summaryrefslogtreecommitdiffstats
path: root/conntrackd.conf.5
blob: 673f895c72b0ae5ca61c9b139c7f6417bf93cdde (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
.\"
.\" (C) Copyright 2015-2018, Arturo Borrero Gonzalez <arturo@netfilter.org>
.\"
.\" %%%LICENSE_START(GPLv2+_DOC_FULL)
.\" This is free documentation; you can redistribute it and/or
.\" modify it under the terms of the GNU General Public License as
.\" published by the Free Software Foundation; either version 2 of
.\" the License, or (at your option) any later version.
.\"
.\" The GNU General Public License's references to "object code"
.\" and "executables" are to be interpreted as the output of any
.\" document formatting or typesetting system, including
.\" intermediate and printed output.
.\"
.\" This manual is distributed in the hope that it will be useful,
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
.\" GNU General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public
.\" License along with this manual; if not, see
.\" <http://www.gnu.org/licenses/>.
.\" %%%LICENSE_END
.\"
.TH CONNTRACKD.CONF 5 "Jan 27, 2019"

.SH NAME
conntrackd.conf \- configuration file for conntrackd daemon

.SH DESCRIPTION
\fBconntrackd.conf\fP is the main configuration file for the
\fBconntrackd(8)\fP daemon. It is loaded by calling `\fIconntrackd -C
conntrackd.conf\fP'.

The format of this file is simple, using brackets for sections and
key-value pairs for concrete configuration directives:

.nf
	section1 {
		option1 value1
		option2 value2
	}
	section2 {
		option3 value3
		subsection1 {
			option4 value4
		}
	}
.fi

You should consider this file as case-sensitive.
Empty lines and lines starting with the '#' character are ignored.

Before starting to develop a new configuration, you may want to learn the
concepts behind this technlogy at
\fIhttp://conntrack-tools.netfilter.org/manual.html\fP.

There are complete configuration examples at the end of this man page.

.SH SYNC

This top-level section defines how \fBconntrackd(8)\fP should handle
synchronization with other cluster nodes.

There are 3 main synchronization modes or protocols: \fBNOTRACK\fP, \fBALARM\fP
and \fBFTFW\fP.

There are 3 transport protocols as well: \fBTCP\fP, \fBMulticast\fP
and \fBUDP\fP.

You have to choose one synchronization mode and one transport protocol.

Also, there are some general options in this section.

.SS Mode FTFW

This mode is based on a reliable protocol that performs message tracking.
Thus, the protocol can recover from message loss, re-ordering and corruption.

In this synchronization mode you may configure \fBResendQueueSize\fP,
\fBCommitTimeout\fP, \fBPurgeTimeout\fP, \fBACKWindowSize\fP ,
\fBDisableExternalCache\fP and \fBStartupResync\fP.

.TP
.BI "ResendQueueSize <value>"
Size of the resend queue (in objects). This is the maximum number of objects
that can be stored waiting to be confirmed via acknoledgment.
If you keep this value low, the daemon will have less chances to recover
state-changes under message omission. On the other hand, if you keep this value
high, the daemon will consume more memory to store dead objects.

Example: ResendQueueSize 131072

Default is 131072 objects.

.TP
.BI "CommitTimeout <seconds>"
This parameter allows you to set an initial fixed timeout for the committed
entries when this node goes from backup to primary. This mechanism provides
a way to purge entries that were not recovered appropriately after the
specified fixed timeout. If you set a low value, TCP entries in Established
states with no traffic may hang. For example, an SSH connection without
KeepAlive enabled.

Example: CommitTimeout 180

By default, this option is not set (the daemon uses an approximate timeout
value calculation mechanism).

.TP
.BI "PurgeTimeout <seconds>"
If the firewall replica goes from primary to backup, the
`\fIconntrackd -t command\fP' is invoked in the script. This command schedules
a flush of the table in N seconds.

This is useful to purge the connection tracking table of zombie entries and
avoid clashes with old entries if you trigger several consecutive hand-overs.

Default is 60 seconds.

.TP
.BI "ACKWindowSize <value>"
Set the acknowledgement window size. If you decrease this value, the number of
acknowlegdments increases. More acknowledgments means more overhead as
\fBconntrackd(8)\fP has to handle more control messages. On the other hand, if
you increase this value, the resend queue gets more populated. This results in
more overhead in the queue releasing.

