diff options
author | Bob Gilligan <gilligan@vyatta.com> | 2008-06-05 17:07:39 -0700 |
---|---|---|
committer | Bob Gilligan <gilligan@vyatta.com> | 2008-06-05 17:07:39 -0700 |
commit | ce3b792e020062d4cf17d452cb432d900a13bd64 (patch) | |
tree | ace76a7b34a96ee18902d6b489eb30ea10c9f18c | |
parent | 72513826f382a2fe4fa188c2477a01925478ac12 (diff) | |
download | vyatta-cfg-firewall-ce3b792e020062d4cf17d452cb432d900a13bd64.tar.gz vyatta-cfg-firewall-ce3b792e020062d4cf17d452cb432d900a13bd64.zip |
Bugfix: 2120
Added a configuration parameter to set the netfilter conntrack table
size.
-rw-r--r-- | templates/firewall/conntrack-table-size/node.def | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/templates/firewall/conntrack-table-size/node.def b/templates/firewall/conntrack-table-size/node.def new file mode 100644 index 0000000..bead82f --- /dev/null +++ b/templates/firewall/conntrack-table-size/node.def @@ -0,0 +1,36 @@ +# +# Config template for: firewall conntrack-table-size +# +# Sets the size of the TCP connection tracking table in the netfilter +# nf_conntrack module, which is used by firewall and NAT. The size of +# this table determines how many TCP connections can be simultaneously +# tracked. If new connections arrive and the table is full, older +# connections will be dropped out of the table. System administrators +# must set the connection tracking table size based on the number of +# connections they expect their system to track. The connection +# tracking table consumes kernel memory, so the size selected should +# be no larger than necessary. +# + +type: u32 + +help: Set size of netfilter connection tracking table + +comp_help:Possible completions: + <1 - 50000000>\tNumber of entries allowed in connection tracking table + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 50000000) ; "Value must be between 1 and 50,000,000" + +update: + sudo sh -c "echo $VAR(@) > \ + /proc/sys/net/nf_conntrack_max" +delete: + sudo sh -c "echo 32768 > \ + /proc/sys/net/nf_conntrack_max" + + + + + + + |