A central part of my firewall configuration is:
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
It seems that
RELATED does not work for multicast responses: when the host sends to a multicast group (in my case a UPnP SSDP discovery, to 220.127.116.11:1900), the corresponding responses from a specific IP address back to the sender's randomly selected port are dropped.
What is the correct way to preserve the
--state ESTABLISHED,RELATED semantics, but make the response matching work for multicast?