# nf_conntrack: automatic helper assignment is deprecated

## FizzyWidget

 *Quote:*   

> nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.

 

Is the message I am seeing, and seeing as I know little to nothing about iptables, and google isn't being of much use, I was wondering if someone here might know what this means and how I can correct it

----------

## hydrapolic

I think this has something to do with state module being obsoleted by conntrack. 

conntrack:

  This module, when combined with connection tracking, allows access to the connection tracking state for this packet/connection.

state:

  The "state" module is an obsolete version of "conntrack".  "state" allows access to the connection tracking state for this packet.

Since CONFIG_NETFILTER_XT_MATCH_STATE is by default included in the kernel, this can trigger the warning you are seeing. If you use iptables, enable the conntrack module and rewrite your rules and/or remove the state module from iptables.

----------

## bxm

I'm also receiving the same message.

According to https://home.regit.org/netfilter-en/secure-use-of-helpers/, the helper is a security risk and can disabled in the /proc (> kernels 3.5) by executing :

echo 0 > /proc/sys/net/netfilter/nf_conntrack_helper

(or by appending to /etc/sysctl.conf: net.netfilter.nf_conntrack_helper = 0)

If nf_conntract is configured as a module, it can be loaded with the helper disabled:

modprobe nf_conntrack nf_conntrack_helper=0

Otherwise, if the module is built in the kernel, according to http://wiki.soekris.info/Gentoo_3.6.6, it can be disabled in grub by appending to the kernel options:

nf_conntrack.nf_conntrack_helper=0

----------

