From 5a663a5d56e019ab09750c1040aec832fdd4e480 Mon Sep 17 00:00:00 2001 From: Chris Buechler Date: Fri, 28 Nov 2014 17:30:16 -0600 Subject: [PATCH] Skip v6 WANs in Unbound access-control. Ticket #4023 --- etc/inc/unbound.inc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/etc/inc/unbound.inc b/etc/inc/unbound.inc index 6e19dd2565..a2ecde2ad0 100644 --- a/etc/inc/unbound.inc +++ b/etc/inc/unbound.inc @@ -619,7 +619,9 @@ function unbound_acls_config() { if (is_ipaddrv6($ifip)) { $subnet_bits = get_interface_subnetv6($ubif); $subnet_ip = gen_subnetv6($ifip, $subnet_bits); - $aclcfg .= "access-control: {$subnet_ip}/{$subnet_bits} allow\n"; + // only add LAN-type interfaces + if (!interface_has_gateway($ubif)) + $aclcfg .= "access-control: {$subnet_ip}/{$subnet_bits} allow\n"; // add for IPv6 static routes to local networks // for safety, we include only routes reachable on an interface with no // gateway specified - read: not an Internet connection.