Questions tagged [conntrack]
The conntrack tag has no usage guidance.
74
questions
0
votes
2
answers
58
views
How to apply DROP rule immediately (iptables/conntrack)
An external IP is connecting to my mailserver VM every second and I just want to block this IP immediately without dropping existing connections.
So I apply a DROP rule.
I even reloaded all the ...
- 135
0
votes
0
answers
31
views
How Docker interacts with conntrack?
I am trying to understand how Docker interacts with conntrack. I created two containers (connected to docker0), pinged 4 times from one to the other, and analyzed the iptables counts. This is the ...
0
votes
0
answers
89
views
Drop first SYN packet with nftables
How can I drop the first SYN packet (or the first SYN/ACK reply) received by my server?
I have a test VPS set up to capture and analyze malicious traffic directed to non-standard TCP ports, for ...
- 1
1
vote
0
answers
36
views
how to allow sip traffic, from field's IP is modified by routers ip
I have the following problem:
PC1 - eth0: 192.168.188.55
eth1: part of br0: 10.147.20.69
tap1: part of b0: 10.147.20.2 -> connected to PC2
on eth1: i have a trunc sip device ...
- 11
0
votes
1
answer
43
views
How can I allowing all established incoming connections without conntrack?
I want to make my iptables accepted all stablished incoming connections,
but I don't have conntrack in my system so I can't run:
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
It ...
- 3
0
votes
0
answers
375
views
why allowing established incoming connections doesn't work?
I am trying to allowing all established incoming connections in my iptables using this command:
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
but I get this error message:
"...
- 3
0
votes
0
answers
365
views
Disable connection tracking
I'm on Ubuntu 22.04 and I would like to disable connection tracking for UDP port 123, so I tried:
firewall-cmd --direct --add-rule ipv4 raw PREROUTING 1 -p udp --dport 123 -j NOTRACK
firewall-cmd --...
- 255
0
votes
0
answers
146
views
conntrack events(conntrack -E) show 0.0.0.0 as source and destination addresses
These are the logs down below.
[DESTROY] udp 17 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=3 bytes=216 [UNREPLIED] src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=0 bytes=0
[NEW] udp ...
0
votes
1
answer
582
views
iptables FTP connection tracking not working
I am hoping someone can point me in the right direction here please.
Running proftpd (with tls support) on a public IP.
FTP client connects, but can't do a directory listing. When I change the "...
0
votes
1
answer
328
views
How conntrack and network namespaces works together?
Is nf_conntrack respects network namespaces? Does it creates a separate table for each network namespace based on its sysctl limits, or does it share memory (and limits) between different network ...
- 256
0
votes
3
answers
667
views
How to prevent netfilter to automatically change the source ports
I observed that netfilter changes the source port when a connection is established in the conntrack module. I need to prevent this behavior.
Here is what I have done to reproduce my problem:
I create ...
2
votes
1
answer
729
views
Conntrack, failed to NAT its own TCP packets from another VRF
I came across a tricky problem with source NAT when using multiple VRF on a Debian based router. It's a bit complex to explain, so I will try to be clear, but it will not be short, sorry for that. The ...
- 31
0
votes
1
answer
178
views
route ipv4 to ipv6 as mechanism to overcome not owning an ipv4 block for load balancing purposes on premise k8s (none aws/gcp)
This is not a question about tunnelling, although that may be part of a solution.
With public cloud providers it's trivial to request a load balancer due to providers owning large class A/B/C public ...
- 153
1
vote
0
answers
211
views
Conntrack not showing iptables redirected flow
I have a client and server. At Server I have a redirect rule to redirect all incoming flows to port 15006.
Client IP: 10.20.3.53
ServerIP : 10.20.3.63
I have the following iptables rules on the ...
- 111
1
vote
0
answers
570
views
Apache keeps TCP Connection in CLOSE-WAIT state for 600 Seconds
My setup consists of two apache servers like in this diagram:
|Apache | >==Reverse Proxy Connection====> |Apache |
|Server1| <==Response through conntrack==< |Server2|
After a successful ...
- 43
1
vote
0
answers
121
views
Connections not obeying conntrack
I have a tunnel set up on interface vti68. I am NATing both the source and destination.
The host has 10.1.30.51 as local, and 172.16.0.80 as remote.
Traffic in the tunnel is translated such that 10....
- 307
1
vote
1
answer
204
views
Persist conntrack database across reboots
I run a NAT router on Debian 10 which takes only a few seconds to reboot, way less then 120 seconds, more like 3. I'd like to keep established connections so that a reboot of the router does not break ...
