We should support dhcp-interface for the ipsec remote-access VPN to have parity with site-to-site. This is a niche usecase mostly applicable to homelabs (and maybe the rare SMB site), but is trivial to implement.
Description
Description
Details
Details
- Version
- -
- Is it a breaking change?
- Perfectly compatible
Revisions and Commits
Revisions and Commits
rVYOSONEX vyos-1x | |||
rVYOSONEXa8b85291f47c Merge pull request #3302 from lucasec/t5872-fix |
Related Objects
Related Objects
- Mentioned In
- rVYOSONEX7441c14810e5: Merge pull request #3303 from vyos/mergify/bp/sagitta/pr-3302
rVYOSONEX8ac67c2fc030: T5872: fix ipsec dhclient hook uses "exit" instead of "return"
rVYOSONEX840ab82e8821: T5872: fix ipsec dhclient hook uses "exit" instead of "return"
rVYOSONEX42c9243e05a9: Merge pull request #3204 from vyos/mergify/bp/sagitta/pr-2965
rVYOSONEX71fe258f6a4d: T5872: re-write exit hook to always regenerate config
rVYOSONEX40b0986d66c3: T5872: further fixes to ipsec dhcp exit hook
rVYOSONEX781807e732da: T5872: fix ipsec dhclient exit hook
rVYOSONEX5a722cf84914: T5872: ipsec remote access VPN: support dhcp-interface.
rVYOSONEXf7834324d3d9: T5872: ipsec remote access VPN: support dhcp-interface.
rVYOSONEXcd8ef21f280f: T5872: fix ipsec dhclient exit hook
rVYOSONEX92012a0b3db8: T5872: further fixes to ipsec dhcp exit hook
rVYOSONEX679b78356cbd: T5872: re-write exit hook to always regenerate config
rVYOSONEXba05d82eadce: Merge pull request #2965 from lucasec/t5872
Event Timeline
Comment Actions
Hi.
commit 40b0986d66c3a0891dedbedc273b5485e5a8ca3a Author: Lucas Christian <lucas@lucasec.com> Date: Sat Feb 10 11:26:47 2024 -0800 T5872: further fixes to ipsec dhcp exit hook (cherry picked from commit 92012a0b3db8e93b10db4137414073f0371ed8cc)
- This commit brings the regression with DHCP default routes. In this commit all "return" calls were replaced with "exit" calls (and added a few of new "exit" calls).
- In case of exit call dhclient stops execution rest of the scripts at all
- However, isc-dhcp-client package contains /etc/dhcp/dhclient-exit-hooks.d/rfc3442-classless-routes file where DHCP default gateway is added
- Due to the alphabetic order this script goes after 99-ipsec-dhclient-hook and never executed
- To proove that dhclient never executes any script after the exit, you can create a simple file like: /etc/dhcp/dhclient-exit-hooks.d/00-test with only one string: "exit"