Fixes #4504 Allow the bypass policy for LAN to be enabled and prevent traffic sent to lan ip to go to the ipsec tunnel

1 files changed, 19 insertions, 0 deletions

diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index 6f63839..ce8181c 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -641,6 +641,25 @@ EOD;
 		$ipsecconf .= "config setup\n\tuniqueids = {$uniqueids}\n";
 		$ipsecconf .= "\tcharondebug=\"" . vpn_ipsec_configure_loglevels(true) . "\"\n";
 
+		if (isset($config['ipsec']['shuntlaninterfaces'])) {
+			if ($config['interfaces']['lan']) {
+				$lanip = get_interface_ip("lan");
+				if (!empty($lanip) && is_ipaddrv4($lanip)) {
+					$lansn = get_interface_subnet("lan");
+					$lansa = gen_subnet($lanip, $lansn);
+					$ipsecconf .= <<<EOD
+conn bypasslan
+	leftsubnet={$lanip}/32
+	rightsubnet={$lansa}/{$lansn}
+	authby=never
+	type=pass
+	auto=route
+
+EOD;
+				}
+			}
+		}
+
 		foreach ($a_phase1 as $ph1ent) {
 			if (isset($ph1ent['disabled'])) {
 				continue;