### Copyright (C) 1997 John D. Hardin
### This program is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### This program is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with this program; if not, write to the Free Software
### Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

### $Id: masq.template,v 2.18 1999-09-14 21:55:14-07 jhardin Exp $

proc masq {} {
    # IP Masquerade Settings

    Desc "IP Masquerade settings"

    ShortDesc "IP-Masq settings"

    Header head1 -text "IP Masquerade settings"\
	    -background gray\
	    -help "IP Masquerading allows your firewall to hide the existence of the local network"\
	    "while permitting computers on the local network to access the Internet transparently"\
	    "even if they have IP addresses that are not valid for use on the Internet.\n"\
	    "Computers being masqueraded should have their default gateway set to the firewall;"\
	    "if you have a router, configure its routing tables to route Internet"\
	    "addresses to the firewall."

    Label label1 -text "IP Masquerade support"\
            -textafter "compiled into the kernel."\
	    -default ""\
	    -packFrame:anchor center \
	    -help "IP Masquerade support must be compiled into the kernel. If it is not,"\
	    "then you must configure and build a new kernel; see the Kernel HOWTO for"\
	    "instructions.\n\nNote: IP Masquerade is experimental in kernels prior to 2.0.30 -"\
	    "you must select \"Yes\" when asked \"Prompt for development and/or incomplete"\
	    "code/drivers\" in \"Code Maturity Level Options\". You should upgrade"\
            "to the newest kernel, as new features for masquerade support have been added."

    Label label4 -text "IP Forwarding support"\
            -textafter "compiled into the kernel."\
	    -default "is"\
	    -packFrame:anchor center \
	    -help "Forwarding support must be compiled into the kernel if you wish to transfer"\
	          "packets between the local network and the Internet. If it is not,"\
	          "then you must configure and build a new kernel; see the Kernel HOWTO for"\
	          "instructions."

    Label label2 -text "A local network"\
	    -default ""\
	    -packFrame:anchor center \
	    -help "You can only masquerade if there are other computers on the local network."

    CheckBox masquerade -text "Enable IP Masquerading"\
	    -default 0\
	    -packFrame:anchor center \
	    -help "Enable configuration of IP Masquerading.\nThis will set the default"\
	          "policy for forwarding to DENY for security reasons."

    Header head2 -text "Services to Masquerade"\
        -background gray\
	-help "Here you list the services you wish to masquerade."\
	      "\n\nIf you wish to masquerade all services, then set your default policy to \"allow\"."\
	      "You will still be able to deny services on a computer-by-computer basis."\
	      "If you wish to selectively provide masquerading, then set your default policy to \"deny\""\
	      "and list just those services you wish to provide."\
	      "\n\nNote: these rules will apply to all masqueraded systems."

    Radio defaultpolicy -text "Default masquerade policy"\
	    -defaultIndex 0\
	    -packFrame:anchor center \
	    -help "If you wish to masquerade all local hosts unless explicitly denied, select \"Allow\"."\
                  "If you wish to masquerade only certain hosts, select \"Deny\"."\
	    -entryhelp {\
	      "Allow" "Unless explicitly denied, services will be masqueraded."\
	      "Deny" "Unless explicitly enabled, services will not be masqueraded."\
	    }

    Line line1

    Label label5 -text "Masquerade support modules"\
            -textafter "be loaded."\
	    -default "can"\
	    -packFrame:anchor center \
	    -help "Certain network protocols need special support to work with masquerading. This"\
	          "support is provided as modules that extend kernel functionality.\n\nIn order to load"\
	          "these modules, the location of the \"modprobe\" program must be known."\
                  "You may need to modify your PATH before running this module."

    CheckBox masq_cuseeme -text "Masquerade CU-SeeMe (2.0.30+)"\
	    -default 0\
	    -help "Masquerade CU-SeeMe video conference traffic."
    
    CheckBox masq_ftp -text "Masquerade FTP"\
	    -default 1\
	    -help "Masquerade FTP file transfer traffic."
    
