From fdc7a438272e1d59d8f9279af2ec10c9cf44f646 Mon Sep 17 00:00:00 2001
From: mh <mh@immerda.ch>
Date: Tue, 26 Apr 2011 03:08:37 +0200
Subject: allow esp traffic from and to me

---
 manifests/rules/ipsec.pp | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

(limited to 'manifests')

diff --git a/manifests/rules/ipsec.pp b/manifests/rules/ipsec.pp
index c609d0a..3e9db55 100644
--- a/manifests/rules/ipsec.pp
+++ b/manifests/rules/ipsec.pp
@@ -1,18 +1,30 @@
 class shorewall::rules::ipsec {
-    shorewall::rule { 'net-me-ipsec-udp':
+    shorewall::rule {
+      'net-me-ipsec-udp':
         source          => 'net',
         destination     => '$FW',
         proto           => 'udp',
         destinationport => '500',
         order           => 240,
         action          => 'ACCEPT';
-    }
-    shorewall::rule { 'me-net-ipsec-udp':
+      'me-net-ipsec-udp':
         source          => '$FW',
         destination     => 'net',
         proto           => 'udp',
         destinationport => '500',
         order           => 240,
         action          => 'ACCEPT';
+      'net-me-ipsec':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'esp',
+        order           => 240,
+        action          => 'ACCEPT';
+      'me-net-ipsec':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'esp',
+        order           => 240,
+        action          => 'ACCEPT';
     }
 }
-- 
cgit v1.2.3