T5614: extend ipv4 firewall documentation on conntrack-helper matching

1 files changed, 24 insertions, 0 deletions

diff --git a/docs/configuration/firewall/ipv4.rst b/docs/configuration/firewall/ipv4.rst
index 9a683d22..ee83967f 100644
--- a/docs/configuration/firewall/ipv4.rst
+++ b/docs/configuration/firewall/ipv4.rst
@@ -906,6 +906,30 @@ geoip) to keep database and rules updated.
    Match when 'count' amount of connections are seen within 'time'. These
    matching criteria can be used to block brute-force attempts.
 
+.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
+   conntrack-helper <module>
+.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
+   conntrack-helper <module>
+.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
+   conntrack-helper <module>
+.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
+   conntrack-helper <module>
+
+   Match based on connection tracking protocol helper module to secure use of 
+   that helper module. See below for possible completions `<module>`. 
+
+   .. code-block:: none
+
+      Possible completions:
+          ftp                  Related traffic from FTP helper
+          h323                 Related traffic from H.323 helper
+          pptp                 Related traffic from PPTP helper
+          nfs                  Related traffic from NFS helper
+          sip                  Related traffic from SIP helper
+          tftp                 Related traffic from TFTP helper
+          sqlnet               Related traffic from SQLNet helper
+
+
 ********
 Synproxy
 ********