Revision 2afbe080
Added by Charlie almost 16 years ago
etc/inc/filter.inc | ||
---|---|---|
1734 | 1734 |
pass out on \$loopback all label "pass loopback" |
1735 | 1735 |
|
1736 | 1736 |
anchor "firewallout" |
1737 |
|
|
1738 |
EOD; |
|
1739 |
|
|
1740 |
/* find out igmpproxy upstream interface name if igmpproxy installed/configured */ |
|
1741 |
if (is_array($config['installedpackages']['igmpproxy']['config'])){ |
|
1742 |
$igmp_upstr_int_real_name = ""; |
|
1743 |
$igmp_cfg =& $config['installedpackages']['igmpproxy']['config']; |
|
1744 |
foreach($igmp_cfg as $igmp_int){ |
|
1745 |
if ($igmp_int['igmptype'] == 'upstream') |
|
1746 |
$igmp_upstr_int_real_name = $config['interfaces'][$igmp_int['igmpname']]['if']; |
|
1747 |
} |
|
1748 |
if ($igmp_upstr_int_real_name != ""){ |
|
1749 |
$ipfrules .= <<<EOD |
|
1750 |
# let out IGMP with IP-options |
|
1751 |
pass out on $igmp_upstr_int_real_name all allow-opts keep state label "let out with IP-options on IGMP Upstream interface" |
|
1752 |
|
|
1753 |
EOD; |
|
1754 |
|
|
1755 |
} |
|
1756 |
} |
|
1757 |
$ipfrules .= <<<EOD |
|
1737 | 1758 |
# let out anything from the firewall host itself and decrypted IPsec traffic |
1738 | 1759 |
pass out all keep state label "let out anything from firewall host itself" |
1739 | 1760 |
|
Also available in: Unified diff
Add allow-opts at Upstream igmpproxy interface if the package is present