5

I've been working on a project that is nearly complete: to be able to kill my children's internet connections at the touch of a button. I've implemented part of the solution by basically calling:

ufw deny from IP

The threat of killing their internet works half the time, and the above works half of the remaining half. Where I run into issues are long youtube videos. It's sometimes convenient that existing connections continue, but I'd also like to have a button that would kill all existing traffic to/from the IP. This has proved much more difficult than expected.

I've tried cutter, which doesn't even seem to work on Ubuntu 14.04. I've tried tcpkill. It seems to run, but doesn't seem to do anything (I've supplied both Ethernet interfaces) and seems to want to continually run. Although my ufw is persistent, I'd rather the kill immediately is state-less and just drop all existing connections.

Conntrack sounded promising (http://conntrack-tools.netfilter.org/manual.html), and had the following:

Delete one entry, this can be used to block traffic if:

  • You have a stateful rule-set that blocks traffic in INVALID state.

  • You have set /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_loose or /proc/sys/net/netfilter/nf_conntrack_tcp_loose, depending on your kernel version, to zero.

The command

 conntrack -D -s <IP>

seems to take and show deletions of something, but the youtube video keeps humming along and I see connections reforming when I do

conntrack -L

I've done

 echo 0 > nf_conntrack_tcp_loose

and cat'ed it to make sure it stuck, but it doesn't seem to delete the connections.

I'm not 100% sure what "a stateful rule-set that blocks traffic in INVALID state" means, but I do see the follow rule

DROP       all  --  0.0.0.0/0            0.0.0.0/0            ctstate INVALID

when doing a "iptables -L -n", if that's what it references.

I've found the following:

iptables -A INPUT -s "$BLOCK_THIS_IP" -j DROP

It didn't work for me, but it's likely due to it being proceeded with a general rule to allow all traffic on the internal network, and with reordering it might work. I'd rather not mix iptables commands with ufw commands. Given that UFW has already setup the iptables to deny any new connections, setting up a drop in iptables seems redundant, and I really don't want to mix UFW with iptable commands if I can help it.

Can anyone tell me how I might use "conntrack -D" to end existing connections to/from a host, or some other way to this short of bringing the network or interface down and then back? Figuring out how to do this has been more elusive than imagined.

Thanks,

Mark

I did some more testing that I'd like to share.

First, started checking the kill with just a ssh connection. This actually turned out fairly easy. Both the tcpkill method and conntrack -D methods worked. (I also tried with nf_conntrack_tcp_loose=1 (default for my system) and confirmed that you do need to set it to 0 for the conntrack -D method to work).

I don't know how the youtube connections work, but they seem to be hard to kill. If I just call conntrack -D IP method once, it does not die. But if I setup the following loop

while sleep 1 ; do conntrack -D -s 10.42.43.25 ; done

it would eventually die.

The log was:

