0

We can figure out number of connections in GNU\Linux with ip_conntrack module, And I can print current connections and maximum of connections with:

root@debian:/home/mohsen/test/shell# sysctl net.ipv4.netfilter.ip_conntrack_count
net.ipv4.netfilter.ip_conntrack_count = 28
root@debian:/home/mohsen/test/shell# sysctl net.ipv4.netfilter.ip_conntrack_max 
net.ipv4.netfilter.ip_conntrack_max = 65536

And i can change them.

And with PF firewall i can :

pfctl -si | grep current
pfctl -sm | grep states 

Now, I have two serious question:

  1. How can I change them in PF firewall?
  2. How can I change maximum and current such as ip_conntrack in FreeBSD without any firewall or thirdparty?
4

You set options in pfctl.conf with a set limit { ... } statement.

You can modify the packet filter state while it is running by passing the `-m' (merge) option to pfctl(8), ie

    FreeBSD 9.3-RELEASE-p10 (GENERIC) #0: Tue Feb 24 21:28:03 UTC 2015
    # pfctl -sm
    No ALTQ support in kernel
    ALTQ related functions disabled
    states        hard limit    10000
    src-nodes     hard limit    10000
    frags         hard limit     5000
    tables        hard limit     1000
    table-entries hard limit   200000
    # echo "set limit { states 1000000, frags 1000000, src-nodes 100000, tables 1000000, table-entries 1000000 }" | pfctl -mf -
    No ALTQ support in kernel
    ALTQ related functions disabled
    # pfctl -sm
    No ALTQ support in kernel
    ALTQ related functions disabled
    states        hard limit  1000000
    src-nodes     hard limit   100000
    frags         hard limit  1000000
    tables        hard limit  1000000
    table-entries hard limit  1000000

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.