Oldest known version of this page was edited on 2007-08-19 02:11:41 by ChrisBuechler []

Future Goals

This page will be maintained as a list of things we want to do post version 1.0. If we kept perpetually adding things we want to see in the project, we would never reach stable status. As of August 2005, we are in a feature freeze for the first beta release, to eventually become release 1.0. These are things we want to incorporate after reaching that milestone.

Basic/advanced segregation

Many pages have a long, long list of options, many of which will never be used by most users, and many of which will confuse those that aren't intricately familiar with firewalls. As one example, on the firewall rules pages, source port, advanced options, state type, state timeout, and gateway will not be used by the vast majority of users. We should hide these options unless "advanced" mode is enabled, or hide them all under an advanced section on the page that can be expanded.

Fix access of NAT'ed services from internal networks

resolve this issue that I'm tired of hearing about and tired of trying to get users to understand and work around. same as: http://m0n0.ch/wall/docbook/faq-lannat.html∞

thoughts

• you can use netcat to "bounce" the connections
• maybe a transparent DNS proxy exists that can rewrite the DNS replies containing any defined public IP addresses. Seems like a kludge, but that's how Cisco handles it with the PIX
• there supposedly is some sort of NAT bouncing trick workaround that works on ipfilter/ipnat, with the only caveat being you need to rewrite those NAT rules whenever the WAN IP changes (dhclient exit hooks?). Sorry for the lack of detail, it was discussed on the m0n0wall list at some point in the past. Same might work with pf, or pf might have its own work around somebody knows of