Revision e636f373
Added by Chris Buechler over 10 years ago
| etc/inc/filter.inc | ||
|---|---|---|
| 2814 | 2814 |
|
| 2815 | 2815 |
$saved_tracker += 100; |
| 2816 | 2816 |
$tracker = $saved_tracker; |
| 2817 |
|
|
| 2818 |
$ipfrules .= <<<EOD |
|
| 2817 |
|
|
| 2818 |
if (!isset($config['system']['no_apipa_block'])) {
|
|
| 2819 |
$ipfrules .= <<<EOD |
|
| 2819 | 2820 |
# block IPv4 link-local. Per RFC 3927, link local "MUST NOT" be forwarded by a routing device, |
| 2820 | 2821 |
# and clients "MUST NOT" send such packets to a router. FreeBSD won't route 169.254./16, but |
| 2821 | 2822 |
# route-to can override that, causing problems such as in redmine #2073 |
| 2822 | 2823 |
block in {$log['block']} quick from 169.254.0.0/16 to any tracker {$increment_tracker($tracker)} label "Block IPv4 link-local"
|
| 2823 | 2824 |
block in {$log['block']} quick from any to 169.254.0.0/16 tracker {$increment_tracker($tracker)} label "Block IPv4 link-local"
|
| 2825 |
|
|
| 2826 |
EOD; |
|
| 2827 |
} |
|
| 2828 |
|
|
| 2829 |
$ipfrules .= <<<EOD |
|
| 2824 | 2830 |
#--------------------------------------------------------------------------- |
| 2825 | 2831 |
# default deny rules |
| 2826 | 2832 |
#--------------------------------------------------------------------------- |
Also available in: Unified diff
Allow disabling the APIPA block via hidden config option. Very rarely necessary or desirable, but Amazon VPC VPNs use that as their tunnel subnet with BGP setups.