PHP/MySQL/Apache tuning advice

Setup: I have a 2048 Linode and my site has been going along just fine for years. I upgraded from Debian 5 to Debian 7 Wheezy a month ago and it went fine. My site is mostly Apache, PHP, MySQL and is used mostly for phpBB, my own custom PHP-based site/blog, and serving files.

Problem: 3 times in the past 2 days the site stopped responding. CPU was idle, 1.8gb RAM free. Nothing interesting in the Apache, MySQL, or PHP logs. Restarting Apache and MySQL did not help. Rebooting fixed the problem for ~14 hours. syslog shows many, many of these:

localhost kernel: nf_conntrack: table full, dropping packet
localhost kernel: nf_conntrack: table full, dropping packet
localhost kernel: net_ratelimit: 8 callbacks suppressed
localhost kernel: nf_conntrack: table full, dropping packet

After some Google-fu, I found this informative page:

http://antmeetspenguin.blogspot.com/201 … outer.html">http://antmeetspenguin.blogspot.com/2011/01/high-performance-linux-router.html

Increasing nfconntrackmax allowed the site to respond again, but it is possible that whatever the problem was will just cause it to hit the max again. Still, I edited /etc/sysctl.conf and added:

net.netfilter.nf_conntrack_max = 32768
net.netfilter.nf_conntrack_tcp_timeout_established = 86400

I also found this in my sysctl.conf:

net.ipv4.netfilter.ip_conntrack_max = 32768
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_tw_reuse = 0
net.ipv4.tcp_orphan_retries = 1
net.ipv4.tcp_fin_timeout = 25
net.ipv4.tcp_max_orphans = 8192
net.ipv4.ip_local_port_range = 32768    61000

I'm guessing I put this in on some previous tuning a long time ago. I'm not sure if it is any good?

Linode support (those guys are great!) suggested leaving nfconntrackmax at the default (16384). One theory is something is up with my iptables, possibly "some odd circular iptables entries". I had used arno's firewall script and also installed fail2ban. Here's my iptables:

http://pastebin.com/raw.php?i=hhjd55PE

Very sorry for the formatting, that was copied out of the Lish console while the site was not responding. I don't really know anything about iptables, so I don't know if all that stuff is reasonable. Support suggested rebooting then doing this to reset the iptables:

service fail2ban stop
service arno-iptables-firewall stop
iptables -F 
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

So I did that and the site is running fine, though fully open. I can give it a few days to see if it stops responding. Assuming the site is ok with the iptables reset, what do I do for a permanent solution? I don't want to bother Linode support further, since it's clearly not a problem on their end, so I was hoping maybe someone here could help. :) I considered paying for Linode Managed, but I feel it would be a waste once my site is working reliably again.

Support mentioned, "If it is working properly, then my guess is that it's arno's script. There's some configuration you can do with it but honestly I haven't seen a case where the script performs better than fail2ban for typical use." Does this mean I should not have used both arno and fail2ban? Is fail2ban alone enough to protect me? All I did with arno is open 6 ports, so I'm not doing anything fancy. I installed fail2ban because I thought it might protect from HTTP basic auth and SSH brute force.