How long does conntrack remember a connection?

Question

From this link it seems that conntrack remembers a connection for X seconds after it is closed.

Does anybody know how long that X is and if it is configurable?

Answer 1

A reason conntrack should remember a TCP connection after it has been closed is the same reason TCP should remember a connection after it has been closed: RFC 793 about TCP, especially the part about TIME-WAIT that should be by default (not very clearly written) 2mn. Of course for UDP, ICMP or some other protocols, this doesn't apply but the delay is here to remember a session. This is needed for stateful firewalling or NAT.

This said, once netfilter's conntrack is loaded, most settings are available there:

/proc/sys/net/netfilter/

(They might have been elsewere on very old kernels)

They can be displayed with for example:

# sysctl net.netfilter | grep timeout
net.netfilter.nf_conntrack_dccp_timeout_closereq = 64

[...]

net.netfilter.nf_conntrack_dccp_timeout_timewait = 240
net.netfilter.nf_conntrack_frag6_timeout = 60
net.netfilter.nf_conntrack_generic_timeout = 600
net.netfilter.nf_conntrack_gre_timeout = 30
net.netfilter.nf_conntrack_gre_timeout_stream = 180
net.netfilter.nf_conntrack_icmp_timeout = 30
net.netfilter.nf_conntrack_icmpv6_timeout = 30

[...]

net.netfilter.nf_conntrack_tcp_timeout_close = 10
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
net.netfilter.nf_conntrack_tcp_timeout_established = 432000
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_last_ack = 30
net.netfilter.nf_conntrack_tcp_timeout_max_retrans = 300
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 120
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300
net.netfilter.nf_conntrack_udp_timeout = 30
net.netfilter.nf_conntrack_udp_timeout_stream = 120

You can use the same command (or else use echo nnn > /proc/sys/...) to change a setting. For example to increase the TCP CLOSE state timeout to a higher delay, eg 60:

sysctl -w net.netfilter.nf_conntrack_tcp_timeout_close=60

Some features and default settings might depend on kernel options and version. For example, net.netfilter.nf_conntrack_udp_timeout_stream for "established" UDP traffic (considered as such when there was more than just one packet and its reply in the same flow) was decreased from 180 to 120 in recent kernels (>= 5.0 ?).

There are additional methods to configure dedicated timeout policies to apply to specific kinds of connection, rather than using the default global values: either with nfct along iptables or with nftables.