diff --git a/compat/os/linux.h b/compat/os/linux.h

index 0ff05c6..d51389b 100644

--- a/compat/os/linux.h

+++ b/compat/os/linux.h

@@ -44,6 +44,36 @@

 #include <netinet/in.h>

 #endif

+/*

+ * Netfilter header madness. (see Bug 4323)

+ *

+ * Netfilter have a history of defining their own versions of network protocol

+ * primitives without sufficient protection against the POSIX defines which are

+ * aways present in Linux.

+ *

+ * netinet/in.h must be included before any other sys header in order to properly

+ * activate include guards in <linux/libc-compat.h> the kernel maintainers added

+ * to workaround it.

+ */

+#if HAVE_NETINET_IN_H

+#include <netinet/in.h>

+#endif

+

+/*

+ * Netfilter header madness. (see Bug 4323)

+ *

+ * Netfilter have a history of defining their own versions of network protocol

+ * primitives without sufficient protection against the POSIX defines which are

+ * aways present in Linux.

+ *

+ * netinet/in.h must be included before any other sys header in order to properly

+ * activate include guards in <linux/libc-compat.h> the kernel maintainers added

+ * to workaround it.

+ */

+#if HAVE_NETINET_IN_H

+#include <netinet/in.h>

+#endif

+

 /*

  * sys/capability.h is only needed in Linux apparently.

  *