webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-28 11:43:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

IPsec: Replace MARK 50 by 0x00800000

Browse Source 
This change is necessary because we are using the right-hand two bytes
for storing the QoS classes.

All IPsec traffic will now be skipped and never classified by the QoS.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This commit is contained in:
Michael Tremer
2021-10-04 18:52:22 +01:00
committed by Arne Fitzenreiter
parent f857c5c630
commit 51c4b73f7a
3 changed files with 16 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
config/qos/makeqosscripts.pl
View File

@@ -61,6 +61,9 @@ my $QOS_INC_MASK = 0x0000ff00;
my $QOS_INC_SHIFT = 8;
my $QOS_OUT_MASK = 0x000000ff;
my $QOS_OUT_SHIFT = 0;
my $IPSEC_MASK = 0x00800000;
my $QOS_INC_SKIP_MASK = $QOS_INC_MASK | $IPSEC_MASK;
my $QOS_OUT_SKIP_MASK = $QOS_OUT_MASK | $IPSEC_MASK;
&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
@@ -220,10 +223,7 @@ print <<END
iptables -t mangle -A POSTROUTING -o $qossettings{'RED_DEV'} -j QOS-OUT
# If the packet is already marked, then skip the processing
iptables -t mangle -A QOS-OUT -m mark ! --mark 0/$QOS_OUT_MASK -j RETURN
### Don't change mark on traffic for the ipsec tunnel
iptables -t mangle -A QOS-OUT -m mark --mark 50 -j RETURN
iptables -t mangle -A QOS-OUT -m mark ! --mark 0/$QOS_OUT_SKIP_MASK -j RETURN
### SET TOS
END
@@ -393,7 +393,7 @@ print <<END
iptables -t mangle -A PREROUTING -i $qossettings{'RED_DEV'} -j QOS-INC
# If the packet is already marked, then skip the processing
iptables -t mangle -A QOS-INC -m mark ! --mark 0/$QOS_INC_MASK -j RETURN
iptables -t mangle -A QOS-INC -m mark ! --mark 0/$QOS_INC_SKIP_MASK -j RETURN
### SET TOS
END