VyOS can be configured to track connections using the connection tracking subsystem. Connection tracking becomes operational once either stateful firewall or NAT is configured.
The connection tracking table contains one entry for each connection being tracked by the system.
The connection tracking expect table contains one entry for each expected connection related to an existing connection. These are generally used by “connection tracking helper” modules such as FTP. The default size of the expect table is 2048 entries.
Set the size of the hash table. The connection tracking hash table makes searching the connection tracking table faster. The hash table uses “buckets” to record entries in the connection tracking table.
Configure the connection tracking protocol helper modules. All modules are enable by default.
Define Conection Timeouts
VyOS supports setting timeouts for connections according to the connection type. You can set timeout values for generic connections, for ICMP connections, UDP connections, or for TCP connections in a number of different states.
Set the timeout in secounds for a protocol or state.
You can also define custom timeout values to apply to a specific subset of connections, based on a packet and flow selector. To do this, you need to create a rule defining the packet and flow selector.
set a destination and/or source address. Accepted input:
<x.x.x.x> IP address to match <x.x.x.x/x> Subnet to match <x.x.x.x>-<x.x.x.x> IP range to match !<x.x.x.x> Match everything except the specified address !<x.x.x.x/x> Match everything except the specified subnet !<x.x.x.x>-<x.x.x.x> Match everything except the specified range
Set a destination and/or source port. Accepted input:
<port name> Named port (any name in /etc/services, e.g., http) <1-65535> Numbered port <start>-<end> Numbered port range (e.g., 1001-1005)
Multiple destination ports can be specified as a comma-separated list. The whole list can also be “negated” using ‘!’. For example: !22,telnet,http,123,1001-1005`
Set the timeout in secounds for a protocol or state in a custom rule.
Set the maximum number of TCP half-open connections.
Policy to track previously established connections.
Set the number of TCP maximum retransmit attempts.
Customized ignore rules, based on a packet and flow selector.