Skip to main content

Questions tagged [conntrack]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
29 views

L3-DSR real server iptables/conntrack configuration

I'm doing L3-DSR setup with a custom LB. The custom LB does DNAT with DSCP setting, though DSCP setting is not irrelevant in this question. I made a lab with some network namespaces VIP: 10.10.10.1 ...
Chul-Woong Yang's user avatar
1 vote
1 answer
41 views

How do I mark incoming iptables request from unknown MAC address with mark 99 using conntrack

I have my iptables rules running for years without incident but after allowing all trusted MAC's access by: /sbin/iptables -A INPUT -m mac --mac-source $MAC -j ACCEPT /sbin/iptables -A FORWARD -m mac -...
Cor Cool's user avatar
2 votes
2 answers
159 views

Can iptables relate the physical wireguard UDP connection to the tunneled TCP session?

I'm locking down the egress of my Linux box, making OUTPUT chain default deny. My wireguard peers are from the subnet 10.1.0.0/16. Originally I thought I can just -A OUTPUT -d 10.1.0.0/16 -j ACCEPT, ...
ron's user avatar
  • 203
0 votes
2 answers
347 views

How to apply DROP rule immediately (iptables/conntrack)

An external IP is connecting to my mailserver VM every second and I just want to block this IP immediately without dropping existing connections. So I apply a DROP rule. I even reloaded all the ...
le_top's user avatar
  • 135
1 vote
0 answers
143 views

how to allow sip traffic, from field's IP is modified by routers ip

I have the following problem: PC1 - eth0: 192.168.188.55 eth1: part of br0: 10.147.20.69 tap1: part of b0: 10.147.20.2 -> connected to PC2 on eth1: i have a trunc sip device ...
SHERIF OMRAN's user avatar
0 votes
1 answer
193 views

How can I allowing all established incoming connections without conntrack?

I want to make my iptables accepted all stablished incoming connections, but I don't have conntrack in my system so I can't run: sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT It ...
Yosef's user avatar
  • 3
0 votes
0 answers
801 views

why allowing established incoming connections doesn't work?

I am trying to allowing all established incoming connections in my iptables using this command: sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT but I get this error message: "...
Yosef's user avatar
  • 3
0 votes
0 answers
290 views

conntrack events(conntrack -E) show 0.0.0.0 as source and destination addresses

These are the logs down below. [DESTROY] udp 17 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=3 bytes=216 [UNREPLIED] src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=0 bytes=0 [NEW] udp ...
jatinBatra's user avatar
0 votes
1 answer
1k views

iptables FTP connection tracking not working

I am hoping someone can point me in the right direction here please. Running proftpd (with tls support) on a public IP. FTP client connects, but can't do a directory listing. When I change the "...
Robert Schmitt's user avatar
0 votes
1 answer
606 views

How conntrack and network namespaces works together?

Is nf_conntrack respects network namespaces? Does it creates a separate table for each network namespace based on its sysctl limits, or does it share memory (and limits) between different network ...
George Shuklin's user avatar
0 votes
3 answers
1k views

How to prevent netfilter to automatically change the source ports

I observed that netfilter changes the source port when a connection is established in the conntrack module. I need to prevent this behavior. Here is what I have done to reproduce my problem: I create ...
sebastien dontneedtoknowthat's user avatar
2 votes
1 answer
1k views

Conntrack, failed to NAT its own TCP packets from another VRF

I came across a tricky problem with source NAT when using multiple VRF on a Debian based router. It's a bit complex to explain, so I will try to be clear, but it will not be short, sorry for that. The ...
Dainii's user avatar
  • 31
0 votes
1 answer
488 views

route ipv4 to ipv6 as mechanism to overcome not owning an ipv4 block for load balancing purposes on premise k8s (none aws/gcp)

This is not a question about tunnelling, although that may be part of a solution. With public cloud providers it's trivial to request a load balancer due to providers owning large class A/B/C public ...
user885983's user avatar
1 vote
0 answers
328 views

Conntrack not showing iptables redirected flow

I have a client and server. At Server I have a redirect rule to redirect all incoming flows to port 15006. Client IP: 10.20.3.53 ServerIP : 10.20.3.63 I have the following iptables rules on the ...
Invictus's user avatar
  • 111
1 vote
0 answers
916 views

Apache keeps TCP Connection in CLOSE-WAIT state for 600 Seconds

My setup consists of two apache servers like in this diagram: |Apache | >==Reverse Proxy Connection====> |Apache | |Server1| <==Response through conntrack==< |Server2| After a successful ...
bit151's user avatar
  • 43
1 vote
0 answers
206 views

Connections not obeying conntrack

I have a tunnel set up on interface vti68. I am NATing both the source and destination. The host has 10.1.30.51 as local, and 172.16.0.80 as remote. Traffic in the tunnel is translated such that 10....
Paul Draper's user avatar
1 vote
1 answer
342 views

Persist conntrack database across reboots

I run a NAT router on Debian 10 which takes only a few seconds to reboot, way less then 120 seconds, more like 3. I'd like to keep established connections so that a reboot of the router does not break ...
bot47's user avatar
  • 327
1 vote
2 answers
674 views

Track IP Adress login RDP when shutdown happen

Today I arrived at the office of an client and the Hyper V server was turnoff. In the Windows Event log is register that the admin user has send a shutdown command. I'm not the only one that has ...
Daniel Camara's user avatar
5 votes
2 answers
18k views

When does iptable's conntrack module track states of packets?

