#conntrack

[ushf]

Annoying tftp

tftp -v -v -v 192.168.0.100 -c get hello.txt

The output showed a bunch of "no route to host". It turns out that on the client you need to modprobe the nf_conntrack_tftp module. I put this permanently into /etc/sysconfig/iptables-config.

IPTABLES_MODULES="ip_conntrack_ftp"

. Everything works well then.

Another quick test using

nc -vz 192.168.0.100 69

netcat to test port 69 availability.

More tftp iptables rules.

Possibly selinux issues.

This is a clear reference on setting up a basic tftp server via xinetd. The Debians often seem to go with a non-xinetd using the tftpd-ha package instead.

[survietamine]

iptables conntrack contexts

On a high load iptables gateway, for fine tunings (with sysctl) the ip_conntrack_max value, it might be useful to know how much contexts are used.

Here a way :

awk 'FNR==2 { print "ibase=16;"toupper($1) }' /proc/net/stat/ip_conntrack | bc

[koshoid]

Show connection tracking table for Linux-NAT (iptables):

conntrack -L

Debian package name: conntrack