- 317
1
vote
2
answers
281
views
Track IP Adress login RDP when shutdown happen
Today I arrived at the office of an client and the Hyper V server was turnoff. In the Windows Event log is register that the admin user has send a shutdown command. I'm not the only one that has ...
4
votes
2
answers
11k
views
When does iptable's conntrack module track states of packets?
It first needs to store states. With some old BSD firewall that I used, I guess was named IPFW, I used to put a rule that sated "keep track of the state of the leaving packet", and this was ...
- 143
1
vote
1
answer
237
views
Do we need conntrack for Load Balancer server?
I have 3 private dedicated server as Load balancer. And then there is IP Addr Public sign to this private dedicated server.
Suddenly, one of these 3 LB servers got nf_conntrack: table full, dropping ...
- 11
1
vote
0
answers
98
views
CEPH netfilter connection tracking issues
We have a CEPH cluster (Ubuntu 18.04, Luminous) for Openstack images and volumes. As I was taking it into production I found many performance issues, slow OSDs, and throughput down to a trickle; this ...
- 11
1
vote
1
answer
2k
views
"use" column in /proc/net/ip_conntrack or nf_conntrack?
i'd like to hack together my own little script to parse conntrack data, to get customized network information from some Linux boxes that are also NAT routers.
an example of a line from the conntrack ...
1
vote
1
answer
1k
views
Linux Log all tcp new connections
On my linux host I want to get per minute logs of all the new tcp connections being created.
I have multiple tap devices on my host from which various are trying to create the tcp connections.
I ...
0
votes
1
answer
696
views
dnsmasq: how to get conntrack numbers in query logs?
I´m currently working on a project (for school) to set up a program which analyses DNS-queries to be used in Docker-Swarm and Kubernetes. For testing purposes I received some (supposedly dnsmasq) logs....
1
vote
2
answers
1k
views
IPtables blocking SSH only if using conntrack
Error
As you can see, the only difference between the working and the not working configuration is -m conntrack --ctstate NEW,ESTABLISHED,RELATED. If I use -m conntrack --ctstate NEW,ESTABLISHED it ...
- 21
4
votes
2
answers
3k
views
/proc/sys/net/netfilter/nf_conntrack_count extreme drop when reading /proc/net/nf_conntrack
I have very busy Web servers, and wanted to introduce some analysis to see what kind of traffic present. Namely, total number of all connections, number of time waits, established connections, udp and ...
0
votes
1
answer
4k
views
Unable to NAT TFTP traffic because iptables is not forwarding the return connection to the client despite TFTP helper creating an expectation
The Problem
I have a TFTP server (Machine 'S') and a TFTP client (Machine 'C') on different subnets. They are connected via a router( Machine 'R'). All 3 machines are Debian 9/Stretch. The router is ...
2
votes
1
answer
3k
views
Conntrack is blocking UDP NAT
I'm working on an application that should relay udp packets from one host to another according to some rules. It is basically NAT.
I negotiate UDP ports with both hosts and after that I need to ...
- 153
1
vote
2
answers
5k
views
How to pass to NFQUEUE all incoming connection packets
I develop an application to inspect packets arriving on a linux machine.
I would like to send in NFQUEUE all the incoming connection packets and only the incoming ones. Not only --state NEW but also --...
- 388
1
vote
1
answer
677
views
IPv6 traffic from 0001 and Link Local (FE80::1)
Trying to get the basic firewall setup for IPv6 using ip6tables (this is on Ubuntu server 16.04). On the INPUT chain, whenever there is client-initiated IPv6 traffic (e.g. running 'apt update'), I get ...
0
votes
1
answer
159
views
How to drop connections RELATED to other dropped connections?
Scenario: I wrote iptables rules for a host where a DPI engine is watching Netfilter queues: firewall rules enqueue traffic incoming to this host into different Netfilter queues depending on whether ...
- 143
1
vote
1
answer
713
views
conntrack delete does not stop runnig copy of big file
I have a router with nat port forwarding configured. I launched a http copy of big file via the nat. The http server is hosted on the LAN PC which contains the big file to download. I launched the ...
- 151
1
vote
1
answer
779
views
Conntrackd cache not showing tcp sessions
I am experiencing a somewhat weird issue with conntrackd. I have created an environment with an active/backup scenario where sessions will be replicated to the backup after a failover and vice versa. ...
- 81
4
votes
1
answer
3k
views
What happened to byte and packet counters in conntrack?
Netfilter's conntrack docs show an example output of conntrack -L that contains bytes= and packets= counters, but when I run it I only see IP and port information.
I'm aware that the docs are really ...
