Many people don't clear the conntrack table when they want to reload their firewall rules. When you have some ESTABLISHED connections, all the sessions won't be affected when you add a rule that blocks some of the connections in question (in the NEW state). The only way to make sure that this isn't going to happen is to kill all the sessions by clearing the conntrack table. In this case all packets will hit the INVALID rule and you have to make a new connection, which now goes through the new rules of
In OpenWRT, you can simply do the following:
# echo f > /proc/net/nf_conntrack
But unfortunately this solution doesn't work on debian.
# echo f > /proc/net/nf_conntrack echo: write error: Input/output error
# ls -al /proc/net/nf_conntrack -r--r----- 1 root root 0 2016-06-05 10:45:52 /proc/net/nf_conntrack
On debian you have to install the
conntrack package, and type the following command:
# conntrack -F conntrack v1.4.3 (conntrack-tools): connection tracking table has been emptied.
echo f doesn't work on debian? Is there a way to make it work somehow, or am I forced to use the