Re: Disabling conntrack for local net

[Mart Frauenlob <mart.frauenlob@chello.at>]

Mart Frauenlob wrote:
> Gary Smith wrote:
>> We have several IP's NAT'd in from public interface.  Even with that 
>> we noticed that 80% or so of the connection entries appear to be 
>> local to local traffic.
>>
>> We have the following subnets
>>
>> 10.40.16.0/24 (NAT'd public)
>> 10.40.17.0/24 (internal data)
>> 10.40.18.0/24 (internal data)
>> 10.40.19.0/24 (internal data)
>> 10.40.20.0/24 (NAT'd public)
>>
>> Public internface NAT's mostly to 10.40.16.0/24 IP's, and a couple on 
>> the 10.40.20.0/24 IP's.  We have data/internal services on the 
>> 10.40.17.0/24 and 10.40.18.0/24.  We see lots of connections from the 
>> 10.40.16.0/24 to the data/internal getting entered into the conntrack 
>> (as you would normally expect). 
>> So, is there any benefit of not conntracking these?  Is so, how do I 
>> do that without breaking the NAT.
>>
>> I know I did this years ago, I just can't remember how.
>>   
>
> Benefit = No resources used on connection tracking
>
> -t raw -m -s x.x.x.x/zz -d y.y.y.y/zz -j NOTRACK
>
sorry, missed that:
or the RAWNAT target from the xtables addon if you used NAT.