File conntrackd.conf of Package conntrack-tools

File conntrackd.conf of Package conntrack-tools (Revision dfe7ba8ab099e87761468bdce43a6741)

Currently displaying revision dfe7ba8ab099e87761468bdce43a6741, show latest

#                                                   
# Synchronizer settings                             
#                                                   
Sync {                                              
        Mode FTFW {                                 
                #                                   
                # Size of the buffer that hold destroy messages for 
                # possible resends (in bytes)                       
                #                                                   
                ResendQueueSize 262144

#
                # Entries committed to the connection tracking table 
                # starts with a limited timeout of N seconds until the
                # takeover process is completed.                      
                #                                                     
                CommitTimeout 180

# Set Acknowledgement window size
                ACKWindowSize 20                 
        }

#
        # Multicast IP and interface where messages are
        # broadcasted (dedicated link). IMPORTANT: Make sure
        # that iptables accepts traffic for destination     
        # 225.0.0.50, eg:                                   
        #                                                   
        #       iptables -I INPUT -d 225.0.0.50 -j ACCEPT   
        #       iptables -I OUTPUT -d 225.0.0.50 -j ACCEPT  
        #                                                   
        Multicast {                                         
                IPv4_address 225.0.0.50                     
                IPv4_interface 10.0.0.145 # IP of dedicated link
                Interface eth1
                Group 3780 
		# Enable/Disable message checksumming                                         
		Checksum on
                # The multicast sender uses a buffer to enqueue the packets
                # that are going to be transmitted. The default size of this
                # socket buffer is available at /proc/sys/net/core/wmem_default.
                # This value determines the chances to have an overrun in the   
                # sender queue. The overrun results packet loss, thus, losing   
                # state information that would have to be retransmitted. If you 
                # notice some packet loss, you may want to increase the size    
                # of the sender buffer.                                         
                #                                                               
                # McastSndSocketBuffer 1249280                                  
                #                                                               
                # The multicast receiver uses a buffer to enqueue the packets   
                # that the socket is pending to handle. The default size of this
                # socket buffer is available at /proc/sys/net/core/rmem_default.
                # This value determines the chances to have an overrun in the   
                # receiver queue. The overrun results packet loss, thus, losing 
                # state information that would have to be retransmitted. If you 
                # notice some packet loss, you may want to increase the size of 
                # the receiver buffer.                                          
                #                                                               
                # McastRcvSocketBuffer 1249280                                  
        }

# Uncomment this if you want to replicate just certain TCP states.
        # This option introduces a tradeoff in the replication: it reduces
        # CPU consumption and lost messages rate at the cost of having    
        # backup replicas that don't contain the current state that the active 
        # replica holds. TCP states are: SYN_SENT, SYN_RECV, ESTABLISHED,      
        # FIN_WAIT, CLOSE_WAIT, LAST_ACK, TIME_WAIT, CLOSE, LISTEN.            
        #                                                                      
        # Replicate ESTABLISHED TIME_WAIT for TCP

# If you have a multiprimary setup (active-active) without connection
        # persistency, ie. you can't know which firewall handles a packet    
        # that is part of a connection, then you need direct commit of       
        # conntrack entries to the kernel conntrack table. OSPF setups must  
        # set on this option. Default is Off.                                
        #                                                                    
        # CacheWriteThrough On                                               
}

#
# General settings
#                 
General {         
        #         
        # Number of buckets in the caches: hash table
        #                                            
        HashSize 8192

#
        # Maximum number of conntracks: 
        # it must be >= $ cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max
        #                                                                  
        HashLimit 65535

#
        # Logfile: on, off, or a filename
        # Default: on (/var/log/conntrackd.log)
        #
        #LogFile off

#
        # Syslog: on, off or a facility name (daemon (default) or local0..7)
        # Default: off
        #
        Syslog on

#
        # Lockfile
        #
        LockFile /var/lock/conntrack.lock

#
        # Unix socket configuration
        #
        UNIX {
                Path /tmp/sync.sock
                Backlog 20
        }

#
        # Netlink socket buffer size
        #
        SocketBufferSize 262142

#
        # Increase the socket buffer up to maximum if required
        #
        SocketBufferSizeMaxGrown 655355

#
	# Ignore traffic for a certain set of IP's: Usually
	# all the IP assigned to the firewall since local
	# traffic must be ignored, just forwarded connections
	# are worth to replicate
	#
	Filter {
		Address Ignore {
        		IPv4_address 127.0.0.1 # loopback
		}
		Protocol Ignore {
			ICMP
			IGMP
			VRRP
		}
	}
}
#
# Do not replicate certain protocol traffic
#
#IgnoreProtocol {
#        UDP
#        ICMP
#        IGMP
#        VRRP
#        # numeric numbers also valid
#}