On Sun, Oct 27, 2013 at 12:14:48AM +0400, WGH wrote: > It seems that, when masquerading, conntrack silently drops idle > connection after nf_conntrack_tcp_timeout_established seconds. This's > pretty terrible, as application inside the network, if it never sends > anything, will never know that connection was dropped. If this is a problem for you, then increase nf_conntrack_tcp_timeout_established to an insanely high value. You do realize, of course, that the conntrack table has a finite number of entries. > RFC 5382 gives us a solution to this: > > A NAT can check if an endpoint for a session has crashed by sending a > > TCP keep-alive packet and receiving a TCP RST packet in response. > > However, it I couldn't find such feature in netfilter. It would be > pretty nice to have. Keepalives should be done in the application, not in the firewall. Phil -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
