From 86e6e0bcffcbb988dc7f80ac0aed25cad28d79eb Mon Sep 17 00:00:00 2001
From: jim-p <jimp@netgate.com>
Date: Mon, 26 Aug 2019 15:24:34 -0400
Subject: [PATCH] Fix state kill ordering in rc.newwanip. Fixes #4674

Move state kill to after new rules and routing have been setup.
Otherwise there is a race condition where new states could be created
before the new rules and routing are in place.
---
 src/etc/rc.newwanip | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/etc/rc.newwanip b/src/etc/rc.newwanip
index 4bdb6ea74c..5b3ec3fbed 100755
--- a/src/etc/rc.newwanip
+++ b/src/etc/rc.newwanip
@@ -205,18 +205,6 @@ if (platform_booting() && !in_array(substr($interface_real, 0, 3), array("ppp",
  * could be failing back in which case we need to switch IPs back anyhow.
  */
 if (!is_ipaddr($oldip) || $curwanip != $oldip || !is_ipaddrv4($config['interfaces'][$interface]['ipaddr'])) {
-	/* IP changed, kill states accordingly */
-	if ($curwanip != $oldip) {
-		if (isset($config['system']['ip_change_kill_states'])) {
-			log_error("IP Address has changed, killing all states (ip_change_kill_states is set).");
-			pfSense_kill_states($oldip);
-			filter_flush_state_table();
-		} else {
-			log_error("IP Address has changed, killing states on former IP Address $oldip.");
-			pfSense_kill_states($oldip);
-		}
-	}
-
 	/*
 	 * Some services (e.g. dyndns, see ticket #4066) depend on
 	 * filter_configure() to be called before, otherwise pass out
@@ -232,6 +220,18 @@ if (!is_ipaddr($oldip) || $curwanip != $oldip || !is_ipaddrv4($config['interface
 	/* reconfigure static routes (kernel may have deleted them) */
 	system_routing_configure($interface);
 
+	/* If the IP address changed, kill old states after rules and routing have been updated */
+	if ($curwanip != $oldip) {
+		if (isset($config['system']['ip_change_kill_states'])) {
+			log_error("IP Address has changed, killing all states (ip_change_kill_states is set).");
+			pfSense_kill_states($oldip);
+			filter_flush_state_table();
+		} else {
+			log_error("IP Address has changed, killing states on former IP Address $oldip.");
+			pfSense_kill_states($oldip);
+		}
+	}
+
 	/* reload unbound */
 	services_unbound_configure();