lucaspalomodevelop/core
1
0
Fork 0
mirror of https://github.com/lucaspalomodevelop/core.git synced 2026-03-15 09:04:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Firewall: Settings: Advanced / syncookies - make stateless loopback rule conditional as a temporary solution and add a clear note about the state requirement. closes https://github.com/opnsense/core/issues/8008

Browse Source
This commit is contained in:
Ad Schellevis 2024-10-23 20:19:25 +02:00
parent 2c4c5cf09b
commit e7e7e57dc1
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/etc/inc/filter.lib.inc
View File

@ -524,7 +524,12 @@ function filter_core_rules_system($fw, $defaults)
}
}
// loopback. dont log internal communications
$fw->registerFilterRule(5, array('interface' => 'lo0', 'log' => false, 'descr' => 'pass loopback', 'statetype' => 'none'), $defaults['pass']);
if (!empty($config['system']['syncookies'])) {
/* temporary work-around, syncookies require states to avoid dropping traffic */
$fw->registerFilterRule(5, array('interface' => 'lo0', 'log' => false, 'descr' => 'pass loopback'), $defaults['pass']);
} else {
$fw->registerFilterRule(5, array('interface' => 'lo0', 'log' => false, 'descr' => 'pass loopback', 'statetype' => 'none'), $defaults['pass']);
}
// out from this Firewall
$fw->registerFilterRule(
5,

4
src/www/system_advanced_firewall.php
View File

@ -786,6 +786,10 @@ include("head.inc");
</div>
<div class="hidden" data-for="help_for_syncookies">
<?=gettext("When syncookies are active, pf will answer each incoming TCP SYN with a syncookie SYNACK, without allocating any resources.");?>
<br/>
<strong>
<?=gettext("NOTE: this feature does require all tcp rules to be state aware, issues are to be expected when creating stateless rules");?>
</strong>
</div>
</td>
</tr>