linux 如何修复nf_conntrack:出于安全原因,默认自动助手分配已关闭

amrnrhlw  于 2023-01-29  发布在  Linux
关注(0)|答案(1)|浏览(807)

我收到消息了

  1. nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.

内核是5.4.23,nftables版本是0.9.3。我如何为那个ct状态分配一个helper?

  1. table ip filter {
  2. chain input {
  3. type filter hook input priority filter; policy accept;
  4. ct state established,related accept
  5. iif "lo" accept
  6. }
  7. chain forward {
  8. type filter hook forward priority filter; policy accept;
  9. }
  10. chain output {
  11. type filter hook output priority filter; policy accept;
  12. }
  13. }
vd2z7a6w

vd2z7a6w1#

我在CentOS 8上遇到了相同的错误。要解决它,请通过以下方式启用自动conntrack助手分配:

  1. echo "net.netfilter.nf_conntrack_helper = 1" >> /etc/sysctl.conf
  2. sysctl -p

--编辑:根据@2072和@Gwyneth Llewelyn的以下评论,除非只是为了测试,否则不建议执行上述更改。相反,可以在此处找到适当的解决方案

相关问题