I enabled NAT reflection in order to be able to access services from inside the LAN the same way as I would do it from outside. It works, only that the connection is dropped after exactly 20s if idle.

For a test (replicating the problem) you can do the following: Create a port redirection for SSH (or any other interactive TCP connection) to an internal SSH capable pc and enable reflection. From outside my LAN I can now ssh in without any problems no matter how long I stay idle. From inside the LAN the connection will be dropped after 20s idletime. Hence ONLY the reflected connection is affected.

Everything works if I generate traffic. However generating enough traffci is not a solution, since I need a jabber server (uses TCP 5222) inside the LAN (access via the WAN adress in order to not need to change if ouside the LAN) with the result that it keeps me logging in and out periodically.

This question was already asked, however there was no solution yet. I tried different settings for keeping the state for the original port redirection rule with no influence. Also changing the general optimisation policy does not change the above described behaviour.

Since I'm not (yet) so familiar with pf could someone point me towards where e.g. the timeouts for states are set? I see the /etc/pf.conf does not contain anything usefull (doesn't seem to be used at all).

Can sombody help? It's easy to replicate - just use putty and ssh and wait for 20s - the connection will drop..

Regards
Arno