^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) .. SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) ===================================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) Netfilter Conntrack Sysfs variables
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) ===================================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) /proc/sys/net/netfilter/nf_conntrack_* Variables:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) =================================================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) nf_conntrack_acct - BOOLEAN
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) - 0 - disabled (default)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) - not 0 - enabled
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) Enable connection tracking flow accounting. 64-bit byte and packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) counters per flow are added.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) nf_conntrack_buckets - INTEGER
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) Size of hash table. If not specified as parameter during module
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) loading, the default size is calculated by dividing total memory
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) by 16384 to determine the number of buckets but the hash table will
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) never have fewer than 32 and limited to 16384 buckets. For systems
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) with more than 4GB of memory it will be 65536 buckets.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) This sysctl is only writeable in the initial net namespace.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) nf_conntrack_checksum - BOOLEAN
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) - 0 - disabled
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) - not 0 - enabled (default)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) Verify checksum of incoming packets. Packets with bad checksums are
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) in INVALID state. If this is enabled, such packets will not be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) considered for connection tracking.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) nf_conntrack_count - INTEGER (read-only)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) Number of currently allocated flow entries.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) nf_conntrack_events - BOOLEAN
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) - 0 - disabled
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) - not 0 - enabled (default)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) If this option is enabled, the connection tracking code will
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) provide userspace with connection tracking events via ctnetlink.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) nf_conntrack_expect_max - INTEGER
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) Maximum size of expectation table. Default value is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) nf_conntrack_buckets / 256. Minimum is 1.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) nf_conntrack_frag6_high_thresh - INTEGER
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) default 262144
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) Maximum memory used to reassemble IPv6 fragments. When
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) nf_conntrack_frag6_high_thresh bytes of memory is allocated for this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) purpose, the fragment handler will toss packets until
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) nf_conntrack_frag6_low_thresh is reached.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) nf_conntrack_frag6_low_thresh - INTEGER
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) default 196608
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) See nf_conntrack_frag6_low_thresh
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) nf_conntrack_frag6_timeout - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) default 60
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) Time to keep an IPv6 fragment in memory.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) nf_conntrack_generic_timeout - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) default 600
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) Default for generic timeout. This refers to layer 4 unknown/unsupported
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) protocols.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) nf_conntrack_helper - BOOLEAN
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) - 0 - disabled (default)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) - not 0 - enabled
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) Enable automatic conntrack helper assignment.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) If disabled it is required to set up iptables rules to assign
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) helpers to connections. See the CT target description in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) iptables-extensions(8) man page for further information.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) nf_conntrack_icmp_timeout - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) default 30
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) Default for ICMP timeout.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) nf_conntrack_icmpv6_timeout - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) default 30
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) Default for ICMP6 timeout.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) nf_conntrack_log_invalid - INTEGER
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) - 0 - disable (default)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) - 1 - log ICMP packets
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) - 6 - log TCP packets
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) - 17 - log UDP packets
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) - 33 - log DCCP packets
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) - 41 - log ICMPv6 packets
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) - 136 - log UDPLITE packets
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) - 255 - log packets of any protocol
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) Log invalid packets of a type specified by value.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) nf_conntrack_max - INTEGER
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) Size of connection tracking table. Default value is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) nf_conntrack_buckets value * 4.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) nf_conntrack_tcp_be_liberal - BOOLEAN
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) - 0 - disabled (default)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) - not 0 - enabled
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) Be conservative in what you do, be liberal in what you accept from others.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) If it's non-zero, we mark only out of window RST segments as INVALID.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) nf_conntrack_tcp_loose - BOOLEAN
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) - 0 - disabled
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) - not 0 - enabled (default)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) If it is set to zero, we disable picking up already established
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) connections.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) nf_conntrack_tcp_max_retrans - INTEGER
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) default 3
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) Maximum number of packets that can be retransmitted without
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) received an (acceptable) ACK from the destination. If this number
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) is reached, a shorter timer will be started.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) nf_conntrack_tcp_timeout_close - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) default 10
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) nf_conntrack_tcp_timeout_close_wait - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) default 60
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) nf_conntrack_tcp_timeout_established - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) default 432000 (5 days)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) nf_conntrack_tcp_timeout_fin_wait - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) default 120
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) nf_conntrack_tcp_timeout_last_ack - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) default 30
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) nf_conntrack_tcp_timeout_max_retrans - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) default 300
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) nf_conntrack_tcp_timeout_syn_recv - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) default 60
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) nf_conntrack_tcp_timeout_syn_sent - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) default 120
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) nf_conntrack_tcp_timeout_time_wait - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) default 120
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) nf_conntrack_tcp_timeout_unacknowledged - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) default 300
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) nf_conntrack_timestamp - BOOLEAN
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) - 0 - disabled (default)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) - not 0 - enabled
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) Enable connection tracking flow timestamping.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) nf_conntrack_udp_timeout - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) default 30
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) nf_conntrack_udp_timeout_stream - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) default 120
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) This extended timeout will be used in case there is an UDP stream
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) detected.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) nf_conntrack_gre_timeout - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) default 30
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) nf_conntrack_gre_timeout_stream - INTEGER (seconds)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) default 180
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) This extended timeout will be used in case there is an GRE stream
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) detected.
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags