Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Im using a private IP address and I want to keep alive SNAT entries in my Router (Gateway) for at least two hours (some windows apps of my network are using TCP keepalive set to 2 hours). Gateway is a Linux machine so i set nf_conntrack_tcp_timeout_established and nf_conntrack_generic_timeout values to 7400 seconds:

echo 7400 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established
echo 7400 > /proc/sys/net/netfilter/nf_conntrack_generic_timeout

Now, when a TCP connection is stablished shortly after i can see the new value:

# cat /proc/net/ip_conntrack
tcp      6 7399 ESTABLISHED src=192.168.0.192 dst=108.168.176.194
sport=51826 dport=5222 src=108.168.176.194 dst=95.63.14.117 sport=5222 
dport=51826 [ASSURED] use=1

But few seconds later i read the value again and now the value has returned to 60 seconds:

tcp      6 39 ESTABLISHED src=192.168.0.192 dst=108.168.176.194 
sport=51826 dport=5222 src=108.168.176.194 dst=95.63.14.117 sport=5222 
dport=51826 [ASSURED] use=1
share|improve this question

1 Answer 1

up vote 0 down vote accepted

The root cause was that the conntrack code in the kernel has been modified. As we are using a embedded linux distribution modified by our provider, the function that refresh the timeout for the SNAT entry was pointing to a special function used for provide one of the our provider new 'features'. I have fixed it and now it is working as expected.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.