Is there a way to extend the timeout of elements in an nftables set?
Cyrus <[email protected]> Sat, 11 Oct 2025 12:09:22 +0200
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <CAEcyiz83o-NK263Efj5xfGPuVMUqur7TT-RofZ-WkJirMzB9oA@mail.gmail.com> |
With ipsets, the timeout of an element in a set gets extended each time you `ipset add` it. However, that doesn't happen with nftables (v1.1.1) sets - when you `nft add` an element, the timeout is set initially but never subsequently updated. Is there another way to do this that I'm missing? Regardless, I think it's worth noting that the existing behavior makes the `nftset` functionality of dnsmasq (where it automatically adds select resolved IPs to nftables sets) unusable for me compared to its equivalent `ipset` functionality. Thanks, Cyrus