This will avoid outgoing IPsec traffic being dropped by IPFire itself,
if the default firewall behavior for outgoing traffic is set to
"blocked", and no appropriate rules have been manually configured in the
web interface.
To ensure configured IPsec tunnels will always work flawlessly,
regardless of the firewall default policy and any manually created
firewall rules, create and delete outgoing iptables rules accordingly
when bringing an IPsec connection up or down.
Tested-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---
src/patches/strongswan-ipfire.patch | 49 +++++++++++++++++------------
1 file changed, 29 insertions(+), 20 deletions(-)
@@ -1,13 +1,5 @@
-commit b439f74361d393bcb85109b6c41a905cf613a296
-Author: Peter Müller <peter.mueller@ipfire.org>
-Date: Wed May 18 17:46:57 2022 +0000
-
- IPFire modifications to _updown script
-
- Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
-
diff --git a/src/_updown/_updown.in b/src/_updown/_updown.in
-index 34eaf68c7..9ed387a0a 100644
+index 34eaf68c7..38aa63354 100644
--- a/src/_updown/_updown.in
+++ b/src/_updown/_updown.in
@@ -242,10 +242,10 @@ up-host:iptables)
@@ -98,7 +90,7 @@ index 34eaf68c7..9ed387a0a 100644
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
-@@ -342,47 +324,37 @@ up-client:iptables)
+@@ -342,47 +324,46 @@ up-client:iptables)
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
then
logger -t $TAG -p $FAC_PRIO \
@@ -111,7 +103,7 @@ index 34eaf68c7..9ed387a0a 100644
fi
fi
+
-+ # Open Firewall for IPinIP + AH + ESP Traffic
++ # Open firewall for incoming and outgoing IPinIP + AH + ESP traffic to the peers' IP
+ iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p IPIP \
+ -s $PLUTO_PEER $S_PEER_PORT \
+ -d $PLUTO_ME $D_MY_PORT -j ACCEPT
@@ -121,6 +113,15 @@ index 34eaf68c7..9ed387a0a 100644
+ iptables --wait -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p ESP \
+ -s $PLUTO_PEER $S_PEER_PORT \
+ -d $PLUTO_ME $D_MY_PORT -j ACCEPT
++ iptables --wait -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p IPIP \
++ -s $PLUTO_ME $D_MY_PORT \
++ -d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
++ iptables --wait -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p AH \
++ -s $PLUTO_ME $D_MY_PORT \
++ -d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
++ iptables --wait -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p ESP \
++ -s $PLUTO_ME $D_MY_PORT \
++ -d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
+
;;
down-client:iptables)
@@ -161,7 +162,7 @@ index 34eaf68c7..9ed387a0a 100644
-s $PLUTO_PEER -d $PLUTO_ME $IPSEC_POLICY_IN -j ACCEPT
fi
#
-@@ -392,12 +364,24 @@ down-client:iptables)
+@@ -392,12 +373,32 @@ down-client:iptables)
if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
then
logger -t $TAG -p $FAC_PRIO -- \
@@ -174,7 +175,7 @@ index 34eaf68c7..9ed387a0a 100644
fi
fi
+
-+ # Close Firewall for IPinIP + AH + ESP Traffic
++ # Close firewall for incoming and outgoing IPinIP + AH + ESP traffic to the peers' IP
+ iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p IPIP \
+ -s $PLUTO_PEER $S_PEER_PORT \
+ -d $PLUTO_ME $D_MY_PORT -j ACCEPT
@@ -184,11 +185,19 @@ index 34eaf68c7..9ed387a0a 100644
+ iptables --wait -D IPSECINPUT -i $PLUTO_INTERFACE -p ESP \
+ -s $PLUTO_PEER $S_PEER_PORT \
+ -d $PLUTO_ME $D_MY_PORT -j ACCEPT
-+
++ iptables --wait -D IPSECINPUT -o $PLUTO_INTERFACE -p IPIP \
++ -s $PLUTO_ME $D_MY_PORT \
++ -d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
++ iptables --wait -D IPSECINPUT -o $PLUTO_INTERFACE -p AH \
++ -s $PLUTO_ME $D_MY_PORT \
++ -d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
++ iptables --wait -D IPSECINPUT -o $PLUTO_INTERFACE -p ESP \
++ -s $PLUTO_ME $D_MY_PORT \
++ -d $PLUTO_PEER $S_PEER_PORT -j ACCEPT
;;
#
# IPv6
-@@ -422,10 +406,10 @@ up-host-v6:iptables)
+@@ -422,10 +423,10 @@ up-host-v6:iptables)
# connection to me, with (left/right)firewall=yes, coming up
# This is used only by the default updown script, not by your custom
# ones, so do not mess with it; see CAUTION comment up at top.
@@ -201,7 +210,7 @@ index 34eaf68c7..9ed387a0a 100644
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
-@@ -454,10 +438,10 @@ down-host-v6:iptables)
+@@ -454,10 +455,10 @@ down-host-v6:iptables)
# connection to me, with (left/right)firewall=yes, going down
# This is used only by the default updown script, not by your custom
# ones, so do not mess with it; see CAUTION comment up at top.
@@ -214,7 +223,7 @@ index 34eaf68c7..9ed387a0a 100644
-s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
#
-@@ -487,10 +471,10 @@ up-client-v6:iptables)
+@@ -487,10 +488,10 @@ up-client-v6:iptables)
# ones, so do not mess with it; see CAUTION comment up at top.
if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
then
@@ -227,7 +236,7 @@ index 34eaf68c7..9ed387a0a 100644
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
-d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
fi
-@@ -499,10 +483,10 @@ up-client-v6:iptables)
+@@ -499,10 +500,10 @@ up-client-v6:iptables)
# or sometimes host access via the internal IP is needed
if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
then
@@ -240,7 +249,7 @@ index 34eaf68c7..9ed387a0a 100644
-s $PLUTO_MY_CLIENT $S_MY_PORT \
-d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
fi
-@@ -535,11 +519,11 @@ down-client-v6:iptables)
+@@ -535,11 +536,11 @@ down-client-v6:iptables)
# ones, so do not mess with it; see CAUTION comment up at top.
if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
then
@@ -254,7 +263,7 @@ index 34eaf68c7..9ed387a0a 100644
-s $PLUTO_PEER_CLIENT $S_PEER_PORT \
-d $PLUTO_MY_CLIENT $D_MY_PORT \
$IPSEC_POLICY_IN -j ACCEPT
-@@ -549,11 +533,11 @@ down-client-v6:iptables)
+@@ -549,11 +550,11 @@ down-client-v6:iptables)
# or sometimes host access via the internal IP is needed
if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
then