iptables doesn't kill existing connections

[colin-scott]

We currently use iptables to create partitions between controllers. Unfortunately, iptables only disallows new connections (including new UDP packets), but it doesn't kill existing TCP connections.

Ideally we should create complete partitions.