From e397ee623ec0bf006969d0e015985b908fa0fc5b Mon Sep 17 00:00:00 2001 From: Bill Marquette Date: Sun, 20 Feb 2005 17:55:16 +0000 Subject: [PATCH] Make carp rules a little tighter and don't sync to peer (peer will already have same state) --- etc/inc/filter.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 801723a18f..25a39c5ab6 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -931,8 +931,8 @@ function filter_rules_generate() { /* if carp is defined, lets pass the traffic */ if(is_carp_defined() == true) { - $ipfrules .= "pass on " . $lanif . " proto carp keep state label \"carp\"\n"; - $ipfrules .= "pass on " . $wanif . " proto carp keep state label \"carp\"\n"; + $ipfrules .= "pass on " . $lanif . " proto carp from $lanif:network to 224.0.0.18 keep state (no-sync) label \"carp\"\n"; + $ipfrules .= "pass on " . $wanif . " proto carp from $wanif:network to 224.0.0.18 keep state (no-sync) label \"carp\"\n"; } /* if squid is installed, lets install its rule */