Re: Dynamically adding rules - are connection tracking states maintained?

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

noa levy a écrit :
> I still don't understand one thing though: Let's say I delete a rule
> that allows SSH traffic. There are probably many entries in the
> conntrack table for SSH sessions. Will these sessions continue to be
> allowed in, even though I have just deleted the rule that allowed SSH
> (and my default policy is DROP)? 

You are asking the wrong question. Iptables is a packet filter, it does 
not filter "sessions" (or connections). As already said, the conntrack 
table is not affected by rule deletion/insertion. So whether packets 
belonging to existing connections are allowed or not depends on the new 
ruleset. If the new ruleset says to ACCEPT packets in the ESTABLISHED 
state, then established connections are still allowed.