diff --git a/src/opnsense/service/templates/OPNsense/IPFW/ipfw.conf b/src/opnsense/service/templates/OPNsense/IPFW/ipfw.conf index 8432a3c3e..b6db1197d 100644 --- a/src/opnsense/service/templates/OPNsense/IPFW/ipfw.conf +++ b/src/opnsense/service/templates/OPNsense/IPFW/ipfw.conf @@ -10,7 +10,7 @@ {% for cp_intf in cp_item.interfaces.split(',') %} {% if intf_key == cp_intf %} {% if cp_item.enabled|default('0') == '1' %} -{% do cp_interface_list.append({'zone':cp_item.description, 'zoneid':cp_item.zoneid,'if':interface.if, 'obj':cp_item}) %} +{% do cp_interface_list.append({'zone':cp_item.description, 'zoneid':cp_item.zoneid,'if':interface.if,'obj':cp_item}) %} {% do is_cp.append(1) %} {% endif %} {% endif %} @@ -99,16 +99,14 @@ add 202 skipto 60000 ipv6 from any to ::1 add 203 skipto 60000 ipv4 from any to 127.0.0.0/8 #====================================================================================== -# Allow traffic to this hosts static ip's +# Allow traffic to this host #====================================================================================== -{% for intf_key,interface in interfaces.iteritems() %} -{% if intf_key != "wan" and interface.ipaddr not in ["dhcp", "ppp", "pppoe", "l2tp", "pptp"] and interface.ipaddr|default("") != "" %} -add {{loop.index + 1000}} skipto 60000 udp from any to {{ interface.ipaddr }} dst-port 53 keep-state -add {{loop.index + 1000}} skipto 60000 ip from any to { 255.255.255.255 or {{interface.ipaddr}} } in -add {{loop.index + 1000}} skipto 60000 ip from { 255.255.255.255 or {{interface.ipaddr}} } to any out -add {{loop.index + 1000}} skipto 60000 icmp from { 255.255.255.255 or {{interface.ipaddr}} } to any out icmptypes 0 -add {{loop.index + 1000}} skipto 60000 icmp from any to { 255.255.255.255 or {{interface.ipaddr}} } in icmptypes 8 -{% endif %} +{% for item in cp_interface_list %} +add {{loop.index + 1000}} skipto 60000 udp from any to me dst-port 53 via {{item.if}} keep-state +add {{loop.index + 1000}} skipto 60000 ip from any to { 255.255.255.255 or me } in via {{item.if}} +add {{loop.index + 1000}} skipto 60000 ip from { 255.255.255.255 or me } to any out via {{item.if}} +add {{loop.index + 1000}} skipto 60000 icmp from { 255.255.255.255 or me } to any out via {{item.if}} icmptypes 0 +add {{loop.index + 1000}} skipto 60000 icmp from any to { 255.255.255.255 or me } in via {{item.if}} icmptypes 8 {% endfor %} {% for item in cp_interface_list %}