persistent nf_conntrack sysctl

gernazdasch

New Member
Jun 9, 2022
20
1
3
Hello.

I am trying to modify nf_conntrack options

in /etc/sysctl.conf i have :

Code:
net.netfilter.nf_conntrack_generic_timeout=60
net.netfilter.nf_conntrack_icmp_timeout=10
#net.netfilter.nf_conntrack_tcp_timeout_close=10
net.netfilter.nf_conntrack_tcp_timeout_close_wait=20
net.netfilter.nf_conntrack_tcp_timeout_established=1800
net.netfilter.nf_conntrack_tcp_timeout_fin_wait=30
#net.netfilter.nf_conntrack_tcp_timeout_last_ack=30
#net.netfilter.nf_conntrack_tcp_timeout_max_retrans=300
net.netfilter.nf_conntrack_tcp_timeout_syn_recv=30
net.netfilter.nf_conntrack_tcp_timeout_syn_sent=60
net.netfilter.nf_conntrack_tcp_timeout_time_wait=60
#net.netfilter.nf_conntrack_tcp_timeout_unacknowledged=300
#net.netfilter.nf_conntrack_udp_timeout=30
net.netfilter.nf_conntrack_udp_timeout_stream=60

and in /etc/network/interfaces i have :
Code:
auto vmbr1
iface vmbr1 inet static
        address 192.168.10.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0

        # give internet to this network
        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up echo 60 > /proc/sys/net/netfilter/nf_conntrack_generic_timeout;
        post-up echo 10 > /proc/sys/net/netfilter/nf_conntrack_icmp_timeout;
        post-up echo 10 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_close;
        post-up echo 20 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_close_wait;
        post-up echo 1800 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established;
        post-up echo 30 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_fin_wait;
        post-up echo 30 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_last_ack;
        post-up echo 300 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_max_retrans;
        post-up echo 30 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_syn_recv;
        post-up echo 60 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_syn_sent;
        post-up echo 60 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_time_wait;
        post-up echo 300 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_unacknowledged;
        post-up echo 30 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout;
        post-up echo 60 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout_stream;

Every time when i restart Proxmox i still get the default values, why is that?

And why i get so many nf_conntrack connections?

==> nf_conntrack_count <==
105421

Sometimes i can even have 400.000+ and most of them are ESTABLISHED :

Code:
conntrack -L | cut -d " " -f9 | sort  | uniq -c | sort -nr
conntrack v1.4.5 (conntrack-tools): 66510 flow entries have been shown.
  46345 ESTABLISHED
   6490 TIME_WAIT
   5658 SYN_SENT
   3834 CLOSE
   2101 SYN_RECV
   1093 LAST_ACK
    949 FIN_WAIT
     34 CLOSE_WAIT

I am using the VM for web crawling running a multi-threaded app.
 

spirit

Famous Member
Apr 2, 2010
5,866
702
133
www.odiso.com
the main problem is that sysctl can't be setup, if nfconntrack module is not yet loaded.

iptables dynamically loaded it when creating rules.

simply add a file:

/etc/modules-load.d/nf_conntrack.conf
with
Code:
nf_conntrack
nf_conntrack_ipv4
nf_conntrack_ipv6
nf_conntrack_ftp

then your sysctl shoud work at boot.

And why i get so many nf_conntrack connections?
I am using the VM for web crawling running a multi-threaded app.

Does you web crawling create 1 connection by http request ? (http 1.0). or does it use keepalived (http 1.1?).
also is you application closing nicely the tcp connection ?

(a clean tcp RST should remove the entry from conntrack)
 

gernazdasch

New Member
Jun 9, 2022
20
1
3
the main problem is that sysctl can't be setup, if nfconntrack module is not yet loaded.

iptables dynamically loaded it when creating rules.

simply add a file:

/etc/modules-load.d/nf_conntrack.conf
with
Code:
nf_conntrack
nf_conntrack_ipv4
nf_conntrack_ipv6
nf_conntrack_ftp

then your sysctl shoud work at boot.



Does you web crawling create 1 connection by http request ? (http 1.0). or does it use keepalived (http 1.1?).
also is you application closing nicely the tcp connection ?

(a clean tcp RST should remove the entry from conntrack)
Yes, i am doing a lot of connections and i don't close them, because using the .close() function would consume more CPU/RAM and other resources, so instead i am killing the thread/fork and letting kernel doing its job.

On other dedicated servers, this is no problem, as they are automatically get cleaned.

A simple conntrack -F table shouldn't solve this problem without loosing packets? I have to say that this occurs when using NAT on VM, if i started the script straight from a dedicated (not VM enviroment) this is not occurring.

I tried what you told me, is not working, still having the default value after reboot :

Code:
/proc/sys/net# cat nf_conntrack_max
262144
 
Last edited:

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get your own in 60 seconds.

Buy now!