Only create a rdr for local interfaces which is destined for the actual address we have a portforward for.

This prevents people from ending up in our netcat code for reflection when trying to access other websites.
Should fix Issue #99

1 files changed, 12 insertions, 2 deletions

diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index 9504a00..a098915 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -623,13 +623,23 @@ function filter_generate_reflection($rule, $extport, &$starting_localhost_port)
 			/* do not process interfaces with gateways*/
 			if (interface_has_gateway($ifent))
 				continue;
-			if($extport[1])
+
+			if($extport[1]) {
 				$range_end = ($extport[1]);
-			else
+			} else {
 				$range_end = ($extport[0]);
+			}
 			$range_end++;
+			if (alias_expand($rule['external-address'])) {
+				$extaddr = alias_expand($extaddr);
+			} else if ($rule['external-address'] <> "") {
+				$extaddr = $rule['external-address'];
+			} else {
+				$extaddr = $FilterIflist[$rule['interface']]['ip'];
+			}
 			if($rule['local-port'])
 				$lrange_start = $rule['local-port'];
+
 			if($range_end - $extport[0] > 500) {
 				$range_end = $extport[0]+1;
 				log_error("Not installing nat reflection rules for a port range > 500");