strongswan: update _updown to use conmark for QoS

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

diff --git a/lfs/strongswan b/lfs/strongswan
index 3b481ac2eb073dc6389d46b2ba5c306a449ff841..46c0309fb21ae3fe89ebd2b207411a45a8cc80dd 100644 (file)
--- a/lfs/strongswan
+++ b/lfs/strongswan
@@ -72,8 +72,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
        @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
        cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-disable-ipv6.patch
        cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-ipfire.patch
-       cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-ipfire-interfaces.patch
-       cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-ipfire-revert.patch
 
        $(UPDATE_AUTOMAKE)
        cd $(DIR_APP) && ./configure \

diff --git a/src/patches/strongswan-ipfire-interfaces.patch b/src/patches/strongswan-ipfire-interfaces.patch
deleted file mode 100644 (file)
index 5ec96a4..0000000
--- a/src/patches/strongswan-ipfire-interfaces.patch
+++ /dev/null
@@ -1,72 +0,0 @@
---- strongswan-5.7.0/src/_updown/_updown.in.bak        2019-02-06 18:19:25.723893992 +0000
-+++ strongswan-5.7.0/src/_updown/_updown.in    2019-02-06 18:28:21.520560665 +0000
-@@ -130,6 +130,13 @@
- #              address family.
- #
- 
-+VARS=(
-+      id status name lefthost type ctype psk local local_id leftsubnets
-+      remote_id remote rightsubnets x3 x4 x5 x6 x7 x8 x9 x10 x11 x12
-+      x13 x14 x15 x16 x17 x18 x19 proto x20 x21 x22
-+      route x23 mode interface_mode interface_address interface_mtu rest
-+)
-+
- function ip_encode() {
-       local IFS=.
- 
-@@ -319,6 +326,13 @@
-       fi
-       ;;
- up-client:iptables)
-+      # Read IPsec configuration
-+      while IFS="," read -r "${VARS[@]}"; do
-+              if [ "${PLUTO_CONNECTION}" = "${name}" ]; then
-+                      break
-+              fi
-+      done < /var/ipfire/vpn/config
-+
-       # connection to client subnet, with (left/right)firewall=yes, coming up
-       # This is used only by the default updown script, not by your custom
-       # ones, so do not mess with it; see CAUTION comment up at top.
-@@ -383,23 +397,25 @@
-             "tunnel+ $PLUTO_PEER -- $PLUTO_ME"
-       fi
- 
--      # Add source nat so also the gateway can access the other nets
--      eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
--      for _src in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
--              ip_in_subnet "${_src}" "${PLUTO_MY_CLIENT}"
--              if [ $? -eq 0 ]; then
--                      src=${_src}
--                      break
-+      if [ -z "${interface_mode}" ]; then
-+              # Add source nat so also the gateway can access the other nets
-+              eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
-+              for _src in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
-+                      ip_in_subnet "${_src}" "${PLUTO_MY_CLIENT}"
-+                      if [ $? -eq 0 ]; then
-+                              src=${_src}
-+                              break
-+                      fi
-+              done
-+
-+              if [ -n "${src}" ]; then
-+                      iptables --wait -t nat -A IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src
-+                      logger -t $TAG -p $FAC_PRIO \
-+                              "snat+ $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src"
-+              else
-+                      logger -t $TAG -p $FAC_PRIO \
-+                              "Cannot create NAT rule because no IP of the IPFire does match the subnet. $PLUTO_MY_CLIENT"
-               fi
--      done
--
--      if [ -n "${src}" ]; then
--              iptables --wait -t nat -A IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src
--              logger -t $TAG -p $FAC_PRIO \
--                      "snat+ $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src"
--      else
--              logger -t $TAG -p $FAC_PRIO \
--                      "Cannot create NAT rule because no IP of the IPFire does match the subnet. $PLUTO_MY_CLIENT"
-       fi
- 
-       # Flush routing cache

diff --git a/src/patches/strongswan-ipfire-revert.patch b/src/patches/strongswan-ipfire-revert.patch
deleted file mode 100644 (file)
index 91c7621..0000000
--- a/src/patches/strongswan-ipfire-revert.patch
+++ /dev/null
@@ -1,113 +0,0 @@
---- strongswan-5.7.2/src/_updown/_updown.in.bak        2019-04-08 16:27:08.549214441 +0100
-+++ strongswan-5.7.2/src/_updown/_updown.in    2019-04-08 16:30:30.195868788 +0100
-@@ -130,36 +130,6 @@
- #              address family.
