[IPFire-SCM] [git.ipfire.org] IPFire 2.x development tree branch, master, updated. f1f39aea071c0660f87cbd04b385bb77cb70cf00

13 Sep 2011

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, master has been updated
       via  f1f39aea071c0660f87cbd04b385bb77cb70cf00 (commit)
       via  7589902e644345a8b383d604cf5e16c786352f59 (commit)
       via  38ce4769ab38fdef7fc5892b4fe554de968d8d47 (commit)
       via  0f0db884a9bc1524c69c040cd84b8f23bb2c85dd (commit)
      from  1a140b78980fe0f488e25a3b2dd92256e3751ab0 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit f1f39aea071c0660f87cbd04b385bb77cb70cf00
Author: Arne Fitzenreiter arne_f@ipfire.org
Date:   Tue Sep 13 19:05:04 2011 +0200
ovpnmain.cgi: change connected/disconnected to enabled/disabled at n2n connections.
commit 7589902e644345a8b383d604cf5e16c786352f59
Author: Arne Fitzenreiter arne_f@ipfire.org
Date:   Tue Sep 13 14:25:44 2011 +0200
strongswan: import micha's new strongswan gateway detection.
commit 38ce4769ab38fdef7fc5892b4fe554de968d8d47
Author: Arne Fitzenreiter arne_f@ipfire.org
Date:   Tue Sep 13 14:09:59 2011 +0200
core53: add log.dat to updater.
commit 0f0db884a9bc1524c69c040cd84b8f23bb2c85dd
Author: Alfred Haas alfred.haas@ipfire.org
Date:   Tue Sep 13 14:06:58 2011 +0200
log.dat: add n2n to openvpn log.
-----------------------------------------------------------------------
Summary of changes:
 config/rootfiles/core/53/filelists/files           |    1 +
 html/cgi-bin/logs.cgi/log.dat                      |    2 +-
 html/cgi-bin/ovpnmain.cgi                          |    4 +-
 lfs/strongswan                                     |    2 +-
 ..._ipfire.patch => strongswan-4.5.3_ipfire.patch} |  110 +++++++++++++++-----
 5 files changed, 88 insertions(+), 31 deletions(-)
 rename src/patches/{strongswan-4.4.0_ipfire.patch => strongswan-4.5.3_ipfire.patch} (83%)
Difference in files:

diff --git a/config/rootfiles/core/53/filelists/files b/config/rootfiles/core/53/filelists/files
index 3e71a05..2d47486 100644
--- a/config/rootfiles/core/53/filelists/files
+++ b/config/rootfiles/core/53/filelists/files
@@ -13,6 +13,7 @@ srv/web/ipfire/cgi-bin/ovpnmain.cgi
 srv/web/ipfire/cgi-bin/pakfire.cgi
 srv/web/ipfire/cgi-bin/routing.cgi
 srv/web/ipfire/cgi-bin/vpnmain.cgi
+srv/web/ipfire/cgi-bin/logs.cgi/log.dat
 var/ipfire/langs/
 usr/local/bin/ipsecctrl
 usr/local/bin/openvpnctrl
diff --git a/html/cgi-bin/logs.cgi/log.dat b/html/cgi-bin/logs.cgi/log.dat
index c0da266..e2d0244 100644
--- a/html/cgi-bin/logs.cgi/log.dat
+++ b/html/cgi-bin/logs.cgi/log.dat
@@ -61,7 +61,7 @@ my %sections = (
         'auth' => '(\w+(pam_unix)[.*]: )',
         'kernel' => '(kernel: (?!DROP_))',
         'ipsec' => '(ipsec_[\w_]+: |pluto[.*]: |charon: |vpnwatch: )',
-        'openvpn' => '(openvpnserver)[.*]: ',
+        'openvpn' => '(openvpnserver[.*]: |.*n2n[.*]: )',
         'pakfire' => '(pakfire:) ',
         'wireless' => '(hostapd:|kernel: ath.*:|kernel: wifi[0-9]:) '
     );
diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index b66299b..ea52f85 100644
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -3727,7 +3727,7 @@ END
    my $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
if ($confighash{$key}[0] eq 'off') {
-	    $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourblue}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
+	    $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourblue}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'disabled'}</font></b></td></tr></table>";
    } else {
###
@@ -3750,7 +3750,7 @@ END
 #			   $p->close();
if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
-       $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></td></tr></table>";
