CONNTRACKD.CONF(5)

✨ CONNTRACKD.CONF ✨

okay bestie, welcome to the conntrackd.conf glow-up 💖 this is the config file page from the File Formats Manual, and yes it's a whole vibe. strap in.

---

🌸 NAME 🌸

conntrackd.conf — the configuration file for the conntrackd daemon 🎀

---

🦋 DESCRIPTION 🦋

so conntrackd.conf is THE main configuration file for the conntrackd(8) daemon. you load it by calling conntrackd -C conntrackd.conf. that's the whole thing, it's giving main character energy fr fr.

the format of this file is simple — brackets for sections, key-value pairs for the actual config directives:

section1 {
     option1 value1
     option2 value2
}
section2 {
     option3 value3
     subsection1 {
          option4 value4
     }
}

you should consider this file case-sensitive. no cap. and empty lines plus lines that start with the # character? ignored. ghosted. 💅

before you start developing a new configuration, you may want to learn the concepts behind this technology at http://conntrack-tools.netfilter.org/manual.html. it's lowkey required reading, iykyk.

there are complete configuration examples at the end of this man page. yes, the whole thing. go off. ✨

---

💅 SYNC 💅

this top-level section defines how conntrackd(8) should handle synchronization with other cluster nodes. it's the group chat of your firewall cluster, basically.

there are 3 main synchronization modes or protocols: NOTRACK, ALARM and FTFW.

there are 3 transport protocols as well: TCP, Multicast and UDP.

you have to choose one synchronization mode and one transport protocol. pick your fighter, bestie, you can't have both.

also, there are some general options in this section.

---

🔥 Mode FTFW 🔥

this mode is based on a reliable protocol that performs message tracking. so the protocol can actually recover from message loss, re-ordering and corruption. it's the responsible one. the one with a planner. 🗂️

in this synchronization mode you may configure ResendQueueSize, CommitTimeout, PurgeTimeout, ACKWindowSize, DisableExternalCache and StartupResync.

💖 ResendQueueSize value 💖

size of the resend queue (in objects). this is the max number of objects that can be stored waiting to be confirmed via acknowledgment. if you keep this value low, the daemon has less chances to recover state-changes under message omission 😭. on the other hand, if you keep this value high, the daemon consumes more memory to store dead objects. it's giving hoarder behaviour ngl.

Example: ResendQueueSize 131072

default is 131072 objects.

💖 CommitTimeout seconds 💖

this parameter lets you set an initial fixed timeout for the committed entries when this node goes from backup to primary. this mechanism provides a way to purge entries that were not recovered appropriately after the specified fixed timeout. if you set a low value, TCP entries in Established states with no traffic may hang. for example, an SSH connection without KeepAlive enabled. not the vibe. 🙈

Example: CommitTimeout 180

by default, this option is not set (the daemon uses an approximate timeout value calculation mechanism).

💖 PurgeTimeout seconds 💖

if the firewall replica goes from primary to backup, the conntrackd -t command is invoked in the script. this command schedules a flush of the table in N seconds.

this is useful to purge the connection tracking table of zombie entries 🧟 and avoid clashes with old entries if you trigger several consecutive hand-overs.

default is 60 seconds.

💖 ACKWindowSize value 💖

set the acknowledgment window size. if you decrease this value, the number of acknowledgments increases. more acknowledgments means more overhead because conntrackd(8) has to handle more control messages. on the other hand, if you increase this value, the resend queue gets more populated. this results in more overhead in the queue releasing. it's a whole tradeoff arc, honestly.

Example: ACKWindowSize 300

if not set, default window size is 300 (value is based on some practical experiments measuring the cycles spent by the acknowledgment handling with oprofile). science slay 🔬

💖 DisableExternalCache yes|no 💖

this clause allows you to disable the external cache. thus, the state entries are directly injected into the kernel conntrack table. as a result, you save memory in user-space but you consume slots in the kernel conntrack table for backup state entries. moreover, disabling the external cache means more CPU consumption. you need a Linux kernel >= 2.6.29 to use this feature.

if you are installing conntrackd(8) for first time, please read the user manual and i encourage you to consider using the fail-over scripts instead of enabling this option! 🫶

by default this is set to no, meaning the external cache is enabled.

