I'm running into problems with a stateful firewall on a bridge device. The Linux kernel is 2.6.37. The problem appears to be that no connection tracking entries are being made. conntrack -L shows no entries. But sysctl appears to be set correctly: net.bridge.bridge-nf-call-arptables = 1 net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-filter-vlan-tagged = 0 net.bridge.bridge-nf-filter-pppoe-tagged = 0 Does anybody have any suggestions as to what I should look at next?