firewall: fix squid start with IPv6 disabled; fixes #271

While blocking IPv6 in this case is a good start, loopback traffic
from internal to internal should never be blocked as some deamons
like squid use it to probe and/or communicate.

src/etc/inc/filter.inc

@@ -2609,9 +2609,9 @@ function filter_rules_generate()
 	if(isset($config['syslog']['nologdefaultpass']))
 		$log['pass'] = "log";
 
-
-	if(!isset($config['system']['ipv6allow'])) {
-		$ipfrules .= "\n# Block all IPv6\n";
+	if (!isset($config['system']['ipv6allow'])) {
+		$ipfrules .= "\n# Block all IPv6 except loopback traffic\n";
+		$ipfrules .= "pass quick inet6 from ::1 to ::1\n";
 		$ipfrules .= "block in {$log['block']} quick inet6 all  label \"Block all IPv6\"\n";
 		$ipfrules .= "block out {$log['block']} quick inet6 all label \"Block all IPv6\"\n";
 	}