diff options
| author | Chris Buechler <cmb@pfsense.org> | 2014-12-30 20:11:19 -0600 |
|---|---|---|
| committer | Chris Buechler <cmb@pfsense.org> | 2014-12-30 20:11:19 -0600 |
| commit | a7f2eea80f2fac9426d4efa463a1e7a886898037 (patch) | |
| tree | 0a3b63603339a102fe07641bc81a9f5b367ef773 | |
| parent | 69f7d82f421fcb5eca2352e56a42c72652db1778 (diff) | |
| download | pfsense-a7f2eea80f2fac9426d4efa463a1e7a886898037.zip pfsense-a7f2eea80f2fac9426d4efa463a1e7a886898037.tar.gz | |
Only set route-to and reply-to on ESP and ISAKMP rules if the remote endpoint is not within the parent interface's subnet. Ticket #4157
| -rw-r--r-- | etc/inc/filter.inc | 30 |
1 files changed, 18 insertions, 12 deletions
diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 1f94ce5..0707d36 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -3694,21 +3694,27 @@ function filter_generate_ipsec_rules($log = array()) { } unset($gateway); - /* add endpoint routes to correct gateway on interface */ + /* add endpoint routes to correct gateway on interface if the + remote endpoint is not on this interface's subnet */ if((is_ipaddrv4($rgip)) && (interface_has_gateway($parentinterface))) { - $gateway = get_interface_gateway($parentinterface); - $interface = $FilterIflist[$parentinterface]['if']; - - $route_to = " route-to ( $interface $gateway ) "; - $reply_to = " reply-to ( $interface $gateway ) "; - + $parentifsubnet = get_interface_ip($parentinterface) . "/" . get_interface_subnet($parentinterface); + if (!ip_in_subnet($rgip, $parentifsubnet)) { + $gateway = get_interface_gateway($parentinterface); + $interface = $FilterIflist[$parentinterface]['if']; + + $route_to = " route-to ( $interface $gateway ) "; + $reply_to = " reply-to ( $interface $gateway ) "; + } } if((is_ipaddrv6($rgip)) && (interface_has_gatewayv6($parentinterface))) { - $gateway = get_interface_gateway_v6($parentinterface); - $interface = $FilterIflist[$parentinterface]['if']; - - $route_to = " route-to ( $interface $gateway ) "; - $reply_to = " reply-to ( $interface $gateway ) "; + $parentifsubnet = get_interface_ipv6($parentinterface) . "/" . get_interface_subnetv6($parentinterface); + if (!ip_in_subnet($rgip, $parentifsubnet)) { + $gateway = get_interface_gateway_v6($parentinterface); + $interface = $FilterIflist[$parentinterface]['if']; + + $route_to = " route-to ( $interface $gateway ) "; + $reply_to = " reply-to ( $interface $gateway ) "; + } } /* Just in case */ |
