firewalld nf_conntrack_max Static Default Lacks Runtime Scaling on openSUSE

Answer to the Question

openSUSE’s firewalld does not provide a built‑in mechanism to resize the kernel’s connection‑tracking table after boot. The only supported way to change nf_conntrack_max is via sysctl (temporarily or permanently). To avoid table‑full drops while preventing OOM, a small, declarative systemd service can read /proc/meminfo at boot and on memory hot‑plug events, calculate a safe limit, and write it with sysctl -w. This keeps the value static for the lifetime of the service but allows it to adapt to the current RAM size and any later hot‑plug changes.

Likely Explanation

• The default calculation (≈65 k entries per GB) is conservative and static; it never reacts to sustained high‑traffic workloads.
• Increasing nf_conntrack_max consumes ~300 bytes per entry; a 1 GB system would need ~90 MB of kernel memory for 300 k entries.
• Firewalld’s configuration layer only manages nftables rules, not kernel slab parameters.
• OpenSUSE packaging has not yet chosen a dynamic adjuster; administrators normally create /etc/sysctl.d/ drop‑ins.

Confirmed Facts

• Changing net.netfilter.nf_conntrack_max via sysctl -w is volatile; persistence requires a file in /etc/sysctl.d/ or /etc/sysctl.conf.
• Memory hot‑plug events trigger udev rules that can invoke scripts; systemd also offers systemd‑system.conf hooks for memory.target.
• Kernel logs contain the exact message nf_conntrack: table full, dropping packet when the limit is reached.

Recommended Steps for This Case

1. Check current limits and usage:

   sysctl net.netfilter.nf_conntrack_max
   sysctl net.netfilter.nf_conntrack_count
   

2. Define a safety multiplier: For most workloads, 80 % of the default per‑GB value is sufficient. For example, on 8 GB RAM, 8 × 65 k × 0.8 ≈ 416 k entries.
3. Create a drop‑in file to set a static baseline: /etc/sysctl.d/99-firewalld-conntrack.conf

   # /etc/sysctl.d/99-firewalld-conntrack.conf
   net.netfilter.nf_conntrack_max = 400000
   

4. Optional – Add a oneshot systemd service for dynamic adjustment:

   [Unit]
   Description=Set nf_conntrack_max based on current RAM
   After=local-fs.target
   
   [Service]
   Type=oneshot
   ExecStart=/usr/local/bin/set-conntrack-max.sh
   RemainAfterExit=yes
   
   [Install]
   WantedBy=multi-user.target
   

   Script /usr/local/bin/set-conntrack-max.sh:

   #!/usr/bin/env bash
   # Calculate 65k entries per GB, capped at 500k
   MEM_GB=$(awk '/MemTotal/ {printf "%.0f", $2/1024/1024}' /proc/meminfo)
   BASE=$((MEM_GB * 65000))
   LIMIT=$((BASE * 80 / 100))
   # Cap to 500k to avoid OOM on very large systems
   if [ $LIMIT -gt 500000 ]; then LIMIT=500000; fi
   sysctl -w net.netfilter.nf_conntrack_max=$LIMIT
   

5. Reload sysctl and enable the service:

   sysctl --system
   systemctl enable --now set-conntrack-max
   

6. Monitor for table‑full drops: Use dmesg | grep nf_conntrack or journalctl -k | grep nf_conntrack to confirm the limit is no longer hit.

Missing Diagnostic Detail

To fine‑tune the multiplier or absolute ceiling, could you share the peak nf_conntrack_count observed during your busiest period? This helps decide whether a 70 % or 80 % scaling factor is appropriate.