2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2015 IPFire Team #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
24 VPN_CONFIG
="/var/ipfire/vpn/config"
26 eval $
(/usr
/local
/bin
/readhash
/var
/ipfire
/ethernet
/settings
)
27 eval $
(/usr
/local
/bin
/readhash
/var
/ipfire
/vpn
/settings
)
30 id status name lefthost
type ctype psk
local local_id leftsubnets
31 remote_id remote rightsubnets x3 x4 x5 x6 x7 x8 x9 x10 x11 x12
32 x13 x14 x15 x16 x17 x18 x19 proto x20 x21 x22
33 route x23 mode interface_mode interface_address interface_mtu rest
43 dig +short A
"${hostname}" |
tail -n1
47 # Register local variables
53 # We are done when IPsec is not enabled
54 if [ "${ENABLED}" = "on" ]; then
55 while IFS
="," read -r "${VARS[@]}"; do
56 # Check if the connection is enabled
57 [ "${status}" = "on" ] ||
continue
59 # Check if this a net-to-net connection
60 [ "${type}" = "net" ] ||
continue
62 # Determine the interface name
63 case "${interface_mode}" in
65 local intf
="${interface_mode}${id}"
72 # Add the interface to the list of all interfaces
73 interfaces
+=( "${intf}" )
75 # Compat for older connections
76 if [ "${local}" = "off" ]; then
77 if [ "${VPN_IP}" = "%defaultroute" ]; then
84 # Handle %defaultroute
85 if [ -z "${local}" ]; then
86 if [ -r "/var/ipfire/red/local-ipaddress" ]; then
87 local="$(</var/ipfire/red/local-ipaddress)"
89 elif [ "${RED_TYPE}" = "STATIC" -a -n "${RED_ADDRESS}" ]; then
90 local="${RED_ADDRESS}"
94 # Resolve any hostnames
95 if [[ ! ${remote} =~ ^
[0-9]+\.
[0-9]+\.
[0-9]+\.
[0-9]+$
]]; then
96 remote
="$(resolve_hostname "${remote}")"
104 case "${interface_mode}" in
107 args
+=( "ttl" "255" )
112 args
+=( "key" "${id}" )
116 # Update the settings when the interface already exists
117 if [ -d "/sys/class/net/${intf}" ]; then
118 ip link change dev
"${intf}" \
119 type "${interface_mode}" "${args[@]}" &>/dev
/null
121 # Create a new interface and bring it up
123 log
"Creating interface ${intf}"
124 if ! ip link add name
"${intf}" type "${interface_mode}" "${args[@]}"; then
125 log
"Could not create interface ${intf}"
131 ip addr flush dev
"${intf}"
132 ip addr add
"${interface_address}" dev
"${intf}"
135 ip link
set dev
"${intf}" mtu
"${interface_mtu}"
137 # Bring up the interface
138 ip link
set dev
"${intf}" up
139 done < "${VPN_CONFIG}"
142 # Delete all other interfaces
144 for intf
in /sys
/class
/net
/gre
[0-9]* /sys
/class
/net
/vti
[0-9]*; do
145 intf
="$(basename "${intf}")"
147 # Ignore a couple of interfaces that cannot be deleted
154 # Check if interface is on the list
155 local i found
="false"
156 for i
in ${interfaces[@]}; do
157 if [ "${intf}" = "${i}" ]; then
163 # Nothing to do if interface was found
166 # Delete the interface
167 log
"Deleting interface ${intf}"
168 ip link del
"${intf}" &>/dev
/null