Example: ACKWindowSize 300

If not set, default window size is 300 (value is based on some practical
experiments measuring the cycles spent by the acknowledgment handling
with oprofile).

.TP
.BI "DisableExternalCache <on|off>"
This clause allows you to disable the external cache. Thus, the state entries
are directly injected into the kernel conntrack table. As a result, you save
memory in user-space but you consume slots in the kernel conntrack table for
backup state entries. Moreover, disabling the external cache means more CPU
consumption. You need a \fBLinux kernel >= 2.6.29\fP to use this feature.

If you are installing \fBconntrackd(8)\fP for first time, please read the user
manual and I encourage you to consider using the fail-over scripts instead of
enabling this option!

By default, this clause is set off.

.TP
.BI "StartupResync <on|off>"
Order conntrackd to request a complete conntrack table resync against the other
node at startup. A single request will be made.

This is useful to get in sync with another node which has been running while we
were down.

Example: StartupResync on

By default, this clause is set off.

.SS Mode ALARM

This mode is spamming. It is based on a alarm-based protocol that periodically
re-sends the flow state to the backup firewall replicas. This protocol consumes
a lot of bandwidth but it resolves synchronization problems fast.

In this synchronization mode you may configure \fBRefreshTime\fP,
\fBCacheTimeout\fP, \fBCommitTimeout\fP and \fBPurgeTimeout\fP.

.TP
.BI "RefreshTime <seconds>"
If a conntrack entry is not modified in <= N seconds, then a message is
broadcasted. For example, this mechanism may be used to resynchronize nodes
that just joined the multicast group.

Example: RefreshTime 15

.TP
.BI "CacheTimeout <seconds>"
If we don't receive a notification about the state of an entry in the
external cache after N seconds, then remove it.

Example: CacheTimeout 180

.TP
.BI "CommitTimeout <seconds>"
Same as in \fBFTFW\fP mode.

.TP
.BI "PurgeTimeout <seconds>"
Same as in \fBFTFW\fP mode.

.SS Mode NOTRACK

Is the most simple mode as it is based on a best effort replication protocol,
ie. unreliable protocol. This protocol sends and receives the state information
without performing any specific checking.

In this synchronization mode you may configure \fBDisableInternalCache\fP,
\fBDisableExternalCache\fP, \fBCommitTimeout\fP, \fBPurgeTimeout\fP and
\fBStartupResync\fP.

.TP
.BI "DisableInternalCache <on|off>"
This clause allows you to disable the internal cache. Thus, the synchronization
messages are directly sent through the dedicated link.

This option is set off by default.

.TP
.BI "DisableExternalCache <on|off>"
Same as in \fBFTFW\fP mode.

.TP
.BI "CommitTimeout <seconds>"
Same as in \fBFTFW\fP mode.

.TP
.BI "PurgeTimeout <seconds>"
Same as in \fBFTFW\fP mode.

.TP
.BI "StartupResync <on|off>"
Same as in \fBFTFW\fP mode.

.SS MULTICAST

This section indicates to \fBconntrackd(8)\fP to use multicast as transport
mechanism between nodes of the firewall cluster.

Please note you can specify more than one dedicated link. Thus, if one
dedicated link fails, the daemon can fail-over to another. Note that adding
more than one dedicated link does not mean that state-updates will be sent to
all of them. There is only one active dedicated link at a given moment.

The \fIDefault\fP keyword indicates that this interface will be selected as the
initial dedicated link. You can have up to 4 redundant dedicated links.

Note: use different multicast groups for every redundant link.

Example:
.nf
	Multicast Default {
		IPv4_address 225.0.0.51
		Group 3781
		IPv4_interface 192.168.100.101
		Interface eth3
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
	Multicast {
		IPv4_address 225.0.0.51
		Group 3782
		IPv4_interface 192.168.100.102
		Interface eth4
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
.fi

.TP
.BI "IPv4_address <address>"
Multicast address: The address that you use as destination in the
synchronization messages. You do not have to add this IP to any of your
existing interfaces.

Example: IPv4_address 255.0.0.50

.TP
.BI "Group <number>"
The multicast group that identifies the cluster.

