Skip to content

O
OpnSense
Commit 66f30c7f authored by Ad Schellevis's avatar Ad Schellevis
Browse files
Options

update ipfw template with current captive portal setup

parent 4d5ad276
Hide whitespace changes
Inline Side-by-side
Showing with 66 additions and 25 deletions
src/opnsense/service/templates/OPNsense/IPFW/ipfw.conf
View file @ 66f30c7f
{# collect interfaces list (with / without captive portal enabled) #}
{% set cp_interface_list = [] %}
{% set no_cp_interface_list = [] %}
{% if helpers.exists('captiveportal') %}
{% for intf_key,interface in interfaces.iteritems()%}
{% set is_cp=[] %}
{% for cp_key,cp_item in captiveportal.iteritems() %}
{% if intf_key == cp_item.interface and interface.ipaddr != 'dhcp' %}
{% do cp_interface_list.append({'zone':cp_key,'zoneid':cp_item.zoneid,'if':interface.if}) %}
{% do is_cp.append(1) %}
{% endif %}
{% endfor %}
{% if not is_cp%}
{% do no_cp_interface_list.append(interface) %}
{% endif %}
{% endfor %}
{% else %}
{% for intf_key,interface in interfaces.iteritems() %}
{% do no_cp_interface_list.append(interface) %}
{% endfor %}
{% endif %}
#====================================================================================== #======================================================================================
# flush ruleset # flush ruleset
#====================================================================================== #======================================================================================
...@@ -30,41 +51,61 @@ add {{loop.index + 1000}} allow icmp from any to { 255.255.255.255 or {{interfa ...@@ -30,41 +51,61 @@ add {{loop.index + 1000}} allow icmp from any to { 255.255.255.255 or {{interfa
{% endif %} {% endif %}
{% endfor %} {% endfor %}
{% if helpers.exists('captiveportal') %} {% for item in cp_interface_list %}
{% for cp_key,cp_item in captiveportal.iteritems() %}
{% for intf_key,interface in interfaces.iteritems() %}
{% if intf_key == cp_item.interface and interface.ipaddr != 'dhcp' %}
#=================================================================================== #===================================================================================
# zone {{cp_key}} ({{cp_item.zoneid}}) configuration # zone {{item.zone}} ({{item.zoneid}}) configuration
#=================================================================================== #===================================================================================
{# authenticated users ( table 1 + 2 ) #} {# authenticated users ( table 1 + 2 ) #}
add {{3000 + cp_item.zoneid|int * 10 + 1 }} skipto {{10001 + cp_item.zoneid|int * 1000 }} ip from table({{6*(cp_item.zoneid|int-1) + 1 }}) to any via {{interface.if}} add {{3000 + item.zoneid|int * 10 + 1 }} skipto {{10001 + item.zoneid|int * 1000 }} ip from table({{6*(item.zoneid|int-1) + 1 }}) to any via {{item.if}}
add {{3000 + cp_item.zoneid|int * 10 + 2 }} skipto {{10001 + cp_item.zoneid|int * 1000 }} ip from table({{6*(cp_item.zoneid|int-1) + 1 }}) to any via {{interface.if}} add {{3000 + item.zoneid|int * 10 + 2 }} skipto {{10001 + item.zoneid|int * 1000 }} ip from table({{6*(item.zoneid|int-1) + 1 }}) to any via {{item.if}}
{# authenticated hosts ( table 3 + 4 ) #} {# authenticated hosts ( table 3 + 4 ) #}
add {{3000 + cp_item.zoneid|int * 10 + 3 }} skipto {{10001 + cp_item.zoneid|int * 1000 }} ip from table({{6*(cp_item.zoneid|int-1) + 3 }}) to any via {{interface.if}} add {{3000 + item.zoneid|int * 10 + 3 }} skipto {{10001 + item.zoneid|int * 1000 }} ip from table({{6*(item.zoneid|int-1) + 3 }}) to any via {{item.if}}
add {{3000 + cp_item.zoneid|int * 10 + 4 }} skipto {{10001 + cp_item.zoneid|int * 1000 }} ip from table({{6*(cp_item.zoneid|int-1) + 3 }}) to any via {{interface.if}} add {{3000 + item.zoneid|int * 10 + 4 }} skipto {{10001 + item.zoneid|int * 1000 }} ip from table({{6*(item.zoneid|int-1) + 3 }}) to any via {{item.if}}
