Does iptables mangle table on debian squeeze have limitations on number of rules?

Question

I'm running Proxmox 2.2 (Debian squeeze 2.6.32-11-pve)

Currently, I've added about 60 rules to iptables mangle table for blocking attacks. but when I try to add a new rule, the server stops working and is not accessible anymore (The new rule is just to block an IP and I'm not blocking myself out).

There is no special logs in /var/log/messages at the time of malfunction of the server, but I find the following error repeatedly in the messages log:

nf_conntrack: table full

I've modified /etc/sysctl.conf and increased the nf_conntrack_max number, but the problem still exists.

I was wondering is this malfunction related to number of rules in the mangle table? Is there any limitations on number of rules in this table?

I've already spent a lot of time on building an automatic firewall for my server and it is all based on mangle table.

Answer 1

nf_conntrack table doesn't contain firewall rules. It's a table for connection tracking data. You can see what's there in file /proc/net/ip_conntrack

To solve the problem with nf_conntrack limit consider this:

1. increase net.netfilter.nf_conntrack_max and net.nf_conntrack_max in /etc/sysctl.conf
2. disable connection tracking for certain packets using -j NOTRACK in iptables rule

Iptables doesn't have reasonable limit on number of rules, because it will be very slow even with few thousands of rules.