HN Reader

This sounds like bad advice, I don't know why ISC is pushing this... they would be better off trying to make DNS a TCP-only service to stop amplification attacks.

What a terrible website. It moves the viewport around and interferes with scrolling.

The fun part is that in some cases just listing the iptables rules with an iptables -L will cause it to load the conntrack module and the default max for this is very low for anything that is a DNS server or perform a lot of DNS lookups. That's why it's a good idea to always set the sysctl nf_conntrack_max value quite high even if you aren't using conntrack. The actual sysctl key for nf_conntrack is different depending on the version of the kernel, it's net.netfilter.nf_conntrack_max nowadays.

I’m concerned that this is output generated by an LLM (specifically chatgpt) as the writing style is eerily similar.

iptables conntrack is indeed a huge menace, but you should bypass conntrack entirely for local network connections as you don’t need it.

The only thing conntrack would give you for local requests is better logging, but YAGNI.