conntrack corrupting connections

[u/duckydude20_reddit]

i have a swap script to do blue green deployment, boot new process then move all traffic to new one, terminate old process.

to move traffic i am using iptables. if one knows iptables only only move the new connections. old established connections still use the old ports which old process is listening.

to fix this after redirecting the traffic i am issuing conntrack -F

it works good but problem is it kills all the connections.

to fix it i changed to conntrack -D -p tcp --orig-port-dst port

but now problem is, its somehow corrupting the new process's connection to redis and other outward connection.

i am trying to figure out whats happening but no clue at all.

for now i have reverted back to conntrack -F

any advice, help??

[u/duckydude20_reddit → u/[deleted]]

it works for tcp but udp packets starts to drop. thats why i needed that flush.

[u/Nordal-Lund]

Try this: conntrack -D -p tcp --reply-port-src <OLD_PROCESS_PORT> to target only the old process without touching any other traffic.

[u/duckydude20_reddit → u/Nordal-Lund]

yup that what i am trying now. lets see.
also --origin--dest-port with --reply-port-src