diff options
Diffstat (limited to 'data/templates/ipsec')
| -rw-r--r-- | data/templates/ipsec/charon/dhcp.conf.tmpl | 11 | ||||
| -rw-r--r-- | data/templates/ipsec/swanctl.conf.tmpl | 46 | ||||
| -rw-r--r-- | data/templates/ipsec/swanctl/remote_access.tmpl | 17 |
3 files changed, 25 insertions, 49 deletions
diff --git a/data/templates/ipsec/charon/dhcp.conf.tmpl b/data/templates/ipsec/charon/dhcp.conf.tmpl index 2879550a8..96dfd7633 100644 --- a/data/templates/ipsec/charon/dhcp.conf.tmpl +++ b/data/templates/ipsec/charon/dhcp.conf.tmpl @@ -1,12 +1,11 @@ dhcp { load = yes - -{% if options is defined and options.remote_access is defined and options.remote_access.dhcp_pool is defined %} -{% if options.remote_access.dhcp_pool.interface is defined %} - interface = {{ options.remote_access.dhcp_pool.interface }} +{% if options is defined and options.remote_access is defined and options.remote_access.dhcp is defined %} +{% if options.remote_access.dhcp.interface is defined %} + interface = {{ options.remote_access.dhcp.interface }} {% endif %} -{% if options.remote_access.dhcp_pool.server is defined %} - server = {{ options.remote_access.dhcp_pool.server }} +{% if options.remote_access.dhcp.server is defined %} + server = {{ options.remote_access.dhcp.server }} {% endif %} {% endif %} diff --git a/data/templates/ipsec/swanctl.conf.tmpl b/data/templates/ipsec/swanctl.conf.tmpl index b85fe7d41..161f19f95 100644 --- a/data/templates/ipsec/swanctl.conf.tmpl +++ b/data/templates/ipsec/swanctl.conf.tmpl @@ -15,8 +15,8 @@ connections { {{ peer_tmpl.conn(peer, peer_conf, ike_group, esp_group) }} {% endfor %} {% endif %} -{% if remote_access is defined and remote_access is not none %} -{% for rw, rw_conf in remote_access.items() if rw_conf.disable is not defined %} +{% if remote_access is defined and remote_access.connection is defined and remote_access.connection is not none %} +{% for rw, rw_conf in remote_access.connection.items() if rw_conf.disable is not defined %} {{ remote_access_tmpl.conn(rw, rw_conf, ike_group, esp_group) }} {% endfor %} {% endif %} @@ -26,33 +26,19 @@ connections { } pools { -{% if remote_access is defined %} -{% for ra, ra_conf in remote_access.items() if ra_conf.pool.dhcp_enable is not defined %} -{% if ra_conf.pool is defined and ra_conf.pool.prefix is defined %} -{% for prefix in ra_conf.pool.prefix %} -{% if prefix | is_ipv4 %} - ra-{{ ra }}-ipv4 { - addrs = {{ prefix }} -{% if ra_conf.pool.name_server_v4 is defined and ra_conf.pool.name_server_v4 is not none %} - dns = {{ ra_conf.pool.name_server_v4 | join(',') }} -{% endif %} -{% if ra_conf.pool.exclude_v4 is defined and ra_conf.pool.exclude_v4 is not none %} - split_exclude = {{ ra_conf.pool.exclude_v4 | join(',') }} -{% endif %} - } -{% elif prefix | is_ipv6 %} - ra-{{ ra }}-ipv6 { - addrs = {{ prefix }} -{% if ra_conf.pool.name_server_v6 is defined and ra_conf.pool.name_server_v6 is not none %} - dns = {{ ra_conf.pool.name_server_v6 | join(',') }} -{% endif %} -{% if ra_conf.pool.exclude_v6 is defined and ra_conf.pool.exclude_v6 is not none %} - split_exclude = {{ ra_conf.pool.exclude_v6 | join(',') }} -{% endif %} - } -{% endif %} -{% endfor %} +{% if remote_access is defined and remote_access.pool is defined and remote_access.pool is not none %} +{% for pool, pool_config in remote_access.pool.items() %} + {{ pool }} { +{% if pool_config.prefix is defined and pool_config.prefix is not none %} + addrs = {{ pool_config.prefix }} {% endif %} +{% if pool_config.name_server is defined and pool_config.name_server is not none %} + dns = {{ pool_config.name_server | join(',') }} +{% endif %} +{% if pool_config.exclude is defined and pool_config.exclude is not none %} + split_exclude = {{ pool_config.exclude | join(',') }} +{% endif %} + } {% endfor %} {% endif %} } @@ -103,8 +89,8 @@ secrets { {% endif %} {% endfor %} {% endif %} -{% if remote_access is defined %} -{% for ra, ra_conf in remote_access.items() if remote_access is defined %} +{% if remote_access is defined and remote_access.connection is defined and remote_access.connection is not none %} +{% for ra, ra_conf in remote_access.connection.items() if ra_conf.disable is not defined %} {% if ra_conf.authentication.server_mode == 'pre-shared-secret' %} ike_{{ ra }} { {% if ra_conf.authentication.id is defined %} diff --git a/data/templates/ipsec/swanctl/remote_access.tmpl b/data/templates/ipsec/swanctl/remote_access.tmpl index ea79a6d6b..66ac94b13 100644 --- a/data/templates/ipsec/swanctl/remote_access.tmpl +++ b/data/templates/ipsec/swanctl/remote_access.tmpl @@ -10,18 +10,9 @@ send_certreq = no rekey_time = {{ ike.lifetime }}s keyingtries = 0 -{% if rw_conf.pool is defined and rw_conf.pool.dhcp_enable is defined %} - pools = dhcp -{% elif rw_conf.pool is defined and rw_conf.pool.prefix is defined and rw_conf.pool.prefix is not none %} -{% set pool = namespace(name='') %} -{% for prefix in rw_conf.pool.prefix %} -{% if not loop.first %} -{% set pool.name = pool.name ~ ',' %} -{% endif %} -{% set afi = '-ipv4' if prefix | is_ipv4 else '-ipv6' %} -{% set pool.name = pool.name + 'ra-' + name + afi %} -{% endfor %} - pools = {{ pool.name }} + unique = never +{% if rw_conf.pool is defined and rw_conf.pool is not none %} + pools = {{ rw_conf.pool | join(',') }} {% endif %} local { {% if rw_conf.authentication.id is defined and rw_conf.authentication.use_x509_id is not defined %} @@ -42,7 +33,7 @@ } children { ikev2-vpn { - esp_proposals = {{ esp | get_esp_ike_cipher | join(',') }} + esp_proposals = {{ esp | get_esp_ike_cipher | join(',') }} rekey_time = {{ esp.lifetime }}s rand_time = 540s dpd_action = clear |