CONNTRACKD.CONF(5) (NAME) conntrackd.conf - conntrackd (DESCRIPTION) conntrackd.conf conntrackd(8) . `conntrackd -C conntrackd.conf` . (brackets) - : section1 { option1 value1 option2 value2 } section2 { option3 value3 subsection1 { option4 value4 } } (case-sensitive) . '#' . http://conntrack- tools.netfilter.org/manual.html . . (SYNC) conntrackd(8) . : NOTRACK ALARM FTFW . : TCP Multicast UDP . . . FTFW (Mode FTFW) (reliable) . . ResendQueueSize CommitTimeout PurgeTimeout ACKWindowSize DisableExternalCache StartupResync . ResendQueueSize <> ( ). acknowledgment . . . : ResendQueueSize 131072 131072 . CommitTimeout <> (backup) (primary) (timeout) . . TCP Established SSH KeepAlive . : CommitTimeout 180 ( ). PurgeTimeout <> `conntrackd -t` . N . (zombie) (hand-over) . 60 . ACKWindowSize <> (acknowledgment) . . (overhead) conntrackd(8) . . . : ACKWindowSize 300 300 ( acknowledgment oprofile ). DisableExternalCache (external cache) . conntrack . conntrack . . Linux kernel >= 2.6.29 . conntrackd(8) fail-over ! no . StartupResync conntrackd conntrack . . . : StartupResync yes no . ALARM (Mode ALARM) (spamming) . . . RefreshTime CacheTimeout CommitTimeout PurgeTimeout . RefreshTime <> conntrack N (broadcast) . . : RefreshTime 15 CacheTimeout <> N . : CacheTimeout 180 CommitTimeout <> FTFW . PurgeTimeout <> FTFW . NOTRACK (Mode NOTRACK) (best effort) (unreliable) . . DisableInternalCache DisableExternalCache CommitTimeout PurgeTimeout StartupResync . DisableInternalCache . . no . DisableExternalCache FTFW . CommitTimeout <> FTFW . PurgeTimeout <> FTFW . StartupResync FTFW . (MULTICAST) conntrackd(8) (multicast) . . (fail-over) . . . Default . (redundant) . : . : Multicast Default { IPv4_address 225.0.0.51 Group 3781 IPv4_interface 192.168.100.101 Interface eth3 SndSocketBuffer 1249280 RcvSocketBuffer 1249280 Checksum on } Multicast { IPv4_address 225.0.0.51 Group 3782 IPv4_interface 192.168.100.102 Interface eth4 SndSocketBuffer 1249280 RcvSocketBuffer 1249280 Checksum on } IPv4_address <> : . IP . : IPv4_address 255.0.0.50 Group <> . : Group 3780 . IPv4_interface <> IP . . : IPv4_interface 192.168.100.100 Interface <> . : Interface eth2 SndSocketBuffer <> . /proc/sys/net/core/wmem_default . (overrun) . . . . : NOTRACK (best effort) . : SndSocketBuffer 1249280 RcvSocketBuffer <> . /proc/sys/net/core/rmem_default . . . . . : NOTRACK . : RcvSocketBuffer 1249280 Checksum / (checksum) . (fault-tolerance) . . UDP (UDP) conntrackd(8) UDP . Multicast Default (fail-over) . : UDP { IPv4_address 172.16.0.1 IPv4_Destination_Address 172.16.0.2 Port 3781 Interface eth3 SndSocketBuffer 1249280 RcvSocketBuffer 1249280 Checksum on } IPv4_address <> IPv4 UDP . : IPv4_address 192.168.2.100 IPv6_address <> IPv6 UDP . : IPv6_address fe80::215:58ff:fe28:5a27 IPv4_Destination_Address <> IPv4 UDP . : IPv4_Destination_Address 192.168.2.101 IPv6_Destionation_Address <> IPv6 UDP . : IPv6_Destination_Address fe80::2d0:59ff:fe2a:775c Port <> UDP . : Port 3780 Interface <> Multicast . SndSocketBuffer <> Multicast . RcvSocketBuffer <> Multicast . Checksum Multicast . TCP (TCP) (Unicast) TCP . NOTRACK (reliable) . TCP UDP . Multicast Default fail-over . : TCP { IPv6_address fe80::215:58ff:fe28:5a27 IPv6_Destination_Address