>>Thanks, where does PVE set that value?
/usr/share/perl5/PVE/Firewall.pm
sub update_nf_conntrack_max {
my ($hostfw_conf) = @_;
my $max = 65536; # reasonable default
my $options = $hostfw_conf->{options} || {};
if (defined($options->{nf_conntrack_max}) && ($options->{nf_conntrack_max}
> $max)) {
$max = $options->{nf_conntrack_max};
$max = int(($max+ 8191)/8192)*8192; # round to multiples of 8192
}
my $filename_nf_conntrack_max = "/proc/sys/net/nf_conntrack_max";
my $filename_hashsize = "/sys/module/nf_conntrack/parameters/hashsize";
my $current =
int(PVE::Tools::file_read_firstline($filename_nf_conntrack_max) || $max);
if ($current != $max) {
my $hashsize = int($max/4);
PVE::ProcFSTools::write_proc_entry($filename_hashsize, $hashsize);
PVE::ProcFSTools::write_proc_entry($filename_nf_conntrack_max, $max);
}
}
sub update_nf_conntrack_tcp_timeout_established {
my ($hostfw_conf) = @_;
my $options = $hostfw_conf->{options} || {};
my $value = defined($options->{nf_conntrack_tcp_timeout_established}) ?
$options->{nf_conntrack_tcp_timeout_established} : 432000;
PVE::ProcFSTools::write_proc_entry("/proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established",
$value);
}
----- Mail original -----
De: "Stefan Priebe - Profihost AG" <[email protected]>
À: "Dietmar Maurer" <[email protected]>, [email protected]
Envoyé: Mardi 2 Décembre 2014 09:51:07
Objet: Re: [pve-devel] PVE Firewall and nf_conntrack
Am 02.12.2014 um 09:31 schrieb Dietmar Maurer:
>> The kernel host log is full of:
>>
>> [1620408.606201] net_ratelimit: 462 callbacks suppressed [1620408.606204]
>> nf_conntrack: table full, dropping packet
>>
>> 1.) Where do we use nf_conntrack?
>
> everywhere
>
>> 2.) Should PVE ship with a sysctl file raising the nf conntrack limits?
>
> You can adjust the value the the GUI (Host firewall option nf_conntrack_max)
Thanks, where does PVE set that value?
I've a custom /etc/sysctl.d/ conf file which sets the value to 6.5
Million but pve seems to reset the value on boot to 65536.
Stefan
_______________________________________________
pve-devel mailing list
[email protected]
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
_______________________________________________
pve-devel mailing list
[email protected]
http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
