Bug #8518 » 8518.diff
| src/etc/inc/filter.inc | ||
|---|---|---|
| 3614 | 3614 |
if ($vip['mode'] == "proxyarp") {
|
| 3615 | 3615 |
continue; |
| 3616 | 3616 |
} |
| 3617 |
if (!is_ipaddrv4($vip['ip']) || !is_subnetv4("{$vip['ip']}/{$vip['sn']}")) {
|
|
| 3618 |
continue; |
|
| 3619 |
} |
|
| 3617 | 3620 |
if (ip_in_subnet($vip['ip'], "{$ifcfg['sa']}/{$ifcfg['sn']}")) {
|
| 3618 | 3621 |
$ipfrules .= "pass out {$log['pass']} route-to ( {$ifcfg['if']} {$gw} ) from {$vip['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n";
|
| 3619 | 3622 |
} else {
|
| ... | ... | |
| 3630 | 3633 |
$ipfrules .= "pass out {$log['pass']} route-to ( {$stf} {$gwv6} ) inet6 from {$ifcfg['ipv6']} to !{$ifcfg['ipv6']}/{$pdlen} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n";
|
| 3631 | 3634 |
if (is_array($ifcfg['vips6'])) {
|
| 3632 | 3635 |
foreach ($ifcfg['vips6'] as $vip) {
|
| 3636 |
if (!is_ipaddrv6($vip['ip']) || !is_subnetv6("{$vip['ip']}/{$pdlen}")) {
|
|
| 3637 |
continue; |
|
| 3638 |
} |
|
| 3633 | 3639 |
$ipfrules .= "pass out {$log['pass']} route-to ( {$stf} {$gwv6} ) inet6 from {$vip['ip']} to !{$vip['ip']}/{$pdlen} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n";
|
| 3634 | 3640 |
} |
| 3635 | 3641 |
} |