active connections

active connections

[azeem ahmad]

hi all
i m having a problem that i m using MASQUERADING on a redhat 8.0 box with 
iptables. the problem is that when i want the users to be disconnected i 
flush iptables; the new connections dont get established but the current 
active connections dont break. like if a user is downloading msn messenger 
for example and i flush iptables, this user's connection dont break. so what 
i can do to break the active connection
please help me out
Regards
Azeem

_________________________________________________________________
Help STOP SPAM with the new MSN 8 and get 2 months FREE*  
http://join.msn.com/?page=features/junkmail

Re: active connections

[Antony Stone]

On Saturday 01 May 2004 1:43 am, azeem ahmad wrote:

> hi all
> i m having a problem that i m using MASQUERADING on a redhat 8.0 box with
> iptables. the problem is that when i want the users to be disconnected i
> flush iptables; the new connections dont get established but the current
> active connections dont break.

Indeed.   Current connections ("ESTABLISHED" in connection tracking terms) are 
handled in the background, and not by your ruleset (your rules only deal with 
the first packet of a connection).

> like if a user is downloading msn messenger
> for example and i flush iptables, this user's connection dont break. so
> what i can do to break the active connection

You would have to unload the connection tracking module (if you use modules), 
or insert a DROP rule into a mangle table in order to specifically cut off 
the connection/s.

Regards,

Antony.

-- 
Bill Gates has personally assured the Spanish Academy that he will never allow 
the upside-down question mark to disappear from Microsoft word-processing 
programs, which must be reassuring for millions of Spanish-speaking people, 
though just a piddling afterthought as far as he's concerned.

 - Lynne Truss, "Eats, Shoots and Leaves"

                                                     Please reply to the list;
                                                           please don't CC me.

Re: active connections

[Alexis]

and they will, this is conntrack :)
try unload the module and thats it



----- Original Message ----- 
From: "azeem ahmad" <azeem484@hotmail.com>
To: <netfilter@lists.netfilter.org>;
<netfilter-failover@lists.netfilter.org>
Sent: Friday, April 30, 2004 9:43 PM
Subject: active connections


> hi all
> i m having a problem that i m using MASQUERADING on a redhat 8.0 box with
> iptables. the problem is that when i want the users to be disconnected i
> flush iptables; the new connections dont get established but the current
> active connections dont break. like if a user is downloading msn messenger
> for example and i flush iptables, this user's connection dont break. so
what
> i can do to break the active connection
> please help me out
> Regards
> Azeem
>
> _________________________________________________________________
> Help STOP SPAM with the new MSN 8 and get 2 months FREE*
> http://join.msn.com/?page=features/junkmail
>
>
>

Re: active connections

[azeem ahmad]

thanks
but i m a student so i want to caputure the concept also. so please tell me 
the mystery or tell me about any tutorial about it.
Regards


>From: "Alexis" <alexis@tpys.com.ar>
>To: "netfilter" <netfilter@lists.netfilter.org>
>Subject: Re: active connections
>Date: Sat, 1 May 2004 10:02:50 -0300
>
>and they will, this is conntrack :)
>try unload the module and thats it
>
>
>
>----- Original Message -----
>From: "azeem ahmad" <azeem484@hotmail.com>
>To: <netfilter@lists.netfilter.org>;
><netfilter-failover@lists.netfilter.org>
>Sent: Friday, April 30, 2004 9:43 PM
>Subject: active connections
>
>
> > hi all
> > i m having a problem that i m using MASQUERADING on a redhat 8.0 box 
>with
> > iptables. the problem is that when i want the users to be disconnected i
> > flush iptables; the new connections dont get established but the current
> > active connections dont break. like if a user is downloading msn 
>messenger
> > for example and i flush iptables, this user's connection dont break. so
>what
> > i can do to break the active connection
> > please help me out
> > Regards
> > Azeem
> >
> > _________________________________________________________________
> > Help STOP SPAM with the new MSN 8 and get 2 months FREE*
> > http://join.msn.com/?page=features/junkmail
> >
> >
> >
>
>

_________________________________________________________________
Add photos to your e-mail with MSN 8. Get 2 months FREE*. 
http://join.msn.com/?page=features/featuredemail

Re: active connections

[Antony Stone]

On Monday 03 May 2004 4:43 pm, azeem ahmad wrote:


> > > hi all
> > > i m having a problem that i m using MASQUERADING on a redhat 8.0 box
> > > with iptables. the problem is that when i want the users to be
> > > disconnected i flush iptables; the new connections dont get established
> > > but the current active connections dont break. like if a user is
> > > downloading msn messenger for example and i flush iptables, this user's
> > > connection dont break. so what i can do to break the active connection
> > > please help me out
> >
> > From: "Alexis" <alexis@tpys.com.ar>
> >
> > and they will, this is conntrack :)
> > try unload the module and thats it
>
> thanks
> but i m a student so i want to caputure the concept also. so please tell me
> the mystery or tell me about any tutorial about it.

Current connections ("ESTABLISHED" in connection tracking terms) are 
handled in the background, and not by your ruleset (your rules only deal with 
the first packet of a connection).   Therefore changing the ruleset makes no 
difference to connections which are already established.

For more info on how netfilter's connection tracking works:

http://iptables-tutorial.frozentux.net/iptables-tutorial.html#STATEMACHINE
http://www.sns.ias.edu/~jns/security/iptables/iptables_conntrack.html

Regards,

Antony.

-- 
Behind the counter a boy with a shaven head stared vacantly into space,
a dozen spikes of microsoft protruding from the socket behind his ear.

 - William Gibson, Neuromancer (1984)

                                                     Please reply to the list;
                                                           please don't CC me.

RE: active connections

[Daniel Chemko]

>> thanks
>> but i m a student so i want to caputure the concept also. so please
>> tell me the mystery or tell me about any tutorial about it.

Just an extra step, if you flush your rules and established connections
still work, this could be because you are using SNAT to connec tto the
internet, no?

Conntrack saved entries know how to NAT to and from the source to the
destination because it is stored inside the conntrack table entry.
/proc/net/ip_conntrack is a list of the active sessions.

When you flush the NAT table, any new connections won't NAT properly
because you have removed the rule. Existing connections will already
know how to NAT the connection because its stored elsewhere.

This is the wrong way to deal with dynamic table closures. What you want
is a filter chain that explicitly drops unwanted sessions. Eventually
the sessions will timeout on their own. I haven't used them, but there
are also tools which can generate FIN/RST's on TCP connections which
basically causes a graceful shutdown of the line.

active connections

["Михаил"]

Mon, 3 May 2004 10:19:34 -0700 Daniel Chemko wrote:

>>> thanks
>>> but i m a student so i want to caputure the concept also. so please
>>> tell me the mystery or tell me about any tutorial about it.
>
>This is the wrong way to deal with dynamic table closures. What you want
>is a filter chain that explicitly drops unwanted sessions. Eventually
>the sessions will timeout on their own. I haven't used them, but there
>are also tools which can generate FIN/RST's on TCP connections which
>basically causes a graceful shutdown of the line.

Could you please name such a tools?
Or just point a direction, where I should look for it. :)