Tagged Questions

0
votes
1answer
54 views

iptables nat taking 30 seconds to start redirecting

I am implementing a SIP Proxy that should be able to redirect all RTP traffic between two clients that can't reach each other. To implement that, I decided to manipulate the negotiated addresses in ...
0
votes
1answer
153 views

nf_conntrack: table full, dropping packet

Mar 24 03:29:26 kernel: [1557411.243821] TCP: time wait bucket table overflow (CT0) Mar 24 03:29:26 kernel: [1557411.243828] TCP: time wait bucket table overflow (CT0) Mar 24 03:29:26 kernel: ...
0
votes
2answers
104 views

netfilter ip_conntrack and (d)DoS

Does using netfilter.ip_conntrack in the kernel in anyway help mitigate (d)DoS attacks or does it make it worse? I know it adds the ability to track connections and such but just curious if it helps ...
0
votes
2answers
95 views

yum not updating /etc/rc.d/init.d/iptables

I have been hit by the bug https://bugzilla.redhat.com/show_bug.cgi?id=493226 (restarting iptables ignores values in /etc/sysctl.conf). This bug has been fixed by RH quite a while ago. The server ...
1
vote
0answers
198 views

A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?

I'm looking for a minimal iptables ruleset for a rather high volume Nginx/Varnish reverse proxy. I'd like to close down the server, so that only ports 80 and 22 are open at all for connections from ...
2
votes
1answer
838 views

Why does nf_conntrack_count keep increasing?

I'm using Ubuntu 11.10 & nginx. My server's currently doing about 350 rps (that's the load that's coming in). I use iptables to make sure connections on certain ports are restricted only to ...
3
votes
1answer
151 views

Iproute2 tools vs conntrack tools

I have a linux box which is setup as firewall/gateway for the network. Was just wondering why ss and other iproute2 tools show much less than iptables conntrack. Is it because the router function is ...
0
votes
1answer
643 views

iptables dos limit for all ports

I know how to use limit conntrack option to allow for DoS protection. However, I want to add a protection to limit no more than say 50 connections for each port. How can I do this? Basically, I want ...
1
vote
1answer
595 views

Conntrack: Does deletion of conntrack entry delete the tcp connection?

I am wondering if Conntrack -D deletes the tcp connection or does it just delete the connection tracking entry? I established an ssh to my router and then deleted the entry using Conntrack -D ...
0
votes
1answer
340 views

conntrack -L does not show any connection

I am writing a utility which will use Conntrack commands to show the connection states. I am a beginner and I wanted to play with the Conntrack before I could start my work. So, when I tried conntrack ...
1
vote
1answer
182 views

looks like conntrack utility is installed but i cannot find it

Ive been told to use the 'conntrack' utility (http://linux.die.net/man/8/conntrack) for some purpose. now as in the description writen: conntrack -L Dump the connection tracking table in ...