-m conntrack is the key here:
conntrack match v1.2.9 options:
[!] --ctstate
[INVALID|ESTABLISHED|NEW|RELATED|UNTRACKED|SNAT|DNAT][,...]
State(s) to match
[!] --ctproto proto Protocol to match; by number or name,
eg. `tcp'
--ctorigsrc [!] address[/mask]
Original source specification
--ctorigdst [!] address[/mask]
Original destination specification
--ctreplsrc [!] address[/mask]
Reply source specification
--ctrepldst [!] address[/mask]
Reply destination specification
[!] --ctstatus [NONE|EXPECTED|SEEN_REPLY|ASSURED|CONFIRMED][,...]
Status(es) to match
[!] --ctexpire time[:time] Match remaining lifetime in seconds
against
value or range of values (inclusive)
