diff options
| author | Daniil Baturin <daniil@vyos.io> | 2022-06-08 09:36:10 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-06-08 09:36:10 +0300 |
| commit | 5ee5d3718371d7af48f917f34b52cf2846f6c5e8 (patch) | |
| tree | 836cd716ca8eb0b29a3eb81ed59e2f0e50c38eac | |
| parent | 00b394d70263c7d8b857580fe39fbf6153c23bf7 (diff) | |
| parent | 656e2f1755df003da6f2ee96466d61361158a49a (diff) | |
| download | vyos-opennhrp-5ee5d3718371d7af48f917f34b52cf2846f6c5e8.tar.gz vyos-opennhrp-5ee5d3718371d7af48f917f34b52cf2846f6c5e8.zip | |
T4350: DMVPN spokes do not work behind NAT
| -rwxr-xr-x | etc/opennhrp-script | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/etc/opennhrp-script b/etc/opennhrp-script index 92c0043..463e911 100755 --- a/etc/opennhrp-script +++ b/etc/opennhrp-script @@ -28,9 +28,12 @@ peer-up) logger -t ${_script_name} -p local7.notice "Create link from $NHRP_SRCADDR ($NHRP_SRCNBMA) to $NHRP_DESTADDR ($NHRP_DESTNBMA)" if [[ ( ${_type} == "spoke" ) && ( -e ${_strongswan_pid} ) ]]; then if grep "${NHRP_SRCADDR}" "${_nhrp_ipsec}"; then - swanctl -t -S $NHRP_SRCNBMA -R $NHRP_DESTNBMA > /dev/null 2>&1 - logger -t ${_script_name} -p local7.notice "IPSec: connect to $NHRP_SRCADDR ($NHRP_SRCNBMA)" - swanctl -i -c dmvpn -S $NHRP_SRCNBMA -R $NHRP_DESTNBMA || exit 1 + if swanctl -l -r | grep -q "^list-sa event {dmvpn-DMVPN-.* state=ESTABLISHED local-host=$NHRP_SRCNBMA.*remote-host=$NHRP_DESTNBMA"; then + logger -t ${_script_name} -p local7.notice "IPSec: connection to $NHRP_DESTADDR ($NHRP_DESTNBMA) already exists" + else + logger -t ${_script_name} -p local7.notice "IPSec: connect to $NHRP_DESTADDR ($NHRP_DESTNBMA)" + swanctl -i -c dmvpn -S $NHRP_SRCNBMA -R $NHRP_DESTNBMA || exit 1 + fi fi fi ;; |