Questions tagged [conntrack]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
2answers
109 views

When does iptable's conntrack module track states of packets?

It first needs to store states. With some old BSD firewall that I used, I guess was named IPFW, I used to put a rule that sated "keep track of the state of the leaving packet", and this was ...
0
votes
0answers
33 views

Why do some packets seem not to participate in connection tracking on my linux firewall?

I have a KVM host with a virtual pfSense that should NAT traffic from other virtual boxes behind the pfSense's public IP. The pfSense is connected to two bridges: vmbr0 is connecting it to the public ...
1
vote
1answer
40 views

Do we need conntrack for Load Balancer server?

I have 3 private dedicated server as Load balancer. And then there is IP Addr Public sign to this private dedicated server. Suddenly, one of these 3 LB servers got nf_conntrack: table full, dropping ...
1
vote
0answers
40 views

CEPH netfilter connection tracking issues

We have a CEPH cluster (Ubuntu 18.04, Luminous) for Openstack images and volumes. As I was taking it into production I found many performance issues, slow OSDs, and throughput down to a trickle; this ...
1
vote
1answer
498 views

“use” column in /proc/net/ip_conntrack or nf_conntrack?

i'd like to hack together my own little script to parse conntrack data, to get customized network information from some Linux boxes that are also NAT routers. an example of a line from the conntrack ...
0
votes
1answer
207 views

Linux Log all tcp new connections

On my linux host I want to get per minute logs of all the new tcp connections being created. I have multiple tap devices on my host from which various are trying to create the tcp connections. I ...
0
votes
1answer
212 views

dnsmasq: how to get conntrack numbers in query logs?

I´m currently working on a project (for school) to set up a program which analyses DNS-queries to be used in Docker-Swarm and Kubernetes. For testing purposes I received some (supposedly dnsmasq) logs....
1
vote
2answers
454 views

IPtables blocking SSH only if using conntrack

Error As you can see, the only difference between the working and the not working configuration is -m conntrack --ctstate NEW,ESTABLISHED,RELATED. If I use -m conntrack --ctstate NEW,ESTABLISHED it ...
1
vote
2answers
2k views

/proc/sys/net/netfilter/nf_conntrack_count extreme drop when reading /proc/net/nf_conntrack

I have very busy Web servers, and wanted to introduce some analysis to see what kind of traffic present. Namely, total number of all connections, number of time waits, established connections, udp and ...
0
votes
1answer
2k views

Unable to NAT TFTP traffic because iptables is not forwarding the return connection to the client despite TFTP helper creating an expectation

The Problem I have a TFTP server (Machine 'S') and a TFTP client (Machine 'C') on different subnets. They are connected via a router( Machine 'R'). All 3 machines are Debian 9/Stretch. The router is ...
1
vote
1answer
1k views

Conntrack is blocking UDP NAT

I'm working on an application that should relay udp packets from one host to another according to some rules. It is basically NAT. I negotiate UDP ports with both hosts and after that I need to ...
1
vote
2answers
2k views

How to pass to NFQUEUE all incoming connection packets

I develop an application to inspect packets arriving on a linux machine. I would like to send in NFQUEUE all the incoming connection packets and only the incoming ones. Not only --state NEW but also --...
0
votes
1answer
287 views

IPv6 traffic from 0001 and Link Local (FE80::1)

Trying to get the basic firewall setup for IPv6 using ip6tables (this is on Ubuntu server 16.04). On the INPUT chain, whenever there is client-initiated IPv6 traffic (e.g. running 'apt update'), I get ...
0
votes
1answer
96 views

How to drop connections RELATED to other dropped connections?

Scenario: I wrote iptables rules for a host where a DPI engine is watching Netfilter queues: firewall rules enqueue traffic incoming to this host into different Netfilter queues depending on whether ...
1
vote
1answer
376 views

conntrack delete does not stop runnig copy of big file

I have a router with nat port forwarding configured. I launched a http copy of big file via the nat. The http server is hosted on the LAN PC which contains the big file to download. I launched the ...
1
vote
1answer
525 views

Conntrackd cache not showing tcp sessions

I am experiencing a somewhat weird issue with conntrackd. I have created an environment with an active/backup scenario where sessions will be replicated to the backup after a failover and vice versa. ...
3
votes
1answer
2k views

What happened to byte and packet counters in conntrack?

