What is conntrack?

conntrack (Linux connection tracking) is the kernel table of every flow passing through a machine, which stateful firewalls and NAT rely on.

For each new flow, conntrack records the protocol and the addresses and ports in both directions: the original direction and the expected reply. It does this for TCP, and also for UDP and ICMP, which have no connections of their own; for those it keeps a flow alive with a timer after the last packet. Every packet is then given a state that firewall rules can match:

• new: the first packet of a flow it hasn't seen.
• established: a packet belonging to a flow that has seen traffic both ways.
• related: a new flow tied to an existing one, such as an ICMP error about a TCP connection.
• invalid: a packet that fits no tracked flow, such as a TCP SYN-ACK with no SYN before it.

NAT depends on the same table. The translation is chosen for a flow's first packet and stored in its conntrack entry, which is how the router knows to rewrite the replies on the way back.

On a router you meet conntrack through stateful firewall rules ("accept established and related, drop invalid") and through NAT and SNAT. The classic surprise is asymmetric routing: if a request leaves through one router and the reply comes back through another, the second router never saw the start of the flow, marks the reply invalid and drops it. The table also has a maximum size; on a busy router it can fill up, and new connections then fail. The conntrack command from the conntrack-tools package lists and deletes entries, and VyOS exposes it too. The Packets That Never Come Back lesson uses conntrack to explain a missing return route and an asymmetric path through a stateful firewall.