bionic (5) conntrackd.conf.5.gz

Provided by: conntrackd_1.4.4+snapshot20161117-6ubuntu2_amd64 bug

NAME

       conntrackd.conf - configuration file for conntrackd daemon

DESCRIPTION

       conntrackd.conf  is  the  main  configuration  file for the conntrackd(8) daemon. It is loaded by calling
       `conntrackd -C conntrackd.conf'.

       The format of this file is  simple,  using  brackets  for  sections  and  key-value  pairs  for  concrete
       configuration directives:

            section1 {
                 option1 value1
                 option2 value2
            }
            section2 {
                 option3 value3
                 subsection1 {
                      option4 value4
                 }
            }

       You  should  consider this file as case-sensitive.  Empty lines and lines starting with the '#' character
       are ignored.

       Before starting to develop a new configuration, you may want to learn the concepts behind this  technlogy
       at http://conntrack-tools.netfilter.org/manual.html.

       There are complete configuration examples at the end of this man page.

SYNC

       This top-level section defines how conntrackd(8) should handle synchronization with other cluster nodes.

       There are 3 main synchronization modes or protocols: NOTRACK, ALARM and FTFW.

       There are 3 transport protocols as well: TCP, Multicast and UDP.

       You have to choose one synchronization mode and one transport protocol.

       Also, there are some general options in this section.

   Mode FTFW
       This mode is based on a reliable protocol that performs message tracking.  Thus, the protocol can recover
       from message loss, re-ordering and corruption.

       In  this  synchronization  mode  you  may   configure   ResendQueueSize,   CommitTimeout,   PurgeTimeout,
       ACKWindowSize and DisableExternalCache.

       ResendQueueSize <value>
              Size  of  the  resend queue (in objects). This is the maximum number of objects that can be stored
              waiting to be confirmed via acknoledgment.  If you keep this value low, the daemon will have  less
              chances to recover state-changes under message omission. On the other hand, if you keep this value
              high, the daemon will consume more memory to store dead objects.

              Example: ResendQueueSize 131072

              Default is 131072 objects.

       CommitTimeout <seconds>
              This parameter allows you to set an initial fixed timeout for the committed entries when this node
              goes  from  backup  to  primary.  This  mechanism  provides  a  way to purge entries that were not
              recovered appropriately after the specified fixed timeout. If you set a low value, TCP entries  in
              Established  states  with  no  traffic  may hang. For example, an SSH connection without KeepAlive
              enabled.

              Example: CommitTimeout 180

              By default, this option is not set (the daemon  uses  an  approximate  timeout  value  calculation
              mechanism).

       PurgeTimeout <seconds>
              If the firewall replica goes from primary to backup, the `conntrackd -t command' is invoked in the
              script. This command schedules a flush of the table in N seconds.

              This is useful to purge the connection tracking table of zombie entries and avoid clashes with old
              entries if you trigger several consecutive hand-overs.

              Default is 60 seconds.

       ACKWindowSize <value>
              Set  the  acknowledgement  window  size. If you decrease this value, the number of acknowlegdments
              increases. More acknowledgments means more overhead as conntrackd(8) has to  handle  more  control
              messages.  On  the  other  hand, if you increase this value, the resend queue gets more populated.
              This results in more overhead in the queue releasing.

              Example: ACKWindowSize 300

              If not set, default window size is 300 (value is based on some practical experiments measuring the
              cycles spent by the acknowledgment handling with oprofile).

       DisableExternalCache <on|off>
              This  clause  allows  you  to  disable  the  external  cache. Thus, the state entries are directly
              injected into the kernel conntrack table. As a result, you  save  memory  in  user-space  but  you
              consume  slots  in  the  kernel  conntrack table for backup state entries. Moreover, disabling the
              external cache means more CPU consumption. You need a Linux kernel >= 2.6.29 to use this feature.

              If you are installing conntrackd(8) for first time, please read the user manual  and  I  encourage
              you to consider using the fail-over scripts instead of enabling this option!

