ipsec-policy: Don't install any block rules for connections with an interface

[people/pmueller/ipfire-2.x.git] / config / firewall / ipsec-policy

diff --git a/config/firewall/ipsec-policy b/config/firewall/ipsec-policy
index 53384fc5de104efedffb844fb7c1775f71d09852..e2048844a837220cfeb282c2ec3a5bbfa403ca5f 100644 (file)
--- a/config/firewall/ipsec-policy
+++ b/config/firewall/ipsec-policy
@@ -82,6 +82,22 @@ install_policy() {
                # Check if this a net-to-net connection
                [ "${type}" = "net" ] || continue
 
+               # Install permissions for GRE traffic
+               case "${interface_mode}" in
+                       gre)
+                               if [ -n "${remote}" ]; then
+                                       iptables -A IPSECINPUT -p gre \
+                                               -s "${remote}" -j ACCEPT
+
+                                       iptables -A IPSECOUTPUT -p gre \
+                                               -d "${remote}" -j ACCEPT
+                               fi
+                               ;;
+               esac
+
+               # Install firewall rules only for interfaces without interface
+               [ -n "${interface_mode}" ] && continue
+
                # Split multiple subnets
                rightsubnets="${rightsubnets//\|/ }"