diff options
| -rw-r--r-- | data/templates/ipsec/swanctl.conf.tmpl | 14 | ||||
| -rw-r--r-- | data/templates/ipsec/swanctl/remote_access.tmpl | 9 | ||||
| -rw-r--r-- | interface-definitions/vpn_ipsec.xml.in | 126 |
3 files changed, 146 insertions, 3 deletions
diff --git a/data/templates/ipsec/swanctl.conf.tmpl b/data/templates/ipsec/swanctl.conf.tmpl index 15c035688..03f1e9942 100644 --- a/data/templates/ipsec/swanctl.conf.tmpl +++ b/data/templates/ipsec/swanctl.conf.tmpl @@ -21,6 +21,20 @@ connections { {% endif %} } +pools { +{% if remote_access is defined %} +{% for ra, ra_conf in remote_access.items() if remote_access is defined %} + ra-{{ ra }} { + addrs = {{ ra_conf.pool.prefix }} + dns = {{ ra_conf.pool.dns_server | join(",") }} +{% if ra_conf.pool.exclude is defined %} + split_exclude = {{ ra_conf.pool.exclude | join(",") }} +{% endif %} + } +{% endfor %} +{% endif %} +} + secrets { {% if profile is defined %} {% for name, profile_conf in profile.items() if profile_conf.disable is not defined and profile_conf.bind is defined and profile_conf.bind.tunnel is defined %} diff --git a/data/templates/ipsec/swanctl/remote_access.tmpl b/data/templates/ipsec/swanctl/remote_access.tmpl index 89f6e343e..004aace2e 100644 --- a/data/templates/ipsec/swanctl/remote_access.tmpl +++ b/data/templates/ipsec/swanctl/remote_access.tmpl @@ -4,12 +4,13 @@ {% set esp = esp_group[rw_conf.esp_group] %} ra-{{ name }} { remote_addrs = %any - local_addrs = %any + local_addrs = {{ rw_conf.local_address if rw_conf.local_address is defined else '%any' }} proposals = {{ ike_group[rw_conf.ike_group] | get_esp_ike_cipher | join(',') }} version = {{ ike.key_exchange[4:] if ike is defined and ike.key_exchange is defined else "0" }} send_certreq = no rekey_time = {{ ike.lifetime }}s keyingtries = 0 + pools = ra-{{ name }} local { auth = pubkey {% if rw_conf.authentication is defined and rw_conf.authentication.id is defined and rw_conf.authentication.use_x509_id is not defined %} @@ -21,7 +22,6 @@ } remote { auth = eap-mschapv2 - id = %any eap_id = %any } children { @@ -29,8 +29,11 @@ esp_proposals = {{ esp | get_esp_ike_cipher | join(',') }} rekey_time = {{ esp.lifetime }}s rand_time = 540s - local_ts = 0.0.0.0/0 dpd_action = clear +{% set local_prefix = rw_conf.local_network.prefix if rw_conf.local_network is defined and rw_conf.local_network.prefix is defined else ['0.0.0.0/0', '::/0'] %} +{% set local_port = rw_conf.local_network.port if rw_conf.local_network is defined and rw_conf.local_network.port is defined else '' %} +{% set local_suffix = '[%any/{1}]'.format(local_port) if local_port else '' %} + local_ts = {{ local_prefix | join(local_suffix + ",") }}{{ local_suffix }} } } } diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in index ef3b05e29..a9444ecc5 100644 --- a/interface-definitions/vpn_ipsec.xml.in +++ b/interface-definitions/vpn_ipsec.xml.in @@ -743,6 +743,132 @@ #include <include/generic-disable-node.xml.i> #include <include/ipsec/esp-group.xml.i> #include <include/ipsec/ike-group.xml.i> + <leafNode name="local-address"> + <properties> + <help>IPv4 or IPv6 address of a local interface to use for VPN</help> + <completionHelp> + <list>any</list> + </completionHelp> + <valueHelp> + <format>ipv4</format> + <description>IPv4 address of a local interface for VPN</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>IPv6 address of a local interface for VPN</description> + </valueHelp> + <valueHelp> + <format>any</format> + <description>Allow any IPv4 address present on the system to be used for VPN</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + <validator name="ipv6-address"/> + <regex>^(any)$</regex> + </constraint> + </properties> + </leafNode> + <node name="local-network"> + <properties> + <help>Local traffic selectors</help> + </properties> + <children> + <leafNode name="port"> + <properties> + <help>Any TCP or UDP port</help> + <valueHelp> + <format>port name</format> + <description>Named port (any name in /etc/services, e.g., http)</description> + </valueHelp> + <valueHelp> + <format>u32:1-65535</format> + <description>Numbered port</description> + </valueHelp> + </properties> + </leafNode> + <leafNode name="prefix"> + <properties> + <help>Local IPv4 or IPv6 prefix</help> + <valueHelp> + <format>ipv4</format> + <description>Local IPv4 prefix</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>Local IPv6 prefix</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + <validator name="ipv6-prefix"/> + </constraint> + <multi/> + </properties> + </leafNode> + </children> + </node> + <node name="pool"> + <properties> + <help>IP address pool for remote-access users</help> + </properties> + <children> + <leafNode name="exclude"> + <properties> + <help>Local IPv4 or IPv6 pool prefix exclusions</help> + <valueHelp> + <format>ipv4</format> + <description>Local IPv4 pool prefix exclusion</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>Local IPv6 pool prefix exclusion</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + <validator name="ipv6-prefix"/> + </constraint> + <multi/> + </properties> + </leafNode> + <leafNode name="prefix"> + <properties> + <help>Local IPv4 or IPv6 pool prefix</help> + <valueHelp> + <format>ipv4</format> + <description>Local IPv4 pool prefix</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>Local IPv6 pool prefix</description> + </valueHelp> + <constraint> + <validator name="ipv4-prefix"/> + <validator name="ipv6-prefix"/> + </constraint> + </properties> + </leafNode> + <leafNode name="dns-server"> + <properties> + <help>IPv4 or IPv6 DNS addresses for pool</help> + <completionHelp> + <list>any</list> + </completionHelp> + <valueHelp> + <format>ipv4</format> + <description>IPv4 DNS address for pool</description> + </valueHelp> + <valueHelp> + <format>ipv6</format> + <description>IPv6 DNS address for pool</description> + </valueHelp> + <constraint> + <validator name="ipv4-address"/> + <validator name="ipv6-address"/> + </constraint> + <multi/> + </properties> + </leafNode> + </children> + </node> <leafNode name="timeout"> <properties> <help>Timeout to close connection if no data is transmitted</help> |