              By default, this clause is set off.

   Mode ALARM
       This mode is spamming. It is based on a alarm-based protocol that periodically re-sends the flow state to
       the backup firewall replicas. This protocol consumes a lot of bandwidth but it  resolves  synchronization
       problems fast.

       In this synchronization mode you may configure RefreshTime, CacheTimeout, CommitTimeout and PurgeTimeout.

       RefreshTime <seconds>
              If  a conntrack entry is not modified in <= N seconds, then a message is broadcasted. For example,
              this mechanism may be used to resynchronize nodes that just joined the multicast group.

              Example: RefreshTime 15

       CacheTimeout <seconds>
              If we don't receive a notification about the state of an entry  in  the  external  cache  after  N
              seconds, then remove it.

              Example: CacheTimeout 180

       CommitTimeout <seconds>
              Same as in FTFW mode.

       PurgeTimeout <seconds>
              Same as in FTFW mode.

   Mode NOTRACK
       Is  the  most  simple mode as it is based on a best effort replication protocol, ie. unreliable protocol.
       This protocol sends and receives the state information without performing any specific checking.

       In this synchronization mode you may configure DisableInternalCache, DisableExternalCache,  CommitTimeout
       and PurgeTimeout.

       DisableInternalCache <on|off>
              This  clause  allows  you  to  disable  the internal cache. Thus, the synchronization messages are
              directly sent through the dedicated link.

              This option is set off by default.

       DisableExternalCache <on|off>
              Same as in FTFW mode.

       CommitTimeout <seconds>
              Same as in FTFW mode.

       PurgeTimeout <seconds>
              Same as in FTFW mode.

   MULTICAST
       This section indicates to conntrackd(8) to use multicast as transport  mechanism  between  nodes  of  the
       firewall cluster.

       Please  note  you can specify more than one dedicated link. Thus, if one dedicated link fails, the daemon
       can fail-over to another. Note that adding more than one dedicated link does not mean that  state-updates
       will be sent to all of them. There is only one active dedicated link at a given moment.

       The Default keyword indicates that this interface will be selected as the initial dedicated link. You can
       have up to 4 redundant dedicated links.

       Note: use different multicast groups for every redundant link.

       Example:
            Multicast Default {
                 IPv4_address 225.0.0.51
                 Group 3781
                 IPv4_interface 192.168.100.101
                 Interface eth3
                 SndSocketBuffer 1249280
                 RcvSocketBuffer 1249280
                 Checksum on
            }
            Multicast {
                 IPv4_address 225.0.0.51
                 Group 3782
                 IPv4_interface 192.168.100.102
                 Interface eth4
                 SndSocketBuffer 1249280
                 RcvSocketBuffer 1249280
                 Checksum on
            }

       IPv4_address <address>
              Multicast address: The address that you use as destination in the synchronization messages. You do
              not have to add this IP to any of your existing interfaces.

              Example: IPv4_address 255.0.0.50

       Group <number>
              The multicast group that identifies the cluster.

              Example: Group 3780

              If any doubt, do not modify this value.

       IPv4_interface <address>
              IP  address  of  the  interface  that  you  are going to use to send the synchronization messages.
              Remember that you must use a dedicated link for the synchronization messages.

              Example:  IPv4_interface 192.168.100.100

       Interface <name>
              The name of the interface that you are going to use to send the synchronization messages.

              Example: Interface eth2

       SndSocketBuffer <number>
              This transport protocol sender uses a  buffer  to  enqueue  the  packets  that  are  going  to  be
              transmitted.     The    default    size    of    this    socket    buffer    is    available    at
              /proc/sys/net/core/wmem_default.

              This value determines the chances to have an overrun in the sender queue. The overrun  results  in
              packet  loss,  thus,  losing  state information that would have to be retransmitted. If you notice
              some packet loss, you may want to increase the size of the buffer.  The  system  default  size  is
              usually around ~100 KBytes which is fairly small for busy firewalls.

