Hello all,
I have run into a wall on this one. I have need to change the default
settings on NAT entries through a Linux 2.4.32/iptables 1.2.11 based
firewall. Multiple searches have lead me to believe that tuning NAT
masquerade timeouts through iptables is not possible as it apparently
was through ipchains/ipfwadm.
This document (and other similar linux NAT/MASQ howtos):
http://howtos.linux.com/guides/nag2/x-087-2-masq.configuration.shtml
State: "The iptables implementation uses much longer default timers and
does not allow you to set them." Or something meaning the same thing.
An old discussion about this:
http://www.cs.washington.edu/homes/bdferris/afs_conntrack_nat/index.html
leads me to believe that perhaps if this is possible, it will be through
tuning the various core conntrack tcp/udp settings for the timeouts
(e.g. ip_conntrack_udp_timeout_stream
ip_conntrack_tcp_timeout_close_wait
ip_conntrack_udp_timeout
ip_conntrack_tcp_timeout_close
ip_conntrack_tcp_timeout_time_wait
ip_conntrack_tcp_timeout_syn_sent
ip_conntrack_icmp_timeout
ip_conntrack_tcp_timeout_syn_recv
ip_conntrack_generic_timeout
ip_conntrack_tcp_timeout_last_ack
ip_conntrack_tcp_timeout_fin_wait
ip_conntrack_tcp_timeout_established)
Any guidance on this issue would be greatly appreciated!
SJ
