systemvm: allow related and established routed traffic

Source local main commit:
- 166bb4304f systemvm: allow related and established routed traffic

Source Apache commits:
- 1fc4cb9 Routed VR: accept packets from related and established connections (apache#12986)

Change summary:
- add an nftables ct state established,related accept rule when creating forward chains in CsNetfilter
- leave the existing input/output ICMP allowance behavior unchanged
- record Record 044 sync notes in the history document

Functional impact:
- prevents routed VR forward chains from dropping reply traffic that belongs to already established or related connections
- improves flow continuity for routed guest traffic without widening new-connection exposure

Validation:
- cherry-pick from main applied cleanly on ablestack-europa with no additional manual conflict resolution
- runtime/systemvm test execution has not been run yet in this environment by request

Author: dhslove

developer/history/apache-main-sync-2026-04-17.md

@@ -1153,6 +1153,29 @@
 - Resolution notes:
   - `N/A`
 
+### Record 044 - allow established and related traffic in routed VR forward chain
+
+- Local branch: `main`
+- Local commit: `166bb4304f`
+- Source Apache commits:
+  - `1fc4cb90bf` Routed VR: accept packets from related and established connections (#12986)
+- Summary:
+  - Add an nftables `ct state established,related accept` rule when creating `forward` chains in `CsNetfilter`
+  - Leave the existing input/output ICMP allowance behavior unchanged
+- Functional impact:
+  - Prevents routed VR forward chains from dropping reply traffic that belongs to already established or related connections
+  - Improves flow continuity for routed guest traffic without widening new-connection exposure
+- Validation:
+  - Apache cherry-pick applied cleanly on `main` with no manual conflict resolution
+  - Cached diff is limited to a 2-line `CsNetfilter.py` change in the `forward` hook path
+  - Runtime/systemvm test execution has not been run yet in this environment by request
+- Europa cherry-pick status:
+  - `Applied cleanly on ablestack-europa; local commit pending creation`
+- Conflict notes:
+  - `None observed on main`
+- Resolution notes:
+  - `N/A`
+
 ### Observed Already Satisfied
 
 - `8608b4edd0` `Fix snapshot copy resource limit concurrency`

systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py

@@ -244,6 +244,8 @@ def add_ip4_chain(self, address_family, table, chain, hook, action):
         CsHelper.execute("nft add chain %s %s %s '{ %s }'" % (address_family, table, chain, chain_policy))
         if hook == "input" or hook == "output":
             CsHelper.execute("nft add rule %s %s %s icmp type { echo-request, echo-reply } accept" % (address_family, table, chain))
+        elif hook == "forward":
+            CsHelper.execute("nft add rule %s %s %s ct state established,related accept" % (address_family, table, chain))
 
     def apply_nft_ipv4_rules(self, rules, type):
         if len(rules) == 0: