From 5d32492676a401804b2bec1f138c170057f56f2a Mon Sep 17 00:00:00 2001
From: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
Date: Wed, 10 Sep 2025 11:37:17 -0300
Subject: [PATCH] IPv6 firewall: accept packets from related and established
 connections (#10970)

* IPv6 firewall: accept related packets and packets from established connections

* Remove rule from input chain
---
 systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py b/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py
index bf7aaf5ddd6..80d64e8f2d9 100755
--- a/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py
+++ b/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py
@@ -232,6 +232,8 @@ class CsNetfilters(object):
         if hook == "input" or hook == "output":
             CsHelper.execute("nft add rule %s %s %s icmpv6 type { echo-request, echo-reply, \
                 nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept" % (address_family, table, chain))
+        elif hook == "forward":
+            CsHelper.execute("nft add rule %s %s %s ct state established,related accept" % (address_family, table, chain))
 
     def add_ip4_chain(self, address_family, table, chain, hook, action):
         chain_policy = ""