              Note: The NOTRACK protocol is best effort, it is really recommended to increase the buffer size.

              Example: SndSocketBuffer 1249280

       RcvSocketBuffer <number>
              This  transport  protocol receiver uses a buffer to enqueue the packets that the socket is pending
              to handle. The default size of this socket buffer is available at /proc/sys/net/core/rmem_default.

              This value determines the chances to have an overrun in the receiver queue.  The  overrun  results
              in  packet loss, thus, losing state information that would have to be retransmitted. If you notice
              some packet loss, you may want to increase the size of the buffer.  The  system  default  size  is
              usually around ~100 KBytes which is fairly small for busy firewalls.

              Note: The NOTRACK protocol is best effort, it is really recommended to increase the buffer size.

              Example: RcvSocketBuffer 1249280

       Checksum <on|off>
              Enable/Disable  message  checksumming. This is a good property to achieve fault-tolerance. In case
              of doubt, use it.

   UDP
       This section indicates to conntrackd(8) to use UDP as transport mechanism between nodes of  the  firewall
       cluster.

       As  in  the Multicast configuration, you may especify several fail-over dedicated links using the Default
       keyword.

       Example:
            UDP {
                 IPv4_address 172.16.0.1
                 IPv4_Destination_Address 172.16.0.2
                 Port 3781
                 Interface eth3
                 SndSocketBuffer 1249280
                 RcvSocketBuffer 1249280
                 Checksum on
            }

       IPv4_address <address>
              UDP IPv4 address that this firewall uses to listen to events.

              Example: IPv4_address 192.168.2.100

       IPv6_address <address>
              UDP IPv6 address that this firewall uses to listen to events.

              Example: IPv6_address fe80::215:58ff:fe28:5a27

       IPv4_Destination_Address <address>
              Destination IPv4 UDP address that  receives  events,  ie.  the  other  firewall's  dedicated  link
              address.

              Example: IPv4_Destination_Address 192.168.2.101

       IPv6_Destionation_Address <address>
              Destination  IPv6  UDP  address  that  receives  events,  ie.  the other firewall's dedicated link
              address.

              Example: IPv6_Destination_Address fe80::2d0:59ff:fe2a:775c

       Port <number>
              UDP port used

              Example: Port 3780

       Interface <name>
              Same as in the Multicast transport protocol configuration.

       SndSocketBuffer <number>
              Same as in the Multicast transport protocol configuration.

       RcvSocketBuffer <number>
              Same as in the Multicast transport protocol configuration.

       Checksum <on|off>
              Same as in the Multicast transport protocol configuration.

   TCP
       You can also use Unicast TCP to propagate events.

       If you combine this transport with the NOTRACK mode, it becomes reliable.

       The TCP transport protocol can be configured in exactly the same way as the UDP transport protocol.

       As in the Multicast configuration, you may especify several fail-over dedicated links using  the  Default
       keyword.

       Example:
            TCP {
                 IPv6_address fe80::215:58ff:fe28:5a27
                 IPv6_Destination_Address fe80::215:58ff:fe28:5a27
                 Port 3781
                 Interface eth2
                 SndSocketBuffer 1249280
                 RcvSocketBuffer 1249280
                 Checksum on
            }

   OPTIONS
       Other unsorted options that are related to the synchronization protocol or transport mechanism.

       TCPWindowTracking <on|off>
              TCP state-entries have window tracking disabled by default, you can enable it with this option. As
              said, default is off.  This feature requires a Linux kernel >= 2.6.36.

       ExpectationSync <on|{ list }>
              Set this option on if you want to enable the synchronization of expectations.  You have to specify
              the list of helpers that you want to enable.

              This feature requires a Linux kernel >= 3.5.

              Example, sync all expectations:
                   ExpectationSync on

              Example, sync given expectations:
                   ExpectationSync {
                        ftp
                        ras
                        q.931
                        h.245
                        sip
                   }

              By default, this option is disabled.

GENERAL

       This top-level section contains generic configuration directives for the conntrackd(8) daemon.

