How do you block new incoming tcp connections on X port?

If you want to block attempts to establish new sessions to a given port, but still allow packets to established sessions through, you'd need to do something like:

iptables -A INPUT -j DROP -p tcp --syn --destination-port dport

This should allow any connection initiated from the local machine, that happens to use dport as its local port number.


this should block the traffic without involving conn_track:

iptables -A INPUT -j DROP -p tcp --destination-port <your port>

connection tracking should only do its job when you specify -m state or --state in your rules.