[CentOS] iptables starts blocking outbound http traffic

Filipe Brandenburger filbranden at gmail.com
Thu Nov 6 15:07:13 UTC 2008


Hi,

On Thu, Nov 6, 2008 at 09:33, Neil Aggarwal <neil at jammconsulting.com> wrote:
> # Allow http connections from the outside world
> /sbin/iptables -A INPUT -i eth0 -d $ETH0_IP -p tcp --sport 1024: --dport
> http -m state --state NEW,ESTABLISHED -j ACCEPT
> /sbin/iptables -A OUTPUT -o eth0 -s $ETH0_IP -p tcp --sport http --dport
> 1024: -m state --state ESTABLISHED -j ACCEPT
>
> Any ideas what is going on?

If you're using ESTABLISHED, it depends on ip_conntrack being able to
track the connections. ip_conntrack keeps a table of all connections,
but this table is limited in size, so it may be overflowing.

You can see how many entries you have in that table at any moment with
this command:
# cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count

And you can see what the maximum is set with this command:
# cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max

The default in CentOS 5 is 16k connections.

IIRC, you can increase that dinamically with echo ... >/proc/sys/...
or with sysctl. Also, I believe you can set the default after a reboot
in /etc/sysctl.conf. I think it's also possible to do that in
/etc/modprobe.conf, but I'm not sure what the syntax is anymore, and
modinfo ip_conntrack didn't give me any clues. Google should help with
that.

HTH,
Filipe


More information about the CentOS mailing list