When creating SNAT rules, the outgoing interface is not set. As a side effect, traffic that should be send unnatted to a vpn tunnel can be natted which is a BUG. With this patch the SNAT rules are getting a outgoing interface according to the configuration. When selecting the RED Target network, all SNAT rules will be configured with "-o red0". Otherwise if "all" is selected, there is no interface in the rule, which matches all networks.
Signed-off-by: Alexander Marx alexander.marx@ipfire.org --- config/firewall/rules.pl | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl index daa9565..8b0c6dd 100644 --- a/config/firewall/rules.pl +++ b/config/firewall/rules.pl @@ -467,6 +467,10 @@ sub buildrules { } elsif ($NAT_MODE eq "SNAT") { my @nat_options = @options;
+ if ($destination_intf) { + push(@nat_options, ("-o", $destination_intf)); + } + push(@nat_options, @source_options); push(@nat_options, @destination_options);