From afff762ede3ec5bdb169aa3add53c0b57335e323 Mon Sep 17 00:00:00 2001
From: Christoph <ckubu@oopen.de>
Date: Sat, 11 Nov 2017 17:09:32 +0100
Subject: [PATCH] Add support for CISCO kompartibles VPN (user by FRITZBox).

---
 conf/default_ports.conf     |  5 +++++
 conf/main_ipv4.conf.sample  |  4 ++++
 conf/main_ipv6.conf.sample  |  4 ++++
 conf/post_decalrations.conf |  8 ++++++++
 ip6t-firewall-gateway       | 29 +++++++++++++++++++++++++++++
 ipt-firewall-gateway        | 29 +++++++++++++++++++++++++++++
 6 files changed, 79 insertions(+)

diff --git a/conf/default_ports.conf b/conf/default_ports.conf
index 0191f18..a6ee932 100644
--- a/conf/default_ports.conf
+++ b/conf/default_ports.conf
@@ -31,6 +31,11 @@ standard_print_raw_port=515
 standard_print_port=9100
 standard_remote_console_port=5900
 
+# - IPsec - Internet Security Association and
+# -  Key Management Protocol
+standard_isakmp_port=500
+standard_ipsec_nat_t=4500
+
 
 # - Comma separated lists
 # -
diff --git a/conf/main_ipv4.conf.sample b/conf/main_ipv4.conf.sample
index 7615f6d..ac70028 100644
--- a/conf/main_ipv4.conf.sample
+++ b/conf/main_ipv4.conf.sample
@@ -1091,6 +1091,10 @@ allow_samba_requests_out=true
 allow_vpn_out=true
 vpn_out_ports="1194 1195 1196"
 
+allow_cisco_vpn_out=true
+cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"
+cisco_vpn_out_protocol="esp"
+
 
 # ===
 # = Services allowed between local networks
diff --git a/conf/main_ipv6.conf.sample b/conf/main_ipv6.conf.sample
index ec0b1cf..0179e2b 100644
--- a/conf/main_ipv6.conf.sample
+++ b/conf/main_ipv6.conf.sample
@@ -1031,6 +1031,10 @@ allow_samba_requests_out=true
 allow_vpn_out=true
 vpn_out_ports="1194 1195 1196"
 
+allow_cisco_vpn_out=true
+cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"
+cisco_vpn_out_protocol="esp"
+
 
 # ===
 # = Services allowed between local networks
diff --git a/conf/post_decalrations.conf b/conf/post_decalrations.conf
index 82b444f..7d0e9bf 100644
--- a/conf/post_decalrations.conf
+++ b/conf/post_decalrations.conf
@@ -394,6 +394,14 @@ for _port in $ssh_ports ; do
    ssh_port_arr+=("$_port")
 done
 
+# ---
+# - Cisco kompartible VPN Ports
+# ---
+declare -a cisco_vpn_out_port_arr
+for _port in $cisco_vpn_out_ports ; do
+   cisco_vpn_out_port_arr+=("$_port")
+done
+
 # ---
 # - VPN Ports
 # ---
diff --git a/ip6t-firewall-gateway b/ip6t-firewall-gateway
index 2233da6..3df216f 100755
--- a/ip6t-firewall-gateway
+++ b/ip6t-firewall-gateway
@@ -1485,6 +1485,35 @@ else
 fi
 
 
+# ---
+# - Cisco kompartibles VPN (FRITZ!Box)
+# ---
+
+echononl "\t\tCisco VPN Service (FRITZ\!Box) only out"
+
+if $allow_cisco_vpn_out && [[ ${#cisco_vpn_out_port_arr[@]} -gt 0 ]]; then
+   for _dev in ${ext_if_arr[@]} ; do
+      for _port in ${cisco_vpn_out_port_arr[@]} ; do
+         $ip6t -A OUTPUT -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
+            $ip6t -A FORWARD -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         fi
+      done
+   done
+
+   for _vpn_if in ${vpn_if_arr[@]} ; do
+      $ip6t -A OUTPUT -o $_vpn_if -p $cisco_vpn_out_protocol -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_forward_between_interfaces ; then
+         $ip6t -A FORWARD -o $_vpn_if -p $cisco_vpn_out_protocol -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
 # ---
 # - VPN Service only out
 # ---
diff --git a/ipt-firewall-gateway b/ipt-firewall-gateway
index f20a6ba..5be1a57 100755
--- a/ipt-firewall-gateway
+++ b/ipt-firewall-gateway
@@ -1961,6 +1961,35 @@ else
 fi
 
 
+# ---
+# - Cisco kompartibles VPN (FRITZ!Box)
+# ---
+
+echononl "\t\tCisco VPN Service (FRITZ\!Box) only out"
+
+if $allow_cisco_vpn_out && [[ ${#cisco_vpn_out_port_arr[@]} -gt 0 ]]; then
+   for _dev in ${ext_if_arr[@]} ; do
+      for _port in ${cisco_vpn_out_port_arr[@]} ; do
+         $ipt -A OUTPUT -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+            $ipt -A FORWARD -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         fi
+      done
+   done
+
+   for _vpn_if in ${vpn_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_vpn_if -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -o $_vpn_if -p $cisco_vpn_out_protocol -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
 # ---
 # - VPN Service only out
 # ---