From owner-freebsd-hackers Fri Mar 31 11:16:55 2000 Delivered-To: freebsd-hackers@freebsd.org Received: from spcem01sgl.sugar-land.omnes.net (spcem01sgl.sugar-land.omnes.net [163.188.48.51]) by hub.freebsd.org (Postfix) with ESMTP id B868A37BDC7 for ; Fri, 31 Mar 2000 11:16:47 -0800 (PST) (envelope-from rayk@sugar-land.spc.slb.com) Received: from rayk-sgl.sugar-land.spc.slb.com ([163.188.49.242]) by spcem01sgl.sugar-land.omnes.net (Post.Office MTA v3.5.3 release 223 ID# 0-58147U25000L25000S0V35) with ESMTP id net for ; Fri, 31 Mar 2000 13:10:18 -0600 Message-Id: <4.3.1.2.20000331123429.00ad6890@163.188.48.51> X-Sender: rayk@163.188.48.51 X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Fri, 31 Mar 2000 13:16:36 -0600 To: freebsd-hackers@FreeBSD.ORG From: Keith Ray Subject: ssh timeouts & ipfw dyn_ack_lifetime Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG I am having a problem with ssh sessions from my windows box to my freebsd box timing out after a number of idle minutes. SecureCRT still shows a valid connection until I try to type some keys, and then after a minute it says "connecton reset". I believe I have isolated the problem to the ipfw firewall timing out the connection. I am currently using dynamic rules such as: add check-state add reset tcp from any to {myip} established add reset tcp from {myip} to any established add allow tcp from any to {myip} ssh setup keep-state The sysctl variable net.inet.ip.fw.dyn_ack_lifetime seems to be responsible for this, but I only want to set a very large lifetime for things like ssh. Is it possible to disable automatic timeouts or make long timeouts on a rule-by-rule basis? Or perhaps a way to keep the dynamic rule alive as long as the connection is alive? To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message