From 0f5350608ed5790101caf94c19bf08a0a0c2118f Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Mon, 11 May 2015 13:00:34 +0200 Subject: [PATCH] firewall: Accept related ICMP packets again This rule is required to forward ICMP error messages for aborted TCP connections and the like. --- src/initscripts/init.d/firewall | 1 + 1 file changed, 1 insertion(+) diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall index c21cba73c..7614b51bb 100644 --- a/src/initscripts/init.d/firewall +++ b/src/initscripts/init.d/firewall @@ -90,6 +90,7 @@ iptables_init() { iptables -N CONNTRACK iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT iptables -A CONNTRACK -m conntrack --ctstate INVALID -j DROP + iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT iptables -t raw -N CONNTRACK iptables -t raw -A PREROUTING -j CONNTRACK