Project

General

Profile

« Previous | Next » 

Revision 4bc0961e

Added by Chris Buechler over 16 years ago

Block all IPv6 traffic by default, since IPv6 isn't supported, there isn't any way to add such rules in the GUI, and nearly all users won't want IPv6 to traverse their firewall at this point. Add "Allow IPv6" checkbox to disable this behavior.

View differences:

etc/inc/filter.inc
2189 2189 
block quick from <snort2c> to any label "Block snort2c hosts"
2190 2190 
block quick from any to <snort2c> label "Block snort2c hosts"
2191 2191 

  		




  
  2192
  
    
EOD;


  		




  
  2193
  
    

  		




  
  2194
  
    
        if(!isset($config['system']['ipv6allow'])) {


  		




  
  2195
  
    
                $ipfrules .= "# Block all IPv6\n";


  		




  
  2196
  
    
                $ipfrules .= "block in quick inet6 all\n";


  		




  
  2197
  
    
                $ipfrules .= "block out quick inet6 all\n";


  		




  
  2198
  
    
        }


  		




  
  2199
  
    

  		




  
  2200
  
    
        $ipfrules .= <<<EOD


  		




  2192
  2201
  
    
# loopback


  		




  2193
  2202
  
    
anchor "loopback"


  		




  2194
  2203
  
    
pass in quick on \$loopback all label "pass loopback"


  		












  

    
      usr/local/www/system_advanced.php
    
  





  38
  38
  
    
$pconfig['scrubnodf'] = $config['system']['scrubnodf'];


  		




  39
  39
  
    
$pconfig['ipv6nat_enable'] = isset($config['diag']['ipv6nat']['enable']);


  		




  40
  40
  
    
$pconfig['ipv6nat_ipaddr'] = $config['diag']['ipv6nat']['ipaddr'];


  		




  
  41
  
    
$pconfig['ipv6allow'] = isset($config['system']['ipv6allow']);


  		




  41
  42
  
    
$pconfig['cert'] = base64_decode($config['system']['webgui']['certificate']);


  		




  42
  43
  
    
$pconfig['key'] = base64_decode($config['system']['webgui']['private-key']);


  		




  43
  44
  
    
$pconfig['disableconsolemenu'] = isset($config['system']['disableconsolemenu']);


  		




  ......




  175
  176
  
    
			unset($config['diag']['ipv6nat']['enable']);


  		




  176
  177
  
    
			unset($config['diag']['ipv6nat']['ipaddr']);


  		




  177
  178
  
    
		}


  		




  
  179
  
    
		if($_POST['ipv6allow'] == "yes") {


  		




  
  180
  
    
			$config['system']['ipv6allow'] = true;


  		




  
  181
  
    
		} else {


  		




  
  182
  
    
			unset($config['system']['ipv6allow']);


  		




  
  183
  
    
		}                


  		




  178
  184
  
    
		$oldcert = $config['system']['webgui']['certificate'];


  		




  179
  185
  
    
		$oldkey = $config['system']['webgui']['private-key'];


  		




  180
  186
  
    
		$config['system']['webgui']['certificate'] = base64_encode($_POST['cert']);


  		




  ......




  367
  373
  
    
			<td colspan="2" class="list" height="12">&nbsp;</td>


  		




  368
  374
  
    
		</tr>


  		




  369
  375
  
    
		<tr>


  		




  370
  
  
    
			<td colspan="2" valign="top" class="listtopic">IPv6 tunneling</td>


  		




  
  376
  
    
			<td colspan="2" valign="top" class="listtopic">IPv6</td>


  		




  
  377
  
    
		</tr>


  		




  
  378
  
    
       		<tr>


  		




  
  379
  
    
			<td width="22%" valign="top" class="vncell">Allow IPv6</td>


  		




  
  380
  
    
			<td width="78%" class="vtable">


  		




  
  381
  
    
				<input name="ipv6allow" type="checkbox" id="ipv6allow" value="yes" <?php if ($pconfig['ipv6allow']) echo "checked"; ?> onclick="enable_change(false)" />


  		




  
  382
  
    
				<strong>Allow IPv6 traffic</strong>


  		




  
  383
  
    
				<br /> <br />


  		




  
  384
  
    
				All IPv6 traffic will be blocked unless this box is checked.


  		




  
  385
  
    
			</td>


  		




  371
  386
  
    
		</tr>


  		




  372
  387
  
    
		<tr>


  		




  373
  
  
    
			<td width="22%" valign="top" class="vncell">&nbsp;</td>


  		




  
  388
  
    
			<td width="22%" valign="top" class="vncell">IPv6 tunneling</td>


  		




  374
  389
  
    
			<td width="78%" class="vtable">


  		




  375
  390
  
    
				<input name="ipv6nat_enable" type="checkbox" id="ipv6nat_enable" value="yes" <?php if ($pconfig['ipv6nat_enable']) echo "checked"; ?> onclick="enable_change(false)" />


  		




  376
  391
  
    
				<strong>NAT encapsulated IPv6 packets (IP protocol 41/RFC2893) to:</strong>


  		




  ......




  379
  394
  
    
				&nbsp;(IP address)


  		




  380
  395
  
    
			</td>


  		




  381
  396
  
    
		</tr>


  		




  
  397
  
    
        	<tr>


  		




  
  398
  
    
			<td width="22%" valign="top">&nbsp;</td>


  		




  
  399
  
    
			<td width="78%">


  		




  
  400
  
    
				<input name="Submit" type="submit" class="formbtn" value="Save" onclick="enable_change(true)" />


  		




  
  401
  
    
			</td>


  		




  
  402
  
    
		</tr>


  		




  382
  403
  
    
		<tr>


  		




  383
  404
  
    
			<td colspan="2" class="list" height="12">&nbsp;</td>


  		




  384
  405
  
    
		</tr>


  		












Also available in:  Unified diff