puppetlabs/puppetlabs-firewall — pull request #257 by evaryont (2013-10-16 01:51:02+00:00)
Title: Support conntrack stateful firewall matching

Since Linux 3.7+ the "state" module has been removed from the kernel, leaving
only the "conntrack" module. This patch adds support for the conntrack module in
iptables by adding a new parameter to the firewall type, 'ctstate'.

Updates the README to demonstrate using the ctstate parameter instead of state
to nudge people to use it instead. This is safe as far as back to Linux kernel
2.6.18, so long as CONFIG_NF_CONNTRACK is enabled.

Closes #231 and #142.

And a question, since the state trules are no longer working, should they be automatically converted to ctstate rules? What happens when both types of rules are applied? I'd think the state rules should be dropped (perhaps with a warning if it doesn't match ctstate).