On Thu, 2012-12-13 at 01:02 -0500, Neal Murphy wrote: > Brief summary > ------------- > I want to be certain that my firewall stops all communication on a conn and > its related conns when that 'master' conn becomes prohibited or is > disconnected. I've not tried recently, but I seem to recall from past experience that it doesn't. Why not just try? Use your FTP example, start an FTP connection, prohibit the "master" FTP connection and see what happens to the related connections? It may not be the answer you want, but one way around this might be to flush the conntrack table (conntrack -F) at the relevant point in time. Andy -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
