diff options
| author | Ermal <eri@pfsense.org> | 2014-03-17 21:24:58 +0000 |
|---|---|---|
| committer | Ermal <eri@pfsense.org> | 2014-03-17 21:24:58 +0000 |
| commit | d5d22d6e36120b3250d337dccd3194d1a61c4451 (patch) | |
| tree | fd0ec0b8aec0f724ec9faea9c50e617e73267588 /etc | |
| parent | 7f7626ba444140848da559431688a5b38d3eeffd (diff) | |
| download | pfsense-d5d22d6e36120b3250d337dccd3194d1a61c4451.zip pfsense-d5d22d6e36120b3250d337dccd3194d1a61c4451.tar.gz | |
Disable default allow incoming rules for 6to4 and 6rd interfaces. This rule unintentionally allows all services on the interface to be reachble and maybe more!
Diffstat (limited to 'etc')
| -rw-r--r-- | etc/inc/filter.inc | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 82de74a..bcbf6a4 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2868,7 +2868,8 @@ pass in on \${$oc['descr']} proto 41 from {$config['interfaces'][$on]['gateway-6 pass out on \${$oc['descr']} proto 41 from any to {$config['interfaces'][$on]['gateway-6rd']} label "{$fix_rule_label("Allow 6in4 traffic out for 6rd on {$oc['descr']}")}" EOD; - if (is_ipaddrv6($oc['ipv6'])) { + /* XXX: Really need to allow 6rd traffic coming in for v6 this is against default behaviour! */ + if (0 && is_ipaddrv6($oc['ipv6'])) { $ipfrules .= <<<EOD pass in on \${$oc['descr']} inet6 from any to {$oc['ipv6']}/{$oc['snv6']} label "{$fix_rule_label("Allow 6rd traffic in for 6rd on {$oc['descr']}")}" pass out on \${$oc['descr']} inet6 from {$oc['ipv6']}/{$oc['snv6']} to any label "{$fix_rule_label("Allow 6rd traffic out for 6rd on {$oc['descr']}")}" @@ -2885,7 +2886,8 @@ pass out on \${$oc['descr']} proto 41 from {$oc['ip']} to any label "{$fix_rule_ EOD; } - if (is_ipaddrv6($oc['ipv6'])) { + /* XXX: Really need to allow 6to4 traffic coming in for v6 this is against default behaviour! */ + if (0 && is_ipaddrv6($oc['ipv6'])) { $ipfrules .= <<<EOD pass in on \${$oc['descr']} inet6 from any to {$oc['ipv6']}/{$oc['snv6']} label "{$fix_rule_label("Allow 6in4 traffic in for 6to4 on {$oc['descr']}")}" pass out on \${$oc['descr']} inet6 from {$oc['ipv6']}/{$oc['snv6']} to any label "{$fix_rule_label("Allow 6in4 traffic out for 6to4 on {$oc['descr']}")}" |
