diff options
| author | Chris Buechler <cmb@pfsense.org> | 2015-04-08 21:42:36 -0500 |
|---|---|---|
| committer | Chris Buechler <cmb@pfsense.org> | 2015-04-08 21:43:53 -0500 |
| commit | b48f658083b97490e85afa418eefd139834fd9d2 (patch) | |
| tree | 5d13e7402d3e4a830e4ba213f1c97a83e58e6e63 | |
| parent | 7c0c6355807c3dd864f39086e9fbe2b6a6330805 (diff) | |
| download | pfsense-b48f658083b97490e85afa418eefd139834fd9d2.zip pfsense-b48f658083b97490e85afa418eefd139834fd9d2.tar.gz | |
Allow disabling the APIPA block via hidden config option. Very rarely necessary or desirable, but Amazon VPC VPNs use that as their tunnel subnet with BGP setups.
| -rw-r--r-- | etc/inc/filter.inc | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 099e8aa..9982019 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -3091,13 +3091,19 @@ function filter_rules_generate() { $saved_tracker += 100; $tracker = $saved_tracker; - - $ipfrules .= <<<EOD + + if (!isset($config['system']['no_apipa_block'])) { + $ipfrules .= <<<EOD # block IPv4 link-local. Per RFC 3927, link local "MUST NOT" be forwarded by a routing device, # and clients "MUST NOT" send such packets to a router. FreeBSD won't route 169.254./16, but # route-to can override that, causing problems such as in redmine #2073 block in {$log['block']} quick from 169.254.0.0/16 to any tracker {$increment_tracker($tracker)} label "Block IPv4 link-local" block in {$log['block']} quick from any to 169.254.0.0/16 tracker {$increment_tracker($tracker)} label "Block IPv4 link-local" + +EOD; + } + + $ipfrules .= <<<EOD #--------------------------------------------------------------------------- # default deny rules #--------------------------------------------------------------------------- |
