mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Disable default allow incoming rules for 6to4 and 6rd interfaces. This rule unintentionally allows all services on the interface to be reachble and maybe more!

Browse Source
This commit is contained in:
Ermal 2014-03-17 21:24:58 +00:00
parent 01df403551
commit 22889e9ee7
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
etc/inc/filter.inc
View File

@ -2781,7 +2781,8 @@ pass in on \${$oc['descr']} proto 41 from {$config['interfaces'][$on]['gateway-6
pass out on \${$oc['descr']} proto 41 from any to {$config['interfaces'][$on]['gateway-6rd']} label "{$fix_rule_label("Allow 6in4 traffic out for 6rd on {$oc['descr']}")}"
EOD;
if (is_ipaddrv6($oc['ipv6'])) {
/* XXX: Really need to allow 6rd traffic coming in for v6 this is against default behaviour! */
if (0 && is_ipaddrv6($oc['ipv6'])) {
$ipfrules .= <<<EOD
pass in on \${$oc['descr']} inet6 from any to {$oc['ipv6']}/{$oc['snv6']} label "{$fix_rule_label("Allow 6rd traffic in for 6rd on {$oc['descr']}")}"
pass out on \${$oc['descr']} inet6 from {$oc['ipv6']}/{$oc['snv6']} to any label "{$fix_rule_label("Allow 6rd traffic out for 6rd on {$oc['descr']}")}"
@ -2798,7 +2799,8 @@ pass out on \${$oc['descr']} proto 41 from {$oc['ip']} to any label "{$fix_rule_
EOD;
}
if (is_ipaddrv6($oc['ipv6'])) {
/* XXX: Really need to allow 6to4 traffic coming in for v6 this is against default behaviour! */
if (0 && is_ipaddrv6($oc['ipv6'])) {
$ipfrules .= <<<EOD
pass in on \${$oc['descr']} inet6 from any to {$oc['ipv6']}/{$oc['snv6']} label "{$fix_rule_label("Allow 6in4 traffic in for 6to4 on {$oc['descr']}")}"
pass out on \${$oc['descr']} inet6 from {$oc['ipv6']}/{$oc['snv6']} to any label "{$fix_rule_label("Allow 6in4 traffic out for 6to4 on {$oc['descr']}")}"