On Wed, Dec 12, 2012 at 12:53:02PM +0100, Herbert Poetzl wrote: > > How can I change net.ipv4.ip_local_port_range only for specific guest? > > maybe by utilizing a network namespace, but no guarantees there I know that at least tcp_keepalive_time is global. harry:/proc/sys/net/ipv4# echo 32767 61000 > ip_local_port_range harry:/proc/sys/net/ipv4# cat ip_local_port_range 32767 61000 harry:/proc/sys/net/ipv4# vspace -e v1012 --net cat ip_local_port_range 32767 61000 so local-port-range is global too. Iptables is per network namespace though... (The modules are global, so keep an eye on your conntrack per network namespace, it might be way too low). Anyway: to answer the question in another way: You should always expand the ip_local_port_range, since the local_port_range is actually shared. You will not have enough local ports if you are going to connect to a vserver on the same hosts. It seems that if the traffic is host local, linux will prevent using same source ports, even if the local source address is different. (In tcp the sourceip:sourceport destinationip:destinationport should be unique. It seems like if you do local traffic, it's more like sourceport destinationport that must be unique, at least for time_wait). This matters if you have haproxy and varnish on the same host connecting to eachother. Of course when having seperate network namespaces (which means seperate ip stacks) it doesn't matter.