apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-10-26 08:42:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

CS-15536: Insert VPN mangle policy to FORWARD and OUTPUT

Browse Source 
In order to get traffic tagged while ACL chain involved in PREROUTING chain.

Also using more generic tag checking in nat table.
This commit is contained in:
Sheng Yang 2012-07-17 16:47:37 -07:00
parent 14fa5279e2
commit a1333649db
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
patches/systemvm/debian/config/opt/cloud/bin/ipsectunnel.sh
View File

@ -40,16 +40,21 @@ enable_iptable() {
sudo iptables -A INPUT -i $outIf -p udp -m udp --dport 500 -j ACCEPT sudo iptables -A INPUT -i $outIf -p udp -m udp --dport 500 -j ACCEPT
for net in $rightnets for net in $rightnets
do do
sudo iptables -A PREROUTING -t mangle -s $leftnet -d $net -j MARK --set-mark $vpnoutmark sudo iptables -A FORWARD -t mangle -s $leftnet -d $net -j MARK --set-mark $vpnoutmark
sudo iptables -A OUTPUT -t mangle -s $leftnet -d $net -j MARK --set-mark $vpnoutmark
done done
# Prevent NAT on "marked" VPN traffic, so need to be the first one on POSTROUTING chain
sudo iptables -t nat -I POSTROUTING -t nat -o $outIf -m mark --mark $vpnoutmark -j ACCEPT
} }
disable_iptable() { disable_iptable() {
sudo iptables -D INPUT -i $outIf -p udp -m udp --dport 500 -j ACCEPT sudo iptables -D INPUT -i $outIf -p udp -m udp --dport 500 -j ACCEPT
for net in $rightnets for net in $rightnets
do do
sudo iptables -D PREROUTING -t mangle -s $leftnet -d $net -j MARK --set-mark $vpnoutmark sudo iptables -D FORWARD -t mangle -s $leftnet -d $net -j MARK --set-mark $vpnoutmark
sudo iptables -D OUTPUT -t mangle -s $leftnet -d $net -j MARK --set-mark $vpnoutmark
done done
sudo iptables -t nat -D POSTROUTING -t nat -o $outIf -m mark --mark $vpnoutmark -j ACCEPT
} }
ipsec_tunnel_del() { ipsec_tunnel_del() {
@ -107,10 +112,6 @@ ipsec_tunnel_add() {
sudo ipsec auto --rereadall sudo ipsec auto --rereadall
sudo ipsec auto --add vpn-$rightpeer sudo ipsec auto --add vpn-$rightpeer
sudo ipsec auto --up vpn-$rightpeer sudo ipsec auto --up vpn-$rightpeer
# Prevent NAT on "marked" VPN traffic
sudo iptables -D POSTROUTING -t nat -o $outIf -j SNAT --to-source $outIp
sudo iptables -D POSTROUTING -t nat -o $outIf -m mark ! --mark $vpnoutmark -j SNAT --to-source $outIp
sudo iptables -A POSTROUTING -t nat -o $outIf -m mark ! --mark $vpnoutmark -j SNAT --to-source $outIp
logger -t cloud "$(basename $0): done ipsec tunnel entry for right peer=$rightpeer right networks=$rightnets" logger -t cloud "$(basename $0): done ipsec tunnel entry for right peer=$rightpeer right networks=$rightnets"