up vote 2 down vote favorite
share [g+] share [fb]

How do you block new incoming tcp connections on X port? Needs to be done with iptables. I actually have a working iptables command but we always reach ip_conntrack_max even when ip_conntrack_max isset at very high. There a way to do it without keeping track?

link|improve this question
0% accept rate
feedback

2 Answers

up vote 2 down vote

If you want to block attempts to establish new sessions to a given port, but still allow packets to established sessions through, you'd need to do something like:

iptables -A INPUT -j DROP -p tcp --syn --destination-port dport

This should allow any connection initiated from the local machine, that happens to use dport as its local port number.

link|improve this answer
feedback
up vote 1 down vote

this should block the traffic without involving conn_track:

iptables -A INPUT -j DROP -p tcp --destination-port <your port>

connection tracking should only do its job when you specify -m state or --state in your rules.

link|improve this answer
1  
The question was for blocking incoming TCP connections - that should have been a huge clue to filter on SYN – PP. Mar 10 '10 at 14:23
as i understand it: when you drop syn packets, there will be no connections, so you can drop every connection to the port. – Christian Mar 10 '10 at 14:50
If, for some reason, you have attempted to initiate a connection using that port number as the local port, dropping everything would drop the returning SYNACK, dropping SYN-only packets just stops non-locally-initiated packets. Admittedly, less of a problem when you have a specified destination port, but in the general case... – Vatine Mar 16 '10 at 11:29
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.