From mboxrd@z Thu Jan  1 00:00:00 1970
From: Peter =?utf-8?q?M=C3=BCller?= <peter.mueller@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] rules.pl: apply location filter to ppp0 if configured
Date: Tue, 03 Nov 2020 11:48:09 +0100
Message-ID: <06d3845b-348d-ca6b-d1cf-a12157e85bae@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============4236521247591067267=="
List-Id: <development.lists.ipfire.org>

--===============4236521247591067267==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

In order to prevent collateral damage to internal traffic, commit
c69c820025c21713cdb77eae3dd4fa61ca71b5fb introduced applying location
block on red0 as a sanity check.

On systems configured to use PPPoE, however, traffic appears on the ppp0
interface instead. This patch checks if a system is configured to use
this connection method, and applies the location filter to this
interface. red0 is used otherwise.

Fixes: #12519

Cc: Michael Tremer <michael.tremer(a)ipfire.org>
Signed-off-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org>
---
 config/firewall/rules.pl | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index c2641a92d..bc6187052 100644
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -2,7 +2,7 @@
 ############################################################################=
###
 #                                                                           =
  #
 # IPFire.org - A linux based firewall                                       =
  #
-# Copyright (C) 2007-2019  IPFire Team  <info(a)ipfire.org>                 =
    #
+# Copyright (C) 2007-2020  IPFire Team  <info(a)ipfire.org>                 =
    #
 #                                                                           =
  #
 # This program is free software: you can redistribute it and/or modify      =
  #
 # it under the terms of the GNU General Public License as published by      =
  #
@@ -628,8 +628,11 @@ sub locationblock {
 		return;
 	}
=20
-	# Only check the RED interface
-	if ($defaultNetworks{'RED_DEV'} ne "") {
+	# Only check the RED interface, which is ppp0 in case of RED_TYPE being
+	# set to "PPPOE", and red0 in case of RED_TYPE not being empty otherwise.
+	if ($defaultNetworks{'RED_TYPE'} eq "PPPOE") {
+		run("$IPTABLES -A LOCATIONBLOCK ! -i ppp0 -j RETURN");
+	} elsif ($defaultNetworks{'RED_DEV'} ne "") {
 		run("$IPTABLES -A LOCATIONBLOCK ! -i $defaultNetworks{'RED_DEV'} -j RETURN=
");
 	}
=20
--=20
2.26.2

--===============4236521247591067267==--