From 7c0e431a878d63fdb0440dbd2c1fad1e7d379f8c Mon Sep 17 00:00:00 2001
From: Benjamin Schweizer <cxcv@cxcv.de>
Date: Fri, 16 Mar 2018 17:30:08 +0100
Subject: [PATCH 1/2] avoid firwall rules for proxyarp addresses

---
 src/etc/inc/filter.inc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/etc/inc/filter.inc b/src/etc/inc/filter.inc
index 2f40164077..5e37bd35f2 100644
--- a/src/etc/inc/filter.inc
+++ b/src/etc/inc/filter.inc
@@ -1169,6 +1169,7 @@ function filter_generate_optcfg_array() {
 						$oic['vips6'][$vipidx]['sn'] = $vip['subnet_bits'];
 					}
 				}
+                if (isset($vip['mode'])) $oic['vips'][$vipidx]['mode']=$vip['mode'];
 			}
 		}
 		unset($vips);
@@ -3601,6 +3602,7 @@ EOD;
 			$ipfrules .= "pass out {$log['pass']} route-to ( {$ifcfg['if']} {$gw} ) from {$ifcfg['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n";
 			if (is_array($ifcfg['vips'])) {
 				foreach ($ifcfg['vips'] as $vip) {
+                    if ($vip['mode'] == "proxyarp") { continue; } 
 					if (ip_in_subnet($vip['ip'], "{$ifcfg['sa']}/{$ifcfg['sn']}")) {
 						$ipfrules .= "pass out {$log['pass']} route-to ( {$ifcfg['if']} {$gw} ) from {$vip['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n";
 					} else {

From a7e859b80d55abfbdcae1918065aaf59baba4900 Mon Sep 17 00:00:00 2001
From: Benjamin Schweizer <cxcv@cxcv.de>
Date: Sat, 17 Mar 2018 20:22:32 +0100
Subject: [PATCH 2/2] fixed code style

---
 src/etc/inc/filter.inc | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/etc/inc/filter.inc b/src/etc/inc/filter.inc
index 5e37bd35f2..6b02770033 100644
--- a/src/etc/inc/filter.inc
+++ b/src/etc/inc/filter.inc
@@ -1169,7 +1169,9 @@ function filter_generate_optcfg_array() {
 						$oic['vips6'][$vipidx]['sn'] = $vip['subnet_bits'];
 					}
 				}
-                if (isset($vip['mode'])) $oic['vips'][$vipidx]['mode']=$vip['mode'];
+				if (isset($vip['mode'])) {
+					$oic['vips'][$vipidx]['mode']=$vip['mode'];
+				}
 			}
 		}
 		unset($vips);
@@ -3602,7 +3604,9 @@ EOD;
 			$ipfrules .= "pass out {$log['pass']} route-to ( {$ifcfg['if']} {$gw} ) from {$ifcfg['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n";
 			if (is_array($ifcfg['vips'])) {
 				foreach ($ifcfg['vips'] as $vip) {
-                    if ($vip['mode'] == "proxyarp") { continue; } 
+					if ($vip['mode'] == "proxyarp") {
+						continue; 
+					} 
 					if (ip_in_subnet($vip['ip'], "{$ifcfg['sa']}/{$ifcfg['sn']}")) {
 						$ipfrules .= "pass out {$log['pass']} route-to ( {$ifcfg['if']} {$gw} ) from {$vip['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n";
 					} else {