Netfilter's conntrack docs show an example output of conntrack -L that contains bytes= and packets= counters, but when I run it I only see IP and port information. I'm aware that the docs are really ...
0
votes
1answer
4k views

ip_conntrack_max not found

I did reconfigure /etc/sysctl.conf net.ipv4.netfilter.ip_conntrack_max = 65536 net.nf_conntrack_max = 65536 net.netfilter.nf_conntrack_tcp_timeout_established = 600 net.ipv4.netfilter....
0
votes
0answers
635 views

Debian sysctl config not persisting on reboot

I am running ubuntu 14.04: Linux WEBLB3 3.13.0-79-generic #123-Ubuntu SMP Fri Feb 19 14:27:58 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux I have modified the /etc/sysctl.conf file to set sysctl settings ...
0
votes
0answers
1k views

nf_conntrack_ipv6 not tracking outgoing connections

I'm trying to get outgoing IPv6 routing going, my issue is, that conntrack is not working correctly. I've dumped the traffic via tcpdump, which shows me that the packets go outside (e.g. internal ...
1
vote
1answer
2k views

Overwhelmed by “TCP: time wait bucket table overflow” errors — What can I do to mitigate?

I've got a legacy system running Debian 7 (proxmox) hosting OpenVZ containers, and I'm seeing a troublesome problem where the system is being overwhelmed by open connections to VZ container running ...
0
votes
1answer
421 views

Why do the numbers shown in ip_conntrack_count and conntrack -L differ

I noticed the following today on our router: user@router:~$ cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count 28141 However: user@router:~$ sudo conntrack -L > /dev/null conntrack v1.2.1 (...
0
votes
1answer
2k views

iptables counters in NAT table and state NOT NEW

I read everywhere that it is dangerous to do traffic filtering in the nat table because the nat table is only consulted for connections whose state is "NEW" (later packets bypass the table). Does it ...
0
votes
1answer
227 views

FTP EPSV command and iptables

Troubleshooting an issue with an FTP connection going through an iptables firewall and seeing some strange issues with passive mode. We are trying to connect to an FTP server and get the directory ...
1
vote
0answers
345 views

How to prevent conntrack overflow on host with many qemu guests

Is there any way to make iptables conntrack use separate data structures for each network interface? Would network namespaces help here (put each guest together with its tap device in its own netns ...
2
votes
1answer
6k views

“nf_conntrack: table full, dropping packet” even though nf_conntrack_count is much less than nf_conntrack_max

I have a node in our cluster which gets lots of "nf_conntrack: table full, dropping packet" messages in the syslog. I checked the nf_conntrack_count and it was running right up against the ...
0
votes
1answer
6k views

How to use conntrack to allow SIP traffic

I have the following problem: Device (eth0)----> SWITCH(trunk)+VLAN120 ---> (PC1) +VLAN200 ---> (PC2) I am able to ping from PC1 to PC2 which are in ...
1
vote
1answer
587 views

On a Linux NAT host, late duplicate segments cause connection resets

https://www.cloudshark.org/captures/6f185eb12e97 172.30.5.1 Linux vm with bridged networking, running on another server, VM has RFC1918 address only 144.76.103.194 Linux host ...
3
votes
1answer
2k views

iptables blocking some of the traffic on ports 80 and 443 when it shouldn't?

A web server I'm administering shows weird iptables denials from IPv4 addresses on destination port 443, despite HTTPS traffic being explicitly allowed. Port 80 is also allowed in the same rule, but ...
6
votes
4answers
7k views

Route IP Traffic Based on Process to Different Default Routes / Interfaces

I'm trying to determine if it is possible to selectively route IP packets from a process or process group through a specific interface while all other packets are routed through another interface. ...
1
vote
1answer
1k views

Can't get iptables working in VPS - state and conntrack not possible [duplicate]

I've been browsing and reading documentations all night and I can't figure out any solution... I'm trying to get iptables working on my VPS (Debian 7). But I can't get established connections ...
1
vote
2answers
51 views

See stats of data in and out of each connection to a port

I have an application listening to a port. The clients connect to it using http connection. At any given time I see around 3000 connections established. I assume not all these connections are in use (...
0
votes
1answer
76 views

accessing ip_conntrack causes concurrency problems after yum update

I have a Centos 5.11 server, and a script I cron every 10 minutes The script is simply this #!/bin/sh FNAME=/var/www/html/cached/conntrack_count COUNT=`cat /proc/net/ip_conntrack | /usr/bin/wc -l` ...
1
vote
0answers
667 views

Ghost tcp connections: ss sees them, nothing else does

We have a strange problem. Our remote server shows over 900 connections coming from our office over port 80: # ss -n | grep ESTAB | grep $OFFICEIP | grep :80 | wc -l 935 Netstat shows a similar ...
2
votes
0answers
2k views

Does netfilter reassemble IP fragments when packet is forwarded?

