conntrack: add conntrack information and enable conntrack in index

2 files changed, 187 insertions, 2 deletions

diff --git a/docs/configuration/system/conntrack.rst b/docs/configuration/system/conntrack.rst
index 7d5d4308..6329fcf2 100644
--- a/docs/configuration/system/conntrack.rst
+++ b/docs/configuration/system/conntrack.rst
@@ -1,2 +1,186 @@
-conntrack
-#########
\ No newline at end of file
+
+#########
+Conntrack
+#########
+
+VyOS can be configured to track connections using the connection
+tracking subsystem. Connection tracking becomes operational once either
+stateful firewall or NAT is configured.
+
+*********
+Configure
+*********
+
+.. cfgcmd:: set system conntrack table-size <1-50000000>
+    :defaultvalue:
+
+    The connection tracking table contains one entry for each connection being
+    tracked by the system.
+
+.. cfgcmd:: set system conntrack expect-table-size <1-50000000>
+    :defaultvalue:
+
+    The connection tracking expect table contains one entry for each expected
+    connection related to an existing connection. These are generally used by
+    “connection tracking helper” modules such as FTP.
+    The default size of the expect table is 2048 entries.
+
+.. cfgcmd:: set system conntrack hash-size <1-50000000>
+    :defaultvalue:
+
+    Set the size of the hash table. The connection tracking hash table makes
+    searching the connection tracking table faster. The hash table uses “buckets” to
+    record entries in the connection tracking table.
+
+.. cfgcmd:: system conntrack modules ftp
+.. cfgcmd:: system conntrack modules h323
+.. cfgcmd:: system conntrack modules nfs
+.. cfgcmd:: system conntrack modules pptp
+.. cfgcmd:: system conntrack modules sip
+.. cfgcmd:: system conntrack modules sqlnet
+.. cfgcmd:: system conntrack modules tftp
+
+    Configure the connection tracking protocol helper modules.
+    All modules are enable by default.
+
+    | Use `delete system conntrack modules` to deactive all modules.
+    | Or, for example ftp, `delete system conntrack modules ftp`.
+
+
+Define Conection Timeouts
+=========================
+
+VyOS supports setting timeouts for connections according to the
+connection type. You can set timeout values for generic connections, for ICMP
+connections, UDP connections, or for TCP connections in a number of different states.
+
+.. cfgcmd:: system conntrack timeout icmp <1-21474836>
+    :defaultvalue:
+.. cfgcmd:: system conntrack timeout other <1-21474836>
+    :defaultvalue:
+.. cfgcmd:: system conntrack timeout tcp close <1-21474836>
+    :defaultvalue:
+.. cfgcmd:: system conntrack timeout tcp close-wait <1-21474836>
+    :defaultvalue:
+.. cfgcmd:: system conntrack timeout tcp established <1-21474836>
+    :defaultvalue:
+.. cfgcmd:: system conntrack timeout tcp fin-wait <1-21474836>
+    :defaultvalue:
+.. cfgcmd:: system conntrack timeout tcp last-ack <1-21474836>
+    :defaultvalue:
+.. cfgcmd:: system conntrack timeout tcp syn-recv <1-21474836>
+    :defaultvalue:
+.. cfgcmd:: system conntrack timeout tcp syn-sent <1-21474836>
+    :defaultvalue:
+.. cfgcmd:: system conntrack timeout tcp time-wait <1-21474836>
+    :defaultvalue:
+.. cfgcmd:: system conntrack timeout udp other <1-21474836>
+    :defaultvalue:
+.. cfgcmd:: system conntrack timeout udp stream <1-21474836>
+    :defaultvalue:
+
+    Set the timeout in secounds for a protocol or state.
+
+
+You can also define custom timeout values to apply to a specific subset of
+connections, based on a packet and flow selector. To do this, you create a rule
+defining the packet and flow selector.
+
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> description <test>
+
+    Set a rule description.
+
+
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> destination address <ip-address>
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> source address <ip-address>
+
+    set a destination and/or source address. Accepted input:
+
+    .. code-block:: none
+
+        <x.x.x.x>    IP address to match
+        <x.x.x.x/x>  Subnet to match
+        <x.x.x.x>-<x.x.x.x>
+                        IP range to match
