Hi,
I haven't tried the direct modprobe options - I didn't know how it
might/may break how firewalld is using the module as a helper.
What I have done, as a workaround for now, is to put use
'/etc/rc.d/rc.local' and put the command to change the sip_timeout option
on the fly:
echo 300 > /sys/module/nf_conntrack_sip/parameters/sip_timeout
You need to make sure '/etc/rc.d/rc.local' is executable:
chmod +x /etc/rc.d/rc.local
This seems to work as expected/desired and after a reboot the sip_timeout
value is 300.
Cheers!
On Fri, 16 Feb 2024 at 14:24, Eric Garver <egarver(a)redhat.com> wrote:
On Fri, Feb 16, 2024 at 10:22:05AM +0000, solarmon wrote:
> Hi,
>
> I understand that the nf_conntrack_sip module is used as the helper
module
> for the 'sip' service. I understand that firewalld loads up the modules
> using this modprobe config file:
>
> /etc/modprobe.d/firewalld-sysctls.conf
This file is about setting nf_conntrack* sysctls. It won't load any
extra modules.
> However, what I would like to do it set the nf_conntrack_sip
'sip_timeout'
> option value. The default is 3600 and this can be seen and set in
> realtime at:
>
> /sys/module/nf_conntrack_sip/parameters/sip_timeout
>
> However, I would like to get firewalld to set the sip_timeout value when
it
> loads the module.
>
> I have tried create a specific modprobe config file
> at /etc/modprobe.d/50-nf_conntrack_sip.conf with the following contents:
>
> options nf_conntrack_sip sip_timeout=300
This looks correct to me.
> However, this does not seem to work and after a reboot,
> the /sys/module/nf_conntrack_sip/parameters/sip_timeout value is still
3600.
>
> Is there a way to specify the sip_timer option when defining the sip
> service in firewalld?
Ugh. There is no sysctl for sip_timeout so you're on the right track.
You must set it as a module option.
Does it work if you do it with modprobe?
# modprobe -r nf_conntrack_sip
# modprobe nf_conntrack_sip sip_timeout=300