- #
- 
--VARS=(
--      id status name lefthost type ctype psk local local_id leftsubnets
--      remote_id remote rightsubnets x3 x4 x5 x6 x7 x8 x9 x10 x11 x12
--      x13 x14 x15 x16 x17 x18 x19 proto x20 x21 x22
--      route x23 mode interface_mode interface_address interface_mtu rest
--)
--
--function ip_encode() {
--      local IFS=.
--
--      local int=0
--      for field in $1; do
--              int=$(( $(( $int << 8 )) | $field ))
--      done
--
--      echo $int
--}
--
--function ip_in_subnet() {
--      local netmask
--      netmask=$(_netmask $2)
--      [ $(( $(ip_encode $1) & $netmask)) = $(( $(ip_encode ${2%/*}) & $netmask )) ]
--}
--
--function _netmask() {
--      local vlsm
--      vlsm=${1#*/}
--      [ $vlsm -eq 0 ] && echo 0 || echo $(( -1 << $(( 32 - $vlsm )) ))
--}
--
- # define a minimum PATH environment in case it is not set
- PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/sbin"
- export PATH
-@@ -326,13 +296,6 @@
-       fi
-       ;;
- up-client:iptables)
--      # Read IPsec configuration
--      while IFS="," read -r "${VARS[@]}"; do
--              if [ "${PLUTO_CONNECTION}" = "${name}" ]; then
--                      break
--              fi
--      done < /var/ipfire/vpn/config
--
-       # connection to client subnet, with (left/right)firewall=yes, coming up
-       # This is used only by the default updown script, not by your custom
-       # ones, so do not mess with it; see CAUTION comment up at top.
-@@ -396,30 +359,6 @@
-           logger -t $TAG -p $FAC_PRIO \
-             "tunnel+ $PLUTO_PEER -- $PLUTO_ME"
-       fi
--
--      if [ -z "${interface_mode}" ]; then
--              # Add source nat so also the gateway can access the other nets
--              eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
--              for _src in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
--                      ip_in_subnet "${_src}" "${PLUTO_MY_CLIENT}"
--                      if [ $? -eq 0 ]; then
--                              src=${_src}
--                              break
--                      fi
--              done
--
--              if [ -n "${src}" ]; then
--                      iptables --wait -t nat -A IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src
--                      logger -t $TAG -p $FAC_PRIO \
--                              "snat+ $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src"
--              else
--                      logger -t $TAG -p $FAC_PRIO \
--                              "Cannot create NAT rule because no IP of the IPFire does match the subnet. $PLUTO_MY_CLIENT"
--              fi
--      fi
--
--      # Flush routing cache
--      ip route flush cache
-       ;;
- down-client:iptables)
-       # connection to client subnet, with (left/right)firewall=yes, going down
-@@ -487,28 +426,6 @@
-           logger -t $TAG -p $FAC_PRIO \
-             "tunnel- $PLUTO_PEER -- $PLUTO_ME"
-       fi
--
--      # remove source nat
--      eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
--      for _src in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
--              ip_in_subnet "${_src}" "${PLUTO_MY_CLIENT}"
--              if [ $? -eq 0 ]; then
--                      src=${_src}
--                      break
--              fi
--      done
--
--      if [ -n "${src}" ]; then
--              iptables --wait -t nat -D IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src
--              logger -t $TAG -p $FAC_PRIO \
--                      "snat- $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src"
--      else
--              logger -t $TAG -p $FAC_PRIO \
--                      "Cannot remove NAT rule because no IP of the IPFire does match the subnet."