It first needs to store states. With some old BSD firewall that I used, I guess was named IPFW, I used to put a rule that sated "keep track of the state of the leaving packet", and this was ...
caveman's user avatar
  • 153
1 vote
1 answer
399 views

Do we need conntrack for Load Balancer server?

I have 3 private dedicated server as Load balancer. And then there is IP Addr Public sign to this private dedicated server. Suddenly, one of these 3 LB servers got nf_conntrack: table full, dropping ...
3-commerce's user avatar
1 vote
0 answers
147 views

CEPH netfilter connection tracking issues

We have a CEPH cluster (Ubuntu 18.04, Luminous) for Openstack images and volumes. As I was taking it into production I found many performance issues, slow OSDs, and throughput down to a trickle; this ...
Dennis's user avatar
  • 11
1 vote
1 answer
2k views

"use" column in /proc/net/ip_conntrack or nf_conntrack?

i'd like to hack together my own little script to parse conntrack data, to get customized network information from some Linux boxes that are also NAT routers. an example of a line from the conntrack ...
Moritz von Schweinitz's user avatar
1 vote
1 answer
2k views

Linux Log all tcp new connections

On my linux host I want to get per minute logs of all the new tcp connections being created. I have multiple tap devices on my host from which various are trying to create the tcp connections. I ...
Prashant Singh's user avatar
0 votes
1 answer
872 views

dnsmasq: how to get conntrack numbers in query logs?

I´m currently working on a project (for school) to set up a program which analyses DNS-queries to be used in Docker-Swarm and Kubernetes. For testing purposes I received some (supposedly dnsmasq) logs....
MasseGiraffe425's user avatar
1 vote
2 answers
1k views

IPtables blocking SSH only if using conntrack

Error As you can see, the only difference between the working and the not working configuration is -m conntrack --ctstate NEW,ESTABLISHED,RELATED. If I use -m conntrack --ctstate NEW,ESTABLISHED it ...
flexbrane's user avatar
4 votes
2 answers
4k views

/proc/sys/net/netfilter/nf_conntrack_count extreme drop when reading /proc/net/nf_conntrack

I have very busy Web servers, and wanted to introduce some analysis to see what kind of traffic present. Namely, total number of all connections, number of time waits, established connections, udp and ...
Victoria Javi's user avatar
0 votes
1 answer
5k views

Unable to NAT TFTP traffic because iptables is not forwarding the return connection to the client despite TFTP helper creating an expectation

The Problem I have a TFTP server (Machine 'S') and a TFTP client (Machine 'C') on different subnets. They are connected via a router( Machine 'R'). All 3 machines are Debian 9/Stretch. The router is ...
succulent_headcrab's user avatar
3 votes
1 answer
4k views

Conntrack is blocking UDP NAT

I'm working on an application that should relay udp packets from one host to another according to some rules. It is basically NAT. I negotiate UDP ports with both hosts and after that I need to ...
Vargas's user avatar
  • 173
1 vote
2 answers
5k views

How to pass to NFQUEUE all incoming connection packets

I develop an application to inspect packets arriving on a linux machine. I would like to send in NFQUEUE all the incoming connection packets and only the incoming ones. Not only --state NEW but also --...
vx3r's user avatar
  • 408
1 vote
1 answer
763 views

IPv6 traffic from 0001 and Link Local (FE80::1)

Trying to get the basic firewall setup for IPv6 using ip6tables (this is on Ubuntu server 16.04). On the INPUT chain, whenever there is client-initiated IPv6 traffic (e.g. running 'apt update'), I get ...
Vic Morrowshead's user avatar
0 votes
1 answer
179 views

How to drop connections RELATED to other dropped connections?

Scenario: I wrote iptables rules for a host where a DPI engine is watching Netfilter queues: firewall rules enqueue traffic incoming to this host into different Netfilter queues depending on whether ...
elmazzun's user avatar
  • 153
1 vote
1 answer
825 views

conntrack delete does not stop runnig copy of big file

I have a router with nat port forwarding configured. I launched a http copy of big file via the nat. The http server is hosted on the LAN PC which contains the big file to download. I launched the ...
MOHAMED's user avatar
  • 151
1 vote
1 answer
901 views

Conntrackd cache not showing tcp sessions

I am experiencing a somewhat weird issue with conntrackd. I have created an environment with an active/backup scenario where sessions will be replicated to the backup after a failover and vice versa. ...
Jimmy_A's user avatar
  • 81
4 votes
1 answer
3k views

What happened to byte and packet counters in conntrack?

