Comment 22 for bug 50093

I have the same problem in Debian 9 Stretch, net.netfilter.nf_conntrack_max and net.nf_conntrack_max does not apply after reboot. The pure solution is load module nf_conntrack before sysctl. You can do this with the command:
echo "nf_conntrack" >> /etc/modules