window scaling + + + + + TCP sack + + + + + TCP fack + + + + + TCP ECN + + + + + TCP SYN cookies + + + + + TCP timestamps + + + + + Files + + + + + Enable support for additional files here. Files in the selected templates directory will be added to the configuration of this Firewall. + + + + + Add additional files to firewall configuration + + + + + Template directory + + + + + Select templates directory for this Firewall + + + + + Browse + Выбрать + + + + Open current path in file browser + + + + + Open + + + solarisAdvancedDialog_q - + Solaris: advanced settings Solaris: расширенные настройки - + &OK OK - + &Cancel Отмена - + Options Опции - + Ignore ICMP redirects Игнорировать пакеты ICMP redirect - - - - - + + + + + No change Без изменений - - - - - + + + + + On Включить - - - - - + + + + + Off Выключить - + Forward directed broadcasts Маршрутизировать направленные широковещательные пакеты - + Respond to echo broadcast Отвечать на широковещательные ICMP ping пакеты - + Packet forwarding Маршрутизация пакетов - + Forward source routed packets Маршрутизировать пакеты с маршрутизацией источника - + Path Путь - + ipf: ipf: - + ipnat: ipnat: - + Specify directory path and a file name for the following utilities on the OS your firewall machine is running. Leave these empty if you want to use default values. Укажите полный путь к перечисленным утилитам в операционной системе этого межсетевого экрана. Для незаполненных полей будут использованы значения по-умолчанию. @@ -21670,32 +22901,38 @@ Please use commas to separate a list of IP addresses. transferDialog - + Transfer error: %1 - + + &Continue - + + No firewalls selected for transfer + + + + Waiting - + Error: Failed to start program - + Error: Waiting for program termination - + Error: Program returned failure status @@ -21703,12 +22940,12 @@ Please use commas to separate a list of IP addresses. transferDialog_q - + Config transfer options - + <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <html><head><meta name="qrichtext" content="1" /><style type="text/css"> p, li { white-space: pre-wrap; } @@ -21717,78 +22954,78 @@ p, li { white-space: pre-wrap; } - + Select usbstick volume to start firewall config transfer: - + Select a portable disk volume to transfer firewall configs - + Device - + Size Размер - + Mounted - + Mountpoint - + Filesystem - + Double click on a firewall in this tree to jump to the corresponding process log entry - + Firewall - + Progress Прогресс - + Process log Журнал обработки - + Save log to file Сохранить журнал в файл - + Start the export! - + Transfer Перенос конфигурации - - Cancel + + Close @@ -21841,7 +23078,7 @@ p, li { white-space: pre-wrap; } vrrpOptionsDialog - + Input not valid: %1 @@ -21869,17 +23106,22 @@ p, li { white-space: pre-wrap; } - + + Use IPsec AH protected VRRP + + + + VRRP Secret - + Virtual Router ID - + VRID