--- filter.inc.bak 2018-06-06 11:38:15.442508000 +1000 +++ filter.inc 2018-06-07 10:56:17.873309000 +1000 @@ -218,14 +218,32 @@ } $gwstatus =& $a_gateways[$gateway['monitor']]; if (strstr($gwstatus['status'], "down")) { - $any_gateway_down = true; - break; + if (!empty($gateway['interface'])) + $gwiface = $gateway['interface']; + else + $gwiface = get_real_interface($gateway['friendlyiface']); + + log_error("Removing NAT states for interface {$gwiface}"); + $nat_states = exec_command("/sbin/pfctl -i {$gwiface} -ss"); + $cleared_states = array(); + foreach (explode("\n", $nat_states) as $nat_state) { + if (preg_match_all('/([\d\.]+):[\d]+[\s-><)]+/i', $nat_state, $ipv4_matches, PREG_SET_ORDER) != 3) + continue; + + $natsrc = $ipv4_matches[1][1]; + $dst = $ipv4_matches[2][1]; + + if (empty($natsrc) || empty($dst) || in_array("{$natsrc},{$dst}", $cleared_states)) + continue; + + $cleared_states[] = "{$natsrc},{$dst}"; + pfSense_kill_states($natsrc, $dst); + } + log_error("Removing states for interface {$gwiface}"); + mwexec("/sbin/pfctl -i {$gwiface} -Fs", true); } } } - if ($any_gateway_down == true) { - mwexec("/sbin/pfctl -Fs"); - } } /* reload filter sync */