⚠️ bestie listen — if it's your first time, read the manual and think about the fail-over scripts instead of flipping this on. fr fr.

💖 StartupResync yes|no 💖

order conntrackd to request a complete conntrack table resync against the other node at startup. a single request will be made.

this is useful to get in sync with another node which has been running while we were down. it's giving "sorry i was offline, catch me up" ✨

Example: StartupResync yes

by default, this clause is set to no.

---

🌈 Mode ALARM 🌈

this mode is spamming. it is based on an alarm-based protocol that periodically re-sends the flow state to the backup firewall replicas. this protocol consumes a LOT of bandwidth but it resolves synchronization problems fast. it's the friend that texts you 47 times but honestly? it works. 💀

in this synchronization mode you may configure RefreshTime, CacheTimeout, CommitTimeout and PurgeTimeout.

🎀 RefreshTime seconds 🎀

if a conntrack entry is not modified in <= N seconds, then a message is broadcasted. for example, this mechanism may be used to resynchronize nodes that just joined the multicast group.

Example: RefreshTime 15

🎀 CacheTimeout seconds 🎀

if we don't receive a notification about the state of an entry in the external cache after N seconds, then remove it. bye bestie 👋

Example: CacheTimeout 180

🎀 CommitTimeout seconds 🎀

same as in FTFW mode.

🎀 PurgeTimeout seconds 🎀

same as in FTFW mode.

---

🦋 Mode NOTRACK 🦋

is the most simple mode as it is based on a best effort replication protocol, ie. unreliable protocol. this protocol sends and receives the state information without performing any specific checking. it's the "i'll get there when i get there" mode. no thoughts, head empty 🫧

in this synchronization mode you may configure DisableInternalCache, DisableExternalCache, CommitTimeout, PurgeTimeout and StartupResync.

🌸 DisableInternalCache yes|no 🌸

this clause allows you to disable the internal cache. thus, the synchronization messages are directly sent through the dedicated link.

this option is set to no by default.

🌸 DisableExternalCache yes|no 🌸

same as in FTFW mode.

🌸 CommitTimeout seconds 🌸

same as in FTFW mode.

🌸 PurgeTimeout seconds 🌸

same as in FTFW mode.

🌸 StartupResync yes|no 🌸

same as in FTFW mode.

---

👑 MULTICAST 👑

this section indicates to conntrackd(8) to use multicast as transport mechanism between nodes of the firewall cluster.

please note you can specify more than one dedicated link. thus, if one dedicated link fails, the daemon can fail-over to another. note that adding more than one dedicated link does not mean that state-updates will be sent to all of them. there is only one active dedicated link at a given moment. monogamy but make it networking 💅

the Default keyword indicates that this interface will be selected as the initial dedicated link. you can have up to 4 redundant dedicated links.

Note: use different multicast groups for every redundant link. don't be lazy, bestie.

Example:

Multicast Default {
     IPv4_address 225.0.0.51
     Group 3781
     IPv4_interface 192.168.100.101
     Interface eth3
     SndSocketBuffer 1249280
     RcvSocketBuffer 1249280
     Checksum on
}
Multicast {
     IPv4_address 225.0.0.51
     Group 3782
     IPv4_interface 192.168.100.102
     Interface eth4
     SndSocketBuffer 1249280
     RcvSocketBuffer 1249280
     Checksum on
}

⭐ IPv4_address address ⭐

multicast address: the address that you use as destination in the synchronization messages. you do not have to add this IP to any of your existing interfaces.

Example: IPv4_address 255.0.0.50

⭐ Group number ⭐

the multicast group that identifies the cluster.

Example: Group 3780

if any doubt, do not modify this value. seriously, hands off 🔥

⭐ IPv4_interface address ⭐

IP address of the interface that you are going to use to send the synchronization messages. remember that you must use a dedicated link for the synchronization messages.

Example: IPv4_interface 192.168.100.100

⭐ Interface name ⭐

the name of the interface that you are going to use to send the synchronization messages.