+       $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'enabledtitle'}</font></b></td></tr></table>";
        } 
     }
diff --git a/lfs/strongswan b/lfs/strongswan
index 1efd283..cb97bf7 100644
--- a/lfs/strongswan
+++ b/lfs/strongswan
@@ -71,7 +71,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
    @$(PREBUILD)
    @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-4.4.0_ipfire.patch
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-4.5.3_ipfire.patch
cd $(DIR_APP) && ./configure --prefix="/usr" --sysconfdir="/etc" \
    				--enable-cisco-quirks \
diff --git a/src/patches/strongswan-4.4.0_ipfire.patch b/src/patches/strongswan-4.4.0_ipfire.patch
deleted file mode 100644
index 298a1e3..0000000
--- a/src/patches/strongswan-4.4.0_ipfire.patch
+++ /dev/null
@@ -1,286 +0,0 @@
-diff -Naur strongswan-4.4.0.org/src/_updown/_updown.in strongswan-4.4.0/src/_updown/_updown.in
---- strongswan-4.4.0.org/src/_updown/_updown.in	2010-03-15 21:52:51.000000000 +0100
-+++ strongswan-4.4.0/src/_updown/_updown.in	2010-05-15 13:33:40.000000000 +0200
-@@ -374,12 +374,12 @@
- 	# connection to me, with (left/right)firewall=yes, coming up
- 	# This is used only by the default updown script, not by your custom
- 	# ones, so do not mess with it; see CAUTION comment up at top.
--	iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
- 	    -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
- 	    -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
--	iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	iptables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
- 	    -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
--	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
-+	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j MARK --set-mark 50
- 	#
- 	# log IPsec host connection setup
- 	if [ $VPN_LOGGING ]
-@@ -387,10 +387,10 @@
- 	  if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
- 	  then
- 	    logger -t $TAG -p $FAC_PRIO \
--	      "+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
-+	      "host+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
- 	  else
- 	    logger -t $TAG -p $FAC_PRIO \
--	      "+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
-+	      "host+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
- 	  fi
- 	fi
- 	;;
-@@ -398,12 +398,12 @@
- 	# connection to me, with (left/right)firewall=yes, going down
- 	# This is used only by the default updown script, not by your custom
- 	# ones, so do not mess with it; see CAUTION comment up at top.
--	iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
- 	    -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
- 	    -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
--	iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	iptables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
- 	    -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
--	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
-+	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j MARK --set-mark 50
- 	#
- 	# log IPsec host connection teardown
- 	if [ $VPN_LOGGING ]
-@@ -411,10 +411,10 @@
- 	  if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
- 	  then
- 	    logger -t $TAG -p $FAC_PRIO -- \
--	      "- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
-+	      "host- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
- 	  else
- 	    logger -t $TAG -p $FAC_PRIO -- \
--	    "- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
-+	    "host- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
- 	  fi
- 	fi
- 	;;
-@@ -424,10 +424,10 @@
- 	# ones, so do not mess with it; see CAUTION comment up at top.
