Many people don't clear the conntrack table when they want to reload their firewall rules. When you have some ESTABLISHED connections, all the sessions won't be affected when you add a rule that blocks some of the connections in question (in the NEW state). The only way to make sure that this isn't going to happen is to kill all the sessions by clearing the conntrack table. In this case all packets will hit the INVALID rule and you have to make a new connection, which now goes through the new rules of iptables.

In OpenWRT, you can simply do the following:

# echo f > /proc/net/nf_conntrack

But unfortunately this solution doesn't work on debian.

# echo f > /proc/net/nf_conntrack
echo: write error: Input/output error

Here's why:

# ls -al /proc/net/nf_conntrack
-r--r----- 1 root root 0 2016-06-05 10:45:52 /proc/net/nf_conntrack

On debian you have to install the conntrack package, and type the following command:

# conntrack -F
conntrack v1.4.3 (conntrack-tools): connection tracking table has been emptied.

Why echo f doesn't work on debian? Is there a way to make it work somehow, or am I forced to use the conntrack tool?

  • Same thing here, although I could swear the difference is not about it being specific to OpenWRT, but more due to the functionality not being supported in newer kernels, and/or files having different names in proc. – Rui F Ribeiro Jun 5 '16 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.