       Systemd <on|off>
              Enable systemd(1) runtime support if conntrackd(8) is compiled with the proper configuration. Then
              you can use a service unit of Type=notify.

              Obviusly, this requires the init systemd of your system to be systemd(1).

              Note: systemd(1) watchdog is supported as well.

              Example: Systemd off

              By default runtime support is activated.

       Nice <value>
              Set the nice(1) value of the daemon, this value goes from -20 (most favorable  scheduling)  to  19
              (least favorable). Using a very low value reduces the chances to lose state-change events.

              Example: Nice -20

              Default  is  0  but this example sets it to most favourable scheduling as this is generally a good
              idea.

       HashSize <value>
              Number of buckets in the cache hashtable. The bigger it is, the closer it gets to O(1) at the cost
              of consuming more memory. Read some documents about tuning hashtables for further reference.

              Example: HashSize 32768

       HashLimit <value>
              Maximum  number  of  conntracks,  it  should be double of /proc/sys/net/netfilter/nf_conntrack_max
              since the daemon may keep some dead  entries  cached  for  possible  retransmission  during  state
              synchronization.

              Example: HashLimit 131072

       LogFile <on|off|filename>
              Enable conntrackd(8) to log to a file.

              Example: LogFile on

              Default is off. The default logfile is /var/log/conntrackd.log.

       Syslog <on|off|facility>
              Enable  connection  logging  via  Syslog.  If  you  set the facility, use the same as in the Stats
              section, otherwise you'll get a warning message.

              Example: Syslog local0

              Default is off.

       Lockfile <filename>
              Lockfile to be used by conntrackd(8) (absolute path).

              Example: LockFile /var/lock/conntrack.lock

              Default is /var/lock/conntrack.lock.

       NetlinkBufferSize <value>
              Netlink event socket buffer size. If you do not specify this clause, the default buffer size value
              in  /proc/net/core/rmem_default  is used. This default value is usually around 100 Kbytes which is
              fairly small for busy firewalls. This leads to event message dropping and high CPU consumption.

              Example: NetlinkBufferSize 2097152

       NetlinkBufferSizeMaxGrowth <value>
              The daemon doubles the size of the netlink event socket buffer size if it  detects  netlink  event
              message dropping. This clause sets the maximum buffer size growth that can be reached.

              Example:  NetlinkBufferSizeMaxGrowth 8388608

       NetlinkOverrunResync <on|off|value>
              If  the  daemon detects that Netlink is dropping state-change events, it automatically schedules a
              resynchronization against the Kernel after 30  seconds  (default  value).  Resynchronizations  are
              expensive  in terms of CPU consumption since the daemon has to get the full kernel state-table and
              purge state-entries that do not exist anymore.

              Note: Be careful of setting a very small value here.

              Example: NetlinkOverrunResync on

              The default value is 30 seconds.  If not specified, the daemon assumes that this option is enabled
              and uses the default value.

       NetlinkEventsReliable <on|off>
              If  you want reliable event reporting over Netlink, set on this option. If you set on this clause,
              it is a good idea to set off NetlinkOverrunResync.

              You need Linux Kernel >= 2.6.31 for this option to work.

              Example: NetlinkEventsReliable on

              This option is off by default.

       PollSecs <seconds>
              By default, the daemon receives state updates following an event-driven  model.   You  can  modify
              this behaviour by switching to polling mode with this clause.

              This  clause tells conntrackd(8) to dump the states in the kernel every N seconds. With regards to
              synchronization mode, the polling mode can only guarantee that long-lifetime states are recovered.
              The  main  advantage  of  this  method  is  the  reduction in the state replication at the cost of
              reducing the chances of recovering connections.

              Example: PollSecs 15

       EventIterationLimit <value>
              The daemon prioritizes the handling of state-change events coming from the core. With this clause,
              you  can  set  the maximum number of state-change events (those coming from kernel-space) that the
              daemon will handle after which it will handle other events coming from the network or userspace.

