webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

rules.pl: apply location filter to ppp0 if configured

Browse Source 
In order to prevent collateral damage to internal traffic, commit
c69c820025 introduced applying location
block on red0 as a sanity check.

On systems configured to use PPPoE, however, traffic appears on the ppp0
interface instead. This patch checks if a system is configured to use
this connection method, and applies the location filter to this
interface. red0 is used otherwise.

Fixes: #12519

Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Peter Müller
2020-11-03 11:48:09 +01:00
committed by Michael Tremer
parent 66c9d821d6
commit 2293e1de0b
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
config/firewall/rules.pl
View File

@@ -2,7 +2,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
# Copyright (C) 2007-2019 IPFire Team <info@ipfire.org> #
# Copyright (C) 2007-2020 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -628,8 +628,11 @@ sub locationblock {
return;
}
# Only check the RED interface
if ($defaultNetworks{'RED_DEV'} ne "") {
# Only check the RED interface, which is ppp0 in case of RED_TYPE being
# set to "PPPOE", and red0 in case of RED_TYPE not being empty otherwise.
if ($defaultNetworks{'RED_TYPE'} eq "PPPOE") {
run("$IPTABLES -A LOCATIONBLOCK ! -i ppp0 -j RETURN");
} elsif ($defaultNetworks{'RED_DEV'} ne "") {
run("$IPTABLES -A LOCATIONBLOCK ! -i $defaultNetworks{'RED_DEV'} -j RETURN");
}