{# authenticated mac addresses ( table 5 + 6 ) #} {# authenticated mac addresses ( table 5 + 6 ) #}
add {{3000 + cp_item.zoneid|int * 10 + 5 }} skipto {{10001 + cp_item.zoneid|int * 1000 }} ip from table({{6*(cp_item.zoneid|int-1) + 5 }}) to any via {{interface.if}} add {{3000 + item.zoneid|int * 10 + 5 }} skipto {{10001 + item.zoneid|int * 1000 }} ip from table({{6*(item.zoneid|int-1) + 5 }}) to any via {{item.if}}
add {{3000 + cp_item.zoneid|int * 10 + 6 }} skipto {{10001 + cp_item.zoneid|int * 1000 }} ip from table({{6*(cp_item.zoneid|int-1) + 5 }}) to any via {{interface.if}} add {{3000 + item.zoneid|int * 10 + 6 }} skipto {{10001 + item.zoneid|int * 1000 }} ip from table({{6*(item.zoneid|int-1) + 5 }}) to any via {{item.if}}
{% endif %}
{% endfor %}
{% endfor %} {% endfor %}
{% endif %}
#======================================================================================
# redirect non-authenticated clients to captive portal @ local port 8000 + zoneid
#======================================================================================
{% for item in cp_interface_list %}
add {{5000 + item.zoneid|int }} fwd 127.0.0.1,{{ item.zoneid|int + 8000 }} tcp from any to any dst-port 80 in via {{item.if}}
add {{5000 + item.zoneid|int }} allow ip from any to any dst-port 80 via {{item.if}}
{% endfor %}
#======================================================================================
# accept traffic from all interfaces not used by captive portal
#======================================================================================
{% for item in no_cp_interface_list %}
add {{6001 + loop.index }} allow all from any to any via {{item.if}} ;
{% endfor %}
# let the responses from the captive portal web server back out
add 6200 pass tcp from any to any out
# block everything else (not mentioned before)
add 6201 skipto 65534 all from any to any
#====================================================================================== #======================================================================================
# setup zone accounting section # setup zone accounting section
#====================================================================================== #======================================================================================
{% if helpers.exists('captiveportal') %} {% for item in cp_interface_list %}
{% for cp_key,cp_item in captiveportal.iteritems() %} # zone {{item.zone}} ({{item.zoneid}})
{% for intf_key,interface in interfaces.iteritems() %} add {{ (item.zoneid|int * 1000) + 10001 }} count ip from any to any via {{item.if}}
{% if intf_key == cp_item.interface and interface.ipaddr != 'dhcp' %} add {{ (item.zoneid|int * 1000) + 10998 }} skipto 30000 all from any to any via {{item.if}}
# zone {{cp_key}} ({{cp_item.zoneid}}) add {{ (item.zoneid|int * 1000) + 10999 }} deny all from any to any not via {{item.if}}
add {{ (cp_item.zoneid|int * 1000) + 10001 }} count ip from any to any via {{interface.if}}
add {{ (cp_item.zoneid|int * 1000) + 10998 }} skipto 30000 all from any to any via {{interface.if}}
add {{ (cp_item.zoneid|int * 1000) + 10999 }} deny all from any to any not via {{interface.if}}
{% endif %}
{% endfor %}
{% endfor %} {% endfor %}
{% endif %}
#======================================================================================
# setup accounting section, first rule is counting all CP traffic
# rule 65500 unlocks the traffic already authorized from a CP zone
#======================================================================================
add 30000 set 0 count ip from any to any
add 65500 pass ip from any to any
# block all unmatched
add 65534 deny all from any to any
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment

Technounit-GROUP 2023