- Use raw table and NOTRACK to skip conntrack for the (UDP) DNS queries and still benefit from conntrack for all other connections.
pom raw patch. Testing....ouch, bit on the edge for me to try to use that...
I'd love to be able to track nothing but smtp and optimize on that too so that I can give connlimit a go.