From 61438a1e2cee7388de7a2fceb014fcedbfe2eeb6 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Thu, 19 Jan 2006 00:15:20 +0000
Subject: [PATCH] Fix XXX.   Do not allow DHCP out WAN if interface is not
 selected for DHCP.

---
 etc/inc/filter.inc | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index 4a8f9a8610..f631135278 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -1520,15 +1520,16 @@ pass out quick on {$wancfg['if']} proto tcp from any to any port = 1723 flags S/
 EOD;
 	}
 
-	$ipfrules .= <<<EOD
+	if ($wancfg['ipaddr'] == "dhcp") {
+
+		$ipfrules .= <<<EOD
 
 # allow our DHCP client out to the WAN
-# XXX - should be more restrictive
-# (not possible at the moment - need 'me' like in ipfw)
 anchor "wandhcp"
 pass out quick on $wanif proto udp from any port = 68 to any port = 67 label "allow dhcp client out wan"
 
 EOD;
+	}
 
 if($config['interfaces']['lan']['bridge'] <> "wan" and $config['interfaces']['wan']['bridge'] <> "lan")
 	$ipfrules .= "block in $log quick on $wanif proto udp from any port = 67 to {$lansa_sn_combo} port = 68 label \"allow dhcp client out wan\"\n";