--      fi
--
--      # Flush routing cache
--      ip route flush cache
-       ;;
- #
- # IPv6

diff --git a/src/patches/strongswan-ipfire.patch b/src/patches/strongswan-ipfire.patch
index 17c40b025cdc53bdf4a5bbe8e195dd139713044c..38202c1ec5147b3d78497885cb8b8c94a3909622 100644 (file)
--- a/src/patches/strongswan-ipfire.patch
+++ b/src/patches/strongswan-ipfire.patch
@@ -1,36 +1,7 @@
---- strongswan-5.3.0/src/_updown/_updown.in.old        2015-03-17 18:17:43.000000000 +0000
-+++ strongswan-5.3.0/src/_updown/_updown.in    2015-03-30 22:48:27.084030719 +0000
-@@ -122,6 +122,29 @@
- #              address family.
- #
- 
-+function ip_encode() {
-+      local IFS=.
-+
-+      local int=0
-+      for field in $1; do
-+              int=$(( $(( $int << 8 )) | $field ))
-+      done
-+
-+      echo $int
-+}
-+
-+function ip_in_subnet() {
-+      local netmask
-+      netmask=$(_netmask $2)
-+      [ $(( $(ip_encode $1) & $netmask)) = $(( $(ip_encode ${2%/*}) & $netmask )) ]
-+}
-+
-+function _netmask() {
-+      local vlsm
-+      vlsm=${1#*/}
-+      [ $vlsm -eq 0 ] && echo 0 || echo $(( -1 << $(( 32 - $vlsm )) ))
-+}
-+
- # define a minimum PATH environment in case it is not set
- PATH="/sbin:/bin:/usr/sbin:/usr/bin:@sbindir@"
- export PATH
-@@ -232,12 +255,12 @@
+diff -Naur strongswan-5.9.3.org/src/_updown/_updown.in strongswan-5.9.3/src/_updown/_updown.in
+--- strongswan-5.9.3.org/src/_updown/_updown.in        2020-12-09 19:01:30.000000000 +0100
++++ strongswan-5.9.3/src/_updown/_updown.in    2021-10-18 14:51:34.446203334 +0200
+@@ -242,12 +242,15 @@
        # connection to me, with (left/right)firewall=yes, coming up
        # This is used only by the default updown script, not by your custom
        # ones, so do not mess with it; see CAUTION comment up at top.
@@ -39,14 +10,17 @@
            -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
            -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
 -      iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++      iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++          -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
++          -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j CONNMARK --set-xmark 0x00800000/0x00800000
 +      iptables --wait -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
            -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
 -          -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
-+          -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j MARK --set-xmark 0x00800000/0x00800000
++          -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j CONNMARK --set-xmark 0x00800000/0x00800000
        #
        # allow IPIP traffic because of the implicit SA created by the kernel if
        # IPComp is used (for small inbound packets that are not compressed)
-@@ -253,10 +276,10 @@
+@@ -263,10 +266,10 @@
          if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
          then
            logger -t $TAG -p $FAC_PRIO \
@@ -59,11 +33,14 @@
          fi
        fi
        ;;
