Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is it possible to make iptables fall back to stateless filtering under load, during an attack etc, when the connection tracking tables are full and new connections are about to be dropped?

I'm aware that this would have some serious security implications, and the fallback rules should therefore be selected very conservatively. Also, NAT would unavoidably break when disabling connection tracking, but this is not an issue here (the host in question is an actual firewall).

Any solution would likely have two parts:

  • React to a full state table within iptables (That is, without parsing logs and modifying rules via a cron job or daemon)
  • Disable all or some stateful rules, or add some new, higher priority rules that accept packets before state tracking is applied

Can that be done? If not, is there a better way than detecting a table overflow via some kind of log parsing and reacting by insertion or deletion of rules, or unloading of the connection tracking module?

share|improve this question

2 Answers 2

If you're running into a full connection tracking table, then simply enlarge it.

Set the following in /etc/sysctl.conf or a file which it includes:

net.ipv4.netfilter.ip_conntrack_max = 131072

(Raise the number until you have enough space.)

On much older Linux servers, you must use the equivalent old deprecated sysctl:

net.ipv4.ip_conntrack_max = 131072

To apply the change, reboot or run:

sysctl -p
share|improve this answer
    
Are there any disadvantages (other than wasted memory) of just setting this to a massive number and forgetting about it? –  nickgrim Jan 28 '13 at 18:16
    
Not really, it just uses up some more RAM. And of course the server CPU has to be capable of handling that many connections, but that doesn't seem to be an issue here. –  Michael Hampton Jan 28 '13 at 18:17

Under high load, especially with lots of connections, yes it will begin to slow down. So going stateless is a good idea.

Sadly there is no way to fallback to stateless filtering on the fly. However, you can simply skip the states for heavy traffics: udp, port 80, ... using the NOTRACK target.

Under very high load, I would recommend to go fully stateless if possible.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.