From: Tobias DiPasquale <codeslinger@gmail.com>
To: netfilter@lists.netfilter.org
Subject: Re: ip_conntrack limit && stateless firewalls
Date: Fri, 11 Feb 2005 09:55:36 -0500 [thread overview]
Message-ID: <876ef97a05021106551fb5dacb@mail.gmail.com> (raw)
In-Reply-To: <Pine.CYG.4.62.0502110943440.2348@MI340a.chem.mathsci.usna.edu>
On Fri, 11 Feb 2005 09:49:40 -0500, Kevin Van Workum <vanw@usna.edu> wrote:
> I'm having a problem with my firewall where packets are being dropped due
> to the ip_conntrack limit. I could up the limit, but my users need 30k+
> connections simultaneously and with the minimum overhead. And I only have
> 1 firewall box. So I'd like to disable or by-pass ip_conntrack some how to
> avoid dropped packets and reduce over head. How can I do this, and more
> importantly, would it be helpful.
You can use the NOTRACK target on the traffic that is causing the
problem (which will disable using ip_conntrack on that traffic), or
you can decompile conntrack altogether. The latter would basically
make the firewall stateless. man iptables for more info on using
NOTRACK.
--
[ Tobias DiPasquale ]
0x636f6465736c696e67657240676d61696c2e636f6d
next prev parent reply other threads:[~2005-02-11 14:55 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-02-11 14:49 ip_conntrack limit && stateless firewalls Kevin Van Workum
2005-02-11 14:55 ` Tobias DiPasquale [this message]
2005-02-13 12:22 ` Jose Maria Lopez Hernandez
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=876ef97a05021106551fb5dacb@mail.gmail.com \
--to=codeslinger@gmail.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.