mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add a checkbox that disabled automatically generates negate rules for directly connected networks and VPNs

Browse Source 
Ticket #2057 in redmine
This commit is contained in:
smos 2011-12-20 20:55:54 +01:00 committed by Chris Buechler
parent 184a6cebbd
commit 4d6f1fddf6
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
etc/inc/filter.inc
View File

@ -2045,7 +2045,7 @@ function filter_generate_user_rule($rule) {
$line = "";
/* exception(s) to a user rules can go here. */
/* rules with a gateway or pool should create another rule for routing to vpns */
if(($aline['route'] <> "") && (trim($aline['type']) == "pass") && strstr($dst, "any")) {
if((($aline['route'] <> "") && (trim($aline['type']) == "pass") && strstr($dst, "any")) && (!isset($config['system']['disablenegate']))) {
/* negate VPN/PPTP/PPPoE/Static Route networks for load balancer/gateway rules */
$negate_networks = " to <negate_networks> ";
$line .= $aline['type'] . $aline['direction'] . $aline['log'] . $aline['quick'] .

16
usr/local/www/system_advanced_firewall.php
View File

@ -57,6 +57,7 @@ $pconfig['optimization'] = $config['filter']['optimization'];
$pconfig['maximumstates'] = $config['system']['maximumstates'];
$pconfig['maximumtableentries'] = $config['system']['maximumtableentries'];
$pconfig['disablereplyto'] = isset($config['system']['disablereplyto']);
$pconfig['disablenegate'] = isset($config['system']['disablenegate']);
$pconfig['disablenatreflection'] = $config['system']['disablenatreflection'];
if (!isset($config['system']['enablebinatreflection']))
$pconfig['disablebinatreflection'] = "yes";
@ -135,6 +136,11 @@ if ($_POST) {
else
unset($config['system']['disablereplyto']);
if($_POST['disablenegate'] == "yes")
$config['system']['disablenegate'] = $_POST['disablenegate'];
else
unset($config['system']['disablenegate']);
if($_POST['enablenatreflectionhelper'] == "yes")
$config['system']['enablenatreflectionhelper'] = "yes";
else
@ -356,6 +362,16 @@ function update_description(itemnum) {
<br />
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell">Disable Negate rules</td>
<td width="78%" class="vtable">
<input name="disablenegate" type="checkbox" id="disablenegate" value="yes" <?php if ($pconfig['disablenegate']) echo "checked"; ?> />
<strong><?=gettext("Disable Negate rule on policy routing rules");?></strong>
<br />
<?=gettext("With Multi-WAN you generally want to ensure traffic reaches directly connected networks and VPN networks when using policy routing. You can disable this for special purposes but it requires manually creating rules for these networks");?>
<br />
</td>
</tr>
<tr>
<td colspan="2" class="list" height="12">&nbsp;</td>
</tr>