diff --git a/net/frr/src/etc/inc/plugins.inc.d/frr.inc b/net/frr/src/etc/inc/plugins.inc.d/frr.inc
index 3b546e830..d6a0bd2a8 100644
--- a/net/frr/src/etc/inc/plugins.inc.d/frr.inc
+++ b/net/frr/src/etc/inc/plugins.inc.d/frr.inc
@@ -42,74 +42,151 @@ function frr_carp_enabled()
function frr_firewall($fw)
{
+ global $config;
+ if (empty((string)(new \OPNsense\Quagga\General())->fwrules)) {
+ // automatic rules disabled
+ return;
+ }
$ospf = new \OPNsense\Quagga\OSPF();
if ((string)$ospf->enabled == '1') {
+ $ospf_default = [
+ 'ipprotocol' => 'inet',
+ 'protocol' => 'ospf',
+ 'statetype' => 'keep',
+ 'type' => 'pass',
+ 'disablereplyto' => 1,
+ 'quick' => true,
+ 'log' => !isset($config['syslog']['nologdefaultpass']),
+ '#ref' => 'ui/quagga/general/index',
+ ];
foreach ($ospf->networks->network->iterateItems() as $network) {
if ((string)$network->enabled == '1') {
$fw->registerFilterRule(
1, /* priority */
- array(
- 'ipprotocol' => 'inet',
- 'protocol' => 'ospf',
- 'statetype' => 'keep',
- 'label' => 'Pass OSPF (autogenerated)',
+ [
+ 'descr' => 'Pass OSPF (autogenerated)',
'from' => $network->ipaddr . '/' . $network->netmask,
'to' => '224.0.0.0/24',
- 'direction' => 'in',
- 'type' => 'pass',
- 'disablereplyto' => 1,
- 'quick' => true
- ),
- null
+ 'direction' => 'in'
+ ],
+ $ospf_default
);
$fw->registerFilterRule(
1,
- array(
- 'ipprotocol' => 'inet',
- 'protocol' => 'ospf',
- 'statetype' => 'keep',
- 'label' => 'Pass OSPF UNICAST (autogenerated)',
+ [
+ 'descr' => 'Pass OSPF UNICAST (autogenerated)',
'from' => $network->ipaddr . '/' . $network->netmask,
'to' => '(self)',
- 'direction' => 'in',
- 'type' => 'pass',
- 'disablereplyto' => 1,
- 'quick' => true
- ),
- null
+ 'direction' => 'in'
+ ],
+ $ospf_default
);
$fw->registerFilterRule(
1,
- array(
- 'ipprotocol' => 'inet',
- 'protocol' => 'ospf',
- 'statetype' => 'keep',
- 'label' => 'Pass OSPF (autogenerated)',
- 'from' => '224.0.0.0/24',
- 'to' => $network->ipaddr . '/' . $network->netmask,
- 'direction' => 'out',
- 'type' => 'pass',
- 'disablereplyto' => 1,
- 'quick' => true
- ),
- null
+ [
+ 'descr' => 'Pass OSPF (autogenerated)',
+ 'from' => '(self)'
+ 'to' => '224.0.0.0/24',
+ 'direction' => 'out'
+ ],
+ $ospf_default
);
$fw->registerFilterRule(
1,
- array(
- 'ipprotocol' => 'inet',
- 'protocol' => 'ospf',
- 'statetype' => 'keep',
- 'label' => 'Pass OSPF UNICAST (autogenerated)',
+ [
+ 'descr' => 'Pass OSPF UNICAST (autogenerated)',
'from' => '(self)',
'to' => $network->ipaddr . '/' . $network->netmask,
'direction' => 'out',
- 'type' => 'pass',
- 'disablereplyto' => 1,
- 'quick' => true
- ),
- null
+ ],
+ $ospf_default
+ );
+ }
+ }
+ }
+
+ $ospf6 = new \OPNsense\Quagga\OSPF6();
+
+ if ((string)$ospf6->enabled == '1') {
+ $ospf6_default = [
+ 'ipprotocol' => 'inet6',
+ 'protocol' => 'ospf',
+ 'statetype' => 'keep',
+ 'type' => 'pass',
+ 'disablereplyto' => 1,
+ 'quick' => true,
+ 'log' => !isset($config['syslog']['nologdefaultpass']),
+ '#ref' => 'ui/quagga/general/index',
+ ];
+
+ foreach ($ospf6->interfaces->interface->iterateItems() as $interface) {
+ if ((string)$interface->enabled == '1') {
+ $fw->registerFilterRule(
+ 1, /* priority */
+ [
+ 'interface' => $interface->interfacename,
+ 'descr' => 'Pass OSPF6 MULTICAST (autogenerated)',
+ 'from' => 'fe80::0/10',
+ 'to' => 'ff02::5/128',
+ 'direction' => 'in'
+ ],
+ $ospf6_default
+ );
+ $fw->registerFilterRule(
+ 1, /* priority */
+ [
+ 'interface' => $interface->interfacename,
+ 'descr' => 'Pass OSPF6 MULTICAST DR (autogenerated)',
+ 'from' => 'fe80::0/10',
+ 'to' => 'ff02::6/128',
+ 'direction' => 'in'
+ ],
+ $ospf6_default
+ );
+ $fw->registerFilterRule(
+ 1,
+ [
+ 'interface' => $interface->interfacename,
+ 'descr' => 'Pass OSPF6 UNICAST (autogenerated)',
+ 'from' => 'fe80::0/10',
+ 'to' => '(self)',
+ 'direction' => 'in'
+ ],
+ $ospf6_default
+ );
+ $fw->registerFilterRule(
+ 1,
+ [
+ 'interface' => $interface->interfacename,
+ 'descr' => 'Pass OSPF6 MULTICAST (autogenerated)',
+ 'from' => '(self)',
+ 'to' => 'ff02::5/128',
+ 'direction' => 'out'
+ ],
+ $ospf6_default
+ );
+ $fw->registerFilterRule(
+ 1,
+ [
+ 'interface' => $interface->interfacename,
+ 'descr' => 'Pass OSPF6 MULTICAST DR (autogenerated)',
+ 'from' => '(self)',
+ 'to' => 'ff02::6/128',
+ 'direction' => 'out'
+ ],
+ $ospf6_default
+ );
+ $fw->registerFilterRule(
+ 1,
+ [
+ 'interface' => $interface->interfacename,
+ 'descr' => 'Pass OSPF6 UNICAST (autogenerated)',
+ 'from' => '(self)',
+ 'to' => 'fe80::0/10',
+ 'direction' => 'out'
+ ],
+ $ospf6_default
);
}
}
diff --git a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/general.xml b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/general.xml
index fc3d304c3..b3c2c1b7e 100644
--- a/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/general.xml
+++ b/net/frr/src/opnsense/mvc/app/controllers/OPNsense/Quagga/forms/general.xml
@@ -36,4 +36,12 @@
dropdown
This is the detail level of the log. A higher level means more data is logged.
+
+ general.fwrules
+
+ checkbox
+ Enable automatically created firewall rules, when additional policies are needed, disable this and define
+ your own custom policies in the Firewall section.
+
+
diff --git a/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/General.xml b/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/General.xml
index cc0b58304..473e47bec 100644
--- a/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/General.xml
+++ b/net/frr/src/opnsense/mvc/app/models/OPNsense/Quagga/General.xml
@@ -1,7 +1,7 @@
//OPNsense/quagga/general
Quagga Routing configuration
- 1.0.2
+ 1.0.3
0
@@ -43,5 +43,9 @@
Debugging
+
+ 1
+ Y
+