What does these option do for netfilter?

Swakoo · 05-14-2009, 10:55 PM

Quote:

# echo 1 > /proc/sys/net/netfilter/nf_conntrack_tcp_be_liberal

# echo 1 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal

Recently I need to troubleshoot a debian based router (Vyatta) and these options were required to allow sending of mails with attachment successfully to a specific recipient.

It works for all other recipients by default (without the options)

what are they for?
How do I make it persistent?

Thanks!

i92guboj · 05-15-2009, 01:12 AM

If you have your kernel sources installed, you can find complete documentation for this at Documentation/networking/ip-sysctl.txt

If you don't, just google for 'Documentation/networking/ip-sysctl.txt' and you should be able to find it.

chrism01 · 05-15-2009, 01:33 AM

Just FYI, in CENTOS you edit /etc/sysctl.conf. I'd guess its something similar for you.

Swakoo · 05-15-2009, 03:03 AM

hmm.. i guess this vyatta is a striped down version (lenny/sid)..
tried google for the keywords you mentioned, but i don't see the 2 modules i am looking at hmm

google always return not found if i became too specific

how do one make such changes persistent in debian? is it the same /etc/sysctl.conf?
I see the same file

i92guboj · 05-15-2009, 03:13 AM

I guess yep.

Values are stored in this fashion on that file.

Code:

value.for.this_keyword = <value>

Swakoo · 05-15-2009, 05:53 AM

but for the 2 fields i am looking at, anyone can explain what are they for?

just curious how toggling it can solve my problem.

i92guboj · 05-15-2009, 06:03 AM

No idea, for my version of the kernel at least they are not in the docs.

archtoad6 · 06-14-2009, 04:39 PM

No idea either. Googling indicates that the definitions should be in a file named ip-sysctl.txt. None of the ones I tracked down mentioned, let alone defined,
/proc/sys/net/netfilter/nf_conntrack_tcp_be_liberal or
/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal

http://www.kernel.org/doc/Documentat.../ip-sysctl.txt is one of the longer (more complete?) that I found.