"nf_conntrack: table full, dropping packet" even though nf_conntrack_count is much less than nf_conntrack_max

Solution 1:

I had the same issue a while back on a Squid system.

One of the most effective way I found to reduce the size of the conntrack was to reduce the default TCP timeout in the kernel.

The net.netfilter.nf_conntrack_tcp_timeout_established is set to 432000 by default. That's right...that's 5 days.

To set the value you can issue the following command;

sysctl -w net.netfilter.nf_conntrack_tcp_timeout_established=X

And if you want that change to be persistent you need to add the line to /etc/sysctl.conf.

After reducing that value to 600 the conntrack count was steadily going down over a couple of days.

I used sysctl net.netfilter.nf_conntrack_max and sysctl net.netfilter.nf_conntrack_count in order to get the values.