- 1,859
0
votes
1
answer
6k
views
ip_conntrack_max not found
I did reconfigure /etc/sysctl.conf
net.ipv4.netfilter.ip_conntrack_max = 65536
net.nf_conntrack_max = 65536
net.netfilter.nf_conntrack_tcp_timeout_established = 600
net.ipv4.netfilter....
- 21
1
vote
0
answers
1k
views
Debian sysctl config not persisting on reboot
I am running ubuntu 14.04:
Linux WEBLB3 3.13.0-79-generic #123-Ubuntu SMP Fri Feb 19 14:27:58 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
I have modified the /etc/sysctl.conf file to set sysctl settings ...
- 171
0
votes
0
answers
2k
views
nf_conntrack_ipv6 not tracking outgoing connections
I'm trying to get outgoing IPv6 routing going, my issue is, that conntrack is not working correctly.
I've dumped the traffic via tcpdump, which shows me that the packets go outside (e.g. internal ...
1
vote
1
answer
2k
views
Overwhelmed by "TCP: time wait bucket table overflow" errors -- What can I do to mitigate?
I've got a legacy system running Debian 7 (proxmox) hosting OpenVZ containers, and I'm seeing a troublesome problem where the system is being overwhelmed by open connections to VZ container running ...
- 11
0
votes
1
answer
597
views
Why do the numbers shown in ip_conntrack_count and conntrack -L differ
I noticed the following today on our router:
user@router:~$ cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count
28141
However:
user@router:~$ sudo conntrack -L > /dev/null
conntrack v1.2.1 (...
- 417
0
votes
1
answer
3k
views
iptables counters in NAT table and state NOT NEW
I read everywhere that it is dangerous to do traffic filtering in the nat table because the nat table is only consulted for connections whose state is "NEW" (later packets bypass the table).
Does it ...
- 972
0
votes
1
answer
312
views
FTP EPSV command and iptables
Troubleshooting an issue with an FTP connection going through an iptables firewall and seeing some strange issues with passive mode.
We are trying to connect to an FTP server and get the directory ...
- 951
1
vote
0
answers
446
views
How to prevent conntrack overflow on host with many qemu guests
Is there any way to make iptables conntrack use separate data structures for each network interface? Would network namespaces help here (put each guest together with its tap device in its own netns ...
- 808
2
votes
1
answer
7k
views
"nf_conntrack: table full, dropping packet" even though nf_conntrack_count is much less than nf_conntrack_max
I have a node in our cluster which gets lots of "nf_conntrack: table full, dropping packet" messages in the syslog. I checked the nf_conntrack_count and it was running right up against the ...
- 200
0
votes
1
answer
7k
views
How to use conntrack to allow SIP traffic
I have the following problem:
Device (eth0)----> SWITCH(trunk)+VLAN120 ---> (PC1)
+VLAN200 ---> (PC2)
I am able to ping from PC1 to PC2 which are in ...
- 113
1
vote
1
answer
755
views
On a Linux NAT host, late duplicate segments cause connection resets
https://www.cloudshark.org/captures/6f185eb12e97
172.30.5.1 Linux vm with bridged networking, running on another server, VM has RFC1918 address only
144.76.103.194 Linux host ...
- 1,750
3
votes
1
answer
2k
views
iptables blocking some of the traffic on ports 80 and 443 when it shouldn't?
A web server I'm administering shows weird iptables denials from IPv4 addresses on destination port 443, despite HTTPS traffic being explicitly allowed. Port 80 is also allowed in the same rule, but ...
- 197
8
votes
5
answers
9k
views
Route IP Traffic Based on Process to Different Default Routes / Interfaces
I'm trying to determine if it is possible to selectively route IP packets from a process or process group through a specific interface while all other packets are routed through another interface. ...
- 191
1
vote
1
answer
2k
views
Can't get iptables working in VPS - state and conntrack not possible [duplicate]
I've been browsing and reading documentations all night and I can't figure out any solution...
I'm trying to get iptables working on my VPS (Debian 7).
But I can't get established connections ...
1
vote
2
answers
104
views
See stats of data in and out of each connection to a port
I have an application listening to a port. The clients connect to it using http connection. At any given time I see around 3000 connections established. I assume not all these connections are in use (...
- 121
0
votes
1
answer
95
views
accessing ip_conntrack causes concurrency problems after yum update
I have a Centos 5.11 server, and a script I cron every 10 minutes
The script is simply this
#!/bin/sh
FNAME=/var/www/html/cached/conntrack_count
COUNT=`cat /proc/net/ip_conntrack | /usr/bin/wc -l`
...
- 531