# Haproxy cause to full nf\_conntrack\_max

**URL:** <https://discourse.haproxy.org/t/haproxy-cause-to-full-nf-conntrack-max/5875>\
**Category:** Help!\
**Created:** [November 1, 2020, 5:43am UTC](https://discourse.haproxy.org/t/haproxy-cause-to-full-nf-conntrack-max/5875 "2020-11-01T05:43:44Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![saleh](https://avatars.discourse-cdn.com/v4/letter/s/e79b87/32.png) [@saleh](https://discourse.haproxy.org/u/saleh)\
**Post date:** [November 1, 2020, 5:43am UTC](https://discourse.haproxy.org/t/haproxy-cause-to-full-nf-conntrack-max/5875/1 "2020-11-01T05:43:44Z")

</div>

Hi  
I setup haproxy(HA-Proxy version 1.5.18 2016/05/10 in centos7  
) with below config (proxy hundreds of web sites) .But now i see kernel drop packets and reveal lots of error message on monitoring tools indicate ping loss is too high on my server .although i increased nf\_conntrack\_count and setup max connection in haproxy to 10000 but just a few hours later nf\_conntrack\_count (current connection) reaches to nf\_contrack\_max (600000). also in in haproxy log just show incomprehensible information posted after haproxy config.

# Global settings

```
log 127.0.0.1:514 local0
stats socket /var/run/haproxy.stat
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 10000
user haproxy
group haproxy
daemon
stats socket /var/lib/haproxy/stats

```

defaults  
log global  
option tcplog  
option dontlognull  
option http-server-close  
option redispatch  
retries 3  
timeout http-request 10s  
timeout queue 1m  
timeout connect 30s  
timeout client 1m  
timeout server 2m  
#timeout http-keep-alive 10s  
timeout check 10s  
maxconn 4000

#---------------------------------------------------------------------  
frontend http-in  
bind \*:80  
mode http  
redirect scheme https code 301

frontend tls  
bind \*:443  
mode tcp  
tcp-request inspect-delay 5s  
tcp-request content accept if { req\_ssl\_hello\_type 1 }  
tcp-request content capture req\_ssl\_sni len 10  
#log-format “capture0: %[capture.req.hdr(0)]”

use\_backend [something.com](http://something.com) if { req\_ssl\_sni -i [something.com](http://something.com) }  
…  
…  
default\_backend other-tls

backend other-tls  
mode tcp  
option ssl-hello-chk  
server google-site [yahoo.com:443](http://yahoo.com:443)

backend [something.com](http://something.com)  
mode tcp  
option ssl-hello-chk  
server something-site [something.com:443](http://something.com:443)  
…  
…  
##############################################################  
haproxy.log  
############  
Nov 1 09:00:01 localhost haproxy[15072]: 2.190.54.80:49554 [01/Nov/2020:08:58:01.618] tls other-tls/google-site 90003/-1/120003 0 cC 4008/3999/3749/3749/3 0/0  
Nov 1 09:00:01 localhost haproxy[15072]: 49.12.108.130:51765 [01/Nov/2020:08:58:01.668] tls other-tls/google-site 90004/-1/120004 0 sC 4008/3999/3748/3748/3 0/0  
Nov 1 09:00:01 localhost haproxy[15072]: 5.160.32.10:60732 [01/Nov/2020:08:58:01.753] tls other-tls/google-site 90003/-1/120003 0 cC 4008/3999/3749/3749/3 0/0  
Nov 1 09:00:01 localhost haproxy[15072]: 81.12.108.130:47867 [01/Nov/2020:08:58:01.756] tls other-tls/google-site 90002/-1/120001 0 cC 4008/3999/3749/3749/3 0/0  
Nov 1 09:00:01 localhost haproxy[15072]: 91.98.142.90:31132 [01/Nov/2020:09:00:01.773] http-in http-in/ -1/-1/4 148 LR 4010/10/0/0/0 0/0  
Nov 1 09:00:01 localhost haproxy[15072]: 5.160.51.44:63643 [01/Nov/2020:09:00:01.769] http-in http-in/ -1/-1/8 147 LR 4009/9/0/0/0 0/0  
Nov 1 09:00:01 localhost haproxy[15072]: 46.209.207.227:53677 [01/Nov/2020:08:58:01.882] tls other-tls/google-site 90003/-1/120002 0 cC 4007/3998/3748/3748/3 0/0  
Nov 1 09:00:01 localhost haproxy[15072]: 80.75.4.214:53361 [01/Nov/2020:08:58:01.882] tls other-tls/google-site 90003/-1/120002 0 sC 4006/3997/3747/3747/3 0/0  
Nov 1 09:00:01 localhost haproxy[15072]: 5.160.103.238:30621 [01/Nov/2020:09:00:01.902] http-in http-in/ -1/-1/1 147 LR 4009/9/0/0/0 0/0  
Nov 1 09:00:01 localhost haproxy[15072]: 92.242.207.41:51244 [01/Nov/2020:08:58:01.985] tls other-tls/google-site 90002/-1/120002 0 cC 4007/3999/3746/3746/3 0/0