rules.pl: apply location filter to ppp0 if configured
Commit Message
In order to prevent collateral damage to internal traffic, commit
c69c820025c21713cdb77eae3dd4fa61ca71b5fb introduced applying location
block on red0 as a sanity check.
On systems configured to use PPPoE, however, traffic appears on the ppp0
interface instead. This patch checks if a system is configured to use
this connection method, and applies the location filter to this
interface. red0 is used otherwise.
Fixes: #12519
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---
config/firewall/rules.pl | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
@@ -2,7 +2,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2019 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2020 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -628,8 +628,11 @@ sub locationblock {
return;
}
- # Only check the RED interface
- if ($defaultNetworks{'RED_DEV'} ne "") {
+ # Only check the RED interface, which is ppp0 in case of RED_TYPE being
+ # set to "PPPOE", and red0 in case of RED_TYPE not being empty otherwise.
+ if ($defaultNetworks{'RED_TYPE'} eq "PPPOE") {
+ run("$IPTABLES -A LOCATIONBLOCK ! -i ppp0 -j RETURN");
+ } elsif ($defaultNetworks{'RED_DEV'} ne "") {
run("$IPTABLES -A LOCATIONBLOCK ! -i $defaultNetworks{'RED_DEV'} -j RETURN");
}