Dustin C. Hatch
f8641cb912
This commit adjusts the firewall and networking configuration on dc0 to host the Pyrocufflink remote access IPsec VPN locally instead of forwarding it to the internal VPN server.
25 lines
846 B
Django/Jinja
25 lines
846 B
Django/Jinja
{#- vim: set sw=4 ts=4 sts=4 et : #}
|
|
table inet filter {
|
|
set vpn_subnets {
|
|
type ipv4_addr
|
|
flags interval
|
|
elements = {
|
|
172.31.0.64/28,
|
|
{% for prefix in firemon_networks %}
|
|
{{ prefix }},
|
|
{% endfor %}
|
|
}
|
|
}
|
|
|
|
chain forward {
|
|
ct state established,related accept
|
|
iifname {{ dch_networks.guest.router_iface }} oif != {{ internet_iface }} drop
|
|
iif != {{ internet_iface }} oifname {{ dch_networks.guest.router_iface }} drop
|
|
iif != {{ internet_iface }} oif != {{ internet_iface }} counter accept
|
|
iif {{ internet_iface }} ip saddr @vpn_subnets counter accept
|
|
iif != {{ internet_iface }} ip daddr @vpn_subnets counter accept
|
|
tcp dport smtp counter reject with icmpx type host-unreachable
|
|
oif {{ internet_iface }} accept
|
|
}
|
|
}
|