firewall: also exclude reply-to and route-to

PR: https://forum.opnsense.org/index.php?topic=29554.0
opnsense · Jul 31, 2022 · b5bda2b · b5bda2b
1 parent c21cafa
commit b5bda2b
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/src/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php b/src/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php
@@ -255,9 +255,11 @@ protected function convertAddress(&$rule)
                         }
                     } elseif (!empty($interfaces[$network_name]['if'])) {
                         $rule[$target] = "({$interfaces[$network_name]['if']}:network)";
-                        if ($rule['ipprotocol'] == 'inet6' && $this instanceof FilterRule && $rule['interface'] == $network_name) {
-                            /* historically pf(4) excludes link-local on :network to avoid anti-spoof overlap */
-                            $rule[$target] .= ',fe80::/10';
+                        if ($rule['ipprotocol'] == 'inet6' && $rule['interface'] == $network_name) {
+                            if ($this instanceof FilterRule && empty($rule['gateway']) && empty($rule['reply'])) {
+                                /* historically pf(4) excludes link-local on :network to avoid anti-spoof overlap */
+                                $rule[$target] .= ',fe80::/10';
+                            }
                         }
                     } elseif (Util::isIpAddress($rule[$tag]['network']) || Util::isSubnet($rule[$tag]['network'])) {
                         $rule[$target] = $rule[$tag]['network'];