port shutdown but nat flow also flowing

[zzlyzq]

Hi, guies:

Recentely, I was using vyos 1.1.17 do a basic nat routing, I used just one trunk port to split vlans, and routing traffic between some vlans.

Running with 1Mbps video streaming for about one week, I disabled the svi interface ,but the flow was also streaming.

I rebooted the vyos, and the video streaming is over.

Also, at the time we disabled the svi interface:

1. use monitor interface ethernet eth1.332 with no number to represent that there was a streaming
2. use tcpdump we could see that the streaming was there

Any body had saw the problem?

[JFL]

When a NAT rule has some translation active and you delete this rule, VyOs doesn’t delete the existing conntrack entry.

So the existing flow will continue to run. This has caused some headaches to me since it’s also true when you change a rule.

You can delete the conntack entry using sudo conntrack -D -d <destination ip>
The -D flag is for delete and -d for the destination IP

See conntack manual (sudo man conntrack) for more option

[zzlyzq]

@JFL

When a NAT rule has some translation active and you delete this rule, VyOs doesn’t delete the existing conntrack entry.

So the existing flow will continue to run. This has caused some headaches to me since it’s also true when you change a rule.

You can delete the conntack entry using sudo conntrack -D -d <destination ip>
The -D flag is for delete and -d for the destination IP

See conntack manual (sudo man conntrack) for more option

yes, you said it. Yestoday I thought the method same with you. And the solution was we should clear that manually.

Thanks body.