For completeness sake I would add that one must also set options nf_conntrack expect_hashsize=X hashsize=X in /etc/modules.d/nf_conntrack.conf, X being 1/4

For completeness sake I would add that one must also set options nf_conntrack expect_hashsize=X hashsize=X in /etc/modules.d/nf_conntrack.conf, X being 1/4 the size of conntrack_max