Home / server / Questions / 234560
Accepted
tex
Asked: 2011-02-12 13:27:54 +0800 CST

How to turn iptables stateless?

  • 772

I'm running a Linux server that - from time to time - faces heavy load and the conntrack table overflows. Since it's iptables firewall ruleset is very simple I'd like to turn it to stateless mode. I know that iptables can operate in stateful connection tracking mode and in a stateless mode.

My firewall rules are all in place I'm pretty sure that they are stateless but my question is how can I verify that the firewall is really operating in stateless mode?

firewall linux iptables

3 Answers

  1. Best Answer

    You need to specify some iptables rules to prevent packets to be conntracked :

    iptables -t raw -I PREROUTING -j NOTRACK
iptables -t raw -I OUTPUT -j NOTRACK
    • 20

  2. cat /proc/net/ip_conntrack shows all connection tracking.

    So, if it's stateless, the output of the above command should be empty.

    (Alternatively, use cat /proc/net/nf_conntrack)

    • 5

  3. Install conntrack, and look at the output. I am pretty sure if you are stateless no connections will be displayed.

    • 4