drop nf_conntrack_max, best to tweak timers when they come