Questions tagged [ip-conntrack]

The tag has no usage guidance.

0
votes
1answer
18 views

Gracefully closing an inactive TCP connection

Does exist a command to "gracefully" close a TCP connection opened by a process before it reaches its timeout? I would like to gracefully close all those TCP connections in a CLOSE_WAIT/TIME_WAIT ...
1
vote
1answer
20 views

How long does conntrack remember a connection?

From this link it seems that conntrack remembers a connection for X seconds after it is closed. Does anybody know how long that X is and if it is configurable?
0
votes
1answer
31 views

Conntrack and dynamic ipset/iptables rules

I don't understand some basic concepts of conntrack module. First of all, I'm sure it's enabled in my system (Ubuntu 18.04), modinfo shows info about nf_conntrack and /proc/modules file tells ...
0
votes
0answers
27 views

Keep conntrack state for current ssh connection on netfilter rule flush/reload

When i am reloading netfilter with a new ruleset that drops invalid packets flush ruleset ... ct state invalid counter log prefix "Drop input invalid " drop comment "drop invalid packets" ... over ...
0
votes
1answer
85 views

Is there any way to view nfmark like ctmark?

I understand that iptables --set-mark does not add mark "on" the packets. The MARK target is for associating a mark with the packet in the kernel data structures. The packet itself is not modified. ...
4
votes
0answers
81 views

Multicast ICMPv6 comes back with conntrack state invalid

I was playing arround with the Multicast feature of IPv6. $ ping ff02::2%wlp3s0 This should normally result in an echo-reply from all the routers on your local network segment (Wikipedia - IPv6). So ...
1
vote
2answers
983 views

nf_conntrack_sip does not work SOMETIMES, restarting iptables USUALLY fixes it

I'm trying to use nf_conntrack_sip on box that is running Asterisk, that is, not routing traffic for another VoIP box. Setup works until I reboot. After reboot nf_conntrack_sip ALMOST always stops ...
1
vote
0answers
229 views

iptables connlimit-above allowing more connections than desired

I'm trying to set a per-ip connection limit on a kubernetes node using iptables connlimit. Since each container on the VM has a different source IP (overlay net), using connlimit should work. I added ...
1
vote
1answer
181 views

How to catch conntrack markers correctly?

Server with DHCP (iface eth0 172.5.1.1/24) gives internet via openvpn tunnel(iface tun0 10.8.1.6) to lan clients. I need to mark tcp connections from exact lan client, for example 172.5.1.123 ...
0
votes
1answer
361 views

How to resolve “no connection tracking support in the kernel” in Vuurmuur?

So I'm trying to get Vuurmuur installed on a headless linux box that I've been using as a home router. So far, I've been using iptables but wanted to switch to using something more convenient/easier ...
1
vote
1answer
2k views

conntrack entries details

I amreading the documentation of Iptables about the connection tracking here and I have troubles figuring the following part, highlited by me: tcp 6 117 SYN_SENT src=192.168.1.6 dst=192.168.1.9 ...
2
votes
0answers
92 views

Does Linux still enforce a connection tracking limit?

We've recently upgraded to Ubuntu 16.04 (kernel 4.4) and I've noticed some new behavior regarding net.netfilter.nf_conntrack_max. In the past (with 12.04 running 3.2) if you hit nf_conntrack_max you ...
4
votes
1answer
1k views

Is there a way to have NPTv6 with connection tracking on Linux?

Apparently, the implementation of NPTv6 (Network Prefix Translation for IPv6) which is currently in Linux kernel is incompatible with connection tracking. This is quite disappointing, since I feel ...
1
vote
0answers
326 views

Default number of connections that are allowed per ip per minute/second

I have the following rules applied as a part of DDoS prevention. To prevent Spoofed packets -A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP" -A INPUT -s 255.0.0.0/8 -j DROP -A INPUT -...
0
votes
0answers
42 views

error nf_conntrack table full without iptables running

Why I am getting "nf_conntrack table full" error in syslog even when I am not running iptables? I believe if iptables not running then nf_conntrack shouldn't used, even it's loaded into the kernel.
5
votes
1answer
256 views

connlimit counters start over after iptables restored

I have a connlimit rule in iptables that allow only 5 connection to port 80. iptables -A FORWARD -p tcp -m tcp --syn --dport 80 -m connlimit --connlimit-above 5 --connlimit-saddr -j DROP This ...
-1
votes
1answer
2k views

Why is /proc/net/nf_conntrack empty?

On my RHEL 6.5 I expected /proc/net/nf_conntrack to contain the latest/current connections but it is completely empty: [root@plop ~]# cat /proc/net/nf_conntrack [root@plop ~]# Can you help me ...
1
vote
0answers
479 views

conntrack -E - traffic counter reporting

I'm currently in the process of writing small solution which would continuously receive output from conntrack -E command and along with some other stats, it would count/monitor traffic. The only ...
1
vote
0answers
239 views

How to drop packet if conntrack entry not present

Is there a way to check if conntrack exists before doing a particular action in iptable chains ? I would like to drop the packet in mangle-postrouting if conntrack entry is not present, dont want it ...
0
votes
1answer
519 views

ip_conntrack and FreeBSD

We can figure out number of connections in GNU\Linux with ip_conntrack module, And I can print current connections and maximum of connections with: root@debian:/home/mohsen/test/shell# sysctl net....
5
votes
2answers
650 views

MySQL has over 95,000 connections but processlist is empty?

I have a server that is running mysql and it's using a lot of memory. I run: mysql > show status like '%onn%'; +--------------------------+-------+ | Variable_name | Value | +----------...