#!/bin/bash 

#CONNTRACK_MAX_VALUE=262144
CONNTRACK_MAX_VALUE=524288

#HASHSIZE_VALUE=32768
#HASHSIZE_VALUE=65536
HASHSIZE_VALUE=131072

CONNTRACK_COUNT=131072

CONNTRACK_GENERIC_TIMEOUT=60
conntrack_tcp_timeout_established=54000

function show_current_settings 
{
        CURRENT_ALLOWED_CONNECTIONS=`cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max`
        CURRENT_ALLOWED_CONNECTIONS_SYSCTL=`/sbin/sysctl -a|grep -i nf_conntrack_max`
        echo -e "\ncurrent allowed connections: $CURRENT_ALLOWED_CONNECTIONS"
        echo "current allowed connections in sysctl: $CURRENT_ALLOWED_CONNECTIONS_SYSCTL"

        CURRENT_OPENED_CONNECTIONS=`/sbin/sysctl net.netfilter.nf_conntrack_count`
        echo "current opened connections: $CURRENT_OPENED_CONNECTIONS"

        SHOW_LSMOD_CONNECTIONS=`/sbin/lsmod | egrep 'ip_tables|conntrack'`
        echo -e "SHOW_LSMOD_CONNECTIONS: $SHOW_LSMOD_CONNECTIONS \n"
}

function set_conntrack_max 
{
        /sbin/sysctl -w net.netfilter.nf_conntrack_max=$CONNTRACK_MAX_VALUE
        if [[ $(grep -cE "/proc/sys/net/netfilter/nf_conntrack_max" /etc/rc.d/rc.local) -ne 0 ]]; then
                logger -s "inside /proc/sys/net/netfilter/nf_conntrack_max already exists, we will sed it now"
                sed -i -e 's/echo .* > \/proc\/sys\/net\/netfilter\/nf_conntrack_max/echo '$CONNTRACK_MAX_VALUE' > \/proc\/sys\/net\/netfilter\/nf_conntrack_max/g' /etc/rc.d/rc.local
                else
                logger -s "inside else code for /proc/sys/net/netfilter/nf_conntrack_max which doesnt exist yet, we can safely echo >> it"
                echo "echo $CONNTRACK_MAX_VALUE > /proc/sys/net/netfilter/nf_conntrack_max" >> /etc/rc.d/rc.local
        fi
}

function set_hashsize 
{
        echo $HASHSIZE_VALUE > /sys/module/nf_conntrack/parameters/hashsize
        if [[ $(grep -cE "/sys/module/nf_conntrack/parameters/hashsize" /etc/rc.d/rc.local) -ne 0 ]]; then
                logger -s "inside /sys/module/nf_conntrack/parameters/hashsize already exists, we will sed it now"
                sed -i -e 's/echo .* > \/sys\/module\/nf_conntrack\/parameters\/hashsize/echo '$HASHSIZE_VALUE' > \/sys\/module\/nf_conntrack\/parameters\/hashsize/g' /etc/rc.d/rc.local
                else
                logger -s "inside else code for /sys/module/nf_conntrack/parameters/hashsize which doesnt exist yet, we can safely echo >> it"
                echo "echo $HASHSIZE_VALUE > /sys/module/nf_conntrack/parameters/hashsize" >> /etc/rc.d/rc.local
        fi
}

function set_conntrack_count 
{
        if [[ $(grep -cE "net.netfilter.nf_conntrack_count" /etc/sysctl.conf) -ne 0 ]]; then
                logger -s "inside net.netfilter.nf_conntrack_count already exists, we will sed it now"
                sed -i -e "s/net.netfilter.nf_conntrack_count = .*/net.netfilter.nf_conntrack_count = $CONNTRACK_COUNT/g" /etc/sysctl.conf
                else
                logger -s "inside else code for net.netfilter.nf_conntrack_count which doesnt exist yet, we can safely echo >> it"
                echo "net.netfilter.nf_conntrack_count = $CONNTRACK_COUNT" >> /etc/sysctl.conf
        fi
        #/sbin/sysctl -p
}

function conntrack_generic_timeout 
{ 
        if [[ $(grep -cE "net.ipv4.netfilter.ip_conntrack_generic_timeout" /etc/sysctl.conf) -ne 0 ]]; then
                logger -s "inside net.ipv4.netfilter.ip_conntrack_generic_timeout already exists, we will sed it now"
                sed -i -e "s/net.ipv4.netfilter.ip_conntrack_generic_timeout = .*/net.ipv4.netfilter.ip_conntrack_generic_timeout = $CONNTRACK_GENERIC_TIMEOUT/g" /etc/sysctl.conf
                else
                logger -s "inside else code for net.ipv4.netfilter.ip_conntrack_generic_timeout which doesnt exist yet, we can safely echo >> it"
                /sbin/sysctl -w net.ipv4.netfilter.ip_conntrack_generic_timeout = $CONNTRACK_GENERIC_TIMEOUT
        fi
}

function conntrack_tcp_timeout_established 
{
        if [[ $(grep -cE "net.ipv4.netfilter.ip_conntrack_tcp_timeout_established" /etc/sysctl.conf) -ne 0 ]]; then
                logger -s "inside net.ipv4.netfilter.ip_conntrack_tcp_timeout_established already exists, we will sed it now"
                sed -i -e "s/net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = .*/net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = $conntrack_tcp_timeout_established/g" /etc/sysctl.conf
                else
                logger -s "inside else code for net.ipv4.netfilter.ip_conntrack_tcp_timeout_established which doesnt exist yet, we can safely echo >> it"
                sysctl -w net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = $conntrack_tcp_timeout_established
        fi
}

function edit_bashrc
{
	echo "alias nfopen='/sbin/sysctl net.netfilter.nf_conntrack_count'
	alias nfmax='/sbin/sysctl -a|grep -i nf_conntrack_max'" >> ~/.bashrc
	. ~/.bashrc
}

show_current_settings
set_conntrack_max
set_hashsize
set_conntrack_count
conntrack_generic_timeout
conntrack_tcp_timeout_established
show_current_settings
edit_bashrc