    conntrack v1.4.1 (conntrack-tools): 17 flow entries have been deleted.
    udp      17 10 src=___.___.43.25 dst=___.___.43.1 sport=57859 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=57859 mark=0 use=1
    tcp      6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.163.19 sport=59023 dport=80 src=___.___.163.19 dst=___.___.221.222 sport=80 dport=59023 [ASSURED] mark=0 use=1
    tcp      6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.218.3 sport=59033 dport=443 src=___.___.218.3 dst=___.___.221.222 sport=443 dport=59033 [ASSURED] mark=0 use=1
    tcp      6 102 TIME_WAIT src=___.___.43.25 dst=___.___.242.247 sport=59044 dport=443 src=___.___.242.247 dst=___.___.221.222 sport=443 dport=59044 [ASSURED] mark=0 use=1
    tcp      6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.247.248 sport=59024 dport=443 src=___.___.247.248 dst=___.___.221.222 sport=443 dport=59024 [ASSURED] mark=0 use=1
    tcp      6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59042 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59042 [ASSURED] mark=0 use=1
    udp      17 0 src=___.___.43.25 dst=___.___.43.1 sport=60775 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=60775 mark=0 use=1
    tcp      6 431980 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.78 sport=59035 dport=443 src=sss.sss.sss.78 dst=___.___.221.222 sport=443 dport=59035 [ASSURED] mark=0 use=1
    tcp      6 97 TIME_WAIT src=___.___.43.25 dst=___.___.234.25 sport=59039 dport=443 src=___.___.234.25 dst=___.___.221.222 sport=443 dport=59039 [ASSURED] mark=0 use=1
    udp      17 11 src=___.___.43.25 dst=___.___.43.1 sport=56527 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=56527 mark=0 use=1
    tcp      6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.218.110 sport=59020 dport=443 src=___.___.218.110 dst=___.___.221.222 sport=443 dport=59020 [ASSURED] mark=0 use=1
    tcp      6 431999 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59043 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59043 [ASSURED] mark=0 use=1
    tcp      6 431948 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.97 sport=59025 dport=443 src=sss.sss.sss.97 dst=___.___.221.222 sport=443 dport=59025 [ASSURED] mark=0 use=1
    udp      17 6 src=___.___.43.25 dst=___.___.43.1 sport=53498 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=53498 mark=0 use=1
    tcp      6 431988 ESTABLISHED src=___.___.43.25 dst=___.___.10.188 sport=58987 dport=5228 src=___.___.10.188 dst=___.___.221.222 sport=5228 dport=58987 [ASSURED] mark=0 use=1
    tcp      6 431999 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.138 sport=59021 dport=443 src=sss.sss.sss.138 dst=___.___.221.222 sport=443 dport=59021 [ASSURED] mark=0 use=1
    tcp      6 431979 ESTABLISHED src=___.___.43.25 dst=___.___.103.74 sport=59038 dport=443 src=___.___.103.74 dst=___.___.221.222 sport=443 dport=59038 [ASSURED] mark=0 use=1
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 2 flow entries have been deleted.
    tcp      6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59049 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59049 [ASSURED] mark=0 use=1
    tcp      6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59050 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59050 [ASSURED] mark=0 use=1
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
    tcp      6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59052 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59052 [ASSURED] mark=0 use=1
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
    tcp      6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59053 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59053 [ASSURED] mark=0 use=1
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
    conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
    tcp      6 431999 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59055 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59055 [ASSURED] mark=0 use=1
    ...
tcp      6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59089 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59089 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp      6 300 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59090 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59090 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp      6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59092 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59092 [ASSURED] mark=0 use=2
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp      6 300 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.138 sport=59094 dport=443 src=sss.sss.sss.138 dst=___.___.221.222 sport=443 dport=59094 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp      6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59095 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59095 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
... (finally dead)

So the question now is what is happening here? How are flow entries being established after I've initially deleted all the flows? What am I missing? Is there something on how this all works where I can't simply close this down with a one-shot command?

Just some more information. I've convinced myself that local buffering isn't affecting my perception what is happening. After I've done a single delete I can see amount of data in the buffer continue to grow. Also, I can take a long video and drag the youtube frame time greatly into the future well beyond the buffer water-mark and the video works at the much later date.

Chain INPUT (policy DROP)
target     prot opt source               destination         
fail2ban-ssh  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22
ufw-before-logging-input  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-before-input  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-after-input  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-after-logging-input  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-reject-input  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-track-input  all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ufw-before-logging-forward  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-before-forward  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-after-forward  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-after-logging-forward  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-reject-forward  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-track-forward  all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ufw-before-logging-output  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-before-output  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-after-output  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-after-logging-output  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-reject-output  all  --  0.0.0.0/0            0.0.0.0/0           
ufw-track-output  all  --  0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-ssh (1 references)
target     prot opt source               destination         
REJECT     all  --  116.31.116.41        0.0.0.0/0            reject-with icmp-port-unreachable
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain ufw-after-forward (1 references)
target     prot opt source               destination         

Chain ufw-after-input (1 references)
target     prot opt source               destination         
ufw-skip-to-policy-input  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:137
ufw-skip-to-policy-input  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:138
ufw-skip-to-policy-input  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:139
ufw-skip-to-policy-input  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:445
ufw-skip-to-policy-input  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:67
ufw-skip-to-policy-input  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:68
ufw-skip-to-policy-input  all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
target     prot opt source               destination         