Example: Group 3780

If any doubt, do not modify this value.

.TP
.BI "IPv4_interface <address>"
IP address of the interface that you are going to use to
send the synchronization messages. Remember that you must
use a dedicated link for the synchronization messages.

Example:  IPv4_interface 192.168.100.100

.TP
.BI "Interface <name>"
The name of the interface that you are going to use to send the synchronization
messages.

Example: Interface eth2

.TP
.BI "SndSocketBuffer <number>"
This transport protocol sender uses a buffer to enqueue the packets
that are going to be transmitted. The default size of this socket buffer is
available at \fB/proc/sys/net/core/wmem_default\fP.

This value determines the chances to have an overrun in the sender queue. The
overrun results in packet loss, thus, losing state information that would have
to be retransmitted. If you notice some packet loss, you may want to increase
the size of the buffer. The system default size is usually around
~100 KBytes which is fairly small for busy firewalls.

Note: The \fBNOTRACK\fP protocol is best effort, it is really recommended
to increase the buffer size.

Example: SndSocketBuffer 1249280

.TP
.BI "RcvSocketBuffer <number>"
This transport protocol receiver uses a buffer to enqueue the
packets that the socket is pending to handle. The default size of this socket
buffer is available at \fB/proc/sys/net/core/rmem_default\fP.

This value determines the chances to have an overrun in the receiver queue.
The overrun results in packet loss, thus, losing state information that would
have to be retransmitted. If you notice some packet loss, you may want to
increase the size of the buffer. The system default size is usually
around ~100 KBytes which is fairly small for busy firewalls.

Note: The \fBNOTRACK\fP protocol is best effort, it is really recommended
to increase the buffer size.

Example: RcvSocketBuffer 1249280

.TP
.BI "Checksum <on|off>"
Enable/Disable message checksumming. This is a good property to achieve
fault-tolerance. In case of doubt, use it.

.SS UDP
This section indicates to \fBconntrackd(8)\fP to use UDP as transport
mechanism between nodes of the firewall cluster.

As in the \fBMulticast\fP configuration, you may especify several fail-over
dedicated links using the \fIDefault\fP keyword.

Example:
.nf
	UDP {
		IPv4_address 172.16.0.1
		IPv4_Destination_Address 172.16.0.2
		Port 3781
		Interface eth3
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
.fi

.TP
.BI "IPv4_address <address>"
UDP IPv4 address that this firewall uses to listen to events.

Example: IPv4_address 192.168.2.100

.TP
.BI "IPv6_address <address>"
UDP IPv6 address that this firewall uses to listen to events.

Example: IPv6_address fe80::215:58ff:fe28:5a27

.TP
.BI "IPv4_Destination_Address <address>"
Destination IPv4 UDP address that receives events, ie. the other firewall's
dedicated link address.

Example: IPv4_Destination_Address 192.168.2.101

.TP
.BI "IPv6_Destionation_Address <address>"
Destination IPv6 UDP address that receives events, ie. the other firewall's
dedicated link address.

Example: IPv6_Destination_Address fe80::2d0:59ff:fe2a:775c

.TP
.BI "Port <number>"
UDP port used

Example: Port 3780

.TP
.BI "Interface <name>"
Same as in the \fBMulticast\fP transport protocol configuration.

.TP
.BI "SndSocketBuffer <number>"
Same as in the \fBMulticast\fP transport protocol configuration.

.TP
.BI "RcvSocketBuffer <number>"
Same as in the \fBMulticast\fP transport protocol configuration.

.TP
.BI "Checksum <on|off>"
Same as in the \fBMulticast\fP transport protocol configuration.


.SS TCP
You can also use Unicast TCP to propagate events.

If you combine this transport with the \fBNOTRACK\fP mode, it becomes reliable.

The TCP transport protocol can be configured in exactly the same way as
the \fBUDP\fP transport protocol.

As in the \fBMulticast\fP configuration, you may especify several fail-over
dedicated links using the \fIDefault\fP keyword.

Example:
.nf
	TCP {
		IPv6_address fe80::215:58ff:fe28:5a27
		IPv6_Destination_Address fe80::215:58ff:fe28:5a27
		Port 3781
		Interface eth2
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
.fi

.SS OPTIONS

Other unsorted options that are related to the synchronization protocol
or transport mechanism.

