Revision c74c5c61
Added by | src/etc/inc/filter.inc | ||
|---|---|---|
| 5033 | 5033 |
} |
| 5034 | 5034 |
|
| 5035 | 5035 |
/* Add rules to allow IKE to pass */ |
| 5036 |
$shorttunneldescr = substr($descr, 0, 35);
|
|
| 5036 |
$tunnel_rule_label_prefix = 'IPsec: ' . substr($descr, 0, 35) . ' - ';
|
|
| 5037 | 5037 |
// don't add "pass out" rules where $rgip is any, 0.0.0.0/0 or ::/0 as it will over-match and often break VPN clients behind the system in multi-WAN scenarios. redmine #5819, #12262 |
| 5038 | 5038 |
if ($passout) {
|
| 5039 |
$shorttunneldescr = fix_rule_label($tunnel_rule_label_prefix . 'outbound isakmp'); |
|
| 5039 | 5040 |
$ike_out = isset($ph1ent['ikeport']) ? $ph1ent['ikeport'] : 500; |
| 5040 |
$ipfrules .= "pass out {$log_preferences['default_pass']} $route_to proto udp from (self) to {$rgip} port = {$ike_out} ridentifier {$increment_tracker()} keep state label \"IPsec: {$shorttunneldescr} - outbound isakmp\"\n";
|
|
| 5041 |
$ipfrules .= "pass out {$log_preferences['default_pass']} $route_to proto udp from (self) to {$rgip} port = {$ike_out} ridentifier {$increment_tracker()} keep state label \"{$shorttunneldescr}\"\n";
|
|
| 5041 | 5042 |
} |
| 5042 | 5043 |
$ike_in = config_get_path('ipsec/port', 500);
|
| 5044 |
$shorttunneldescr = fix_rule_label($tunnel_rule_label_prefix . 'inbound isakmp'); |
|
| 5043 | 5045 |
$ipfrules .= <<<EOD |
| 5044 |
pass in {$log_preferences['default_pass']} on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto udp from {$rgip} to (self) port = {$ike_in} ridentifier {$increment_tracker()} keep state label "IPsec: {$shorttunneldescr} - inbound isakmp"
|
|
| 5046 |
pass in {$log_preferences['default_pass']} on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto udp from {$rgip} to (self) port = {$ike_in} ridentifier {$increment_tracker()} keep state label "{$shorttunneldescr}"
|
|
| 5045 | 5047 |
|
| 5046 | 5048 |
EOD; |
| 5047 | 5049 |
if ($passout) {
|
| 5048 | 5050 |
$natt_out = isset($ph1ent['nattport']) ? $ph1ent['nattport'] : 4500; |
| 5049 |
$ipfrules .= "pass out {$log_preferences['default_pass']} $route_to proto udp from (self) to {$rgip} port = {$natt_out} ridentifier {$increment_tracker()} keep state label \"IPsec: {$shorttunneldescr} - outbound nat-t\"\n";
|
|
| 5051 |
$shorttunneldescr = fix_rule_label($tunnel_rule_label_prefix . 'outbound nat-t'); |
|
| 5052 |
$ipfrules .= "pass out {$log_preferences['default_pass']} $route_to proto udp from (self) to {$rgip} port = {$natt_out} ridentifier {$increment_tracker()} keep state label \"{$shorttunneldescr}\"\n";
|
|
| 5050 | 5053 |
} |
| 5051 | 5054 |
$natt_in = config_get_path('ipsec/port_nat_t', 4500);
|
| 5055 |
$shorttunneldescr = fix_rule_label($tunnel_rule_label_prefix . 'inbound nat-t'); |
|
| 5052 | 5056 |
$ipfrules .= <<<EOD |
| 5053 |
pass in {$log_preferences['default_pass']} on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto udp from {$rgip} to (self) port = {$natt_in} ridentifier {$increment_tracker()} keep state label "IPsec: {$shorttunneldescr} - inbound nat-t"
|
|
| 5057 |
pass in {$log_preferences['default_pass']} on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto udp from {$rgip} to (self) port = {$natt_in} ridentifier {$increment_tracker()} keep state label "{$shorttunneldescr}"
|
|
| 5054 | 5058 |
|
| 5055 | 5059 |
EOD; |
| 5056 | 5060 |
/* Add rules to allow the protocols in use */ |
| 5057 | 5061 |
if ($prot_used_esp) {
|
| 5058 | 5062 |
if ($passout) {
|
| 5059 |
$ipfrules .= "pass out {$log_preferences['default_pass']} $route_to proto esp from (self) to {$rgip} ridentifier {$increment_tracker()} keep state label \"IPsec: {$shorttunneldescr} - outbound esp proto\"\n";
|
|
| 5063 |
$shorttunneldescr = fix_rule_label($tunnel_rule_label_prefix . 'outbound esp proto'); |
|
| 5064 |
$ipfrules .= "pass out {$log_preferences['default_pass']} $route_to proto esp from (self) to {$rgip} ridentifier {$increment_tracker()} keep state label \"{$shorttunneldescr}\"\n";
|
|
| 5060 | 5065 |
} |
| 5066 |
$shorttunneldescr = fix_rule_label($tunnel_rule_label_prefix . 'inbound esp proto'); |
|
| 5061 | 5067 |
$ipfrules .= <<<EOD |
| 5062 |
pass in {$log_preferences['default_pass']} on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto esp from {$rgip} to (self) ridentifier {$increment_tracker()} keep state label "IPsec: {$shorttunneldescr} - inbound esp proto"
|
|
| 5068 |
pass in {$log_preferences['default_pass']} on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto esp from {$rgip} to (self) ridentifier {$increment_tracker()} keep state label "{$shorttunneldescr}"
|
|
| 5063 | 5069 |
|
| 5064 | 5070 |
EOD; |
| 5065 | 5071 |
} |
| 5066 | 5072 |
if ($prot_used_ah) {
|
| 5067 | 5073 |
if ($passout) {
|
| 5068 |
$ipfrules .= "pass out {$log_preferences['default_pass']} $route_to proto ah from (self) to {$rgip} ridentifier {$increment_tracker()} keep state label \"IPsec: {$shorttunneldescr} - outbound ah proto\"\n";
|
|
| 5074 |
$shorttunneldescr = fix_rule_label($tunnel_rule_label_prefix . 'outbound ah proto'); |
|
| 5075 |
$ipfrules .= "pass out {$log_preferences['default_pass']} $route_to proto ah from (self) to {$rgip} ridentifier {$increment_tracker()} keep state label \"{$shorttunneldescr}\"\n";
|
|
| 5069 | 5076 |
} |
| 5077 |
$shorttunneldescr = fix_rule_label($tunnel_rule_label_prefix . 'inbound ah proto'); |
|
| 5070 | 5078 |
$ipfrules .= <<<EOD |
| 5071 |
pass in {$log_preferences['default_pass']} on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto ah from {$rgip} to (self) ridentifier {$increment_tracker()} keep state label "IPsec: {$shorttunneldescr} - inbound ah proto"
|
|
| 5079 |
pass in {$log_preferences['default_pass']} on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto ah from {$rgip} to (self) ridentifier {$increment_tracker()} keep state label "{$shorttunneldescr}"
|
|
| 5072 | 5080 |
|
| 5073 | 5081 |
EOD; |
| 5074 | 5082 |
} |
Also available in: Unified diff
Fix rule label for default IPsec rules. Fix #16095