Connection time-out 900s - State violatie rule

[Mwason]

Hello,

I have a setup with multiple VLAN's.
They all can connect to the 'main'vlan by a floating rule.

Connections can be made but after 900s (since Firewall mode conservative active, in normal-mode much earlier!) the connections time-out and are blocked by 'Default deny/state violation rule'.
But are rebuild directly after accepted by the 'floating rule'.
(see attachment)

How can I prevent the connection to time-out and/or being blocked.

Looking forward at your suggestions...

Mwason

[Patrick M. Hausen]

What type of connections? Can you enable some sort of keepalive? E.g. in SSH?

[Mwason]

Via TCP they connect to a adress at port 30300.
There is only temporarely traffic but the connection should stay open...

[Patrick M. Hausen]

OPNsense will timeout any connection if there is no packet flow. Either implement keepalive on the application side or disable state tracking for these rules. IIRC that means you need a reverse rule for the packets to flow in both directions. Never needed this so far.