so, turns out connection tracking isn't enabled per default in centos. meh
commenting out, play at your own leisure