- 	if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
- 	then
--	  iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	  iptables -I IPSECFORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
- 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
--	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
--	  iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j MARK --set-mark 50
-+	  iptables -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
- 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
- 	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
- 	fi
-@@ -436,12 +436,12 @@
- 	# or sometimes host access via the internal IP is needed
- 	if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
- 	then
--	  iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	  iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
- 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
- 	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
--	  iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	  iptables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
- 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
--	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
-+	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j MARK --set-mark 50
- 	fi
- 	#
- 	# log IPsec client connection setup
-@@ -450,12 +450,38 @@
- 	  if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
- 	  then
- 	    logger -t $TAG -p $FAC_PRIO \
--	      "+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
-+	      "client+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
- 	  else
- 	    logger -t $TAG -p $FAC_PRIO \
--	      "+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
-+	      "client+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
- 	  fi
- 	fi
-+
-+	#
-+	# Open Firewall for IPinIP + AH + ESP Traffic
-+	  iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p IP \
-+	      -s $PLUTO_PEER $S_PEER_PORT \
-+	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
-+	  iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p AH \
-+	      -s $PLUTO_PEER $S_PEER_PORT \
-+	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
-+	  iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p ESP \
-+	      -s $PLUTO_PEER $S_PEER_PORT \
-+	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
-+	if [ $VPN_LOGGING ]
-+	then
-+	    logger -t $TAG -p $FAC_PRIO \
-+	      "tunnel+ $PLUTO_PEER -- $PLUTO_ME"
-+	fi
-+
-+	# Add source nat so also the gateway can access the other nets
-+	src=$(/sbin/ip route|grep $PLUTO_MY_CLIENT|(read net key_dev dev key_proto key_kernel key_scope key_link key_src src; echo $src))
-+	iptables -t nat -A IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src
-+	logger -t $TAG -p $FAC_PRIO \
-+		"snat+ $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src"
-+
-+	# Flush routing cache
-+	ip route flush cache
- 	;;
- down-client:iptables)
- 	# connection to client subnet, with (left/right)firewall=yes, going down
-@@ -463,11 +489,11 @@
- 	# ones, so do not mess with it; see CAUTION comment up at top.
- 	if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
- 	then
--	  iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	  iptables -D IPSECFORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
- 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
- 	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
--	         $IPSEC_POLICY_OUT -j ACCEPT
--	  iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	         $IPSEC_POLICY_OUT -j MARK --set-mark 50
-+	  iptables -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
- 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
- 	      -d $PLUTO_MY_CLIENT $D_MY_PORT \
- 	         $IPSEC_POLICY_IN -j ACCEPT
-@@ -477,14 +503,14 @@
- 	# or sometimes host access via the internal IP is needed
- 	if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
- 	then
--	  iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	  iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
- 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
- 	      -d $PLUTO_MY_CLIENT $D_MY_PORT \
- 	         $IPSEC_POLICY_IN -j ACCEPT
--	  iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	  iptables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
- 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
- 	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
--	         $IPSEC_POLICY_OUT -j ACCEPT
-+	         $IPSEC_POLICY_OUT -j MARK --set-mark 50
- 	fi
- 	#
- 	# log IPsec client connection teardown
-@@ -493,12 +519,38 @@
- 	  if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
- 	  then
- 	    logger -t $TAG -p $FAC_PRIO -- \
--	      "- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
-+	      "client- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
- 	  else
- 	    logger -t $TAG -p $FAC_PRIO -- \
--	      "- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
-+	      "client- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
- 	  fi
- 	fi
-+
-+	#
-+	# Close Firewall for IPinIP + AH + ESP Traffic
-+	  iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p IP \
-+	      -s $PLUTO_PEER $S_PEER_PORT \
-+	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
-+	  iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p AH \
-+	      -s $PLUTO_PEER $S_PEER_PORT \
-+	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
-+	  iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p ESP \
-+	      -s $PLUTO_PEER $S_PEER_PORT \
-+	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
-+	if [ $VPN_LOGGING ]
-+	then
-+	    logger -t $TAG -p $FAC_PRIO \
-+	      "tunnel- $PLUTO_PEER -- $PLUTO_ME"
-+	fi
-+
-+	# remove source nat
-+	src=$(/sbin/ip route|grep $PLUTO_MY_CLIENT|(read net key_dev dev key_proto key_kernel key_scope key_link key_src src; echo $src))
-+	iptables -t nat -D IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src
-+	logger -t $TAG -p $FAC_PRIO \
-+		"snat- $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src"
-+
-+	# Flush routing cache
-+	ip route flush cache
- 	;;
- #
- # IPv6
-@@ -533,10 +585,10 @@
- 	# connection to me, with (left/right)firewall=yes, coming up
- 	# This is used only by the default updown script, not by your custom
- 	# ones, so do not mess with it; see CAUTION comment up at top.
