UNIX for Dummies Questions & Answers

I am having an issue with iptables. My server is a RHEL6 64bit system.

In my application I have a large number of connected clients ~100k to a particular service. The application works fine when iptables is off, 100k clients are able to connect.

However, when I turn iptables on and add a "port forwarding" rule (NAT), the number of client connections is reduced to 64k. Keep in mind that it doesn't matter what the NAT rule is, it doesn't even have to be related to the port of my service.

Just having the firewall enabled (with at least one valid rule) causes the connections to drop to 64k. See the following sequence of commands (note that my service is on 1883, completely independent of the rule that is being added):

Code:

[foo@bar ~]$ sudo /etc/init.d/iptables status
Firewall is stopped.
[foo@bar ~]$ netstat -a --numeric-ports | grep ":1883" | wc -l 
80670
[foo@bar ~]$ sudo iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 8000 -j DNAT --to-destination :8001
[foo@bar ~]$ netstat -a --numeric-ports | grep ":1883" | wc -l 
65536
[foo@bar ~]$ sudo /etc/init.d/iptables stop
Flushing firewall rules:                                   [  OK  ]
Setting chains to policy ACCEPT: nat                       [  OK  ]
Unloading iptables modules:                                [  OK  ]
[foo@bar ~]$ netstat -a --numeric-ports | grep ":1883" | wc -l
75536

Is there a 64k connection limitation when iptables is enabled? Is there a way to increase this limit?

Any help would be greatly appreciated.

Josh

Can you post output of

Code:

ulimit -a

You should perhaps increase the value of max open files kernel parameter.
Also remember that those parameters can be setuped per user in limits.conf

Hope the clears things out
Regards
Peasant.