Example: Interface eth2

⭐ SndSocketBuffer number ⭐

this transport protocol sender uses a buffer to enqueue the packets that are going to be transmitted. the default size of this socket buffer is available at /proc/sys/net/core/wmem_default.

this value determines the chances to have an overrun in the sender queue. the overrun results in packet loss, thus, losing state information that would have to be retransmitted 😭. if you notice some packet loss, you may want to increase the size of the buffer. the system default size is usually around ~100 KBytes which is fairly small for busy firewalls. not it.

Note: the NOTRACK protocol is best effort, it is really recommended to increase the buffer size.

Example: SndSocketBuffer 1249280

⭐ RcvSocketBuffer number ⭐

this transport protocol receiver uses a buffer to enqueue the packets that the socket is pending to handle. the default size of this socket buffer is available at /proc/sys/net/core/rmem_default.

this value determines the chances to have an overrun in the receiver queue. the overrun results in packet loss, thus, losing state information that would have to be retransmitted 😭. if you notice some packet loss, you may want to increase the size of the buffer. the system default size is usually around ~100 KBytes which is fairly small for busy firewalls.

Note: the NOTRACK protocol is best effort, it is really recommended to increase the buffer size.

Example: RcvSocketBuffer 1249280

⭐ Checksum yes|no ⭐

enable/disable message checksumming. this is a good property to achieve fault-tolerance. in case of doubt, use it. iconic behaviour honestly ✨

---

💜 UDP 💜

this section indicates to conntrackd(8) to use UDP as transport mechanism between nodes of the firewall cluster.

---

more coming bestie, this page is long — stay tuned 💖

As in the Multicast setup, you can totally stack several fail-over dedicated links using the Default keyword. Redundancy queen behavior honestly 💅

Example:

     UDP {
          IPv4_address 172.16.0.1
          IPv4_Destination_Address 172.16.0.2
          Port 3781
          Interface eth3
          SndSocketBuffer 1249280
          RcvSocketBuffer 1249280
          Checksum on
     }

• IPv4_address <address> — the UDP IPv4 address this firewall sits on to listen for events. It's giving "this is where I receive my gossip" ✨

Example: IPv4_address 192.168.2.100

• IPv6_address <address> — same vibe, but IPv6. The UDP IPv6 address this firewall listens on for events. 🦋

Example: IPv6_address fe80::215:58ff:fe28:5a27

• IPv4_Destination_Address <address> — the destination IPv4 UDP address where events get sent, aka the other firewall's dedicated link address. You're literally sliding into their DMs, but make it UDP 📨

Example: IPv4_Destination_Address 192.168.2.101

• IPv6_Destionation_Address <address> — the destination IPv6 UDP address that receives events, i.e. the other firewall's dedicated link address. (Yes bestie, that spelling is exactly what's in the config — don't come for me 😭)

Example: IPv6_Destination_Address fe80::2d0:59ff:fe2a:775c

• Port <number> — the UDP port in use. Pick your lane, pick your number.

Example: Port 3780

• Interface <name> — literally the same as in the Multicast transport protocol configuration. No notes, same rules apply. 👑
• SndSocketBuffer <number> — same as in the Multicast transport protocol configuration. Copy-paste energy, but correct.
• RcvSocketBuffer <number> — same as in the Multicast transport protocol configuration. Twin of the one above, fr fr.
• Checksum <yes|no> — same as in the Multicast transport protocol configuration. Simple as that. ✅

---

🌈 TCP 🌈

You can also use Unicast TCP to propagate events. Options! Variety! Main character energy 🎀

And here's the slay: if you combine this transport with NOTRACK mode, it becomes reliable. Highkey iconic behavior.

The TCP transport protocol can be configured in exactly the same way as the UDP transport protocol. Same keys, same shapes, no new lore.

