The conntrack match extension doesn't handle address inversion correctly. (Tom Eastep)
diff --git a/extensions/libipt_conntrack.c b/extensions/libipt_conntrack.c
index 5521684..27870b1 100644
--- a/extensions/libipt_conntrack.c
+++ b/extensions/libipt_conntrack.c
@@ -414,8 +414,8 @@
 {
 	char buf[BUFSIZ];
 
-        if (inv)
-               	fputc('!', stdout);
+        if (inv) 
+               	printf("! ");
 
 	if (mask->s_addr == 0L && !numeric)
 		printf("%s ", "anywhere");