How do I tear down an active tcp/udp session thru my firewall

drokmed · 04-10-2008, 03:12 PM

Hi,

I have somebody running a myspace client on their workstation. I have already blocked the destination IP addresses for myspace, but the user doesn't turn off his computer, leaving his myspace session active.

The firewall is:

Debian Etch
iptables (shorewall)

The session shows up on ntop.

I can't reboot the firewall, there is too much traffic going through.

Thanks for reading

beadyallen · 04-10-2008, 03:41 PM

There's probably a better solution, but could you temporarily insert a rule in the firewall to block ALL the traffic coming from and going to the client on the specific port? If you inserted it before the ACCEPT all related/established rule, that should kill it off. You can then delete it when the connection's been broken. No need to flush the firewall.
I'd also be interested to learn how to kill a specific connection directly though.

drokmed · 04-10-2008, 03:55 PM

LOL that worked

I walked by and heard him complaining LOL

I'd still like to know if there is a better way of tearing down sessions, if anyone knows.

beadyallen · 04-10-2008, 03:59 PM

Glad it helped. Sometimes a 'quick fix' solution is the best.

win32sux · 04-10-2008, 04:59 PM

Quote:

Originally Posted by drokmed

I'd still like to know if there is a better way of tearing down sessions, if anyone knows.

Have a look at Cutter - it's part of Debian.

EDIT: BTW, I just noticed you were also asking about UDP. Just wanted to point-out that since UDP is connectionless, an iptables filtering approach would probably be just fine for it. There isn't any actual connection to "cut".

drokmed · 04-11-2008, 11:23 AM

Thanks for cutter, didn't know about that one.

Is there a way to LIST active tcp connections from the command line? Right now, I'm using ntop to list them from a web browser.

btw lol yeah no such thing as tearing down udp connections, just block them

edit: netstat -nt looks closest I can get to it.

win32sux · 04-11-2008, 11:25 AM

Quote:

Originally Posted by drokmed

Is there a way to LIST active tcp connections from the command line?

Well, I just use netstat.

drokmed · 04-11-2008, 11:32 AM

netstat -nt | grep EST

Includes local to local, want to get rid of those, just show routed.

win32sux · 04-11-2008, 11:57 AM

Quote:

Originally Posted by drokmed

netstat -nt | grep EST

Includes local to local, want to get rid of those, just show routed.

I'm sure if you read through the man page you can find the options to show only the routed ones.

But if you want a quicker way maybe apt-get install netstat-nat.

drokmed · 04-11-2008, 12:07 PM

Quote:

Originally Posted by win32sux

But if you want a quicker way maybe apt-get install netstat-nat.

NICE!!!

Didn't know that one either... thanks!