ipsec-policy: Don't install any block rules for connections with an interface

[people/pmueller/ipfire-2.x.git] / config / firewall / ipsec-policy

diff --git a/config/firewall/ipsec-policy b/config/firewall/ipsec-policy
index 4544a447d0bb294f62e75df9bfa8c3047df21570..e2048844a837220cfeb282c2ec3a5bbfa403ca5f 100644 (file)
--- a/config/firewall/ipsec-policy
+++ b/config/firewall/ipsec-policy
@@ -21,11 +21,13 @@
 
 VPN_CONFIG="/var/ipfire/vpn/config"
 
+eval $(/usr/local/bin/readhash /var/ipfire/vpn/settings)
+
 VARS=(
        id status name lefthost type ctype x1 x2 x3 leftsubnets
-       x4 righthost rightsubnets x5 x6 x7 x8 x9 x10 x11 x12
+       remote righthost rightsubnets x5 x6 x7 x8 x9 x10 x11 x12
        x13 x14 x15 x16 x17 x18 x19 x20 x21 proto x22 x23 x24
-       route rest
+       route x26 mode interface_mode interface_address interface_mtu rest
 )
 
 block_subnet() {
@@ -53,9 +55,22 @@ block_subnet() {
 }
 
 install_policy() {
-       # Flush all exists rules
+       # Flush existing rules
+       iptables -F IPSECINPUT
+       iptables -F IPSECOUTPUT
        iptables -F IPSECBLOCK
 
+       # We are done when IPsec is not enabled
+       [ "${ENABLED}" = "on" ] || exit 0
+
+       # IKE
+       iptables -A IPSECINPUT  -p udp --dport 500 -j ACCEPT
+       iptables -A IPSECOUTPUT -p udp --dport 500 -j ACCEPT
+
+       # IKE NAT
+       iptables -A IPSECINPUT  -p udp --dport 4500 -j ACCEPT
+       iptables -A IPSECOUTPUT -p udp --dport 4500 -j ACCEPT
+
        # Register local variables
        local "${VARS[@]}"
        local action
@@ -67,6 +82,22 @@ install_policy() {
                # Check if this a net-to-net connection
                [ "${type}" = "net" ] || continue
 
+               # Install permissions for GRE traffic
+               case "${interface_mode}" in
+                       gre)
+                               if [ -n "${remote}" ]; then
+                                       iptables -A IPSECINPUT -p gre \
+                                               -s "${remote}" -j ACCEPT
+
+                                       iptables -A IPSECOUTPUT -p gre \
+                                               -d "${remote}" -j ACCEPT
+                               fi
+                               ;;
+               esac
+
+               # Install firewall rules only for interfaces without interface
+               [ -n "${interface_mode}" ] && continue
+
                # Split multiple subnets
                rightsubnets="${rightsubnets//\|/ }"