Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do you block new incoming tcp connections on X port? Needs to be done with iptables. I actually have a working iptables command but we always reach ip_conntrack_max even when ip_conntrack_max isset at very high. There a way to do it without keeping track?

share|improve this question

If you want to block attempts to establish new sessions to a given port, but still allow packets to established sessions through, you'd need to do something like:

iptables -A INPUT -j DROP -p tcp --syn --destination-port dport

This should allow any connection initiated from the local machine, that happens to use dport as its local port number.

share|improve this answer

this should block the traffic without involving conn_track:

iptables -A INPUT -j DROP -p tcp --destination-port <your port>

connection tracking should only do its job when you specify -m state or --state in your rules.

share|improve this answer
The question was for blocking incoming TCP connections - that should have been a huge clue to filter on SYN – PP. Mar 10 '10 at 14:23
as i understand it: when you drop syn packets, there will be no connections, so you can drop every connection to the port. – Christian Mar 10 '10 at 14:50
If, for some reason, you have attempted to initiate a connection using that port number as the local port, dropping everything would drop the returning SYNACK, dropping SYN-only packets just stops non-locally-initiated packets. Admittedly, less of a problem when you have a specified destination port, but in the general case... – Vatine Mar 16 '10 at 11:29

Dropping --syn will stop new connections and there shouldn't be any half-open connections to track. In general filtering "without keeping track" is possible at the -t raw -I PREROUTING stage.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.