    CheckBox masq_irc -text "Masquerade IRC"\
	    -default 0\
	    -help "Masquerade Internet Relay Chat traffic."
    
    CheckBox masq_quake -text "Masquerade Quake (2.0.30+)"\
	    -default 0\
	    -help "Masquerade Quake network gaming traffic."
    
    CheckBox masq_raudio -text "Masquerade RealAudio"\
	    -default 0\
	    -help "Masquerade RealAudio streaming audio traffic."
    
    CheckBox masq_vdolive -text "Masquerade VDO Live (2.0.30+)"\
	    -default 0\
	    -help "Masquerade VDO Live traffic."
    
    Frame mframe0 -entries {masq_cuseeme masq_ftp masq_irc} -orient top
    Frame mframe1 -entries {masq_quake masq_raudio masq_vdolive} -orient top
    Frame mframe2 -entries {mframe0 mframe1} -orient left -packFrame:anchor center

    Line line2
    global ServiceList

    ComboBox masqservice -text "Deny/Allow service for all computers"\
	    -count 10\
	    -help \
	      "If the default masquerade policy is \"Allow\" then"\
	      "only the services listed here (if any) will be denied."\
	      "This may be overridden on a computer-by-computer basis.\n"\
	      "If the default masquerade policy is \"Deny\" then"\
	      "only the services listed here (if any) will be allowed."\
	      "This may be overridden on a computer-by-computer basis.\n"\
	      "Select a service from the list, or enter one in the form port#(:port#)/\[tcp|udp\]."\
	      "For example, to deny or allow HTTP requests, enter \"80/tcp\". See the file"\
	      "/etc/services (from which this list was generated) for a list of services with some comments,"\
	      "or consult your ISP."\
            -entries $ServiceList
    
    ExtEntry masqservices -entries masqservice\
            -count 2 -help "Services to deny or allow for all masqueraded computers." \
	    -packFrame:anchor center

    CheckBox masqallIPSec -text "Masquerade IPSec for all local network computers"\
	    -packFrame:anchor center \
	    -default 0
    
    CheckBox masqallPPTP -text "Masquerade PPTP for all local network computers"\
	    -packFrame:anchor center \
	    -default 0
    
    Header head3 -text "Computers to Masquerade or Prevent Masquerading"\
        -background gray\
	-help "Here you list the computers you wish to masquerade. If the default masquerade policy is ALLOW,"\
	      "these computers will be blocked."\
	      "\nYou can also deny or allow services on a host-by-host basis."

    Entry masqsystem -text "Computer to masquerade" -help "The IP address or name of a computer on the local network."

    CheckBox hostallow -text "Default Allow"\
	    -packFrame:anchor center \
            -help "Set the default policy for this host to \"Allow\"."

    CheckBox masqIPSec -text "Masquerade IPSec"\
	    -packFrame:anchor center \
	    -default 0
    
    CheckBox masqPPTP -text "Masquerade PPTP"\
	    -packFrame:anchor center \
	    -default 0
    
    ComboBox servicebyhost -text "Deny/Allow"\
	    -count 10\
	    -help \
	      "If the default masquerade policy is \"Allow\" then"\
	      "only the services listed here (if any) will be denied."\
	      "This will override a global allow defined above."\
	      "If the default masquerade policy is \"Deny\" then"\
	      "only the services listed here (if any) will be allowed."\
	      "This will override a global deny defined above."\
	      "\n\nSelect a service from the list, or enter one in the form port#(:port#)/\[tcp|udp\]."\
	      "For example, to deny or allow HTTP requests, enter \"80/tcp\". See the file"\
	      "/etc/services (from which this list was generated) for a list of services with some comments,"\
	      "or consult your ISP."\
            -entries $ServiceList
    
    ExtEntry servicesbyhost -entries servicebyhost -count 2 -help "Services to deny or allow."

