Questions tagged [ip-conntrack]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
108 views

Porting Iptables to Nftables firewall with conntrack marks

Hi dear esteemed community, I'm having a hard time porting my very functional iptables firewall to nftables. No issues with input/output/forward stuffs, it's mainly the conntrack marking. What I ...
0
votes
0answers
32 views

No conntrack kernel module in yocto

I used yocto to generate an image and modified the kernel in order to allow a line like this to work: iptables -A INPUT -m conntrack [...] Adding in my kernel configuration file: ...
0
votes
0answers
91 views

Only enable conntrack for certain connections based on ipset - netfilter

I'm trying DNS traffic redirection setup based on IPSET. Basically, I need to do the DNAT for each IP listed in the IPSET, and at the same time, I need other connections not to track to minimize the ...
2
votes
0answers
327 views

Tagging outgoing packets with iptables

Is there any possibility to mark outgoing packets with iptables and recognize them by the response? I have a very simple outgoing rule: iptables -A OUTPUT -m conntrack --ctstate NEW,ESTABLISHED,...
0
votes
1answer
826 views

Gracefully closing an inactive TCP connection

Does exist a command to "gracefully" close a TCP connection opened by a process before it reaches its timeout? I would like to gracefully close all those TCP connections in a CLOSE_WAIT/TIME_WAIT ...
3
votes
1answer
8k views

How long does conntrack remember a connection?

From this link it seems that conntrack remembers a connection for X seconds after it is closed. Does anybody know how long that X is and if it is configurable?
1
vote
1answer
742 views

Conntrack and dynamic ipset/iptables rules

I don't understand some basic concepts of conntrack module. First of all, I'm sure it's enabled in my system (Ubuntu 18.04), modinfo shows info about nf_conntrack and /proc/modules file tells ...
1
vote
1answer
1k views

Is there any way to view nfmark like ctmark?

I understand that iptables --set-mark does not add mark "on" the packets. The MARK target is for associating a mark with the packet in the kernel data structures. The packet itself is not modified. ...
7
votes
0answers
360 views

Multicast ICMPv6 comes back with conntrack state invalid

I was playing arround with the Multicast feature of IPv6. $ ping ff02::2%wlp3s0 This should normally result in an echo-reply from all the routers on your local network segment (Wikipedia - IPv6). So ...
1
vote
1answer
4k views

nf_conntrack_sip does not work SOMETIMES, restarting iptables USUALLY fixes it

I'm trying to use nf_conntrack_sip on box that is running Asterisk, that is, not routing traffic for another VoIP box. Setup works until I reboot. After reboot nf_conntrack_sip ALMOST always stops ...
1
vote
0answers
605 views

iptables connlimit-above allowing more connections than desired

I'm trying to set a per-ip connection limit on a kubernetes node using iptables connlimit. Since each container on the VM has a different source IP (overlay net), using connlimit should work. I added ...
1
vote
1answer
453 views

How to catch conntrack markers correctly?

Server with DHCP (iface eth0 172.5.1.1/24) gives internet via openvpn tunnel(iface tun0 10.8.1.6) to lan clients. I need to mark tcp connections from exact lan client, for example 172.5.1.123 ...
0
votes
1answer
612 views

How to resolve "no connection tracking support in the kernel" in Vuurmuur?

So I'm trying to get Vuurmuur installed on a headless linux box that I've been using as a home router. So far, I've been using iptables but wanted to switch to using something more convenient/easier ...
2
votes
1answer
5k views

conntrack entries details

I amreading the documentation of Iptables about the connection tracking here and I have troubles figuring the following part, highlited by me: tcp 6 117 SYN_SENT src=192.168.1.6 dst=192.168.1.9 ...
2
votes
0answers
131 views

Does Linux still enforce a connection tracking limit?

We've recently upgraded to Ubuntu 16.04 (kernel 4.4) and I've noticed some new behavior regarding net.netfilter.nf_conntrack_max. In the past (with 12.04 running 3.2) if you hit nf_conntrack_max you ...
5
votes
1answer
3k views

Is there a way to have NPTv6 with connection tracking on Linux?

Apparently, the implementation of NPTv6 (Network Prefix Translation for IPv6) which is currently in Linux kernel is incompatible with connection tracking. This is quite disappointing, since I feel ...
1
vote
0answers
501 views

Default number of connections that are allowed per ip per minute/second

I have the following rules applied as a part of DDoS prevention. To prevent Spoofed packets -A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP" -A INPUT -s 255.0.0.0/8 -j DROP -A INPUT -...
0
votes
0answers
50 views

error nf_conntrack table full without iptables running

Why I am getting "nf_conntrack table full" error in syslog even when I am not running iptables? I believe if iptables not running then nf_conntrack shouldn't used, even it's loaded into the kernel.
5
votes
1answer
335 views

connlimit counters start over after iptables restored

I have a connlimit rule in iptables that allow only 5 connection to port 80. iptables -A FORWARD -p tcp -m tcp --syn --dport 80 -m connlimit --connlimit-above 5 --connlimit-saddr -j DROP This ...
-1
votes
1answer
2k views

Why is /proc/net/nf_conntrack empty?

On my RHEL 6.5 I expected /proc/net/nf_conntrack to contain the latest/current connections but it is completely empty: [root@plop ~]# cat /proc/net/nf_conntrack [root@plop ~]# Can you help me ...
1
vote
0answers
619 views

conntrack -E - traffic counter reporting

I'm currently in the process of writing small solution which would continuously receive output from conntrack -E command and along with some other stats, it would count/monitor traffic. The only ...
1
vote
0answers
295 views

How to drop packet if conntrack entry not present

Is there a way to check if conntrack exists before doing a particular action in iptable chains ? I would like to drop the packet in mangle-postrouting if conntrack entry is not present, dont want it ...
0
votes
1answer
693 views

ip_conntrack and FreeBSD

We can figure out number of connections in GNU\Linux with ip_conntrack module, And I can print current connections and maximum of connections with: root@debian:/home/mohsen/test/shell# sysctl net....
6
votes
2answers
939 views

MySQL has over 95,000 connections but processlist is empty?

I have a server that is running mysql and it's using a lot of memory. I run: mysql > show status like '%onn%'; +--------------------------+-------+ | Variable_name | Value | +----------...