ipsec: T1210: remote-access pools can not hold both IPv4 and IPv6 prefixes

... this enables a dual-stack IKEv2 VPN deployment.

1 files changed, 11 insertions, 3 deletions

diff --git a/data/templates/ipsec/swanctl/remote_access.tmpl b/data/templates/ipsec/swanctl/remote_access.tmpl
index 95f2108fb..ea79a6d6b 100644
--- a/data/templates/ipsec/swanctl/remote_access.tmpl
+++ b/data/templates/ipsec/swanctl/remote_access.tmpl
@@ -10,10 +10,18 @@
         send_certreq = no
         rekey_time = {{ ike.lifetime }}s
         keyingtries = 0
-{%   if rw_conf.pool.dhcp_enable is defined %}
+{%   if rw_conf.pool is defined and rw_conf.pool.dhcp_enable is defined %}
         pools = dhcp
-{%   else %}
-        pools = ra-{{ name }}
+{%   elif rw_conf.pool is defined and rw_conf.pool.prefix is defined and rw_conf.pool.prefix is not none %}
+{%   set pool = namespace(name='')  %}
+{%     for prefix in rw_conf.pool.prefix %}
+{%       if not loop.first %}
+{%         set pool.name = pool.name ~ ',' %}
+{%       endif %}
+{%       set afi = '-ipv4' if prefix | is_ipv4 else '-ipv6' %}
+{%       set pool.name = pool.name + 'ra-' + name + afi %}
+{%     endfor %}
+        pools = {{ pool.name }}
 {%   endif %}
         local {
 {%   if rw_conf.authentication.id is defined and rw_conf.authentication.use_x509_id is not defined %}