diff options
| -rw-r--r-- | Makefile.am | 2 | ||||
| -rw-r--r-- | etc/modprobe.d/vyatta_nf_conntrack | 21 | ||||
| -rw-r--r-- | scripts/firewall/firewall.init.in | 3 | ||||
| -rw-r--r-- | templates/firewall/conntrack-expect-table-size/node.def | 34 | ||||
| -rw-r--r-- | templates/firewall/conntrack-hash-size/node.def | 19 | ||||
| -rw-r--r-- | templates/firewall/node.def | 14 |
6 files changed, 92 insertions, 1 deletions
diff --git a/Makefile.am b/Makefile.am index a140082..41aef8a 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1,6 +1,8 @@ cfgdir = $(datadir)/vyatta-cfg/templates share_perl5dir = /opt/vyatta/share/perl5/Vyatta/IpTables curverdir = $(sysconfdir)/config-migrate/current +modprobedir = /etc/modprobe.d +modprobe_DATA = etc/modprobe.d/vyatta_nf_conntrack sbin_SCRIPTS = share_perl5_DATA = diff --git a/etc/modprobe.d/vyatta_nf_conntrack b/etc/modprobe.d/vyatta_nf_conntrack new file mode 100644 index 0000000..b907431 --- /dev/null +++ b/etc/modprobe.d/vyatta_nf_conntrack @@ -0,0 +1,21 @@ +# +# **** License **** +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# This code was originally developed by Vyatta, Inc. +# Portions created by Vyatta are Copyright (C) 2010 Vyatta, Inc. +# All Rights Reserved. +# **** End License **** +# +# Author: Mohit Mehta +# Description: Sets hash size for connection tracking table +# As of 2.6.33: "expect_hashsize" is readonly + +options nf_conntrack hashsize=4096 diff --git a/scripts/firewall/firewall.init.in b/scripts/firewall/firewall.init.in index d93b13c..22f48fd 100644 --- a/scripts/firewall/firewall.init.in +++ b/scripts/firewall/firewall.init.in @@ -92,6 +92,9 @@ start () { # set conntrack table size sysctl -q -w net.nf_conntrack_max=16384 + + # set conntrack expect table size + sysctl -q -w net.netfilter.nf_conntrack_expect_max=2048 } case "$ACTION" in diff --git a/templates/firewall/conntrack-expect-table-size/node.def b/templates/firewall/conntrack-expect-table-size/node.def new file mode 100644 index 0000000..12d7884 --- /dev/null +++ b/templates/firewall/conntrack-expect-table-size/node.def @@ -0,0 +1,34 @@ +# +# Config template for: firewall conntrack-expect-table-size +# +# This is the table of expectations. Connection tracking expectations are +# the mechanism used to "expect" RELATED connections to existing ones. +# Expectations are generally used by "connection tracking helpers" (sometimes +# called application level gateways [ALGs]) for more complex protocols such as +# FTP, SIP, H.323. +# +# default value when firewall is not set - 2048 +# default value when firewall is set - 4096 +# + +type: u32 + +help: Set size of netfilter connection tracking expect table + +default: 4096 + +comp_help:Possible completions: + <1 - 50000000>\tNumber of entries allowed in connection tracking expect table + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 50000000) ; "Value must be between 1 and 50,000,000" + +update: + sudo sh -c "echo $VAR(@) > \ + /proc/sys/net/netfilter/nf_conntrack_expect_max" + + + + + + + diff --git a/templates/firewall/conntrack-hash-size/node.def b/templates/firewall/conntrack-hash-size/node.def new file mode 100644 index 0000000..0d11fae --- /dev/null +++ b/templates/firewall/conntrack-hash-size/node.def @@ -0,0 +1,19 @@ +help: Set hash size for connection tracking table +type: u32 + +default: 4096 + +comp_help:Possible completions: + <1 - 50000000>\tSize of hash to use for connection tracking table + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 50000000) ; "Value must be between 1 and 50,000,000" + +update: + if ! grep -q "nf_conntrack hashsize=$VAR(@)$" /etc/modprobe.d/vyatta_nf_conntrack + then + sudo sh -c "sed -i -e '/options nf_conntrack hashsize/d' \ + /etc/modprobe.d/vyatta_nf_conntrack" + sudo sh -c "echo options nf_conntrack hashsize=$VAR(@) >> \ + /etc/modprobe.d/vyatta_nf_conntrack" + echo "Updated conntrack hash size. This change will take affect when the system is rebooted." + fi diff --git a/templates/firewall/node.def b/templates/firewall/node.def index 3cdad32..daa8a51 100644 --- a/templates/firewall/node.def +++ b/templates/firewall/node.def @@ -1,6 +1,18 @@ priority: 215 help: Configure firewall -delete: # set conntrack table size to standard 16384 entries if firewall disabled +delete: # set conntrack table size to standard 16384 entries if fw disabled sudo sh -c "echo 16384 > /proc/sys/net/nf_conntrack_max" + # set conntrack expect table size to standard 2048 entries if fw disabled + sudo sh -c "echo 2048 > /proc/sys/net/netfilter/nf_conntrack_expect_max" + + # set conntrack hash size to standard 4096 + if ! grep -q "nf_conntrack hashsize=4096$" /etc/modprobe.d/vyatta_nf_conntrack + then + sudo sh -c "sed -i -e '/options nf_conntrack hashsize/d' \ + /etc/modprobe.d/vyatta_nf_conntrack" + sudo sh -c "echo options nf_conntrack hashsize=4096 >> \ + /etc/modprobe.d/vyatta_nf_conntrack" + echo "Conntrack hash size set to default 4096. This change will take affect when the system is rebooted." + fi |