And just like in the Multicast configuration, you may specify several fail-over dedicated links using the Default keyword. 💫

Example:

     TCP {
          IPv6_address fe80::215:58ff:fe28:5a27
          IPv6_Destination_Address fe80::215:58ff:fe28:5a27
          Port 3781
          Interface eth2
          SndSocketBuffer 1249280
          RcvSocketBuffer 1249280
          Checksum yes
     }

---

✨ OPTIONS ✨

Other unsorted options that are related to the synchronization protocol or transport mechanism. The miscellaneous drawer of this config file, and honestly? We love a grab bag. 🧚

• TCPWindowTracking <yes|no> — TCP state-entries have window tracking disabled by default, and this option is how you turn it on. Like I said: default is off. Heads up though, this feature requires a Linux kernel >= 2.6.36. 👑
• ExpectationSync <on|{ list }> — set this option on if you want to enable the synchronization of expectations. You have to specify the list of helpers you want to enable, no shortcuts bestie.

This feature requires a Linux kernel >= 3.5. 🫶

Example, sync all expectations:

       ExpectationSync on

Example, sync given expectations:

       ExpectationSync {
            ftp
            ras
            q.931
            h.245
            sip
       }

By default, this option is disabled. 🙈

✨ GENERAL ✨

This top-level section is where all the generic config directives for the conntrackd(8) daemon live. Basically the everyday settings, bestie. 💅

---

• Systemd <yes|no> — Turn on systemd(1) runtime support, but only if conntrackd(8) was compiled with the right configuration. Once it's on, you can use a service unit of Type=notify. 🎀

Obviously this requires your system's init to be systemd(1).

Note: systemd(1) watchdog is supported too. 👑

Example: Systemd yes

By default, runtime support is enabled if conntrackd was built with the systemd feature. Otherwise it's off.

• Nice <value> — Deprecated. Conntrackd ignores this option and it's gonna get removed in the future. Just so you know, you can run nice(1) and renice(1) externally instead. Also FYI, conntrackd(8) now uses a RT scheduler by default. 💀
• HashSize <value> — How many buckets live in the cache hashtable. The bigger it is, the closer it gets to O(1), at the cost of eating more memory. Go read some docs about tuning hashtables for further reference. 📚

Example: HashSize 32768

• HashLimit <value> — Max number of conntracks. It should be double of /proc/sys/net/netfilter/nf_conntrack_max, because the daemon may keep some dead entries cached for possible retransmission during state synchronization.

Example: HashLimit 131072

• LogFile <yes|no|filename> — Lets conntrackd(8) log to a file. ✍️

Example: LogFile no

Default is no. Default logfile is /var/log/conntrackd.log.

• Syslog <yes|no|facility> — Enable connection logging via Syslog. If you set the facility, use the same one as in the Stats section, otherwise you'll get a warning message. 🙈

Example: Syslog local0

Default is off.

• Lockfile <filename> — The lockfile that conntrackd(8) uses (absolute path, no shortcuts).

Example: LockFile /var/lock/conntrack.lock

Default is /var/lock/conntrack.lock.

• NetlinkBufferSize <value> — Netlink event socket buffer size. If you don't specify this clause, the default buffer size value in /proc/sys/net/core/rmem_default gets used. That default is usually around 100 Kbytes, which is fairly small for busy firewalls. And that leads to event message dropping and high CPU consumption. 😭

Example: NetlinkBufferSize 2097152

• NetlinkBufferSizeMaxGrowth <value> — The daemon doubles the size of the netlink event socket buffer size if it detects netlink event message dropping. This clause sets the maximum buffer size growth that can be reached.

Example: NetlinkBufferSizeMaxGrowth 8388608

• NetlinkOverrunResync <yes|no|value> — If the daemon detects that Netlink is dropping state-change events, it automatically schedules a resynchronization against the Kernel after 30 seconds (the default value). Heads up: resynchronizations are expensive in terms of CPU consumption, because the daemon has to grab the full kernel state-table and purge state-entries that don't exist anymore.

Note: be careful of setting a very small value here. 🚨

Example: NetlinkOverrunResync yes

The default value is 30 seconds. If not specified, the daemon assumes this option is enabled and uses the default value.

• NetlinkEventsReliable <yes|no> — If you want reliable event reporting over Netlink, set this on. And if you set this clause on, it's a good idea to set off NetlinkOverrunResync.

You need Linux Kernel >= 2.6.31 for this option to work.

Example: NetlinkEventsReliable yes

This option is off by default.

