diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/configuration/system/conntrack.rst | 188 | ||||
| -rw-r--r-- | docs/configuration/system/index.rst | 1 |
2 files changed, 187 insertions, 2 deletions
diff --git a/docs/configuration/system/conntrack.rst b/docs/configuration/system/conntrack.rst index 7d5d4308..6329fcf2 100644 --- a/docs/configuration/system/conntrack.rst +++ b/docs/configuration/system/conntrack.rst @@ -1,2 +1,186 @@ -conntrack -#########
\ No newline at end of file + +######### +Conntrack +######### + +VyOS can be configured to track connections using the connection +tracking subsystem. Connection tracking becomes operational once either +stateful firewall or NAT is configured. + +********* +Configure +********* + +.. cfgcmd:: set system conntrack table-size <1-50000000> + :defaultvalue: + + The connection tracking table contains one entry for each connection being + tracked by the system. + +.. cfgcmd:: set system conntrack expect-table-size <1-50000000> + :defaultvalue: + + The connection tracking expect table contains one entry for each expected + connection related to an existing connection. These are generally used by + “connection tracking helper” modules such as FTP. + The default size of the expect table is 2048 entries. + +.. cfgcmd:: set system conntrack hash-size <1-50000000> + :defaultvalue: + + Set the size of the hash table. The connection tracking hash table makes + searching the connection tracking table faster. The hash table uses “buckets” to + record entries in the connection tracking table. + +.. cfgcmd:: system conntrack modules ftp +.. cfgcmd:: system conntrack modules h323 +.. cfgcmd:: system conntrack modules nfs +.. cfgcmd:: system conntrack modules pptp +.. cfgcmd:: system conntrack modules sip +.. cfgcmd:: system conntrack modules sqlnet +.. cfgcmd:: system conntrack modules tftp + + Configure the connection tracking protocol helper modules. + All modules are enable by default. + + | Use `delete system conntrack modules` to deactive all modules. + | Or, for example ftp, `delete system conntrack modules ftp`. + + +Define Conection Timeouts +========================= + +VyOS supports setting timeouts for connections according to the +connection type. You can set timeout values for generic connections, for ICMP +connections, UDP connections, or for TCP connections in a number of different states. + +.. cfgcmd:: system conntrack timeout icmp <1-21474836> + :defaultvalue: +.. cfgcmd:: system conntrack timeout other <1-21474836> + :defaultvalue: +.. cfgcmd:: system conntrack timeout tcp close <1-21474836> + :defaultvalue: +.. cfgcmd:: system conntrack timeout tcp close-wait <1-21474836> + :defaultvalue: +.. cfgcmd:: system conntrack timeout tcp established <1-21474836> + :defaultvalue: +.. cfgcmd:: system conntrack timeout tcp fin-wait <1-21474836> + :defaultvalue: +.. cfgcmd:: system conntrack timeout tcp last-ack <1-21474836> + :defaultvalue: +.. cfgcmd:: system conntrack timeout tcp syn-recv <1-21474836> + :defaultvalue: +.. cfgcmd:: system conntrack timeout tcp syn-sent <1-21474836> + :defaultvalue: +.. cfgcmd:: system conntrack timeout tcp time-wait <1-21474836> + :defaultvalue: +.. cfgcmd:: system conntrack timeout udp other <1-21474836> + :defaultvalue: +.. cfgcmd:: system conntrack timeout udp stream <1-21474836> + :defaultvalue: + + Set the timeout in secounds for a protocol or state. + + +You can also define custom timeout values to apply to a specific subset of +connections, based on a packet and flow selector. To do this, you create a rule +defining the packet and flow selector. + +.. cfgcmd:: system conntrack timeout custom rule <1-9999> description <test> + + Set a rule description. + + +.. cfgcmd:: system conntrack timeout custom rule <1-9999> destination address <ip-address> +.. cfgcmd:: system conntrack timeout custom rule <1-9999> source address <ip-address> + + set a destination and/or source address. Accepted input: + + .. code-block:: none + + <x.x.x.x> IP address to match + <x.x.x.x/x> Subnet to match + <x.x.x.x>-<x.x.x.x> + IP range to match + !