Bug#895364: iptables: using conntrack prevents dropping ip fragments

[Jim Pirzyk]

Further research into this bug, I have found this patch report for netfilter

https://patchwork.ozlabs.org/patch/863720/