diff options
| author | Micah Anderson <micah@riseup.net> | 2022-11-18 16:09:17 -0500 |
|---|---|---|
| committer | Micah Anderson <micah@riseup.net> | 2022-11-18 16:09:17 -0500 |
| commit | 25f191677e06bd1c22e678f97f797189ce8b9ff2 (patch) | |
| tree | 3a4f9c952c3650a9c6ae8996ec18c7b7944732f2 | |
| parent | d25723bc19fb295001c43945e9ec3726042e206f (diff) | |
openvpn: increase conntrack values to better serve vpn gws
The default nf_conntrack values were too small for more heavy gateway use. This
increases these values according to the methodology that is recommended.
| -rw-r--r-- | config/roles/openvpn/defaults/main.yml | 1 | ||||
| -rw-r--r-- | config/roles/openvpn/tasks/openvpn.yml | 29 |
2 files changed, 30 insertions, 0 deletions
diff --git a/config/roles/openvpn/defaults/main.yml b/config/roles/openvpn/defaults/main.yml new file mode 100644 index 0000000..8373001 --- /dev/null +++ b/config/roles/openvpn/defaults/main.yml @@ -0,0 +1 @@ +nf_conntrack_max: 262144 diff --git a/config/roles/openvpn/tasks/openvpn.yml b/config/roles/openvpn/tasks/openvpn.yml index 605f428..7269689 100644 --- a/config/roles/openvpn/tasks/openvpn.yml +++ b/config/roles/openvpn/tasks/openvpn.yml @@ -11,6 +11,17 @@ dest: "/etc/firewall/filter.d/50openvpn" notify: "reload firewall" +# Ensure the conntrack module is loaded before systemd-sysctl tries to set parameters +# Without this, systemd-sysctl will try to load on boot conntrack settings before the module +# is loaded, and fail to adjust them. +- name: Set conntrack to load before systemd-sysctl does its operations + copy: + dest: '/etc/modules-load.d/conntrack.conf' + content: | + # in order for sysctl to adjust some nf_conntrack settings shortly after boot + # we load the module early + nf_conntrack + # Set ip forwarding necessary for openvpn ipv4 - sysctl: name: net.ipv4.ip_forward @@ -46,6 +57,24 @@ - net.core.wmem_max - net.core.wmem_default +# Increase the conntrack buckets +- sysctl: + name: net.netfilter.nf_conntrack_buckets + value: '65536' + sysctl_set: yes + +# Increase conntrack established timeouts +- sysctl: + name: net.netfilter.nf_conntrack_tcp_timeout_established + value: '172800' + sysctl_set: yes + +# Decreate conntrack time_wait +- sysctl: + name: net.netfilter.nf_conntrack_tcp_timeout_time_wait + value: '60' + sysctl_set: yes + - name: Install firewall nat config for vpnweb template: src: "50openvpn_nat.firewall.j2" |