+ case FW3_TABLE_RAW:
+ if (redir->target == FW3_FLAG_DNAT && redir->helper.ptr)
+ {
+ if (!fw3_cthelper_check_proto(redir->helper.ptr, proto))
+ {
+ info(" ! Skipping protocol %s since helper '%s' does not support it",
+ fw3_protoname(proto), redir->helper.ptr->name);
+ return;
+ }
+
+ if (!redir->helper.set)
+ info(" - Auto-selected conntrack helper '%s' based on proto/port",
+ redir->helper.ptr->name);
+
+ r = fw3_ipt_rule_create(h, proto, NULL, NULL, &redir->ip_src, &redir->ip_redir);
+ fw3_ipt_rule_sport_dport(r, &redir->port_src, &redir->port_redir);
+ fw3_ipt_rule_mac(r, mac);
+ fw3_ipt_rule_ipset(r, &redir->ipset);
+ fw3_ipt_rule_limit(r, &redir->limit);
+ fw3_ipt_rule_time(r, &redir->time);
+ fw3_ipt_rule_mark(r, &redir->mark);
+ fw3_ipt_rule_addarg(r, false, "-m", "conntrack");
+ fw3_ipt_rule_addarg(r, false, "--ctstate", "DNAT");
+ fw3_ipt_rule_target(r, "CT");
+ fw3_ipt_rule_addarg(r, false, "--helper", redir->helper.ptr->name);
+ set_comment(r, redir->name, num, "CT helper");
+ fw3_ipt_rule_append(r, "zone_%s_helper", redir->_src->name);
+ }
+ break;
+