iptables: Replace state module by conntrack module.

The state module is deprecated in recent releases of iptables.

diff --git a/functions.firewall b/functions.firewall
index 610ed54c35fc0e3313033a6d27fc8a8bb3a13c66..3f0d5ff85394e039c222d1add7878a2598ab1a25 100644 (file)
--- a/functions.firewall
+++ b/functions.firewall
@@ -235,9 +235,9 @@ function firewall_connection_tracking() {
        log INFO "Creating Connection Tracking chain..."
 
        iptables_chain_create "${protocol}" CONNTRACK
-       iptables "${protocol}" -A CONNTRACK -m state --state ESTABLISHED,RELATED -j ACCEPT
-       iptables "${protocol}" -A CONNTRACK -m state --state INVALID -j "$(iptables_LOG "INVALID packet: ")"
-       iptables "${protocol}" -A CONNTRACK -m state --state INVALID -j DROP
+       iptables "${protocol}" -A CONNTRACK -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+       iptables "${protocol}" -A CONNTRACK -m conntrack --ctstate INVALID -j "$(iptables_LOG "INVALID packet: ")"
+       iptables "${protocol}" -A CONNTRACK -m conntrack --ctstate INVALID -j DROP
 
        iptables "${protocol}" -A INPUT   -j CONNTRACK
        iptables "${protocol}" -A OUTPUT  -j CONNTRACK
@@ -251,8 +251,8 @@ function firewall_localhost_create_chains() {
        log DEBUG "Creating firewall chains for localhost..."
 
        # Accept everything on lo
-       iptables "${protocol}" -A INPUT  -i lo -m state --state NEW -j ACCEPT
-       iptables "${protocol}" -A OUTPUT -o lo -m state --state NEW -j ACCEPT
+       iptables "${protocol}" -A INPUT  -i lo -m conntrack --ctstate NEW -j ACCEPT
+       iptables "${protocol}" -A OUTPUT -o lo -m conntrack --ctstate NEW -j ACCEPT
 }
 
 function firewall_zone_create_chains() {

diff --git a/functions.firewall-policy b/functions.firewall-policy
index 842fa9fb808a30f222c705b510c0e409423a25be..e7b0cf1abdb9ea42b67db5d3158419ece758ef23 100644 (file)
--- a/functions.firewall-policy
+++ b/functions.firewall-policy
@@ -62,7 +62,7 @@ function policy_zone_allow_all() {
        local chain="ZONE_${zone^^}_${other_zone^^}_POLICY"
 
        # Just accept all new connections.
-       iptables -A "${chain}" -m state --state NEW -j ACCEPT
+       iptables -A "${chain}" -m conntrack --ctstate NEW -j ACCEPT
 }
 
 function policy_zone_deny_all() {