templates-cfg/system/conntrack/node.def


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

help: Connection tracking engine options

priority: 218 # before NAT and conntrack-sync are configured

delete: # set conntrack table size to standard 262144 entries if conntrack settings are removed
        sudo sysctl -q -w net/nf_conntrack_max=262144

        # set conntrack expect table size to standard 2048 entries if conntrack settings are removed
        sudo sysctl -q -w net/netfilter/nf_conntrack_expect_max=2048

        # set conntrack hash size to standard 32768 
        if ! grep -q "nf_conntrack hashsize=32768$" /etc/modprobe.d/vyatta_nf_conntrack.conf
        then
          sudo sh -c "sed -i -e '/options nf_conntrack hashsize/d' \
                /etc/modprobe.d/vyatta_nf_conntrack.conf"
          sudo sh -c "echo options nf_conntrack hashsize=32768 >> \
                /etc/modprobe.d/vyatta_nf_conntrack.conf"
          echo "Conntrack hash size set to default 32768. This change will take effect when the system is rebooted."
        fi

        # need to restart conntrackd with updated conntrack table size
        if cli-shell-api existsActive service conntrack-sync; then
          sudo /opt/vyatta/sbin/vyatta-conntrack-sync.pl --action=enable 
        fi