mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-10 19:15:54 +02:00
cda384a280
When an on-demand VPN connection is not up, the packets will traverse the firewall and be rejected by the IPSECBLOCK chain which will cause that an ICMP error message will be sent to the client. If that does not happen and the packet is being silently dropped, the client will retransmit and by then the VPN connection will hopefully be up. Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
89 lines
2.8 KiB
Bash
89 lines
2.8 KiB
Bash
#!/bin/bash
|
|
###############################################################################
|
|
# #
|
|
# IPFire.org - A linux based firewall #
|
|
# Copyright (C) 2015 IPFire Team #
|
|
# #
|
|
# This program is free software: you can redistribute it and/or modify #
|
|
# it under the terms of the GNU General Public License as published by #
|
|
# the Free Software Foundation, either version 3 of the License, or #
|
|
# (at your option) any later version. #
|
|
# #
|
|
# This program is distributed in the hope that it will be useful, #
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
|
|
# GNU General Public License for more details. #
|
|
# #
|
|
# You should have received a copy of the GNU General Public License #
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
|
|
# #
|
|
###############################################################################
|
|
|
|
VPN_CONFIG="/var/ipfire/vpn/config"
|
|
|
|
block_subnet() {
|
|
local subnet="${1}"
|
|
local action="${2}"
|
|
|
|
# Don't block a wildcard subnet
|
|
if [ "${subnet}" = "0.0.0.0/0" ] || [ "${subnet}" = "0.0.0.0/0.0.0.0" ]; then
|
|
return 0
|
|
fi
|
|
|
|
case "${action}" in
|
|
reject)
|
|
iptables -A IPSECBLOCK -d "${subnet}" -j REJECT --reject-with icmp-net-unreachable
|
|
;;
|
|
drop)
|
|
iptables -A IPSECBLOCK -d "${subnet}" -j DROP
|
|
;;
|
|
*)
|
|
return 1
|
|
;;
|
|
esac
|
|
|
|
return 0
|
|
}
|
|
|
|
block_ipsec() {
|
|
# Flush all exists rules
|
|
iptables -F IPSECBLOCK
|
|
|
|
local action
|
|
|
|
local vars="id status name lefthost type ctype x1 x2 x3 leftsubnets"
|
|
vars="${vars} x4 righthost rightsubnets x5 x6 x7 x8 x9 x10 x11 x12"
|
|
vars="${vars} x13 x14 x15 x16 x17 x18 x19 x20 x21 proto x22 x23 x24"
|
|
vars="${vars} route rest"
|
|
|
|
# Register local variables
|
|
local ${vars}
|
|
|
|
while IFS="," read -r ${vars}; do
|
|
# Check if the connection is enabled
|
|
[ "${status}" = "on" ] || continue
|
|
|
|
# Check if this a net-to-net connection
|
|
[ "${type}" = "net" ] || continue
|
|
|
|
# Split multiple subnets
|
|
rightsubnets="${rightsubnets//\|/ }"
|
|
|
|
case "${route}" in
|
|
route)
|
|
action="drop"
|
|
;;
|
|
*)
|
|
action="reject"
|
|
;;
|
|
esac
|
|
|
|
local rightsubnet
|
|
for rightsubnet in ${rightsubnets}; do
|
|
block_subnet "${rightsubnet}" "${action}"
|
|
done
|
|
done < "${VPN_CONFIG}"
|
|
}
|
|
|
|
block_ipsec || exit $?
|