The format of this file is simple, using brackets for sections and key-value pairs for concrete configuration directives:
section1 {
option1 value1
option2 value2
}
section2 {
option3 value3
subsection1 {
option4 value4
}
}
You should consider this file as case-sensitive. Empty lines and lines starting with the '#' character are ignored.
Before starting to develop a new configuration, you may want to learn the concepts behind this technlogy at http://conntrack-tools.netfilter.org/manual.html.
There are complete configuration examples at the end of this man page.
This top-level section defines how conntrackd(8) should handle synchronization with other cluster nodes.
There are 3 main synchronization modes or protocols: NOTRACK, ALARM and FTFW.
There are 3 transport protocols as well: TCP, Multicast and UDP.
You have to choose one synchronization mode and one transport protocol.
Also, there are some general options in this section.
This mode is based on a reliable protocol that performs message tracking. Thus, the protocol can recover from message loss, re-ordering and corruption.
In this synchronization mode you may configure ResendQueueSize, CommitTimeout, PurgeTimeout, ACKWindowSize , DisableExternalCache and StartupResync.
Example: ResendQueueSize 131072
Default is 131072 objects.
Example: CommitTimeout 180
By default, this option is not set (the daemon uses an approximate timeout value calculation mechanism).
This is useful to purge the connection tracking table of zombie entries and avoid clashes with old entries if you trigger several consecutive hand-overs.
Default is 60 seconds.
Example: ACKWindowSize 300
If not set, default window size is 300 (value is based on some practical experiments measuring the cycles spent by the acknowledgment handling with oprofile).
If you are installing conntrackd(8) for first time, please read the user manual and I encourage you to consider using the fail-over scripts instead of enabling this option!
By default, this clause is set off.
This is useful to get in sync with another node which has been running while we were down.
Example: StartupResync on
By default, this clause is set off.
This mode is spamming. It is based on a alarm-based protocol that periodically re-sends the flow state to the backup firewall replicas. This protocol consumes a lot of bandwidth but it resolves synchronization problems fast.
In this synchronization mode you may configure RefreshTime, CacheTimeout, CommitTimeout and PurgeTimeout.
Example: RefreshTime 15
Example: CacheTimeout 180
Is the most simple mode as it is based on a best effort replication protocol, ie. unreliable protocol. This protocol sends and receives the state information without performing any specific checking.
In this synchronization mode you may configure DisableInternalCache, DisableExternalCache, CommitTimeout, PurgeTimeout and StartupResync.
This option is set off by default.
This section indicates to conntrackd(8) to use multicast as transport mechanism between nodes of the firewall cluster.
Please note you can specify more than one dedicated link. Thus, if one dedicated link fails, the daemon can fail-over to another. Note that adding more than one dedicated link does not mean that state-updates will be sent to all of them. There is only one active dedicated link at a given moment.
The Default keyword indicates that this interface will be selected as the initial dedicated link. You can have up to 4 redundant dedicated links.
Note: use different multicast groups for every redundant link.
Example:
Multicast Default {
IPv4_address 225.0.0.51
Group 3781
IPv4_interface 192.168.100.101
Interface eth3
SndSocketBuffer 1249280
RcvSocketBuffer 1249280
Checksum on
}
Multicast {
IPv4_address 225.0.0.51
Group 3782
IPv4_interface 192.168.100.102
Interface eth4
SndSocketBuffer 1249280
RcvSocketBuffer 1249280
Checksum on
}
Example: IPv4_address 255.0.0.50
Example: Group 3780
If any doubt, do not modify this value.
Example: IPv4_interface 192.168.100.100
Example: Interface eth2
This value determines the chances to have an overrun in the sender queue. The overrun results in packet loss, thus, losing state information that would have to be retransmitted. If you notice some packet loss, you may want to increase the size of the buffer. The system default size is usually around ~100 KBytes which is fairly small for busy firewalls.
Note: The NOTRACK protocol is best effort, it is really recommended to increase the buffer size.
Example: SndSocketBuffer 1249280
This value determines the chances to have an overrun in the receiver queue. The overrun results in packet loss, thus, losing state information that would have to be retransmitted. If you notice some packet loss, you may want to increase the size of the buffer. The system default size is usually around ~100 KBytes which is fairly small for busy firewalls.
Note: The NOTRACK protocol is best effort, it is really recommended to increase the buffer size.
Example: RcvSocketBuffer 1249280
As in the Multicast configuration, you may especify several fail-over dedicated links using the Default keyword.
Example:
UDP {
IPv4_address 172.16.0.1
IPv4_Destination_Address 172.16.0.2
Port 3781
Interface eth3
SndSocketBuffer 1249280
RcvSocketBuffer 1249280
Checksum on
}
Example: IPv4_address 192.168.2.100
Example: IPv6_address fe80::215:58ff:fe28:5a27
Example: IPv4_Destination_Address 192.168.2.101
Example: IPv6_Destination_Address fe80::2d0:59ff:fe2a:775c
Example: Port 3780
If you combine this transport with the NOTRACK mode, it becomes reliable.
