zones: allow untracked traffic as well

[project/firewall3.git] / zones.c

diff --git a/zones.c b/zones.c
index 88133e26b3348fdc9e1ce261ed2b241ef955c166..a4458fe5f7ea96b0248bb1ed70f7c459f56317a4 100644 (file)
--- a/zones.c
+++ b/zones.c
@@ -1,7 +1,7 @@
 /*
  * firewall3 - 3rd OpenWrt UCI firewall implementation
  *
- *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
+ *   Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -348,6 +348,11 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                                r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
                                fw3_ipt_rule_target(r, jump_target(t));
                                fw3_ipt_rule_extra(r, zone->extra_src);
+
+                               if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
+                                       fw3_ipt_rule_extra(r,
+                                                          "-m conntrack --ctstate NEW,UNTRACKED");
+
                                fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name,
                                                     fw3_flag_names[t]);
                        }
@@ -357,6 +362,11 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                                r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
                                fw3_ipt_rule_target(r, jump_target(t));
                                fw3_ipt_rule_extra(r, zone->extra_dest);
+
+                               if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
+                                       fw3_ipt_rule_extra(r,
+                                                          "-m conntrack --ctstate NEW,UNTRACKED");
+
                                fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
                                                     fw3_flag_names[t]);
                        }