From a0793ae4686da42ae5c8281bd296f4e82070ec41 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Sun, 31 May 2009 14:51:17 -0400 Subject: [PATCH] Add NAT-T ports. Submitted-by: JimP@ --- etc/inc/filter.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index f647e586b9..9cdddbc3eb 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2819,6 +2819,10 @@ EOD; $shorttunneldescr = substr($tunnel['descr'], 0, 26); $ipfrules .= "pass out quick on \${$iface} proto udp from any to {$remote_gateway} port = 500 keep state label \"IPSEC: {$shorttunneldescr} - outbound isakmp\"\n"; $ipfrules .= "pass in quick on \${$iface} proto udp from {$remote_gateway} to any port = 500 keep state label \"IPSEC: {$shorttunneldescr} - inbound isakmp\"\n"; + if (isset($tunnel['natt'])) { + $ipfrules .= "pass out quick on \${$iface} proto udp from any to {$remote_gateway} port = 4500 keep state label \"IPSEC: {$shorttunneldescr} - outbound nat-t\"\n"; + $ipfrules .= "pass in quick on \${$iface} proto udp from {$remote_gateway} to any port = 4500 keep state label \"IPSEC: {$shorttunneldescr} - inbound nat-t\"\n"; + } if ($tunnel['p2']['protocol'] == 'esp') { $ipfrules .= "pass out quick on \${$iface} proto esp from any to {$remote_gateway} keep state label \"IPSEC: {$shorttunneldescr} - outbound esp proto\"\n"; $ipfrules .= "pass in quick on \${$iface} proto esp from {$remote_gateway} to any keep state label \"IPSEC: {$shorttunneldescr} - inbound esp proto\"\n"; @@ -2842,6 +2846,9 @@ EOD; $ipfrules .= "pass in quick on \${$iface} proto udp from any to any port = 500 keep state label \"IPSEC: Mobile - inbound isakmp\"\n"; $ipfrules .= "pass in quick on \${$iface} proto esp from any to any keep state label \"IPSEC: Mobile - inbound esp proto\"\n"; $ipfrules .= "pass in quick on \${$iface} proto ah from any to any keep state label \"IPSEC: Mobile - inbound ah proto\"\n"; + if (isset($ipseccfg['mobileclients']['natt'])) { + $ipfrules .= "pass in quick on \${$iface} proto udp from any to any port = 4500 keep state label \"IPSEC: Mobile - inbound nat-t\"\n"; + } } } }