> Isn't it wrong the fact of conntrack is deleting the connection tracking > after receiving the FIN packet from just one direction? So far, you did not produce a packet trace. Nobody knows whether there was only one FIN in one direction, that's just your imagination :-) Really, I won't hazard a guess to what's really going on here. Show the traces, please, starting with the SYNs. regards Patrick