Is there any thing on UI where i can set idle time out of tcp connection.And what is default value of astaro gateway 8.0 for idle tcp connection timeout.
hi Ulrich
Hi
Ulrich i have following observations:
1)output of conntrack-L for 3 times
6621 Established src client dst sport dport packets=856 bytes=39443 src= dst= sport dport packets=855 bytes=38331[Assured]
mark=0 use=0
b)6602 Established src client dst sport dport packets=859 bytes=39443 src= dst= sport dport packets=858 bytes=38443[Assured]
mark=0 use=0
c)6877 Established src client dst sport dport packets=860 bytes=39443 src= dst= sport dport packets=859 bytes=38487[Assured]
mark=0 use=0
2)nf_conntrack_tcp_be_liberal=0
3)There is persistent connection maintained ie no coonection break
firewall having above mentioned settings
is there any other configuration required to make ip_conntrack_tcp_timeout_established" =900 sec effective
no data is send from server to client or client to server.
The first 6 on each conntrack line is separated from the following three numbers? Should be, because you have a maximum of 900 seconds for established TCP seconds.
If yes and the three lines are in chronological order, then there is traffic going over you TCP connection. Note: Even if your application is not sending any data, there is a technology called TCP keepalive, which keeps the connection alive.
hi
when i configured ip_conntrack_tcp_timeout_established=5 min or 30 sec
then connections are broken by firewall but if i do it 15 min.Then though i m not sending any data from client or from server still there is some communication happenig(visible in wireshark) between client and server after every 5 min and connection is not broken by firewall.
Is there need to change any other vale if i want that tcp idle connection get dropped by firewall
No, there is no other way to break connections using TCP keepalive with a shorted interval than ip_conntrack_tcp_timeout_established. You can decrease ip_conntrack_tcp_timeout_established to 5 min, but be aware that clients can decrease their TCP keepalive interval too.
hi
as per my application (client server) if connection is broken by third party
then client immediately tries to connect to server.But the behavier that i am observing is that when i have configured ip_conntrack_tcp_timeout_established" =180 sec.and rest of values are default.
Still connection is dropped by every 10 min.what i wanted to ask that if there is any other value is to configure from tcp timeouts values.so that firewall can drop connection after 180 sec (if connection remain idle for 180 sec)
thanks DA Merlin. further I want to ask that .if connection remain idle then after tcp timeout when firewall drop the connection then till how much time it keep dropping the packets.if client tries to reconnect then would it able to reconnect to server or firewall will stop connection
This depends on the clients TCP implementation. But after the client detects a broken connection, it may re-establish the TCP connection immediately. There is now way for the firewall to block this.
So you either have to allow connections or block them. There is no way to allow one connection and block all further connections...