firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add support for CISCO kompartibles VPN (user by FRITZBox).

Browse Source
This commit is contained in:
Christoph 2017-11-11 17:09:32 +01:00
parent 355086a2a4
commit afff762ede
6 changed files with 79 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
conf/default_ports.conf
View File

@ -31,6 +31,11 @@ standard_print_raw_port=515
standard_print_port=9100
standard_remote_console_port=5900
# - IPsec - Internet Security Association and
# - Key Management Protocol
standard_isakmp_port=500
standard_ipsec_nat_t=4500
# - Comma separated lists
# -

4
conf/main_ipv4.conf.sample
View File

@ -1091,6 +1091,10 @@ allow_samba_requests_out=true
allow_vpn_out=true
vpn_out_ports="1194 1195 1196"
allow_cisco_vpn_out=true
cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"
cisco_vpn_out_protocol="esp"
# ===
# = Services allowed between local networks

4
conf/main_ipv6.conf.sample
View File

@ -1031,6 +1031,10 @@ allow_samba_requests_out=true
allow_vpn_out=true
vpn_out_ports="1194 1195 1196"
allow_cisco_vpn_out=true
cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"
cisco_vpn_out_protocol="esp"
# ===
# = Services allowed between local networks

8
conf/post_decalrations.conf
View File

@ -394,6 +394,14 @@ for _port in $ssh_ports ; do
ssh_port_arr+=("$_port")
done
# ---
# - Cisco kompartible VPN Ports
# ---
declare -a cisco_vpn_out_port_arr
for _port in $cisco_vpn_out_ports ; do
cisco_vpn_out_port_arr+=("$_port")
done
# ---
# - VPN Ports
# ---

29
ip6t-firewall-gateway
View File

@ -1485,6 +1485,35 @@ else
fi
# ---
# - Cisco kompartibles VPN (FRITZ!Box)
# ---
echononl "\t\tCisco VPN Service (FRITZ\!Box) only out"
if $allow_cisco_vpn_out && [[ ${#cisco_vpn_out_port_arr[@]} -gt 0 ]]; then
for _dev in ${ext_if_arr[@]} ; do
for _port in ${cisco_vpn_out_port_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
fi
done
done
for _vpn_if in ${vpn_if_arr[@]} ; do
$ip6t -A OUTPUT -o $_vpn_if -p $cisco_vpn_out_protocol -m conntrack --ctstate NEW -j ACCEPT
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -o $_vpn_if -p $cisco_vpn_out_protocol -m conntrack --ctstate NEW -j ACCEPT
fi
done
echo_done
else
echo_skipped
fi
# ---
# - VPN Service only out
# ---

29
ipt-firewall-gateway
View File

@ -1961,6 +1961,35 @@ else
fi
# ---
# - Cisco kompartibles VPN (FRITZ!Box)
# ---
echononl "\t\tCisco VPN Service (FRITZ\!Box) only out"
if $allow_cisco_vpn_out && [[ ${#cisco_vpn_out_port_arr[@]} -gt 0 ]]; then
for _dev in ${ext_if_arr[@]} ; do
for _port in ${cisco_vpn_out_port_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
$ipt -A FORWARD -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
fi
done
done
for _vpn_if in ${vpn_if_arr[@]} ; do
$ipt -A OUTPUT -o $_vpn_if -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding ; then
$ipt -A FORWARD -o $_vpn_if -p $cisco_vpn_out_protocol -m conntrack --ctstate NEW -j ACCEPT
fi
done
echo_done
else
echo_skipped
fi
# ---
# - VPN Service only out
# ---