ipsec-*: Name some more configuration variables

[ipfire-2.x.git] / config / firewall / ipsec-policy

diff --git a/config/firewall/ipsec-policy b/config/firewall/ipsec-policy
index 53384fc5de104efedffb844fb7c1775f71d09852..1ad4de65013fe66c8d3e36fb62c370256b865289 100644 (file)
--- a/config/firewall/ipsec-policy
+++ b/config/firewall/ipsec-policy
@@ -24,10 +24,10 @@ VPN_CONFIG="/var/ipfire/vpn/config"
 eval $(/usr/local/bin/readhash /var/ipfire/vpn/settings)
 
 VARS=(
-       id status name lefthost type ctype x1 x2 x3 leftsubnets
-       remote righthost rightsubnets x5 x6 x7 x8 x9 x10 x11 x12
-       x13 x14 x15 x16 x17 x18 x19 x20 x21 proto x22 x23 x24
-       route x26 mode interface_mode interface_address interface_mtu rest
+       id status name lefthost type ctype psk local local_id leftsubnets
+       remote_id remote rightsubnets x3 x4 x5 x6 x7 x8 x9 x10 x11 x12
+       x13 x14 x15 x16 x17 x18 x19 proto x20 x21 x22
+       route x23 mode interface_mode interface_address interface_mtu rest
 )
 
 block_subnet() {
@@ -82,6 +82,27 @@ install_policy() {
                # Check if this a net-to-net connection
                [ "${type}" = "net" ] || continue
 
+               # Default local to 0.0.0.0/0
+               if [ "${local}" = "" -o "${local}" = "off" ]; then
+                       local="0.0.0.0/0"
+               fi
+
+               # Install permissions for GRE traffic
+               case "${interface_mode}" in
+                       gre)
+                               if [ -n "${remote}" ]; then
+                                       iptables -A IPSECINPUT -p gre \
+                                               -s "${remote}" -d "${local}" -j ACCEPT
+
+                                       iptables -A IPSECOUTPUT -p gre \
+                                               -s "${local}" -d "${remote}" -j ACCEPT
+                               fi
+                               ;;
+               esac
+
+               # Install firewall rules only for interfaces without interface
+               [ -n "${interface_mode}" ] && continue
+
                # Split multiple subnets
                rightsubnets="${rightsubnets//\|/ }"