Linux router conntrack settings
Linux firewall? Conntrack? NAT? Connection issues?
This is one of those "I'll never remember this again if I don't write it down" types of posts. So entirely for my own purposes, basically :)
I have a linux box acting as a firewall/NAT device for my local network. Among other things, I'm using conntrack modules for NAT connection tracking to handle proper NAT port forwards and also for firewall rules to filter active connections properly.
A few issues cropped up in weird places like Netflix, YouTube, VEVO, and other streaming services where streams would die for no apparent reason. I always just chalked this up to ephemeral internet issues and did not investigate it deeply as it was not common enough to be more than a minor, infrequent, and random inconvenience. However, a consistent, reproducible, and most irritatingly CONSTANT problem trying to watch twitch.tv streams finally got me looking into this in detail.
Now, I don't know the details of WebRTC, HLS, RTP, and all the other protocols under the hood for video streaming tunnels through HTTP. What I do know (now) is that the default timeouts in conntrack in 3.x kernels seem to be too aggressive (at least for my internet connection), causing conntrack to often drop the TCP connection tracking for computers using these streaming protocols.
The result? Random drop-outs and network connectivity problems in HTTP-based video streaming.
The fix ends up being stupid simple. I just doubled (or sometimes tripled/quadrupled) the TCP connection timeouts for conntrack and, at least so far, streaming stability has improved dramatically (and twitch.tv actually works). The new timeouts are still short enough that for my limited network size I'm in no danger of running out of conntrack entries in any reasonable timeframe.
So, to the end of my /etc/sysctl.conf file, I simply added these timeouts (Ubuntu 14 LTS system, btw):
net.netfilter.nf_conntrack_icmp_timeout = 60 net.netfilter.nf_conntrack_tcp_timeout_close = 60 net.netfilter.nf_conntrack_tcp_timeout_close_wait = 120 net.netfilter.nf_conntrack_tcp_timeout_established = 86400 net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 240 net.netfilter.nf_conntrack_tcp_timeout_last_ack = 120 net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 120 net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 240 net.netfilter.nf_conntrack_tcp_timeout_time_wait = 240 net.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300 net.netfilter.nf_conntrack_udp_timeout = 60 net.netfilter.nf_conntrack_udp_timeout_stream = 240
Oh, and while I'm on the topic... I also updated my conntrack modules to handle a few of those irritating protocols. These work much more cleanly now with the proper conntrack handling in place (especially PPTP). To my /etc/modules I have added:
nf_conntrack_proto_gre nf_conntrack_pptp nf_conntrack_sip nf_conntrack_h323 nf_conntrack_ftp nf_nat_proto_gre nf_nat_pptp nf_nat_sip nf_nat_h323 nf_nat_ftp
