As long as the conntrack entry exists (30 timeout for icmp (ping)), the nat table isn't used anymore. It's just short-circuited by the conntrack entry.
You can inspect this behaviour in realtime with
conntrack -E (install the conntrack package if you don't have the command). Every
[NEW] entry means a new flow appeared and the nat table was read once. Then it's not used anymore.
To remove this remaining entry, use
conntrack -D [...] . Check the manual. So for example after removing the MASQUERADE rule while having a ping to 220.127.116.11 still working, doing:
conntrack -D --orig-dst 18.104.22.168
should derail this ping. Beware, your internal IP will leak to internet (until it's blocked by a router not liking a non-routable source ip on internet).
Other way to kill the connection without removing the MASQUERADE rule:
Note that NAT isn't intended for firewalling. That using NAT usually protects like a firewall is just a side effect. You should use the filter table to prevent traffic.
Very early in the FORWARD chain, and if it exists, before the usual
-m conntrack --state ESTABLISHED -j ACCEPT put (a jump to) a new chain called for example blacklist. In this chain simply insert any rule that will match the current connection you want to kill, be it a specific source ip, destination ip, port, ... You can also make use of the
set module and the
ipset command. See the example in
man iptables-extensions :
iptables -A FORWARD -m set --match-set test src,dst just put it in the blacklist chain instead and add a