• PollSecs <seconds> — By default, the daemon receives state updates following an event-driven model. You can switch up this behaviour by switching to polling mode with this clause. 🦋

This clause tells conntrackd(8) to dump the states in the kernel every N seconds. As for synchronization mode, polling mode can only guarantee that long-lifetime states are recovered. The main advantage of this method is the reduction in state replication, at the cost of reducing the chances of recovering connections.

Example: PollSecs 15

• EventIterationLimit <value> — The daemon prioritizes handling state-change events coming from the core. With this clause, you can set the max number of state-change events (those coming from kernel-space) that the daemon will handle, after which it'll handle other events coming from the network or userspace.

A low value improves interactivity (in terms of real-time behaviour) at the cost of extra CPU consumption.

Example: EventIterationLimit 100

Default (if not set) is 100.

🧚 UNIX 🧚

Unix socket configuration. This socket is what conntrackd(8) uses to listen to external commands like conntrackd -k or conntrackd -n. 👑

Example:

UNIX {
     Path /var/run/conntrackd.ctl
}

• Path <filename> — Absolute path to the Unix socket.

Example: Path /var/run/conntrackd.ctl

• Backlog <value> — Deprecated option. 💀

🌈 FILTER 🌈

Event filtering. This clause lets you filter certain traffic.

There are currently three filter-sets: Protocol, Address and State. The filter is attached to an action that can be: Accept or Ignore. So you can define the event filtering policy of the filter-sets in positive or negative logic, depending on your needs. 🎀

You can also select whether conntrackd(8) filters the event messages from userspace or kernel-space. Kernel-space event filtering saves some CPU cycles by avoiding the copy of the event message from kernel-space to user-space. Kernel-space event filtering is preferred — but you need a Linux kernel >= 2.6.29 to filter from kernel-space.

The syntax for this section is: Filter From <from> { }.

If you want to select kernel-space event filtering, use the keyword Kernelspace instead of Userspace.

Example:

Filter From Userspace {
     Protocol Accept {
          TCP
          SCTP
          DCCP
     }
     Address Ignore {
          IPv4_address 127.0.0.1
          IPv6_address ::1
     }
     State Accept {
          ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP
     }
}

• Protocol <policy> { <protocols list> } — Accept only certain protocols: you may want to replicate the state of flows depending on their layer 4 protocol.

Policy is one of Accept or Ignore.

Protocols are: TCP, SCTP, DCCP, UDP, ICMP and IPv6-ICMP.

The ICMP and IPv6-ICMP protocols require a Linux kernel >= 2.6.31.

Example:

Protocol Accept {
     TCP
     SCTP
     DCCP
}

• Address <policy> { <addresses list> } — Ignore traffic for a certain set of IPs: usually all the IPs assigned to the firewall, since local traffic must be ignored — only forwarded connections are worth replicating. 🫶

Note that these values depend on the local IPs that are assigned to the firewall.

You may specify several IPv4_address and/or IPv6_address directives. You can also specify networks in CIDR format.

Policy is one of Accept or Ignore.

Example:

Address Ignore {
     IPv4_address 127.0.0.1 # loopback
     IPv4_address 192.168.0.100 # virtual IP 1
     IPv4_address 192.168.1.100 # virtual IP 2
     IPv4_address 192.168.100.100 # dedicated link ip
     IPv4_address 192.168.0.0/24
     IPv6_address ::1
}

• State <policy> { <states list> for TCP } — Filter by flow state. This option introduces a trade-off in the replication: it reduces CPU consumption, at the cost of having lazy backup firewall replicas. 😴

Note: only affects TCP flows.

The existing TCP states are: SYN_SENT, SYN_RECV, ESTABLISHED, FIN_WAIT, CLOSE_WAIT, LAST_ACK, TIME_WAIT, CLOSED and LISTEN.

Policy is one of Accept or Ignore.

Example:

State Accept {
     ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP
}

👑 SCHEDULER 👑

Pick a different scheduler for the daemon — you can select between RR and FIFO, plus the process priority.

Using a RT scheduler reduces the chances of overrunning the Netlink buffer, and conntrackd(8) uses RR by default unless FIFO is selected. See sched_setscheduler(2) for more info. 💅

Example:

Scheduler {
     Type FIFO
     Priority 99
}

• Type <type> — Supported values are RR or FIFO.

