Re: nf-ct-list and nf-exp-delete

On Tue, 7 Oct 2025 13:10:46 +0200
Pablo Neira Ayuso <[email protected]> wrote:

> On Tue, Oct 07, 2025 at 05:15:08AM -0400, [email protected] wrote:
> > [iptables v1.8.7; old, but it's what I have.]
> > 
> > Why does 'nf-exp-delete -i [id]' *not* remove remove some conntrack entries even after being told to remove them multiple times? It deletes most entries for my purposes (if condition is met, delete conntrack entry and block the IP using ipset). Blocked IPs are DROPped on internet side, and RESET and REJECTed on the internal side. But from time to time, I see ESTABLISHED conns that don't get (can't be) deleted.
> 
> nf-exp-delete -i [id] ????

Given:
----
# nf-ct-list --tcp-state=ESTABLISHED --reply-src=10.X.X.2 -f details
tcp ESTABLISHED 188.132.249.148:57992 -> 204.111.X.X:443 10.X.X.2:443 <- 188.132.249.148:57992 mark 17488 
    id 0xf016f3da family inet refcnt 1 timeout 10m 17s <ASSURED,DNAT>
----

then:
----
nf-exp-delete -i 0xf016f3da
----
usually removes that entry from conntrack. In my experience, some entries are not, and cannot be, removed without drastic measures that would interrupt firewall operations.

N