From 3f7723bbff326fd73e15997a712a9dcd2b1dc2a5 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Mon, 24 Jul 2006 21:17:03 +0000
Subject: [PATCH] Allow IPSEC traffic on all WAN interfaces as needed.

Ticket
 #1028

---
 etc/inc/filter.inc | 40 ++++++++++++++++++++++++----------------
 1 file changed, 24 insertions(+), 16 deletions(-)

diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index 3246a75f11..861cbe3cce 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -2221,6 +2221,12 @@ EOD;
 				$ipsec_failoverip = $sasyncd['ip'];
 		}
 
+		/* build an interface collection */
+		$ifdescrs = array ("wan");
+		for ($j = 1; isset ($config['interfaces']['opt' . $j]); $j++) {
+			$ifdescrs['opt' . $j] = "opt" . $j;
+		}
+
 		if(is_array($config['ipsec']['tunnel']) && isset($config['ipsec']['enable'])) {
 			foreach ($config['ipsec']['tunnel'] as $tunnel) {
 				update_filter_reload_status("Creating IPSEC tunnel items {$tunnel['descr']}...");
@@ -2242,21 +2248,21 @@ EOD;
 					continue;
 				}
 				$local_subnet = return_vpn_subnet($tunnel['local-subnet']);
-				$ipfrules .= "pass out quick on {$wanif} proto udp from {$ipsec_ip} to {$remote_gateway} port = 500 keep state label \"IPSEC: {$tunnel['descr']} - outbound isakmp\"\n";
-				$ipfrules .= "pass in quick on {$wanif} proto udp from {$remote_gateway} to {$ipsec_ip} port = 500 keep state label \"IPSEC: {$tunnel['descr']} - inbound isakmp\"\n";
-
-				if ($tunnel['p2']['protocol'] == 'esp') {
-				$ipfrules .= "pass out quick on {$wanif} proto esp from {$ipsec_ip} to {$remote_gateway} keep state label \"IPSEC: {$tunnel['descr']} - outbound esp proto\"\n";
-				$ipfrules .= "pass in quick on {$wanif} proto esp from {$remote_gateway} to {$ipsec_ip} keep state label \"IPSEC: {$tunnel['descr']} - inbound esp proto\"\n";
+				foreach($ifdescrs as $iface) {
+					$ipfrules .= "pass out quick on \${$iface} proto udp from {$ipsec_ip} to {$remote_gateway} port = 500 keep state label \"IPSEC: {$tunnel['descr']} - outbound isakmp\"\n";
+					$ipfrules .= "pass in quick on \${$iface} proto udp from {$remote_gateway} to {$ipsec_ip} port = 500 keep state label \"IPSEC: {$tunnel['descr']} - inbound isakmp\"\n";
+	
+					if ($tunnel['p2']['protocol'] == 'esp') {
+						$ipfrules .= "pass out quick on \${$iface} proto esp from {$ipsec_ip} to {$remote_gateway} keep state label \"IPSEC: {$tunnel['descr']} - outbound esp proto\"\n";
+						$ipfrules .= "pass in quick on \${$iface} proto esp from {$remote_gateway} to {$ipsec_ip} keep state label \"IPSEC: {$tunnel['descr']} - inbound esp proto\"\n";
+					}
+	
+					if ($tunnel['p2']['protocol'] == 'ah') {
+						$ipfrules .= "pass out quick on \${$iface} proto ah from {$ipsec_ip} to {$remote_gateway} keep state label \"IPSEC: {$tunnel['descr']} - outbound ah proto\"\n";
+						$ipfrules .= "pass in quick on \${$iface} proto ah from {$remote_gateway} to {$ipsec_ip} keep state label \"IPSEC: {$tunnel['descr']} - inbound ah proto\"\n";
+					}
 				}
 
-				if ($tunnel['p2']['protocol'] == 'ah') {
-				$ipfrules .= "pass out quick on {$wanif} proto ah from {$ipsec_ip} to {$remote_gateway} keep state label \"IPSEC: {$tunnel['descr']} - outbound ah proto\"\n";
-				$ipfrules .= "pass in quick on {$wanif} proto ah from {$remote_gateway} to {$ipsec_ip} keep state label \"IPSEC: {$tunnel['descr']} - inbound ah proto\"\n";
-				}
-
-				//$ipfrules .= "pass out quick on {$lanif} from {$tunnel['remote-subnet']} to {$local_subnet} keep state label \"IPSEC: {$tunnel['descr']} - remote to local\"\n";
-				//$ipfrules .= "pass in quick on {$lanif} from {$local_subnet} to {$tunnel['remote-subnet']} keep state label \"IPSEC:  {$tunnel['descr']} - local to remote\"\n";
 			}
 		}
 
@@ -2265,9 +2271,11 @@ EOD;
 		 */
 		$ipseccfg = $config['ipsec'];
 		if (isset($ipseccfg['mobileclients']['enable'])) {
-			$ipfrules .= "pass in quick on {$wanif} proto udp from any to any port = 500 keep state label \"IPSEC: Mobile - inbound isakmp\"\n";
-			$ipfrules .= "pass in quick on {$wanif} proto esp from any to any keep state label \"IPSEC: Mobile - inbound esp proto\"\n";
-			$ipfrules .= "pass in quick on {$wanif} proto ah from any to any  keep state label \"IPSEC: Mobile - inbound ah proto\"\n";
+			foreach($ifdescrs as $iface) {
+				$ipfrules .= "pass in quick on \${$iface} proto udp from any to any port = 500 keep state label \"IPSEC: Mobile - inbound isakmp\"\n";
+				$ipfrules .= "pass in quick on \${$iface} proto esp from any to any keep state label \"IPSEC: Mobile - inbound esp proto\"\n";
+				$ipfrules .= "pass in quick on \${$iface} proto ah from any to any  keep state label \"IPSEC: Mobile - inbound ah proto\"\n";
+			}
 		}
 	}
 	$ipfrules .= <<<EOD