Recently, the connection-tracking table capacity on the loadbalancer/router was exceeded, leading to connections being dropped. This caused all kinds of mysterious problems in various parts of MB, e.g. via internal DNS queries failing. It was resolved by increasing conntrack_max to some higher arbitrary value. If/when the load reaches that higher limit, the problem will resurface.

As internal connections (from something inside MB to something inside MB, using local IPs) don't need NATting or firewalling, it would make sense to exclude those connections from tracking. This would mean that they don't count to the maximum number of connections, but more importantly that if the tracking table gets filled up again and connections are being dropped, those internal connections won't be affected.

To this end, all that is needed should be an entry like this:

iptables -t raw -I PREROUTING -s 10.10.0.0/16 -d 10.10.0.0/16 -j NOTRACK
iptables -t raw -I OUTPUT -s 10.10.0.0/16 -d 10.10.0.0/16 -j NOTRACK