Chain ufw-after-logging-input (1 references)
target     prot opt source               destination         
LOG        all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-output (1 references)
target     prot opt source               destination         

Chain ufw-after-output (1 references)
target     prot opt source               destination         

Chain ufw-before-forward (1 references)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 3
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 4
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 11
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 12
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 8
ufw-user-forward  all  --  0.0.0.0/0            0.0.0.0/0           

Chain ufw-before-input (1 references)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
ufw-logging-deny  all  --  0.0.0.0/0            0.0.0.0/0            ctstate INVALID
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ctstate INVALID
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 3
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 4
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 11
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 12
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 8
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
ufw-not-local  all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     udp  --  0.0.0.0/0            224.0.0.251          udp dpt:5353
ACCEPT     udp  --  0.0.0.0/0            239.255.255.250      udp dpt:1900
ufw-user-input  all  --  0.0.0.0/0            0.0.0.0/0           

Chain ufw-before-logging-forward (1 references)
target     prot opt source               destination         

Chain ufw-before-logging-input (1 references)
target     prot opt source               destination         

Chain ufw-before-logging-output (1 references)
target     prot opt source               destination         

Chain ufw-before-output (1 references)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
ufw-user-output  all  --  0.0.0.0/0            0.0.0.0/0           

Chain ufw-logging-allow (0 references)
target     prot opt source               destination         
LOG        all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "

Chain ufw-logging-deny (2 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0            ctstate INVALID limit: avg 3/min burst 10
LOG        all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-not-local (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
RETURN     all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
RETURN     all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
ufw-logging-deny  all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10
DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain ufw-reject-forward (1 references)
target     prot opt source               destination         

Chain ufw-reject-input (1 references)
target     prot opt source               destination         

Chain ufw-reject-output (1 references)
target     prot opt source               destination         

Chain ufw-skip-to-policy-forward (0 references)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain ufw-skip-to-policy-input (7 references)
target     prot opt source               destination         
DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain ufw-skip-to-policy-output (0 references)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain ufw-track-forward (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW

Chain ufw-track-input (1 references)
target     prot opt source               destination         

Chain ufw-track-output (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW

Chain ufw-user-forward (1 references)
target     prot opt source               destination         

Chain ufw-user-input (1 references)
target     prot opt source               destination         
ACCEPT     all  --  10.42.43.25          0.0.0.0/0           
ACCEPT     all  --  10.42.43.0/24        0.0.0.0/0           

Chain ufw-user-limit (0 references)
target     prot opt source               destination         
LOG        all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain ufw-user-logging-forward (0 references)
target     prot opt source               destination         

Chain ufw-user-logging-input (0 references)
target     prot opt source               destination         

Chain ufw-user-logging-output (0 references)
target     prot opt source               destination         

Chain ufw-user-output (1 references)
target     prot opt source               destination

When I change the state to turn-off a particular machine, the log change is represented in the following diff:

