Re: Dynamically adding rules - are connection tracking states maintained?

[Josh Cepek <josh.cepek@usa.net>]

[-- Attachment #1: Type: text/plain, Size: 2444 bytes --]

noa levy wrote:
> Thank you again for your response. Suppose I do want drop existing connections, but I don't want to add the "drop" rule above the "allow established" rule, for performance reasons. Does netfilter provide any API for flushing the conntrack table (all of it or specific entries)?

Not easily, and not without disrupting other active connections.  If 
conntrack support is compiled in as modules you can unload and reload 
them, but this requires that no iptables rules reference the conntrack 
module (ie: you must delete such rules first.)  Once unloaded, the 
kernel will forget the maintained state table, but this also has the 
side-effect of breaking any active sessions that were in an ESTABLISHED 
state when you deleted the rules and reset the state table.

AFAIK there is no way to manually flush the conntrack state table or 
remove specific entries.

> Will stopping the firewall completely flush these entries?
>   

That depends entirely on what the script "stopping the firewall" 
actually does, but general the answer is "no".  If it simply flushes all 
chains and removes non-standard chains, the state table will still exist 
as this support is provided by the conntrack kernel modules, not the 
iptables rules themselves.  Most scripts I've seen on any distro will 
not actually unload the conntrack modules when the firewall initscript 
is stopped, and of course this wouldn't even be possible if conntrack 
support is compiled into the kernel rather than as a module.

It sounds like you might be using the wrong tool for the job; to 
disconnect a user with an active ssh session why not look at running 
sshd processes and send a SIGTERM or SIGINT signal to the one with the 
user or users you wish to disconnect?  This strikes me as a problem best 
handled at an application level rather than a kernel level.

>
> --- On Tue, 4/29/08, Pascal Hambourg <pascal.mail@plouf.fr.eu.org> wrote:
>
>   
>> You are asking the wrong question. Iptables is a packet
>> filter, it does 
>> not filter "sessions" (or connections). As
>> already said, the conntrack 
>> table is not affected by rule deletion/insertion. So
>> whether packets 
>> belonging to existing connections are allowed or not
>> depends on the new 
>> ruleset. If the new ruleset says to ACCEPT packets in the
>> ESTABLISHED 
>> state, then established connections are still allowed.

-- 
Josh



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 197 bytes --]