For the record, I'm using solaris. There isn't a way that ipnat can somehow detect that the underlying ip address has changed and clear out those entries sooner rather than later?
What's happening is this: I have a vonage.com telephone, it uses one of those cute little cisco ata186 boxes. That box constantly communicates with the server through a sort of ping. I think the box is actually keeping the nat state fresh in this case because it keeps sending packets even though it no longer receives replies. In essence, the box never gets a new nat and never starts working again without manual intervention i.e. I have to unplug the ata186, then ipnat -F, then replug in the ata186. Something which happens maybe 2-3 times a day. So, I'm wondering, is there no way we can speed the process up say to a few seconds? On Fri, Jul 11, 2003 at 02:31:18PM -0400, Jim Sandoz wrote: > > mike, > > that's normal. ipf is waiting for TCP FIN+ACK's to go past, > indicating that the state can be torn down. but in the case > you note below, since the connection is interrupted and ip's > changed, ipf will never see the FIN+ACK's. but don't worry, > ipf's internal timers will eventually kill off these states; > so you don't have to manually stand guard for this situation. > > if you look at the output of "ipfstat -t" you will note that > for these "abandoned" states, the ttl is decrementing towards > zero. when the ttl reaches zero the connection will in fact > be deleted from ipf's state table, preventing the table from > ending up full of "stale" entries. > > IIRC the default ipf timeout for TCP states is 7 days. you > don't mention what OS you are running but you can change this > timeout at compile or boot time. param is "tcpidletimeout". > > see the solaris /etc/system example in > http://www.phildev.net/ipf/IPFsolaris.html#10 > > in *bsd land you can do the same in sysctrl.conf or some such. > > i use tcpidletimeout = 24 hours without ill effects. but if > you have applications that sit idle for longer than that you > may want to adjust accordingly. > > regards, > jim > > > > Michael Grant wrote: > > >I use ipnat on my dynamic dialup ip connection. I basically leave the > >connection up all the time but from time to time my isp bumps me off > >and it dials right back up. > > > >I have noticed that my connections which are still up when the line > >bounced keep the old ip address in the nat table. I have to manually > >execute 'ipnat -F' to flush the entries. Is this a known problem? > > > >I'm using ipfilter 3.4.31. > > > >Michael Grant
