diff options
| author | Chris Buechler <cmb@pfsense.org> | 2014-12-30 20:11:19 -0600 |
|---|---|---|
| committer | Chris Buechler <cmb@pfsense.org> | 2014-12-30 20:12:19 -0600 |
| commit | c8c4520ae2cc54642e0cc131f5f3f558257f7f80 (patch) | |
| tree | 9bff6d069426d43f9bfd03230c3d5f7cd967e4ef /etc/inc | |
| parent | 430f8380ba168a79d23baa0b1eed71dfe14931ba (diff) | |
| download | pfsense-c8c4520ae2cc54642e0cc131f5f3f558257f7f80.zip pfsense-c8c4520ae2cc54642e0cc131f5f3f558257f7f80.tar.gz | |
Only set route-to and reply-to on ESP and ISAKMP rules if the remote endpoint is not within the parent interface's subnet. Ticket #4157
Diffstat (limited to 'etc/inc')
| -rw-r--r-- | etc/inc/filter.inc | 30 |
1 files changed, 18 insertions, 12 deletions
diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 1f94ce5..0707d36 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -3694,21 +3694,27 @@ function filter_generate_ipsec_rules($log = array()) { } unset($gateway); - /* add endpoint routes to correct gateway on interface */ + /* add endpoint routes to correct gateway on interface if the + remote endpoint is not on this interface's subnet */ if((is_ipaddrv4($rgip)) && (interface_has_gateway($parentinterface))) { - $gateway = get_interface_gateway($parentinterface); - $interface = $FilterIflist[$parentinterface]['if']; - - $route_to = " route-to ( $interface $gateway ) "; - $reply_to = " reply-to ( $interface $gateway ) "; - + $parentifsubnet = get_interface_ip($parentinterface) . "/" . get_interface_subnet($parentinterface); + if (!ip_in_subnet($rgip, $parentifsubnet)) { + $gateway = get_interface_gateway($parentinterface); + $interface = $FilterIflist[$parentinterface]['if']; + + $route_to = " route-to ( $interface $gateway ) "; + $reply_to = " reply-to ( $interface $gateway ) "; + } } if((is_ipaddrv6($rgip)) && (interface_has_gatewayv6($parentinterface))) { - $gateway = get_interface_gateway_v6($parentinterface); - $interface = $FilterIflist[$parentinterface]['if']; - - $route_to = " route-to ( $interface $gateway ) "; - $reply_to = " reply-to ( $interface $gateway ) "; + $parentifsubnet = get_interface_ipv6($parentinterface) . "/" . get_interface_subnetv6($parentinterface); + if (!ip_in_subnet($rgip, $parentifsubnet)) { + $gateway = get_interface_gateway_v6($parentinterface); + $interface = $FilterIflist[$parentinterface]['if']; + + $route_to = " route-to ( $interface $gateway ) "; + $reply_to = " reply-to ( $interface $gateway ) "; + } } /* Just in case */ |
