noa levy wrote:
Thank you again for your response. Suppose I do want drop existing connections, but I don't want to add the "drop" rule above the "allow established" rule, for performance reasons. Does netfilter provide any API for flushing the conntrack table (all of it or specific entries)?
Not easily, and not without disrupting other active connections. If conntrack support is compiled in as modules you can unload and reload them, but this requires that no iptables rules reference the conntrack module (ie: you must delete such rules first.) Once unloaded, the kernel will forget the maintained state table, but this also has the side-effect of breaking any active sessions that were in an ESTABLISHED state when you deleted the rules and reset the state table.
AFAIK there is no way to manually flush the conntrack state table or remove specific entries.
Will stopping the firewall completely flush these entries?
That depends entirely on what the script "stopping the firewall" actually does, but general the answer is "no". If it simply flushes all chains and removes non-standard chains, the state table will still exist as this support is provided by the conntrack kernel modules, not the iptables rules themselves. Most scripts I've seen on any distro will not actually unload the conntrack modules when the firewall initscript is stopped, and of course this wouldn't even be possible if conntrack support is compiled into the kernel rather than as a module.
It sounds like you might be using the wrong tool for the job; to disconnect a user with an active ssh session why not look at running sshd processes and send a SIGTERM or SIGINT signal to the one with the user or users you wish to disconnect? This strikes me as a problem best handled at an application level rather than a kernel level.
--- On Tue, 4/29/08, Pascal Hambourg <pascal.mail@xxxxxxxxxxxxxxx> wrote:You are asking the wrong question. Iptables is a packetfilter, it does not filter "sessions" (or connections). As already said, the conntrack table is not affected by rule deletion/insertion. So whether packets belonging to existing connections are allowed or not depends on the new ruleset. If the new ruleset says to ACCEPT packets in the ESTABLISHED state, then established connections are still allowed.
-- Josh
Attachment:
signature.asc
Description: OpenPGP digital signature