-@@ -264,12 +287,12 @@
+@@ -274,12 +277,15 @@
        # connection to me, with (left/right)firewall=yes, going down
        # This is used only by the default updown script, not by your custom
        # ones, so do not mess with it; see CAUTION comment up at top.
 -      iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++      iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++          -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
++          -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j CONNMARK --set-xmark 0x00800000/0x00800000
 +      iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
            -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
            -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
@@ -71,11 +48,11 @@
 +      iptables --wait -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
            -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
 -          -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
-+          -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j MARK --set-xmark 0x00800000/0x00800000
++          -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j CONNMARK --set-xmark 0x00800000/0x00800000
        #
        # IPIP exception teardown
        if [ -n "$PLUTO_IPCOMP" ]
-@@ -284,10 +307,10 @@
+@@ -294,10 +300,10 @@
          if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
          then
            logger -t $TAG -p $FAC_PRIO -- \
@@ -88,20 +65,23 @@
          fi
        fi
        ;;
-@@ -297,24 +320,24 @@
+@@ -307,24 +313,30 @@
        # ones, so do not mess with it; see CAUTION comment up at top.
        if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
        then
 -        iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++        iptables --wait -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++            -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
++            -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j RETURN
 +        iptables --wait -I IPSECFORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
              -s $PLUTO_MY_CLIENT $S_MY_PORT \
 -            -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
 -        iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+            -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j MARK --set-xmark 0x00800000/0x00800000
++            -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j CONNMARK --set-xmark 0x00800000/0x00800000
 +        iptables --wait -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
              -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
 -            -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
-+            -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j RETURN
++            -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j CONNMARK --set-xmark 0x00800000/0x00800000
        fi
        #
        # a virtual IP requires an INPUT and OUTPUT rule on the host
@@ -114,14 +94,17 @@
 -            -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
 -        iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
 +            -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j RETURN
++        iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++            -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
++            -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j CONNMARK --set-xmark 0x00800000/0x00800000
 +        iptables --wait -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
              -s $PLUTO_MY_CLIENT $S_MY_PORT \
 -            -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
-+            -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j MARK --set-xmark 0x00800000/0x00800000
++            -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j CONNMARK --set-xmark 0x00800000/0x00800000
        fi
        #
        # allow IPIP traffic because of the implicit SA created by the kernel if
-@@ -322,7 +345,7 @@
+@@ -332,7 +344,7 @@
        # INPUT is correct here even for forwarded traffic.
        if [ -n "$PLUTO_IPCOMP" ]
        then
@@ -130,7 +113,7 @@
              -s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
        fi
        #
-@@ -332,12 +355,51 @@
+@@ -342,12 +354,29 @@
          if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
          then
            logger -t $TAG -p $FAC_PRIO \
@@ -159,32 +142,10 @@
 +          logger -t $TAG -p $FAC_PRIO \
 +            "tunnel+ $PLUTO_PEER -- $PLUTO_ME"
 +      fi
-+
-+      # Add source nat so also the gateway can access the other nets
-+      eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
-+      for _src in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
-+              ip_in_subnet "${_src}" "${PLUTO_MY_CLIENT}"
-+              if [ $? -eq 0 ]; then
-+                      src=${_src}
-+                      break
-+              fi
-+      done
-+
-+      if [ -n "${src}" ]; then
-+              iptables --wait -t nat -A IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src
-+              logger -t $TAG -p $FAC_PRIO \
-+                      "snat+ $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src"
-+      else
-+              logger -t $TAG -p $FAC_PRIO \
-+                      "Cannot create NAT rule because no IP of the IPFire does match the subnet. $PLUTO_MY_CLIENT"
-+      fi
-+
-+      # Flush routing cache
-+      ip route flush cache
        ;;
  down-client:iptables)
