webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

firewall: replace mark with --pol ipsec to exclude ipsec traffic from masquerade

Browse Source 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This commit is contained in:
Arne Fitzenreiter
2021-10-19 18:27:49 +00:00
parent ef7d9d7657
commit e850a61429
1 changed files with 1 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/initscripts/system/firewall
View File

@@ -14,9 +14,6 @@ fi
NAT_MASK="0x0f000000"
IPSEC_MARK="0x00800000"
IPSEC_MASK="${IPSEC_MARK}"
IPS_REPEAT_MARK="0x80000000"
IPS_REPEAT_MASK="0x80000000"
IPS_BYPASS_MARK="0x40000000"
@@ -396,7 +393,7 @@ iptables_red_up() {
fi
# Outgoing masquerading (don't masqerade IPsec)
iptables -t nat -A REDNAT -m mark --mark "${IPSEC_MARK}/${IPSEC_MASK}" -o "${IFACE}" -j RETURN
iptables -t nat -A REDNAT -m policy --pol ipsec --dir=out -o "${IFACE}" -j RETURN
if [ "${IFACE}" = "${GREEN_DEV}" ]; then
iptables -t nat -A REDNAT -i "${GREEN_DEV}" -o "${IFACE}" -j RETURN