From 2293e1de0bef48e607ff4701bad07863d9ed57ee Mon Sep 17 00:00:00 2001 From: =?utf8?q?Peter=20M=C3=BCller?= Date: Tue, 3 Nov 2020 11:48:09 +0100 Subject: [PATCH] rules.pl: apply location filter to ppp0 if configured MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit In order to prevent collateral damage to internal traffic, commit c69c820025c21713cdb77eae3dd4fa61ca71b5fb introduced applying location block on red0 as a sanity check. On systems configured to use PPPoE, however, traffic appears on the ppp0 interface instead. This patch checks if a system is configured to use this connection method, and applies the location filter to this interface. red0 is used otherwise. Fixes: #12519 Cc: Michael Tremer Signed-off-by: Peter Müller Signed-off-by: Michael Tremer --- config/firewall/rules.pl | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl index c2641a92d3..bc61870526 100644 --- a/config/firewall/rules.pl +++ b/config/firewall/rules.pl @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team # +# Copyright (C) 2007-2020 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -628,8 +628,11 @@ sub locationblock { return; } - # Only check the RED interface - if ($defaultNetworks{'RED_DEV'} ne "") { + # Only check the RED interface, which is ppp0 in case of RED_TYPE being + # set to "PPPOE", and red0 in case of RED_TYPE not being empty otherwise. + if ($defaultNetworks{'RED_TYPE'} eq "PPPOE") { + run("$IPTABLES -A LOCATIONBLOCK ! -i ppp0 -j RETURN"); + } elsif ($defaultNetworks{'RED_DEV'} ne "") { run("$IPTABLES -A LOCATIONBLOCK ! -i $defaultNetworks{'RED_DEV'} -j RETURN"); } -- 2.39.2