diff options
Diffstat (limited to 'templates')
| -rw-r--r-- | templates/firewall/conntrack-expect-table-size/node.def | 34 | ||||
| -rw-r--r-- | templates/firewall/conntrack-hash-size/node.def | 19 | ||||
| -rw-r--r-- | templates/firewall/node.def | 14 |
3 files changed, 66 insertions, 1 deletions
diff --git a/templates/firewall/conntrack-expect-table-size/node.def b/templates/firewall/conntrack-expect-table-size/node.def new file mode 100644 index 0000000..12d7884 --- /dev/null +++ b/templates/firewall/conntrack-expect-table-size/node.def @@ -0,0 +1,34 @@ +# +# Config template for: firewall conntrack-expect-table-size +# +# This is the table of expectations. Connection tracking expectations are +# the mechanism used to "expect" RELATED connections to existing ones. +# Expectations are generally used by "connection tracking helpers" (sometimes +# called application level gateways [ALGs]) for more complex protocols such as +# FTP, SIP, H.323. +# +# default value when firewall is not set - 2048 +# default value when firewall is set - 4096 +# + +type: u32 + +help: Set size of netfilter connection tracking expect table + +default: 4096 + +comp_help:Possible completions: + <1 - 50000000>\tNumber of entries allowed in connection tracking expect table + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 50000000) ; "Value must be between 1 and 50,000,000" + +update: + sudo sh -c "echo $VAR(@) > \ + /proc/sys/net/netfilter/nf_conntrack_expect_max" + + + + + + + diff --git a/templates/firewall/conntrack-hash-size/node.def b/templates/firewall/conntrack-hash-size/node.def new file mode 100644 index 0000000..0d11fae --- /dev/null +++ b/templates/firewall/conntrack-hash-size/node.def @@ -0,0 +1,19 @@ +help: Set hash size for connection tracking table +type: u32 + +default: 4096 + +comp_help:Possible completions: + <1 - 50000000>\tSize of hash to use for connection tracking table + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 50000000) ; "Value must be between 1 and 50,000,000" + +update: + if ! grep -q "nf_conntrack hashsize=$VAR(@)$" /etc/modprobe.d/vyatta_nf_conntrack + then + sudo sh -c "sed -i -e '/options nf_conntrack hashsize/d' \ + /etc/modprobe.d/vyatta_nf_conntrack" + sudo sh -c "echo options nf_conntrack hashsize=$VAR(@) >> \ + /etc/modprobe.d/vyatta_nf_conntrack" + echo "Updated conntrack hash size. This change will take affect when the system is rebooted." + fi diff --git a/templates/firewall/node.def b/templates/firewall/node.def index 3cdad32..daa8a51 100644 --- a/templates/firewall/node.def +++ b/templates/firewall/node.def @@ -1,6 +1,18 @@ priority: 215 help: Configure firewall -delete: # set conntrack table size to standard 16384 entries if firewall disabled +delete: # set conntrack table size to standard 16384 entries if fw disabled sudo sh -c "echo 16384 > /proc/sys/net/nf_conntrack_max" + # set conntrack expect table size to standard 2048 entries if fw disabled + sudo sh -c "echo 2048 > /proc/sys/net/netfilter/nf_conntrack_expect_max" + + # set conntrack hash size to standard 4096 + if ! grep -q "nf_conntrack hashsize=4096$" /etc/modprobe.d/vyatta_nf_conntrack + then + sudo sh -c "sed -i -e '/options nf_conntrack hashsize/d' \ + /etc/modprobe.d/vyatta_nf_conntrack" + sudo sh -c "echo options nf_conntrack hashsize=4096 >> \ + /etc/modprobe.d/vyatta_nf_conntrack" + echo "Conntrack hash size set to default 4096. This change will take affect when the system is rebooted." + fi |