persistent nf_conntrack sysctl

[gernazdasch]

Hello.

I am trying to modify nf_conntrack options

in /etc/sysctl.conf i have :

net.netfilter.nf_conntrack_generic_timeout=60
net.netfilter.nf_conntrack_icmp_timeout=10
#net.netfilter.nf_conntrack_tcp_timeout_close=10
net.netfilter.nf_conntrack_tcp_timeout_close_wait=20
net.netfilter.nf_conntrack_tcp_timeout_established=1800
net.netfilter.nf_conntrack_tcp_timeout_fin_wait=30
#net.netfilter.nf_conntrack_tcp_timeout_last_ack=30
#net.netfilter.nf_conntrack_tcp_timeout_max_retrans=300
net.netfilter.nf_conntrack_tcp_timeout_syn_recv=30
net.netfilter.nf_conntrack_tcp_timeout_syn_sent=60
net.netfilter.nf_conntrack_tcp_timeout_time_wait=60
#net.netfilter.nf_conntrack_tcp_timeout_unacknowledged=300
#net.netfilter.nf_conntrack_udp_timeout=30
net.netfilter.nf_conntrack_udp_timeout_stream=60

and in /etc/network/interfaces i have :

auto vmbr1
iface vmbr1 inet static
        address 192.168.10.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0

        # give internet to this network
        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up echo 60 > /proc/sys/net/netfilter/nf_conntrack_generic_timeout;
        post-up echo 10 > /proc/sys/net/netfilter/nf_conntrack_icmp_timeout;
        post-up echo 10 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_close;
        post-up echo 20 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_close_wait;
        post-up echo 1800 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established;
        post-up echo 30 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_fin_wait;
        post-up echo 30 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_last_ack;
        post-up echo 300 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_max_retrans;
        post-up echo 30 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_syn_recv;
        post-up echo 60 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_syn_sent;
        post-up echo 60 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_time_wait;
        post-up echo 300 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_unacknowledged;
        post-up echo 30 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout;
        post-up echo 60 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout_stream;

Every time when i restart Proxmox i still get the default values, why is that?

And why i get so many nf_conntrack connections?

==> nf_conntrack_count <==
105421

Sometimes i can even have 400.000+ and most of them are ESTABLISHED :

conntrack -L | cut -d " " -f9 | sort  | uniq -c | sort -nr
conntrack v1.4.5 (conntrack-tools): 66510 flow entries have been shown.
  46345 ESTABLISHED
   6490 TIME_WAIT
   5658 SYN_SENT
   3834 CLOSE
   2101 SYN_RECV
   1093 LAST_ACK
    949 FIN_WAIT
     34 CLOSE_WAIT

I am using the VM for web crawling running a multi-threaded app.

 

[spirit]

the main problem is that sysctl can't be setup, if nfconntrack module is not yet loaded.

iptables dynamically loaded it when creating rules.

simply add a file:

/etc/modules-load.d/nf_conntrack.conf
with

nf_conntrack
nf_conntrack_ipv4
nf_conntrack_ipv6
nf_conntrack_ftp

then your sysctl shoud work at boot.

And why i get so many nf_conntrack connections?
I am using the VM for web crawling running a multi-threaded app.

Does you web crawling create 1 connection by http request ? (http 1.0). or does it use keepalived (http 1.1?).
also is you application closing nicely the tcp connection ?

(a clean tcp RST should remove the entry from conntrack)

 

[gernazdasch]

the main problem is that sysctl can't be setup, if nfconntrack module is not yet loaded.

iptables dynamically loaded it when creating rules.

simply add a file:

/etc/modules-load.d/nf_conntrack.conf
with

nf_conntrack
nf_conntrack_ipv4
nf_conntrack_ipv6
nf_conntrack_ftp

then your sysctl shoud work at boot.



Does you web crawling create 1 connection by http request ? (http 1.0). or does it use keepalived (http 1.1?).
also is you application closing nicely the tcp connection ?

(a clean tcp RST should remove the entry from conntrack)

Yes, i am doing a lot of connections and i don't close them, because using the .close() function would consume more CPU/RAM and other resources, so instead i am killing the thread/fork and letting kernel doing its job.

On other dedicated servers, this is no problem, as they are automatically get cleaned.

A simple conntrack -F table shouldn't solve this problem without loosing packets? I have to say that this occurs when using NAT on VM, if i started the script straight from a dedicated (not VM enviroment) this is not occurring.

I tried what you told me, is not working, still having the default value after reboot :

/proc/sys/net# cat nf_conntrack_max
262144