conntrack-sync and NFSv3



In my setup with conntrack-sync things works nice except when I need NFSv3.

In /var/log/messages it’s logged:

Mar  3 15:25:39 vyos-01 conntrack-tools[4353]: no CT attached to this packet
Mar  3 15:25:39 vyos-01 conntrack-tools[4353]: failed to process message

I see the packet on the ingress interface but nothing comes on the egress interface. When I disable conntrack-sync it works, but then my failover will be broken.


Removing the following from iptables makes nfs work, but what does it break?

Chain VYATTA_CT_HELPER (2 references)
target     prot opt source               destination
CT         tcp  --              tcp dpt:1525 CT helper tns
CT         tcp  --              tcp dpt:1521 CT helper tns
CT         udp  --              udp dpt:111 CT helper rpc
CT         tcp  --              tcp dpt:111 CT helper rpc


I got similar problem with oracle db.
Removing the following from iptables looks similar to

set system conntrack modules nfs 'disable' set system conntrack modules sqlnet 'disable'


But the conntrack works, but not together with conntrack-sync. So I wonder what will break when setting the conntrack to disable?

The best thing would probably be if we could find a way to get it work with conntrack, and not just disable it.


Any update on this? just hit this bug…


look at the bug, there are the latest updates