Conntrack - Connection Tracking

Overview

Connection Tracking (conntrack) is a Linux kernel subsystem that tracks the state of network connections passing through VyOS. This functionality is the foundation for:

Stateful firewalls - packet filtering based on connection state
NAT (Network Address Translation) - network address translation
Load balancing - distributing load across servers
QoS - quality of service management

Conntrack is activated automatically when stateful firewall rules or NAT are configured, and it keeps a record of all active connections in a dedicated state table.

Key Capabilities

Tracking of TCP, UDP, ICMP and other protocols
Support for Application Layer Gateways (ALG) for complex protocols
Flexible timeout configuration for various connection states
Ability to bypass tracking for specific traffic
Detailed logging of connection events
Fine-grained performance tuning through hash-table parameters

When Conntrack Tuning Is Needed

High-load NAT gateways - the connection table size must be increased
VoIP gateways - SIP ALG and UDP timeouts must be configured
FTP servers - the FTP helper module must be enabled
Memory optimization - lowering timeouts to free up resources
Troubleshooting - enabling logging for diagnostics
Bypass conntrack - excluding specific traffic from tracking

Conntrack Architecture

Connection Table

Conntrack stores information about each tracked connection in a table, including:

Source IP/Port - source address and port
Destination IP/Port - destination address and port
Protocol - protocol (TCP, UDP, ICMP, etc.)
State - the current connection state
Timeout - time until the entry is removed
Mark - a mark used for routing and QoS
Helper - the associated helper module (for FTP, SIP, etc.)

TCP Connection States

Conntrack tracks the following TCP states:

SYN_SENT - SYN sent, waiting for SYN-ACK
SYN_RECV - SYN received, SYN-ACK sent
ESTABLISHED - connection established
FIN_WAIT - FIN initiated, waiting for close
CLOSE_WAIT - FIN received, waiting for close from the application
LAST_ACK - final ACK sent
TIME_WAIT - connection closed, waiting for possible retransmissions
CLOSE - connection fully closed

UDP and Other Protocol States

For connectionless protocols:

NEW - the first packet of a connection
ESTABLISHED - a reply packet has been received
UNREPLIED - no reply received within the timeout

Configuring the Connection Table Size

Determining the Required Size

The conntrack table size must account for the maximum number of concurrent connections. Estimation formula:

Table Size = (Expected Connections × 1.5) + Safety Margin

Factors that affect the size:

Number of users - the average number of clients
Traffic type - HTTP/HTTPS (short connections) vs SSH/VPN (long-lived)
NAT - each NAT connection consumes an entry
Timeouts - longer timeouts mean more entries

Table Size Configuration

# Set the connection table size (default: 262144)
set system conntrack table-size '524288'

# Set the expectation table size (default: 2048)
# Used by helper modules (FTP, SIP, etc.)
set system conntrack expect-table-size '4096'

# Set the hash-table size (default: 32768)
# Affects lookup speed in the table
set system conntrack hash-size '65536'

Sizing Recommendations

Scenario	Table Size	Hash Size	Expect Table
Small office (up to 50 users)	65536	16384	1024
Medium office (50-200 users)	262144	32768	2048
Large office (200-1000 users)	524288	65536	4096
Data center / ISP	2097152+	262144+	8192+

Calculating Required Memory

Each conntrack entry consumes approximately 350 bytes of memory:

Memory (MB) = (Table Size × 350) / 1048576

Examples:
- 262144 entries = ~87 MB
- 524288 entries = ~175 MB
- 1048576 entries = ~350 MB
- 2097152 entries = ~700 MB

Make sure the router has enough RAM for the chosen table size.

Configuring Timeouts

TCP Timeouts

Conntrack supports separate timeouts for each TCP connection state:

# Global TCP settings
set system conntrack tcp half-open-connections '512'    # Max. half-open connections
set system conntrack tcp loose 'enable'                  # Track mid-stream connections
set system conntrack tcp max-retrans '3'                 # Max. retransmission attempts

# Timeouts for the various TCP states (in seconds)
set system conntrack timeout tcp close '10'              # STATE: CLOSE
set system conntrack timeout tcp close-wait '60'         # STATE: CLOSE_WAIT
set system conntrack timeout tcp established '432000'    # STATE: ESTABLISHED (5 days)
set system conntrack timeout tcp fin-wait '120'          # STATE: FIN_WAIT
set system conntrack timeout tcp last-ack '30'           # STATE: LAST_ACK
set system conntrack timeout tcp syn-recv '60'           # STATE: SYN_RECV
set system conntrack timeout tcp syn-sent '120'          # STATE: SYN_SENT
set system conntrack timeout tcp time-wait '120'         # STATE: TIME_WAIT

UDP Timeouts

# UDP timeouts (in seconds)
set system conntrack timeout udp stream '180'     # Bidirectional UDP (reply received)
set system conntrack timeout udp other '30'       # Unidirectional UDP (no reply)

ICMP Timeouts

# ICMP timeout (in seconds)
set system conntrack timeout icmp '30'

Generic Timeouts

# Timeouts for other protocols (in seconds)
set system conntrack timeout other '600'      # Other protocols

Timeout Optimization for Various Scenarios

Scenario 1: High-load HTTP/HTTPS proxy

# Lower the timeouts for faster entry release
set system conntrack timeout tcp close '5'
set system conntrack timeout tcp close-wait '30'
set system conntrack timeout tcp established '7200'    # 2 hours instead of 5 days
set system conntrack timeout tcp fin-wait '60'
set system conntrack timeout tcp last-ack '15'
set system conntrack timeout tcp time-wait '60'

Scenario 2: VPN/SSH server with long-lived connections

# Increase timeouts for stable connections
set system conntrack timeout tcp established '864000'  # 10 days
set system conntrack timeout tcp fin-wait '180'
set system conntrack timeout tcp time-wait '180'

Scenario 3: VoIP/SIP server

# Optimization for UDP traffic
set system conntrack timeout udp stream '300'    # 5 minutes for active RTP streams
set system conntrack timeout udp other '60'      # 1 minute for SIP signaling

Helper Modules (ALG)

Helper modules (Application Layer Gateways) ensure correct operation of complex protocols that:

Open dynamic ports
Embed IP addresses in the payload
Require special NAT handling

Available Helper Modules

By default, all helper modules are enabled. You can disable the ones you do not need to improve security and performance.