--	ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	ip6tables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
- 	    -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
- 	    -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
--	ip6tables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	ip6tables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
- 	    -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
- 	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
- 	#
-@@ -557,10 +609,10 @@
- 	# connection to me, with (left/right)firewall=yes, going down
- 	# This is used only by the default updown script, not by your custom
- 	# ones, so do not mess with it; see CAUTION comment up at top.
--	ip6tables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	ip6tables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
- 	    -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
- 	    -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
--	ip6tables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	ip6tables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
- 	    -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
- 	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
- 	#
-@@ -583,10 +635,10 @@
- 	# ones, so do not mess with it; see CAUTION comment up at top.
- 	if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
- 	then
--	  ip6tables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	  ip6tables -I IPSECFORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
- 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
- 	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
--	  ip6tables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	  ip6tables -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
- 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
- 	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
- 	fi
-@@ -595,10 +647,10 @@
- 	# or sometimes host access via the internal IP is needed
- 	if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
- 	then
--	  ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	  ip6tables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
- 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
- 	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
--	  ip6tables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	  ip6tables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
- 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
- 	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
- 	fi
-@@ -622,11 +674,11 @@
- 	# ones, so do not mess with it; see CAUTION comment up at top.
- 	if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
- 	then
--	  ip6tables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	  ip6tables -D IPSECFORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
- 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
- 	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
- 	         $IPSEC_POLICY_OUT -j ACCEPT
--	  ip6tables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	  ip6tables -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
- 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
- 	      -d $PLUTO_MY_CLIENT $D_MY_PORT \
- 	         $IPSEC_POLICY_IN -j ACCEPT
-@@ -636,11 +688,11 @@
- 	# or sometimes host access via the internal IP is needed
- 	if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
- 	then
--	  ip6tables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
-+	  ip6tables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
- 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
- 	      -d $PLUTO_MY_CLIENT $D_MY_PORT \
- 	         $IPSEC_POLICY_IN -j ACCEPT
--	  ip6tables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
-+	  ip6tables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
- 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
- 	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
- 	         $IPSEC_POLICY_OUT -j ACCEPT
diff --git a/src/patches/strongswan-4.5.3_ipfire.patch b/src/patches/strongswan-4.5.3_ipfire.patch
new file mode 100644
index 0000000..2ba975b
--- /dev/null
+++ b/src/patches/strongswan-4.5.3_ipfire.patch
@@ -0,0 +1,342 @@
+diff -Naur strongswan-4.5.3.org/src/_updown/_updown.in strongswan-4.5.3/src/_updown/_updown.in
+--- strongswan-4.5.3.org/src/_updown/_updown.in	2010-10-22 16:33:30.000000000 +0200
++++ strongswan-4.5.3/src/_updown/_updown.in	2011-09-13 14:19:31.000000000 +0200
+@@ -183,6 +183,29 @@
+ 	;;
+ esac
+ 
++function ip_encode() {
++	local IFS=.
