X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=zones.c;h=368243564c306d6ad0c173b07efb3d0ca7e62db2;hp=66c70a5e6ce66b062e0ae9efaf6e67655c61b443;hb=6009904eb4dfe91e3d0b5cb96c4095232a303835;hpb=47b23946cb2d51c486cd01596744955f850e2060

diff --git a/zones.c b/zones.c
index 66c70a5..3682435 100644
--- a/zones.c
+++ b/zones.c
@@ -348,6 +348,10 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
 				r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
 				fw3_ipt_rule_target(r, jump_target(t));
 				fw3_ipt_rule_extra(r, zone->extra_src);
+
+				if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
+					fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW");
+
 				fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name,
 				                     fw3_flag_names[t]);
 			}
@@ -357,6 +361,10 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
 				r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
 				fw3_ipt_rule_target(r, jump_target(t));
 				fw3_ipt_rule_extra(r, zone->extra_dest);
+
+				if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
+					fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW");
+
 				fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
 				                     fw3_flag_names[t]);
 			}