mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix reject rules to the same as in 1_2. return is valid on all rules

Browse Source
This commit is contained in:
Chris Buechler 2009-12-18 22:20:44 -05:00
parent a29dc11b12
commit e91baab820
3 changed files with 4 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
etc/inc/filter.inc
View File

@ -1361,16 +1361,7 @@ function filter_generate_user_rule($rule)
$type = "pass ";
}
if ($type == "reject") {
/* special reject packet */
if ($rule['protocol'] == "tcp") {
$aline['type'] = "block return-rst ";
} else if ($rule['protocol'] == "udp") {
$aline['type'] = "block return-icmp ";
} else if ($rule['protocol'] == "tcp/udp") {
$aline['type'] = "block return ";
} else {
$aline['type'] = "block ";
}
$aline['type'] = "block return ";
} else
$aline['type'] = $type . " ";
if (isset($rule['floating']) && $rule['floating'] == "yes") {
@ -2406,4 +2397,4 @@ EOD;
return($ipfrules);
}
?>
?>

5
usr/local/www/firewall_rules.php
View File

@ -369,10 +369,7 @@ echo "<script type=\"text/javascript\" language=\"javascript\" src=\"/javascript
<?php if ($filterent['type'] == "block")
$iconfn = "block";
else if ($filterent['type'] == "reject") {
if ($filterent['protocol'] == "tcp" || $filterent['protocol'] == "udp" || $filterent['protocol'] == "tcp/udp")
$iconfn = "reject";
else
$iconfn = "block";
$iconfn = "reject";
} else
$iconfn = "pass";
if (isset($filterent['disabled'])) {

2
usr/local/www/firewall_rules_edit.php
View File

@ -529,7 +529,7 @@ include("head.inc");
<br/>
<span class="vexpl">
Choose what to do with packets that match the criteria specified below. <br/>
Hint: the difference between block and reject is that with reject, a packet (TCP RST or ICMP port unreachable for UDP) is returned to the sender, whereas with block the packet is dropped silently. In either case, the original packet is discarded. Reject only works when the protocol is set to either TCP or UDP (but not &quot;TCP/UDP&quot;) below.
Hint: the difference between block and reject is that with reject, a packet (TCP RST or ICMP port unreachable for UDP) is returned to the sender, whereas with block the packet is dropped silently. In either case, the original packet is discarded.
</span>
</td>
</tr>