++
++	local int=0
++	for field in $1; do
++		int=$(( $(( $int << 8 )) | $field ))
++	done
++
++	echo $int
++}
++
++function ip_in_subnet() {
++	local netmask
++	netmask=$(_netmask $2)
++	[ $(( $(ip_encode $1) & $netmask)) = $(( $(ip_encode ${2%/*}) & $netmask )) ]
++}
++
++function _netmask() {
++	local vlsm
++	vlsm=${1#*/}
++	[ $vlsm -eq 0 ] && echo 0 || echo $(( -1 << $(( 32 - $vlsm )) ))
++}
++
+ # utility functions for route manipulation
+ # Meddling with this stuff should not be necessary and requires great care.
+ uproute() {
+@@ -387,12 +410,12 @@
+ 	# connection to me, with (left/right)firewall=yes, coming up
+ 	# This is used only by the default updown script, not by your custom
+ 	# ones, so do not mess with it; see CAUTION comment up at top.
+-	iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
+ 	    -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
+ 	    -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
+-	iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	iptables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
+ 	    -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
+-	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
++	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j MARK --set-mark 50
+ 	#
+ 	# log IPsec host connection setup
+ 	if [ $VPN_LOGGING ]
+@@ -400,10 +423,10 @@
+ 	  if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
+ 	  then
+ 	    logger -t $TAG -p $FAC_PRIO \
+-	      "+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
++	      "host+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
+ 	  else
+ 	    logger -t $TAG -p $FAC_PRIO \
+-	      "+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
++	      "host+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
+ 	  fi
+ 	fi
+ 	;;
+@@ -411,12 +434,12 @@
+ 	# connection to me, with (left/right)firewall=yes, going down
+ 	# This is used only by the default updown script, not by your custom
+ 	# ones, so do not mess with it; see CAUTION comment up at top.
+-	iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
+ 	    -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
+ 	    -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
+-	iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	iptables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
+ 	    -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
+-	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
++	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j MARK --set-mark 50
+ 	#
+ 	# log IPsec host connection teardown
+ 	if [ $VPN_LOGGING ]
+@@ -424,10 +447,10 @@
+ 	  if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
+ 	  then
+ 	    logger -t $TAG -p $FAC_PRIO -- \
+-	      "- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
++	      "host- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
+ 	  else
+ 	    logger -t $TAG -p $FAC_PRIO -- \
+-	    "- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
++	    "host- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
+ 	  fi
+ 	fi
+ 	;;
+@@ -437,10 +460,10 @@
+ 	# ones, so do not mess with it; see CAUTION comment up at top.
+ 	if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
+ 	then
+-	  iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  iptables -I IPSECFORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
+ 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
+-	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
+-	  iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j MARK --set-mark 50
++	  iptables -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
+ 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
+ 	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
+ 	fi
+@@ -449,12 +472,12 @@
+ 	# or sometimes host access via the internal IP is needed
+ 	if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
+ 	then
+-	  iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	  iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
+ 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
+ 	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
+-	  iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  iptables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
+ 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
+-	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
++	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j MARK --set-mark 50
+ 	fi
+ 	#
+ 	# log IPsec client connection setup
+@@ -463,12 +486,51 @@
+ 	  if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
+ 	  then
+ 	    logger -t $TAG -p $FAC_PRIO \
+-	      "+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
++	      "client+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
+ 	  else
+ 	    logger -t $TAG -p $FAC_PRIO \
+-	      "+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
++	      "client+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
+ 	  fi
+ 	fi
++
++	#
++	# Open Firewall for IPinIP + AH + ESP Traffic
++	  iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p IP \
++	      -s $PLUTO_PEER $S_PEER_PORT \
++	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
++	  iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p AH \
++	      -s $PLUTO_PEER $S_PEER_PORT \
++	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
++	  iptables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p ESP \
++	      -s $PLUTO_PEER $S_PEER_PORT \
++	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
++	if [ $VPN_LOGGING ]
++	then
++	    logger -t $TAG -p $FAC_PRIO \
++	      "tunnel+ $PLUTO_PEER -- $PLUTO_ME"
++	fi
++
++	# Add source nat so also the gateway can access the other nets
++	eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
++	for _src in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
++		ip_in_subnet "${_src}" "${PLUTO_MY_CLIENT}"
++		if [ $? -eq 0 ]; then
++			src=${_src}
++			break
++		fi
++	done
++
++	if [ -n "${src}" ]; then
++		iptables -t nat -A IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src
++		logger -t $TAG -p $FAC_PRIO \
++			"snat+ $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src"
++	else
++		logger -t $TAG -p $FAC_PRIO \
++			"Cannot create NAT rule because no IP of the IPFire does match the subnet. $PLUTO_MY_CLIENT"
++	fi
++
++	# Flush routing cache
++	ip route flush cache
+ 	;;
+ down-client:iptables)
+ 	# connection to client subnet, with (left/right)firewall=yes, going down
+@@ -476,11 +538,11 @@
+ 	# ones, so do not mess with it; see CAUTION comment up at top.
