Is it possible to make iptables fall back to stateless filtering under load, during an attack etc, when the connection tracking tables are full and new connections are about to be dropped?
I'm aware that this would have some serious security implications, and the fallback rules should therefore be selected very conservatively. Also, NAT would unavoidably break when disabling connection tracking, but this is not an issue here (the host in question is an actual firewall).
Any solution would likely have two parts:
- React to a full state table within iptables (That is, without parsing logs and modifying rules via a cron job or daemon)
- Disable all or some stateful rules, or add some new, higher priority rules that accept packets before state tracking is applied
Can that be done? If not, is there a better way than detecting a table overflow via some kind of log parsing and reacting by insertion or deletion of rules, or unloading of the connection tracking module?