Firewalld insert rule before ESTABLISHED

I want to ban already established connections.

Default iptables rules generated by firewalld

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j INPUT_direct

How to insert rule before -j ACCEPT ?

Or how to move INPUT_direct to top?

Or how to remove conntrack rule?

Solution 1:

You can insert an iptables rule with iptables -I parameter So if you specify iptables -I INPUT -j INPUT_direct this rule will be inserted to to top.

If you specify it with a row numer: iptables -I INPUT 2 -j INPUT_direct it will be inserted as rule in line 2.

In order to move the rule:

1. Delete it first: iptables -D INPUT -j INPUT_direct
2. Insert it to the top iptables -I INPUT -j INPUT_direct