I have this on 1.890 as well. My 'uname -r' reports "4.9.0-8-amd64". The fix suggested by David of adding the '--ctstate' option to the "@known_args" array in the firewall4-lib.pl and firewall6-lib.pl files also worked for me. I added it to the files in both the firewall and firewall6 directories.