This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, next has been updated via a3452c90307aa6fd2b8543c17c15638c2ffda15e (commit) via 637eee2607c015947778523be13cce1c1ed938c6 (commit) from f529ad213f52c5dc6d4eb0a8d0988e9f23fde5e5 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit a3452c90307aa6fd2b8543c17c15638c2ffda15e Author: Michael Tremer michael.tremer@ipfire.org Date: Tue Apr 24 10:47:16 2018 +0100

ipsec: Open ports in outgoing direction

When the firewall policy is blocked, no outgoing IPsec connections can be established. That is slightly counter-intuitive since we open ports in the incoming direction automatically.

Fixes: #11704

Reported-by: Oliver Fuhrer oliver.fuhrer@bluewin.ch Signed-off-by: Michael Tremer michael.tremer@ipfire.org

commit 637eee2607c015947778523be13cce1c1ed938c6 Author: Ersan Yildirim ersan73@gmail.com Date: Tue Apr 24 10:46:52 2018 +0100

Fix mistakes in Turkish translation

Signed-off-by: Michael Tremer michael.tremer@ipfire.org

-----------------------------------------------------------------------

Summary of changes: langs/tr/cgi-bin/tr.pl | 2 +- src/misc-progs/ipsecctrl.c | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-)

Difference in files: diff --git a/langs/tr/cgi-bin/tr.pl b/langs/tr/cgi-bin/tr.pl index 6eb3a7e03..53f0afc7a 100644 --- a/langs/tr/cgi-bin/tr.pl +++ b/langs/tr/cgi-bin/tr.pl @@ -1762,7 +1762,7 @@ 'off' => 'kapalı', 'ok' => 'TAMAM', 'older' => 'Eski', -'on' => 'üstünde', +'on' => 'açık', 'one hour' => 'Bir Saat', 'one month' => 'Bir Ay', 'one week' => 'Bir Hafta', diff --git a/src/misc-progs/ipsecctrl.c b/src/misc-progs/ipsecctrl.c index 204753640..9afc409ca 100644 --- a/src/misc-progs/ipsecctrl.c +++ b/src/misc-progs/ipsecctrl.c @@ -63,6 +63,10 @@ void open_physical (char *interface, int nat_traversal_port) { safe_system(str); sprintf(str, "/sbin/iptables --wait -A IPSECINPUT -p udp -i %s --dport 500 -j ACCEPT", interface); safe_system(str); + sprintf(str, "/sbin/iptables --wait -D IPSECOUTPUT -p udp -o %s --dport 500 -j ACCEPT >/dev/null 2>&1", interface); + safe_system(str); + sprintf(str, "/sbin/iptables --wait -A IPSECOUTPUT -p udp -o %s --dport 500 -j ACCEPT", interface); + safe_system(str);

if (! nat_traversal_port) return; @@ -71,6 +75,10 @@ void open_physical (char *interface, int nat_traversal_port) { safe_system(str); sprintf(str, "/sbin/iptables --wait -A IPSECINPUT -p udp -i %s --dport %i -j ACCEPT", interface, nat_traversal_port); safe_system(str); + sprintf(str, "/sbin/iptables --wait -D IPSECOUTPUT -p udp -o %s --dport %i -j ACCEPT >/dev/null 2>&1", interface, nat_traversal_port); + safe_system(str); + sprintf(str, "/sbin/iptables --wait -A IPSECOUTPUT -p udp -o %s --dport %i -j ACCEPT", interface, nat_traversal_port); + safe_system(str); }

void ipsec_norules() {

hooks/post-receive -- IPFire 2.x development tree