+        !<x.x.x.x>   Match everything except the specified address
+        !<x.x.x.x/x> Match everything except the specified subnet
+        !<x.x.x.x>-<x.x.x.x>
+                        Match everything except the specified range
+
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> destination port <value>
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> source port <value>
+
+    Set a destination and/or source port. Accepted input:
+
+    .. code-block:: none
+
+        <port name>    Named port (any name in /etc/services, e.g., http)
+        <1-65535>      Numbered port
+        <start>-<end>  Numbered port range (e.g., 1001-1005)
+    
+    Multiple destination ports can be specified as a comma-separated list.
+    The whole list can also be "negated" using '!'. For example:
+    `!22,telnet,http,123,1001-1005``
+
+            
+
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol icmp <1-21474836>
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol other <1-21474836>
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp close <1-21474836>
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp close-wait <1-21474836>
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp established <1-21474836>
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp fin-wait <1-21474836>
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp last-ack <1-21474836>
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp syn-recv <1-21474836>
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp syn-sent <1-21474836>
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp time-wait <1-21474836>
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol udp other <1-21474836>
+.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol udp stream <1-21474836>
+
+    Set the timeout in secounds for a protocol or state in a custom rule.
+
+
+.. cfgcmd:: system conntrack tcp half-open-connections <1-21474836>
+    :defaultvalue:
+
+    Set the maximum number of TCP half-open connections.
+
+.. cfgcmd:: system conntrack tcp loose <enable | disable>
+    :defaultvalue:
+
+    Policy to track previously established connections.
+
+.. cfgcmd:: system conntrack tcp max-retrans <1-2147483647>
+    :defaultvalue:
+
+    Set the number of TCP maximum retransmit attempts.
+
+.. cfgcmd:: system conntrack ignore rule <1-9999> description <text>
+.. cfgcmd:: system conntrack ignore rule <1-9999> destination address <ip-address>
+.. cfgcmd:: system conntrack ignore rule <1-9999> destination port <port>
+.. cfgcmd:: system conntrack ignore rule <1-9999> inbound-interface <interface>
+.. cfgcmd:: system conntrack ignore rule <1-9999> protocol <protocol>
+.. cfgcmd:: system conntrack ignore rule <1-9999> source address <ip-address>
+.. cfgcmd:: system conntrack ignore rule <1-9999> source port <port>
+
+    Configure customized ignore rules for selective connection tracking
+
+.. cfgcmd:: system conntrack log icmp destroy
+.. cfgcmd:: system conntrack log icmp new
+.. cfgcmd:: system conntrack log icmp update
+.. cfgcmd:: system conntrack log other destroy
+.. cfgcmd:: system conntrack log other new
+.. cfgcmd:: system conntrack log other update
+.. cfgcmd:: system conntrack log tcp destroy
+.. cfgcmd:: system conntrack log tcp new
+.. cfgcmd:: system conntrack log tcp update close-wait
+.. cfgcmd:: system conntrack log tcp update established
+.. cfgcmd:: system conntrack log tcp update fin-wait
+.. cfgcmd:: system conntrack log tcp update last-ack
+.. cfgcmd:: system conntrack log tcp update syn-received
+.. cfgcmd:: system conntrack log tcp update time-wait
+.. cfgcmd:: system conntrack log udp destroy
+.. cfgcmd:: system conntrack log udp new
+.. cfgcmd:: system conntrack log udp update
+
+    Log the connection tracking events per protocol.
\ No newline at end of file
diff --git a/docs/configuration/system/index.rst b/docs/configuration/system/index.rst
index ac84da49..9791ddb1 100644
--- a/docs/configuration/system/index.rst
+++ b/docs/configuration/system/index.rst
@@ -8,6 +8,7 @@ System
    :includehidden:
 
    acceleration
+   conntrack
    console
    flow-accounting
    host-name