5

How do you block new incoming tcp connections on X port? Needs to be done with iptables. I actually have a working iptables command but we always reach ip_conntrack_max even when ip_conntrack_max isset at very high. There a way to do it without keeping track?

5

If you want to block attempts to establish new sessions to a given port, but still allow packets to established sessions through, you'd need to do something like:

iptables -A INPUT -j DROP -p tcp --syn --destination-port dport

This should allow any connection initiated from the local machine, that happens to use dport as its local port number.

1

this should block the traffic without involving conn_track:

iptables -A INPUT -j DROP -p tcp --destination-port <your port>

connection tracking should only do its job when you specify -m state or --state in your rules.

  • 1
    The question was for blocking incoming TCP connections - that should have been a huge clue to filter on SYN – PP. Mar 10 '10 at 14:23
  • as i understand it: when you drop syn packets, there will be no connections, so you can drop every connection to the port. – Christian Mar 10 '10 at 14:50
  • If, for some reason, you have attempted to initiate a connection using that port number as the local port, dropping everything would drop the returning SYNACK, dropping SYN-only packets just stops non-locally-initiated packets. Admittedly, less of a problem when you have a specified destination port, but in the general case... – Vatine Mar 16 '10 at 11:29
0

Dropping --syn will stop new connections and there shouldn't be any half-open connections to track. In general filtering "without keeping track" is possible at the -t raw -I PREROUTING stage.

0

You could accept everything other than SYN packets. One way to do it would be:

iptables -A INPUT -p tcp '!' --syn --destination-port <your-port> -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.