nf-ct-list and nf-exp-delete

[iptables v1.8.7; old, but it's what I have.]

Why does 'nf-exp-delete -i [id]' *not* remove remove some conntrack entries even after being told to remove them multiple times? It deletes most entries for my purposes (if condition is met, delete conntrack entry and block the IP using ipset). Blocked IPs are DROPped on internet side, and RESET and REJECTed on the internal side. But from time to time, I see ESTABLISHED conns that don't get (can't be) deleted.

Quoted 3 lines · On Tue, Oct 07, 2025 at 05:15:08AM -0400, [email protected] wrote:

[iptables v1.8.7; old, but it's what I have.]

Why does 'nf-exp-delete -i [id]' *not* remove remove some conntrack entries even after being told to remove them multiple times? It deletes most entries for my purposes (if condition is met, delete conntrack entry and block the IP using ipset). Blocked IPs are DROPped on internet side, and RESET and REJECTed on the internal side. But from time to time, I see ESTABLISHED conns that don't get (can't be) deleted.

nf-exp-delete -i [id] ????

Quoted 6 lines · On Tue, 7 Oct 2025 13:10:46 +0200 Pablo Neira Ayuso <[email protected]> wrote:

Quoted 3 lines · On Tue, Oct 07, 2025 at 05:15:08AM -0400, [email protected] wrote:

[iptables v1.8.7; old, but it's what I have.]

Why does 'nf-exp-delete -i [id]' *not* remove remove some conntrack entries even after being told to remove them multiple times? It deletes most entries for my purposes (if condition is met, delete conntrack entry and block the IP using ipset). Blocked IPs are DROPped on internet side, and RESET and REJECTed on the internal side. But from time to time, I see ESTABLISHED conns that don't get (can't be) deleted.

nf-exp-delete -i [id] ????

Given:
----

# nf-ct-list --tcp-state=ESTABLISHED --reply-src=10.X.X.2 -f details
tcp ESTABLISHED 188.132.249.148:57992 -> 204.111.X.X:443 10.X.X.2:443 <- 188.132.249.148:57992 mark 17488 
    id 0xf016f3da family inet refcnt 1 timeout 10m 17s <ASSURED,DNAT>
----

then:
----
nf-exp-delete -i 0xf016f3da
----
usually removes that entry from conntrack. In my experience, some entries are not, and cannot be, removed without drastic measures that would interrupt firewall operations.

Quoted 17 lines · On Tue, Oct 07, 2025 at 06:45:31PM -0400, [email protected] wrote:

Quoted 6 lines · On Tue, 7 Oct 2025 13:10:46 +0200 Pablo Neira Ayuso <[email protected]> wrote:

Quoted 3 lines · On Tue, Oct 07, 2025 at 05:15:08AM -0400, [email protected] wrote:

[iptables v1.8.7; old, but it's what I have.]

Why does 'nf-exp-delete -i [id]' *not* remove remove some conntrack entries even after being told to remove them multiple times? It deletes most entries for my purposes (if condition is met, delete conntrack entry and block the IP using ipset). Blocked IPs are DROPped on internet side, and RESET and REJECTed on the internal side. But from time to time, I see ESTABLISHED conns that don't get (can't be) deleted.

nf-exp-delete -i [id] ????

Given:
----

# nf-ct-list --tcp-state=ESTABLISHED --reply-src=10.X.X.2 -f details
tcp ESTABLISHED 188.132.249.148:57992 -> 204.111.X.X:443 10.X.X.2:443 <- 188.132.249.148:57992 mark 17488 
    id 0xf016f3da family inet refcnt 1 timeout 10m 17s <ASSURED,DNAT>
----

Quoted 5 lines

then:
----
nf-exp-delete -i 0xf016f3da
----
usually removes that entry from conntrack. In my experience, some entries are not, and cannot be, removed without drastic measures that would interrupt firewall operations.

Where are these tools in the git netfilter.org repository ?

And how does this relate to iptables v1.8.7 as you claim ?