From 9b97719c5c7839215fa4ff4392995af28055f803 Mon Sep 17 00:00:00 2001 From: Remi Bergsma Date: Fri, 14 Aug 2015 09:05:59 +0200 Subject: [PATCH] tighten security of site-to-site VPN It was like this in 4.4 and 4.5 --- systemvm/patches/debian/config/opt/cloud/bin/configure.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/systemvm/patches/debian/config/opt/cloud/bin/configure.py b/systemvm/patches/debian/config/opt/cloud/bin/configure.py index 154f0c95516..9f7ffb7b433 100755 --- a/systemvm/patches/debian/config/opt/cloud/bin/configure.py +++ b/systemvm/patches/debian/config/opt/cloud/bin/configure.py @@ -425,9 +425,9 @@ class CsSite2SiteVpn(CsDataBag): CsHelper.execute("ipsec auto --rereadall") def configure_iptables(self, dev, obj): - self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 500 -j ACCEPT" % dev]) - self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 4500 -j ACCEPT" % dev]) - self.fw.append(["", "front", "-A INPUT -i %s -p esp -j ACCEPT" % dev]) + self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 500 -s %s -d %s -j ACCEPT" % (dev, obj['peer_gateway_ip'], obj['local_public_ip'])]) + self.fw.append(["", "front", "-A INPUT -i %s -p udp -m udp --dport 4500 -s %s -d %s -j ACCEPT" % (dev, obj['peer_gateway_ip'], obj['local_public_ip'])]) + self.fw.append(["", "front", "-A INPUT -i %s -p esp -s %s -d %s -j ACCEPT" % (dev, obj['peer_gateway_ip'], obj['local_public_ip'])]) self.fw.append(["nat", "front", "-A POSTROUTING -t nat -o %s -m mark --mark 0x525 -j ACCEPT" % dev]) for net in obj['peer_guest_cidr_list'].lstrip().rstrip().split(','): self.fw.append(["mangle", "front",