<x.x.x.x> Match everything except the specified address + !<x.x.x.x/x> Match everything except the specified subnet + !<x.x.x.x>-<x.x.x.x> + Match everything except the specified range + +.. cfgcmd:: system conntrack timeout custom rule <1-9999> destination port <value> +.. cfgcmd:: system conntrack timeout custom rule <1-9999> source port <value> + + Set a destination and/or source port. Accepted input: + + .. code-block:: none + + <port name> Named port (any name in /etc/services, e.g., http) + <1-65535> Numbered port + <start>-<end> Numbered port range (e.g., 1001-1005) + + Multiple destination ports can be specified as a comma-separated list. + The whole list can also be "negated" using '!'. For example: + `!22,telnet,http,123,1001-1005`` + + + +.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol icmp <1-21474836> +.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol other <1-21474836> +.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp close <1-21474836> +.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp close-wait <1-21474836> +.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp established <1-21474836> +.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp fin-wait <1-21474836> +.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp last-ack <1-21474836> +.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp syn-recv <1-21474836> +.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp syn-sent <1-21474836> +.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol tcp time-wait <1-21474836> +.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol udp other <1-21474836> +.. cfgcmd:: system conntrack timeout custom rule <1-9999> protocol udp stream <1-21474836> + + Set the timeout in secounds for a protocol or state in a custom rule. + + +.. cfgcmd:: system conntrack tcp half-open-connections <1-21474836> + :defaultvalue: + + Set the maximum number of TCP half-open connections. + +.. cfgcmd:: system conntrack tcp loose <enable | disable> + :defaultvalue: + + Policy to track previously established connections. + +.. cfgcmd:: system conntrack tcp max-retrans <1-2147483647> + :defaultvalue: + + Set the number of TCP maximum retransmit attempts. + +.. cfgcmd:: system conntrack ignore rule <1-9999> description <text> +.. cfgcmd:: system conntrack ignore rule <1-9999> destination address <ip-address> +.. cfgcmd:: system conntrack ignore rule <1-9999> destination port <port> +.. cfgcmd:: system conntrack ignore rule <1-9999> inbound-interface <interface> +.. cfgcmd:: system conntrack ignore rule <1-9999> protocol <protocol> +.. cfgcmd:: system conntrack ignore rule <1-9999> source address <ip-address> +.. cfgcmd:: system conntrack ignore rule <1-9999> source port <port> + + Configure customized ignore rules for selective connection tracking + +.. cfgcmd:: system conntrack log icmp destroy +.. cfgcmd:: system conntrack log icmp new +.. cfgcmd:: system conntrack log icmp update +.. cfgcmd:: system conntrack log other destroy +.. cfgcmd:: system conntrack log other new +.. cfgcmd:: system conntrack log other update +.. cfgcmd:: system conntrack log tcp destroy +.. cfgcmd:: system conntrack log tcp new +.. cfgcmd:: system conntrack log tcp update close-wait +.. cfgcmd:: system conntrack log tcp update established +.. cfgcmd:: system conntrack log tcp update fin-wait +.. cfgcmd:: system conntrack log tcp update last-ack +.. cfgcmd:: system conntrack log tcp update syn-received +.. cfgcmd:: system conntrack log tcp update time-wait +.. cfgcmd:: system conntrack log udp destroy +.. cfgcmd:: system conntrack log udp new +.. cfgcmd:: system conntrack log udp update + + Log the connection tracking events per protocol.
\ No newline at end of file diff --git a/docs/configuration/system/index.rst b/docs/configuration/system/index.rst index ac84da49..9791ddb1 100644 --- a/docs/configuration/system/index.rst +++ b/docs/configuration/system/index.rst @@ -8,6 +8,7 @@ System :includehidden: acceleration + conntrack console flow-accounting host-name |