2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2015 IPFire Team #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
22 VPN_CONFIG
="/var/ipfire/vpn/config"
24 eval $
(/usr
/local
/bin
/readhash
/var
/ipfire
/vpn
/settings
)
27 id status name lefthost
type ctype psk
local local_id leftsubnets
28 remote_id remote rightsubnets x3 x4 x5 x6 x7 x8 x9 x10 x11 x12
29 x13 x14 x15 x16 x17 x18 x19 proto x20 x21 x22
30 route x23 mode interface_mode interface_address interface_mtu rest
37 # Nothing to be done if no action is requested
38 if [ "${action}" = "none" ]; then
42 # Don't block a wildcard subnet
43 if [ "${subnet}" = "0.0.0.0/0" ] ||
[ "${subnet}" = "0.0.0.0/0.0.0.0" ]; then
49 iptables
-A IPSECBLOCK
-d "${subnet}" -j REJECT
--reject-with icmp-net-unreachable
52 iptables
-A IPSECBLOCK
-d "${subnet}" -j DROP
63 # Flush existing rules
64 iptables
-F IPSECINPUT
65 iptables
-F IPSECOUTPUT
66 iptables
-F IPSECBLOCK
68 # We are done when IPsec is not enabled
69 [ "${ENABLED}" = "on" ] ||
exit 0
72 iptables
-A IPSECINPUT
-p udp
--dport 500 -j ACCEPT
73 iptables
-A IPSECOUTPUT
-p udp
--dport 500 -j ACCEPT
76 iptables
-A IPSECINPUT
-p udp
--dport 4500 -j ACCEPT
77 iptables
-A IPSECOUTPUT
-p udp
--dport 4500 -j ACCEPT
79 # Register local variables
83 while IFS
="," read -r "${VARS[@]}"; do
84 # Check if the connection is enabled
85 [ "${status}" = "on" ] ||
continue
87 # Check if this a net-to-net connection
88 [ "${type}" = "net" ] ||
continue
90 # Default local to 0.0.0.0/0
91 if [ "${local}" = "" -o "${local}" = "off" ]; then
95 # Install permissions for GRE traffic
96 case "${interface_mode}" in
98 if [ -n "${remote}" ]; then
99 iptables
-A IPSECINPUT
-p gre \
100 -s "${remote}" -d "${local}" -j ACCEPT
102 iptables
-A IPSECOUTPUT
-p gre \
103 -s "${local}" -d "${remote}" -j ACCEPT
108 # Install firewall rules only for interfaces without interface
109 [ -n "${interface_mode}" ] && continue
111 # Split multiple subnets
112 rightsubnets
="${rightsubnets//\|/ }"
124 for rightsubnet
in ${rightsubnets}; do
125 block_subnet
"${rightsubnet}" "${action}"
127 done < "${VPN_CONFIG}"
130 install_policy ||
exit $?