rules.pl: Fix SNAT over VPN.

This commit adds flags which will are applied if SNAT should be used on
the red address or any configured alias.

They prevent doing the SNAT when tranismitting packet through a VPN over the red interface.

Fixes #12162.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Tested-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 86db47367a31ee4823b81650b1a101a4caded5ed..6129af86103505c557e2649cb63f54a238a92a28 100644 (file)
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -479,16 +479,31 @@ sub buildrules {
 
                                                # Source NAT
                                                } elsif ($NAT_MODE eq "SNAT") {
+                                                       my @snat_options = ( "-m", "policy", "--dir", "out", "--pol", "none" );
                                                        my @nat_options = @options;
 
+                                                       # Get addresses for the configured firewall interfaces.
+                                                       my @local_addresses = &fwlib::get_internal_firewall_ip_addresses(1);
+
+                                                       # Check if the nat_address is one of the local addresses.
+                                                       foreach my $local_address (@local_addresses) {
+                                                               if ($nat_address eq $local_address) {
+                                                                       # Clear SNAT options.
+                                                                       @snat_options = ();
+
+                                                                       # Finish loop.
+                                                                       last;
+                                                               }
+                                                       }
+
                                                        push(@nat_options, @destination_intf_options);
                                                        push(@nat_options, @source_options);
                                                        push(@nat_options, @destination_options);
 
                                                        if ($LOG) {
-                                                               run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options @log_limit_options -j LOG --log-prefix 'SNAT '");
+                                                               run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options @snat_options @log_limit_options -j LOG --log-prefix 'SNAT '");
                                                        }
-                                                       run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options -j SNAT --to-source $nat_address");
+                                                       run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options @snat_options -j SNAT --to-source $nat_address");
                                                }
                                        }