netfilter's Connection Tracking system (nf_conntrack)

What is netfilter's Connection Tracking system?

The connection tracking system Show archive.org snapshot often referenced as nf_conntrack is part of the Netfilter framework. It allows the Linux kernel to keep track of all logical network connections and sessions. In combination with iptables this feature is used to achieve a stateful firewall.

Why to care about nf_conntrack?

All connections are stored in the connection tracking table. The size of the tracking table is based on the memory of the system. A node with 4 GB RAM will get a maximum table size of 64 KB.

On most systems the default settings are fine. However if you're running a VM host which has a lot of virtual machines running which by themselves have a lot of connections the connection tracking table can get filled. This could happen if you're running virtual load balancers on your VM hosts.

If the table is full and there are still many new connections coming in the kernel will start to drop packages. You might not be able to establish new connections and dmesg will output messages like:

Copy2021-06-29T09:21:01,266251+02:00 nf_conntrack: nf_conntrack: table full, dropping packet
2021-06-29T09:21:01,267799+02:00 nf_conntrack: nf_conntrack: table full, dropping packet
2021-06-29T09:21:01,267806+02:00 nf_conntrack: nf_conntrack: table full, dropping packet

Interact with nf_conntrack

It's possible to interact with nf_conntrack directly via the /proc/sys/net/netfilter/nf_conntrack_* variables Show archive.org snapshot or through a userspace tool like conntrack.

Get the maximum size of the connection tracking table

Copy$ cat /proc/sys/net/netfilter/nf_conntrack_max

Get the size of the currently allocated flow entries

Copy$ cat /proc/sys/net/netfilter/nf_conntrack_count

Raise the connection tracking table size to 512 KB

Copy$ sudo sysctl -w net.nf_conntrack_max=524288

Attention: If you're using Proxmox the sysctl value will get restored after a short moment. Change the option nf_conntrack_max in the host specific firewall configuration Show archive.org snapshot instead.

List all connection tracking table entries

Copy$ sudo conntrack -L

Check for temporary entries

These entries will be deleted Show archive.org snapshot as soon as the system runs out of connection tracking entries.

Copy$ sudo conntrack -L | grep 'UNREPLIED'