Conversation
Edited 29 days ago

oh my fucking god i think i solved the fucking DNS timeout issues

DNS is handled by my VPS
my VPS is also a NATing firewall (on wireguard)
sysctl net.netfilter.nf_conntrack_max scales with ram
said VPS has 0.5 GB RAM
the sysctl was set to 4096 (a usual value is more like >=128k)
dmesg was flooded with nf_conntrack: table full, dropping packet

1
0
0
@deneb If you don't need port translation, consider static nat using `tc-nat(8)`.
1
0
0

@rw i do need it i think; i egress some traffic from other devices using the VPS' public IP

are there any concerns with just raising the sysctl value?
(nf_conntrack_count is between 5500 and 6000 atm)

1
0
0
@deneb Well, as long you are aware of the memory foot print, all good.
Have an eye on the nf_conntrack slab (/proc/slabinfo).
1
0
1

@rw aight, great to know, thanks!

0
0
0