config/firewall/ipsec-policy

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2015 IPFire Team                                              #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 VPN_CONFIG="/var/ipfire/vpn/config"
  23
  24 eval $(/usr/local/bin/readhash /var/ipfire/vpn/settings)
  25
  26 VARS=(
  27         id status name lefthost type ctype x1 x2 x3 leftsubnets
  28         x4 righthost rightsubnets x5 x6 x7 x8 x9 x10 x11 x12
  29         x13 x14 x15 x16 x17 x18 x19 x20 x21 proto x22 x23 x24
  30         route rest
  31 )
  32
  33 block_subnet() {
  34         local subnet="${1}"
  35         local action="${2}"
  36
  37         # Don't block a wildcard subnet
  38         if [ "${subnet}" = "0.0.0.0/0" ] || [ "${subnet}" = "0.0.0.0/0.0.0.0" ]; then
  39                 return 0
  40         fi
  41
  42         case "${action}" in
  43                 reject)
  44                         iptables -A IPSECBLOCK -d "${subnet}" -j REJECT --reject-with icmp-net-unreachable
  45                         ;;
  46                 drop)
  47                         iptables -A IPSECBLOCK -d "${subnet}" -j DROP
  48                         ;;
  49                 *)
  50                         return 1
  51                         ;;
  52         esac
  53
  54         return 0
  55 }
  56
  57 install_policy() {
  58         # Flush existing rules
  59         iptables -F IPSECINPUT
  60         iptables -F IPSECOUTPUT
  61         iptables -F IPSECBLOCK
  62
  63         # We are done when IPsec is not enabled
  64         [ "${ENABLED}" = "on" ] || exit 0
  65
  66         # IKE
  67         iptables -A IPSECINPUT  -p udp --dport 500 -j ACCEPT
  68         iptables -A IPSECOUTPUT -p udp --dport 500 -j ACCEPT
  69
  70         # IKE NAT
  71         iptables -A IPSECINPUT  -p udp --dport 4500 -j ACCEPT
  72         iptables -A IPSECOUTPUT -p udp --dport 4500 -j ACCEPT
  73
  74         # Register local variables
  75         local "${VARS[@]}"
  76         local action
  77
  78         while IFS="," read -r "${VARS[@]}"; do
  79                 # Check if the connection is enabled
  80                 [ "${status}" = "on" ] || continue
  81
  82                 # Check if this a net-to-net connection
  83                 [ "${type}" = "net" ] || continue
  84
  85                 # Split multiple subnets
  86                 rightsubnets="${rightsubnets//\|/ }"
  87
  88                 case "${route}" in
  89                         route)
  90                                 action="drop"
  91                                 ;;
  92                         *)
  93                                 action="reject"
  94                                 ;;
  95                 esac
  96
  97                 local rightsubnet
  98                 for rightsubnet in ${rightsubnets}; do
  99                         block_subnet "${rightsubnet}" "${action}"
 100                 done
 101         done < "${VPN_CONFIG}"
 102 }
 103
 104 install_policy || exit $?