    Line line3

    Frame frame0 -entries {masqsystem hostallow masqIPSec masqPPTP} -orient top
    Frame frame1 -entries {frame0 servicesbyhost} -orient left
    Frame frame2 -entries {frame1 line3} -orient top
    ExtEntry masqlist -entries frame2 -count 2

    ShowPage {
      global MasqInKernel
      global ForwardInKernel
      global LocalNetIP
      if {$MasqInKernel == 0 || ${isp@on_internet} == 0} {
        if {$MasqInKernel == 0} {
	  set label1 "is not"
        } else {
	  set label1 "is"
        }
	Disable label4
	Disable label2
        Disable masquerade
	Disable head2
	Disable defaultpolicy
	Disable masq_cuseeme
	Disable masq_ftp
	Disable masq_irc
	Disable masq_quake
	Disable masq_raudio
	Disable masq_vdolive
        Disable mframe2
	Disable masqservices
	Disable masqallIPSec
	Disable masqallPPTP
	Disable head3
        Disable masqlist
	set masquerade 0
      } else {
	set label1 "is"
        if {$ForwardInKernel == 0} {
	  set label4 "is not"
	  Disable label2
          Disable masquerade
	  Disable head2
	  Disable defaultpolicy
	  Disable masq_cuseeme
	  Disable masq_ftp
	  Disable masq_irc
	  Disable masq_quake
	  Disable masq_raudio
	  Disable masq_vdolive
          Disable mframe2
	  Disable masqservices
	  Disable masqallIPSec
	  Disable masqallPPTP
	  Disable head3
          Disable masqlist
	  set masquerade 0
        } else {
	  set label4 "is"
          if {$LocalNetIP == "" || $LocalNetMask == "" || $LocalNetIP == "Unknown" || $LocalNetMask == "Unknown"} {
	    set label2 "does not exist."
            Disable masquerade
	    Disable head2
	    Disable defaultpolicy
	    Disable masq_cuseeme
	    Disable masq_ftp
	    Disable masq_irc
	    Disable masq_quake
	    Disable masq_raudio
	    Disable masq_vdolive
            Disable mframe2
	    Disable masqservices
	    Disable masqallIPSec
	    Disable masqallPPTP
	    Disable head3
            Disable masqlist
	    set masquerade 0
	  } else {
	    set label2 "exists."
	    if {$masquerade} {
	      Enable head2
	      Enable defaultpolicy
	      global MODPROBE
	      if {$MODPROBE != ""} {
                set label5 "can"
	        Enable masq_cuseeme
	        Enable masq_ftp
	        Enable masq_irc
	        Enable masq_quake
	        Enable masq_raudio
	        Enable masq_vdolive
                Enable mframe2
              } else {
                set label5 "cannot"
	        Disable masq_cuseeme
	        Disable masq_ftp
	        Disable masq_irc
	        Disable masq_quake
	        Disable masq_raudio
	        Disable masq_vdolive
                Disable mframe2
              }
	      Enable masqservices
	      if {$defaultpolicy(index) == 0} {
	        Disable masqallIPSec
	        Disable masqallPPTP
	      } else {
	        Enable masqallIPSec
	        Enable masqallPPTP
	      }
	      Enable head3
              Enable masqlist
	      forevery masqlist {
	        if {$defaultpolicy(index) == 0} {
	          Disable hostallow
		  Disable masqIPSec
		  Disable masqPPTP
	        } else {
	          Enable hostallow
		  if {$hostallow} {
		    Disable masqIPSec
		    Disable masqPPTP
		  } else {
		    Enable masqIPSec
		    Enable masqPPTP
		  }
	        }
	      }
	    } else {
	      Disable head2
	      Disable defaultpolicy
	      Disable masq_cuseeme
	      Disable masq_ftp
	      Disable masq_irc
	      Disable masq_quake
	      Disable masq_raudio
	      Disable masq_vdolive
	      Disable masqservices
	      Disable masqallIPSec
	      Disable masqallPPTP
	      Disable head3
	      Disable masqlist
	    }
	  }
	}
      }
    }