Netfilter's conntrack docs show an example output of conntrack -L that contains bytes= and packets= counters, but when I run it I only see IP and port information. I'm aware that the docs are really ...
itsadok's user avatar
  • 1,889
0 votes
1 answer
7k views

ip_conntrack_max not found

I did reconfigure /etc/sysctl.conf net.ipv4.netfilter.ip_conntrack_max = 65536 net.nf_conntrack_max = 65536 net.netfilter.nf_conntrack_tcp_timeout_established = 600 net.ipv4.netfilter....
auc's user avatar
  • 21
1 vote
0 answers
1k views

Debian sysctl config not persisting on reboot

I am running ubuntu 14.04: Linux WEBLB3 3.13.0-79-generic #123-Ubuntu SMP Fri Feb 19 14:27:58 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux I have modified the /etc/sysctl.conf file to set sysctl settings ...
John Foley's user avatar
0 votes
0 answers
2k views

nf_conntrack_ipv6 not tracking outgoing connections

I'm trying to get outgoing IPv6 routing going, my issue is, that conntrack is not working correctly. I've dumped the traffic via tcpdump, which shows me that the packets go outside (e.g. internal ...
Thomas Rosenstein's user avatar
1 vote
1 answer
2k views

Overwhelmed by "TCP: time wait bucket table overflow" errors -- What can I do to mitigate?

I've got a legacy system running Debian 7 (proxmox) hosting OpenVZ containers, and I'm seeing a troublesome problem where the system is being overwhelmed by open connections to VZ container running ...
Ross Messiah's user avatar
0 votes
1 answer
763 views

Why do the numbers shown in ip_conntrack_count and conntrack -L differ

I noticed the following today on our router: user@router:~$ cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count 28141 However: user@router:~$ sudo conntrack -L > /dev/null conntrack v1.2.1 (...
dorian's user avatar
  • 437
1 vote
1 answer
3k views

iptables counters in NAT table and state NOT NEW

I read everywhere that it is dangerous to do traffic filtering in the nat table because the nat table is only consulted for connections whose state is "NEW" (later packets bypass the table). Does it ...
Fox's user avatar
  • 1,072
0 votes
1 answer
379 views

FTP EPSV command and iptables

Troubleshooting an issue with an FTP connection going through an iptables firewall and seeing some strange issues with passive mode. We are trying to connect to an FTP server and get the directory ...
Devnull's user avatar
  • 951
2 votes
0 answers
538 views

How to prevent conntrack overflow on host with many qemu guests

Is there any way to make iptables conntrack use separate data structures for each network interface? Would network namespaces help here (put each guest together with its tap device in its own netns ...
gucki's user avatar
  • 828
2 votes
1 answer
8k views

"nf_conntrack: table full, dropping packet" even though nf_conntrack_count is much less than nf_conntrack_max

I have a node in our cluster which gets lots of "nf_conntrack: table full, dropping packet" messages in the syslog. I checked the nf_conntrack_count and it was running right up against the ...
Matthew Sharp's user avatar
0 votes
1 answer
8k views

How to use conntrack to allow SIP traffic

I have the following problem: Device (eth0)----> SWITCH(trunk)+VLAN120 ---> (PC1) +VLAN200 ---> (PC2) I am able to ping from PC1 to PC2 which are in ...
RootPhoenix's user avatar
1 vote
1 answer
765 views

On a Linux NAT host, late duplicate segments cause connection resets

https://www.cloudshark.org/captures/6f185eb12e97 172.30.5.1 Linux vm with bridged networking, running on another server, VM has RFC1918 address only 144.76.103.194 Linux host ...
Michael Renner's user avatar
3 votes
1 answer
2k views

iptables blocking some of the traffic on ports 80 and 443 when it shouldn't?

A web server I'm administering shows weird iptables denials from IPv4 addresses on destination port 443, despite HTTPS traffic being explicitly allowed. Port 80 is also allowed in the same rule, but ...
JK Laiho's user avatar
  • 207
8 votes
5 answers
11k views

Route IP Traffic Based on Process to Different Default Routes / Interfaces

I'm trying to determine if it is possible to selectively route IP packets from a process or process group through a specific interface while all other packets are routed through another interface. ...
justinzane's user avatar
1 vote
1 answer
2k views

Can't get iptables working in VPS - state and conntrack not possible [duplicate]

I've been browsing and reading documentations all night and I can't figure out any solution... I'm trying to get iptables working on my VPS (Debian 7). But I can't get established connections ...
Ser0toning Hunter's user avatar
1 vote
2 answers
162 views

See stats of data in and out of each connection to a port

I have an application listening to a port. The clients connect to it using http connection. At any given time I see around 3000 connections established. I assume not all these connections are in use (...
Amod Pandey's user avatar
0 votes
1 answer
101 views

accessing ip_conntrack causes concurrency problems after yum update

I have a Centos 5.11 server, and a script I cron every 10 minutes The script is simply this #!/bin/sh FNAME=/var/www/html/cached/conntrack_count COUNT=`cat /proc/net/ip_conntrack | /usr/bin/wc -l` ...
carpii's user avatar
  • 561