+ 	if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/32" ]
+ 	then
+-	  iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  iptables -D IPSECFORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
+ 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
+ 	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
+-	         $IPSEC_POLICY_OUT -j ACCEPT
+-	  iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	         $IPSEC_POLICY_OUT -j MARK --set-mark 50
++	  iptables -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
+ 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
+ 	      -d $PLUTO_MY_CLIENT $D_MY_PORT \
+ 	         $IPSEC_POLICY_IN -j ACCEPT
+@@ -490,14 +552,14 @@
+ 	# or sometimes host access via the internal IP is needed
+ 	if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
+ 	then
+-	  iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	  iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
+ 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
+ 	      -d $PLUTO_MY_CLIENT $D_MY_PORT \
+ 	         $IPSEC_POLICY_IN -j ACCEPT
+-	  iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  iptables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
+ 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
+ 	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
+-	         $IPSEC_POLICY_OUT -j ACCEPT
++	         $IPSEC_POLICY_OUT -j MARK --set-mark 50
+ 	fi
+ 	#
+ 	# log IPsec client connection teardown
+@@ -506,12 +568,51 @@
+ 	  if [ "$PLUTO_PEER_CLIENT" = "$PLUTO_PEER/32" ]
+ 	  then
+ 	    logger -t $TAG -p $FAC_PRIO -- \
+-	      "- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
++	      "client- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
+ 	  else
+ 	    logger -t $TAG -p $FAC_PRIO -- \
+-	      "- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
++	      "client- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
+ 	  fi
+ 	fi
++
++	#
++	# Close Firewall for IPinIP + AH + ESP Traffic
++	  iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p IP \
++	      -s $PLUTO_PEER $S_PEER_PORT \
++	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
++	  iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p AH \
++	      -s $PLUTO_PEER $S_PEER_PORT \
++	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
++	  iptables -D IPSECINPUT -i $PLUTO_INTERFACE -p ESP \
++	      -s $PLUTO_PEER $S_PEER_PORT \
++	      -d $PLUTO_ME $D_MY_PORT -j ACCEPT
++	if [ $VPN_LOGGING ]
++	then
++	    logger -t $TAG -p $FAC_PRIO \
++	      "tunnel- $PLUTO_PEER -- $PLUTO_ME"
++	fi
++
++	# remove source nat
++	eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
++	for _src in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
++		ip_in_subnet "${_src}" "${PLUTO_MY_CLIENT}"
++		if [ $? -eq 0 ]; then
++			src=${_src}
++			break
++		fi
++	done
++
++	if [ -n "${src}" ]; then
++		iptables -t nat -D IPSECNAT -o $PLUTO_INTERFACE -s $PLUTO_ME -d $PLUTO_PEER_CLIENT -j SNAT --to $src
++		logger -t $TAG -p $FAC_PRIO \
++			"snat- $PLUTO_INTERFACE-$PLUTO_ME : $PLUTO_PEER_CLIENT - $src"
++	else
++		logger -t $TAG -p $FAC_PRIO \
++			"Cannot remove NAT rule because no IP of the IPFire does match the subnet."
