When i am reloading netfilter with a new ruleset that drops invalid packets

flush ruleset
ct state invalid counter log prefix "Drop input invalid " drop comment "drop invalid packets"

over ssh then the current ssh connection is lost because the established connection is regarded as invalid, probably because the conntrack entries are flushed, too. Is it possible to keep the conntrack entries (at least for the current ssh connection) and flush everything else?

OS: Ubuntu 18.04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.