From: Jo-Philipp Wich Date: Mon, 8 Aug 2016 14:48:47 +0000 (+0200) Subject: zones: allow untracked traffic as well X-Git-Url: http://git.openwrt.org/?p=project%2Ffirewall3.git;a=commitdiff_plain;h=6818f758fe8b0de9eae45adf4bae91a312cc8f0c zones: allow untracked traffic as well Now that we only allow ctstate NEW traffic by default we also need to whitelist traffic explicitely marked by --notrack. Signed-off-by: Jo-Philipp Wich --- diff --git a/zones.c b/zones.c index 3682435..a4458fe 100644 --- a/zones.c +++ b/zones.c @@ -350,7 +350,8 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state, fw3_ipt_rule_extra(r, zone->extra_src); if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid) - fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW"); + fw3_ipt_rule_extra(r, + "-m conntrack --ctstate NEW,UNTRACKED"); fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name, fw3_flag_names[t]); @@ -363,7 +364,8 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state, fw3_ipt_rule_extra(r, zone->extra_dest); if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid) - fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW"); + fw3_ipt_rule_extra(r, + "-m conntrack --ctstate NEW,UNTRACKED"); fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name, fw3_flag_names[t]);