3

I have a router with openwrt. I want to temporarily cut all transit traffic without changing the router's configuration. I do this:

iptables -I FORWARD -j DROP 

New connections cannot be established now. But existing connections (even ping) continue to work. How can I make iptables stop existing connections?

3

specific versions of OpenWRT have a performance optimization enabled. This turns it off:

sysctl -w net.netfilter.nf_conntrack_skip_filter=0

http://wiki.openwrt.org/doc/uci/firewall#nf_conntrack_skip_filter

  • As stated on the provided link: "Only available in Barrier Breaker. Revoked in Chaos Calmer RC1 and onwards due to various problems.". Thus on more recent version of OpenWrt, this option is not available. If anybody knows I to perform the blocking, please share with the community. – Hans Deragon Jan 12 '18 at 2:40
  • @HansDeragon just use the command from the question – basin Jan 12 '18 at 7:16
  • root@OpenWrt:~# sysctl -w net.netfilter.nf_conntrack_skip_filter=0 sysctl: error: 'net.netfilter.nf_conntrack_skip_filter' is an unknown key – Hans Deragon Jan 12 '18 at 12:52
  • iptables -D delegate_forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT is one way, but this disabling it manually. I want the rule to be removed all the time. I want to be able to block my kids connections any the time, while keeping mine going. It seams that this is a feature missing within OpenWrt. – Hans Deragon Jan 12 '18 at 12:59
  • 1
    @HansDeragon The closest thing in the router's web UI is Network - Firewall - Traffic Rules You can create forward rules there with the Mac addresses (yours or others), set or clear the "enabled" checkbox and press "save & apply" – basin Jan 12 '18 at 17:26
-1

Try with # iptables -i FORWARD 1 -m state --state ESTABLISHED -j DROP

Updated

I have not experienced this kind scenario before, but think matching particular connection state we could achieve what you want.

Options are;

--state ESTABLISHED = connections already established,

--state NEW = consider connections going to be start

  • Can you expand on why that would work? It doesn't make sense to me. I thought the OP's command ought to causes every packet to be dropped, unconditionally, regardless of ESTABLISHED state and indeed regardless of anything else. – Celada Jul 22 '15 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.