diff --git a/src/freedombone-utils-firewall b/src/freedombone-utils-firewall index c80ba763..94f161f4 100755 --- a/src/freedombone-utils-firewall +++ b/src/freedombone-utils-firewall @@ -110,15 +110,13 @@ function enable_ipv6 { echo 1 > /proc/sys/net/ipv6/conf/all/forwarding } -function firewall_update_external_ip { +function update_external_ip { ip_update_script=/usr/bin/externalipupdate echo '#!/bin/bash' >> $ip_update_script echo "existing_ip=\$(cat $CONFIGURATION_FILE | grep \"EXTERNAL_IPV4_ADDRESS=\" | head -n 1 | awk -F '=' '{print \$2}')'" >> $ip_update_script echo "curr_ip=\$(nslookup . $EXTERNAL_IP_LOOKUP_URL | grep Address | tail -n 1 | awk -F ' ' '{print \$2}')" >> $ip_update_script echo 'if [[ "$curr_ip" != "$existing_ip" ]]; then' >> $ip_update_script echo " sed -i \"s|EXTERNAL_IPV4_ADDRESS=.*|EXTERNAL_IPV4_ADDRESS=\${curr_ip}|g\" $CONFIGURATION_FILE" >> $ip_update_script - echo " iptables -t nat -D POSTROUTING -s \${curr_ip}/24 -o ${FIREWALL_EIFACE} -j MASQUERADE" >> $ip_update_script - echo " iptables -t nat -A POSTROUTING -s \${curr_ip}/24 -o ${FIREWALL_EIFACE} -j MASQUERADE" >> $ip_update_script echo ' iptables-save > /etc/firewall.conf' >> $ip_update_script echo 'fi' >> $ip_update_script @@ -126,35 +124,28 @@ function firewall_update_external_ip { } function firewall_disable_vpn { - read_config_param EXTERNAL_IPV4_ADDRESS - if [ ! $EXTERNAL_IPV4_ADDRESS ]; then - return - fi - sed -i '/externalipupdate/d' /etc/crontab iptables -D INPUT -i ${FIREWALL_EIFACE} -m state --state NEW -p udp --dport 1194 -j ACCEPT iptables -D INPUT -i tun+ -j ACCEPT iptables -D FORWARD -i tun+ -j ACCEPT iptables -D FORWARD -i tun+ -o ${FIREWALL_EIFACE} -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -D FORWARD -i ${FIREWALL_EIFACE} -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT - iptables -t nat -D POSTROUTING -s ${EXTERNAL_IPV4_ADDRESS}/24 -o ${FIREWALL_EIFACE} -j MASQUERADE + iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o ${FIREWALL_EIFACE} -j MASQUERADE iptables -D OUTPUT -o tun+ -j ACCEPT save_firewall_settings + sed -i '/VPN=/d' $FIREWALL_CONFIG } function firewall_enable_vpn { - curr_external_ipv4_address=$(get_external_ipv4_address) iptables -A INPUT -i ${FIREWALL_EIFACE} -m state --state NEW -p udp --dport 1194 -j ACCEPT iptables -A INPUT -i tun+ -j ACCEPT iptables -A FORWARD -i tun+ -j ACCEPT iptables -A FORWARD -i tun+ -o ${FIREWALL_EIFACE} -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i ${FIREWALL_EIFACE} -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT - iptables -t nat -A POSTROUTING -s ${curr_external_ipv4_address}/24 -o ${FIREWALL_EIFACE} -j MASQUERADE + iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ${FIREWALL_EIFACE} -j MASQUERADE iptables -A OUTPUT -o tun+ -j ACCEPT - write_config_param EXTERNAL_IPV4_ADDRESS "$curr_external_ipv4_address" save_firewall_settings - firewall_update_external_ip echo "VPN=1194" >> $FIREWALL_CONFIG }