There is a syntax error if you'll try to use interface with the name containing underscore. The kernel works with such an interfaces, so there's no reason conntrackd shouldn't. I propose the following patch to fix this, works for me: --- read_config_lex.l.orig 2015-02-17 16:35:08.160554333 +0600 +++ read_config_lex.l 2015-02-17 16:35:24.053887237 +0600 @@ -47,7 +47,7 @@ ip6_part {hex_255}":"? ip6_form1 {ip6_part}{0,7}"::"{ip6_part}{0,7} ip6_form2 ({hex_255}":"){0,7}{hex_255} ip6 {ip6_form1}{ip6_cidr}?|{ip6_form2}{ip6_cidr}? -string [a-zA-Z][a-zA-Z0-9\.\-]* +string [a-zA-Z][a-zA-Z0-9_\.\-]* persistent [P|p][E|e][R|r][S|s][I|i][S|s][T|t][E|e][N|n][T|T] nack [N|n][A|a][C|c][K|k] alarm [A|a][L|l][A|a][R|r][M|m] -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html