[PATCH 2/6] firewall: Don't filter output INVALID packets

This should never cause any problems, but will cause that certain more complicated featured like SYNPROXY won't work.

Signed-off-by: Michael Tremer michael.tremer@ipfire.org --- src/initscripts/system/firewall | 1 - 1 file changed, 1 deletion(-)

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index d14466ef0..054d58c01 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -156,7 +156,6 @@ iptables_init() {

iptables -N CTOUTPUT iptables -A CTOUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT - iptables -A CTOUTPUT -m conntrack --ctstate INVALID -j CTINVALID iptables -A CTOUTPUT -p icmp -m conntrack --ctstate RELATED -j ACCEPT

# Restore any connection marks