FTP Helper

# Disable the FTP helper (default: enabled)
set system conntrack modules ftp disable

# The FTP helper handles:
# - The PORT command for active FTP
# - The PASV command for passive FTP
# - Dynamic data connections on ports >1024

When to disable: If FTP is not used, disable it for security.

H.323 Helper

# Disable the H.323 helper
set system conntrack modules h323 disable

# H.323 is used for:
# - VoIP (an alternative to SIP)
# - Video conferencing
# - Dynamic RTP/RTCP streams

When to disable: If no H.323 VoIP equipment is used.

NFS Helper

# Disable the NFS helper
set system conntrack modules nfs disable

# The NFS helper supports:
# - Network File System v3
# - Dynamic RPC ports

When to disable: If NFS is not used on the network.

PPTP Helper

# Disable the PPTP helper
set system conntrack modules pptp disable

# The PPTP helper handles:
# - GRE tunnels for PPTP VPN
# - Control connections on port 1723

When to disable: If PPTP VPN is not used (IPsec/WireGuard is recommended instead).

SIP Helper

# Disable the SIP helper
set system conntrack modules sip disable

# The SIP helper handles:
# - SDP (Session Description Protocol) inside SIP messages
# - Dynamic RTP/RTCP ports for audio/video
# - NAT traversal for SIP

When to disable: If VoIP is not used. IMPORTANT: For SIP to work correctly through NAT, the helper must be enabled.

SQLNet Helper

# Disable the SQLNet helper
set system conntrack modules sqlnet disable

# SQLNet is used for:
# - Oracle Database connections
# - Dynamic Oracle ports

When to disable: If Oracle Database is not used.

TFTP Helper

# Disable the TFTP helper
set system conntrack modules tftp disable

# The TFTP helper handles:
# - Trivial File Transfer Protocol
# - Dynamic UDP ports for data transfer

When to disable: If TFTP is not used (for example, for loading IP phone configurations).

Security Recommendations

Disable unused helper modules:

# Minimal configuration for a typical office
set system conntrack modules ftp disable     # If FTP is not used
set system conntrack modules h323 disable    # If only SIP is used
set system conntrack modules nfs disable     # Usually not required
set system conntrack modules pptp disable    # Use modern VPNs
set system conntrack modules sqlnet disable  # If there is no Oracle DB
set system conntrack modules tftp disable    # If not used

# Keep only SIP enabled (if VoIP is used)
# The SIP helper is enabled by default

Ignore Rules

Ignore rules let you exclude specific traffic from the conntrack table. This is useful for:

High-performance servers - excluding internal traffic
Reducing load - bypassing conntrack for trusted traffic
Specific protocols - traffic that does not require state tracking

Ignore Rules Syntax

set system conntrack ignore rule <number>

Filtering Criteria

Filtering by Destination Address

# Ignore traffic to a specific IP
set system conntrack ignore rule 10 destination address '192.168.100.10'

# Ignore traffic to a subnet
set system conntrack ignore rule 20 destination address '10.0.0.0/8'

Filtering by Destination Port

# Ignore traffic to port 80
set system conntrack ignore rule 30 destination port '80'

# Ignore a range of ports
set system conntrack ignore rule 40 destination port '8000-8999'

Filtering by Source Address

# Ignore traffic from a specific IP
set system conntrack ignore rule 50 source address '192.168.1.100'

# Ignore traffic from a subnet
set system conntrack ignore rule 60 source address '172.16.0.0/12'

Filtering by Source Port

# Ignore traffic from a specific port
set system conntrack ignore rule 70 source port '53'

Filtering by Protocol

# Ignore all ICMP traffic
set system conntrack ignore rule 80 protocol 'icmp'

# Ignore all UDP traffic
set system conntrack ignore rule 90 protocol 'udp'

# Supported protocols: tcp, udp, icmp, all

Filtering by Inbound Interface

# Ignore traffic from interface eth2
set system conntrack ignore rule 100 inbound-interface 'eth2'

Filtering by TCP Flags

# Ignore TCP packets with the SYN flag set
set system conntrack ignore rule 110 protocol 'tcp'
set system conntrack ignore rule 110 tcp flags syn

Practical Examples

Example 1: Ignoring internal DNS traffic

# DNS queries between servers do not require conntrack
set system conntrack ignore rule 10 description 'Bypass internal DNS'
set system conntrack ignore rule 10 destination address '192.168.1.53'
set system conntrack ignore rule 10 destination port '53'
set system conntrack ignore rule 10 protocol 'udp'

Example 2: Ignoring monitoring health checks

# Exclude health checks from the load balancer
set system conntrack ignore rule 20 description 'Bypass load balancer health checks'
set system conntrack ignore rule 20 source address '10.0.1.10'
set system conntrack ignore rule 20 destination port '80,443'
set system conntrack ignore rule 20 protocol 'tcp'

Example 3: Ignoring traffic between trusted servers

# Bypass conntrack for traffic between backend servers
set system conntrack ignore rule 30 description 'Bypass trusted backend network'
set system conntrack ignore rule 30 source address '10.10.0.0/24'
set system conntrack ignore rule 30 destination address '10.10.0.0/24'

Example 4: Ignoring high-frequency syslog traffic

# Syslog traffic creates many short UDP connections
set system conntrack ignore rule 40 description 'Bypass syslog traffic'
set system conntrack ignore rule 40 destination port '514'
set system conntrack ignore rule 40 protocol 'udp'

Important Notes

Rule order - rules are applied in order of their numbers
Impact on NAT - ignored traffic cannot use NAT
Impact on the firewall - stateful firewall rules do not work for ignored traffic
Performance - use with care; bypassing conntrack can lead to security issues

Conntrack Logging

Conntrack can log connection events for debugging and auditing.

