Use the iptables CT target to attach connection tracking helpers
My system with linux-3.6.6 now contains the following in dmesg:
nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.
This is also discussed in e.g. https://bbs.archlinux.org/viewtopic.php?id=148345
Basically, for each protocol for which we want to do content inspection/mangling, we need to add something like:
iptables -t raw -A OUTPUT -p tcp --dport 21 -j CT --helper ftp
To create explicit mapping with the port number and the protocol expected.
#1 Updated by Kaarle Ritvanen over 6 years ago
We should also consider the suggestions in this document:
Blindly accepting all packets in RELATED state is considered a security risk.
#4 Updated by Stuart Cardall about 2 years ago
the rule should be added to the prerouting table:
iptables -A PREROUTING -t raw -p tcp --dport 2121 \\ -d 220.127.116.11 -j CT --helper ftp