.TP
.BI "TCPWindowTracking <on|off>"
TCP state-entries have window tracking disabled by default, you can enable it
with this option. As said, default is off.
This feature requires a \fBLinux kernel >= 2.6.36\fP.

.TP
.BI "ExpectationSync <on|{ list }>"
Set this option on if you want to enable the synchronization of expectations.
You have to specify the list of helpers that you want to enable.

This feature requires a \fBLinux kernel >= 3.5\fP.

Example, sync all expectations:
.nf
	ExpectationSync on
.fi

Example, sync given expectations:
.nf
	ExpectationSync {
		ftp
		ras
		q.931
		h.245
		sip
	}
.fi

By default, this option is disabled.

.SH GENERAL

This top-level section contains generic configuration directives for the
\fBconntrackd(8)\fP daemon.

.TP
.BI "Systemd <on|off>"
Enable \fBsystemd(1)\fP runtime support if \fBconntrackd(8)\fP is compiled
with the proper configuration. Then you can use a service unit of
\fIType=notify\fP.

Obviously, this requires the init of your system to be \fBsystemd(1)\fP.

Note: \fBsystemd(1)\fP watchdog is supported as well.

Example: Systemd on

By default runtime support is enabled if conntrackd was built with the systemd
feature. Otherwise is off.

.TP
.BI "Nice <value>"
Deprecated. Conntrackd ignores this option and it will be removed in the
future. Please note that you can run \fBnice(1)\fP and \fBrenice(1)\fP
externally. Also note that \fBconntrackd(8)\fP now uses by default a RT
scheduler.

.TP
.BI "HashSize <value>"
Number of buckets in the cache hashtable. The bigger it is, the closer it gets
to \fIO(1)\fP at the cost of consuming more memory. Read some documents about
tuning hashtables for further reference.

Example: HashSize 32768

.TP
.BI "HashLimit <value>"
Maximum number of conntracks, it should be double of
\fB/proc/sys/net/netfilter/nf_conntrack_max\fP since the daemon may keep some
dead entries cached for possible retransmission during state synchronization.

Example: HashLimit 131072

.TP
.BI "LogFile <on|off|filename>"
Enable \fBconntrackd(8)\fP to log to a file.

Example: LogFile on

Default is off. The default logfile is \fB/var/log/conntrackd.log\fP.

.TP
.BI "Syslog <on|off|facility>"
Enable connection logging via Syslog. If you set the facility, use the same as
in the \fBStats\fP section, otherwise you'll get a warning message.

Example: Syslog local0

Default is off.

.TP
.BI "Lockfile <filename>"
Lockfile to be used by \fBconntrackd(8)\fP (absolute path).

Example: LockFile /var/lock/conntrack.lock

Default is \fB/var/lock/conntrack.lock\fP.

.TP
.BI "NetlinkBufferSize <value>"
Netlink event socket buffer size. If you do not specify this clause, the
default buffer size value in \fB/proc/sys/net/core/rmem_default\fP is used. This
default value is usually around \fB100 Kbytes\fP which is fairly small for
busy firewalls. This leads to event message dropping and high CPU consumption.

Example: NetlinkBufferSize 2097152

.TP
.BI "NetlinkBufferSizeMaxGrowth <value>"
The daemon doubles the size of the netlink event socket buffer size if it
detects netlink event message dropping. This clause sets the maximum buffer
size growth that can be reached.

Example:  NetlinkBufferSizeMaxGrowth 8388608

.TP
.BI "NetlinkOverrunResync <on|off|value>"
If the daemon detects that Netlink is dropping state-change events, it
automatically schedules a resynchronization against the Kernel after 30 seconds
(default value). Resynchronizations are expensive in terms of CPU consumption
since the daemon has to get the full kernel state-table and purge state-entries
that do not exist anymore.

Note: Be careful of setting a very small value here.

Example: NetlinkOverrunResync on

The default value is \fB30\fP seconds.
If not specified, the daemon assumes that this option is enabled and uses the
default value.

.TP
.BI "NetlinkEventsReliable <on|off>"
If you want reliable event reporting over Netlink, set on this option. If you
set on this clause, it is a good idea to set off \fBNetlinkOverrunResync\fP.