Event Types

# Log new connections
set system conntrack log event new

# Log connection updates
set system conntrack log event update

# Log connection teardown
set system conntrack log event destroy

Filtering by Protocol

# Log only TCP events
set system conntrack log event new protocol 'tcp'

# Log only UDP events
set system conntrack log event update protocol 'udp'

# Log only ICMP events
set system conntrack log event destroy protocol 'icmp'

# Log other protocols
set system conntrack log event new protocol 'other'

Configuring the Queue Size

# Set the log queue size (100-999999, default: 0)
# A larger queue prevents log loss under high load
set system conntrack log event new queue-size '10000'

Full Logging Configuration

# Detailed logging of TCP connections
set system conntrack log event new
set system conntrack log event new protocol 'tcp'
set system conntrack log event new queue-size '10000'

set system conntrack log event destroy
set system conntrack log event destroy protocol 'tcp'
set system conntrack log event destroy queue-size '10000'

# Save and apply
commit
save

Viewing Logs

# View conntrack logs in the system logs
show log conntrack

# Use journalctl to filter
journalctl -xe | grep conntrack

Logging Recommendations

Production - log only critical events (new for debugging)
Development - all events can be enabled for diagnostics
High-load - increase queue-size to prevent log loss
Disk space - logging generates a large volume of data; use rotation

Configuring Custom Timeouts

Custom timeouts let you set specific timeouts for particular subsets of traffic based on rules.

IPv4 Custom Timeouts

# Create a rule with a custom timeout
set system conntrack timeout custom ipv4 rule <number>

Filtering by Destination Address

# Apply timeouts for traffic to a specific address
set system conntrack timeout custom ipv4 rule 10 destination address '192.168.1.100'

Filtering by Destination Port

# Apply timeouts for traffic to a specific port
set system conntrack timeout custom ipv4 rule 20 destination port '80'

Filtering by Protocol

# Apply timeouts for a specific protocol
set system conntrack timeout custom ipv4 rule 30 protocol 'tcp'
set system conntrack timeout custom ipv4 rule 30 protocol tcp close-wait '30'
set system conntrack timeout custom ipv4 rule 30 protocol tcp established '3600'

Filtering by Source Address

# Apply timeouts for traffic from a specific address
set system conntrack timeout custom ipv4 rule 40 source address '10.0.0.0/8'

Filtering by Source Port

# Apply timeouts for traffic from a specific port
set system conntrack timeout custom ipv4 rule 50 source port '5060'

IPv6 Custom Timeouts

# Create a rule with a custom timeout for IPv6
set system conntrack timeout custom ipv6 rule <number>

# The syntax is the same as for IPv4
set system conntrack timeout custom ipv6 rule 10 destination address '2001:db8::1'
set system conntrack timeout custom ipv6 rule 10 protocol 'tcp'
set system conntrack timeout custom ipv6 rule 10 protocol tcp established '7200'

Practical Custom Timeout Examples

Example 1: Short timeouts for HTTP/HTTPS

# HTTP traffic usually consists of short connections
set system conntrack timeout custom ipv4 rule 10 description 'Short timeouts for HTTP/HTTPS'
set system conntrack timeout custom ipv4 rule 10 destination port '80,443'
set system conntrack timeout custom ipv4 rule 10 protocol 'tcp'
set system conntrack timeout custom ipv4 rule 10 protocol tcp close-wait '15'
set system conntrack timeout custom ipv4 rule 10 protocol tcp established '1800'
set system conntrack timeout custom ipv4 rule 10 protocol tcp time-wait '30'

Example 2: Long timeouts for SSH

# SSH connections can be long-lived and idle
set system conntrack timeout custom ipv4 rule 20 description 'Long timeouts for SSH'
set system conntrack timeout custom ipv4 rule 20 destination port '22'
set system conntrack timeout custom ipv4 rule 20 protocol 'tcp'
set system conntrack timeout custom ipv4 rule 20 protocol tcp established '86400'  # 24 hours

Example 3: Optimization for SIP/RTP

# SIP signaling (UDP)
set system conntrack timeout custom ipv4 rule 30 description 'SIP signaling'
set system conntrack timeout custom ipv4 rule 30 destination port '5060'
set system conntrack timeout custom ipv4 rule 30 protocol 'udp'
set system conntrack timeout custom ipv4 rule 30 protocol udp stream '180'

# RTP media (UDP)
set system conntrack timeout custom ipv4 rule 40 description 'RTP media streams'
set system conntrack timeout custom ipv4 rule 40 destination port '10000-20000'
set system conntrack timeout custom ipv4 rule 40 protocol 'udp'
set system conntrack timeout custom ipv4 rule 40 protocol udp stream '300'

Example 4: Timeouts for a specific server

# Special timeouts for a critical application server
set system conntrack timeout custom ipv4 rule 50 description 'Application server timeouts'
set system conntrack timeout custom ipv4 rule 50 destination address '192.168.100.10'
set system conntrack timeout custom ipv4 rule 50 protocol 'tcp'
set system conntrack timeout custom ipv4 rule 50 protocol tcp established '14400'  # 4 hours
set system conntrack timeout custom ipv4 rule 50 protocol tcp close-wait '60'

Yandex Cloud: High-Performance NAT Gateway

Scenario

Deploying a NAT gateway in Yandex Cloud to provide internet access for a private subnet with many microservices. Requirements:

Support for up to 100,000 concurrent connections
Optimization for short-lived HTTP/HTTPS connections
Minimal memory consumption
High packet-processing performance

Topology

Internet (eth0: 192.0.2.10/24)
    |
[VyOS NAT Gateway - Yandex Cloud Compute Instance]
    |
Private Network (eth1: 10.128.0.1/24)
    |
[Microservices: 10.128.0.10-254]

Full Configuration

# Basic interface configuration
set interfaces ethernet eth0 address '192.0.2.10/24'
set interfaces ethernet eth0 description 'WAN - Yandex Cloud External Network'
set interfaces ethernet eth1 address '10.128.0.1/24'
set interfaces ethernet eth1 description 'LAN - Private Subnet'

# NAT configuration
set nat source rule 100 description 'NAT for private network'
set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '10.128.0.0/24'
set nat source rule 100 translation address 'masquerade'

# Conntrack optimization for high load
set system conntrack table-size '262144'        # 256K connections
set system conntrack hash-size '65536'          # Speed up lookups
set system conntrack expect-table-size '2048'   # Standard size

