On Fri, Feb 16, 2024 at 10:22:05AM +0000, solarmon wrote:
Hi,
I understand that the nf_conntrack_sip module is used as the helper module
for the 'sip' service. I understand that firewalld loads up the modules
using this modprobe config file:
/etc/modprobe.d/firewalld-sysctls.conf
This file is about setting nf_conntrack* sysctls. It won't load any
extra modules.
However, what I would like to do it set the nf_conntrack_sip
'sip_timeout'
option value. The default is 3600 and this can be seen and set in
realtime at:
/sys/module/nf_conntrack_sip/parameters/sip_timeout
However, I would like to get firewalld to set the sip_timeout value when it
loads the module.
I have tried create a specific modprobe config file
at /etc/modprobe.d/50-nf_conntrack_sip.conf with the following contents:
options nf_conntrack_sip sip_timeout=300
This looks correct to me.
However, this does not seem to work and after a reboot,
the /sys/module/nf_conntrack_sip/parameters/sip_timeout value is still 3600.
Is there a way to specify the sip_timer option when defining the sip
service in firewalld?
Ugh. There is no sysctl for sip_timeout so you're on the right track.
You must set it as a module option.
Does it work if you do it with modprobe?
# modprobe -r nf_conntrack_sip
# modprobe nf_conntrack_sip sip_timeout=300