              A low value improves interactivity (in terms of real-time behaviour) at  the  cost  of  extra  CPU
              consumption.

              Example: EventIterationLimit 100

              Default (if not set) is 100.

   UNIX
       Unix  socket  configuration.  This  socket  is  used by conntrackd(8) to listen to external commands like
       `conntrackd -k' or `conntrackd -n'.

       Example:
            UNIX {
                 Path /var/run/conntrackd.ctl
                 Backlog 20
            }

       Path <filename>
              Absolute path to the Unix socket.

              Example: Path /var/run/conntrackd.ctl

       Backlog <value>
              Number of items in the backlog.

              Example: Backlog 20

   FILTER
       Event filtering. This clause allows you to filter certain traffic.

       There are currently three filter-sets: Protocol, Address and State. The filter is attached to  an  action
       that  can  be:  Accept  or  Ignore. Thus, you can define the event filtering policy of the filter-sets in
       positive or negative logic depending on your needs.

       You can select if conntrackd(8) filters the event messages from user-space or kernel-space.  The  kernel-
       space  event  filtering saves some CPU cycles by avoiding the copy of the event message from kernel-space
       to user-space. The kernel-space event filtering is prefered, however,  you  require  a  Linux  kernel  >=
       2.6.29 to filter from kernel-space.

       The syntax for this section is: Filter From <from> { }.

       If you want to select kernel-space event filtering, use the keyword Kernelspace instead of Userspace.

       Example:
            Filter From Userspace {
                 Protocol Accept {
                      TCP
                      SCTP
                      DCCP
                 }
                 Address Ignore {
                      IPv4_address 127.0.0.1
                      IPv6_address ::1
                 }
                 State Accept {
                      ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT
                 }
            }

       Protocol <policy> { <protocols list> }
              Accept  only  certain  protocols:  You may want to replicate the state of flows depending on their
              layer 4 protocol.

              Policy is one of Accept or Ignore.

              Protocols are: TCP, SCTP, DCCP, UDP, ICMP and IPv6-ICMP.

              The ICMP and IPv6-ICMP protocols require a Linux kernel >= 2.6.31.

              Example:
                   Protocol Accept {
                        TCP
                        SCTP
                        DCCP
                   }

       Address <policy> { <addresses list> }
              Ignore traffic for a certain set of IP's: Usually all the IP assigned to the firewall since  local
              traffic must be ignored, only forwarded connections are worth to replicate.

              Note that these values depends on the local IPs that are assigned to the firewall.

              You may specify several IPv4_address and/or IPv6_address directives. You can also specify networks
              in CIDR format.

              Policy is one of Accept or Ignore.

              Example:
                   Address Ignore {
                        IPv4_address 127.0.0.1 # loopback
                        IPv4_address 192.168.0.100 # virtual IP 1
                        IPv4_address 192.168.1.100 # virtual IP 2
                        IPv4_address 192.168.100.100 # dedicated link ip
                        IPv4_address 192.168.0.0/24
                        IPv6_address ::1
                   }

       State <policy> { <states list> }
              Filter by flow state.  This option introduces a trade-off  in  the  replication:  it  reduces  CPU
              consumption at the cost of having lazy backup firewall replicas.

              Note: only affects TCP flows.

              The  existing  TCP  states  are:  SYN_SENT, SYN_RECV, ESTABLISHED, FIN_WAIT, CLOSE_WAIT, LAST_ACK,
              TIME_WAIT, CLOSED and LISTEN.

              Policy is one of Accept or Ignore.

              Example:
                   State Accept {
                        ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT
                   }

   SCHEDULER
       Select a different scheduler for the daemon, you can select between RR and FIFO and the process priority.

       See sched_setscheduler(2) for more information. Using a RT scheduler reduces the chances to  overrun  the
       Netlink buffer.

       Example:
            Scheduler {
                 Type FIFO
                 Priority 99
            }

       Type <type>
              Supported values are RR or FIFO.

       Priority <value>
              Value of the scheduler priority.