    Change {
	  if {$masquerade} {
	    Enable head2
	    Enable defaultpolicy
	    Enable masqservices
	    Enable masq_cuseeme
	    Enable masq_ftp
	    Enable masq_irc
	    Enable masq_quake
	    Enable masq_raudio
	    Enable masq_vdolive
	    if {$defaultpolicy(index) == 0} {
	      Disable masqallIPSec
	      Disable masqallPPTP
	    } else {
	      Enable masqallIPSec
	      Enable masqallPPTP
	    }
	    Enable head3
            Enable masqlist
	    forevery masqlist {
	      if {$defaultpolicy(index) == 0} {
	        Disable hostallow
		Disable masqIPSec
		Disable masqPPTP
	      } else {
	        Enable hostallow
		if {$hostallow} {
		  Disable masqIPSec
		  Disable masqPPTP
		} else {
		  Enable masqIPSec
		 Enable masqPPTP
		}
	      }
	    }
	  } else {
	    Disable head2
	    Disable defaultpolicy
	    Disable masq_cuseeme
	    Disable masq_ftp
	    Disable masq_irc
	    Disable masq_quake
	    Disable masq_raudio
	    Disable masq_vdolive
	    Disable masqservices
	    Disable masqallIPSec
	    Disable masqallPPTP
	    Disable head3
	    Disable masqlist
	  }
    }

    Save {
	if {$masquerade == 0 || ${isp@on_internet} == 0} {
	  print "# Not masquerading"
	} else {
    	  global IPFWADM
	  if {$IPFWADM == ""} {
	    # nothing
	  } else {
	    global MODPROBE
	    if {$MODPROBE != "" && (
                  $masq_cuseeme == 1 ||
	          $masq_ftp == 1 ||
	          $masq_irc == 1 ||
	          $masq_quake == 1 ||
	          $masq_raudio == 1 ||
	          $masq_vdolive == 1) } {
              print "# Load the masquerade support modules for certain services"
	      if {$masq_cuseeme} {
                print $MODPROBE "ip_masq_cuseeme"
              }
	      if {$masq_ftp} {
                print $MODPROBE "ip_masq_ftp"
              }
	      if {$masq_irc} {
                print $MODPROBE "ip_masq_irc"
              }
	      if {$masq_quake} {
                print $MODPROBE "ip_masq_quake"
              }
	      if {$masq_raudio} {
                print $MODPROBE "ip_masq_raudio"
              }
	      if {$masq_vdolive} {
                print $MODPROBE "ip_masq_vdolive"
              }
	      print
	    }
	    global LocalNetIP
	    global LocalNetMask
	    global ISPPort
	    global DialdPort
	    global UseIPUP
	    global MatchPort
	    print "# Allow forwarding of local network traffic"
	    print $IPFWADM "-F -a accept \$LETH -S \$LNET -D \$LNET"
	    print "# Block forwarding certain traffic that shouldn't go out anyway"
	    print "# reject rather than deny, to aid troubleshooting"
	    print $IPFWADM "-F -a reject -o \$INET -S \$LNET -D \$LNET"
	    print $IPFWADM "-F -a reject \$INET -S \$LNET -D 10.0.0.0/8"
	    print $IPFWADM "-F -a reject \$INET -S \$LNET -D 172.16.0.0/12"
	    print $IPFWADM "-F -a reject \$INET -S \$LNET -D 192.168.0.0/16"
	    print
	    if {$DialdPort != ""} {
	      print "# Including sl0 is necessary because diald changes the default route from sl0"
	      print "# to pppX as it brings up the link. If sl0 were omitted then the masqueraded"
	      print "# systems would not be able to bring up the link, and would only have their"
	      print "# packets forwarded if the link was already up."
	    }

	    forevery masqlist {
	      print
	      print "# Masquerade $masqsystem"
	      set io_policy_needed 0

