I have a LAN configuration where iptables masquerade rule is applied on the gateway to enable internet access for the machines in the LAN. Its working fine, however the existing connections are still alive even after removing the masquerade rule. eg: ping continues on the machines in the LAN even after the masquerade rule is removed. It does not work when pinged again. So existing connections are not killed on removal of the masquerade rule. The rule I added is:

iptables -A POSTROUTING -o eth0 -j MASQUERADE

Any suggestions to modify this rule / other solutions to kill the existing connections. ?

  • Looks like we need to run a program to kill the established connections – Vijay47 Oct 13 '17 at 11:40
  • Could you provide the result of the command "cat /proc/sys/net/ipv4/ip_forward". It should be equal to 0 to stuck the ip forward. – dubis Oct 13 '17 at 14:44
  • I have enabled IP forward, otherwise the traffic from the LAN interface wont be forwarded to the WAN interface. Its 1. – Vijay47 Oct 14 '17 at 16:25

As long as the conntrack entry exists (30 timeout for icmp (ping)), the nat table isn't used anymore. It's just short-circuited by the conntrack entry.

You can inspect this behaviour in realtime with conntrack -E (install the conntrack package if you don't have the command). Every [NEW] entry means a new flow appeared and the nat table was read once. Then it's not used anymore.

To remove this remaining entry, use conntrack -D [...] . Check the manual. So for example after removing the MASQUERADE rule while having a ping to still working, doing:

conntrack -D  --orig-dst

should derail this ping. Beware, your internal IP will leak to internet (until it's blocked by a router not liking a non-routable source ip on internet).

Other way to kill the connection without removing the MASQUERADE rule:

Note that NAT isn't intended for firewalling. That using NAT usually protects like a firewall is just a side effect. You should use the filter table to prevent traffic.

Very early in the FORWARD chain, and if it exists, before the usual -m conntrack --state ESTABLISHED -j ACCEPT put (a jump to) a new chain called for example blacklist. In this chain simply insert any rule that will match the current connection you want to kill, be it a specific source ip, destination ip, port, ... You can also make use of the set module and the ipset command. See the example in man iptables-extensions : iptables -A FORWARD -m set --match-set test src,dst just put it in the blacklist chain instead and add a -j DROP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.