The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
99 views

Limiting outgoing connections by port to control nf_conntrack usage

I would like to make my system more resilient against certain failure. When the system makes rapid outbound TCP connections fail, the nf_conntrack table fills up with TIME_WAIT entries. This ...
0
votes
0answers
382 views

iptables/netfilter (nf_ct_ftp) drops ftp packets

I have a strange problem. netfilter (the module nf_ct_ftp) drops packet from one of my ftp client. But it happens only with this client (91.xxx.xxx.170), all others clients (about 100) are working ...
0
votes
1answer
161 views

Debugging HAProxy

I have tested / been testing a server cluster locally for quite a while with no problem. I have recently set my server cluster up for a live test, and I have noticed problems, and believe that the ...
3
votes
1answer
186 views

What does nf_conntrack.acct really do?

I've found the kernel parameter nf_conntrack.acct interesting, in that the kernel documentation merely says "Enable connection tracking flow accounting". I've appended this to grub and rebooted and I ...
0
votes
1answer
617 views

What is the difference between nf_conntrack_max and nf_conntrack_expect_max?

I understand what nf_conntrack_max is, but what does nf_conntrack_expect_max actually do? I haven't been able to find an explanation on this anywhere.
5
votes
3answers
1k views

Where is the correct place to set net.netfilter.nf_conntrack_buckets?

I'm currently trying to set net.netfilter.nf_conntrack_buckets on boot. I initially assumed that this could be done through sysctl.conf, but net.netfilter.nf_conntrack_buckets (and other ...
2
votes
0answers
342 views

A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?

I'm looking for a minimal iptables ruleset for a rather high volume Nginx/Varnish reverse proxy. I'd like to close down the server, so that only ports 80 and 22 are open at all for connections from ...
2
votes
2answers
963 views

nf_conntrack complaints in dmesg

While investigating complains on bad HTTP server performance, I've discovered these lines in dmesg of my Xen XCP host that contains a guest OS with said server: [11458852.811070] net_ratelimit: 321 ...