Quick help with NOTRACK rule

Hello all,

I have a simple ruleset (for testing purposes) iam trying to exclude only the SSH service in being tracked at conntrack. I have not been able to achieve this.. iam obviously missing something?

#!/bin/bash

#### CLEANUP
/sbin/iptables -P OUTPUT ACCEPT;
/sbin/iptables -P INPUT DROP;
/sbin/iptables -P FORWARD ACCEPT;
/sbin/iptables -F;
/sbin/iptables -X;
### CLEANUP

# DEFAULT POLICIES
/sbin/iptables -P INPUT DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -P OUTPUT ACCEPT

# LOOP BACK ALLOWED
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT

#KEEP STATE BOTH INPUT / OUTPUT (STATEFULL FIREWALL) /sbin/iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT /sbin/iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

iptables -t raw -A OUTPUT -p tcp --sport 22 -j NOTRACK

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 5666 -j ACCEPT

After applying the above, and reconnecting via ssh to the machine i still see this in the table:

ipv4 2 tcp 6 185 ESTABLISHED src=221.199.62.74 dst=26.38.165.111 sport=1063 dport=22 src=26.38.165.111 dst=221.199.62.74 sport=22 dport=1063 [ASSURED] mark=0 secmark=0 use=2

I also tried adding one more rule iptables -t raw -A INPUT -p tcp --sport 22 -j NOTRACK but i get
iptables: No chain/target/match by that name.

Thanks
Alex

Hello,

Please read the iptables man page about the raw table :

It provides the following built-in chains: PREROUTING (for packets arriving via any network interface) OUTPUT (for packets generated by local processes)

Also, you want to match incoming packets with destination port 22, not source. So :

iptables -t raw -A PREROUTING -p tcp --dport 22 -j NOTRACK