Default: RR

• Priority <value> — Value of the scheduler priority. Minimum is 0, maximum is 99.

Default: 99 (as returned by sched_get_priority_max(2) for SCHED_RR)

---

⭐ STATS ⭐

This top-level section tells conntrackd(8) to work as a statistic collector for the nf_conntrack linux kernel subsystem. 📊

• LogFile <yes|no|filename> — If you enable this option, the daemon writes the information about destroyed connections to a logfile.

Default is no. Default filename is /var/log/conntrackd-stats.log.

• NetlinkEventsReliable <yes|no> — If you want reliable event reporting over Netlink, set this on. And if you set this clause on, it's a good idea to set off NetlinkOverrunResync. This requires Linux kernel >= 2.6.31.

Default is no.

• Syslog <yes|no|facility> — Enable connection logging via Syslog. If you set the facility, use the same one as in the General section, otherwise you'll get a warning message. 🙈

Example: Syslog local0

Default is no.

💫 HELPER 💫

Heads up bestie: this config is very advanced and has nothing to do with synchronization or stats collection. Different lane entirely. 🛣️

This top-level section tells conntrackd(8) to inject user-space helpers into the nf_conntrack linux kernel subsystem. What happens then? The nf_conntrack engine starts sending connections to userspace for further processing. It's giving kernel and userspace holding hands. 🫶

But before any of that, you have to make sure you've registered the given user-space helper stub. No stub, no vibes. 💅

Example:

% nfct add helper ftp inet tcp

Every user-space helper should be registered using a Type section, and they're named this way:

Type <name> <af> <transport>

Examples:

Helper {
     Type ftp inet tcp {
          QueueNum 0
          QueueLen 10240
          Policy ftp {
               ExpectMax 1
               ExpectTimeout 300
          }
     }
     Type rpc inet tcp {
          QueueNum 1
          QueueLen 10240
          Policy rpc {
               ExpectMax 1
               ExpectTimeout 300
          }
     }
     Type rpc inet udp {
          QueueNum 2
          QueueLen 10240
          Policy rpc {
               ExpectMax 1
               ExpectTimeout 300
          }
     }
     Type tns inet tcp {
          QueueNum 3
          QueueLen 10240
          Policy tns {
               ExpectMax 1
               ExpectTimeout 300
          }
     }
     Type dhcpv6 inet6 udp {
          QueueNum 4
          QueueLen 10240
          Policy dhcpv6 {
               ExpectMax 1
               ExpectTimeout 300
          }
     }
     Type ssdp inet udp {
          QueueNum 5
          QueueLen 10240
          Policy ssdp {
               ExpectMax 1
               ExpectTimeout 300
          }
     }
}

Now the parameters that live inside the Type section, one by one: 👇

• QueueNum <number> — sets the NFQUEUE number you wanna use to receive traffic from the kernel. Pick your queue, bestie. Example: QueueNum 0
• QueueLen <number> — the maximum number of packets just chilling in the queue, waiting for a verdict from user-space. 🕐 If you hit this error message, bump that value up:

"nf_queue: full at X entries, dropping packet(s)"

Default is 1024. Example: QueueLen 10240

• Policy <name> { } — sets the expectation policy for the given helper. This sub-section contains 2 directives: ExpectMax <number> (maximum number of simultaneous expectations) and ExpecTimeout <seconds> (maximum living time for one expectation).

---

🌈 COMPLETE EXAMPLES 🌈

Below you'll find some real-life working examples. Actual configs, actually functioning. Chef's kiss. 😘

✨ STATS EXAMPLE ✨

This config example tells conntrackd(8) to work as a stats collector. Just vibes and numbers. 📊

Stats {
     LogFile yes
     NetlinkEventsReliable no
     Syslog yes
}
General {
     Systemd yes
     HashSize 8192
     HashLimit 65535
     Syslog yes
     LockFile /var/lock/conntrack.lock
     UNIX {
          Path /var/run/conntrackd.ctl
     }
     NetlinkBufferSize 262142
     NetlinkBufferSizeMaxGrowth 655355
     Filter {
          Protocol Accept {
               TCP
               UDP
          }
          Address Ignore {
               IPv4_address 127.0.0.1
               IPv6_address ::1
          }
     }
}