# Aggressive timeouts to free up entries
set system conntrack timeout tcp close '5'
set system conntrack timeout tcp close-wait '30'
set system conntrack timeout tcp established '3600'    # 1 hour for HTTP
set system conntrack timeout tcp fin-wait '60'
set system conntrack timeout tcp last-ack '15'
set system conntrack timeout tcp syn-recv '30'
set system conntrack timeout tcp syn-sent '60'
set system conntrack timeout tcp time-wait '30'

# Short UDP timeouts
set system conntrack timeout udp stream '60'
set system conntrack timeout udp other '30'

# Disable unused helper modules
set system conntrack modules ftp disable
set system conntrack modules h323 disable
set system conntrack modules nfs disable
set system conntrack modules pptp disable
set system conntrack modules sip disable
set system conntrack modules sqlnet disable
set system conntrack modules tftp disable

# TCP parameters for high load
set system conntrack tcp half-open-connections '1024'
set system conntrack tcp loose 'enable'
set system conntrack tcp max-retrans '3'

# Ignore health checks from the Yandex Cloud Load Balancer
set system conntrack ignore rule 10 description 'Bypass Yandex CLB health checks'
set system conntrack ignore rule 10 source address '198.18.235.0/24'
set system conntrack ignore rule 10 destination port '80,443'
set system conntrack ignore rule 10 protocol 'tcp'

# Firewall for the WAN interface
set firewall ipv4 name WAN_LOCAL default-action 'drop'
set firewall ipv4 name WAN_LOCAL rule 10 action 'accept'
set firewall ipv4 name WAN_LOCAL rule 10 state established
set firewall ipv4 name WAN_LOCAL rule 10 state related
set firewall ipv4 name WAN_LOCAL rule 20 action 'drop'
set firewall ipv4 name WAN_LOCAL rule 20 state invalid
set firewall ipv4 name WAN_LOCAL rule 30 action 'accept'
set firewall ipv4 name WAN_LOCAL rule 30 protocol 'icmp'

set firewall ipv4 input filter name 'WAN_LOCAL'

# Save the configuration
commit
save

Monitoring and Verification

# View conntrack statistics
show conntrack statistics

# Current number of connections
show conntrack table ipv4 | count

# Top hosts by number of connections
conntrack -L -o extended | awk '{print $5}' | sort | uniq -c | sort -rn | head -20

# Check table utilization (fill percentage)
echo "scale=2; $(cat /proc/sys/net/netfilter/nf_conntrack_count) * 100 / $(cat /proc/sys/net/netfilter/nf_conntrack_max)" | bc

# Monitor NAT performance
show nat source statistics

# Check ignore rules
show system conntrack ignore

Recommendations for Yandex Cloud

Instance Type - use instances with enough RAM (at least 4GB for 256K connections)
Network Performance - choose instances with high network throughput
Placement Groups - for HA, place several NAT gateways in different availability zones
Cloud Monitoring - integrate with Yandex Monitoring to track conntrack metrics
Backup - regularly save the configuration to Yandex Object Storage

Troubleshooting in Yandex Cloud

# Check for conntrack table full errors
dmesg | grep "nf_conntrack: table full"

# Check for dropped packets
show interfaces ethernet eth0 statistics

# Check NAT translations
show nat source translations

# Check system resources
show system resources

VK Cloud: SIP ALG for a VoIP Gateway

Scenario

Configuring VyOS in VK Cloud (Mail.ru Cloud Solutions) as an edge router for an office with IP telephony. Requirements:

Support for SIP registrations from 50 IP phones
Correct SIP ALG operation for NAT traversal
Optimized timeouts for RTP/RTCP streams
QoS for voice traffic
Resilience when registering with an external SIP provider

Topology

Internet (eth0: 95.163.248.10/24) - VK Cloud External Network
    |
[VyOS SIP Gateway - VK Cloud Instance]
    |
Office LAN (eth1: 192.168.1.1/24)
    |
[IP phones: 192.168.1.100-150]
    |
SIP Provider: sip.provider.ru (UDP/5060, RTP/10000-20000)

Full Configuration

# Basic interface configuration
set interfaces ethernet eth0 address '95.163.248.10/24'
set interfaces ethernet eth0 description 'WAN - VK Cloud External'
set interfaces ethernet eth1 address '192.168.1.1/24'
set interfaces ethernet eth1 description 'LAN - Office Network'

# DNS configuration for resolving the SIP provider
set system name-server '8.8.8.8'
set system name-server '8.8.4.4'

# NAT for the office network
set nat source rule 100 description 'Office NAT'
set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '192.168.1.0/24'
set nat source rule 100 translation address 'masquerade'

# Conntrack: increase the table to support multiple RTP streams
# Each active call = at least 2 connections (SIP + RTP)
# 50 phones × 4 connections per call × 2 (margin) = ~400 connections
set system conntrack table-size '65536'
set system conntrack hash-size '16384'
set system conntrack expect-table-size '4096'   # Important for SIP ALG!

# CRITICAL: Enable the SIP helper module for NAT traversal
# Enabled by default; explicit verification:
delete system conntrack modules sip disable     # Make sure it is NOT disabled

# Enable other required modules
delete system conntrack modules tftp disable    # For IP phone provisioning

# Disable unused modules
set system conntrack modules ftp disable
set system conntrack modules h323 disable
set system conntrack modules nfs disable
set system conntrack modules pptp disable
set system conntrack modules sqlnet disable

# Optimize UDP timeouts for VoIP
set system conntrack timeout udp stream '180'   # 3 minutes for active RTP
set system conntrack timeout udp other '60'     # 1 minute for SIP

# TCP timeouts (for SIP over TCP, if used)
set system conntrack timeout tcp established '7200'  # 2 hours

# Custom timeouts for SIP signaling
set system conntrack timeout custom ipv4 rule 10 description 'SIP Signaling'
set system conntrack timeout custom ipv4 rule 10 destination port '5060'
set system conntrack timeout custom ipv4 rule 10 protocol 'udp'
set system conntrack timeout custom ipv4 rule 10 protocol udp stream '300'  # 5 minutes
set system conntrack timeout custom ipv4 rule 10 protocol udp other '120'   # 2 minutes

