How to turn iptables stateless?

Question

I'm running a Linux server that - from time to time - faces heavy load and the conntrack table overflows. Since it's iptables firewall ruleset is very simple I'd like to turn it to stateless mode. I know that iptables can operate in stateful connection tracking mode and in a stateless mode.

My firewall rules are all in place I'm pretty sure that they are stateless but my question is how can I verify that the firewall is really operating in stateless mode?

score 22 · Accepted Answer · edited Feb 12 '11 at 01:14

22

You need to specify some iptables rules to prevent packets to be conntracked :

iptables -t raw -I PREROUTING -j NOTRACK
iptables -t raw -I OUTPUT -j NOTRACK

edited Feb 12 '11 at 01:14

Juliano

5,512
28
28

answered Feb 11 '11 at 21:54

profy

1,146
9
20

actually it is "-t raw" and not "-t RAW" but that was the missing pice. Thank you! – tex Feb 11 '11 at 23:11
2

Sorry, but this doesn't answer your question since it was "how can I *verify* that the firewall is really operating in stateless mode" actually. – poige Feb 12 '11 at 04:07
Please excuse my wording. My english is not perfect, but that was exactly the solution for my problem. – tex Aug 17 '12 at 17:21

score 6 · Answer 2 · answered Mar 07 '11 at 14:36

6

cat /proc/net/ip_conntrack shows all connection tracking.

So, if it's stateless, the output of the above command should be empty.

(Alternatively, use cat /proc/net/nf_conntrack)

answered Mar 07 '11 at 14:36

pepoluan

5,038
4
47
72

score 5 · Answer 3 · answered Feb 11 '11 at 21:53

5

Install conntrack, and look at the output. I am pretty sure if you are stateless no connections will be displayed.

answered Feb 11 '11 at 21:53

Zoredache

130,897
41
276
420

How to turn iptables stateless?

3 Answers3

Linked