Questions tagged [nf-conntrack]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
206 views

“use” column in /proc/net/ip_conntrack or nf_conntrack?

i'd like to hack together my own little script to parse conntrack data, to get customized network information from some Linux boxes that are also NAT routers. an example of a line from the conntrack ...
1
vote
1answer
49 views

Connections disappearing from nf_conntrack

I've been investigating a special issue on our docker host server (17.09.0-ce) and found that every 3-5 minutes, many connections disappear from /proc/net/nf_conntrack causing the client side of the ...
3
votes
1answer
1k views

What happened to byte and packet counters in conntrack?

Netfilter's conntrack docs show an example output of conntrack -L that contains bytes= and packets= counters, but when I run it I only see IP and port information. I'm aware that the docs are really ...
0
votes
1answer
4k views

ip_conntrack_max not found

I did reconfigure /etc/sysctl.conf net.ipv4.netfilter.ip_conntrack_max = 65536 net.nf_conntrack_max = 65536 net.netfilter.nf_conntrack_tcp_timeout_established = 600 net.ipv4.netfilter....
2
votes
2answers
743 views

How to learn Remote FTP Server 's Passive Port Range

Is there any way to learn the port range of "Passive" FTP Server which is not in my authority. It is possible to set the range within configuration file. For example within vsftpd.conf : ...
0
votes
0answers
436 views

nf_conntrack_ftp module has disappearedl

I've been running a Linode droplet for several years with no problems. In the last month, users have reported FTP connection errors, always related to Passive FTP. Investigation shows that the ...
1
vote
1answer
825 views

ufw without connection tracking

I am using ufw on a high traffic webserver (lot of http/https traffic) on ubuntu (12.04 or 14.04). I tried tuning kernel parameters related to connection tracking with some success. However, ...
0
votes
1answer
5k views

How to use conntrack to allow SIP traffic

I have the following problem: Device (eth0)----> SWITCH(trunk)+VLAN120 ---> (PC1) +VLAN200 ---> (PC2) I am able to ping from PC1 to PC2 which are in ...
3
votes
1answer
5k views

iptables fails to load nf_conntrack_ftp [duplicate]

I have recently had to rebuild my iptables configuration and when I run service iptables restart I now receive the following error line: iptables: Loading additional modules: nf_conntrack_ftp [...
1
vote
1answer
719 views

Configuring IPTables without connection tracking module

Usually connection tracking is required for outbound connections to allow established connections back in, for instance: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT I don't have ...
1
vote
2answers
1k views

Conntrack shows no result

I tried the command conntrack -L and it returns nothing when I have a ping www.google.com running. I also tried to load the module by modprobe nf_conntrack. But it still always returns conntrack v1....
2
votes
2answers
11k views

How to mitigate error “kernel: nf_conntrack: table full, dropping packet”

We recently had a problem with one of our servers (Debian Squeeze) becoming unresponsive during heavy-ish load. Looking at the kernel logs, I think this is the cause: kernel: nf_conntrack: table ...
2
votes
1answer
688 views

Stateless NAT with CentOS 6

I'm looking to set up the following: ---[IVR 1] | (internet)----[CentOS box]---+---[IVR 2] | ...
0
votes
1answer
619 views

Limiting outgoing connections by port to control nf_conntrack usage

I would like to make my system more resilient against certain failure. When the system makes rapid outbound TCP connections fail, the nf_conntrack table fills up with TIME_WAIT entries. This ...
1
vote
1answer
4k views

Debugging HAProxy

I have tested / been testing a server cluster locally for quite a while with no problem. I have recently set my server cluster up for a live test, and I have noticed problems, and believe that the ...
3
votes
1answer
5k views

What does nf_conntrack.acct really do?

I've found the kernel parameter nf_conntrack.acct interesting, in that the kernel documentation merely says "Enable connection tracking flow accounting". I've appended this to grub and rebooted and I ...
1
vote
1answer
3k views

What is the difference between nf_conntrack_max and nf_conntrack_expect_max?

I understand what nf_conntrack_max is, but what does nf_conntrack_expect_max actually do? I haven't been able to find an explanation on this anywhere.
12
votes
3answers
10k views

Where is the correct place to set net.netfilter.nf_conntrack_buckets?

I'm currently trying to set net.netfilter.nf_conntrack_buckets on boot. I initially assumed that this could be done through sysctl.conf, but net.netfilter.nf_conntrack_buckets (and other net....
2
votes
0answers
1k views

A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?

I'm looking for a minimal iptables ruleset for a rather high volume Nginx/Varnish reverse proxy. I'd like to close down the server, so that only ports 80 and 22 are open at all for connections from ...
3
votes
2answers
2k views

nf_conntrack complaints in dmesg

While investigating complains on bad HTTP server performance, I've discovered these lines in dmesg of my Xen XCP host that contains a guest OS with said server: [11458852.811070] net_ratelimit: 321 ...