# Custom timeouts for RTP media
set system conntrack timeout custom ipv4 rule 20 description 'RTP Media Streams'
set system conntrack timeout custom ipv4 rule 20 destination port '10000-20000'
set system conntrack timeout custom ipv4 rule 20 protocol 'udp'
set system conntrack timeout custom ipv4 rule 20 protocol udp stream '180'  # 3 minutes

# Custom timeouts for outbound RTP (from the phones)
set system conntrack timeout custom ipv4 rule 30 description 'RTP from phones'
set system conntrack timeout custom ipv4 rule 30 source address '192.168.1.100-192.168.1.150'
set system conntrack timeout custom ipv4 rule 30 source port '10000-20000'
set system conntrack timeout custom ipv4 rule 30 protocol 'udp'
set system conntrack timeout custom ipv4 rule 30 protocol udp stream '180'

# Firewall: allow inbound SIP and RTP
set firewall ipv4 name WAN_LOCAL default-action 'drop'
set firewall ipv4 name WAN_LOCAL rule 10 action 'accept'
set firewall ipv4 name WAN_LOCAL rule 10 state established
set firewall ipv4 name WAN_LOCAL rule 10 state related
set firewall ipv4 name WAN_LOCAL rule 20 action 'drop'
set firewall ipv4 name WAN_LOCAL rule 20 state invalid

# SIP inbound calls (if used)
set firewall ipv4 name WAN_LOCAL rule 100 action 'accept'
set firewall ipv4 name WAN_LOCAL rule 100 description 'Allow SIP from provider'
set firewall ipv4 name WAN_LOCAL rule 100 destination port '5060'
set firewall ipv4 name WAN_LOCAL rule 100 protocol 'udp'
set firewall ipv4 name WAN_LOCAL rule 100 source address 'sip.provider.ru'

# RTP inbound media
set firewall ipv4 name WAN_LOCAL rule 110 action 'accept'
set firewall ipv4 name WAN_LOCAL rule 110 description 'Allow RTP from provider'
set firewall ipv4 name WAN_LOCAL rule 110 destination port '10000-20000'
set firewall ipv4 name WAN_LOCAL rule 110 protocol 'udp'
set firewall ipv4 name WAN_LOCAL rule 110 source address 'sip.provider.ru'

# ICMP for diagnostics
set firewall ipv4 name WAN_LOCAL rule 200 action 'accept'
set firewall ipv4 name WAN_LOCAL rule 200 protocol 'icmp'

set firewall ipv4 input filter name 'WAN_LOCAL'

# QoS: prioritize VoIP traffic (optional)
set traffic-policy shaper OFFICE_SHAPER bandwidth '100mbit'
set traffic-policy shaper OFFICE_SHAPER default bandwidth '80%'
set traffic-policy shaper OFFICE_SHAPER default queue-type 'fair-queue'

# High priority for VoIP
set traffic-policy shaper OFFICE_SHAPER class 10 description 'VoIP Traffic'
set traffic-policy shaper OFFICE_SHAPER class 10 bandwidth '20%'
set traffic-policy shaper OFFICE_SHAPER class 10 priority '1'
set traffic-policy shaper OFFICE_SHAPER class 10 match SIP ip dscp 'ef'
set traffic-policy shaper OFFICE_SHAPER class 10 match SIP ip protocol 'udp'
set traffic-policy shaper OFFICE_SHAPER class 10 match SIP ip destination port '5060'

set traffic-policy shaper OFFICE_SHAPER class 20 description 'RTP Media'
set traffic-policy shaper OFFICE_SHAPER class 20 bandwidth '20%'
set traffic-policy shaper OFFICE_SHAPER class 20 priority '2'
set traffic-policy shaper OFFICE_SHAPER class 20 match RTP ip protocol 'udp'
set traffic-policy shaper OFFICE_SHAPER class 20 match RTP ip destination port '10000-20000'

# Apply QoS to the WAN interface
set interfaces ethernet eth0 traffic-policy out 'OFFICE_SHAPER'

# Logging for SIP debugging (temporary)
set system conntrack log event new
set system conntrack log event new protocol 'udp'
set system conntrack log event new queue-size '5000'

# Save
commit
save

Verifying SIP Operation

# Verify that the SIP helper is loaded
lsmod | grep nf_conntrack_sip
lsmod | grep nf_nat_sip

# View SIP connections in conntrack
conntrack -L -p udp --dport 5060
conntrack -L -p udp --dport 5061  # If SIP TLS is used

# View RTP connections (expected connections from the SIP helper)
conntrack -L -p udp | grep -E "10[0-9]{3}|1[1-9][0-9]{3}|20000"

# Check the expect table (dynamic RTP ports)
cat /proc/net/nf_conntrack_expect

# Conntrack statistics
show conntrack statistics

# Real-time monitoring
sudo conntrack -E -p udp

# Test SIP registration (from an IP phone)
# Check the logs:
show log conntrack | match udp | match 5060

Diagnosing VoIP Problems

Problem: The call is established, but there is no audio (one-way or no-way audio)

Cause: The SIP ALG is not processing SDP messages, and RTP packets are being blocked.

Solution:

# Verify that the SIP helper is enabled
show system conntrack modules

# If disabled, enable it:
delete system conntrack modules sip disable
commit
save

# Reload the conntrack modules
sudo rmmod nf_nat_sip
sudo rmmod nf_conntrack_sip
sudo modprobe nf_conntrack_sip
sudo modprobe nf_nat_sip

# Check the expect table
cat /proc/net/nf_conntrack_expect
# Entries should appear during calls

Problem: Registration drops after 30-60 seconds

Cause: The UDP timeout is too short, and SIP keep-alive cannot refresh the connection in time.

Solution:

# Increase the UDP timeouts
set system conntrack timeout udp stream '300'
set system conntrack timeout udp other '180'

# Or a custom timeout for SIP
set system conntrack timeout custom ipv4 rule 5 destination port '5060'
set system conntrack timeout custom ipv4 rule 5 protocol 'udp'
set system conntrack timeout custom ipv4 rule 5 protocol udp stream '600'  # 10 minutes

commit
save

# Configure keep-alive on the SIP clients (usually 60-90 seconds)

Problem: RTP packets arrive with delay or are lost

Cause: Conntrack table full or QoS problems.

