How do you block new incoming tcp connections on X port?
If you want to block attempts to establish new sessions to a given port, but still allow packets to established sessions through, you'd need to do something like:
iptables -A INPUT -j DROP -p tcp --syn --destination-port dport
This should allow any connection initiated from the local machine, that happens to use dport as its local port number.
this should block the traffic without involving conn_track:
iptables -A INPUT -j DROP -p tcp --destination-port <your port>
connection tracking should only do its job when you specify -m state
or --state
in your rules.