From b4c313d953660b8a70ccfda0b260fd81a6089976 Mon Sep 17 00:00:00 2001
From: Gaurav Sinha <gaurav.sinha@vyatta.com>
Date: Fri, 16 Mar 2012 21:03:51 -0700
Subject: use add instead of create, use inet, pre-pend protocol to iptables
 rule

---
 lib/Vyatta/Conntrack/RuleCT.pm | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm
index 9953291..5c59b93 100644
--- a/lib/Vyatta/Conntrack/RuleCT.pm
+++ b/lib/Vyatta/Conntrack/RuleCT.pm
@@ -74,6 +74,11 @@ sub rule {
         Vyatta::Config::outputError(["Conntrack"], "Conntrack config error: $err_str");
         exit 1;
   }
+  if ($self->{_protocol} = "tcp") {
+    $rule .= " -p tcp";
+  } elsif ($self->{_protocol} = "udp") {
+    $rule .= " -p udp";
+  }
   $rule .= " $srcrule $dstrule ";
   return $rule;
 }
@@ -181,7 +186,7 @@ sub get_policy_command {
   my ($self ) = @_;
   my $command;
   my @level_nodes = split (' ', $self->{_comment});
-  $command .= "policy_$level_nodes[2]_$level_nodes[5]";
+  $command .= "policy_$level_nodes[2]_$level_nodes[5] inet";
   if ($self->{_protocol} eq 'tcp') {
     $command .= " tcp";
     if ($self->{_tcp}->{_close}) {
-- 
cgit v1.2.3