You need \fBLinux Kernel >= 2.6.31\fP for this option to work.

Example: NetlinkEventsReliable on

This option is off by default.

.TP
.BI "PollSecs <seconds>"
By default, the daemon receives state updates following an event-driven model.
You can modify this behaviour by switching to polling mode with this clause.

This clause tells \fBconntrackd(8)\fP to dump the states in the kernel every N
seconds. With regards to synchronization mode, the polling mode can only
guarantee that long-lifetime states are recovered. The main advantage of this
method is the reduction in the state replication at the cost of reducing the
chances of recovering connections.

Example: PollSecs 15

.TP
.BI "EventIterationLimit <value>"
The daemon prioritizes the handling of state-change events coming from the
core. With this clause, you can set the maximum number of state-change events
(those coming from kernel-space) that the daemon will handle after which it
will handle other events coming from the network or userspace.

A low value improves interactivity (in terms of real-time behaviour) at the
cost of extra CPU consumption.

Example: EventIterationLimit 100

Default (if not set) is 100.

.SS UNIX
Unix socket configuration. This socket is used by \fBconntrackd(8)\fP to listen
to external commands like `\fIconntrackd -k\fP' or `\fIconntrackd -n\fP'.

Example:
.nf
	UNIX {
		Path /var/run/conntrackd.ctl
	}
.fi

.TP
.BI "Path <filename>"
Absolute path to the Unix socket.

Example: Path /var/run/conntrackd.ctl

.TP
.BI "Backlog <value>"
Deprecated option.

.SS FILTER
Event filtering. This clause allows you to filter certain traffic.

There are currently three filter-sets: \fBProtocol\fP, \fBAddress\fP and
\fBState\fP. The filter is attached to an action that can be: \fBAccept\fP or
\fBIgnore\fP. Thus, you can define the event filtering policy of the
filter-sets in positive or negative logic depending on your needs.

You can select if \fBconntrackd(8)\fP filters the event messages from
user-space or kernel-space. The kernel-space event filtering saves some CPU
cycles by avoiding the copy of the event message from kernel-space to
user-space. The kernel-space event filtering is prefered, however, you require
a \fBLinux kernel >= 2.6.29\fP to filter from kernel-space.

The syntax for this section is: \fBFilter From <from> { }\fP.

If you want to select kernel-space event filtering, use the keyword
\fBKernelspace\fP instead of \fBUserspace\fP.

Example:
.nf
	Filter From Userspace {
		Protocol Accept {
			TCP
			SCTP
			DCCP
		}
		Address Ignore {
			IPv4_address 127.0.0.1
			IPv6_address ::1
		}
		State Accept {
			ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP
		}
	}
.fi

.TP
.BI "Protocol <policy> { <protocols list> }"
Accept only certain protocols: You may want to replicate the state of flows
depending on their layer 4 protocol.

Policy is one of \fBAccept\fP or \fBIgnore\fP.

Protocols are: \fBTCP\fP, \fBSCTP\fP, \fBDCCP\fP, \fBUDP\fP, \fBICMP\fP and
\fBIPv6-ICMP\fP.

The \fBICMP\fP and \fBIPv6-ICMP\fP protocols require a
\fBLinux kernel >= 2.6.31\fP.

Example:
.nf
	Protocol Accept {
		TCP
		SCTP
		DCCP
	}
.fi

.TP
.BI "Address <policy> { <addresses list> }"
Ignore traffic for a certain set of IP's: Usually all the IP assigned to the
firewall since local traffic must be ignored, only forwarded connections are
worth to replicate.

Note that these values depends on the local IPs that are assigned to the
firewall.

You may specify several \fBIPv4_address\fP and/or \fBIPv6_address\fP
directives. You can also specify networks in CIDR format.

Policy is one of \fBAccept\fP or \fBIgnore\fP.

Example:
.nf
	Address Ignore {
		IPv4_address 127.0.0.1 # loopback
		IPv4_address 192.168.0.100 # virtual IP 1
		IPv4_address 192.168.1.100 # virtual IP 2
		IPv4_address 192.168.100.100 # dedicated link ip
		IPv4_address 192.168.0.0/24
		IPv6_address ::1
	}
.fi

.TP
.BI "State <policy> { <states list> for TCP }"
Filter by flow state.  This option introduces a trade-off in the replication:
it reduces CPU consumption at the cost of having lazy backup firewall replicas.

