session timeout

[Tucker Bradford]

I'm experiencing a very annoying session timeout issue. Its most often 
noticed when sshing to a host behind the firewall from off site. It 
doesn't seem to happen when the connection is initiated from another 
internal network, but that could be due to some bi-directional pass rules.
In any case, a ssh connection from outside to the DMZ will timeout after 
5-10 minutes if idle.

In general my setup is like this:
8 Gb Intel NICs
- 2 external (builtin to mobo)
- 6 internal (dual port PCI-X cards)
Xeon processor and 2 GB RAM
OpenBSD 3.5
I've upped the nmbuffs on the kernel but that's about it for kernel mods.
I use several altq queues, nat (and rdr) route-to (to route certain ips 
through a dedicated Internet connection). I have 5 Internal Zones and a DMZ.
Most of the rules (I can't paste them here) are standard pass in ... 
keep state. The default rule (or rule 0) is block in all.

I use set opimization conservative and have just recently (since the 
problem was noticed) commented out my #set timeout { tcp.first 120, 
tcp.opening 120, tcp.established 28800 }.
i use set block-policy drop and
scrub in all
I also use an antispoof on lo0 and the following generic rules.
block in log quick on {$ext_if,$co1_if} proto tcp from any to any flags /S
block in log quick on {$ext_if,$co1_if} proto tcp from any to any flags 
/SFRA
block in log quick on {$ext_if,$co1_if} proto tcp from any to any flags 
/SFRAU
block in log quick on {$ext_if,$co1_if} proto tcp from any to any flags A/A
block in log quick on {$ext_if,$co1_if} proto tcp from any to any flags 
F/SFRA
block in log quick on {$ext_if,$co1_if} proto tcp from any to any flags 
U/SFRAU
block in log quick on {$ext_if,$co1_if} proto tcp from any to any flags 
SF/SF
block in log quick on {$ext_if,$co1_if} proto tcp from any to any flags 
SF/SFRA
block in log quick on {$ext_if,$co1_if} proto tcp from any to any flags 
SR/SR
block in log quick on {$ext_if,$co1_if} proto tcp from any to any flags 
FUP/FUP
block in log quick on {$ext_if,$co1_if} proto tcp from any to any flags 
FUP/SFRAUPEW
block in log quick on {$ext_if,$co1_if} proto tcp from any to any flags 
SFRAU/SFRAU
block in log quick on {$ext_if,$co1_if} proto tcp from any to any flags 
SFRAUP/SFRAUP
block in log quick on {$ext_if,$co1_if} from { <RFC1918> } to any
block out log quick on {$ext_if,$co1_if} from any to { <RFC1918> }

If I've missed any information, please let me know.
Thanks
-=Tucker