webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

suricata: Explicitly ignore IPsec traffic unless enabled

Browse Source 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This commit is contained in:
Michael Tremer
2024-10-21 17:03:06 +00:00
committed by Arne Fitzenreiter
parent 57853da08b
commit 76b6bc3e9d
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/initscripts/system/suricata
View File

@@ -111,6 +111,18 @@ generate_fw_rules() {
if [ "${!status}" = "on" ]; then
# Handle IPsec packets
case "${zone}" in
RED)
# If IPsec is not enabled, skip everything that is IPsec traffic
if [ "${ENABLE_IDS_IPSEC}" != "on" ]; then
for intf in $(network_get_intfs "${zone}"); do
iptables -w -t mangle -A IPS_SCAN_IN \
-i "${intf}" -m policy --pol ipsec --dir in -j RETURN
iptables -w -t mangle -A IPS_SCAN_OUT \
-o "${intf}" -m policy --pol ipsec --dir out -j RETURN
done
fi
;;
IPSEC)
iptables -w -t mangle -A IPS_SCAN_IN \
-m policy --pol ipsec --dir in -j MARK --set-mark "$(( IPS_SCAN_MARK ))/$(( IPS_SCAN_MASK ))"