From 20fdc10f3761081f423bfc3a38e2ebe7a2aa3055 Mon Sep 17 00:00:00 2001
From: Seth Mos <seth.mos@xs4all.nl>
Date: Thu, 5 Jun 2008 08:51:10 +0000
Subject: [PATCH] Make the vpn configuration add static routes on interfaces
 other then WAN. link_carp_interface_to_parent() now correctly returns parent
 interface instead of always WAN.

---
 etc/inc/pfsense-utils.inc | 20 +++++++++++++-------
 etc/inc/vpn.inc           | 10 ++++++++--
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/etc/inc/pfsense-utils.inc b/etc/inc/pfsense-utils.inc
index 47854d5284..bd27bade8f 100644
--- a/etc/inc/pfsense-utils.inc
+++ b/etc/inc/pfsense-utils.inc
@@ -1211,20 +1211,26 @@ function link_carp_interface_to_parent($interface) {
 	global $config;
 	if($interface == "") return;
 
-	$ifdescrs = array('wan', 'lan');
+	$ifdescrs = array("wan" => "wan", "lan" => "lan");
 	for ($j = 1; isset($config['interfaces']['opt' . $j]); $j++)
 		$ifdescrs['opt' . $j] = "opt" . $j;
 
+	$carp_int = $interface;
+	$carp_ip = find_interface_ip($interface);
+	$carp_subnet = find_virtual_ip_netmask($carp_ip);
+	$starting_ip = gen_subnet("{$carp_ip}", "{$carp_subnet}");
 	$carp_ints = "";
 	$num_carp_ints = find_number_of_created_carp_interfaces();
+
 	foreach ($ifdescrs as $ifdescr => $ifname) {
-		$carp_int = $interface;
-		$carp_ip = find_interface_ip($interface);
-		$carp_subnet = find_virtual_ip_netmask($carp_ip);
-		$starting_ip = gen_subnet("{$carp_ip}", "{$carp_subnet}");
-		if(ip_in_subnet($starting_ip, "{$carp_ip}/{$carp_subnet}"))
-			if(!stristr($carp_ints, $carp_int))
+		if(interface_has_gateway($ifname)) {
+			$interfaceip = $config['interfaces'][$ifname]['ipaddr'];
+			$subnet_bits = $config['interfaces'][$ifname]['subnet'];
+			$subnet_ip = gen_subnet("{$interfaceip}", "{$subnet_bits}");
+			if(ip_in_subnet($carp_ip, "{$subnet_ip}/{$subnet_bits}")) {
 				return $ifname;
+			}
+		}
 	}
 	return $carp_ints;
 }
diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index caef20ab23..cfab6022e1 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -245,8 +245,14 @@ function vpn_ipsec_configure($ipchg = false) {
 				
 					if($tunnel['interface'] <> "wan") {
 						/* static route needed? */
-						if(strstr("carp", $tunnel['interface'])) {
-							
+						if(preg_match("/^carp/i", $tunnel['interface'])) {
+							/* add endpoint routes to correct gateway on interface */
+							$parentinterface = link_carp_interface_to_parent($tunnel['interface']);
+							$gatewayip = get_interface_gateway("$parentinterface");
+							if($gatewayip) {
+								log_error("IPSEC interface is not WAN but {$tunnel['interface']}, adding static route for VPN endpoint {$tunnel['remote-gateway']} via {$gatewayip}");
+								mwexec("/sbin/route add -host {$tunnel['remote-gateway']} {$gatewayip}");
+							}
 						}
 					}
 				}