Hi,
I understand that the nf_conntrack_sip module is used as the helper module for the 'sip' service. I understand that firewalld loads up the modules using this modprobe config file:
/etc/modprobe.d/firewalld-sysctls.conf
However, what I would like to do it set the nf_conntrack_sip 'sip_timeout' option value. The default is 3600 and this can be seen and set in realtime at:
/sys/module/nf_conntrack_sip/parameters/sip_timeout
However, I would like to get firewalld to set the sip_timeout value when it loads the module.
I have tried create a specific modprobe config file at /etc/modprobe.d/50-nf_conntrack_sip.conf with the following contents:
options nf_conntrack_sip sip_timeout=300
However, this does not seem to work and after a reboot, the /sys/module/nf_conntrack_sip/parameters/sip_timeout value is still 3600.
Is there a way to specify the sip_timer option when defining the sip service in firewalld?
Cheers!
solarmon
On Fri, Feb 16, 2024 at 10:22:05AM +0000, solarmon wrote:
Hi,
I understand that the nf_conntrack_sip module is used as the helper module for the 'sip' service. I understand that firewalld loads up the modules using this modprobe config file:
/etc/modprobe.d/firewalld-sysctls.conf
This file is about setting nf_conntrack* sysctls. It won't load any extra modules.
However, what I would like to do it set the nf_conntrack_sip 'sip_timeout' option value. The default is 3600 and this can be seen and set in realtime at:
/sys/module/nf_conntrack_sip/parameters/sip_timeout
However, I would like to get firewalld to set the sip_timeout value when it loads the module.
I have tried create a specific modprobe config file at /etc/modprobe.d/50-nf_conntrack_sip.conf with the following contents:
options nf_conntrack_sip sip_timeout=300
This looks correct to me.
However, this does not seem to work and after a reboot, the /sys/module/nf_conntrack_sip/parameters/sip_timeout value is still 3600.
Is there a way to specify the sip_timer option when defining the sip service in firewalld?
Ugh. There is no sysctl for sip_timeout so you're on the right track. You must set it as a module option.
Does it work if you do it with modprobe?
# modprobe -r nf_conntrack_sip # modprobe nf_conntrack_sip sip_timeout=300
Hi,
I haven't tried the direct modprobe options - I didn't know how it might/may break how firewalld is using the module as a helper.
What I have done, as a workaround for now, is to put use '/etc/rc.d/rc.local' and put the command to change the sip_timeout option on the fly:
echo 300 > /sys/module/nf_conntrack_sip/parameters/sip_timeout
You need to make sure '/etc/rc.d/rc.local' is executable:
chmod +x /etc/rc.d/rc.local
This seems to work as expected/desired and after a reboot the sip_timeout value is 300.
Cheers!
On Fri, 16 Feb 2024 at 14:24, Eric Garver egarver@redhat.com wrote:
On Fri, Feb 16, 2024 at 10:22:05AM +0000, solarmon wrote:
Hi,
I understand that the nf_conntrack_sip module is used as the helper
module
for the 'sip' service. I understand that firewalld loads up the modules using this modprobe config file:
/etc/modprobe.d/firewalld-sysctls.conf
This file is about setting nf_conntrack* sysctls. It won't load any extra modules.
However, what I would like to do it set the nf_conntrack_sip
'sip_timeout'
option value. The default is 3600 and this can be seen and set in realtime at:
/sys/module/nf_conntrack_sip/parameters/sip_timeout
However, I would like to get firewalld to set the sip_timeout value when
it
loads the module.
I have tried create a specific modprobe config file at /etc/modprobe.d/50-nf_conntrack_sip.conf with the following contents:
options nf_conntrack_sip sip_timeout=300
This looks correct to me.
However, this does not seem to work and after a reboot, the /sys/module/nf_conntrack_sip/parameters/sip_timeout value is still
Is there a way to specify the sip_timer option when defining the sip service in firewalld?
Ugh. There is no sysctl for sip_timeout so you're on the right track. You must set it as a module option.
Does it work if you do it with modprobe?
# modprobe -r nf_conntrack_sip # modprobe nf_conntrack_sip sip_timeout=300
firewalld-users@lists.fedorahosted.org