From 30cf2bbe6c202472298d33c49bb4201932409d9f Mon Sep 17 00:00:00 2001 From: JackDoan Date: Tue, 29 Sep 2026 17:38:49 -0500 Subject: [PATCH] Don't check port any firewall rules twice for packets without ports --- firewall.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/firewall.go b/firewall.go index 77c959df..e6e0a610 100644 --- a/firewall.go +++ b/firewall.go @@ -755,7 +755,8 @@ func (fp firewallPort) match(p *firewall.Packet, incoming bool, c *cert.CachedCe port = int32(p.RemotePort) } - if fp[port].match(p, c, caPool) { + // Packets without ports (gre, esp, etc) have port 0, which is PortAny, don't check those rules twice + if port != firewall.PortAny && fp[port].match(p, c, caPool) { return true }