diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index 7a911ec..6ebd5d7 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -26,6 +26,7 @@ struct netns_ct {
 	int			sysctl_tstamp;
 	int			sysctl_checksum;
 	unsigned int		sysctl_log_invalid; /* Log invalid packets */
+	int			sysctl_conntrack_enable;
 #ifdef CONFIG_SYSCTL
 	struct ctl_table_header	*sysctl_header;
 	struct ctl_table_header	*acct_sysctl_header;
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
index 9bb1b8a..3b12ba0 100644
--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
+++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
@@ -74,6 +74,22 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
 		return NF_ACCEPT;
 
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+	{
+		const struct net_device *dev = (hooknum == NF_INET_LOCAL_OUT ?
+						out : in);
+
+		/* Conntrack and defrag disabled ? */
+		if (!dev_net(dev)->ct.sysctl_conntrack_enable) {
+			if (!skb->nfct) {
+				/* Attach fake conntrack entry as in NOTRACK */
+				skb->nfct = &nf_ct_untracked_get()->ct_general;
+				skb->nfctinfo = IP_CT_NEW;
+				nf_conntrack_get(skb->nfct);
+				return NF_ACCEPT;
+			} else
+				return NF_ACCEPT;
+		}
+	}
 #if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE)
 	/* Previously seen (loopback)?  Ignore.  Do this before
 	   fragment check. */
diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
index cdd6d04..cdc8d83 100644
--- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
+++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
@@ -61,7 +61,19 @@ static unsigned int ipv6_defrag(unsigned int hooknum,
 	struct sk_buff *reasm;
 
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
-	/* Previously seen (loopback)?	*/
+	/* Check for no defrag options */
+	const struct net_device *dev = (hooknum == NF_INET_LOCAL_OUT ?
+					out : in);
+
+	/* Conntrack and defrag disabled ? */
+	if (!dev_net(dev)->ct.sysctl_conntrack_enable && !skb->nfct) {
+		/* Attach fake conntrack entry as in NOTRACK */
+		skb->nfct = &nf_ct_untracked_get()->ct_general;
+		skb->nfctinfo = IP_CT_NEW;
+		nf_conntrack_get(skb->nfct);
+		return NF_ACCEPT;
+	}
+	/* Previously seen (loopback)? OR conntrack disabled */
 	if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct))
 		return NF_ACCEPT;
 #endif
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e875f89..f42880c 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -892,6 +892,13 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
 			return NF_ACCEPT;
 		}
 		skb->nfct = NULL;
+	} /* Conntrack disabled ? */
+	else if (!net->ct.sysctl_conntrack_enable) {
+		/* Attach fake conntrack entry as in NOTRACK */
+		skb->nfct = &nf_ct_untracked_get()->ct_general;
+		skb->nfctinfo = IP_CT_NEW;
+		nf_conntrack_get(skb->nfct);
+		return NF_ACCEPT;
 	}
 
 	/* rcu_read_lock()ed by nf_hook_slow */
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 885f5ab..2dd058e 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -446,6 +446,13 @@ static ctl_table nf_ct_sysctl_table[] = {
 		.extra2		= &log_invalid_proto_max,
 	},
 	{
+		.procname	= "nf_conntrack_enable",
+		.data		= &init_net.ct.sysctl_conntrack_enable,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec,
+	},
+	{
 		.procname	= "nf_conntrack_expect_max",
 		.data		= &nf_ct_expect_max,
 		.maxlen		= sizeof(int),
@@ -493,6 +500,7 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
 	table[2].data = &net->ct.htable_size;
 	table[3].data = &net->ct.sysctl_checksum;
 	table[4].data = &net->ct.sysctl_log_invalid;
+	table[5].data = &net->ct.sysctl_conntrack_enable;
 
 	net->ct.sysctl_header = register_net_sysctl_table(net,
 					nf_net_netfilter_sysctl_path, table);
@@ -544,6 +552,7 @@ static int nf_conntrack_net_init(struct net *net)
 		goto out_proc;
 	net->ct.sysctl_checksum = 1;
 	net->ct.sysctl_log_invalid = 0;
+	net->ct.sysctl_conntrack_enable = 1;
 	ret = nf_conntrack_standalone_init_sysctl(net);
 	if (ret < 0)
 		goto out_sysctl;
