Re: nf-ct-list and nf-exp-delete
Pablo Neira Ayuso <[email protected]> Tue, 7 Oct 2025 13:10:46 +0200
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <aOT1NhYSS65KwwJD@calendula> |
On Tue, Oct 07, 2025 at 05:15:08AM -0400, [email protected] wrote: > [iptables v1.8.7; old, but it's what I have.] > > Why does 'nf-exp-delete -i [id]' *not* remove remove some conntrack entries even after being told to remove them multiple times? It deletes most entries for my purposes (if condition is met, delete conntrack entry and block the IP using ipset). Blocked IPs are DROPped on internet side, and RESET and REJECTed on the internal side. But from time to time, I see ESTABLISHED conns that don't get (can't be) deleted. nf-exp-delete -i [id] ????