The consensus seems to be that there is (or needs to be) a fix in debian. A rule could be put in /etc/sysconfig/scripts/SuSEfirewall2-custom to address this issue.