pfSense

The patches added in Bug #2887 no longer works as expected because the output of pfctl -ss no longer matches the format expected.

The previous output was like:

pppoe0 tcp lan_subnet_ip:port -> pppoe_IP:port -> target_ip:port
lan_if tcp lan_subnet_ip:port <- target_ip:port

Where the new output (from at least pfsense 2.3) looks like:

pppoe0 tcp pppoe_IP:port (lan_subnet_ip:port) -> target_ip:port       ESTABLISHED:ESTABLISHED
lan_if tcp target_ip:port <- lan_subnet_ip:port       ESTABLISHED:ESTABLISHED

I believe this patch fixes the code:

@@ -63,11 +63,11 @@

         $cleared_states = array();
         foreach (explode("\n", $nat_states) as $nat_state) {
-            if (preg_match_all('/([\d\.]+):[\d]+[\s->]+/i', $nat_state, $matches, PREG_SET_ORDER) != 3) {
+            if (preg_match_all('/([\d\.]+):[\d]+[\s->)]+/i', $nat_state, $matches, PREG_SET_ORDER) != 3) {
                 continue;
             }

-            $src = $matches[0][1];
+            $src = $matches[1][1];
             $dst = $matches[2][1];

             if (empty($src) || empty($dst) || in_array("{$src},{$dst}", $cleared_states)) {