fe80::215:58ff:fe28:5a27 Port 3781 Interface eth2 SndSocketBuffer 1249280 RcvSocketBuffer 1249280 Checksum yes } (OPTIONS) . TCPWindowTracking TCP (window tracking) . (off) . Linux kernel >= 2.6.36 . ExpectationSync (expectations) on . (helpers) . Linux kernel >= 3.5 . : ExpectationSync on : ExpectationSync { ftp ras q.931 h.245 sip } . (GENERAL) conntrackd(8) . Systemd conntrackd(8) systemd(1) . Type=notify . (init) systemd(1) . : (watchdog) systemd(1) . : Systemd yes conntrackd systemd . Nice <> . conntrackd . nice(1) renice(1) . conntrackd(8) (RT) . HashSize <> (buckets) (cache hashtable). O(1) . . : HashSize 32768 HashLimit <> conntrack /proc/sys/net/netfilter/nf_conntrack_max . : HashLimit 131072 LogFile > conntrackd(8) . : LogFile no no . /var/log/conntrackd.log . Syslog > Syslog . (facility) Stats . : Syslog local0 off . Lockfile <> (lockfile) conntrackd(8) ( ). : LockFile /var/lock/conntrack.lock /var/lock/conntrack.lock . NetlinkBufferSize <> (Netlink). /proc/sys/net/core/rmem_default . 100 Kbytes . . : NetlinkBufferSize 2097152 NetlinkBufferSizeMaxGrowth <> . . : NetlinkBufferSizeMaxGrowth 8388608 NetlinkOverrunResync > ( ) . . : . : NetlinkOverrunResync yes 30 . . NetlinkEventsReliable . NetlinkOverrunResync . Linux Kernel >= 2.6.31 . : NetlinkEventsReliable yes (off) . PollSecs <> (event-driven) . (polling) . conntrackd(8) N (dump) . polling . . : PollSecs 15 EventIterationLimit <> . ( ) . ( ) . : EventIterationLimit 100 ( ) . (UNIX) . conntrackd(8) `conntrackd -k` `conntrackd -n` . : UNIX { Path /var/run/conntrackd.ctl } Path <> . : Path /var/run/conntrackd.ctl Backlog <> . (FILTER) . . : Protocol Address State . (action) : Accept Ignore . . conntrackd(8) (userspace) (kernelspace). . Linux kernel >= 2.6.29 . : Filter From { }. Userspace Kernelspace . : Filter From Userspace { Protocol Accept { TCP SCTP DCCP } Address Ignore { IPv4_address 127.0.0.1 IPv6_address ::1 } State Accept { ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP } } Protocol <> { < > } : . (Policy) Accept Ignore . : TCP SCTP DCCP UDP ICMP IPv6-ICMP . ICMP IPv6-ICMP Linux kernel >= 2.6.31 . : Protocol Accept { TCP SCTP DCCP } Address <> { < > } IP: IP (forwarded) . IP . IPv4_address / IPv6_address . CIDR . Accept Ignore . : Address Ignore { IPv4_address 127.0.0.1 # loopback IPv4_address 192.168.0.100 # virtual IP 1 IPv4_address 192.168.1.100 # virtual IP 2 IPv4_address 192.168.100.100 # dedicated link ip IPv4_address 192.168.0.0/24 IPv6_address ::1 } State <> { < > for TCP } . : (lazy) . : TCP . TCP : SYN_SENT SYN_RECV ESTABLISHED FIN_WAIT CLOSE_WAIT LAST_ACK TIME_WAIT CLOSED LISTEN . Accept Ignore . : State Accept { ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP } (SCHEDULER) RR FIFO . (RT) conntrackd(8) RR FIFO . sched_setscheduler(2) . : Scheduler { Type FIFO Priority 99 } Type <> RR FIFO . : RR Priority <> . . : ( sched_get_priority_max(2) SCHED_RR ). (STATS) conntrackd(8) nf_conntrack . LogFile > . no . /var/log/conntrackd-stats.log . NetlinkEventsReliable . NetlinkOverrunResync . Linux kernel >= 2.6.31 . no . Syslog > Syslog . General . : Syslog local0 no . (HELPER) : . conntrackd(8) (user-space helpers) nf_conntrack . nf_conntrack . (stub) . : % nfct add helper ftp inet