diff --git a/gluon/gluon-firewall/files/lib/gluon/upgrade/firewall/invariant/011-wan-firewall b/gluon/gluon-firewall/files/lib/gluon/upgrade/firewall/invariant/011-wan-firewall
index b63f519..792e06a 100755
--- a/gluon/gluon-firewall/files/lib/gluon/upgrade/firewall/invariant/011-wan-firewall
+++ b/gluon/gluon-firewall/files/lib/gluon/upgrade/firewall/invariant/011-wan-firewall
@@ -9,6 +9,7 @@ local c = uci.cursor()
 local function reject_input_on_wan(zone)
 	if zone.name == 'wan' then
 		c:set('firewall', zone['.name'], 'input', 'REJECT')
+		c:set('firewall', zone['.name'], 'conntrack', '1')
 	end
 
 	return true