How do you block new incoming tcp connections on X port? Needs to be done with iptables. I actually have a working iptables command but we always reach ip_conntrack_max even when ip_conntrack_max isset at very high. There a way to do it without keeping track?
If you want to block attempts to establish new sessions to a given port, but still allow packets to established sessions through, you'd need to do something like:
iptables -A INPUT -j DROP -p tcp --syn --destination-port dport
This should allow any connection initiated from the local machine, that happens to use dport as its local port number.
this should block the traffic without involving conn_track:
iptables -A INPUT -j DROP -p tcp --destination-port <your port>
connection tracking should only do its job when you specify
-m state or
--state in your rules.
Dropping --syn will stop new connections and there shouldn't be any half-open connections to track. In general filtering "without keeping track" is possible at the
-t raw -I PREROUTING stage.
You could accept everything other than SYN packets. One way to do it would be:
iptables -A INPUT -p tcp '!' --syn --destination-port <your-port> -j ACCEPT