4

During load testing my server is dropping packets due to "connection tracking" way before it's running out of resources. I'm using Ubuntu Jaunty with ufw. In my syslog I get:

ip_conntrack: table full, dropping packet.

I looked at upping the max connection table size, but I don't know of an advantage for tracking these connections on these ports. I would like to know how to use ufw to tell it not to track requests to port 80 and 443.

Clarifying

  • No natting needed, it's just a web server.

Thank you.

3 Answers 3

0

Connection tracking is an on/off switch, you cannot selectively disable it for some kind of traffic. You should increase the number of connections tracked via varius nf_conntrack_max options under /proc/sys/net. You can also consider enabling syncookies to reduce congestion effects.

Edit: It seems that iptables with -j NOTRACK allows you to disable connection tracking selectively.

3
  • How would I disable it completely?
    – reconbot
    Aug 26, 2009 at 15:25
  • You can rmmod the nf_conntrack module after flushing firewall rules.
    – hayalci
    Aug 26, 2009 at 19:35
  • 2
    That is partially incorrect. You can disable it for certain interfaces or ports using iptables, see below. May 4, 2012 at 22:57
4
iptables -A PREROUTING -p tcp --dport 80 -j NOTRACK 
iptables -A PREROUTING -p tcp --dport 443 -j NOTRACK 

will disable connection tracking just for these ports.

1
  • 1
    On an Ubuntu 10.04 server, that errored out, but this did work: iptables -t raw -A PREROUTING -i lo -j NOTRACK May 4, 2012 at 22:55
-1

Do you NAT? I believe without ip_conntrack you can't NAT.

1
  • I don't use nat - just a web server
    – reconbot
    Jul 21, 2009 at 19:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .