nf-ct-list and nf-exp-delete

nf-ct-list and nf-exp-delete

[imnozi]

[iptables v1.8.7; old, but it's what I have.]

Why does 'nf-exp-delete -i [id]' *not* remove remove some conntrack entries even after being told to remove them multiple times? It deletes most entries for my purposes (if condition is met, delete conntrack entry and block the IP using ipset). Blocked IPs are DROPped on internet side, and RESET and REJECTed on the internal side. But from time to time, I see ESTABLISHED conns that don't get (can't be) deleted.

Thanks,
Neal

Re: nf-ct-list and nf-exp-delete

[Pablo Neira Ayuso]

On Tue, Oct 07, 2025 at 05:15:08AM -0400, imnozi@gmail.com wrote:
> [iptables v1.8.7; old, but it's what I have.]
> 
> Why does 'nf-exp-delete -i [id]' *not* remove remove some conntrack entries even after being told to remove them multiple times? It deletes most entries for my purposes (if condition is met, delete conntrack entry and block the IP using ipset). Blocked IPs are DROPped on internet side, and RESET and REJECTed on the internal side. But from time to time, I see ESTABLISHED conns that don't get (can't be) deleted.

nf-exp-delete -i [id] ????

Re: nf-ct-list and nf-exp-delete

[imnozi]

On Tue, 7 Oct 2025 13:10:46 +0200
Pablo Neira Ayuso <pablo@netfilter.org> wrote:

> On Tue, Oct 07, 2025 at 05:15:08AM -0400, imnozi@gmail.com wrote:
> > [iptables v1.8.7; old, but it's what I have.]
> > 
> > Why does 'nf-exp-delete -i [id]' *not* remove remove some conntrack entries even after being told to remove them multiple times? It deletes most entries for my purposes (if condition is met, delete conntrack entry and block the IP using ipset). Blocked IPs are DROPped on internet side, and RESET and REJECTed on the internal side. But from time to time, I see ESTABLISHED conns that don't get (can't be) deleted.
> 
> nf-exp-delete -i [id] ????

Given:
----
# nf-ct-list --tcp-state=ESTABLISHED --reply-src=10.X.X.2 -f details
tcp ESTABLISHED 188.132.249.148:57992 -> 204.111.X.X:443 10.X.X.2:443 <- 188.132.249.148:57992 mark 17488 
    id 0xf016f3da family inet refcnt 1 timeout 10m 17s <ASSURED,DNAT>
----

then:
----
nf-exp-delete -i 0xf016f3da
----
usually removes that entry from conntrack. In my experience, some entries are not, and cannot be, removed without drastic measures that would interrupt firewall operations.

N

Re: nf-ct-list and nf-exp-delete

[Pablo Neira Ayuso]

On Tue, Oct 07, 2025 at 06:45:31PM -0400, imnozi@gmail.com wrote:
> On Tue, 7 Oct 2025 13:10:46 +0200
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> 
> > On Tue, Oct 07, 2025 at 05:15:08AM -0400, imnozi@gmail.com wrote:
> > > [iptables v1.8.7; old, but it's what I have.]
> > > 
> > > Why does 'nf-exp-delete -i [id]' *not* remove remove some conntrack entries even after being told to remove them multiple times? It deletes most entries for my purposes (if condition is met, delete conntrack entry and block the IP using ipset). Blocked IPs are DROPped on internet side, and RESET and REJECTed on the internal side. But from time to time, I see ESTABLISHED conns that don't get (can't be) deleted.
> > 
> > nf-exp-delete -i [id] ????
> 
> Given:
> ----
> # nf-ct-list --tcp-state=ESTABLISHED --reply-src=10.X.X.2 -f details
> tcp ESTABLISHED 188.132.249.148:57992 -> 204.111.X.X:443 10.X.X.2:443 <- 188.132.249.148:57992 mark 17488 
>     id 0xf016f3da family inet refcnt 1 timeout 10m 17s <ASSURED,DNAT>
> ----
> 
> then:
> ----
> nf-exp-delete -i 0xf016f3da
> ----
> usually removes that entry from conntrack. In my experience, some entries are not, and cannot be, removed without drastic measures that would interrupt firewall operations.

Where are these tools in the git netfilter.org repository ?

And how does this relate to iptables v1.8.7 as you claim ?

Re: nf-ct-list and nf-exp-delete

[imnozi]

On Wed, 8 Oct 2025 13:50:18 +0200
Pablo Neira Ayuso <pablo@netfilter.org> wrote:

> On Tue, Oct 07, 2025 at 06:45:31PM -0400, imnozi@gmail.com wrote:
> > On Tue, 7 Oct 2025 13:10:46 +0200
> > Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> >   
> > > On Tue, Oct 07, 2025 at 05:15:08AM -0400, imnozi@gmail.com wrote:  
> > > > [iptables v1.8.7; old, but it's what I have.]
> > > > 
> > > > Why does 'nf-exp-delete -i [id]' *not* remove remove some conntrack entries even after being told to remove them multiple times? It deletes most entries for my purposes (if condition is met, delete conntrack entry and block the IP using ipset). Blocked IPs are DROPped on internet side, and RESET and REJECTed on the internal side. But from time to time, I see ESTABLISHED conns that don't get (can't be) deleted.  
> > > 
> > > nf-exp-delete -i [id] ????  
> > 
> > Given:
> > ----
> > # nf-ct-list --tcp-state=ESTABLISHED --reply-src=10.X.X.2 -f details
> > tcp ESTABLISHED 188.132.249.148:57992 -> 204.111.X.X:443 10.X.X.2:443 <- 188.132.249.148:57992 mark 17488 
> >     id 0xf016f3da family inet refcnt 1 timeout 10m 17s <ASSURED,DNAT>
> > ----
> > 
> > then:
> > ----
> > nf-exp-delete -i 0xf016f3da
> > ----
> > usually removes that entry from conntrack. In my experience, some entries are not, and cannot be, removed without drastic measures that would interrupt firewall operations.  
> 
> Where are these tools in the git netfilter.org repository ?
> 
> And how does this relate to iptables v1.8.7 as you claim ?

Sorry. My mistake. They are from the libnl package.

Please disregard.

N