Setting NOTRACK on all tcp connections

DISCUSSION Raviv 3 participants 3 messages Dec 1, 2010

Share & tools

Raviv

author

2010-12-01 14:35 UTC #0 lore raw

Hi,

I'm developing a module that should mark DSCP values on SIP and related RTP connections.
For that task i have created the relevant rules.
However i would to use the conntrack only for theses udp (SIP and RTP) connections.When testing in heavy TCP load environment i got the conntrack table full. I tried to setup a rule for notracking TCP connections as follows:

iptables -t raw -A PREROUTING -p tcp -j NOTRACK

but stiil i can see a lot of tcp connections in /proc/net/nf_conntrack.

How do i set the rule for tcp NOTRACK?

Thanks,

Raviv

Pascal Hambourg

2010-12-01 14:42 UTC #1 lore raw

Hello,

Quoted 6 lines · Raviv

I tried to setup a rule for notracking TCP connections as follows:
iptables -t raw -A PREROUTING -p tcp -j NOTRACK
but stiil i can see a lot of tcp connections in /proc/net/nf_conntrack.

If these TCP connections are established by the host, you need to add the same rule in the OUTPUT chain too. Also if you have IPv6 traffic you need to add the same rules with ip6tables.

Jan Engelhardt

2010-12-01 14:47 UTC #2 lore raw

Quoted 11 lines · Pascal Hambourg

Raviv a Ã©crit :
Quoted 6 lines
I tried to setup a rule for notracking TCP connections as follows:
iptables -t raw -A PREROUTING -p tcp -j NOTRACK
but stiil i can see a lot of tcp connections in /proc/net/nf_conntrack.
If these TCP connections are established by the host, you need to add the same rule in the OUTPUT chain too. Also if you have IPv6 traffic you need to add the same rules with ip6tables.

And since we're ultramodern, it's actually

	-p tcp -j CT --notrack