Bug#895364: iptables: using conntrack prevents dropping ip fragments

To: 895364@bugs.debian.org
Subject: Bug#895364: iptables: using conntrack prevents dropping ip fragments
From: Jim Pirzyk <jpirzyk@opendns.com>
Date: Fri, 11 May 2018 14:26:33 -0500
Message-id: <[🔎] CAAi1JC8A_De58mtYZLPdyOp7OZ8k5RmMp5xy8dnMJD+8wtaT=A@mail.gmail.com>
Reply-to: Jim Pirzyk <jpirzyk@opendns.com>, 895364@bugs.debian.org
References: <152337233125.1045.7491468914085650994.reportbug@stretch.localdomain>

This issue has been solved by using the 4.16 kernel (from debian-9 backports) and adding the following file (with contents):

cat /etc/modprobe.d/iptable_raw.conf

options iptable_raw raw_before_defrag=1

Reply to: