I don't understand some basic concepts of conntrack module.
First of all, I'm sure it's enabled in my system (Ubuntu 18.04),
modinfo shows info about nf_conntrack and
/proc/modules file tells nf_conntrack is "live".
Second, I have the following test setup:
Machine A (192.168.1.2) <-----> Router Machine (192.168.1.1 & 192.168.2.1) <----> Machine B (192.168.2.2)
On Router Machine I have the following iptables rule:
iptables -t filter -A FORWARD -m set --match-set BlackListPort dst -j DROP
BlackListPort is an ipset table.
Now I establish an SSH connection from Machine A (1.2) to Machine B (2.2). After I confirm it works, I add port 22 (SSH default) to BlackListPort table.
SSH connection freezes/hangs until I remove port 22 from that ipset table.
Now the question: Since conntrack is present in my system, why SSH block is successful? SSH connection was established before port 22 was added to ipset so conntrack should just skip all packets, allowing SSH to work.