1

I have a problem with my Linux router (Debian). When I run MTR, it always has loss in 1 hop it in my server.

My friends told me it's because my nf_conntrack is full. I have been up max_conntrack but that's just temporary.

I read that nf_conntrack can be flushed, but when I tried I got an error:

net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 1677216
net.ipv4.tcp_wmem = 4096 65536 1677216
net.core.netdev_max_backlog = 64000
net.ipv4.tcp_mtu_probing = 1
net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = 54000
net.netfilter.nf_conntrack_generic_timeout = 120
net.netfilter.nf_contrack_max = 1024000
net.ipv4.tcp_syncookies = 1
error: permission denied on key 'net.netfilter.nf_conntrack_count'

nf_conntrack screenshot

2
  • 3
    Can you explain what this means "had loss in 1 hop it in my server"? Where are you running the MTR and where is the endpoint? Can you post a screenshot?
    – Paul
    Apr 27, 2016 at 4:07
  • I may say something dumb not wouldn't any hop which passes the traffic through it decrease the TTL by one? Isn't that what you're observing?
    – kostix
    Apr 27, 2016 at 17:37

1 Answer 1

-1

I think it is because you are using DROP in your firewall policy. Try to change DROP to REJECT in your rules. More details here

3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .