Threat Shield IP blocks do not work when WAN uses PPPoE

[cotosso]

Description

When the WAN interface is configured with PPPoE, IP-based blocking rules generated by Threat Shield are not effective.

Threat Shield appears to populate the IP blocklists correctly, but traffic from blocked IPs is not actually blocked when the active WAN connection is PPPoE.

Steps to reproduce

1. Configure the WAN interface using PPPoE.
2. Enable Threat Shield IP.
3. Enable one or more IP blocklists.
4. Verify that Threat Shield downloads and applies the blocklists.
5. Generate or receive traffic from an IP included in the active blocklist.

Expected behavior

Traffic from IP addresses included in Threat Shield IP blocklists should be blocked, regardless of whether the WAN uses DHCP, static IP, or PPPoE.

Actual behavior

When the WAN uses PPPoE, traffic from blocked IP addresses is not blocked.

Components

NethSecurity 8.7.2.

[cotosso]

The issue seems to be related to how banIP identifies WAN interfaces.

In the banIP configuration, WAN interfaces are matched by device, when the WAN uses PPPoE, the correct device to use is not the underlying physical device, for example ethX, but the PPPoE device created by the connection, typically named pppoe-INTERFACE_NAME.

Therefore, for a PPPoE WAN, banIP must be configured with the actual PPPoE device, such as pppoe-mywan and not with the physical interface the PPPoE connection runs on, otherwise, the IP blocking rules are applied to the wrong device.

e.g.
current ip a snippet:

27: pppoe-mywan: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492 qdisc fq_codel state UNKNOWN group default qlen 3
    link/ppp 
    inet 100.64.0.2 peer 10.0.0.1/32 scope global pppoe-mywan
       valid_lft forever preferred_lft forever
    inet6 fe80::823:1252:c0de:d5b4 peer fe80::e471:59e:f330:ce79/128 scope link nodad 
       valid_lft forever preferred_lft forever

current banip configuration snippet

banip.global.ban_dev='eth3' 'eth2' 'eth0'

[Tbaile]

QA: Check issue is not reproducibile.

[gsanchietti]

Verified: after a change on banip or network sections, the ban_dev option si correctly populated with pppoe device