🦋 SYNC EXAMPLE 1 🦋

This example configures synchronization in FTFW mode with Multicast transport. It includes common general configuration as well, because why not. 💁

Note: this is one of the recommended setups for conntrackd(8) in a firewall cluster environment. iykyk. 🔥

Sync {
     Mode FTFW {
          ResendQueueSize 131072
          PurgeTimeout 60
          ACKWindowSize 300
          DisableExternalCache no
     }
     Multicast {
          IPv4_address 225.0.0.50
          Group 3780
          IPv4_interface 192.168.100.100
          Interface eth2
          SndSocketBuffer 1249280
          RcvSocketBuffer 1249280
          Checksum yes
     }
     Multicast Default {
          IPv4_address 225.0.0.51
          Group 3781
          IPv4_interface 192.168.100.101
          Interface eth3
          SndSocketBuffer 1249280
          RcvSocketBuffer 1249280
          Checksum yes
     }
     Options {
          TCPWindowTracking no
          ExpectationSync yes
     }
}
General {
     Systemd yes
     HashSize 32768
     HashLimit 131072
     LogFile yes
     Syslog no
     LockFile /var/lock/conntrack.lock
     UNIX {
          Path /var/run/conntrackd.ctl
     }
     NetlinkBufferSize 2097152
     NetlinkBufferSizeMaxGrowth 8388608
     NetlinkOverrunResync yes
     NetlinkEventsReliable no
     EventIterationLimit 100
     Filter From Userspace {
          Protocol Accept {
               TCP
               SCTP
               DCCP
          }
          Address Ignore {
               IPv4_address 127.0.0.1
               IPv4_address 192.168.100.0/24
               IPv6_address ::1
          }
     }
}

🎀 SYNC EXAMPLE 2 🎀

This example configures synchronization in NOTRACK mode with TCP transport. And yes, it includes common general configuration too. Consistency is the moment. 💅

Sync {
     Mode NOTRACK {
          DisableInternalCache yes
          DisableExternalCache yes
     }
     TCP {
          IPv4_address 192.168.2.100
          IPv4_Destination_Address 192.168.2.101
          Port 3780
          Interface eth2
          SndSocketBuffer 1249280
          RcvSocketBuffer 1249280
          Checksum yes
     }
     Options {
          TCPWindowTracking no
          ExpectationSync yes
     }
}
General {
     Systemd yes
     HashSize 32768
     HashLimit 131072
     LogFile yes
     Syslog no
     LockFile /var/lock/conntrack.lock
     UNIX {
          Path /var/run/conntrackd.ctl
     }
     NetlinkBufferSize 2097152
     NetlinkBufferSizeMaxGrowth 8388608
     NetlinkOverrunResync yes
     NetlinkEventsReliable no
     EventIterationLimit 100
     Filter From Userspace {
          Protocol Accept {
               TCP
               SCTP
               DCCP
          }
          Address Ignore {
               IPv4_address 127.0.0.1
               IPv4_address 192.168.0.0/16
               IPv6_address ::1
          }
          State Accept {
               ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP
          }
     }
}

---

🌟 SEE ALSO 🌟

• conntrackd(8)
• conntrack(8)
• nfct(8)
• http://conntrack-tools.netfilter.org/manual.html

Go read those too, bestie, they're the whole friend group. 📚💖

---

👑 AUTHOR 👑

Pablo Neira Ayuso wrote and maintains the conntrackd tool. Iconic behavior, honestly. 🫡

This manual page was written by Arturo Borrero Gonzalez <arturo@debian.org> based on the conntrackd tarball config examples. Slay. ✨

Please send bug reports to <netfilter-devel@lists.netfilter.org>. Subscription is required — yes, for real, you gotta subscribe. No lurking. 👀

This documentation is free/libre under the terms of the GPLv2+. 🦋

---

And that's a wrap on the whole page, babe! 💖 This one shipped as CONNTRACKD.CONF(5), dated Jan 20, 2021 — so go forth, configure your conntrackd, and absolutely ate. 💅✨