Note: only affects TCP flows.

The existing TCP states are: \fBSYN_SENT\fP, \fBSYN_RECV\fP, \fBESTABLISHED\fP,
\fBFIN_WAIT\fP, \fBCLOSE_WAIT\fP, \fBLAST_ACK\fP, \fBTIME_WAIT\fP,
\fBCLOSED\fP and \fBLISTEN\fP.

Policy is one of \fBAccept\fP or \fBIgnore\fP.

Example:
.nf
	State Accept {
		ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP
	}
.fi

.SS SCHEDULER
Select a different scheduler for the daemon, you can select between \fBRR\fP
and \fBFIFO\fP and the process priority.

Using a RT scheduler reduces the chances to overrun the Netlink buffer and
\fBconntrackd(8)\fP uses by default \fBRR\fP unless \fBFIFO\fP is selected.
See \fBsched_setscheduler(2)\fP for more information.

Example:
.nf
	Scheduler {
		Type FIFO
		Priority 99
	}
.fi

.TP
.BI "Type <type>"
Supported values are \fBRR\fP or \fBFIFO\fP.

Default: RR

.TP
.BI "Priority <value>"
Value of the scheduler priority.
Minimum is 0, maximum is 99.

Default: 99 (as returned by \fBsched_get_priority_max(2)\fP for \fBSCHED_RR\fP)

.SH STATS
This top-level section indicates \fBconntrackd(8)\fP to work as a statistic
collector for the nf_conntrack linux kernel subsystem.

.TP
.BI "LogFile <on|off|filename>"
If you enable this option, the daemon writes the information about destroyed
connections to a logfile.

Default is off. Default filename is \fB/var/log/conntrackd-stats.log\fP.

.TP
.BI "NetlinkEventsReliable <on|off>"
If you want reliable event reporting over Netlink, set on this option. If
you set on this clause, it is a good idea to set off
\fBNetlinkOverrunResync\fP. This requires \fBLinux kernel >= 2.6.31\fP.

Default is off.

.TP
.BI "Syslog <on|off|facility>"
Enable connection logging via Syslog.
If you set the facility, use the same as in the \fBGeneral\fP section,
otherwise you'll get a warning message.

Example: Syslog local0

Default is off.

.SH HELPER
Note: this configuration is very advanced and has nothing to do with
synchronization or stats collection.

This top-level section indicates \fBconntrackd(8)\fP to inject user-space
helpers into the nf_conntrack linux kernel subsystem.
It will result in the nf_conntrack engine sending connections to userspace
for further processing.

Before this, you have to make sure you have registered the given user-space
helper stub.

Example:
.nf
	% nfct add helper ftp inet tcp
.fi

Each user-space helper should be registered using a Type section, which
are named this way:
.nf
	\fBType <name> <af> <transport>\fP
.fi

Examples:

.nf
Helper {
	Type ftp inet tcp {
		QueueNum 0
		QueueLen 10240
		Policy ftp {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type rpc inet tcp {
		QueueNum 1
		QueueLen 10240
		Policy rpc {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type rpc inet udp {
		QueueNum 2
		QueueLen 10240
		Policy rpc {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type tns inet tcp {
		QueueNum 3
		QueueLen 10240
		Policy tns {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type dhcpv6 inet6 udp {
		QueueNum 4
		QueueLen 10240
		Policy dhcpv6 {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type ssdp inet udp {
		QueueNum 5
		QueueLen 10240
		Policy ssdp {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
}
.fi

Parameters inside the \fBType\fP section:

.TP
.BI "QueueNum <number>"
Set NFQUEUE number you want to use to receive traffic from the kernel.

Example: QueueNum 0

.TP
.BI "QueueLen <number>"
Maximum number of packets waiting in the queue to receive a verdict from
user-space.

Rise value if you hit the following error message:
.nf
	"nf_queue: full at X entries, dropping packet(s)"
.fi

Default is 1024.

Example: QueueLen 10240

.TP
.BI "Policy <name> { }"
Set the expectation policy for the given helper.