The TCP transport protocol can be configured in exactly the same way as the UDP transport protocol.
As in the Multicast configuration, you may especify several fail-over dedicated links using the Default keyword.
Example:
TCP {
IPv6_address fe80::215:58ff:fe28:5a27
IPv6_Destination_Address fe80::215:58ff:fe28:5a27
Port 3781
Interface eth2
SndSocketBuffer 1249280
RcvSocketBuffer 1249280
Checksum on
}
Other unsorted options that are related to the synchronization protocol or transport mechanism.
This feature requires a Linux kernel >= 3.5.
Example, sync all expectations:
ExpectationSync on
Example, sync given expectations:
ExpectationSync {
ftp
ras
q.931
h.245
sip
}
By default, this option is disabled.
This top-level section contains generic configuration directives for the conntrackd(8) daemon.
Obviously, this requires the init of your system to be systemd(1).
Note: systemd(1) watchdog is supported as well.
Example: Systemd on
By default runtime support is enabled if conntrackd was built with the systemd feature. Otherwise is off.
Example: HashSize 32768
Example: HashLimit 131072
Example: LogFile on
Default is off. The default logfile is /var/log/conntrackd.log.
Example: Syslog local0
Default is off.
Example: LockFile /var/lock/conntrack.lock
Default is /var/lock/conntrack.lock.
Example: NetlinkBufferSize 2097152
Example: NetlinkBufferSizeMaxGrowth 8388608
Note: Be careful of setting a very small value here.
Example: NetlinkOverrunResync on
The default value is 30 seconds. If not specified, the daemon assumes that this option is enabled and uses the default value.
You need Linux Kernel >= 2.6.31 for this option to work.
Example: NetlinkEventsReliable on
This option is off by default.
This clause tells conntrackd(8) to dump the states in the kernel every N seconds. With regards to synchronization mode, the polling mode can only guarantee that long-lifetime states are recovered. The main advantage of this method is the reduction in the state replication at the cost of reducing the chances of recovering connections.
Example: PollSecs 15
A low value improves interactivity (in terms of real-time behaviour) at the cost of extra CPU consumption.
Example: EventIterationLimit 100
Default (if not set) is 100.
Example:
UNIX {
Path /var/run/conntrackd.ctl
}
Example: Path /var/run/conntrackd.ctl
There are currently three filter-sets: Protocol, Address and State. The filter is attached to an action that can be: Accept or Ignore. Thus, you can define the event filtering policy of the filter-sets in positive or negative logic depending on your needs.
You can select if conntrackd(8) filters the event messages from user-space or kernel-space. The kernel-space event filtering saves some CPU cycles by avoiding the copy of the event message from kernel-space to user-space. The kernel-space event filtering is prefered, however, you require a Linux kernel >= 2.6.29 to filter from kernel-space.
The syntax for this section is: Filter From <from> { }.
If you want to select kernel-space event filtering, use the keyword Kernelspace instead of Userspace.
Example:
Filter From Userspace {
Protocol Accept {
TCP
SCTP
DCCP
}
Address Ignore {
IPv4_address 127.0.0.1
IPv6_address ::1
}
State Accept {
ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT
}
}
Policy is one of Accept or Ignore.
Protocols are: TCP, SCTP, DCCP, UDP, ICMP and IPv6-ICMP.
The ICMP and IPv6-ICMP protocols require a Linux kernel >= 2.6.31.
Example:
Protocol Accept {
TCP
SCTP
DCCP
}
Note that these values depends on the local IPs that are assigned to the firewall.
You may specify several IPv4_address and/or IPv6_address directives. You can also specify networks in CIDR format.
Policy is one of Accept or Ignore.
Example:
Address Ignore {
IPv4_address 127.0.0.1 # loopback
IPv4_address 192.168.0.100 # virtual IP 1
IPv4_address 192.168.1.100 # virtual IP 2
IPv4_address 192.168.100.100 # dedicated link ip
IPv4_address 192.168.0.0/24
IPv6_address ::1
}
Note: only affects TCP flows.
The existing TCP states are: SYN_SENT, SYN_RECV, ESTABLISHED, FIN_WAIT, CLOSE_WAIT, LAST_ACK, TIME_WAIT, CLOSED and LISTEN.
Policy is one of Accept or Ignore.
Example:
State Accept {
ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT
}
Using a RT scheduler reduces the chances to overrun the Netlink buffer and conntrackd(8) uses by default RR unless FIFO is selected. See sched_setscheduler(2) for more information.
Example:
Scheduler {
Type FIFO
Priority 99
}
Default: RR
Default: 99 (as returned by sched_get_priority_max(2) for SCHED_RR)
Default is off. Default filename is /var/log/conntrackd-stats.log.
Default is off.
Example: Syslog local0
Default is off.
This top-level section indicates conntrackd(8) to inject user-space helpers into the nf_conntrack linux kernel subsystem. It will result in the nf_conntrack engine sending connections to userspace for further processing.
