[LinuxBender]

For completeness sake I would add that one must also set

  options nf_conntrack expect_hashsize=X hashsize=X

in /etc/modules.d/nf_conntrack.conf, X being 1/4 the size of conntrack_max