How do you block new incoming tcp connections on X port? Needs to be done with iptables. I actually have a working iptables command but we always reach ip_conntrack_max even when ip_conntrack_max isset at very high. There a way to do it without keeping track?
If you want to block attempts to establish new sessions to a given port, but still allow packets to established sessions through, you'd need to do something like:
iptables -A INPUT -j DROP -p tcp --syn --destination-port dport
This should allow any connection initiated from the local machine, that happens to use dport as its local port number.
this should block the traffic without involving conn_track:
connection tracking should only do its job when you specify