X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=zones.c;h=a4458fe5f7ea96b0248bb1ed70f7c459f56317a4;hp=368243564c306d6ad0c173b07efb3d0ca7e62db2;hb=6818f758fe8b0de9eae45adf4bae91a312cc8f0c;hpb=b33f78371e7c7b6a131c2b6c01673cbd4b3c13d1

diff --git a/zones.c b/zones.c
index 3682435..a4458fe 100644
--- a/zones.c
+++ b/zones.c
@@ -350,7 +350,8 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
 				fw3_ipt_rule_extra(r, zone->extra_src);
 
 				if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
-					fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW");
+					fw3_ipt_rule_extra(r,
+					                   "-m conntrack --ctstate NEW,UNTRACKED");
 
 				fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name,
 				                     fw3_flag_names[t]);
@@ -363,7 +364,8 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
 				fw3_ipt_rule_extra(r, zone->extra_dest);
 
 				if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
-					fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW");
+					fw3_ipt_rule_extra(r,
+					                   "-m conntrack --ctstate NEW,UNTRACKED");
 
 				fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
 				                     fw3_flag_names[t]);