rules.pl: apply location filter to ppp0 if configured

In order to prevent collateral damage to internal traffic, commit
c69c820025c21713cdb77eae3dd4fa61ca71b5fb introduced applying location
block on red0 as a sanity check.

On systems configured to use PPPoE, however, traffic appears on the ppp0
interface instead. This patch checks if a system is configured to use
this connection method, and applies the location filter to this
interface. red0 is used otherwise.

Fixes: #12519
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index c2641a92d327be59531dd44a461ac8cc06f5786c..bc6187052614725c1850b2030aeb03f0ead1ef2f 100644 (file)
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2019  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2020  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -628,8 +628,11 @@ sub locationblock {
                return;
        }
 
-       # Only check the RED interface
-       if ($defaultNetworks{'RED_DEV'} ne "") {
+       # Only check the RED interface, which is ppp0 in case of RED_TYPE being
+       # set to "PPPOE", and red0 in case of RED_TYPE not being empty otherwise.
+       if ($defaultNetworks{'RED_TYPE'} eq "PPPOE") {
+               run("$IPTABLES -A LOCATIONBLOCK ! -i ppp0 -j RETURN");
+       } elsif ($defaultNetworks{'RED_DEV'} ne "") {
                run("$IPTABLES -A LOCATIONBLOCK ! -i $defaultNetworks{'RED_DEV'} -j RETURN");
        }