When I only allow RELATED and ESTABLISHED packets, and DROP everything else, my firewall rules work perfectly and I have no problems:### VARIANT A-A INPUT -i wlan0 -m conntrack   --ctstate RELATED,ESTABLISHED       -j ACCEPT-A INPUT -i wlan0                                                    -j   DROPHowever, I want to go a step further and blacklist any IP which has sent me an unsolicited packet. I have modified my rule:### VARIANT B-A INPUT -i wlan0 -m recent --name PORTSCAN --update --seconds 3600  -j   DROP-A INPUT -i wlan0 -m conntrack   --ctstate RELATED,ESTABLISHED       -j ACCEPT-A INPUT -i wlan0 -m recent --name PORTSCAN --set                    -j   DROPThe rules work like this:Rule 1: checks whether IP address is already blacklisted and drops it if yesRule 2: allows RELATED,ESTABLISHED packetsRule 3: all other packets which fail RELATED,ESTABLISHED test are blacklistedThese rules work as intended in 99,9% of cases, but only on few websites do I have problems. The Stack Exchange websites are one such example. It looks as if stackexchange.com is sending me packets, which the conntrack module does not recognize as related or established. Therefore, these packets do not pass rule 2, and are blacklisted by rule 3.This happens usually when I am in the editing mode (i.e. asking a question, or editing an existing question).In such case, I have to flush the blacklist:echo / >/proc/net/xt_recent/PORTSCANand then everything works again.There could be two explanations for this problem:a) the conntrack module is deficient, in that it does not recognize   legitimate packets as being RELATED/ESTABLISHEDb) SE websites are indeed sending unsolicited packetsI believe that b is more likely to be true, because of following reasoning:variant A of my iptables rules drops all packets which it does not recognize as RELATED/ESTABLISHED. Since everything works perfectly well, these packets were not needed for my session. These were indeed unsolicited packets, which were not supposed to be sent to me in the first place.The variant B of my iptables rules just goes a step further in that it punishes the offending IP and adds it to the blacklist.Q: How can I modify my iptables rules, so that it works with SE sites as well?I would also appreciate comments regarding my analysis of the problemhere is my related post on meta.unix.stackexchange.com: stackexchange.com is sending me unsolicited packets (and consequently gets blocked by firewall)
iptables: using conntrack and recent modules to block unsolicited packets
iptables;firewall;packet;netfilter