The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
1answer
72 views

How to use conntrack to allow SIP traffic

I have the following problem: Device (eth0)----> SWITCH(trunk)+VLAN120 ---> (PC1) +VLAN200 ---> (PC2) I am able to ping from PC1 to PC2 which are in ...
0
votes
1answer
24 views

On a Linux NAT host, late duplicate segments cause connection resets

https://www.cloudshark.org/captures/6f185eb12e97 172.30.5.1 Linux vm with bridged networking, running on another server, VM has RFC1918 address only 144.76.103.194 Linux host ...
2
votes
1answer
71 views

iptables blocking some of the traffic on ports 80 and 443 when it shouldn't?

A web server I'm administering shows weird iptables denials from IPv4 addresses on destination port 443, despite HTTPS traffic being explicitly allowed. Port 80 is also allowed in the same rule, but ...
5
votes
4answers
202 views

Route IP Traffic Based on Process to Different Default Routes / Interfaces

I'm trying to determine if it is possible to selectively route IP packets from a process or process group through a specific interface while all other packets are routed through another interface. ...
1
vote
1answer
108 views

Can't get iptables working in VPS - state and conntrack not possible

I've been browsing and reading documentations all night and I can't figure out any solution... I'm trying to get iptables working on my VPS (Debian 7). But I can't get established connections ...
1
vote
2answers
36 views

See stats of data in and out of each connection to a port

I have an application listening to a port. The clients connect to it using http connection. At any given time I see around 3000 connections established. I assume not all these connections are in use ...
0
votes
0answers
39 views

Purpose of sysctrl tcp timeout unack field

Could some one let me know the purpose of sysctrl tcp timeout unack? If i modify this value from 300 t0 400, what will be the impact. /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_unacknowledged ...
0
votes
1answer
43 views

accessing ip_conntrack causes concurrency problems after yum update

I have a Centos 5.11 server, and a script I cron every 10 minutes The script is simply this #!/bin/sh FNAME=/var/www/html/cached/conntrack_count COUNT=`cat /proc/net/ip_conntrack | /usr/bin/wc -l` ...
0
votes
0answers
108 views

Ghost tcp connections: ss sees them, nothing else does

We have a strange problem. Our remote server shows over 900 connections coming from our office over port 80: # ss -n | grep ESTAB | grep $OFFICEIP | grep :80 | wc -l 935 Netstat shows a similar ...
0
votes
0answers
181 views

Does netfilter reassemble IP fragments when packet is forwarded?

IP datagram should be reassemble in the termination of the path because the fragments may arrive from different paths. I think Netfilter need to reassemble a IP datagram to inspect the whole payload ...
1
vote
1answer
141 views

Conntrack shows no result

I tried the command conntrack -L and it returns nothing when I have a ping www.google.com running. I also tried to load the module by modprobe nf_conntrack. But it still always returns conntrack ...
1
vote
1answer
4k views

How to mitigate error “kernel: nf_conntrack: table full, dropping packet”

We recently had a problem with one of our servers (Debian Squeeze) becoming unresponsive during heavy-ish load. Looking at the kernel logs, I think this is the cause: kernel: nf_conntrack: table ...
0
votes
0answers
96 views

Keepalived failover and broken pipe with NAT'd connection?

I have an active/active conntrackd setup with asymmetric routing. Which means some TCP flows can be split between 2 firewalls. i.e. outgoing packets flows out one firewall, and for the same ...
2
votes
1answer
345 views

Why is conntrackd not replicating state?

I have a problem with an active/active firewall cluster where the connection tracking state in the firewall does not seem be be being replicated. It's active/active because I have two routers ...
1
vote
0answers
249 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP ...
0
votes
1answer
661 views

Connection tracking not working in a Debian 7 OpenVZ VPS

I have a small VPS instance (used for web hosting) that runs Debian 7, and for a few weeks I have issues with my firewall and connection tracking. I had no issue for months, but without any system ...
1
vote
1answer
3k views

CentOS 6.5 Iptables conntrack module [duplicate]

I have a VPS server on which CentOS 6.5 x64 is installed. Kernel version from uname command is 2.6.18-028stab107. When I want to use iptables rate limiting like in the following command, I got the ...
2
votes
3answers
897 views

Capture first packet of established TCP connection with iptables?