        # connection to client subnet, with (left/right)firewall=yes, going down
-@@ -345,34 +407,34 @@
+@@ -355,34 +384,42 @@
        # ones, so do not mess with it; see CAUTION comment up at top.
        if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
        then
@@ -194,11 +155,15 @@
              -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
 -               $IPSEC_POLICY_OUT -j ACCEPT
 -        iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+               $IPSEC_POLICY_OUT -j MARK --set-xmark 0x00800000/0x00800000
++               $IPSEC_POLICY_OUT -j CONNMARK --set-xmark 0x00800000/0x00800000
 +        iptables --wait -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
              -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
              -d $PLUTO_MY_CLIENT $D_MY_PORT \
 -               $IPSEC_POLICY_IN -j ACCEPT
++               $IPSEC_POLICY_IN -j CONNMARK --set-xmark 0x00800000/0x00800000
++        iptables --wait -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++            -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
++            -d $PLUTO_MY_CLIENT $D_MY_PORT \
 +               $IPSEC_POLICY_IN -j RETURN
        fi
        #
@@ -212,12 +177,16 @@
              -d $PLUTO_MY_CLIENT $D_MY_PORT \
 -               $IPSEC_POLICY_IN -j ACCEPT
 -        iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++               $IPSEC_POLICY_IN -j CONNMARK --set-xmark 0x00800000/0x00800000
++        iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++            -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
++            -d $PLUTO_MY_CLIENT $D_MY_PORT \
 +               $IPSEC_POLICY_IN -j RETURN
 +        iptables --wait -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
              -s $PLUTO_MY_CLIENT $S_MY_PORT \
              -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
 -               $IPSEC_POLICY_OUT -j ACCEPT
-+               $IPSEC_POLICY_OUT -j MARK --set-xmark 0x00800000/0x00800000
++               $IPSEC_POLICY_OUT -j CONNMARK --set-xmark 0x00800000/0x00800000
        fi
        #
        # IPIP exception teardown
@@ -228,7 +197,7 @@
              -s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
        fi
        #
-@@ -382,12 +444,51 @@
+@@ -392,12 +429,29 @@
          if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
          then
            logger -t $TAG -p $FAC_PRIO -- \
@@ -257,32 +226,10 @@
 +          logger -t $TAG -p $FAC_PRIO \
 +            "tunnel- $PLUTO_PEER -- $PLUTO_ME"
 +      fi
-+
-+      # remove source nat
-+      eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
-+      for _src in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
-+              ip_in_subnet "${_src}" "${PLUTO_MY_CLIENT}"
-+              if [ $? -eq 0 ]; then
-+                      src=${_src}
-+                      break
-+              fi
-+      done
-+
-+      if [ -n "${src}" ]; then
-+              iptables --wait -t nat -D IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src
-+              logger -t $TAG -p $FAC_PRIO \
-+                      "snat- $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src"
-+      else
-+              logger -t $TAG -p $FAC_PRIO \
-+                      "Cannot remove NAT rule because no IP of the IPFire does match the subnet."
-+      fi
-+
-+      # Flush routing cache
-+      ip route flush cache
        ;;
  #
  # IPv6
-@@ -412,10 +513,10 @@
+@@ -422,10 +476,10 @@
        # connection to me, with (left/right)firewall=yes, coming up
        # This is used only by the default updown script, not by your custom
        # ones, so do not mess with it; see CAUTION comment up at top.
@@ -295,7 +242,7 @@
            -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
            -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
        #
-@@ -436,10 +537,10 @@
+@@ -454,10 +508,10 @@
        # connection to me, with (left/right)firewall=yes, going down
        # This is used only by the default updown script, not by your custom
        # ones, so do not mess with it; see CAUTION comment up at top.
@@ -308,7 +255,7 @@
            -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
            -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
        #
-@@ -462,10 +563,10 @@
+@@ -487,10 +541,10 @@
        # ones, so do not mess with it; see CAUTION comment up at top.
        if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
        then
@@ -321,7 +268,7 @@
              -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
              -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
        fi
-@@ -474,10 +575,10 @@
+@@ -499,10 +553,10 @@
        # or sometimes host access via the internal IP is needed
        if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
        then
@@ -334,7 +281,7 @@
              -s $PLUTO_MY_CLIENT $S_MY_PORT \
              -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
        fi
-@@ -501,11 +602,11 @@
+@@ -535,11 +589,11 @@
        # ones, so do not mess with it; see CAUTION comment up at top.
        if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
        then
@@ -348,7 +295,7 @@
              -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
              -d $PLUTO_MY_CLIENT $D_MY_PORT \
                 $IPSEC_POLICY_IN -j ACCEPT
-@@ -515,11 +616,11 @@
+@@ -549,11 +603,11 @@
        # or sometimes host access via the internal IP is needed
        if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
        then