firewall: Allow access to the entire GREEN/BLUE/ORANGE subnets.

This includes the firewall itself as well.

diff --git a/config/firewall/firewall-policy b/config/firewall/firewall-policy
index bd1e40d35a101eea1ba5f5cb98333c118c949100..faf177ccef4631cf934637834a47ce1ce110e720 100755 (executable)
--- a/config/firewall/firewall-policy
+++ b/config/firewall/firewall-policy
@@ -52,6 +52,8 @@ case "${CONFIG_TYPE}" in
                ;;
 esac
 
+HAVE_OPENVPN="true"
+
 # INPUT
 case "${FWPOLICY2}" in
        REJECT)
@@ -61,6 +63,16 @@ case "${FWPOLICY2}" in
                iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_INPUT"
                ;;
        *) # DROP
+               # OpenVPN
+               # Allow direct access to the internal IP addresses of the firewall
+               # from remote subnets if forward policy is allowed.
+               case "${HAVE_OPENVPN},${POLICY}" in
+                       true,MODE1) ;;
+                       true,*)
+                               iptables -A POLICYIN -i tun+ -j ACCEPT
+                               ;;
+               esac
+
                if [ "${DROPINPUT}" = "on" ]; then
                        iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
                fi