firewall: Don't filter output INVALID packets

This should never cause any problems, but will cause that certain more
complicated featured like SYNPROXY won't work.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index d14466ef04eb60c3346268eed8349e097951b843..054d58c01db150810b74c5f8a53db0a2d4338ec4 100644 (file)
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -156,7 +156,6 @@ iptables_init() {
 
        iptables -N CTOUTPUT
        iptables -A CTOUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-       iptables -A CTOUTPUT -m conntrack --ctstate INVALID -j CTINVALID
        iptables -A CTOUTPUT -p icmp -m conntrack --ctstate RELATED -j ACCEPT
 
        # Restore any connection marks