diff --git a/etc/inc/gwlb.inc b/etc/inc/gwlb.inc index 3d95678a4f..24193d6d53 100644 --- a/etc/inc/gwlb.inc +++ b/etc/inc/gwlb.inc @@ -60,8 +60,8 @@ function setup_gateways_monitor() { # pfSense apinger configuration file. Automatically Generated! ## User and group the pinger should run as -user "nobody" -group "nobody" +user "root" +group "wheel" ## Mailer to use (default: "/usr/lib/sendmail -t") #mailer "/var/qmail/bin/qmail-inject" diff --git a/usr/local/www/firewall_nat_1to1.php b/usr/local/www/firewall_nat_1to1.php index d44ced8224..52a1268649 100755 --- a/usr/local/www/firewall_nat_1to1.php +++ b/usr/local/www/firewall_nat_1to1.php @@ -158,7 +158,9 @@ include("head.inc");

Note:
- Depending on the way your WAN connection is setup, you may also need a Virtual IP.

+ Depending on the way your WAN connection is setup, you may also need a Virtual IP.
+ If you add a 1:1 NAT entry for any of the interface IPs on this system, it will make this system inaccessible on that IP address. i.e. if + you use your WAN IP address, any services on this system (IPsec, OpenVPN server, etc.) using the WAN IP address will no longer function.

diff --git a/usr/local/www/firewall_nat_1to1_edit.php b/usr/local/www/firewall_nat_1to1_edit.php index 62c4c33bcd..d7ed094d4a 100755 --- a/usr/local/www/firewall_nat_1to1_edit.php +++ b/usr/local/www/firewall_nat_1to1_edit.php @@ -100,12 +100,6 @@ if ($_POST) { $input_errors[] = "A valid internal subnet must be specified."; } - if (is_ipaddr($config['interfaces']['wan']['ipaddr'])) { - if (check_subnets_overlap($_POST['external'], $_POST['subnet'], - get_interface_ip("wan"), 32)) - $input_errors[] = "The WAN IP address may not be used in a 1:1 rule."; - } - /* check for overlaps with other 1:1 */ foreach ($a_1to1 as $natent) { if (isset($id) && ($a_1to1[$id]) && ($a_1to1[$id] === $natent)) @@ -120,17 +114,6 @@ if ($_POST) { } } - /* check for overlaps with advanced outbound NAT */ - if (is_array($config['nat']['advancedoutbound']['rule'])) { - foreach ($config['nat']['advancedoutbound']['rule'] as $natent) { - if ($natent['target'] && - check_subnets_overlap($_POST['external'], $_POST['subnet'], $natent['target'], 32)) { - $input_errors[] = "An advanced outbound NAT entry overlaps with the specified external subnet."; - break; - } - } - } - if (!$input_errors) { $natent = array(); diff --git a/usr/local/www/firewall_nat_out_edit.php b/usr/local/www/firewall_nat_out_edit.php index 45db4bae09..483aec1ce2 100755 --- a/usr/local/www/firewall_nat_out_edit.php +++ b/usr/local/www/firewall_nat_out_edit.php @@ -169,18 +169,6 @@ if ($_POST) { $ext = gen_subnet($_POST['destination'], $_POST['destination_subnet']) . "/" . $_POST['destination_subnet']; } - if ($_POST['target']) { - /* check for clashes with 1:1 NAT (NAT Addresses is OK) */ - if (is_array($config['nat']['onetoone'])) { - foreach ($config['nat']['onetoone'] as $natent) { - if (check_subnets_overlap($_POST['target'], 32, $natent['external'], $natent['subnet'])) { - $input_errors[] = "A 1:1 NAT mapping overlaps with the specified target IP address."; - break; - } - } - } - } - foreach ($a_out as $natent) { if (isset($id) && ($a_out[$id]) && ($a_out[$id] === $natent)) { continue; diff --git a/usr/local/www/firewall_rules.php b/usr/local/www/firewall_rules.php index af0fedb6b0..75557bc595 100755 --- a/usr/local/www/firewall_rules.php +++ b/usr/local/www/firewall_rules.php @@ -327,7 +327,7 @@ echo "