linux 如何修复nf_conntrack:出于安全原因,默认自动助手分配已关闭

amrnrhlw  于 2023-01-29  发布在  Linux
关注(0)|答案(1)|浏览(780)

我收到消息了

nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based  firewall rule not found. Use the iptables CT target to attach helpers instead.

内核是5.4.23,nftables版本是0.9.3。我如何为那个ct状态分配一个helper?

table ip filter {
        chain input {
                type filter hook input priority filter; policy accept;
                ct state established,related accept
                iif "lo" accept
        }

        chain forward {
                type filter hook forward priority filter; policy accept;
        }

        chain output {
                type filter hook output priority filter; policy accept;
        }
}
vd2z7a6w

vd2z7a6w1#

我在CentOS 8上遇到了相同的错误。要解决它,请通过以下方式启用自动conntrack助手分配:

echo "net.netfilter.nf_conntrack_helper = 1" >> /etc/sysctl.conf
sysctl -p

--编辑:根据@2072和@Gwyneth Llewelyn的以下评论,除非只是为了测试,否则不建议执行上述更改。相反,可以在此处找到适当的解决方案

相关问题