mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow IPSEC traffic on all WAN interfaces as needed.

Browse Source
This commit is contained in:
Scott Ullrich 2006-07-24 21:17:03 +00:00
parent ad356bb7ee
commit 3f7723bbff
1 changed files with 24 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
etc/inc/filter.inc
View File

@ -2221,6 +2221,12 @@ EOD;
$ipsec_failoverip = $sasyncd['ip'];
}
/* build an interface collection */
$ifdescrs = array ("wan");
for ($j = 1; isset ($config['interfaces']['opt' . $j]); $j++) {
$ifdescrs['opt' . $j] = "opt" . $j;
}
if(is_array($config['ipsec']['tunnel']) && isset($config['ipsec']['enable'])) {
foreach ($config['ipsec']['tunnel'] as $tunnel) {
update_filter_reload_status("Creating IPSEC tunnel items {$tunnel['descr']}...");
@ -2242,21 +2248,21 @@ EOD;
continue;
}
$local_subnet = return_vpn_subnet($tunnel['local-subnet']);
$ipfrules .= "pass out quick on {$wanif} proto udp from {$ipsec_ip} to {$remote_gateway} port = 500 keep state label \"IPSEC: {$tunnel['descr']} - outbound isakmp\"\n";
$ipfrules .= "pass in quick on {$wanif} proto udp from {$remote_gateway} to {$ipsec_ip} port = 500 keep state label \"IPSEC: {$tunnel['descr']} - inbound isakmp\"\n";
if ($tunnel['p2']['protocol'] == 'esp') {
$ipfrules .= "pass out quick on {$wanif} proto esp from {$ipsec_ip} to {$remote_gateway} keep state label \"IPSEC: {$tunnel['descr']} - outbound esp proto\"\n";
$ipfrules .= "pass in quick on {$wanif} proto esp from {$remote_gateway} to {$ipsec_ip} keep state label \"IPSEC: {$tunnel['descr']} - inbound esp proto\"\n";
foreach($ifdescrs as $iface) {
$ipfrules .= "pass out quick on \${$iface} proto udp from {$ipsec_ip} to {$remote_gateway} port = 500 keep state label \"IPSEC: {$tunnel['descr']} - outbound isakmp\"\n";
$ipfrules .= "pass in quick on \${$iface} proto udp from {$remote_gateway} to {$ipsec_ip} port = 500 keep state label \"IPSEC: {$tunnel['descr']} - inbound isakmp\"\n";
if ($tunnel['p2']['protocol'] == 'esp') {
$ipfrules .= "pass out quick on \${$iface} proto esp from {$ipsec_ip} to {$remote_gateway} keep state label \"IPSEC: {$tunnel['descr']} - outbound esp proto\"\n";
$ipfrules .= "pass in quick on \${$iface} proto esp from {$remote_gateway} to {$ipsec_ip} keep state label \"IPSEC: {$tunnel['descr']} - inbound esp proto\"\n";
}
if ($tunnel['p2']['protocol'] == 'ah') {
$ipfrules .= "pass out quick on \${$iface} proto ah from {$ipsec_ip} to {$remote_gateway} keep state label \"IPSEC: {$tunnel['descr']} - outbound ah proto\"\n";
$ipfrules .= "pass in quick on \${$iface} proto ah from {$remote_gateway} to {$ipsec_ip} keep state label \"IPSEC: {$tunnel['descr']} - inbound ah proto\"\n";
}
}
if ($tunnel['p2']['protocol'] == 'ah') {
$ipfrules .= "pass out quick on {$wanif} proto ah from {$ipsec_ip} to {$remote_gateway} keep state label \"IPSEC: {$tunnel['descr']} - outbound ah proto\"\n";
$ipfrules .= "pass in quick on {$wanif} proto ah from {$remote_gateway} to {$ipsec_ip} keep state label \"IPSEC: {$tunnel['descr']} - inbound ah proto\"\n";
}
//$ipfrules .= "pass out quick on {$lanif} from {$tunnel['remote-subnet']} to {$local_subnet} keep state label \"IPSEC: {$tunnel['descr']} - remote to local\"\n";
//$ipfrules .= "pass in quick on {$lanif} from {$local_subnet} to {$tunnel['remote-subnet']} keep state label \"IPSEC: {$tunnel['descr']} - local to remote\"\n";
}
}
@ -2265,9 +2271,11 @@ EOD;
*/
$ipseccfg = $config['ipsec'];
if (isset($ipseccfg['mobileclients']['enable'])) {
$ipfrules .= "pass in quick on {$wanif} proto udp from any to any port = 500 keep state label \"IPSEC: Mobile - inbound isakmp\"\n";
$ipfrules .= "pass in quick on {$wanif} proto esp from any to any keep state label \"IPSEC: Mobile - inbound esp proto\"\n";
$ipfrules .= "pass in quick on {$wanif} proto ah from any to any keep state label \"IPSEC: Mobile - inbound ah proto\"\n";
foreach($ifdescrs as $iface) {
$ipfrules .= "pass in quick on \${$iface} proto udp from any to any port = 500 keep state label \"IPSEC: Mobile - inbound isakmp\"\n";
$ipfrules .= "pass in quick on \${$iface} proto esp from any to any keep state label \"IPSEC: Mobile - inbound esp proto\"\n";
$ipfrules .= "pass in quick on \${$iface} proto ah from any to any keep state label \"IPSEC: Mobile - inbound ah proto\"\n";
}
}
}
$ipfrules .= <<<EOD