0
votes
1answer
112 views

Limiting outgoing connections by port to control nf_conntrack usage

I would like to make my system more resilient against certain failure. When the system makes rapid outbound TCP connections fail, the nf_conntrack table fills up with TIME_WAIT entries. This ...
0
votes
0answers
428 views

iptables/netfilter (nf_ct_ftp) drops ftp packets

I have a strange problem. netfilter (the module nf_ct_ftp) drops packet from one of my ftp client. But it happens only with this client (91.xxx.xxx.170), all others clients (about 100) are working ...
3
votes
1answer
216 views

What does nf_conntrack.acct really do?

I've found the kernel parameter nf_conntrack.acct interesting, in that the kernel documentation merely says "Enable connection tracking flow accounting". I've appended this to grub and rebooted and I ...
2
votes
0answers
363 views

A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?

I'm looking for a minimal iptables ruleset for a rather high volume Nginx/Varnish reverse proxy. I'd like to close down the server, so that only ports 80 and 22 are open at all for connections from ...