Solution:

# Check the table fill level
echo "scale=2; $(cat /proc/sys/net/netfilter/nf_conntrack_count) * 100 / $(cat /proc/sys/net/netfilter/nf_conntrack_max)" | bc

# If >80%, increase the size
set system conntrack table-size '131072'
commit

# Check the QoS statistics
show traffic-policy
show interfaces ethernet eth0 statistics

# Temporarily disable QoS for testing
delete interfaces ethernet eth0 traffic-policy
commit

Recommendations for VK Cloud

Floating IP - use a static external IP for stable SIP registration
Security Groups - configure rules for UDP 5060 and 10000-20000
Bandwidth - choose plans with guaranteed bandwidth for VoIP
Monitoring - use VK Cloud monitoring to track packet loss
Backup Gateway - configure a second VyOS instance for failover

IP Phone Configuration

For correct operation through NAT, configure the following on the IP phones:

SIP Server: sip.provider.ru
SIP Port: 5060
RTP Port Range: 10000-20000
NAT Traversal: STUN or Keep-Alive
Keep-Alive Interval: 60 seconds
DTMF Method: RFC2833
Codec: G.711 (a-law/u-law) or G.729

Verification Commands

Viewing the Connection Table

# Show all connections
show conntrack table ipv4

# Show IPv6 connections
show conntrack table ipv6

# Filter by protocol
conntrack -L -p tcp
conntrack -L -p udp
conntrack -L -p icmp

# Filter by source address
conntrack -L -s 192.168.1.100

# Filter by destination address
conntrack -L -d 8.8.8.8

# Filter by port
conntrack -L -p tcp --dport 443
conntrack -L -p tcp --sport 80

# Count the number of connections
show conntrack table ipv4 | count
conntrack -L | wc -l

# Sort by IP address
conntrack -L -o extended | awk '{print $5}' | sort | uniq -c | sort -rn

# Top 20 hosts by number of connections
conntrack -L -o extended | awk '{print $5}' | sort | uniq -c | sort -rn | head -20

Conntrack Statistics

# General statistics
show conntrack statistics

# Detailed statistics from /proc
cat /proc/net/stat/nf_conntrack

# Current table usage
cat /proc/sys/net/netfilter/nf_conntrack_count

# Maximum table size
cat /proc/sys/net/netfilter/nf_conntrack_max

# Table fill percentage
echo "scale=2; $(cat /proc/sys/net/netfilter/nf_conntrack_count) * 100 / $(cat /proc/sys/net/netfilter/nf_conntrack_max)" | bc

# Statistics by protocol
conntrack -S

Real-Time Monitoring

# Track new connections
sudo conntrack -E

# Filter by event type
sudo conntrack -E -e NEW          # New only
sudo conntrack -E -e DESTROY      # Teardown only
sudo conntrack -E -e UPDATE       # Updates only

# Filter by protocol
sudo conntrack -E -p tcp
sudo conntrack -E -p udp

# Combined filters
sudo conntrack -E -e NEW -p tcp --dport 80

Managing Connections

# Delete a specific connection
sudo conntrack -D -s 192.168.1.100 -p tcp --dport 80

# Delete all connections from an IP
sudo conntrack -D -s 192.168.1.100

# Delete all connections (use with caution!)
sudo conntrack -F

# Refresh a connection's timeout
sudo conntrack -U -s 192.168.1.100 -p tcp --dport 22

Checking Helper Modules

# View loaded conntrack modules
lsmod | grep nf_conntrack

# Check specific helper modules
lsmod | grep nf_conntrack_ftp
lsmod | grep nf_conntrack_sip
lsmod | grep nf_conntrack_tftp
lsmod | grep nf_conntrack_pptp

# Module parameters
cat /sys/module/nf_conntrack_*/parameters/*

Checking the Expect Table

# Show the expect table (used by helper modules)
cat /proc/net/nf_conntrack_expect

# For SIP ALG, dynamic RTP ports will appear here
# For FTP, dynamic data connections will appear here

Checking Ignore Rules

# Show the configured ignore rules
show system conntrack ignore

# Check whether traffic is being ignored (via the iptables raw table)
sudo iptables -t raw -L -n -v

# Statistics for the raw table
sudo iptables -t raw -L -n -v --line-numbers

Troubleshooting

Problem: “nf_conntrack: table full, dropping packet”

Symptoms:

Messages “nf_conntrack: table full, dropping packet” appear in the logs (dmesg)
Packets are being dropped
New connections are not being established

Diagnostics:

# Check current usage
cat /proc/sys/net/netfilter/nf_conntrack_count
cat /proc/sys/net/netfilter/nf_conntrack_max

# Fill percentage
echo "scale=2; $(cat /proc/sys/net/netfilter/nf_conntrack_count) * 100 / $(cat /proc/sys/net/netfilter/nf_conntrack_max)" | bc

# Check the logs
dmesg | grep "nf_conntrack: table full"
show log | match "nf_conntrack"

Solution 1: Increase the table size

# Increase table-size
set system conntrack table-size '524288'   # Or more, depending on the load
set system conntrack hash-size '131072'    # hash-size = table-size / 4
commit
save

# Applies after a reboot, or immediately:
sudo sysctl -w net.netfilter.nf_conntrack_max=524288

Solution 2: Optimize timeouts

# Lower the timeouts to free up entries faster
set system conntrack timeout tcp established '3600'   # Instead of 432000 (5 days)
set system conntrack timeout tcp time-wait '30'       # Instead of 120
set system conntrack timeout udp stream '60'          # Instead of 180
commit
save

Solution 3: Use ignore rules

# Exclude internal traffic that does not require tracking
set system conntrack ignore rule 10 source address '10.0.0.0/8'
set system conntrack ignore rule 10 destination address '10.0.0.0/8'
commit
save

Problem: High CPU load due to conntrack

Symptoms:

High CPU usage in softirq
top shows a high %si (software interrupts)
Reduced network performance

Diagnostics:

