diff --git a/Shorewall/Perl/Shorewall/Compiler.pm b/Shorewall/Perl/Shorewall/Compiler.pm
index c91906f89..9e6b01f98 100644
--- a/Shorewall/Perl/Shorewall/Compiler.pm
+++ b/Shorewall/Perl/Shorewall/Compiler.pm
@@ -710,6 +710,16 @@ sub compiler {
#
setup_proxy_arp;
+ my $setting = supplied $config{HELPERS} ? 0 : 1;
+
+ emit( "#\n# Set automatic helper association on kernel 3.5.0 and later\n#" ,
+ 'if [ -f /proc/sys/net/netfilter/nf_conntrack_helper ]; then' ,
+ ' progress_message "Setting up Automatic Helper Association"',
+ " echo $setting > /proc/sys/net/netfilter/nf_conntrack_helper",
+ 'fi',
+ ''
+ );
+
if ( $scriptfilename || $debug ) {
emit 'return 0';
pop_indent;
diff --git a/Shorewall/Perl/Shorewall/Config.pm b/Shorewall/Perl/Shorewall/Config.pm
index 94232a0b6..97fa9e212 100644
--- a/Shorewall/Perl/Shorewall/Config.pm
+++ b/Shorewall/Perl/Shorewall/Config.pm
@@ -62,6 +62,7 @@ our @EXPORT = qw(
have_capability
require_capability
+ kernel_version
);
our @EXPORT_OK = qw( $shorewall_dir initialize shorewall);
@@ -3643,6 +3644,13 @@ sub require_capability( $$$ ) {
fatal_error "$description require${singular} $capdesc{$capability} in your kernel and iptables" unless have_capability $capability;
}
+#
+# Return Kernel Version
+#
+sub kernel_version() {
+ $capabilities{KERNELVERSION}
+}
+
#
# Set default config path
#
diff --git a/Shorewall/manpages/shorewall.conf.xml b/Shorewall/manpages/shorewall.conf.xml
index 209eff551..4cd86e8f6 100644
--- a/Shorewall/manpages/shorewall.conf.xml
+++ b/Shorewall/manpages/shorewall.conf.xml
@@ -737,6 +737,10 @@ net all DROP infothen the chain name is 'net2all'
tftp
+
+ When HELPERS is specified on a system running Kernel 3.5.0 or
+ later, automatic association of helpers to connections is disabled.
+
diff --git a/Shorewall6/manpages/shorewall6.conf.xml b/Shorewall6/manpages/shorewall6.conf.xml
index 5ef8a559f..1eda02d4f 100644
--- a/Shorewall6/manpages/shorewall6.conf.xml
+++ b/Shorewall6/manpages/shorewall6.conf.xml
@@ -646,6 +646,10 @@ net all DROP infothen the chain name is 'net2all'
tftp
+
+ When HELPERS is specified on a system running Kernel 3.5.0 or
+ later, automatic association of helpers to connections is disabled.
+