Is there a way to manually adjust state timeouts?

[Daniel-dev22]

Important notices

Our forum is located at https://forum.opnsense.org , please consider joining discussions there in stead of using GitHub for these matters.

Before you ask a new question, we ask you kindly to acknowledge the following:

• [X] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• [X] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

I see that on pfsense you can manually adjust specific state timeouts rather than changing all the values using the "firewall optimization" setting. However I don't see that setting on opnsense.

I think it probably makes sense if it's possible to adjust 3 state timeouts I should do that rather than changing the setting from "normal" to "conservative" which changes a lot of timeout settings.

https://forum.netgate.com/topic/116472/guide-manually-adjusting-state-timeouts-for-sensitive-services-e-g-voip

I'm having some issues with wifi calling and changing this would be helpful.

udp.first                   300s
udp.single                  150s
udp.multiple                900s

[nerlins]

Seriously, devs, you can't answer this person's question? I am having the same issue and have the exact same question.

[AdSchellevis]

The forum is better suitable for discussions, timeouts can't be set manually, the requested ones are the defaults for conservative optimization.

https://github.com/opnsense/core/blob/657265a410389394cddccf2cda8138fc82513af7/src/etc/inc/filter.inc#L389-L394

[nerlins]

Appreciate the quick response. Not the answer I think both of us were hoping for, but, at least there is an answer to the question.

[Daniel-dev22]

Appreciate the quick response. Not the answer I think both of us were hoping for, but, at least there is an answer to the question.

Yep not what I was looking for as I thought it could conserve CPU mostly by only adjusting timeouts for those 3 not adjusting all state timeouts by using conservative. Does it only adjust 3 timeouts when changing to conservative as that's what the code appears to be doing. Using conservative did fix the issue I just was hoping for a better way.

From pfsense conservative is this

tcp.first                  3600s
tcp.opening                 900s
tcp.established          432000s
tcp.closing                3600s
tcp.finwait                 600s
tcp.closed                  180s
tcp.tsdiff                   60s
udp.first                   300s
udp.single                  150s
udp.multiple                900s
icmp.first                   20s
icmp.error                   10s
other.first                  60s
other.single                 30s
other.multiple               60s
frag                         30s
interval                     10s
adaptive.start           120000 states
adaptive.end             240000 states
src.track                     0s

https://forum.netgate.com/topic/116472/guide-manually-adjusting-state-timeouts-for-sensitive-services-e-g-voip

[nerlins]

@AdSchellevis

The forum is better suitable for discussions, timeouts can't be set manually, the requested ones are the defaults for conservative optimization.

Can we think of this as a feature request, then?

[AdSchellevis]

From pfsense conservative is this

https://github.com/pfsense/pfsense/blob/062972b368fda9ab69b7bfd17274f8b2e9481401/src/etc/inc/filter.inc#L390-L392

^^ the same?

Can we think of this as a feature request, then?

Not really, no, you can open a feature request explaining which settings you would like to change for which reason, although currently I don't expect a lot of movement on it (given the small amount of use cases and the time investment needed).

[OPNsense-bot]

This issue has been automatically timed-out (after 180 days of inactivity).

For more information about the policies for this repository, please read https://github.com/opnsense/core/blob/master/CONTRIBUTING.md for further details.

If someone wants to step up and work on this issue, just let us know, so we can reopen the issue and assign an owner to it.