mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add NAT-T ports.

Browse Source 
Submitted-by: 	JimP@
This commit is contained in:
Scott Ullrich 2009-05-31 14:51:17 -04:00
parent 30934c5913
commit a0793ae468
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
etc/inc/filter.inc
View File

@ -2819,6 +2819,10 @@ EOD;
$shorttunneldescr = substr($tunnel['descr'], 0, 26);
$ipfrules .= "pass out quick on \${$iface} proto udp from any to {$remote_gateway} port = 500 keep state label \"IPSEC: {$shorttunneldescr} - outbound isakmp\"\n";
$ipfrules .= "pass in quick on \${$iface} proto udp from {$remote_gateway} to any port = 500 keep state label \"IPSEC: {$shorttunneldescr} - inbound isakmp\"\n";
if (isset($tunnel['natt'])) {
$ipfrules .= "pass out quick on \${$iface} proto udp from any to {$remote_gateway} port = 4500 keep state label \"IPSEC: {$shorttunneldescr} - outbound nat-t\"\n";
$ipfrules .= "pass in quick on \${$iface} proto udp from {$remote_gateway} to any port = 4500 keep state label \"IPSEC: {$shorttunneldescr} - inbound nat-t\"\n";
}
if ($tunnel['p2']['protocol'] == 'esp') {
$ipfrules .= "pass out quick on \${$iface} proto esp from any to {$remote_gateway} keep state label \"IPSEC: {$shorttunneldescr} - outbound esp proto\"\n";
$ipfrules .= "pass in quick on \${$iface} proto esp from {$remote_gateway} to any keep state label \"IPSEC: {$shorttunneldescr} - inbound esp proto\"\n";
@ -2842,6 +2846,9 @@ EOD;
$ipfrules .= "pass in quick on \${$iface} proto udp from any to any port = 500 keep state label \"IPSEC: Mobile - inbound isakmp\"\n";
$ipfrules .= "pass in quick on \${$iface} proto esp from any to any keep state label \"IPSEC: Mobile - inbound esp proto\"\n";
$ipfrules .= "pass in quick on \${$iface} proto ah from any to any keep state label \"IPSEC: Mobile - inbound ah proto\"\n";
if (isset($ipseccfg['mobileclients']['natt'])) {
$ipfrules .= "pass in quick on \${$iface} proto udp from any to any port = 4500 keep state label \"IPSEC: Mobile - inbound nat-t\"\n";
}
}
}
}