From 7a12625004d261bcd292a75b036522f12840c027 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 10 May 2010 01:10:09 +0200 Subject: doc: description on how to block traffic with conntrack was incomplete This patch completes the documentation with the following discussion that took place in the mailing list. http://marc.info/?l=netfilter&m=127335152521674&w=2 Signed-off-by: Pablo Neira Ayuso --- doc/manual/conntrack-tools.tmpl | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'doc/manual') diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index b897318..c3e8682 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -19,7 +19,7 @@ - 2008 + 2008-2010 Pablo Neira Ayuso @@ -198,7 +198,12 @@ conntrack v0.9.7 (conntrack-tools): 1 flow entries have been shown. conntrack v0.9.7 (conntrack-tools): 1 flow entries has been updated. -Delete one entry, this can be used to block traffic (you have to set /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal to zero). +Delete one entry, this can be used to block traffic if: + + You have a stateful rule-set that blocks traffic in INVALID state. + You have set /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_loose or /proc/sys/net/netfilter/nf_conntrack_tcp_loose, depending on your kernel version, to zero. + + # conntrack -D -p tcp --dport 3486 tcp 6 431982 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=34846 dport=993 packets=169 bytes=14322 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=34846 packets=113 bytes=34787 [ASSURED] mark=1 secmark=0 use=1 -- cgit v1.2.3