Ticket #4235 put reply-to/route-to rules even for mobile-ipsec.

1 files changed, 4 insertions, 5 deletions

diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index f5a911d..1cb6f66 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -4098,19 +4098,18 @@ function filter_generate_ipsec_rules($log = array()) {
 			unset($gateway);
 			/* add endpoint routes to correct gateway on interface if the
 			remote endpoint is not on this interface's subnet  */
-			if ((is_ipaddrv4($rgip)) && (interface_has_gateway($parentinterface))) {
+			if ((isset($ph1ent['mobile']) || is_ipaddrv4($rgip)) && (interface_has_gateway($parentinterface))) {
 				$parentifsubnet = get_interface_ip($parentinterface) . "/" . get_interface_subnet($parentinterface);
-				if (!ip_in_subnet($rgip, $parentifsubnet)) {
+				if (isset($ph1ent['mobile']) || !ip_in_subnet($rgip, $parentifsubnet)) {
 					$gateway = get_interface_gateway($parentinterface);
 					$interface = $FilterIflist[$parentinterface]['if'];
 
 					$route_to = " route-to ( $interface $gateway ) ";
 					$reply_to = " reply-to ( $interface $gateway ) ";
 				}
-			}
-			if ((is_ipaddrv6($rgip)) && (interface_has_gatewayv6($parentinterface))) {
+			} else if ((isset($ph1ent['mobile']) || is_ipaddrv6($rgip)) && (interface_has_gatewayv6($parentinterface))) {
 				$parentifsubnet = get_interface_ipv6($parentinterface) . "/" . get_interface_subnetv6($parentinterface);
-				if (!ip_in_subnet($rgip, $parentifsubnet)) {
+				if (isset($ph1ent['mobile']) || !ip_in_subnet($rgip, $parentifsubnet)) {
 					$gateway = get_interface_gateway_v6($parentinterface);
 					$interface = $FilterIflist[$parentinterface]['if'];