Add automatic firewall rules that allow traffic destined for a downstream delegated prefix.

The downstream router is the one to decide what to do with it. This can still be overridden by user rules, just like outbound traffic.

1 files changed, 6 insertions, 0 deletions

diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index ada85ee..26406c3 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -2721,6 +2721,12 @@ EOD;
 			if(is_ipaddrv6($ifcfgipv6)) {
 				$prefix = Net_IPv6::getNetmask($ifcfgipv6, $pdlen);
 				$ipfrules .= "pass in quick on \${$oc['descr']} inet6 from $prefix/$pdlen to any keep state label \"Allow IPv6 on {$oc['descr']} to any\"\n";
+				/* add rules on the WAN for traffic back in, let the downstream router
+				 * figure out what to do with the traffic */
+				$trackcfgipv6 = find_interface_ipv6(get_real_interface($trackifname));
+				if(is_ipaddrv6($trackcfgipv6)) {
+					$ipfrules .= "pass in quick on \${$trackcfg['descr']} inet6 from any to $prefix/$pdlen to any keep state label \"Allow IPv6 in on {$trackcfg['descr']} to $prefix/$pdlen\"\n";
+				}
 			}
 		}
 	}