++	fi
++
++	# Flush routing cache
++	ip route flush cache
+ 	;;
+ #
+ # IPv6
+@@ -546,10 +647,10 @@
+ 	# connection to me, with (left/right)firewall=yes, coming up
+ 	# This is used only by the default updown script, not by your custom
+ 	# ones, so do not mess with it; see CAUTION comment up at top.
+-	ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	ip6tables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
+ 	    -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
+ 	    -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
+-	ip6tables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	ip6tables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
+ 	    -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
+ 	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
+ 	#
+@@ -570,10 +671,10 @@
+ 	# connection to me, with (left/right)firewall=yes, going down
+ 	# This is used only by the default updown script, not by your custom
+ 	# ones, so do not mess with it; see CAUTION comment up at top.
+-	ip6tables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	ip6tables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
+ 	    -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
+ 	    -d $PLUTO_ME $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
+-	ip6tables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	ip6tables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
+ 	    -s $PLUTO_ME $S_MY_PORT $IPSEC_POLICY_OUT \
+ 	    -d $PLUTO_PEER_CLIENT $D_PEER_PORT -j ACCEPT
+ 	#
+@@ -596,10 +697,10 @@
+ 	# ones, so do not mess with it; see CAUTION comment up at top.
+ 	if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
+ 	then
+-	  ip6tables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  ip6tables -I IPSECFORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
+ 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
+ 	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
+-	  ip6tables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	  ip6tables -I IPSECFORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
+ 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
+ 	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
+ 	fi
+@@ -608,10 +709,10 @@
+ 	# or sometimes host access via the internal IP is needed
+ 	if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
+ 	then
+-	  ip6tables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	  ip6tables -I IPSECINPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
+ 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
+ 	      -d $PLUTO_MY_CLIENT $D_MY_PORT $IPSEC_POLICY_IN -j ACCEPT
+-	  ip6tables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  ip6tables -I IPSECOUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
+ 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
+ 	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT $IPSEC_POLICY_OUT -j ACCEPT
+ 	fi
+@@ -635,11 +736,11 @@
+ 	# ones, so do not mess with it; see CAUTION comment up at top.
+ 	if [ "$PLUTO_PEER_CLIENT" != "$PLUTO_MY_SOURCEIP/128" ]
+ 	then
+-	  ip6tables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  ip6tables -D IPSECFORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
+ 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
+ 	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
+ 	         $IPSEC_POLICY_OUT -j ACCEPT
+-	  ip6tables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	  ip6tables -D IPSECFORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
+ 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
+ 	      -d $PLUTO_MY_CLIENT $D_MY_PORT \
+ 	         $IPSEC_POLICY_IN -j ACCEPT
+@@ -649,11 +750,11 @@
+ 	# or sometimes host access via the internal IP is needed
+ 	if [ -n "$PLUTO_MY_SOURCEIP" -o -n "$PLUTO_HOST_ACCESS" ]
+ 	then
+-	  ip6tables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
++	  ip6tables -D IPSECINPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
+ 	      -s $PLUTO_PEER_CLIENT $S_PEER_PORT \
+ 	      -d $PLUTO_MY_CLIENT $D_MY_PORT \
+ 	         $IPSEC_POLICY_IN -j ACCEPT
+-	  ip6tables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
++	  ip6tables -D IPSECOUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
+ 	      -s $PLUTO_MY_CLIENT $S_MY_PORT \
+ 	      -d $PLUTO_PEER_CLIENT $D_PEER_PORT \
+ 	         $IPSEC_POLICY_OUT -j ACCEPT
hooks/post-receive
--
IPFire 2.x development tree

    

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

[IPFire-SCM] [git.ipfire.org] IPFire 2.x development tree branch, master, updated. f1f39aea071c0660f87cbd04b385bb77cb70cf00