IP datagram should be reassemble in the termination of the path because the fragments may arrive from different paths. I think Netfilter need to reassemble a IP datagram to inspect the whole payload ...
1
vote
2answers
1k views

Conntrack shows no result

I tried the command conntrack -L and it returns nothing when I have a ping www.google.com running. I also tried to load the module by modprobe nf_conntrack. But it still always returns conntrack v1....
2
votes
2answers
11k views

How to mitigate error “kernel: nf_conntrack: table full, dropping packet”

We recently had a problem with one of our servers (Debian Squeeze) becoming unresponsive during heavy-ish load. Looking at the kernel logs, I think this is the cause: kernel: nf_conntrack: table ...
5
votes
2answers
4k views

Why is conntrackd not replicating state?

I have a problem with an active/active firewall cluster where the connection tracking state in the firewall does not seem be be being replicated. It's active/active because I have two routers ...
1
vote
0answers
855 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP "...
0
votes
2answers
1k views

Connection tracking not working in a Debian 7 OpenVZ VPS

I have a small VPS instance (used for web hosting) that runs Debian 7, and for a few weeks I have issues with my firewall and connection tracking. I had no issue for months, but without any system ...
1
vote
1answer
7k views

CentOS 6.5 Iptables conntrack module [duplicate]

I have a VPS server on which CentOS 6.5 x64 is installed. Kernel version from uname command is 2.6.18-028stab107. When I want to use iptables rate limiting like in the following command, I got the ...
2
votes
3answers
3k views

Capture first packet of established TCP connection with iptables?

I'm looking for a way to examine the first packet only of a newly established TCP connection (the first packet with actual payload, that is). Is there a way to do this with iptables? Matching ...
0
votes
1answer
419 views

iptables nat taking 30 seconds to start redirecting

I am implementing a SIP Proxy that should be able to redirect all RTP traffic between two clients that can't reach each other. To implement that, I decided to manipulate the negotiated addresses in ...
3
votes
2answers
6k views

ip_conntrack_count has way too many connections

The conntrack table on my server has over 1.2 million connections, I keep bumping up the limit but the table just continues to grow (but not monotonically -- it does go down sometimes). $ cat /proc/...
3
votes
2answers
8k views

nf_conntrack: table full, dropping packet

Mar 24 03:29:26 kernel: [1557411.243821] TCP: time wait bucket table overflow (CT0) Mar 24 03:29:26 kernel: [1557411.243828] TCP: time wait bucket table overflow (CT0) Mar 24 03:29:26 kernel: [1557411....
12
votes
3answers
11k views

Where is the correct place to set net.netfilter.nf_conntrack_buckets?

I'm currently trying to set net.netfilter.nf_conntrack_buckets on boot. I initially assumed that this could be done through sysctl.conf, but net.netfilter.nf_conntrack_buckets (and other net....
0
votes
2answers
529 views

yum not updating /etc/rc.d/init.d/iptables

I have been hit by the bug https://bugzilla.redhat.com/show_bug.cgi?id=493226 (restarting iptables ignores values in /etc/sysctl.conf). This bug has been fixed by RH quite a while ago. The server ...
2
votes
0answers
1k views

A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?

I'm looking for a minimal iptables ruleset for a rather high volume Nginx/Varnish reverse proxy. I'd like to close down the server, so that only ports 80 and 22 are open at all for connections from ...
5
votes
1answer
11k views

Why does nf_conntrack_count keep increasing?

I'm using Ubuntu 11.10 & nginx. My server's currently doing about 350 rps (that's the load that's coming in). I use iptables to make sure connections on certain ports are restricted only to ...
4
votes
1answer
580 views

Iproute2 tools vs conntrack tools

I have a linux box which is setup as firewall/gateway for the network. Was just wondering why ss and other iproute2 tools show much less than iptables conntrack. Is it because the router function is ...