Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running Proxmox 2.2 (Debian squeeze 2.6.32-11-pve)

Currently, I've added about 60 rules to iptables mangle table for blocking attacks. but when I try to add a new rule, the server stops working and is not accessible anymore (The new rule is just to block an IP and I'm not blocking myself out).

There is no special logs in /var/log/messages at the time of malfunction of the server, but I find the following error repeatedly in the messages log:

nf_conntrack: table full

I've modified /etc/sysctl.conf and increased the nf_conntrack_max number, but the problem still exists.

I was wondering is this malfunction related to number of rules in the mangle table? Is there any limitations on number of rules in this table?

I've already spent a lot of time on building an automatic firewall for my server and it is all based on mangle table.

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

nf_conntrack table doesn't contain firewall rules. It's a table for connection tracking data. You can see what's there in file /proc/net/ip_conntrack

To solve the problem with nf_conntrack limit consider this:

  1. increase net.netfilter.nf_conntrack_max and net.nf_conntrack_max in /etc/sysctl.conf
  2. disable connection tracking for certain packets using -j NOTRACK in iptables rule

Iptables doesn't have reasonable limit on number of rules, because it will be very slow even with few thousands of rules.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.