diff --git a/templates/custom.firewall-restore.j2 b/templates/custom.firewall-restore.j2
index ef3d9ba..eed6683 100644
--- a/templates/custom.firewall-restore.j2
+++ b/templates/custom.firewall-restore.j2
@@ -7,17 +7,25 @@ ipset restore -! < {{ whitelist_ipset_config_file }}
 # IP4
 
 iptables -N f2b-sshd
-iptables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_public_port|join(',') }} -j ACCEPT
-iptables -I INPUT 2 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }}  -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
-iptables -I INPUT 3 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }}  -j DROP
-iptables -I INPUT 4 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd
 iptables -A f2b-sshd -j RETURN
+iptables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd
+
+iptables -N enemy_input
+iptables -A INPUT -j enemy_input
+iptables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }}  -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
+iptables -I enemy_input 2 -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
+iptables -I enemy_input 3 -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -I enemy_input 4 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }}  -j DROP
 
 # IP6
 
 ip6tables -N f2b-sshd
-ip6tables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_public_port|join(',') }} -j ACCEPT
-ip6tables -I INPUT 2 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }}  -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
-ip6tables -I INPUT 3 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }}  -j DROP
-ip6tables -I INPUT 4 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd
 ip6tables -A f2b-sshd -j RETURN
+ip6tables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd
+
+ip6tables -N enemy_input
+ip6tables -A INPUT -j enemy_input
+ip6tables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }}  -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
+ip6tables -I enemy_input 2 -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
+ip6tables -I enemy_input 3 -m state --state RELATED,ESTABLISHED -j ACCEPT
+ip6tables -I enemy_input 4 -p tcp -m multiport ! --dports {{ whitelist_public_port|join(',') }}  -j DROP