Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Recommended value for tcp.established timer

    Scheduled Pinned Locked Moved Firewalling
    2 Posts 2 Posters 1.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      torino
      last edited by

      hi everyone !

      just some questions regarding firewall timers :

      1. what is the recommended value for tcp.established ?
            and what is the default-value in pfsense ?

      2. which tcp-flag(s) triggers the cleanup of the state ESTABLISHED:ESTABLISHED ?
            FIN ? RST ? or both ?

      many thanks for your support !

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        The default is the recommended value:

        : pfctl -st
        tcp.first                   120s
        tcp.opening                  30s
        tcp.established           86400s
        tcp.closing                 900s
        tcp.finwait                  45s
        tcp.closed                   90s
        tcp.tsdiff                   30s
        udp.first                    60s
        udp.single                   30s
        udp.multiple                 60s
        icmp.first                   20s
        icmp.error                   10s
        other.first                  60s
        other.single                 30s
        other.multiple               60s
        frag                         30s
        interval                     10s
        adaptive.start            27600 states
        adaptive.end              55200 states
        src.track                    60s
        

        You can change some of those timers by adjusting the firewall optimization mode under System > Advanced on the Firewall/NAT tab.

        IIRC both FIN and RST will tear down the connection, but that would be something you'd find in pf's documentation in OpenBSD.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.