Re: Deleting subnet range from conntrack

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Steve,

On Tue, Jan 08, 2013 at 01:56:48PM +1100, Steve (Telsat Broadband) wrote:
> Hi All,
> 
> As part of a walled gateway I have written, the gateway is listening on both
> TCP and UDP for incoming connections.  For TCP, the connection is picked up
> and authenticated and allowed to proceed through the gateway; this all
> appears to work normally; however, under UDP, the unauthenticated data is
> sent to the auth processing listener via a NAT 'REDIRECT' command.  This
> command then authenticates the data, BUT the problem is that UDP data still
> continues to be redirected to the auth processor even after authorisation.
> 
> If have found that if I run a 'conntrack -D -s xxx.xxx.xxx.xxx' on the IP in
> question, the UDP data then flows through as expected.  The problem is, that
> for some instances, I'm needing the authorise/permit a subnet or network
> xxx.xxx.xxx.xxx/xx or and IPv6 subnet and it appears that conntrack doesn't
> support this.
> 
> Is there a way to get around this and delete conntrack entries for the
> subnet?

Unfortunately not yet. But it is doable.