Comment # 3 on bug 993426 from Luiz Angelo Daros de Luca

Yes, exactly this ;)

Maybe SuSEfirewall2 should include some "helper" rule for the migration.

I fixed adding:

 iptables -t raw -A PREROUTING -p udp -d my.tftp-server.ip --dport 69 -j CT
--helper tftp

At SuSEfirewall2-custom (which I already use for other issues).