为什么我用iptables无法断掉已产生的连接？

setsuna

比如内网机器10.0.2.1正在通过http来下载qq软件安装包，我这时在linux网关上执行iptables -A FORWARD -s 10.0.2.1/32 -p tcp -m iprange --dst-range 0.0.0.0-255.255.255.255 -m tcp --dport 80 -j REJECT --reject-with tcp-reset，但是下载仍然在继续，只是无法打开新的http连接了。

[root@ filter]# iptables-save
# Generated by iptables-save v1.4.0 on Wed Dec 15 10:14:38 2010
*mangle
:PREROUTING ACCEPT [5048491:1449612366]
:INPUT ACCEPT [3414226:510070692]
:FORWARD ACCEPT [1628685:939153327]
:OUTPUT ACCEPT [3076193:510680838]
:POSTROUTING ACCEPT [4700444:1449616838]
COMMIT
# Completed on Wed Dec 15 10:14:38 2010
# Generated by iptables-save v1.4.0 on Wed Dec 15 10:14:38 2010
*nat
:PREROUTING ACCEPT [56832:4509466]
:POSTROUTING ACCEPT [84892:6069069]
:OUTPUT ACCEPT [35634:2213429]
COMMIT
# Completed on Wed Dec 15 10:14:38 2010
# Generated by iptables-save v1.4.0 on Wed Dec 15 10:14:38 2010
*filter
:INPUT ACCEPT [3414234:510071252]
:FORWARD ACCEPT [167156:11723377]
:OUTPUT ACCEPT [3076184:510679386]
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.0.2.1/32 -p tcp -m iprange --dst-range 0.0.0.0-255.255.255.255 -m tcp --dport 80 -j REJECT --reject-with tcp-reset
-A FORWARD -s 10.0.2.1/32 -p tcp -m iprange --dst-range 0.0.0.0-255.255.255.255 -m tcp --dport 80 -j REJECT --reject-with tcp-reset
COMMIT


请问，我怎么样才能断开这个已产生的http连接？非常感谢！！

setsuna

回复 1# setsuna


   

知道了，问题出在我是-A，应该-I直接insert到最前面

vermouth

-L 看看，记得是从上往下生效的。