netfilter problem cause Gentoo router to crash

[weyhan]

Hi,

I've been experience problems with my Gentoo router and it look like it is may be related to NAT/nf_conntrack. The router is directly connected to the internet via an ADSL modem. The router has shorewall installed and uses netfilter to do the routing as well as protect my internal network. I first notice the problem when I was still on 2.6.22-hardened-r8. I'm now on linux-2.6.23-hardened-r4 and I still see the problem.

The first sign of trouble was when I first saw this error message in my logs:

[Hu]

Please post the output of emerge --info ; free -m -l -t ; iptables-save -c ; ip addr ; ip route. How many systems do you have inside the network? What operating systems do they run? What purposes do they serve (general desktop, PVR, filer, HTTP server, FTP server, etc.)? What is the highest value you have seen for wc -l /proc/net/nf_conntrack?

The last person I saw with this problem traced it to an infected Windows system on the internal network. The infected system was making an excessive number of outbound connections and filling up the connection tracking table. The problem went away when he disinfected the Windows system by wiping its drive.

[weyhan]

Hi Hu,

Thanks for the help. I did read the other thread where you help found an infected machine that is causing the problem but I don't think it is malware at work here. The reason I doubt it is because I have AVG (I know it's not 100% safe) and I found the REJECT lines from the logs goes down a lot after I've stop the bittorrent. I'm using uTorrent 1.7.7 BTW.

I have 3 zones in my network. DMZ has one server which is off now for rebuilding. I have a samba fileserver on the local network also in the process of rebuilding. Apart from a mostly on WinXP desktop, the others network points are usually for notebooks which none are connected at the moment. So, what is left is just the WinXP desktop. Since I've failrly certain the desktop is clean, I don't think that is the problem.

The biggest number I’ve seen from the line count of nf_conntrack is really huge, somewhere in the 6 digits zone. I know when I have the hashsize at 4096; the nf_conntrack_max is 16384, so the largest number is more then that. I have boots up the numbers now from reading some advice on the net to hashsize= 524288 and nf_conntrack_max= 4194304. I did not choose the nf_conntrack_max number because Gentoo does the calculation with this formula:

hashsize * 4 = nf_conntrack_max

The advice I’ve read is that if the box is only for routing, it is better to set the hashsize = nf_conntrack_max but I have not figure out how to do that in Gentoo without editing the init scripts (or was it in the kernel source, I can’t remember).

emerge --info