fujin/rtorrent
1
0
Fork 0
mirror of https://github.com/rakshasa/rtorrent.git synced 2026-08-15 14:42:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

-j NOTRACK is deprecated, -j CT --notrack is the proper replacement

Niklas Haas
2015-08-18 12:47:50 +02:00
parent 9fabf67df7
commit 742b6e4a68
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Using-DHT.asciidoc
+3 -3
@@ -78,11 +78,11 @@ There are several strategies to mitigate this:
2. Reduce the DHT query volume. Since one cannot directly control incoming queries, this can be done by throttling the outgoing DHT bandwidth to discourage too many incoming queries.
3. Turn off connection tracking for DHT packets.
To turn off DHT connection tracking on Linux, use the NOTRACK target in the "raw" netfilter table. For instance, when using UDP port 6881 for DHT, execute these iptables commands:
To turn off DHT connection tracking on Linux, use the CT target's --notrack option in the "raw" netfilter table. For instance, when using UDP port 6881 for DHT, execute these iptables commands:
....
iptables -t raw -I PREROUTING -p udp --dport 6881 -j NOTRACK
iptables -t raw -I OUTPUT -p udp --sport 6881 -j NOTRACK
iptables -t raw -I PREROUTING -p udp --dport 6881 -j CT --notrack
iptables -t raw -I OUTPUT -p udp --sport 6881 -j CT --notrack
....
Note that this causes all DHT packets to have a state of `UNTRACKED`, keep that in mind if you have any state-based rules in the regular netfilter tables. Similarly, ICMP packets received in reply to untracked outgoing DHT packets (for instance `Host Unreachable` or `Time Exceeded`) will have a state of `INVALID` because they do not belong to any known connection.