Questions tagged [nf-conntrack]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
16 views

conntrack events(conntrack -E) show 0.0.0.0 as source and destination addresses

These are the logs down below. [DESTROY] udp 17 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=3 bytes=216 [UNREPLIED] src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=0 bytes=0 [NEW] udp ...
0
votes
1answer
19 views

Should I do the stateful matching with iptables for nat table?

I often see that there are some stateful matching rules in a iptables' chain such as INPUT. I known what they are doing, and I'm interested in that Should I do the same for the chains of the table ...
3
votes
1answer
71 views

NEW counter missed in statistics conntrack -S

From this question Statistics /proc/net/stat/nf_conntrack is missing on Linux server I recognized that /proc/net/stat/nf_conntrack has an alternative conntrack -S. In /proc/net/stat/nf_conntrack there ...
4
votes
1answer
385 views

Statistics /proc/net/stat/nf_conntrack is missing on Linux server

For some reason I have no such file on my server.. root@serv:~# uname -a Linux serv 5.4.0-87-generic #98~18.04.1-Ubuntu SMP Wed Sep 22 10:45:04 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux root@serv:~# cat ...
0
votes
1answer
50 views

iptables FTP connection tracking not working

I am hoping someone can point me in the right direction here please. Running proftpd (with tls support) on a public IP. FTP client connects, but can't do a directory listing. When I change the "...
1
vote
0answers
408 views

net.netfilter.nf_conntrack_helper=1 a security risk?

For a public file archive with an anonymous ftp server (vsftpd) I need to restore passive ftp, which ceased to work after upgrading Ubuntu 16 LTS to 18 LTS some time ago (with 20 to follow). Previous ...
1
vote
0answers
197 views

Apache keeps TCP Connection in CLOSE-WAIT state for 600 Seconds

My setup consists of two apache servers like in this diagram: |Apache | >==Reverse Proxy Connection====> |Apache | |Server1| <==Response through conntrack==< |Server2| After a successful ...
1
vote
1answer
126 views

Do we need conntrack for Load Balancer server?

I have 3 private dedicated server as Load balancer. And then there is IP Addr Public sign to this private dedicated server. Suddenly, one of these 3 LB servers got nf_conntrack: table full, dropping ...
1
vote
1answer
1k views

"use" column in /proc/net/ip_conntrack or nf_conntrack?

i'd like to hack together my own little script to parse conntrack data, to get customized network information from some Linux boxes that are also NAT routers. an example of a line from the conntrack ...
1
vote
1answer
73 views

Connections disappearing from nf_conntrack

I've been investigating a special issue on our docker host server (17.09.0-ce) and found that every 3-5 minutes, many connections disappear from /proc/net/nf_conntrack causing the client side of the ...
4
votes
1answer
2k views

What happened to byte and packet counters in conntrack?

Netfilter's conntrack docs show an example output of conntrack -L that contains bytes= and packets= counters, but when I run it I only see IP and port information. I'm aware that the docs are really ...
0
votes
1answer
6k views

ip_conntrack_max not found

I did reconfigure /etc/sysctl.conf net.ipv4.netfilter.ip_conntrack_max = 65536 net.nf_conntrack_max = 65536 net.netfilter.nf_conntrack_tcp_timeout_established = 600 net.ipv4.netfilter....
2
votes
2answers
1k views

How to learn Remote FTP Server 's Passive Port Range

Is there any way to learn the port range of "Passive" FTP Server which is not in my authority. It is possible to set the range within configuration file. For example within vsftpd.conf : ...
0
votes
0answers
519 views

nf_conntrack_ftp module has disappearedl

I've been running a Linode droplet for several years with no problems. In the last month, users have reported FTP connection errors, always related to Passive FTP. Investigation shows that the ...
1
vote
1answer
1k views

ufw without connection tracking

I am using ufw on a high traffic webserver (lot of http/https traffic) on ubuntu (12.04 or 14.04). I tried tuning kernel parameters related to connection tracking with some success. However, ...
0
votes
1answer
7k views

How to use conntrack to allow SIP traffic

I have the following problem: Device (eth0)----> SWITCH(trunk)+VLAN120 ---> (PC1) +VLAN200 ---> (PC2) I am able to ping from PC1 to PC2 which are in ...
3
votes
1answer
7k views

iptables fails to load nf_conntrack_ftp [duplicate]

I have recently had to rebuild my iptables configuration and when I run service iptables restart I now receive the following error line: iptables: Loading additional modules: nf_conntrack_ftp [...
1
vote
1answer
1k views

Configuring IPTables without connection tracking module

Usually connection tracking is required for outbound connections to allow established connections back in, for instance: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT I don't have ...
1
vote
2answers
2k views

Conntrack shows no result

I tried the command conntrack -L and it returns nothing when I have a ping www.google.com running. I also tried to load the module by modprobe nf_conntrack. But it still always returns conntrack v1....
2
votes
2answers
12k views

How to mitigate error "kernel: nf_conntrack: table full, dropping packet"

We recently had a problem with one of our servers (Debian Squeeze) becoming unresponsive during heavy-ish load. Looking at the kernel logs, I think this is the cause: kernel: nf_conntrack: table ...
2
votes
1answer
878 views

Stateless NAT with CentOS 6

I'm looking to set up the following: ---[IVR 1] | (internet)----[CentOS box]---+---[IVR 2] | ...
0
votes
1answer
758 views

Limiting outgoing connections by port to control nf_conntrack usage

I would like to make my system more resilient against certain failure. When the system makes rapid outbound TCP connections fail, the nf_conntrack table fills up with TIME_WAIT entries. This ...
1
vote
1answer
6k views

Debugging HAProxy

I have tested / been testing a server cluster locally for quite a while with no problem. I have recently set my server cluster up for a live test, and I have noticed problems, and believe that the ...
4
votes
1answer
7k views

What does nf_conntrack.acct really do?

I've found the kernel parameter nf_conntrack.acct interesting, in that the kernel documentation merely says "Enable connection tracking flow accounting". I've appended this to grub and rebooted and I ...
2
votes
1answer
5k views

What is the difference between nf_conntrack_max and nf_conntrack_expect_max?

I understand what nf_conntrack_max is, but what does nf_conntrack_expect_max actually do? I haven't been able to find an explanation on this anywhere.
13
votes
3answers
13k views

Where is the correct place to set net.netfilter.nf_conntrack_buckets?

I'm currently trying to set net.netfilter.nf_conntrack_buckets on boot. I initially assumed that this could be done through sysctl.conf, but net.netfilter.nf_conntrack_buckets (and other net....
2
votes
0answers
1k views

A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?

I'm looking for a minimal iptables ruleset for a rather high volume Nginx/Varnish reverse proxy. I'd like to close down the server, so that only ports 80 and 22 are open at all for connections from ...
3
votes
2answers
3k views

nf_conntrack complaints in dmesg

While investigating complains on bad HTTP server performance, I've discovered these lines in dmesg of my Xen XCP host that contains a guest OS with said server: [11458852.811070] net_ratelimit: 321 ...