Limit the duration of a TCP connection with iptables?

Question

Is it possible to limit the maximum duration of a TCP connection with iptables?

With iptables I can limit the number of concurrent TCP connections per IP address, by using -m connlimit, and I can also limit the number of new connections per IP address per time interval, by using -m hashlimit. I'm currently using these rules to get the desired effect:

iptables -A INPUT -m tcp -p tcp --syn --dport 80 -m connlimit --connlimit-above 10 -j DROP
iptables -A INPUT -m tcp -p tcp --dport 80 -m state --state NEW -m hashlimit --hashlimit-above 15/min --hashlimit-burst 10 --hashlimit-mode srcip --hashlimit-name rtlimit -j DROP

However, is there a way to ensure that an "established" TCP connection will be closed after at most n seconds, in order to prevent "long-standing" connections? (regardless of still "active" or not)

I see people suggest:

iptables -A INPUT -p tcp --dport 80 -m state --state RELATED,ESTABLISHED -m limit --limit 1/minute -j DROP

However, I don't think this really does what I want. To my understanding, above rule would drop all packets that are belonging to an "established" connection and that are coming in at a rate "faster" than one packet per minute. It doesn't close a connection after 1 minute elapsed, or does it?

Is there any way to actually accomplish this with iptables?

Answer 1

UPDATE: There are two issues with my answer. 1) I did not address the part of the question that states 'regardless of still "active" or not'; and 2) The question is about closing the socket at the endpoint(s) of the connection and not about removing the connection from the tracking of iptables (netfilter). END UPDATE.

I see two options here:

Option 1 - global

Limit the idle timeout value of an established connection, for all connections by modifying the appropriate global netfilter variable.

Verify the current default value with:

cat /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established

Modify the default value (for example, to 600 seconds) with:

echo 600 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established

Option 2 - granular

Limit the idle timeout value of an established connection, for specific connections, by setting up a timeout policy and using that policy with the iptables command.

Setup a timeout policy with:

nfct add timeout nam1 inet tcp established 600

Apply that policy to iptables rules:

iptables -I PREROUTING -t raw -p tcp -j CT --timeout nam1
iptables -I OUTPUT -t raw -p tcp -j CT --timeout nam1

You might need to install the nfct tool, which on debian / ubuntu, comes from the package with the same name (nfct).

Additional info

man iptables-extensions shows some information on the CT target.

man nfct shows an example which is close to the information you requested. (You may have issues using the timeout policy with a name of more than four characters in length.)

The conntrack tool can be useful for following what's going on at different events of the connection (e.g. conntrack -E -p tcp).

Answer 2

I have now come up with a different "solution":

I wrote a small script that runs as a cronjob (once per minute) and that dumps all "established" connections into a file, by using the ss command and a bit of grep magic. I also keep the "old" file from the previous run. This way I can identify the connections that have "persisted" since the previous run, by concatenating the two files and then using sort plus uniq -d. These connections will then explicitly be closed, by using the ss --kill command. Seems to work for me.

(yes, this isn't an exact timeout, but probably "good enough" for my purpose)

---

List currently "established" connections:

ss -o state established

Get only "duplicate" lines:

cat file1.txt file2.txt | sort | uniq -d

Close connection, for example:

s --kill -o state established "( dst ${ip} and dport = ${port} )"