Questions tagged [nf-conntrack]
The nf-conntrack tag has no usage guidance.
32
questions
0
votes
0
answers
31
views
NetFilter ConnTrack FTP helper alernative fo handle FTPS
I've been using nf_conntrack_ftp module successfully (though rarely), but now I have to deal with TLS-encrypted FTP - this renders that helper useless an I would have to resort to opening the firewall ...
- 198
1
vote
0
answers
65
views
how to allow sip traffic, from field's IP is modified by routers ip
I have the following problem:
PC1 - eth0: 192.168.188.55
eth1: part of br0: 10.147.20.69
tap1: part of b0: 10.147.20.2 -> connected to PC2
on eth1: i have a trunc sip device ...
- 11
0
votes
0
answers
26
views
How to avoid port duplication when using iptable for DNAT
I configure the iptable output chain DNAT conversion by the following command.
iptables -t nat -A OUTPUT -p tcp --dport 5000 -j DNAT --to 10.100.1.10:2048
When I link 10.100.20.4:5000 on the client ...
- 1
0
votes
0
answers
467
views
Disable connection tracking
I'm on Ubuntu 22.04 and I would like to disable connection tracking for UDP port 123, so I tried:
firewall-cmd --direct --add-rule ipv4 raw PREROUTING 1 -p udp --dport 123 -j NOTRACK
firewall-cmd --...
- 265
0
votes
0
answers
176
views
conntrack events(conntrack -E) show 0.0.0.0 as source and destination addresses
These are the logs down below.
[DESTROY] udp 17 src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=3 bytes=216 [UNREPLIED] src=0.0.0.0 dst=0.0.0.0 sport=0 dport=0 packets=0 bytes=0
[NEW] udp ...
0
votes
1
answer
311
views
Should I do the stateful matching with iptables for nat table?
I often see that there are some stateful matching rules in a iptables' chain such as INPUT.
I known what they are doing, and I'm interested in that
Should I do the same for the chains of the table ...
- 169
3
votes
1
answer
333
views
NEW counter missed in statistics conntrack -S
From this question Statistics /proc/net/stat/nf_conntrack is missing on Linux server I recognized that /proc/net/stat/nf_conntrack has an alternative conntrack -S.
In /proc/net/stat/nf_conntrack there ...
- 95
4
votes
2
answers
3k
views
Statistics /proc/net/stat/nf_conntrack is missing on Linux server
For some reason I have no such file on my server..
root@serv:~# uname -a
Linux serv 5.4.0-87-generic #98~18.04.1-Ubuntu SMP Wed Sep 22 10:45:04 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
root@serv:~# cat ...
- 95
0
votes
1
answer
731
views
iptables FTP connection tracking not working
I am hoping someone can point me in the right direction here please.
Running proftpd (with tls support) on a public IP.
FTP client connects, but can't do a directory listing. When I change the "...
1
vote
0
answers
2k
views
net.netfilter.nf_conntrack_helper=1 a security risk?
For a public file archive with an anonymous ftp server (vsftpd) I need to restore passive ftp, which ceased to work after upgrading Ubuntu 16 LTS to 18 LTS some time ago (with 20 to follow). Previous ...
- 11
1
vote
0
answers
626
views
Apache keeps TCP Connection in CLOSE-WAIT state for 600 Seconds
My setup consists of two apache servers like in this diagram:
|Apache | >==Reverse Proxy Connection====> |Apache |
|Server1| <==Response through conntrack==< |Server2|
After a successful ...
- 43
1
vote
1
answer
263
views
Do we need conntrack for Load Balancer server?
I have 3 private dedicated server as Load balancer. And then there is IP Addr Public sign to this private dedicated server.
Suddenly, one of these 3 LB servers got nf_conntrack: table full, dropping ...
- 11
1
vote
1
answer
2k
views
"use" column in /proc/net/ip_conntrack or nf_conntrack?
i'd like to hack together my own little script to parse conntrack data, to get customized network information from some Linux boxes that are also NAT routers.
an example of a line from the conntrack ...
1
vote
1
answer
102
views
Connections disappearing from nf_conntrack
I've been investigating a special issue on our docker host server (17.09.0-ce) and found that every 3-5 minutes, many connections disappear from /proc/net/nf_conntrack causing the client side of the ...
- 121
4
votes
1
answer
3k
views
What happened to byte and packet counters in conntrack?
Netfilter's conntrack docs show an example output of conntrack -L that contains bytes= and packets= counters, but when I run it I only see IP and port information.