	      if {$defaultpolicy(index) == 0} {
	        print "# Default masquerade policy is allow - deny the listed services for $masqsystem"
	        set policy "-a reject"
	      } else {
	        if {$hostallow} {
	          print "# Default masquerade policy for $masqsystem is allow - deny the listed services"
	          set policy "-a reject"
		} else {
	          print "# Default masquerade policy is deny - masquerade the listed services for $masqsystem"
	          set policy "-a accept -m"
	          set io_policy_needed 1
		  if {$masqIPSec} {
                    print "# UDP port 500 (IPSec/ISAKMP)"
                    print $IPFWADM "-I -a accept \$LETH -P udp -S $masqsystem/32 -D \$ANY 500"
		    print $IPFWADM "-F $policy \$INET -P udp -S $masqsystem/32 -D \$ANY 500"
                    print $IPFWADM "-O -a accept \$INET -P udp -S \$INET_IP -D \$ANY 500"
                    print $IPFWADM "-I -a accept \$INET -P udp -D \$INET_IP -S \$ANY 500"
                    print $IPFWADM "-O -a accept \$LETH -P udp -D $masqsystem/32 -S \$ANY 500"
	            if {$DialdPort != ""} {
                      print $IPFWADM "-F $policy $DialdPort -P udp -S $masqsystem/32 -D \$ANY 500"
		    }
		  }
		  if {$masqPPTP} {
                    print "# TCP port 1723 (PPTP)"
                    print $IPFWADM "-I -a accept \$LETH -P tcp -S $masqsystem/32 -D \$ANY 1723"
		    print $IPFWADM "-F $policy \$INET -P tcp -S $masqsystem/32 -D \$ANY 1723"
		    if { ! ${allowservicesglobal@allowoutboundtcpallports}} {
                      print $IPFWADM "-O -a accept \$INET -P tcp -S \$INET_IP -D \$ANY 1723"
                      print $IPFWADM "-I -a accept \$INET -P tcp \$ConnEstablished -D \$INET_IP -S \$ANY 1723"
		    }
                    print $IPFWADM "-O -a accept \$LETH -P tcp -D $masqsystem/32 -S \$ANY 1723"
	            if {$DialdPort != ""} {
                      print $IPFWADM "-F $policy $DialdPort -P tcp -S $masqsystem/32 -D \$ANY 1723"
		    }
		  }
		}
	      }

	      forevery servicesbyhost {
                set service $servicebyhost
                if {[regexp "$MatchPort" $service junk port junk prot]} {
                  set ACK [pick {$prot == "tcp"} " \$ConnEstablished" ""]
                  # if there's a description before or after the port spec, retrieve it.
                  set descr ""
                  if {![regexp "^(\[A-Za-z0-9\\-_\]+)\[ \t\]+" $service junk descr]} {
                    # not before. try after.
                    regexp "\[ \t(\]+(\[A-Za-z0-9\\-_\]+)" $service junk descr
                  }
                  if {$descr != ""} {
                    set descr " ($descr)"
                  }
      
                  if {$prot == "icmp"} {
                    print "# Cannot masquerade ICMP traffic explicitly"
                  } else {
                    print "# $prot port $port$descr"
		    print $IPFWADM "-F $policy \$INET -P $prot -S $masqsystem/32 -D \$ANY $port"
	            if {$DialdPort != ""} {
                      print $IPFWADM "-F $policy $DialdPort -P $prot -S $masqsystem/32 -D \$ANY $port"
		    }
		    if {$io_policy_needed} {
                      print $IPFWADM "-I -a accept \$LETH -P $prot -S $masqsystem/32 -D \$ANY $port"
                      print $IPFWADM "-O -a accept \$INET -P $prot -S \$INET_IP -D \$ANY $port"
                      print $IPFWADM "-I -a accept \$INET -P $prot$ACK -D \$INET_IP -S \$ANY $port"
                      print $IPFWADM "-O -a accept \$LETH -P $prot$ACK -D $masqsystem/32 -S \$ANY $port"
		    }
                  }
                } else {
		  if {$servicebyhost != ""} {
	            print "# Syntax error: service \"$servicebyhost\" unparseable."
		  }
	        }
	      }

