nfct (8)

nfct subsystem command [parameters]

nfct is the command line tool that allows you Netfilter's manipulate Connection Tracking System.

By the time this manpage has been written, the supported subsystem are timeout

timeout

The timeout subsystem allows you to define fine-grain timeout policies.

version

Displays the version information.

help

Displays the help message.

list

List the existing timeout policies.

add

Add new timeout policy.

delete

Delete timeout policy.

get

Get existing timeout policy.

nfct timeout add test-tcp inet tcp established 100 close 10 close_wait 10

This creates a timeout policy for tcp using 100 seconds for the ESTABLISHED state, 10 seconds for CLOSE state and 10 seconds for the CLOSE_WAIT state.

Then, you can attach the timeout policy with the iptables CT target:

iptables -I PREROUTING -t raw -p tcp -j CT --timeout test-tcp

iptables -I OUTPUT -t raw -p tcp -j CT --timeout test-tcp

You can test that the timeout policy with:

conntrack -E -p tcp

It should display:

[UPDATE] tcp 6 100 ESTABLISHED src=192.168.39.100 dst=57.126.1.20 sport=56463 dport=80 src=57.126.1.20 dst=192.168.39.100 sport=80 dport=56463 [ASSURED]

iptables(8),conntrack(8)

Please, report them to [email protected] or file a bug in Netfilter's bugzilla (https://bugzilla.netfilter.org).

Pablo Neira Ayuso wrote and maintains the nfct tool.

Man page written by Pablo Neira Ayuso <[email protected]>.