tcp Type : Type : Helper { Type ftp inet tcp { QueueNum 0 QueueLen 10240 Policy ftp { ExpectMax 1 ExpectTimeout 300 } } Type rpc inet tcp { QueueNum 1 QueueLen 10240 Policy rpc { ExpectMax 1 ExpectTimeout 300 } } Type rpc inet udp { QueueNum 2 QueueLen 10240 Policy rpc { ExpectMax 1 ExpectTimeout 300 } } Type tns inet tcp { QueueNum 3 QueueLen 10240 Policy tns { ExpectMax 1 ExpectTimeout 300 } } Type dhcpv6 inet6 udp { QueueNum 4 QueueLen 10240 Policy dhcpv6 { ExpectMax 1 ExpectTimeout 300 } } Type ssdp inet udp { QueueNum 5 QueueLen 10240 Policy ssdp { ExpectMax 1 ExpectTimeout 300 } } } Type : QueueNum <> NFQUEUE . : QueueNum 0 QueueLen <> (verdict) . : "nf_queue: full at X entries, dropping packet(s)" 1024 . : QueueLen 10240 Policy <> { } (expectation policy) . : ExpectMax <> ( ) ExpecTimeout <> ( ). (COMPLETE EXAMPLES) . (STATS EXAMPLE) conntrackd(8) . Stats { LogFile yes NetlinkEventsReliable no Syslog yes } General { Systemd yes HashSize 8192 HashLimit 65535 Syslog yes LockFile /var/lock/conntrack.lock UNIX { Path /var/run/conntrackd.ctl } NetlinkBufferSize 262142 NetlinkBufferSizeMaxGrowth 655355 Filter { Protocol Accept { TCP UDP } Address Ignore { IPv4_address 127.0.0.1 IPv6_address ::1 } } } (SYNC EXAMPLE 1) FTFW Multicast . . : conntrackd(8) . Sync { Mode FTFW { ResendQueueSize 131072 PurgeTimeout 60 ACKWindowSize 300 DisableExternalCache no } Multicast { IPv4_address 225.0.0.50 Group 3780 IPv4_interface 192.168.100.100 Interface eth2 SndSocketBuffer 1249280 RcvSocketBuffer 1249280 Checksum yes } Multicast Default { IPv4_address 225.0.0.51 Group 3781 IPv4_interface 192.168.100.101 Interface eth3 SndSocketBuffer 1249280 RcvSocketBuffer 1249280 Checksum yes } Options { TCPWindowTracking no ExpectationSync yes } } General { Systemd yes HashSize 32768 HashLimit 131072 LogFile yes Syslog no LockFile /var/lock/conntrack.lock UNIX { Path /var/run/conntrackd.ctl } NetlinkBufferSize 2097152 NetlinkBufferSizeMaxGrowth 8388608 NetlinkOverrunResync yes NetlinkEventsReliable no EventIterationLimit 100 Filter From Userspace { Protocol Accept { TCP SCTP DCCP } Address Ignore { IPv4_address 127.0.0.1 IPv4_address 192.168.100.0/24 IPv6_address ::1 } } } (SYNC EXAMPLE 2) NOTRACK TCP . . Sync { Mode NOTRACK { DisableInternalCache yes DisableExternalCache yes } TCP { IPv4_address 192.168.2.100 IPv4_Destination_Address 192.168.2.101 Port 3780 Interface eth2 SndSocketBuffer 1249280 RcvSocketBuffer 1249280 Checksum yes } Options { TCPWindowTracking no ExpectationSync yes } } General { Systemd yes HashSize 32768 HashLimit 131072 LogFile yes Syslog no LockFile /var/lock/conntrack.lock UNIX { Path /var/run/conntrackd.ctl } NetlinkBufferSize 2097152 NetlinkBufferSizeMaxGrowth 8388608 NetlinkOverrunResync yes NetlinkEventsReliable no EventIterationLimit 100 Filter From Userspace { Protocol Accept { TCP SCTP DCCP } Address Ignore { IPv4_address 127.0.0.1 IPv4_address 192.168.0.0/16 IPv6_address ::1 } State Accept { ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP } } } (SEE ALSO) conntrackd(8), conntrack(8), nfct(8), http://conntrack-tools.netfilter.org/manual.html (AUTHORS) Pablo Neira Ayuso conntrackd . Arturo Borrero Gonzalez conntrackd . . . GPLv2+ / . Netfilter 20 2021 CONNTRACKD.CONF(5)