diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2013-11-04 07:27:10 +0100 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2015-06-07 02:50:43 +0200 |
| commit | 0dd6a96ce1bf2cef9140d01a5c49eb92e2f8ec6f (patch) | |
| tree | c4e2f42aa56f98d7a0a74045a4fc2848ee18ff8b /roles/common/files/etc/network | |
| parent | b0c2476c07846001fe9758db2be3c20b7fd0db8e (diff) | |
Be more specific regarding the protocol in use for IPSec policies.
We use ESP only, so other protocols shouldn't be ACCEPTed.
Diffstat (limited to 'roles/common/files/etc/network')
| -rwxr-xr-x | roles/common/files/etc/network/if-up.d/ipsec | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/roles/common/files/etc/network/if-up.d/ipsec b/roles/common/files/etc/network/if-up.d/ipsec index 98bf42c..a43af6c 100755 --- a/roles/common/files/etc/network/if-up.d/ipsec +++ b/roles/common/files/etc/network/if-up.d/ipsec @@ -40,7 +40,10 @@ case "$MODE" in # If a packet retained its mark that far, it means it has # been SNAT'ed from $ipsec, and didn't have a xfrm - # association. Hence we nullroute it to avoid leaking data. + # association. Hence we nullroute it to avoid to leak data + # intented to be tunneled through IPSec. /!\ The priority + # must be >220 (strongSwan IPSec's policy) since xfrm lookup + # must take precedence. /bin/ip rule add fwmark "$secmark" table 666 priority 666 || true /bin/ip route add prohibit default table 666 || true ;; |