	      if {$defaultpolicy(index) == 1 && $hostallow} {
	        print "# Default masquerade policy for $masqsystem is allow"
	        print $IPFWADM "-F -a accept -m \$INET -S $masqsystem/32 -D \$ANY"
	        if {$DialdPort != ""} {
	          print $IPFWADM "-F -a accept -m $DialdPort -S $masqsystem/32 -D \$ANY"
	        }
                if { [set general@defaultpolicy(index)] != 1 } {
	          print "# Default policy is deny."
	          if {$DialdPort != ""} {
	            print "# Allow traffic to go out the diald port, so that the link may be brought up."
                    print $IPFWADM "-O -a accept $DialdPort -S $masqsystem/32 -D \$ANY"
                  }
                }
	      } else {
	        print "# Default masquerade policy for $masqsystem is deny"
	        if { $defaultpolicy(index) == 1 && ($masqIPSec || $masqPPTP) } {
	          print $IPFWADM "-F -a reject \$INET -P tcp -S $masqsystem/32 -D \$ANY"
	          print $IPFWADM "-F -a reject \$INET -P udp -S $masqsystem/32 -D \$ANY"
		  print "# Masquerade IPSec/PPTP tunnel traffic for this host."
		  if { [set general@defaultpolicy(index)] != 1 } {
		    # default policy is deny.
		    print "# Warning: the default firewall policy is DENY."
		    print "# THIS WILL NOT WORK."
		    print "# If you wish to permit masquerade of IPsec and PPTP traffic"
		    print "# then you need to set your default policy to ACCEPT and select"
		    print "# the DEFAULT DENY TCP and DEFAULT DENY UDP options."
		    print "# This is a limitation in the firewall generator. Sorry."
                    tk_dialog .warning "Warning" \
		      "Firewall Generator limitation: You cannot masquerade IPsec or PPTP traffic if the default firewall policy is DENY.\nSet the default firewall policy to ACCEPT and select the DEFAULT DENY TCP and DEFAULT DENY UDP options." info 0 OK
		  }
		  print $IPFWADM "-F -a accept -m \$INET -P any -S $masqsystem/32 -D \$ANY"
		} else {
	          print $IPFWADM "-F -a reject \$INET -S $masqsystem/32 -D \$ANY"
		}
	      }
	    }

	    print
	    print "# Global masquerade rules"
	    if {$defaultpolicy(index) == 0} {
	      print "# Default masquerade policy is allow - deny the listed services for all computers"
	      set policy "-a reject"
	    } else {
	      print "# Default masquerade policy is deny - masquerade the listed services for all computers"
	      set policy "-a accept -m"
	      if {$masqallIPSec} {
	        print "# UDP port 500 (IPSec/ISAKMP)"
	        print $IPFWADM "-I -a accept \$LETH -P udp -S \$LNET -D \$ANY 500"
	        print $IPFWADM "-F $policy \$INET -P udp -S \$LNET -D \$ANY 500"
	        print $IPFWADM "-O -a accept \$INET -P udp -S \$INET_IP -D \$ANY 500"
	        print $IPFWADM "-I -a accept \$INET -P udp -D \$INET_IP -S \$ANY 500"
	        print $IPFWADM "-O -a accept \$LETH -P udp -D \$LNET -S \$ANY 500"
	        if {$DialdPort != ""} {
	          print $IPFWADM "-F $policy $DialdPort -P udp -S \$LNET -D \$ANY 500"
	        }
	      }
	      if {$masqallPPTP} {
	        print "# TCP port 1723 (PPTP)"
	        print $IPFWADM "-I -a accept \$LETH -P tcp -S \$LNET -D \$ANY 1723"
	        print $IPFWADM "-F $policy \$INET -P tcp -S \$LNET -D \$ANY 1723"
		if { ! ${allowservicesglobal@allowoutboundtcpallports}} {
	          print $IPFWADM "-O -a accept \$INET -P tcp -S \$INET_IP -D \$ANY 1723"
	          print $IPFWADM "-I -a accept \$INET -P tcp \$ConnEstablished -D \$INET_IP -S \$ANY 1723"
		}
	        print $IPFWADM "-O -a accept \$LETH -P tcp -D \$LNET -S \$ANY 1723"
	        if {$DialdPort != ""} {
	          print $IPFWADM "-F $policy $DialdPort -P tcp -S \$LNET -D \$ANY 1723"
	        }
	      }
	    }

