Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do you block new incoming tcp connections on X port? Needs to be done with iptables. I actually have a working iptables command but we always reach ip_conntrack_max even when ip_conntrack_max isset at very high. There a way to do it without keeping track?

share|improve this question
add comment

2 Answers

If you want to block attempts to establish new sessions to a given port, but still allow packets to established sessions through, you'd need to do something like:

iptables -A INPUT -j DROP -p tcp --syn --destination-port dport

This should allow any connection initiated from the local machine, that happens to use dport as its local port number.

share|improve this answer
add comment

this should block the traffic without involving conn_track:

iptables -A INPUT -j DROP -p tcp --destination-port <your port>

connection tracking should only do its job when you specify -m state or --state in your rules.

share|improve this answer
1  
The question was for blocking incoming TCP connections - that should have been a huge clue to filter on SYN –  PP. Mar 10 '10 at 14:23
    
as i understand it: when you drop syn packets, there will be no connections, so you can drop every connection to the port. –  Christian Mar 10 '10 at 14:50
    
If, for some reason, you have attempted to initiate a connection using that port number as the local port, dropping everything would drop the returning SYNACK, dropping SYN-only packets just stops non-locally-initiated packets. Admittedly, less of a problem when you have a specified destination port, but in the general case... –  Vatine Mar 16 '10 at 11:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.