Re: IPfilter NAT and stalled TCP connexions

[Chuck Swiger <cswiger%mac.com@localhost>]

On Mar 26, 2010, at 7:01 AM, Emmanuel Dreyfus wrote:
> A[s] I understand, 1 minute is the default on NetBSD.
> 
> src/sys/dist/ipf/netinet/ip_nat.c:
>        fr_defnatipage = 120,           /* 60 seconds */


Unless NetBSD has "sysctl net.inet.ip.ttl" set to less than 60, that low of a 
timeout can be expected to be too short.  In fact, I'd suggest that setting NAT 
timeouts to a minimum of least 5 minutes due to:

% grep -i MAXTTL /usr/include/netinet/ip.h
#define MAXTTL          255             /* maximum time to live (seconds) */

...to avoid making assumptions about which platforms are involved.  And if you 
want TCP keepalives to work for things like idle SSH connections, one should 
consider adjusting the default timeout for NAT to something greater than 
"sysctl net.inet.tcp.keepidle".

Regards,
-- 
-Chuck