From 6818f758fe8b0de9eae45adf4bae91a312cc8f0c Mon Sep 17 00:00:00 2001 From: Jo-Philipp Wich Date: Mon, 8 Aug 2016 16:48:47 +0200 Subject: [PATCH] zones: allow untracked traffic as well Now that we only allow ctstate NEW traffic by default we also need to whitelist traffic explicitely marked by --notrack. Signed-off-by: Jo-Philipp Wich --- zones.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/zones.c b/zones.c index 3682435..a4458fe 100644 --- a/zones.c +++ b/zones.c @@ -350,7 +350,8 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state, fw3_ipt_rule_extra(r, zone->extra_src); if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid) - fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW"); + fw3_ipt_rule_extra(r, + "-m conntrack --ctstate NEW,UNTRACKED"); fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name, fw3_flag_names[t]); @@ -363,7 +364,8 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state, fw3_ipt_rule_extra(r, zone->extra_dest); if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid) - fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW"); + fw3_ipt_rule_extra(r, + "-m conntrack --ctstate NEW,UNTRACKED"); fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name, fw3_flag_names[t]); -- 2.30.2