Now that we only allow ctstate NEW traffic by default we also need to
whitelist traffic explicitely marked by --notrack.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
fw3_ipt_rule_extra(r, zone->extra_src);
if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
fw3_ipt_rule_extra(r, zone->extra_src);
if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
- fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW");
+ fw3_ipt_rule_extra(r,
+ "-m conntrack --ctstate NEW,UNTRACKED");
fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name,
fw3_flag_names[t]);
fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name,
fw3_flag_names[t]);
fw3_ipt_rule_extra(r, zone->extra_dest);
if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
fw3_ipt_rule_extra(r, zone->extra_dest);
if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
- fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW");
+ fw3_ipt_rule_extra(r,
+ "-m conntrack --ctstate NEW,UNTRACKED");
fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
fw3_flag_names[t]);
fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
fw3_flag_names[t]);