ip_conntrack_icmp_timeout now taking effect

ip_conntrack_icmp_timeout now taking effect

[jonetsu]

Hello,

  I noticed that in both kernel versions 2.6.26 and 3.0 that the value
of ip_conntrack_icmp_timeout is by default 30.  However when setting up
the most simple firewall with a policy of DROPing everything, that a
continuous remote ping that was started right before setting up the
firewall will continue with kernel 3.0 whereas with kernel 2.6.26 it
will be stopped as soon as the firewall is established.  No flushing of
tables is done prior to setting up the simple test firewall in both
cases. The unit booted with no firewall, all in ACCEPT, before these
tests were made.

  This is quite a change of behaviour.  Flushing everything before
establishing the firewall solves the problem but is not the best
solution as it is possible to remotely be ssh-logged on the unit to make
firewall changes.  Flushing everything would mean that any error made
while setting the firewall could cut off the remote ssh session, and
could prevent establishing a new one.

  Having a value of 1 in ip_conntrack_icmp_timeout stops the continuous
pings when establishing the firewall but this can very likely have
negative effects when pinging under normal circumstances on a slow
connection.

  What is there to do to be able to stop pings as soon as the firewall
is set up while keeping the now-observed icmp conntrack timeout ?  Is
it possible to selectively flush only the ICMP connection tracking
table ?

  Any suggestions greatly appreciated, thanks.

Re: ip_conntrack_icmp_timeout now taking effect

[Kerin Millar]

On 01/03/2012 13:39, jonetsu wrote:
>    What is there to do to be able to stop pings as soon as the firewall
> is set up while keeping the now-observed icmp conntrack timeout ?  Is
> it possible to selectively flush only the ICMP connection tracking
> table ?

Regarding the second question, you might be able to do that if you 
assign a distinct conntrack zone for ICMP traffic (via the CT target). 
You should then be able to run conntrack -D -w <zone-id> but I haven't 
personally tried it. Not particularly elegant but it doesn't appear to 
be possible to use -D with -p icmp alone.

Cheers,

--Kerin