Hello,

I just tested this patch on our main firewall in Hanover and the problem is resolved.

It is not the most beautiful piece of code, but it does the job.

-Michael

Tested-by: Michael Tremer michael.tremer@ipfire.org

On 20 Feb 2020, at 16:24, Stefan Schantl stefan.schantl@ipfire.org wrote:

This commit adds flags which will are applied if SNAT should be used on the red address or any configured alias.

They prevent doing the SNAT when tranismitting packet through a VPN over the red interface.

Fixes #12162.

Signed-off-by: Stefan Schantl stefan.schantl@ipfire.org

config/firewall/rules.pl | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl index 86db47367..6129af861 100644 --- a/config/firewall/rules.pl +++ b/config/firewall/rules.pl @@ -479,16 +479,31 @@ sub buildrules {

				# Source NAT
				} elsif ($NAT_MODE eq "SNAT") {

• 					my @snat_options = ( "-m", "policy", "--dir", "out", "--pol", "none" );
  				my @nat_options = @options;
  
  

• 					# Get addresses for the configured firewall interfaces.
  

• 					my @local_addresses = &fwlib::get_internal_firewall_ip_addresses(1);
  

• 					# Check if the nat_address is one of the local addresses.
  

• 					foreach my $local_address (@local_addresses) {
  

• 						if ($nat_address eq $local_address) {
  

• 							# Clear SNAT options.
  

• 							@snat_options = ();
  

• 							# Finish loop.
  

• 							last;
  

• 						}
  

• 					}
  

• 				push(@nat_options, @destination_intf_options);
  				push(@nat_options, @source_options);
  				push(@nat_options, @destination_options);
  
  				if ($LOG) {
  

• 						run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options @log_limit_options -j LOG --log-prefix 'SNAT '");
  

• 						run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options @snat_options @log_limit_options -j LOG --log-prefix 'SNAT '");
  				}
  

• 					run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options -j SNAT --to-source $nat_address");
  

• 					run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options @snat_options -j SNAT --to-source $nat_address");
  			}
  		}
  
  

-- 2.25.0