Hey guys. Is there any reason why this issue was changed from "possibly destroys the router" (which is true if using conntrack and rebooting the system) to => perfectly compatible?

@Fabse That field is for the compatibility implications of the change for the purpose of backport decisions and release notes. This is a bug, so a fix that restores correct behavior has no compatibility implications — it will just make the system work as it was always expected to work, so it will be safe to backport to any releases and will not require the user to take any action.

Different values originate from the Kernel source code depending on the actual available amount of system memory:

• min value 1024
• up to 4GB RAM 65536
• more then 4GB RAM 262144

if (!nf_conntrack_htable_size) {
        nf_conntrack_htable_size
                = (((nr_pages << PAGE_SHIFT) / 16384)
                   / sizeof(struct hlist_head));
        if (BITS_PER_LONG >= 64 &&
            nr_pages > (4 * (1024 * 1024 * 1024 / PAGE_SIZE)))
                nf_conntrack_htable_size = 262144;
        else if (nr_pages > (1024 * 1024 * 1024 / PAGE_SIZE))
                nf_conntrack_htable_size = 65536;

        if (nf_conntrack_htable_size < 1024)
                nf_conntrack_htable_size = 1024;
        /* Use a max. factor of one by default to keep the average
         * hash chain length at 2 entries.  Each entry has to be added
         * twice (once for original direction, once for reply).
         * When a table size is given we use the old value of 8 to
         * avoid implicit reduction of the max entries setting.
         */
        max_factor = 1;
}

In addition sysctl net.netfilter.nf_conntrack_buckets relates to /sys/module/nf_conntrack/parameters/hashsize

Which now all boils down to:

vyos@vyos:~$ cat /etc/modprobe.d/vyatta_nf_conntrack.conf
# Autogenerated by system_conntrack.py
options nf_conntrack hashsize=32768

which is rendered on system startup by https://github.com/vyos/vyos-1x/blob/a26d3fcd3cb76d6cd56081c3eed6aad56a91563a/src/init/vyos-router#L504

The reason this only appears on the second reboot is that the file is generated during first boot, but the values only apply to conntrack module load on the next reboot. Instead of defining the hashsize during module load - it can be set during runtime, too in /sys/module/nf_conntrack/parameters/hashsize.

So all works as expected - it`s a bug anyway.

https://github.com/vyos/vyos-1x/pull/4548