I'm running CentOS 5.3 and want to disable the nf_conntrack module to improve network performance for haproxy. I'm running iptables with some simple rules. I don't really need the connection tracking.

I'm running on Rackspace cloud servers, so I can't run a custom kernel. I've tried running modprobe, but that doesn't work.

[mmarano@w1 w1]$ sudo modprobe -n -r nf_conntrack
FATAL: Module nf_conntrack is in use.

[mmarano@w1 w1]$ uname -a
Linux w1.somewhere.com 2.6.24-23-xen #1 SMP Mon Jan 26 03:09:12 UTC 2009 x86_64 x86_64 x86_64 GNU/Linux
[mmarano@w1 w1]$ cat /etc/redhat-release 
CentOS release 5.3 (Final)

I want to continue to run iptables after ripping this out, so I can't quite ditch all of netfilters. Anyone have any thoughts?

5 Answers 5

  1. remove any reference to the state module in iptables. So, no rules like


    the state module requires the nf_conntrack (ip_conntrack) module

  2. remove the following line (if it exists) in /etc/sysconfig/iptables-config


    That module requires ip_conntrack which we are trying to ditch.

  3. reload iptables without your state rules.

    sudo iptables -F

    # add your real rules

  4. drop the modules. I had to use:

    sudo modprobe -r xt_NOTRACK nf_conntrack_netbios_ns nf_conntrack_ipv4 xt_state

    sudo modprobe -r nf_conntrack

  5. confirm you don't have a reference to /proc/net/nf_conntrack

  • 1
    HUGE thanks to Willy Tarreau, creator of haproxy, for awesome help on the haproxy mailing list!
    – user22277
    Oct 9, 2009 at 20:18
  • Does anyone know how you'd reverse step 4 if you needed to?
    – UpTheCreek
    Sep 26, 2014 at 12:16
  • When i do "modprobe -rf xt_state" and "modprobe -rf nf_conntrack_ipv6" it say "FATAL: Module xt_state is in use."(on centos), what can i do?
    – diyism
    Oct 28, 2014 at 6:13
  • On ubuntu, i can run "iptables -F" and "modprobe -rf xt_state nf_conntrack_ipv4" without any error.
    – diyism
    Oct 28, 2014 at 6:15
  • I still get modprobe: FATAL: Module nf_conntrack is in use
    – Dave
    May 4, 2022 at 22:02
  • What about adding the module to /etc/modprobe.d/blacklist.conf?

  • Have you tried:

    rmmod -f modulename


           -f --force
              This  option can be extremely dangerous: it has no effect unless
              CONFIG_MODULE_FORCE_UNLOAD was set when the kernel was compiled.
              With  this  option, you can remove modules which are being used,
              or which are not designed to be removed, or have been marked  as
              unsafe (see lsmod(8)).

If you are running Haproxy, you need two types of rules in iptables to disable conntrack in the port 80: ones for the connections from the clients to your balancer and others from your balancer to the backends.

Here is a valid example:

iptables -t raw -I PREROUTING -p tcp --dport 80 -j NOTRACK
iptables -t raw -I PREROUTING -p tcp  --sport 80 -j NOTRACK
iptables -t raw -I OUTPUT -p tcp --dport 80 -j NOTRACK
iptables -t raw -I OUTPUT -p tcp --sport 80 -j NOTRACK

When i do "modprobe -rf xt_state" and "modprobe -rf nf_conntrack_ipv6" it say "FATAL: Module xt_state is in use."(on centos).

"modused" may be useful, it can decrease the usage count of any module: http://www2.informatik.uni-freiburg.de/~danlee/fun/modused/

The key is: service ip6tables stop

and add nf_conntrack, xt_state, iptable_nat, nf_nat, nf_conntrack_ipv4, nf_conntrack_ipv6 into /etc/modprobe.d/blacklist.conf


These will completely disable connection tracking.

iptables -t raw -I PREROUTING -j NOTRACK
iptables -t raw -I OUTPUT -j NOTRACK

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .