From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mart Frauenlob Subject: Re: Disabling conntrack for local net Date: Fri, 23 Oct 2009 07:09:58 +0200 Message-ID: <4AE13AA6.5080509@chello.at> References: <034DEBCAE934A74991E6E76B8DA72D14185DD509DA@HSSBS.holdstead.local> Reply-To: netfilter@vger.kernel.org Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <034DEBCAE934A74991E6E76B8DA72D14185DD509DA@HSSBS.holdstead.local> Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: netfilter@vger.kernel.org Gary Smith wrote: > We have several IP's NAT'd in from public interface. Even with that we noticed that 80% or so of the connection entries appear to be local to local traffic. > > We have the following subnets > > 10.40.16.0/24 (NAT'd public) > 10.40.17.0/24 (internal data) > 10.40.18.0/24 (internal data) > 10.40.19.0/24 (internal data) > 10.40.20.0/24 (NAT'd public) > > Public internface NAT's mostly to 10.40.16.0/24 IP's, and a couple on the 10.40.20.0/24 IP's. We have data/internal services on the 10.40.17.0/24 and 10.40.18.0/24. We see lots of connections from the 10.40.16.0/24 to the data/internal getting entered into the conntrack (as you would normally expect). > > So, is there any benefit of not conntracking these? Is so, how do I do that without breaking the NAT. > > I know I did this years ago, I just can't remember how. > Benefit = No resources used on connection tracking -t raw -m -s x.x.x.x/zz -d y.y.y.y/zz -j NOTRACK Regards Mart