Page MenuHomeVyOS Platform

Configuration of conntrackd PurgeTimeout at the vbash level
Closed, ResolvedPublicFEATURE REQUEST

Description

There is no documented or supported option in VyOS to tune internal conntrackd SYNC timers such as PurgeTimeout.
In VRRP-based stateful firewall scenarios, this means VRRP timing must be aligned with conntrackd behavior. Since conntrackd purges synchronized states after 60 seconds by default, the VRRP preempt-delay must be configured to ≥ 60 seconds to ensure that mastership is restored before the conntrack state is purged.

https://manpages.debian.org/testing/conntrackd/conntrackd.conf.5.en.html#SYNC

Sync {
	Mode FTFW {
		ResendQueueSize 131072
		PurgeTimeout 60
		ACKWindowSize 300
		DisableExternalCache no
	}

Details

Version
-
Is it a breaking change?
Perfectly compatible
Issue type
Feature (new functionality)