root/usr/share/firewall4/templates/zone-drop-invalid.uc

   1 {%+ if (zone.masq ^ zone.masq6): -%}
   2         meta nfproto {{ fw4.nfproto(zone.masq ? 4 : 6) }} {%+ endif -%}
   3 {%+ include("zone-match.uc", { egress: true, rule }) -%}
   4 ct state invalid {%+ if ((zone.log & 1) && zone.log_limit): -%}
   5         limit name "{{ zone.name }}.log_limit" log prefix "drop {{ zone.name }} invalid ct state: "
   6                 {%+ include("zone-drop-invalid.uc", { fw4, zone: { ...zone, log: 0 }, rule }) %}
   7 {%+ else -%}
   8 {%+  if (zone.counter): -%}
   9         counter {%+ endif -%}
  10 {%+  if (zone.log & 1): -%}
  11         log prefix "drop {{ zone.name }} invalid ct state: " {%+ endif -%}
  12 drop comment "!fw4: Prevent NAT leakage"
  13 {%+ endif -%}