When i am reloading netfilter with a new ruleset that drops invalid packets
flush ruleset ... ct state invalid counter log prefix "Drop input invalid " drop comment "drop invalid packets" ...
over ssh then the current ssh connection is lost because the established connection is regarded as invalid, probably because the conntrack entries are flushed, too. Is it possible to keep the conntrack entries (at least for the current ssh connection) and flush everything else?
OS: Ubuntu 18.04