[CentOS] iptables starts blocking outbound http traffic
filbranden at gmail.com
Thu Nov 6 15:07:13 UTC 2008
On Thu, Nov 6, 2008 at 09:33, Neil Aggarwal <neil at jammconsulting.com> wrote:
> # Allow http connections from the outside world
> /sbin/iptables -A INPUT -i eth0 -d $ETH0_IP -p tcp --sport 1024: --dport
> http -m state --state NEW,ESTABLISHED -j ACCEPT
> /sbin/iptables -A OUTPUT -o eth0 -s $ETH0_IP -p tcp --sport http --dport
> 1024: -m state --state ESTABLISHED -j ACCEPT
> Any ideas what is going on?
If you're using ESTABLISHED, it depends on ip_conntrack being able to
track the connections. ip_conntrack keeps a table of all connections,
but this table is limited in size, so it may be overflowing.
You can see how many entries you have in that table at any moment with
# cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count
And you can see what the maximum is set with this command:
# cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max
The default in CentOS 5 is 16k connections.
IIRC, you can increase that dinamically with echo ... >/proc/sys/...
or with sysctl. Also, I believe you can set the default after a reboot
in /etc/sysctl.conf. I think it's also possible to do that in
/etc/modprobe.conf, but I'm not sure what the syntax is anymore, and
modinfo ip_conntrack didn't give me any clues. Google should help with
More information about the CentOS