# Check CPU usage
top
# Pay attention to %si

# Conntrack statistics
show conntrack statistics

# Number of connections
cat /proc/sys/net/netfilter/nf_conntrack_count

Solution 1: Optimize hash-size

# Increase hash-size to speed up lookups
# Recommendation: hash-size = table-size / 4
set system conntrack hash-size '131072'   # For table-size 524288
commit
save

Solution 2: Use ignore rules for trusted traffic

# Bypass conntrack for internal traffic
set system conntrack ignore rule 10 source address '192.168.0.0/16'
set system conntrack ignore rule 10 destination address '192.168.0.0/16'
commit
save

Solution 3: Disable unused helper modules

# Helper modules add overhead
set system conntrack modules ftp disable
set system conntrack modules h323 disable
set system conntrack modules nfs disable
set system conntrack modules pptp disable
set system conntrack modules sqlnet disable
set system conntrack modules tftp disable
# Keep only the required ones (for example, SIP for VoIP)
commit
save

Problem: SIP/VoIP does not work through NAT

Symptoms:

SIP registration succeeds, but there is no audio (one-way or no-way audio)
RTP packets do not pass through
Calls drop

Diagnostics:

# Check whether the SIP helper is enabled
show system conntrack modules | match sip

# Check the expect table (dynamic RTP ports should be present)
cat /proc/net/nf_conntrack_expect

# Monitor SIP connections
conntrack -L -p udp --dport 5060

# Logging for debugging
set system conntrack log event new
set system conntrack log event new protocol 'udp'
commit
show log conntrack | match 5060

Solution 1: Enable the SIP helper

# Make sure the SIP helper is NOT disabled
delete system conntrack modules sip disable
commit
save

# Reload the modules (if that did not help)
sudo rmmod nf_nat_sip
sudo rmmod nf_conntrack_sip
sudo modprobe nf_conntrack_sip
sudo modprobe nf_nat_sip

Solution 2: Increase expect-table-size

# The SIP ALG uses the expect table for dynamic RTP ports
set system conntrack expect-table-size '4096'
commit
save

Solution 3: Adjust UDP timeouts

# Increase UDP timeouts for stable registration
set system conntrack timeout udp stream '300'
set system conntrack timeout udp other '180'

# Custom timeouts for SIP/RTP
set system conntrack timeout custom ipv4 rule 10 destination port '5060'
set system conntrack timeout custom ipv4 rule 10 protocol 'udp'
set system conntrack timeout custom ipv4 rule 10 protocol udp stream '300'

set system conntrack timeout custom ipv4 rule 20 destination port '10000-20000'
set system conntrack timeout custom ipv4 rule 20 protocol 'udp'
set system conntrack timeout custom ipv4 rule 20 protocol udp stream '180'
commit
save

Solution 4: Firewall rules for RTP

# Allow the RTP ports (usually 10000-20000)
set firewall ipv4 name WAN_LOCAL rule 100 action 'accept'
set firewall ipv4 name WAN_LOCAL rule 100 destination port '10000-20000'
set firewall ipv4 name WAN_LOCAL rule 100 protocol 'udp'
commit
save

Problem: FTP does not work through NAT

Symptoms:

The FTP LIST command hangs
Passive mode does not work
Active mode does not work

Diagnostics:

# Check the FTP helper
show system conntrack modules | match ftp
lsmod | grep nf_conntrack_ftp

# Monitor FTP connections
conntrack -L -p tcp --dport 21

# Expect table for FTP data connections
cat /proc/net/nf_conntrack_expect | grep ftp

Solution:

# Enable the FTP helper
delete system conntrack modules ftp disable
commit
save

# Increase expect-table-size
set system conntrack expect-table-size '2048'
commit
save

# Firewall: allow FTP data connections (passive)
set firewall ipv4 name WAN_LOCAL rule 110 action 'accept'
set firewall ipv4 name WAN_LOCAL rule 110 destination port '1024-65535'
set firewall ipv4 name WAN_LOCAL rule 110 protocol 'tcp'
set firewall ipv4 name WAN_LOCAL rule 110 state related
commit
save

Problem: Slow lookups in the conntrack table

Symptoms:

High latency
Slow packet processing
Statistics show many search restarts

Diagnostics:

# Check the search statistics
cat /proc/net/stat/nf_conntrack
# The "search_restart" column shows the number of search restarts

# Ratio of hash-size to table-size
echo "Current hash-size: $(cat /proc/sys/net/netfilter/nf_conntrack_buckets)"
echo "Current table-size: $(cat /proc/sys/net/netfilter/nf_conntrack_max)"

Solution:

# Increase hash-size (recommendation: table-size / 4)
set system conntrack hash-size '131072'   # For table-size 524288
commit
save

# Apply immediately (before a reboot)
sudo sysctl -w net.netfilter.nf_conntrack_buckets=131072

Best Practices

1. Sizing the Connection Table

Estimating requirements:

# Formula for calculating table-size:
# Table Size = (Peak Concurrent Connections × 1.5) + 10% safety margin

# Example for 1000 users:
# Average of 20 connections per user = 20000
# Peak usage (×1.5) = 30000
# Safety margin (10%) = 33000
# Round up to a power of 2: 65536

Parameter ratios:

# Rule of thumb:
# hash-size = table-size / 4
# expect-table-size = table-size / 128 (minimum 2048)

# Example for table-size 524288:
set system conntrack table-size '524288'
set system conntrack hash-size '131072'      # 524288 / 4
set system conntrack expect-table-size '4096' # 524288 / 128

2. Timeout Optimization

HTTP/HTTPS services (short connections):

set system conntrack timeout tcp established '1800'   # 30 minutes
set system conntrack timeout tcp time-wait '30'
set system conntrack timeout tcp close-wait '30'

SSH/VPN services (long-lived connections):

set system conntrack timeout tcp established '86400'  # 24 hours

VoIP/Streaming (UDP):

set system conntrack timeout udp stream '300'   # 5 minutes
set system conntrack timeout udp other '60'     # 1 minute

3. Helper Modules Management

Principle of least privilege:

