The two firewall filters should help.
Although if your firewall filter rules are following the default filter rules set, then there's already a rule
add action=fasttrack-connection chain=forward connection-state=established,related
which should do the trick a few packets later than the pair of rules you presented. Performance-wise shouldn't be much difference but the default rule still gives you possibility to selectively allow connections (using other filter rules placed below this one) between subnets while your pair of rules explicitly allow just everything.
You need to be aware of couple of facts:
- in addition to the action=fasttrack-connection rules you still need matching action=accept rules ... not all fast-tracked packets are really fast-tracked, some of them still travel the "slow path" through rules. If a matching "slow rule" is missing, then those packets might get dropped causing the connections to stall occasionally (if not break)
- firewall filter rules (in "slow path") get evaluated in sequence from top to bottom (until matching rule is found). Hence the rules which match the most packets should be placed higher on the list. And the more specific rules have to be higher than the more general rules (if the action is not the same that is).
