On 10/15/2015 07:01 AM, Thomas D. wrote: > Hi, > > while testing shorewall-5.0.1 with linux-4.2.3 I was hit by > >> nf_conntrack: table full, dropping packet > > after calling `shorewall6 update -A` (which failed on my system because > shorewall6 is not probably configured): > >> # shorewall6 update -A >> Updating Shorewall6 configuration to 5.0.1... >> Processing /etc/shorewall6/params ... >> Processing /etc/shorewall6/shorewall6.conf... >> No update required to configuration file /etc/shorewall6/shorewall6.conf; >> /etc/shorewall6/shorewall6.conf.bak not saved >> Loading Modules... >> Converting 'FORMAT', 'SECTION' and 'COMMENT' lines to compiler directives... >> Checking /etc/shorewall6/zones... >> ERROR: No IP zones defined > > dmesg: > >> [ 1114.963913] ip6_tables: (C) 2000-2006 Netfilter Core Team >> [ 1115.000160] xt_CT: No such helper "pptp" >> [ 1115.002917] xt_CT: No such helper "netbios-ns" >> [ 1115.007574] xt_CT: No such helper "irc" >> [ 1115.010114] xt_CT: No such helper "irc-0" >> [ 1115.022112] xt_CT: No such helper "snmp" >> [ 1121.748818] nf_conntrack: table full, dropping packet >> [ 1122.498444] nf_conntrack: table full, dropping packet >> [ 1122.748811] nf_conntrack: table full, dropping packet >> [ 1123.248461] nf_conntrack: table full, dropping packet >> [ 1123.498550] nf_conntrack: table full, dropping packet >> [ 1123.999159] nf_conntrack: table full, dropping packet >> [ 1124.248537] nf_conntrack: table full, dropping packet >> [ 1124.748596] nf_conntrack: table full, dropping packet > > # sysctl net.netfilter.nf_conntrack_count > -3 > ^^ > Negative value? Before calling `shorewall6 update -A` the counter > showed a value of 4. > > > Looks like I was hit by > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9cf94eab8b309e8bcc78b41dd1561c75b537dd0b > > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=800445 > > > Not a shorewall bug but I wanted to report for people experiencing the > same problem.
Thanks, Thomas. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
