Hi, On Wed, Aug 31, 2016 at 05:47:32PM -0500, /dev/rob0 wrote: [...] > One more thing I can add: I believe it is possible to set different > conntrack timeouts based on protocol/port. Right, this is possible. > I don't know exactly how to do that, but it would make sense for > udp/53 to shorten that to something like 15 seconds; just a bit > beyond the nameservers' and resolver clients' timeout values. Setting custom timeout policies per address/protocol/port (any selector basically) is possible through -j CT --timeout name from the raw table. You have to create the timeout policy in first place through 'nfct' that comes in the conntrack-tools package. I think there are examples for this already, otherwise let me know and we can place it on the manpage. Now that nft has come, the plan is to unify all these command line tools such as conntrack and nfct into nft, so we end up using one single tool to interface with the netfilter subsystem in the future. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
