A full conntrack table drops new connections

Under load, new connections time out and dmesg repeats:

nf_conntrack: table full, dropping packet

Check usage against the limit:

sysctl net.netfilter.nf_conntrack_count net.netfilter.nf_conntrack_max

Short-lived connections, especially lots of HTTP through NAT, consume entries quickly. Either raise nf_conntrack_max — and nf_conntrack_buckets with it, or hash chains lengthen and lookups slow down — or track less, using NOTRACK for pure forwarding.

Each entry costs roughly 300 bytes; scaling to a million needs a memory budget, not just a sysctl.