net.netfilter.nf_conntrack_tcp_timeout_syn_recv is being updated to 60 by itself

[David123]

Hello,
I have an issue where

net.netfilter.nf_conntrack_tcp_timeout_syn_recv is being updated by itself in proxmox to 60. It happens every perhaps 20s.

root@localhost:/etc/sysctl.d# sysctl net.netfilter.nf_conntrack_tcp_timeout_syn_recv
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 6
root@localhost:/etc/sysctl.d# sysctl net.netfilter.nf_conntrack_tcp_timeout_syn_recv
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60

I had similar issue with nf_conntrack_max before but found out that this value needed to be set in the firewall setting. But I can't find any such setting for net.netfilter.nf_conntrack_tcp_timeout_syn_recv in the UI

According to docs: https://pve.proxmox.com/pve-docs-7/chapter-pve-firewall.html

nf_conntrack_tcp_timeout_syn_recv:

Is a valid setting. However if I do set something like:

nf_conntrack_tcp_timeout_syn_recv: 30

It actually never updates to 30. Instead now it stops to auto refresh - guess that solved that issue but seems very broken

Can you advice?

 

[gfngfn256]

AFAICT from the docs you have linked:

nf_conntrack_tcp_timeout_syn_recv: <integer> (30 - 60) (default = 60)
Conntrack syn recv timeout.

and that setting needs to placed in /etc/pve/nodes/<nodename>/host.fw
So if you have no setting there it defaults to 60, as above.

Good luck.