openvpnctrl: Block all transfer subnets.
authorMichael Tremer <michael.tremer@ipfire.org>
Fri, 31 May 2013 11:31:48 +0000 (13:31 +0200)
committerMichael Tremer <michael.tremer@ipfire.org>
Fri, 9 Aug 2013 12:15:27 +0000 (14:15 +0200)
src/misc-progs/openvpnctrl.c

index 0875cec69bb579664553df6749531e82c91b7ec1..3a4c6db806c34bcc8be625fd8cca7ae2d57d74e2 100644 (file)
@@ -27,6 +27,7 @@ char enableorange[STRING_SIZE] = "off";
 char OVPNRED[STRING_SIZE] = "OVPN";
 char OVPNBLUE[STRING_SIZE] = "OVPN_BLUE_";
 char OVPNORANGE[STRING_SIZE] = "OVPN_ORANGE_";
+char OVPNBLOCK[STRING_SIZE] = "OVPNBLOCK";
 char OVPNNAT[STRING_SIZE] = "OVPNNAT";
 char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.2.3";
 
@@ -480,6 +481,11 @@ void setFirewallRules(void) {
                                OVPNRED, redif, conn->proto, conn->port);
                        executeCommand(command);
 
+                       /* Block all communication from the transfer nets. */
+                       snprintf(command, STRING_SIZE, "/sbin/iptables -A %s -s %s -j DROP",
+                               OVPNBLOCK, conn->transfer_subnet);
+                       executeCommand(command);
+
                        local_subnet_address = getLocalSubnetAddress(conn);
                        transfer_subnet_address = calcTransferNetAddress(conn);