	    forevery masqservices {
              set service $masqservice
              if {[regexp "$MatchPort" $service junk port junk prot]} {
                set ACK [pick {$prot == "tcp"} " \$ConnEstablished" ""]
                # if there's a description before or after the port spec, retrieve it.
                set descr ""
                if {![regexp "^(\[A-Za-z0-9\\-_\]+)\[ \t\]+" $service junk descr]} {
                  # not before. try after.
                  regexp "\[ \t(\]+(\[A-Za-z0-9\\-_\]+)" $service junk descr
                }
                if {$descr != ""} {
                  set descr " ($descr)"
                }
      
                if {$prot == "icmp"} {
                  print "# Cannot masquerade ICMP traffic explicitly"
                } else {
                  print "# $prot port $port$descr"
                  print $IPFWADM "-F $policy \$INET -P $prot -S \$LNET -D \$ANY $port"
	          if {$DialdPort != ""} {
                    print $IPFWADM "-F $policy $DialdPort -P $prot -S \$LNET -D \$ANY $port"
		  }
                }
              } else {
                if {$masqservice != ""} {
                  print "# Syntax error: service \"$masqservice\" unparseable."
                }
	      }
	    }

	    print
	    print "# Global masquerade policy"
	    if {$defaultpolicy(index) == 0} {
	      print "# Default masquerade policy is allow"
	      print $IPFWADM "-F -a accept -m \$INET -S \$LNET -D \$ANY"
	      if {$DialdPort != ""} {
	        print $IPFWADM "-F -a accept -m $DialdPort -S \$LNET -D \$ANY"
	      }
              if { [set general@defaultpolicy(index)] != 1 } {
	        print "# Default policy is deny"
	        if {$DialdPort != ""} {
	          print "# Allow traffic to go out the diald port, so that the link may be brought up."
                  print $IPFWADM "-O -a accept $DialdPort -S \$LNET -D \$ANY"
                }
              }
	    } else {
	      print "# Default masquerade policy is deny"
	      if {$DialdPort != ""} {
	        print $IPFWADM "-F -a reject $DialdPort -S \$LNET -D \$ANY"
	      }
	      if {$masqallIPSec || $masqallPPTP} {
	        print $IPFWADM "-F -a reject \$INET -P tcp -S \$LNET -D \$ANY"
	        print $IPFWADM "-F -a reject \$INET -P udp -S \$LNET -D \$ANY"
		print "# Masquerade IPsec/PPTP tunnel traffic."
		if { [set general@defaultpolicy(index)] != 1 } {
		  # default policy is deny.
		  print "# Warning: the default firewall policy is DENY."
		  print "# THIS WILL NOT WORK."
		  print "# If you wish to permit masquerade of IPsec and PPTP traffic"
		  print "# then you need to set your default policy to ACCEPT and select"
		  print "# the DEFAULT DENY TCP and DEFAULT DENY UDP options."
		  print "# This is a limitation in the firewall generator. Sorry."
                  tk_dialog .warning "Warning" \
		    "Firewall Generator limitation: You cannot masquerade IPsec or PPTP traffic if the default firewall policy is DENY.\nSet the default firewall policy to ACCEPT and select the DEFAULT DENY TCP and DEFAULT DENY UDP options." info 0 OK
		}
	        print $IPFWADM "-F -a accept -m \$INET -P any -S \$LNET -D \$ANY"
	      } else {
	        print $IPFWADM "-F -a reject \$INET -S \$LNET -D \$ANY"
	      }
	    }
	  }
        }
    }
}
