firmware: `better' fix for IPv6 loopback allow; #271

`block quick' creates a chain-reaction that requires `pass quick' for
loopback traffic, even though we have non-quick loopback pass rules
below.  If `quick' ought to be used, non-quick should be removed
completely, but that is beyond the scope of this fix.

For now, rather pass all IPv6 traffic on the looback device as opposed
to passing all IPv6 traffic with an IPv6 loopback address.

src/etc/inc/filter.inc

@@ -2611,9 +2611,8 @@ function filter_rules_generate()
 
 	if (!isset($config['system']['ipv6allow'])) {
 		$ipfrules .= "\n# Block all IPv6 except loopback traffic\n";
-		$ipfrules .= "pass quick inet6 from ::1 to ::1\n";
-		$ipfrules .= "block in {$log['block']} quick inet6 all  label \"Block all IPv6\"\n";
-		$ipfrules .= "block out {$log['block']} quick inet6 all label \"Block all IPv6\"\n";
+		$ipfrules .= "pass {$log['pass']} quick on \$loopback inet6\n";
+		$ipfrules .= "block {$log['block']} quick inet6 all label \"Block all IPv6\"\n";
 	}
 
 	$ipfrules .= <<<EOD