diff --git a/Shorewall/Perl/Shorewall/Misc.pm b/Shorewall/Perl/Shorewall/Misc.pm index 21ed51f2d..c1cdca468 100644 --- a/Shorewall/Perl/Shorewall/Misc.pm +++ b/Shorewall/Perl/Shorewall/Misc.pm @@ -843,26 +843,28 @@ sub add_common_rules ( $ ) { my $interfaceref = find_interface $interface; - unless ( $interfaceref->{options}{ignore} & NO_SFILTER || $interfaceref->{options}{rpfilter} || $interfaceref->{physical} eq 'lo' ) { + unless ( $interfaceref->{physical} eq 'lo' ) { + unless ( $interfaceref->{options}{ignore} & NO_SFILTER || $interfaceref->{options}{rpfilter} ) { - my @filters = @{$interfaceref->{filter}}; + my @filters = @{$interfaceref->{filter}}; - $chainref = $filter_table->{forward_option_chain $interface}; + $chainref = $filter_table->{forward_option_chain $interface}; - if ( @filters ) { - add_ijump( $chainref , @ipsec ? 'j' : 'g' => $target1, imatch_source_net( $_ ), @ipsec ), $chainref->{filtered}++ for @filters; - } elsif ( $interfaceref->{bridge} eq $interface ) { - add_ijump( $chainref , @ipsec ? 'j' : 'g' => $target1, imatch_dest_dev( $interface ), @ipsec ), $chainref->{filtered}++ - unless( $config{ROUTE_FILTER} eq 'on' || - $interfaceref->{options}{routeback} || - $interfaceref->{options}{routefilter} || - $interfaceref->{physical} eq '+' ); - } + if ( @filters ) { + add_ijump( $chainref , @ipsec ? 'j' : 'g' => $target1, imatch_source_net( $_ ), @ipsec ), $chainref->{filtered}++ for @filters; + } elsif ( $interfaceref->{bridge} eq $interface ) { + add_ijump( $chainref , @ipsec ? 'j' : 'g' => $target1, imatch_dest_dev( $interface ), @ipsec ), $chainref->{filtered}++ + unless( $config{ROUTE_FILTER} eq 'on' || + $interfaceref->{options}{routeback} || + $interfaceref->{options}{routefilter} || + $interfaceref->{physical} eq '+' ); + } - if ( @filters ) { - $chainref = $filter_table->{input_option_chain $interface}; - add_ijump( $chainref , g => $target, imatch_source_net( $_ ), @ipsec ), $chainref->{filtered}++ for @filters; + if ( @filters ) { + $chainref = $filter_table->{input_option_chain $interface}; + add_ijump( $chainref , g => $target, imatch_source_net( $_ ), @ipsec ), $chainref->{filtered}++ for @filters; + } } for ( option_chains( $interface ) ) {