              Minimum is 0, maximum is 99.

STATS

       This  top-level  section  indicates  conntrackd(8)  to work as a statistic collector for the nf_conntrack
       linux kernel subsystem.

       LogFile <on|off|filename>
              If you enable this option, the daemon writes the information  about  destroyed  connections  to  a
              logfile.

              Default is off. Default filename is /var/log/conntrackd-stats.log.

       NetlinkEventsReliable <on|off>
              If  you want reliable event reporting over Netlink, set on this option. If you set on this clause,
              it is a good idea to set off NetlinkOverrunResync. This requires Linux kernel >= 2.6.31.

              Default is off.

       Syslog <on|off|facility>
              Enable connection logging via Syslog.  If you set the facility, use the same  as  in  the  General
              section, otherwise you'll get a warning message.

              Example: Syslog local0

              Default is off.

HELPER

       Note: this configuration is very advanced and has nothing to do with synchronization or stats collection.

       This  top-level  section indicates conntrackd(8) to inject user-space helpers into the nf_conntrack linux
       kernel subsystem.  It will result in the nf_conntrack engine sending connections to userspace for further
       processing.

       Before this, you have to make sure you have registered the given user-space helper stub.

       Example:
            % nfct add helper ftp inet tcp

       Each user-space helper should be registered using a Type section, which are named this way:
            Type <name> <af> <transport>

       Examples:

       Helper {
            Type ftp inet tcp {
                 QueueNum 0
                 QueueLen 10240
                 Policy ftp {
                      ExpectMax 1
                      ExpectTimeout 300
                 }
            }
            Type rpc inet tcp {
                 QueueNum 1
                 QueueLen 10240
                 Policy rpc {
                      ExpectMax 1
                      ExpectTimeout 300
                 }
            }
            Type rpc inet udp {
                 QueueNum 2
                 QueueLen 10240
                 Policy rpc {
                      ExpectMax 1
                      ExpectTimeout 300
                 }
            }
            Type tns inet tcp {
                 QueueNum 3
                 QueueLen 10240
                 Policy tns {
                      ExpectMax 1
                      ExpectTimeout 300
                 }
            }
            Type dhcpv6 inet6 udp {
                 QueueNum 4
                 QueueLen 10240
                 Policy dhcpv6 {
                      ExpectMax 1
                      ExpectTimeout 300
                 }
            }
            Type ssdp inet udp {
                 QueueNum 5
                 QueueLen 10240
                 Policy ssdp {
                      ExpectMax 1
                      ExpectTimeout 300
                 }
            }
       }

       Parameters inside the Type section:

       QueueNum <number>
              Set NFQUEUE number you want to use to receive traffic from the kernel.

              Example: QueueNum 0

       QueueLen <number>
              Maximum number of packets waiting in the queue to receive a verdict from user-space.

              Rise value if you hit the following error message:
                   "nf_queue: full at X entries, dropping packet(s)"

              Default is 1024.

              Example: QueueLen 10240

       Policy <name> { }
              Set the expectation policy for the given helper.

              This  sub-section  contains  2  directives:  ExpectMax  <number>  (maximum  number of simultaneous
              expectations) and ExpecTimeout <seconds> (maximum living time for one expectation).

COMPLETE EXAMPLES

       Find below some real-life working examples.

   STATS EXAMPLE
       This configuration example tells conntrackd(8) to work as a stats collector.

       Stats {
            LogFile on
            NetlinkEventsReliable Off
            Syslog off
       }
       General {
            Systemd on
            Nice -1
            HashSize 8192
            HashLimit 65535
            Syslog on
            LockFile /var/lock/conntrack.lock
            UNIX {
                 Path /var/run/conntrackd.ctl
                 Backlog 20
            }
            NetlinkBufferSize 262142
            NetlinkBufferSizeMaxGrowth 655355
            Filter {
                 Protocol Accept {
                      TCP
                      UDP
                 }
                 Address Ignore {
                      IPv4_address 127.0.0.1
                      IPv6_address ::1
                 }
            }
       }

   SYNC EXAMPLE 1
       This example configures synchronization in FTFW mode with Multicast transport.

