2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2015 IPFire Team #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
22 VPN_CONFIG
="/var/ipfire/vpn/config"
27 # Don't block a wildcard subnet
28 if [ "${subnet}" = "0.0.0.0/0" ] ||
[ "${subnet}" = "0.0.0.0/0.0.0.0" ]; then
32 iptables
-A IPSECBLOCK
-d "${subnet}" -j REJECT
--reject-with icmp-net-unreachable
36 # Flush all exists rules
37 iptables
-F IPSECBLOCK
39 local id status name lefthost
type ctype unknown1 unknown2 unknown3
40 local leftsubnets unknown4 righthost rightsubnets rest
41 while IFS
="," read -r id status name lefthost
type ctype unkown1 unknown2 unknown3 \
42 leftsubnets unknown4 righthost rightsubnets rest
; do
43 # Check if the connection is enabled
44 [ "${status}" = "on" ] ||
continue
46 # Check if this a net-to-net connection
47 [ "${type}" = "net" ] ||
continue
49 # Split multiple subnets
50 rightsubnets
="${rightsubnets//\|/ }"
53 for rightsubnet
in ${rightsubnets}; do
54 block_subnet
"${rightsubnet}"
56 done < "${VPN_CONFIG}"
59 block_ipsec ||
exit $?