summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBob Gilligan <gilligan@vyatta.com>2008-06-05 17:07:39 -0700
committerBob Gilligan <gilligan@vyatta.com>2008-06-05 17:07:39 -0700
commitce3b792e020062d4cf17d452cb432d900a13bd64 (patch)
treeace76a7b34a96ee18902d6b489eb30ea10c9f18c
parent72513826f382a2fe4fa188c2477a01925478ac12 (diff)
downloadvyatta-cfg-firewall-ce3b792e020062d4cf17d452cb432d900a13bd64.tar.gz
vyatta-cfg-firewall-ce3b792e020062d4cf17d452cb432d900a13bd64.zip
Bugfix: 2120
Added a configuration parameter to set the netfilter conntrack table size.
-rw-r--r--templates/firewall/conntrack-table-size/node.def36
1 files changed, 36 insertions, 0 deletions
diff --git a/templates/firewall/conntrack-table-size/node.def b/templates/firewall/conntrack-table-size/node.def
new file mode 100644
index 0000000..bead82f
--- /dev/null
+++ b/templates/firewall/conntrack-table-size/node.def
@@ -0,0 +1,36 @@
+#
+# Config template for: firewall conntrack-table-size
+#
+# Sets the size of the TCP connection tracking table in the netfilter
+# nf_conntrack module, which is used by firewall and NAT. The size of
+# this table determines how many TCP connections can be simultaneously
+# tracked. If new connections arrive and the table is full, older
+# connections will be dropped out of the table. System administrators
+# must set the connection tracking table size based on the number of
+# connections they expect their system to track. The connection
+# tracking table consumes kernel memory, so the size selected should
+# be no larger than necessary.
+#
+
+type: u32
+
+help: Set size of netfilter connection tracking table
+
+comp_help:Possible completions:
+ <1 - 50000000>\tNumber of entries allowed in connection tracking table
+
+syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 50000000) ; "Value must be between 1 and 50,000,000"
+
+update:
+ sudo sh -c "echo $VAR(@) > \
+ /proc/sys/net/nf_conntrack_max"
+delete:
+ sudo sh -c "echo 32768 > \
+ /proc/sys/net/nf_conntrack_max"
+
+
+
+
+
+
+