4 ms·
Why use PREROUTING chain? You could have achieved same with INPUT chain without specification of ingress interface and server IP address.
by Snawoot 3y ago
Why use PREROUTING chain? You could have achieved same with INPUT chain without specification of ingress interface and server IP address.
- LinuxBender 3y agoAnything I explicitly drop I do so in the raw table to keep them out of the state table. The state table is more CPU expensive especially at high packet rates and runs the risk of depleting the default state table limits especially for anything that now has a broken state on purpose like these poor lil bots. Since I brought it up, here is how to increase the state table limits. Create /etc/modprobe.d/nf_conntrack.conf cat /etc/modprobe.d/nf_conntrack.conf options nf_conntrack expect_hashsize=256400 hashsize=256400 And then in /etc/sysctl.conf: # from /etc/sysctl.conf: increase state table limits. # Requires 1/4 mem to hash table plus 400 overhead because I am the cargo culting king: # cat /etc/modprobe.d/nf_conntrack.conf # options nf_conntrack expect_hashsize=256400 hashsize=256400 net.nf_conntrack_max = 1024000 Should people use default state table memory allocations on a busy node, everyone can be locked out of it regardless of how many TB of RAM are free. The node can appear "down".