Huh. I could have sworn I read it on one of the openwrt wiki pages or forum posts but now I can't find it. State is supported by iptables. The closest I can find in the UCI documentation is "The iptables rules generated for this section rely on the state match." I must have guessed at it.