Firewall functions: IPTABLES
U
SER
G
UIDE
187
H
OW TO MODIFY THE TIMEOUT
To modify the timeout values associated to the various states of the
conntrack
sessions, are
available the following commands:
set conntrack udp timeout SECONDS
set conntrack udp timeout-stream SECONDS
set conntrack icmp timeout SECONDS
set conntrack tcp timeout established SECONDS
set conntrack tcp timeout close SECONDS
set conntrack tcp timeout close-wait SECONDS
set conntrack tcp timeout fin-wait SECONDS
set conntrack tcp timeout last-ack SECONDS
set conntrack tcp timeout time-wait SECONDS
set conntrack tcp timeout syn-sent SECONDS
set conntrack tcp timeout syn-recv SECONDS
In addition, the command
set conntrack sip-alg timeout SECONDS
defines the timeout associated to the SIP protocol sessions.
Finally, the command
set conntrack generic timeout SECONDS
defines the timeout associated to a data stream that belongs to a different protocol from UDP, ICMP
and TCP.
It is possible to disable the
connection tracking
of a predefined category of packets using the
command:
set conntrack-disable protocol PROT from ADDRESS to ADDRESS in-interface INTF
set conntrack-disable protocol PROT from ADDR source-port PORT to ADDR dest-port PORT in-interface INTF
and you can enabled it again by using:
set no-conntrack-disable protocol PROT from ADDRESS to ADDRESS in-interface INTF
set no-conntrack-disable protocol PROT from ADDR source-port PORT to ADDR dest-port PORT in-interface INTF
Displaying the active sessions
To display the active sessions you can use
