diff --git a/etc/ipv4/forward.conf b/etc/ipv4/forward.conf
index 4690ccd..cfae29f 100644
--- a/etc/ipv4/forward.conf
+++ b/etc/ipv4/forward.conf
@@ -2,17 +2,18 @@
 # Use this file to set up network address translation rules
 # Use tabs or single space to separate
 #
-# <action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional>
+# <action> <src-interface> <src-address> <dst-interface> <dst-address> <syn> <bidirectional>
 #
 # Action: Required ( ACCEPT | DROP )
 # Source Interface: Optional ( interface name, aka eth0 )
 # Source Address: Optional ( IP address with optional netmask )
 # Destination Interface: Optional ( interface name, aka eth0 )
 # Destination Address: Optional ( IP address with optional netmask )
+# Syn: Optional, only match (not) syn packets (syn | notsyn )
 # Bidirectional: Optional ( yes | no, defaults to no if '-' )
 # You can use '-' for optional fields
 #============================================================
-#<action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional>
+#<action> <src-interface> <src-address> <dst-interface> <dst-address> <syn> <bidirectional>
 #ACCEPT eth0 - eth1 - yes
 #DROP eth1 192.168.2.0/24 eth0 0/0 no
 
diff --git a/etc/ipv6/forward.conf b/etc/ipv6/forward.conf
index 5f78809..88774a4 100644
--- a/etc/ipv6/forward.conf
+++ b/etc/ipv6/forward.conf
@@ -2,17 +2,18 @@
 # Use this file to set up network address translation rules
 # Use tabs or single space to separate
 #
-# <action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional>
+# <action> <src-interface> <src-address> <dst-interface> <dst-address> <syn> <bidirectional>
 #
 # Action: Required ( ACCEPT | DROP )
 # Source Interface: Optional ( interface name, aka eth0 )
 # Source Address: Optional ( IP address with optional netmask )
 # Destination Interface: Optional ( interface name, aka eth0 )
 # Destination Address: Optional ( IP address with optional netmask )
+# Syn: Optional, only match (not) syn packets (syn | notsyn )
 # Bidirectional: Optional ( yes | no, defaults to no if '-' )
 # You can use '-' for optional fields
 #============================================================
-#<action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional>
+#<action> <src-interface> <src-address> <dst-interface> <dst-address> <syn> <bidirectional>
 #ACCEPT eth0 - eth1 - yes
 #DROP eth1 2002::/64 eth0 2001::/3 no
 
diff --git a/lib/iptables.inc b/lib/iptables.inc
index 27872ca..933a827 100644
--- a/lib/iptables.inc
+++ b/lib/iptables.inc
@@ -328,7 +328,7 @@ function enable_filtering {
 			[[ ${syn} == "syn" ]] && syn="--syn"
 			[[ ${syn} == "notsyn" ]] && syn="! --syn"
 			
-			${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}"
+			${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol} ${syn}"
 			
 			# Blank variables that we're not going to use.
 			[[ ${interface} == "-" ]] && interface=""
@@ -359,11 +359,11 @@ function enable_forwarding {
 		use_conntrack="no"
 		([[ ${IP_VERSION} == "ipv4" ]] && [[ ${Enablev4ConnectionTracking} == "yes" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED"
 		([[ ${IP_VERSION} == "ipv6" ]] && [[ ${Enablev6ConnectionTracking} == "yes" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED"
-		while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional; do
+		while read -r action srcinterface srcaddress dstinterface dstaddress syn bidirectional; do
 			[[ ${action} = \#* ]] && continue
 			[[ ${action} = "" ]] && continue
 			([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \
-					&& ${display} RED "acl.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${srcaddress}" && continue
+					&& ${display} RED "forward.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${syn} ${bidirectional}" && continue
 
 			# Do some creative work with variables to make building the iptables rules fairly painless
 			([[ ${bidirectional} == "yes" ]] && [[ ${srcaddress} != "-" ]]) && revsrcaddress="-d ${srcaddress}"
@@ -374,8 +374,10 @@ function enable_forwarding {
 			[[ ${dstaddress} != "-" ]] && dstaddress="-d ${dstaddress}"
 			[[ ${srcinterface} != "-" ]] && srcinterface="-i ${srcinterface}"
 			[[ ${dstinterface} != "-" ]] && dstinterface="-o ${dstinterface}"
+			[[ ${syn} == "syn" ]] && syn="--syn"
+			[[ ${syn} == "notsyn" ]] && syn="! --syn"
 			
-			${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${srcaddress}"
+			${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${syn} ${bidirectional}"
 			
 			# Blank variables that we're not going to use.
 			[[ ${srcinterface} == "-" ]] && srcinterface=""
@@ -385,9 +387,10 @@ function enable_forwarding {
 			[[ ${bidirectional} == "-" ]] && bidirectional="no"
 			
 			[[ ${action} == "DROP" ]] && conntrack_state=""
+			[[ ${syn} == "-" ]] && syn=""
 			
-			${VER_IPTABLES} -A ${FwdFilter} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${conntrack_state} -j ${action}
-			[[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${revsrcinterface} ${revsrcaddress} ${revdstinterface} ${revdstaddress} ${conntrack_state} -j ${action}
+			${VER_IPTABLES} -A ${FwdFilter} ${srcinterface} ${srcaddress} ${syn} ${dstinterface} ${dstaddress} ${conntrack_state} -j ${action}
+			[[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${revsrcinterface} ${revsrcaddress} ${syn} ${revdstinterface} ${revdstaddress} ${conntrack_state} -j ${action}
 		done < "${FWCONFIGDIR}/ipv${IPVER}/forward.conf"
 		${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done"
 	fi