From: Michael Tremer <michael.tremer@ipfire.org>
Date: Mon, 11 May 2015 11:00:34 +0000 (+0200)
Subject: firewall: Accept related ICMP packets again
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0f5350608ed5790101caf94c19bf08a0a0c2118f;p=people%2Fms%2Fipfire-2.x.git

firewall: Accept related ICMP packets again

This rule is required to forward ICMP error messages for
aborted TCP connections and the like.
---

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index c21cba73cc..7614b51bb2 100644
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -90,6 +90,7 @@ iptables_init() {
 	iptables -N CONNTRACK
 	iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT
 	iptables -A CONNTRACK -m conntrack --ctstate INVALID -j DROP
+	iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT
 	iptables -t raw -N CONNTRACK
 	iptables -t raw -A PREROUTING -j CONNTRACK