This sub-section contains 2 directives:
\fBExpectMax <number>\fP (maximum number of simultaneous expectations)
and \fBExpecTimeout <seconds>\fP (maximum living time for one expectation).

.SH COMPLETE EXAMPLES
Find below some real-life working examples.

.SS STATS EXAMPLE
This configuration example tells \fBconntrackd(8)\fP to work as a stats
collector.

.nf
Stats {
	LogFile on
	NetlinkEventsReliable Off
	Syslog off
}
General {
	Systemd on
	HashSize 8192
	HashLimit 65535
	Syslog on
	LockFile /var/lock/conntrack.lock
	UNIX {
		Path /var/run/conntrackd.ctl
	}
	NetlinkBufferSize 262142
	NetlinkBufferSizeMaxGrowth 655355
	Filter {
		Protocol Accept {
			TCP
			UDP
		}
		Address Ignore {
			IPv4_address 127.0.0.1
			IPv6_address ::1
		}
	}
}
.fi

.SS SYNC EXAMPLE 1
This example configures synchronization in \fBFTFW\fP mode with \fBMulticast\fP
transport.

It includes common general configuration as well.

Note: this is one of the recommended setups for \fBconntrackd(8)\fP in a
firewall cluster environment.

.nf
Sync {
	Mode FTFW {
		ResendQueueSize 131072
		PurgeTimeout 60
		ACKWindowSize 300
		DisableExternalCache Off
	}
	Multicast {
		IPv4_address 225.0.0.50
		Group 3780
		IPv4_interface 192.168.100.100
		Interface eth2
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
	Multicast Default {
		IPv4_address 225.0.0.51
		Group 3781
		IPv4_interface 192.168.100.101
		Interface eth3
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
	Options {
		TCPWindowTracking Off
		ExpectationSync On
	}
}
General {
	Systemd on
	HashSize 32768
	HashLimit 131072
	LogFile on
	Syslog off
	LockFile /var/lock/conntrack.lock
	UNIX {
		Path /var/run/conntrackd.ctl
	}
	NetlinkBufferSize 2097152
	NetlinkBufferSizeMaxGrowth 8388608
	NetlinkOverrunResync On
	NetlinkEventsReliable Off
	EventIterationLimit 100
	Filter From Userspace {
		Protocol Accept {
			TCP
			SCTP
			DCCP
		}
		Address Ignore {
			IPv4_address 127.0.0.1
			IPv4_address 192.168.100.0/24
			IPv6_address ::1
		}
	}
}
.fi

.SS SYNC EXAMPLE 2

This example configures synchronization in \fBNOTRACK\fP mode with \fBTCP\fP
transport.

It includes common general configuration as well.

.nf
Sync {
	Mode NOTRACK {
		DisableInternalCache on
		DisableExternalCache on
	}
	TCP {
		IPv4_address 192.168.2.100
		IPv4_Destination_Address 192.168.2.101
		Port 3780
		Interface eth2
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
	Options {
		TCPWindowTracking Off
		ExpectationSync On
	}
}
General {
	Systemd on
	HashSize 32768
	HashLimit 131072
	LogFile on
	Syslog off
	LockFile /var/lock/conntrack.lock
	UNIX {
		Path /var/run/conntrackd.ctl
	}
	NetlinkBufferSize 2097152
	NetlinkBufferSizeMaxGrowth 8388608
	NetlinkOverrunResync On
	NetlinkEventsReliable Off
	EventIterationLimit 100
	Filter From Userspace {
		Protocol Accept {
			TCP
			SCTP
			DCCP
		}
		Address Ignore {
			IPv4_address 127.0.0.1
			IPv4_address 192.168.0.0/16
			IPv6_address ::1
		}
		State Accept {
			ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP
		}
	}
}
.fi


.SH SEE ALSO
.BR conntrackd(8),
.BR conntrack(8),
.BR nfct(8),
.BR http://conntrack-tools.netfilter.org/manual.html

.SH AUTHOR
Pablo Neira Ayuso wrote and maintains the conntrackd tool.

This manual page was written by Arturo Borrero Gonzalez <arturo@debian.org>
based on the conntrackd tarball config examples.

Please send bug reports to <netfilter-devel@lists.netfilter.org>. Subscription is required.

This documentation is free/libre under the terms of the GPLv2+.