webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-21 00:12:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

IPsec: Replace MARK 50 by 0x00800000

Browse Source 
This change is necessary because we are using the right-hand two bytes
for storing the QoS classes.

All IPsec traffic will now be skipped and never classified by the QoS.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This commit is contained in:
Michael Tremer
2021-10-04 18:52:22 +01:00
committed by Arne Fitzenreiter
parent f857c5c630
commit 51c4b73f7a
3 changed files with 16 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/initscripts/system/firewall
View File

@@ -14,6 +14,9 @@ fi
NAT_MASK="0x0f000000"
IPSEC_MARK="0x00800000"
IPSEC_MASK="${IPSEC_MARK}"
function iptables() {
/sbin/iptables --wait "$@"
}
@@ -376,8 +379,8 @@ iptables_red_up() {
iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
fi
# Outgoing masquerading (don't masqerade IPsec (mark 50))
iptables -t nat -A REDNAT -m mark --mark 50 -o $IFACE -j RETURN
# Outgoing masquerading (don't masqerade IPsec)
iptables -t nat -A REDNAT -m mark --mark "${IPSEC_MARK}/${IPSEC_MASK}" -o "${IFACE}" -j RETURN
if [ "${IFACE}" = "${GREEN_DEV}" ]; then
iptables -t nat -A REDNAT -i "${GREEN_DEV}" -o "${IFACE}" -j RETURN