X-Git-Url: http://git.ipfire.org/?p=ipfire-2.x.git;a=blobdiff_plain;f=src%2Finitscripts%2Fsystem%2Ffirewall;fp=src%2Finitscripts%2Fsystem%2Ffirewall;h=5fef07a00f4b49f9a1d0205928916d6668cc546f;hp=2ae6157aa0a0cdd5b636430b407d3c4adad639bd;hb=5ca74566b3404539b46c904aaec0ac7e4033657f;hpb=53378856a87eabf3e5dff2a8bbc7331ebed694a2

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 2ae6157aa0..5fef07a00f 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -121,9 +121,13 @@ iptables_init() {
 	iptables -A FORWARD -p tcp -j BADTCP
 
 	# Connection tracking chains
+	iptables -N CTINVALID
+	iptables -A CTINVALID  -m limit --limit 10/second -j LOG  --log-prefix "DROP_CTINVALID "
+	iptables -A CTINVALID  -j DROP -m comment --comment "DROP_CTINVALID"
+
 	iptables -N CONNTRACK
 	iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT
-	iptables -A CONNTRACK -m conntrack --ctstate INVALID -j LOG_DROP
+	iptables -A CONNTRACK -m conntrack --ctstate INVALID -j CTINVALID
 	iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT
 
 	# Restore any connection marks