I'm aware that the docs are really ...
- 1,859
0
votes
1
answer
7k
views
ip_conntrack_max not found
I did reconfigure /etc/sysctl.conf
net.ipv4.netfilter.ip_conntrack_max = 65536
net.nf_conntrack_max = 65536
net.netfilter.nf_conntrack_tcp_timeout_established = 600
net.ipv4.netfilter....
- 21
2
votes
2
answers
2k
views
How to learn Remote FTP Server 's Passive Port Range
Is there any way to learn the port range of "Passive" FTP Server which is not in my authority. It is possible to set the range within configuration file. For example within vsftpd.conf :
...
- 571
0
votes
0
answers
576
views
nf_conntrack_ftp module has disappearedl
I've been running a Linode droplet for several years with no problems. In the last month, users have reported FTP connection errors, always related to Passive FTP.
Investigation shows that the ...
- 943
1
vote
1
answer
1k
views
ufw without connection tracking
I am using ufw on a high traffic webserver (lot of http/https traffic) on ubuntu (12.04 or 14.04).
I tried tuning kernel parameters related to connection tracking with some success.
However, ...
- 123
0
votes
1
answer
8k
views
How to use conntrack to allow SIP traffic
I have the following problem:
Device (eth0)----> SWITCH(trunk)+VLAN120 ---> (PC1)
+VLAN200 ---> (PC2)
I am able to ping from PC1 to PC2 which are in ...
- 113
3
votes
1
answer
7k
views
iptables fails to load nf_conntrack_ftp [duplicate]
I have recently had to rebuild my iptables configuration and when I run
service iptables restart
I now receive the following error line:
iptables: Loading additional modules: nf_conntrack_ftp [...
- 157
1
vote
1
answer
1k
views
Configuring IPTables without connection tracking module
Usually connection tracking is required for outbound connections to allow established connections back in, for instance:
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
I don't have ...
- 3,108
2
votes
3
answers
3k
views
Conntrack shows no result
I tried the command conntrack -L and it returns nothing when I have a ping www.google.com running.
I also tried to load the module by modprobe nf_conntrack. But it still always returns conntrack v1....
- 121
2
votes
2
answers
12k
views
How to mitigate error "kernel: nf_conntrack: table full, dropping packet"
We recently had a problem with one of our servers (Debian Squeeze) becoming unresponsive during heavy-ish load. Looking at the kernel logs, I think this is the cause:
kernel: nf_conntrack: table ...
- 1,628
2
votes
1
answer
921
views
Stateless NAT with CentOS 6
I'm looking to set up the following:
---[IVR 1]
|
(internet)----[CentOS box]---+---[IVR 2]
|
...
- 21
0
votes
1
answer
818
views
Limiting outgoing connections by port to control nf_conntrack usage
I would like to make my system more resilient against certain failure. When the
system makes rapid outbound TCP connections fail, the nf_conntrack table
fills up with TIME_WAIT entries. This ...
- 570
1
vote
1
answer
7k
views
Debugging HAProxy
I have tested / been testing a server cluster locally for quite a while with no problem. I have recently set my server cluster up for a live test, and I have noticed problems, and believe that the ...
- 217
4
votes
1
answer
8k
views
What does nf_conntrack.acct really do?
I've found the kernel parameter nf_conntrack.acct interesting, in that the kernel documentation merely says "Enable connection tracking flow accounting".
I've appended this to grub and rebooted and I ...
- 652
2
votes
1
answer
7k
views
What is the difference between nf_conntrack_max and nf_conntrack_expect_max?
I understand what nf_conntrack_max is, but what does nf_conntrack_expect_max actually do? I haven't been able to find an explanation on this anywhere.
- 155
13
votes
3
answers
15k
views
Where is the correct place to set net.netfilter.nf_conntrack_buckets?
I'm currently trying to set net.netfilter.nf_conntrack_buckets on boot. I initially assumed that this could be done through sysctl.conf, but net.netfilter.nf_conntrack_buckets (and other net....
- 155
2
votes
0
answers
1k
views
A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?
I'm looking for a minimal iptables ruleset for a rather high volume Nginx/Varnish reverse proxy. I'd like to close down the server, so that only ports 80 and 22 are open at all for connections from ...
- 394
3
votes
2
answers
3k
views
nf_conntrack complaints in dmesg
While investigating complains on bad HTTP server performance, I've discovered these lines in dmesg of my Xen XCP host that contains a guest OS with said server:
[11458852.811070] net_ratelimit: 321 ...
- 2,403