Re: iptables - drop ESTABLISHED connection

I would recommend using something like tcpkill.  It is part of the dsniff 
package.

- Chris




roderick tapang <retapang@gmail.com> 
08/31/2005 11:06 PM

To
firewalls@securityfocus.com
cc

Subject
iptables - drop ESTABLISHED connection






hi,

forgive me if this is OT for this list. :)
i've been struggling for this since yesterday: how  do i disconnect an
ESTABLISHED connection (say an ssh session) using iptables? here's
from ip_conntrack:

tcp      6 431998 ESTABLISHED src=172.23.8.38 dst=172.23.229.200
sport=41824 dport=22 packets=10 bytes=856 src=172.23.229.200
dst=172.23.8.38 sport=22 dport=41824 packets=7 bytes=700 [ASSURED]
use=1

i can do this:

netstat -patun | grep 172.23.8.38

and then kill the PID. but i need a *graceful* way of doing it.
its in the PREROUTING is it possible to send a FIN packet to that
connection? or an RST maybe (which has the shortest timeout).

tia.

erik
-- 
roderick e. tapang, nclp
retapang at gmail dot com

(o_.'       http://counter.li.org/
//\         ----------------------
V_/_        Linux User   #  253842