# Disable ALL unused helper modules
# Enable only what is genuinely required

# Example: Only SIP for a VoIP office
set system conntrack modules ftp disable
set system conntrack modules h323 disable
set system conntrack modules nfs disable
set system conntrack modules pptp disable
set system conntrack modules sqlnet disable
set system conntrack modules tftp disable
# SIP stays enabled (by default)

Verification after changes:

# Check the loaded modules
lsmod | grep nf_conntrack

4. Using Ignore Rules

When to use:

Internal traffic between trusted servers
Health checks from load balancers
High-frequency monitoring (SNMP, syslog)
Traffic that does not require NAT or stateful filtering

When NOT to use:

Traffic that passes through NAT
Traffic protected by a stateful firewall
Unpredictable or untrusted traffic

Example of correct usage:

# Backend servers communicating directly (without NAT)
set system conntrack ignore rule 10 source address '10.10.0.0/24'
set system conntrack ignore rule 10 destination address '10.10.0.0/24'

# Health checks from a known load balancer
set system conntrack ignore rule 20 source address '10.0.1.10'
set system conntrack ignore rule 20 destination port '80,443'
set system conntrack ignore rule 20 protocol 'tcp'

5. Monitoring and Alerting

Critical metrics:

# 1. Table fill percentage (alert if >80%)
echo "scale=2; $(cat /proc/sys/net/netfilter/nf_conntrack_count) * 100 / $(cat /proc/sys/net/netfilter/nf_conntrack_max)" | bc

# 2. Number of table full errors
dmesg | grep -c "nf_conntrack: table full"

# 3. Number of connections by state
conntrack -S

Monitoring automation:

# Check script (add to cron)
#!/bin/bash
CURRENT=$(cat /proc/sys/net/netfilter/nf_conntrack_count)
MAX=$(cat /proc/sys/net/netfilter/nf_conntrack_max)
PERCENT=$(echo "scale=2; $CURRENT * 100 / $MAX" | bc)

if (( $(echo "$PERCENT > 80" | bc -l) )); then
    echo "WARNING: Conntrack table at ${PERCENT}% capacity"
    # Send an alert (email, telegram, etc.)
fi

6. Logging

Production environment:

# Do NOT enable continuous logging in production
# Use it only for temporary debugging

# To debug a specific problem:
set system conntrack log event new
set system conntrack log event new protocol 'tcp'
set system conntrack log event new queue-size '10000'
commit

# After debugging, ALWAYS disable it:
delete system conntrack log
commit
save

Development environment:

# More detailed logging can be enabled
set system conntrack log event new
set system conntrack log event update
set system conntrack log event destroy
commit

7. Performance Tuning

For high-load systems:

# 1. Increase the table and hash sizes
set system conntrack table-size '2097152'
set system conntrack hash-size '524288'

# 2. Aggressive timeouts
set system conntrack timeout tcp established '3600'
set system conntrack timeout tcp time-wait '30'
set system conntrack timeout udp stream '60'

# 3. Disable all unused helpers
set system conntrack modules ftp disable
set system conntrack modules h323 disable
set system conntrack modules nfs disable
set system conntrack modules pptp disable
set system conntrack modules sip disable
set system conntrack modules sqlnet disable
set system conntrack modules tftp disable

# 4. Use ignore rules for internal traffic
set system conntrack ignore rule 10 source address '10.0.0.0/8'
set system conntrack ignore rule 10 destination address '10.0.0.0/8'

# 5. TCP parameters
set system conntrack tcp half-open-connections '2048'
set system conntrack tcp loose 'enable'
set system conntrack tcp max-retrans '3'

commit
save

8. Security

Protection against SYN flood:

# Limit half-open connections
set system conntrack tcp half-open-connections '512'
set system conntrack tcp max-retrans '3'

Disabling loose tracking (where possible):

# Loose tracking allows mid-stream connections
# Disable it for greater security (may break some scenarios)
set system conntrack tcp loose 'disable'

Protection against conntrack table exhaustion:

# Firewall rate limiting for new connections
set firewall ipv4 name WAN_LOCAL rule 5 action 'drop'
set firewall ipv4 name WAN_LOCAL rule 5 recent count '100'
set firewall ipv4 name WAN_LOCAL rule 5 recent time '60'
set firewall ipv4 name WAN_LOCAL rule 5 state new

9. Configuration Documentation

Use description:

# Always document your settings
set system conntrack timeout custom ipv4 rule 10 description 'Short timeout for HTTP/HTTPS'
set system conntrack ignore rule 10 description 'Bypass internal DNS traffic'

# Document the reasons for changing default values
# (either in configuration comments or in a separate file)

10. Testing Changes

Change procedure:

# 1. Back up the configuration
save /config/backup-$(date +%Y%m%d-%H%M%S).config

# 2. Apply the changes in configure mode
configure
set system conntrack table-size '524288'
commit

# 3. Verify operation
exit
show conntrack statistics
show conntrack table ipv4 | count

# 4. Monitor for 30-60 minutes
# Check metrics, logs, and performance

# 5. If everything is OK - save
save

# 6. If there are problems - roll back
load /config/backup-YYYYMMDD-HHMMSS.config
commit
save

Conclusion

Connection Tracking (conntrack) is a critically important VyOS component that powers the stateful firewall and NAT. Proper conntrack configuration:

Improves performance - by optimizing the table size and timeouts
Saves resources - by using ignore rules to exclude unnecessary traffic
Ensures stability - by making complex protocols work correctly through helper modules
Improves security - by disabling unused modules and tuning TCP parameters

Key Recommendations

Sizing - calculate the table size based on real load, with a margin
Timeouts - set timeouts according to the traffic type
Helpers - disable unused helper modules
Monitoring - regularly check metrics and logs
Testing - test changes before applying them in production

Additional Resources

Official VyOS documentation: https://docs.vyos.io/en/latest/configuration/system/conntrack.html
Linux conntrack-tools: http://conntrack-tools.netfilter.org/
Netfilter documentation: https://www.netfilter.org/documentation/
VyOS Forum: https://forum.vyos.io/

Support

For professional support and consulting on VyOS:

Email: support@opennix.ru
Telegram: @opennix_support
Website: https://opennix.ru

Reviewed by OpenNix · Last updated on 29 July 2026

Acceleration Console - Serial Console