       It includes common general configuration as well.

       Note: this is one of the recommended setups for conntrackd(8) in a firewall cluster environment.

       Sync {
            Mode FTFW {
                 ResendQueueSize 131072
                 PurgeTimeout 60
                 ACKWindowSize 300
                 DisableExternalCache Off
            }
            Multicast {
                 IPv4_address 225.0.0.50
                 Group 3780
                 IPv4_interface 192.168.100.100
                 Interface eth2
                 SndSocketBuffer 1249280
                 RcvSocketBuffer 1249280
                 Checksum on
            }
            Multicast Default {
                 IPv4_address 225.0.0.51
                 Group 3781
                 IPv4_interface 192.168.100.101
                 Interface eth3
                 SndSocketBuffer 1249280
                 RcvSocketBuffer 1249280
                 Checksum on
            }
            Options {
                 TCPWindowTracking Off
                 ExpectationSync On
            }
       }
       General {
            Systemd on
            Nice -20
            Scheduler {
                 Type FIFO
                 Priority 99
            }
            HashSize 32768
            HashLimit 131072
            LogFile on
            Syslog off
            LockFile /var/lock/conntrack.lock
            UNIX {
                 Path /var/run/conntrackd.ctl
                 Backlog 20
            }
            NetlinkBufferSize 2097152
            NetlinkBufferSizeMaxGrowth 8388608
            NetlinkOverrunResync On
            NetlinkEventsReliable Off
            EventIterationLimit 100
            Filter From Userspace {
                 Protocol Accept {
                      TCP
                      SCTP
                      DCCP
                 }
                 Address Ignore {
                      IPv4_address 127.0.0.1
                      IPv4_address 192.168.100.0/24
                      IPv6_address ::1
                 }
            }
       }

   SYNC EXAMPLE 2
       This example configures synchronization in NOTRACK mode with TCP transport.

       It includes common general configuration as well.

       Sync {
            Mode NOTRACK {
                 DisableInternalCache on
                 DisableExternalCache on
            }
            TCP {
                 IPv4_address 192.168.2.100
                 IPv4_Destination_Address 192.168.2.101
                 Port 3780
                 Interface eth2
                 SndSocketBuffer 1249280
                 RcvSocketBuffer 1249280
                 Checksum on
            }
            Options {
                 TCPWindowTracking Off
                 ExpectationSync On
            }
       }
       General {
            Systemd on
            Nice -20
            Scheduler {
                 Type FIFO
                 Priority 99
            }
            HashSize 32768
            HashLimit 131072
            LogFile on
            Syslog off
            LockFile /var/lock/conntrack.lock
            UNIX {
                 Path /var/run/conntrackd.ctl
                 Backlog 20
            }
            NetlinkBufferSize 2097152
            NetlinkBufferSizeMaxGrowth 8388608
            NetlinkOverrunResync On
            NetlinkEventsReliable Off
            EventIterationLimit 100
            Filter From Userspace {
                 Protocol Accept {
                      TCP
                      SCTP
                      DCCP
                 }
                 Address Ignore {
                      IPv4_address 127.0.0.1
                      IPv4_address 192.168.0.0/16
                      IPv6_address ::1
                 }
                 State Accept {
                      ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT
                 }
            }
       }

SEE ALSO

       conntrackd(8), conntrack(8), nfct(8), http://conntrack-tools.netfilter.org/manual.html

AUTHOR

       Pablo Neira Ayuso wrote and maintains the conntrackd tool.

       This manual page was written by Arturo Borrero  Gonzalez  <arturo@debian.org>  based  on  the  conntrackd
       tarball config examples.

       Please send bug reports to <netfilter-devel@lists.netfilter.org>. Subscription is required.

       This documentation is free/libre under the terms of the GPLv2+.

                                                  Oct 18, 2016                                CONNTRACKD.CONF(5)