158c157
< ACCEPT     all  --  10.42.43.25          0.0.0.0/0
---
> DROP       all  --  10.42.43.25          0.0.0.0/0
Community
  • 1
Mark Johnson
  • 71
  • 1
  • 5
  • You could try `iptables -I` to insert at the top of the chain – Ammar Bandukwala Jun 14 '16 at 05:17
  • You do realize that the videos are buffered and the router/firewall can not go get it back from the client device? The data has been sent a while ago. It is also possible that you've set rules to allow established connections which could override your new rule. For further assistance, provide **all** your firewall rules. – Julie Pelletier Jun 14 '16 at 05:19
  • Ammar, Yeah, that's what I alluded to by reordering the rules. That may well be what I go with, but I was trying to avoid having both UFW and iptables commands adding rules. I'm really wondering if there's some stateless way of ending existing connections---as if I just reset the interface. – Mark Johnson Jun 14 '16 at 05:23
  • Julie, buffering is a possibility, but I've been testing while continually letting a video play on my phone. Unless it's buffering 10 minutes of video, I don't think that's what is going on. – Mark Johnson Jun 14 '16 at 05:27
  • Here's what my UFW status is:`To Action From -- ------ ---- Anywhere DENY 10.42.43.25 Anywhere ALLOW 10.42.43.0/24 ` – Mark Johnson Jun 14 '16 at 05:27
  • Using `conntrack -D` just delete data about connections, it does not step in TCP segment manipulation, that's why there is still connections after you've "deleted" them. You (only) delete the entry and next time a ssh segment is seen, a new entry is created. – Jeff Bencteux Jun 15 '16 at 07:16
  • @JeffBencteux So what is happening when it's used to kill a ssh connection, or execute the command long enough to take down the youtube connection? – Mark Johnson Jun 16 '16 at 02:20
  • @MarkJohnson Are you sure connections are torn down? How do you check that? – Jeff Bencteux Jun 16 '16 at 07:03
  • @MarkJohnson My bad, apparently you can but only if you remove firewall rules allowing the connection you are trying to block in the same time (see [here](http://serverfault.com/questions/328641/conntrack-does-deletion-of-conntrack-entry-delete-the-tcp-connection)). What exactly are your iptables rules? And btw does it really bother you to use iptables commands? Because UFW is just a frontend for iptables so in fine, it is the same thing. – Jeff Bencteux Jun 16 '16 at 07:17
  • @JeffBencteux, ideally I'd like to have two options: one to block new connections which is persistent, and another to just terminate existing connections which isn't (it just stops whatever is already established). conntrack -D – Mark Johnson Jun 17 '16 at 05:14
  • @JeffBencteux, ideally I'd like to have two options: one to block new connections which is persistent, and another to just terminate existing connections which isn't (it just stops whatever is already established). The issue I have to switching to a pure iptable approach is that it it doesn't give me exactly what I want: which is how to terminate existing connections? – Mark Johnson Jun 17 '16 at 05:24
  • Note, `conntrack -D` and tcpkill both work fine on ssh. It's the dang youtube traffic that is hard to kill. I tried `timeout 300 tcpkill -i eth2 host 10.42.43.25` on it, and it would stutter but somehow manage to get enough data to keep from starving its buffer. – Mark Johnson Jun 17 '16 at 05:27
  • I may switch to conntrack -D, but have it dropping flows continually for a duration, but this is a hack. The thing with the iptables is that I can setup a rule to drop the packets, but I'm guessing if I set the rule then remove it, it's not going to work. – Mark Johnson Jun 17 '16 at 05:29
  • But right now, I want to know why the heck it's so difficult to end a flow. I'm wondering now if I shut down the interface (eth2) and bring it back up, if that is enough to break the traffic. – Mark Johnson Jun 17 '16 at 05:32
  • What is sayed in the SO link I sent you is that you need to have an iptable rule allowing the trafic (e.g. the youtube one on your children laptop) first and then when connection is established, if you want to kill it you need to remove that rule (so trafic will be blocked next time you try to send a packet matching it) and then use `conntrack -D` to delete it from flow entries so next time a packet is received, it will be considered as a "new" connection and blocked by netfilter. – Jeff Bencteux Jun 17 '16 at 07:50
  • @JeffBencteux that's what I believe I'm doing---and it's not as if it's not working. If you look at the conntrack log I have above, each `conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.` line is a second of time---so for 5 seconds there are now flows and then suddenly something shows up. – Mark Johnson Jun 19 '16 at 23:01
  • But If I look at a diff of my iptable before and after I see: 158c157 < ACCEPT all -- 10.42.43.25 0.0.0.0/0 --- > DROP all -- 10.42.43.25 0.0.0.0/0 ... Let me document the behavior above where it's a bit cleaner – Mark Johnson Jun 19 '16 at 23:02
  • @JeffBencteux my reading of of the log is that I've an established rule, I've deleted it and replaced it with an explicit deny. I then delete the flow data which is sufficient to kill a ssh connection, but not for the youtube traffic it still pops up---but with enough `conntrack -D` I can kill it. It's like a zombie, and I don't know what I'm doing, so shoot it everywhere and eventually it dies--and I'm hoping someone can tell me that all I need to do is shoot it in the brain. – Mark Johnson Jun 19 '16 at 23:45
  • Wireshark is the perfect tool to see what is really going on. – user584583 Aug 24 '17 at 23:02

0 Answers0