2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2015 IPFire Team #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
24 VPN_CONFIG
="/var/ipfire/vpn/config"
27 ROUTE_TABLE_PRIO
="128"
29 eval $
(/usr
/local
/bin
/readhash
/var
/ipfire
/ethernet
/settings
)
30 eval $
(/usr
/local
/bin
/readhash
/var
/ipfire
/vpn
/settings
)
32 # Get RED interface name
33 if [ -r "/var/ipfire/red/iface" ]; then
34 RED_INTF
="$(</var/ipfire/red/iface)"
40 id status name lefthost
type ctype psk
local local_id leftsubnets
41 remote_id remote rightsubnets x3 x4 x5 x6 x7 x8 x9 x10 x11 x12
42 x13 x14 x15 x16 x17 x18 x19 proto x20 x21 x22
43 route x23 mode interface_mode interface_address interface_mtu rest
53 dig +short A
"${hostname}" |
tail -n1
60 for field
in ${address//./ }; do
61 int
=$
(( $
(( ${int} << 8 )) | ${field} ))
67 function ip_in_subnet() {
71 local netmask="${subnet#*/}"
73 # Convert netmask to prefix if necessary
78 netmask="$(netmask2prefix "${netmask}")"
82 local vlsm=$(( -1 << $(( 32 - ${netmask} )) ))
84 [ "$(( $(ip_encode "${address}") & ${vlsm} ))" -eq "$(( $(ip_encode "${subnet%/*}") & ${vlsm} ))" ]
89 local mask="$(ip_encode "${netmask}")"
92 local x="$(( 128 << 24 ))" # 0x80000000
94 while [ $(( ${x} & ${mask} )) -ne 0 ]; do
95 [ ${mask} -eq ${x} ] && mask=0 || mask=$(( ${mask} << 1 ))
96 cidr=$(( ${cidr} + 1 ))
103 # Register local variables
110 ip route flush table "${ROUTE_TABLE}"
113 ip rule del lookup "${ROUTE_TABLE}"
115 # We are done when IPsec is not enabled
116 if [ "${ENABLED}" = "on" ]; then
117 # Enable route table lookup
118 ip rule add lookup "${ROUTE_TABLE}" prio "${ROUTE_TABLE_PRIO}"
120 while IFS="," read -r "${VARS[@]}"; do
121 # Check if the connection is enabled
122 [ "${status}" = "on" ] || continue
124 # Check if this a net-to-net connection
125 [ "${type}" = "net" ] || continue
127 # Determine the interface name
128 case "${interface_mode}" in
130 local intf="${interface_mode}${id}"
137 for _address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
139 for leftsubnet in ${leftsubnets//\|/ }; do
140 if ip_in_subnet "${_address}" "${leftsubnet}"; then
141 address="${_address}"
146 # End loop when address is set
147 [ -n "${address}" ] && break
151 for rightsubnet in ${rightsubnets//\|/ }; do
153 case "${rightsubnet}" in
159 log "Creating route to ${rightsubnet} (via ${address} and ${RED_INTF})"
160 ip route add table "${ROUTE_TABLE}" "${rightsubnet}" proto static \
161 dev "${RED_INTF}" src "${address}"
164 # No interface processing required
169 # Add the interface to the list of all interfaces
170 interfaces+=( "${intf}" )
172 # Compat for older connections
173 if [ "${local}" = "off" ]; then
174 if [ "${VPN_IP}" = "%defaultroute" ]; then
181 # Handle %defaultroute
182 if [ -z "${local}" ]; then
183 if [ -r "/var/ipfire/red/local-ipaddress" ]; then
184 local="$(</var/ipfire/red/local-ipaddress)"
186 elif [ "${RED_TYPE}" = "STATIC" -a -n "${RED_ADDRESS}" ]; then
187 local="${RED_ADDRESS}"
191 # Resolve any hostnames
192 if [[ ! ${remote} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
193 remote="$(resolve_hostname "${remote}")"
201 case "${interface_mode}" in
204 args+=( "ttl" "255" )
209 args+=( "key" "${id}" )
213 # Update the settings when the interface already exists
214 if [ -d "/sys/class/net/${intf}" ]; then
215 ip link change dev "${intf}" \
216 type "${interface_mode}" "${args[@]}" &>/dev/null
218 # Create a new interface and bring it up
220 log "Creating interface ${intf}"
221 if ! ip link add name "${intf}" type "${interface_mode}" "${args[@]}"; then
222 log "Could not create interface ${intf}"
228 ip addr flush dev "${intf}"
229 ip addr add "${interface_address}" dev "${intf}"
232 ip link set dev "${intf}" mtu "${interface_mtu}"
234 # Bring up the interface
235 ip link set dev "${intf}" up
236 done < "${VPN_CONFIG}"
239 # Delete all other interfaces
241 for intf in /sys/class/net/gre[0-9]* /sys/class/net/vti[0-9]*; do
242 intf="$(basename "${intf}")"
244 # Ignore a couple of interfaces that cannot be deleted
251 # Check if interface is on the list
252 local i found="false"
253 for i in ${interfaces[@]}; do
254 if [ "${intf}" = "${i}" ]; then
260 # Nothing to do if interface was found
263 # Delete the interface
264 log "Deleting interface ${intf}"
265 ip link del "${intf}" &>/dev/null
268 # (Re-)Apply all static routes
269 /etc/init.d/static-routes start