Re: iptables - drop ESTABLISHED connection

I don't think you can use iptables to kill a connection with a fin or rst. 
You could start dropping the connection once it's there by putting an 
explicit drop rule in the forward table, but then you'd need to take it out 
again.

There's a whole discussion on this topic at
http://www.lowth.com/cutter/"TCP/IP Connection cutting on Linux
Firewalls and Routers"


On 9/1/05, roderick tapang <retapang@gmail.com> wrote:
> hi,
>
> forgive me if this is OT for this list. :)
> i've been struggling for this since yesterday: how do i disconnect an
> ESTABLISHED connection (say an ssh session) using iptables? here's
> from ip_conntrack:
>
> tcp 6 431998 ESTABLISHED src=172.23.8.38 <http://172.23.8.38> dst=
> 172.23.229.200 <http://172.23.229.200>
> sport=41824 dport=22 packets=10 bytes=856 
> src=172.23.229.200<http://172.23.229.200>
> dst=172.23.8.38 <http://172.23.8.38> sport=22 dport=41824 packets=7 
> bytes=700 [ASSURED]
> use=1
>
> i can do this:
>
> netstat -patun | grep 172.23.8.38 <http://172.23.8.38>
>
> and then kill the PID. but i need a *graceful* way of doing it.
> its in the PREROUTING is it possible to send a FIN packet to that
> connection? or an RST maybe (which has the shortest timeout).
>
> tia.
>
> erik
> --
> roderick e. tapang, nclp
> retapang at gmail dot com
>
> (o_.' http://counter.li.org/
> //\ ----------------------
> V_/_ Linux User # 253842