I'm looking for a way to examine the first packet only of a newly established TCP connection (the first packet with actual payload, that is). Is there a way to do this with iptables? Matching ...
0
votes
1answer
244 views

iptables nat taking 30 seconds to start redirecting

I am implementing a SIP Proxy that should be able to redirect all RTP traffic between two clients that can't reach each other. To implement that, I decided to manipulate the negotiated addresses in ...
2
votes
3answers
2k views

ip_conntrack_count has way too many connections

The conntrack table on my server has over 1.2 million connections, I keep bumping up the limit but the table just continues to grow (but not monotonically -- it does go down sometimes). $ cat ...
2
votes
1answer
4k views

nf_conntrack: table full, dropping packet

Mar 24 03:29:26 kernel: [1557411.243821] TCP: time wait bucket table overflow (CT0) Mar 24 03:29:26 kernel: [1557411.243828] TCP: time wait bucket table overflow (CT0) Mar 24 03:29:26 kernel: ...
5
votes
3answers
3k views

Where is the correct place to set net.netfilter.nf_conntrack_buckets?

I'm currently trying to set net.netfilter.nf_conntrack_buckets on boot. I initially assumed that this could be done through sysctl.conf, but net.netfilter.nf_conntrack_buckets (and other ...
0
votes
2answers
358 views

yum not updating /etc/rc.d/init.d/iptables

I have been hit by the bug https://bugzilla.redhat.com/show_bug.cgi?id=493226 (restarting iptables ignores values in /etc/sysctl.conf). This bug has been fixed by RH quite a while ago. The server ...
2
votes
0answers
531 views

A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?

I'm looking for a minimal iptables ruleset for a rather high volume Nginx/Varnish reverse proxy. I'd like to close down the server, so that only ports 80 and 22 are open at all for connections from ...
2
votes
1answer
4k views

Why does nf_conntrack_count keep increasing?

I'm using Ubuntu 11.10 & nginx. My server's currently doing about 350 rps (that's the load that's coming in). I use iptables to make sure connections on certain ports are restricted only to ...
3
votes
1answer
316 views

Iproute2 tools vs conntrack tools

I have a linux box which is setup as firewall/gateway for the network. Was just wondering why ss and other iproute2 tools show much less than iptables conntrack. Is it because the router function is ...
0
votes
1answer
1k views

iptables dos limit for all ports

I know how to use limit conntrack option to allow for DoS protection. However, I want to add a protection to limit no more than say 50 connections for each port. How can I do this? Basically, I want ...
3
votes
2answers
3k views

Delete specific conntrack entries?

in a multi-ISP configuration, I'm routing and NATing specific traffic, e.g. VoIP, through specific interface - to a distinct provider. When one of the interfaces (or routes) becomes unavailable, all ...
0
votes
2answers
7k views

error: “net.ipv4.netfilter.ip_conntrack_max” is an unknown key

I have a problem on Ubuntu 10.04.3 LTS x64 with sysctl net.ipv4.netfilter.ip_conntrack_max . If I run this command on shell, I get back an error: error: net.ipv4.netfilter.ip_conntrack_max" is an ...
2
votes
1answer
1k views

Conntrack: Does deletion of conntrack entry delete the tcp connection?

I am wondering if Conntrack -D deletes the tcp connection or does it just delete the connection tracking entry? I established an ssh to my router and then deleted the entry using Conntrack -D ...
4
votes
1answer
519 views

Ubuntu HTTP latency falling into strange quantiles

I have an Ubuntu 10.10 server with plenty of RAM, bandwidth and CPU. I'm seeing a strange, repeatable pattern in the distribution of latencies when serving static files from both Apache and nginx. ...
0
votes
1answer
2k views

conntrack -L does not show any connection

I am writing a utility which will use Conntrack commands to show the connection states. I am a beginner and I wanted to play with the Conntrack before I could start my work. So, when I tried conntrack ...
1
vote
1answer
331 views

looks like conntrack utility is installed but i cannot find it

Ive been told to use the 'conntrack' utility (http://linux.die.net/man/8/conntrack) for some purpose. now as in the description writen: conntrack -L Dump the connection tracking table in ...