Before this, you have to make sure you have registered the given user-space helper stub.
Example:
% nfct add helper ftp inet tcp
Each user-space helper should be registered using a Type section, which are named this way:
Type <name> <af> <transport>
Examples:
Helper {
Type ftp inet tcp {
QueueNum 0
QueueLen 10240
Policy ftp {
ExpectMax 1
ExpectTimeout 300
}
}
Type rpc inet tcp {
QueueNum 1
QueueLen 10240
Policy rpc {
ExpectMax 1
ExpectTimeout 300
}
}
Type rpc inet udp {
QueueNum 2
QueueLen 10240
Policy rpc {
ExpectMax 1
ExpectTimeout 300
}
}
Type tns inet tcp {
QueueNum 3
QueueLen 10240
Policy tns {
ExpectMax 1
ExpectTimeout 300
}
}
Type dhcpv6 inet6 udp {
QueueNum 4
QueueLen 10240
Policy dhcpv6 {
ExpectMax 1
ExpectTimeout 300
}
}
Type ssdp inet udp {
QueueNum 5
QueueLen 10240
Policy ssdp {
ExpectMax 1
ExpectTimeout 300
}
}
}
Parameters inside the Type section:
Example: QueueNum 0
Rise value if you hit the following error message:
"nf_queue: full at X entries, dropping packet(s)"
Default is 1024.
Example: QueueLen 10240
This sub-section contains 2 directives: ExpectMax <number> (maximum number of simultaneous expectations) and ExpecTimeout <seconds> (maximum living time for one expectation).
Stats {
LogFile on
NetlinkEventsReliable Off
Syslog off
}
General {
Systemd on
HashSize 8192
HashLimit 65535
Syslog on
LockFile /var/lock/conntrack.lock
UNIX {
Path /var/run/conntrackd.ctl
}
NetlinkBufferSize 262142
NetlinkBufferSizeMaxGrowth 655355
Filter {
Protocol Accept {
TCP
UDP
}
Address Ignore {
IPv4_address 127.0.0.1
IPv6_address ::1
}
}
}
It includes common general configuration as well.
Note: this is one of the recommended setups for conntrackd(8) in a firewall cluster environment.
Sync {
Mode FTFW {
ResendQueueSize 131072
PurgeTimeout 60
ACKWindowSize 300
DisableExternalCache Off
}
Multicast {
IPv4_address 225.0.0.50
Group 3780
IPv4_interface 192.168.100.100
Interface eth2
SndSocketBuffer 1249280
RcvSocketBuffer 1249280
Checksum on
}
Multicast Default {
IPv4_address 225.0.0.51
Group 3781
IPv4_interface 192.168.100.101
Interface eth3
SndSocketBuffer 1249280
RcvSocketBuffer 1249280
Checksum on
}
Options {
TCPWindowTracking Off
ExpectationSync On
}
}
General {
Systemd on
HashSize 32768
HashLimit 131072
LogFile on
Syslog off
LockFile /var/lock/conntrack.lock
UNIX {
Path /var/run/conntrackd.ctl
}
NetlinkBufferSize 2097152
NetlinkBufferSizeMaxGrowth 8388608
NetlinkOverrunResync On
NetlinkEventsReliable Off
EventIterationLimit 100
Filter From Userspace {
Protocol Accept {
TCP
SCTP
DCCP
}
Address Ignore {
IPv4_address 127.0.0.1
IPv4_address 192.168.100.0/24
IPv6_address ::1
}
}
}
This example configures synchronization in NOTRACK mode with TCP transport.
It includes common general configuration as well.
Sync {
Mode NOTRACK {
DisableInternalCache on
DisableExternalCache on
}
TCP {
IPv4_address 192.168.2.100
IPv4_Destination_Address 192.168.2.101
Port 3780
Interface eth2
SndSocketBuffer 1249280
RcvSocketBuffer 1249280
Checksum on
}
Options {
TCPWindowTracking Off
ExpectationSync On
}
}
General {
Systemd on
HashSize 32768
HashLimit 131072
LogFile on
Syslog off
LockFile /var/lock/conntrack.lock
UNIX {
Path /var/run/conntrackd.ctl
}
NetlinkBufferSize 2097152
NetlinkBufferSizeMaxGrowth 8388608
NetlinkOverrunResync On
NetlinkEventsReliable Off
EventIterationLimit 100
Filter From Userspace {
Protocol Accept {
TCP
SCTP
DCCP
}
Address Ignore {
IPv4_address 127.0.0.1
IPv4_address 192.168.0.0/16
IPv6_address ::1
}
State Accept {
ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT
}
}
}
This manual page was written by Arturo Borrero Gonzalez <arturo@debian.org> based on the conntrackd tarball config examples.
Please send bug reports to <netfilter-devel@lists.netfilter.org>. Subscription is required.
This documentation is free/libre under the terms of the GPLv2+.