@@ -3045,6 +3045,11 @@ an option,

 can be used to first remove the old value, and then add a new

 .B \-\-push

 option with the new value.

+

+NOTE2: due to implementation details, 'ifconfig' and 'ifconfig-ipv6'

+can only be removed with an exact match on the option ("push-remove ifconfig"),

+no substring matching and no matching on the IPv4/IPv6 address argument

+is possible.

 .\"*********************************************************

 .TP

 .B \-\-push\-peer\-info

@@ -425,6 +425,7 @@ struct options

     bool push_ifconfig_constraint_defined;

     in_addr_t push_ifconfig_constraint_network;

     in_addr_t push_ifconfig_constraint_netmask;

+    bool push_ifconfig_ipv4_blocked;                    /* IPv4 */

     bool push_ifconfig_ipv6_defined;                    /* IPv6 */

     struct in6_addr push_ifconfig_ipv6_local;           /* IPv6 */

     int push_ifconfig_ipv6_netbits;                     /* IPv6 */

@@ -342,7 +342,8 @@ prepare_push_reply(struct context *c, struct gc_arena *gc,

     /* ipv4 */

     if (c->c2.push_ifconfig_defined && c->c2.push_ifconfig_local

-        && c->c2.push_ifconfig_remote_netmask)

+        && c->c2.push_ifconfig_remote_netmask

+        && !o->push_ifconfig_ipv4_blocked)

     {

         in_addr_t ifconfig_local = c->c2.push_ifconfig_local;

         if (c->c2.push_ifconfig_local_alias)

@@ -602,6 +603,13 @@ push_remove_option(struct options *o, const char *p)

 {

     msg(D_PUSH_DEBUG, "PUSH_REMOVE searching for: '%s'", p);

+    /* ifconfig is special, as not part of the push list */

+    if (streq(p, "ifconfig"))

+    {

+        o->push_ifconfig_ipv4_blocked = true;

+        return;

+    }

+

     /* ifconfig-ipv6 is special, as not part of the push list */

     if (streq( p, "ifconfig-ipv6" ))

     {